Hello everyone and welcome back to Part 25 of my lane ethical hacking course.
So every video of you've watched or until this point now has been the client side section.
What I mean by that is this course is splitting up into five different sections.
So the first lot of videos you have watched.
Up until this point.
So every single video in this course you've watched has been Klein's side.
And what I mean by that is just the general hacking as in into a computer a standalone computer that
someone owns that is more client side because the someone using the computer i.e. a client that involves
like the social engineer and I expect so all of videos you watch like that that I briefly touched on
DNS spoofing or device for the network section.
However there's the create the payload execute the payload using a fake access point and create a fake
access point a making or persuading someone to connect to it.
Also creating like beef pork injecting gear with man and middle f all of that stuff together.
Now it's up to you.
And it's important to when learning through this course is make up your own like methods of putting
everything together.
So if you've watched my live hacking demonstration I essentially put multiple things together to create
one whole hacking method.
So if you watch that video in that video I use the man in the middle f attack to inject beef once beef
so open a create a payload use beef to create a fake notification bar.
They download the payload directly to the local server and basically then they hacked.
So all of that's been discussed now so that's Klein's side over with.
Hopefully it was useful for you.
And if you're only after that sorts of stuff then you can leave the course here now and you don't have
to continue watching.
But now we're onto the Web site penetration testing so this is the Web site attacks and what I've done
is I've decided to split the course up into client side Web site attacks or Web site pan testing.
Then it's going to be the server pan testing or saver attacks.
Then it's going to be a network.
Now if briefly touched on network within clients I'd like the fake access point but I will revisit it
in more detail.
So the network attacks or pan testing will involve cracking WPA keys to be keys cetera.
And then the last section is just going to be a miscellaneous section so there's going to be pivoting
now to make an old man in midlife or metaphor to wait outside the local network so you can use it on
one for example.
So that stuff's really interesting.
But right now we're onto the Web site pen testing.
So essentially what is a Web site.
Our Web site is just a collection of pages that access through the Internet or through web browser access
via the Internet.
So when you visit Facebook you're visiting a Web site a Web page.
That is one page of a collection of many.
Now if Facebook had a an about page then you click on the about page and I'll send you to that.
So they're all connected together which makes up the whole Web site.
Web sites will have web applications on them.
So this is the Web site slash web application pen testing because Web sites will have these sorts of
things on them.
So think of like a search function that processes information that's a web application on a Web site.
They think of a logging system that's a web application on a Web site.
So the person's Web site might be secure enough but they might be one small vulnerability within a web
application on one of their web pages that allows you to gain access to their whole Web site.
So this is like very important very critical for businesses to understand web applications may also
be installed on computers as applications.
So if you think of steam now steam is just an application that you can buy games from the Steam store
and install them and then directly play them.
So it's very popular for P.C. gamers.
It's like the one with all the games on it.
Everyone uses it to play games.
Now that's not a Web site.
It's a web application and it's installed so you can have a web application on a Web site and you can
also have a web application that's installed on your computer.
The reason that's a web application is because it talks to the server of the steam web and the Web sites
the saver of the Web site and it communicates with each of those to the client and the web application
or the Web site will talk to the client on the computer.
And that's why it's a web applications that might have a vulnerability within it because it's installed
on your computer.
And then you might be able to get access through that and then get to the actual Web site.
Now I've already discussed this.
So a computer that uses an operating system that will be for the safer side attacks on the client side
attacks we've already discussed and I'm pretty sure I've discussed enough about the client side attacks
to give you a better understanding of ethical hacking.
So in this video we're just going to start with basic information gathering and we're going to start
to build on it.
So because we start with Web sites we're just going to start at the very basic level.
So if you go to college and open up your colleague Linux machine.
So I'm just going to log in here and then I'll make you expand the screen so I'm on a Web site here
called Who is.
So if you go to the link in the description and just click on it it will send you to this Web site.
So for this part we're just going to do some basic information gathering.
So the set methods what you do with hacking in and testing and pen testing is you start information
gathering.
Then you build up to the next one then you go to the next stage.
The next stage and the next one.
So these will all be discussed.
But right now what are the things like the information gathering to understand what we're targeting
better.
This principle applies for client side because you need to like sniff out networks.
If our computers understand the person you're talking to.
So you could fish for information which is like social engineering.
So all of these attacks and pen testing will start with this.
So once you're on who is little hope you type in the domain.
Now what can be absolute.
Any domain you want.
I'm going to type in my web site so just make this a little bit larger so you can see it.
So if I type code on come on dot com.
This is my Web site and click and it's going to who is little corp.
So it's going to get the DNS server etc..
So as you can see this is how old my Web site is.
This is when it was created.
This is when it's going to expire and when it was updated so as you can see there is the host.
So it's a wonder.
Come on that's who I do pitches my Web site hosting from.
So there's the DNS servers the name servers we go down here you can see an IP address you can see the
IP location and there's one dot com again.
Then the IP history so we can get the IP history so for changes for unique IP addresses over seven years
save a type of patchy and so this is like very basic information gathering.
You can see what it's registered
right here is will is with the registrar will appear.
So I have domain privacy so as you can see here it says in the tech Contact section it just says domain
privacy.
High I've domain privacy through one dot com.
So I essentially pay a little bit more and it protects my information.
Now some Web sites might not have this and it's really really important to have it I reckon.
Now if you're a small local business then it doesn't really matter.
Bill for ones that don't want their private information leaked essentially it's important because my
information would appear right here.
My address my phone number and my name and that's like the most private information I can have.
Really.
Because then you'll know exactly where I live on my exact name plus my phone number.
So that's not really a good idea and so the tech contact I have domain privacy both types of websites
in that doesn't have it all the owners information.
Whoever bought the web address will appear here.
So if you find a Web site that does have that then you can do that in fact that starts to get into docking
which I'm not going to discuss in this course because it's I don't agree with it.
I don't like it.
So you can find information on that elsewhere.
Just type indexing and find out information about that but this is how you start doing stuff like that.
So dates over a discourse that you can see the dates et cetera but the most important part here is the
IP address so we've got an IP address of the actual server so you could take this down if you wanted
to.
And if we just open the terminal so Terminator and what we'll do is we'll just type and ping if you
type ping.
And then the address.
Now you don't type the IP addressing you type the web address so type w w w draw.
Now you can type in any Web site you want here or type in mine.
So coding command dot com click on site.
I'll stop pinging.
So wait a few seconds it's just pinging to get response from the server so they would go we can see
the Web site's live may get a response.
But if you noticed here we get an IP address.
Now let's see if it matches the IP address on who is as you can see it those forty six thirty to 1 5
to 15.
Ninety five.
There we go.
So that's how to get the IP address of the server of the Web site because the Web sites use DNS is an
a DNS basically will fetch the IP address that's attached to the DNS and then that translates an IP
address into a web address.
So essentially when you type in facebook dot com are typing in the IP address for Facebook dot com the
saver on Facebook dot com.
It's just to make translation easier between the IP address of the Web site and the actual name of the
Web site because people don't want to be remember and IP addresses to go to Facebook Google etc..
Just be really annoying because you have to remember thousands of IP addresses just to go to Web sites.
But that's essentially the first video of the Web site pen testing.
This is just a basic information gathering later on in this section we will get onto the more interesting
parts such as astral injection defacing Web sites or collating shells.
Well that's it for this video so if it did help please leave like comments if you stuck with anything.
I'll be happy to help subscribe for future content and I will see you all in the next video.