Hello everyone and welcome back to part 29 of my Lin ethical hacking course.
In this poll we're going to look at our first Web site penetration test.
So essentially companies will pay people to penetrations has their Web site with the web applications
on them.
The first one we're going to look at is a simple upload vulnerability within a page piece.
So when Web sites are created web applications typically think of like a job Web site or a forum where
you upload an avatar or on the job Web site you could upload your CB or additional files maybe.
And the vulnerability comes into it when they allow to allow you to upload same files such as page files
because we are going to generate a page be backdoor that will allow us to connect to the backdoor which
is basically hidden on the Web site's directory.
So it's hidden amongst their files.
We can connect to it.
So that's why it's a backdoor because we can access the Web site through the backdoor thing.
Think of it like that.
And once we've got that connection set up we can literally do anything to that person's web so we can
edit the files we can deface the Web site.
What I mean by that is we can edit the index or PDP can edit the text on the web so we can connect to
the database we can.
Basically we have full control over the Web site.
Think of it like a remote admin panel.
So an admin panel the admin logs in to the administrator of the Web site logs in on connected same files
accounts et cetera.
It's similar to that except it's our payload it's a backdoor so open your mitts disposable machines
so we can connect to it.
Just type I have config and got the IP address of the server and open calendar knocks and visit it in
a year or else you just typed in you are elbow.
So for me it's one or two that will be different for you just click on that should be familiar.
This from the previous video instead of going to Matilda they were going to go to DV w a click on the
and log in.
So the username is admin and the password is just password that's already saved means you just click
log in.
Once you've done that just save the password so you don't have to keep type no in and you'll be presented
with this.
So deed v W.A. isn't a web application that is vulnerable but its main goals are to be a need for security
professionals to test their skills and tools in the legal environment.
It will also help web developers better understand the processes of security in securing web applications
and a teacher's slash students to teach in them web application security in a classroom environment.
So hopefully that clears in open what this actually is this thing of this is just a Web site.
So this could be anyone's Web site say this is a small business business and this is their web that
they don't have much money and they don't have much knowledge on cyber security.
So essentially they would probably implore you to look at their Web site and penetration test their
web applications to find abilities like you were saying before about like a job Web site they might
pay you to find vulnerabilities when uploading a file or using brute force.
So all these down here are vulnerabilities typical vulnerabilities within a web site.
So the amount of small businesses that I've seen have these type of vulnerabilities is quite a lot to
be honest and you can earn good money from penetration testing.
So what I want what I want to get into is cybersecurity ball penetration testing is my favorite thing
because I like the challenge of it.
So this part is really interesting for people who are interested in that also think if you're not then
there's not much point watching these videos.
So let's get started the first one we're going to use is the upload.
So we're gonna find the vulnerability with the net and exploit it and upload our payload and edit some
files.
So imagine this person's web site is a small job Web sites and you will play an image of yourself.
So you just click on Browse.
This is like annual the script appear to be script.
You just click on Browse you find your image and then upload it.
But the one thing you need to do and make sure you need to do first before you upload your actual file
is go to the DMV to be a security and change you from high to low because we'll start on low.
And once we get through out this section of the course because we're only on Web site penetration testing
we're done client side we're on Web site then we'll go and server and then we'll do X like miscellaneous
stuff but change it to low.
And then once we get further on in the course we'll change the security up.
Essentially it just makes it more difficult to actually exploit once it's on high medium and low you
get the idea the security on this Web site is now low.
So let's go back to upload and let's upload an image.
So let's say this web so we can upload our image.
I've got a random image from an old video so I'll just upload that they are.
That's me with a horse mask.
They haven't watched us from the hacking demo.
You click on open Megaupload.
So there we go.
Hackable uploads pic to Jack J peg has successfully uploaded.
And as you can see here we've got a directory of what is so bloated so we can actually visit this image
on the Web site's directory because a Web site essentially will have the index to P P then it will have
a sub directory of uploads.
In this case it's got hackable and then uploads and that's where the uploads go so to find this if you
closest here there's two dots.
Sue full stops.
A forward slash to dots forward slash stamp means go back a directory go back a directory.
So it's basically saying he had to go back to directories and that's because we're in the upload and
we're in the vulnerabilities.
So it's saying go back out of upload and back out of vulnerabilities then you can type hackable then
you can go to uploads so you click on that and you can see here these are images that we've just uploaded.
