What exactly is a vulnerability?
We talked about process of gaining access and making target executable commands, but let us explain
what happens once we exploit the vulnerability.
Well, let's start like this.
And trust me, if it sounds a little complicated, it will be more clear once we get to practical examples
in the next few weeks.
For now, let's explain it like this, we know that developers write programs, they use their code,
which can be written in any language, whether it is Python, Java, C or some other language.
The goal for developer is to create a software using a programming language.
And as we mentioned, that software can be based on any language whatsoever.
Once the software is complete and it goes through a few test checks and security checks, then that
software gets deployed on machines and it can be run from those machines.
This can be any type of software.
It doesn't matter, however, the problem occurs once that software is open to the Internet, for example,
FTP is open and some machines and servers for file transfer protocol.
S.H. could also be open for secure connection, HTP could be open to host a Web page that clients connected.
Basically if your software is hosted on an open port, then it is also open for possible attacks from
the outset.
And as we already know, that the software is consisted of code that developers wrote.
Problem occurs if that code is not well written, if it has some bugs now, it doesn't necessarily mean
that if there is a bug that we can exploit the target.
But sometimes those bugs can be critical and the attacker could use that bug to make software act in
a way that it is not intended to.
That's called exploitable vulnerability.
Usually once exploited, we drop a payload or a shell back so we can control that machine and do what
we want with it.
Once a bug or vulnerabilities discovered, it gets that name that we've seen for vulnerabilities in
cases that starts with CVT and then the year or when the vulnerability first occurred.
I want ability that exists and has not been patched yet by the vendors is called zero day, usually
as soon as critical zero days discovered, it gets patched almost immediately.
But you will see examples of zero days that were used for months before anyone found out about them.
The most recent one was in 2017, when they want to cry.
Ransomware occurred and infected a bunch of hospitals and police stations.
It was based on an exploit called Eternal Blood, which was created and used by NSA.
They never reported it and used it for their attacks until those exploits got stolen from them and got
leaked.
We will see in this course a lot of reasons, zero days that are now patched.
Some of them will even be as recent as just a few months ago.
However, all of this makes sense if the target has a vulnerability.
But remember, vulnerabilities don't always have to be of technical nature.
Imagine a company with a bunch of networked servers and machines fully secured and also protected by
the best firewall.
No security holes, no vulnerabilities.
We can't even scan the target to figure out its infrastructure because its protection is so good.
Now, imagine an employee that works there, let's call him John and let's focus on John at the moment.
John likes cars.
He usually searches for car pictures and videos while working one day he gets an email from a person
that has email name exactly the same as his colleague.
In that email, there is a car picture.
He sees that the email is coming from his colleague, so he doesn't question it.
Therefore, he opens that picture at work and it indeed is a car picture.
But does he know that email was spoofing an email for him so that at the first glance it looks like
it comes from his colleague and that picture opened a car image, but it also ran over a malicious program
in the background.
What happens next now, John, Super Computer is infected and he doesn't even know it, and from his
computer, we can compromise the entire network and the entire inside of the company.
Now, this is just an example, but stuff like this happens a lot.
Matter of fact, most of the hacking that happens that you read about happens this way and not by someone
finding a zero day vulnerability on a fully secured company.
Remember, people are always the weakest spot.
So if you can hack something through them, why would you bother trying to discover a technical vulnerability
that might not even be there?
In the next video?
We're only left to talk briefly about shells and different types of shells that we want to drop once
exploiting the target.
After that, we are ready to get our hands dirty and start gaining access to our target machine.
See you in the next video.