Instructor: What exactly is a vulnerability?
We talked about process of gaining access
and making target execute our commands,
but let us explain what happens
once we exploit to vulnerability.
Well, let's start like this.
And trust me, if it sounds a little complicated,
it'll be more clear once we get to practical examples
in the next few videos.
For now, let's explain it like this.
We know that developers write programs.
They use their code, which can be written in any language
whether it is Python, Java, C, or some other language.
The goal for developer is to create a software
using a programming language.
And as we mentioned,
that software can be based on any language whatsoever.
Once the software is complete
and it goes through a few test checks and security checks,
then that software gets deployed on machines
and it can be ran from those machines.
This can be any type of software.
It doesn't matter.
However, the problem occurs
once that software is open to the internet.
For example, FTP is open on some machines and servers
for file transfer protocol.
SSH could also be open for Secure Shell connection.
HTP could be open to host a webpage that clients connect.
Basically, if your software is hosted on an open port,
then it is also open for possible attacks from the outside.
And as we already know
that the software is consisted of code
that developers wrote.
Problem occurs if that code is not well written,
if it has some bugs.
Now, it doesn't necessarily mean
that if there is a bug
that we can exploit the target,
but sometimes those bugs can be critical.
And the attacker could use that bug
to make software act in a way
that it is not intended to.
That's called exploitable vulnerability.
Usually once exploited, we drop parallel or a shell back
so we can control that machine
and do what we want with it.
Once a bug or vulnerability is discovered,
it gets that name that we've seen
for vulnerabilities in Nasas that starts with CVE
and then the year of when the vulnerability first occurred.
A vulnerability that exists and has not been patched yet
by the vendors is called Zero Day.
Usually as soon as critical Zero Day is discovered,
it gets patched almost immediately.
But you will see examples of Zero Days
that were used for months
before anyone found out about them.
The most known recent one was in 2017
when the WannaCry ransomware occurred
and infected bunch of hospitals and police stations.
It was based on an exploit called Eternal Blue
which was created and used by NSA.
They never reported it and used it for their attacks
until those exploits got stolen from them and got leaked.
We will see in this course a lot of recent Zero Days
that are now patched.
Some of them will even be as recent
as just a few months ago.
However, all of this makes sense
if the target has a vulnerability.
But remember, vulnerabilities don't always
have to be of technical nature.
Imagine a company with bunch of networks,
servers and machines fully secured
and also protected by the best firewall.
No security holds, no vulnerabilities.
We can't even scan the target
to figure out its infrastructure
because it's protection is so good.
Now, imagine an employee that works there.
Let's call him John.
And let's focus on John at the moment.
John likes cars.
He usually searches for car pictures
and videos while working.
One day he gets an email from a person
that has email name exactly the same as his colleague.
In that email, there is a car picture.
He sees that the email is coming from his colleague
so he doesn't question it.
Therefore, he opens that picture at work
and it indeed is a car picture.
But little does he know that email
was spoofing an email for him so that at the first glance,
it looks like it comes from his colleague.
And that picture opened a car image,
but it also ran our malicious program in the background.
What happens next?
Now, John's work computer is infected
and he doesn't even know it.
And from his computer,
we can compromise the entire network
and the entire inside of that company.
Now, this is just an example,
but stuff like this happens a lot.
Matter of fact, most of the hacking that happens
that you read about happens this way
and not by someone finding a Zero Day vulnerability
on a fully secured company.
Remember, people are always the weakest spot.
So if you can hack something through them,
why would you bother trying to discover
a technical vulnerability that might not even be there?
In the next video, we're only left to talk briefly
about shells and different types of shells
that we want to drop once exploiting the target.
After that, we are ready to get our hands dirty
and start gaining access to our target machine.
See you in the next video.