Hello everyone and welcome back to part 26 of my land.
Ethical Hacking course in this part we're going to look at more information gathering there's more tools
that we can look up to gather information about a Web site.
So the next tool.
And this is specifically for the technology used on the Web sites and used to create the Web sites.
So when we find that out we can also look our vulnerabilities within the application or type of programming
the views to create the Web site.
So if you take that craft site report and you it's the first one so the IRS should like a look like
this.
It will also be in the description like always give it a second to load and all you need to do is look
open to the euro.
So it already has like a default one for this Web site.
You can type any sort of web site you URL here and get information for someone to type on my Web site
which is code on command dot com so I'm just going to click enter and there's a description of my web
site.
The keywords and then net cruft risk rating.
So this isn't really important because you can just find this out anyway by going on the Web sites and
view in the source bow down here is quite useful.
So the IP address of the Web site but you can just ping it anyway.
Then we've got the operating system the server rooms on the Web site runs on and there's the web server
now fish go down a little bit more as you can see here.
These are Web trackers.
So this is things like Google Analytics Google advertising add mob et cetera.
So as you can see my web site has four from Google which is admirable.
I am Google Ad Sense Tag Manager et cetera.
So as you can see loads of these will use that sorts of things so here is suggestions with other popular
sites that use it.
So this BBC Ducati you can use the Google Tag Manager.
Major geeks dot uses ad mob etc. Let me go down and here is the site technology so this is the most
useful information that you can find about Web site.
So what you want to look up is the service side.
So this right here now it's got SSL enabled.
So when you go to the Web site in fact it's on this one as well so as you can see here it says toolbar
dot net craft e-commerce to secure connections so basically any information you pass across to this
Web site is secure and encrypted.
If I go to my Web site
Clemenza let it load a second.
As you can see it's also the same.
So that's why SSL is.
I'll discuss more about SSL and encryption et cetera.
So just close my Web site now.
And then there's p p enabled said the server does support BHP and it's also enabled.
So that means that it's using BHP and it's in fact it is created with BHP and BHP is just a service
added programming language.
Basically Page who will interact your database your Web site's database with your Web site.
So when you enter information like you log in or sign or pin factory register to my Web site that will
send your information so it will create your username password pass on to the database and then your
password will be encrypted your user name will be saved in the database and then that's for future use
when you want to log back in it or just check the details that you enter with the details in the database.
So BHP can be like a vulnerability or it can be manipulated then it's used in JavaScript.
Now this isn't very useful because where we want to attack the website server or the Web site itself
with vulnerabilities but the client side JavaScript only works on your actual computer if that makes
sense.
So when you visit the servers Web site on the Web site displays client side stuff will only affect you
so javascript affects the behavior of the Web sites without rooms on your end not the server side.
If we go down a little bit more does the advertising network so-called Google Ad Sense again we already
knew that then this is probably the most important bit of information that we can find is that it's
a page application so this is what is the Web site has been made with and what it runs on.
So as you can see it's a page P application.
Now if they created this Web site in this case it's my Web site so if I created with this with I think
WordPress then it would say WordPress application and then you can search for wordpress vulnerabilities
but in this case it's a page P HP application.
And as you can see the technology that is used is a coding native framework.
So this if a copy and Googling it's basically all just search google for it's essentially just a page
P framework as you can see here but you can also search for like vulnerabilities and they go to some
security vulnerabilities with code igniter so you get the idea with this.
So you can search for the application it is made with the framework it's made with and then just search
for vulnerabilities and then that Web site might have that vulnerability still on their Web site.
Then there's other certain things like the doc type what type of hatred email it uses in the CSF that
uses so it's external CSR assets not internal.
Every website will have external CSX.
Because the advantages of that outweigh the disadvantages.
But we're not here to talk about CSX.
So this is just an extra information gathering tool that you can use so there's one more left up to
this but I'll leave this video here.
So you already know now two methods of finding information about a server.
Once you've got all the information what you're gonna do is we're gonna try to we're going to look at
certain vulnerabilities basic vulnerabilities such as ask you all injection.
Now that is pretty outdated at the moment but there's still some Web sites that still have it.
Then we're gonna look at and try to think what we'll do what we'll do is we'll look at them sort of
vulnerabilities to lay all them or look at it in more advanced ones and then we'll start to D face applied
shells.
And many of the things that you can do with web sites or to try to Penthouse Web sites.
So I'll leave this video here for now.
If it did help please if like comments if you stick with anything I'll be happy to help you describe
for future content.
And I will see you all in the next video.