So most popular Web sites that allow images to be uploaded will have a directory such as uploads with
all the images go or uploads from users.
So we click on that.
That is the image we just uploaded.
So now we know the images is actually stored on their server but lets say we generate a PSP file on
me or upload it.
This is where the vulnerability comes into it because it's not checking for file extensions et cetera.
That's generate a page P barcode backdoor shell.
So I'm going to open terminal instead or Terminator so you can see it better because you can actually
zoom in and to create this all you need to do is type w e the e l y says this is weekly it's come spring
storm Cally Linux and then all you need to do is type generate then type a password.
So this is a password for the shell.
Like I said before think of it like an admin panel an admin panel will have a log in for the admin such
as your username password.
This one only has a password.
So this is for quite ironically this is for security purposes even aware uploading a payload to their
server.
We don't want them to be able to access it.
So we have a password so let's just have one two three four five that we need to store the shell somewhere.
So this is we'll just call it shell drop HP and it's going to be stored inside the root directory click
it into and there we go it's generated.
So if I type alas she can cease.
She'll be here somewhere.
There we go.
Shell dot Page Pate.
So this is just on the redirect.
So if you go to places home and here it is.
So this is our payload.
So we're gonna upload this payload now and let's see what happens so we'll offload it open and click
upload.
There we go.
Hackable or upload.
Sheldon page as imploded successfully.
So now we know our payload is on their server so our virus essentially has found its way into the server
and now it's just sitting there waiting for us to can actually.
And all you need to do to connect to it is type w e.
So we play again.
Then you need to take the you or al of where the payload is stored.
Think of this like as a virus that's entered somewhere and it's just staying quiet until you connect
to it and then it can take over.
So obviously in this case this person's website is vulnerable and it's really quite bad to be honest
if it has this level of security so if you find a website that allows you to just open a page files
that is really bad you can email them and say we're fine.
I found a vulnerability with a new Web site.
They might give you a cash reward.
So this benefits of being a good ethical hacker not just a malicious one.
So I'm going to take the IP address of the server.
Now if this was a genuine Web site you just type you out al of the Web site and then where the page
file has been stored so forward slash it's in DV W.A. DV W.A. and then let me just make sure I got it
right.
So it's a hackable.
Remember you go out of these two directories.
So it's just hackable and then uploads.
So if you think of a normal Web site.
So a typical Web site will not say where it's been or played it but if you think of the previous video
where you can use a script to find all the directories and sensitive files and sub directories then
you can put these two things together and then find it that way.
So it's very clever.
What you can do with all this stuff if you use your head but upload and then Shell dot page and then
all you need to do is take the password to is one two three four five like enter just type one of a
password you saved.
And there we go.
So we've got a session.
It's a help.
And there we go.
So our payloads uploaded.
These are the commands that we can execute now.
So we've basically got full control of their Web site.
We can file remove.
We can edit files so let's see where we are so we're currently in VW BWI hackable.
So let's go into var to be a W DV W.A. and hackable
so now we're in hackable type Alice so there's uploads and users so we can go into the users.
Let's just go back and see the uploads.
Now.
You could go to the main directly with the indexed IP HP.
So let's go to that because that's typically what the main web site would have.
So it'll be just in TV to be way Let's type alas ignore these warnings here because as you can see it
still works.
Now we're on the main directory of the websites as you can see here there's a index top HP and we can
remove that and deface the website.
So what you do is you just remove the file by using a command here.
So file file are an underscore R.M. remove indexed each demo.
In this case I think it's page B so indexed or PSP and add real upload so you can use file or upload
and then upload a new indexed or page.
So I'm not going to be like showing you any sort of commands in this video was just showing you how
to actually see a vulnerable part of a Web site Web and or faced look at your What can I say like your
first vulnerability.
So your first pen test it's a simple one because the security of the website allow this will not be
found on many Web sites these days.
Well it's still useful to know.
So now we've got full access our payloads uploaded and that's basically.
So we've got full control in the next video we'll look at another attacking method and then we'll start
to increase the security when it gets a little bit more complicated to upload our show.
And hopefully this gives you an idea of how Web sites are actually exploited and hacked.
So I'll leave it here for now.
Just for this video so if it did help please leave a comment.
If you stock with anything please leave a comment.
Please leave a like if it did help subscribe for future content and I will see you all in the next video.