Welcome to section 2 of the ghost fast and
hybrid spy during your web application.
Let's start with the first video of section 2 about spidering
process.
This video, what we are going to lunch. So we are going to
learn about spy training process, and I'm going
to explain to you. So here we
are learning about spotting process or we
can also call it crawling in. This section,
will only learn about the spending process provided by
brexit.
But first of all, let's learn the basics.
so,
Let's talk about calling, gisselle Lucas fighting. So
you can see here that crawl. Fees office
can involves navigating around the application
following links submitting forms and logging in
the necessary. Why we
need crawling example, if you have a web application, you
need to test it. Supposed to fall. We need to perform Spalding or
crawling process so that we can get more information about application
flight. Various kinds of links, available in the website, the
rarest kind of you are else available and we
can also test forms inside
the web application process.
Did you get the girl out the content of the application and
navigational that's within it. The seemingly simple
task presenter variety of challenges that Bob's
crawler is able to me to create an accurate map
of a girl. Crawling is like, you are creating a
map of application that what is inside this application. Right? So
what are the various links? Available forms. Login
pages, excetra. So you
we get the overall map in Brookfield after the spending
process? So that's why we need to learn
more about web application which we are testing. If you
are using burp, Suite Community Edition, which is
available in Kali Linux crawling was
pairing process for spelling. Option is not available in
Community Edition. So what does a level Linda
pitbull, images professional?
It was available in both feet,
but now, in current version 8
is not available. So I drink process
and scanning process is not available and current version
of burp Suite.
You can see here the for brexit, professional users. If your machine
appears to support inbox, can will automatically lose them. Browser
for all navigation. All right, let's talk
about how you can
see it is written by default burps crawler, or
spider navigate surround of Target application. Using an
embittered browser. Clicking links, submitting input,
whenever possible. It constructs the map of the application. So
the basic ideas
Boats, which uses an inverted browser. First. It
was it's the website or the target, check
all the links available in the website. It submits
the inputs example, if there's a form of
level inside the web application, so I can
ask you the login, ID and password so that it can submit application
in the
form of directed graph representing, the different locations
in the application and links between these look like you can
see in the diagram are so you can see here.
These are the various pictures of living in the
website. Like blog feedback about the slogan
right now. Login page.
So you need to submit form. So it
will give you a username and
password so that they can log in inside the website so
that he will provide username and password to login and it will also
check the internal pages.
So you can see the crawler makes knows.
I'm sure it's about the URL structure used by the application locations
are identified based on their contents. Not that you
were that was used to reach them. So it
enables the crawler to reliably handle modern applications such as
csrf token second, right?
She can see here. The approach also allows the crawler to
handle applications that use the same letter to reach different conclusions, based on
the state of application of users interaction with it.
so, the basic idea here is
It checks each and every page on the website example, if
it cannot reach a particular page, so it
will ask you or it will ask the user to provide
input, login inside
that be and check internal page, crawler, checks.
All the links in the website Creator grass
for you after completion of
this process.
But also end of the sessions, right?
Addicting changes in application state.
Copy of the city application, login, you need
to provide login. So let's call it can get inside
the web application. You can see here that so start
the log in right Summit, use
a screenshot.
Submitted my credentials, tiny chicks dying tunnel
Bridges like my account, and then it can order, check internal
basalite change password my messages
except truck. That's how it works.
Calling volatile content.
So, you know that many more than love application. Also contained various
kind of volatile content.
And crawling with them. Browser. Somebody for the
machine, a PS2 supported but will use its Android, browser
to navigation of your Target website or application. So
you just need to provide and then
you need to start calling process and then it will check all the links
available in the website and provide you a proper property.
And
So, this is all about fighting or
crawling process.
And the next video we are going to perform spiting process,
and burp, Suite Community Edition.