‫Before starting to learn about finding vulnerabilities and exploiting them, let's see some terminologies
‫and standards used in web application platforms.
‫To be able to understand if there is a vulnerability on an input field, you should send thousands of
‫different payloads.
‫For example, you have to try hundreds of payloads to be sure that there is not an SQL injection vulnerability
‫in a field.
‫There might be tens or hundreds of input fields in a web application.
‫If you want to test the application manually, you may spend months to make it faster.
‫You should use automated tools.
‫There are a lot of automated tools you can choose.
‫Some of them are commercial, such as apps scan, fortify, Acuna Tech's Nets marker.
‫In addition, there are some free tools such as W3, F and Z Attack Proxy.
‫And as a side note, some of the commercial tools have a free trial period so that you can see if they're
‫right for you.
‫Now, let's see how the automated tools work.
‫The automated tool sends a request prepared for a purpose.
‫The application returns a reply for the request, and then the tool analyzes the response to see if
‫there's a weakness, they can send tens of requests in seconds.
‫The first step to understand how the web applications work is to know client server architecture.
‫Systems that want to get services are called clients and the systems to serve the client and to host
‫the application or call server's clients.
‫In most cases are web browsers.
‫In some cases, you can see client side applications other than browsers communicating with the servers
‫using web protocols.
‫These applications are called thick clients.
‫Now, even though there is a thick client on the client side, it's still a web application and you
‫will be able to hack it at the end of this course.
‫Usually there is a database server at the back end.
‫In this slide, you see some of the technologies and standards used in each layer.
‫You don't need to know everything about the technology in detail, but it's better to know which are
‫used in the application.
‫So we're able to focus on the technology used.
‫For example, if we try to exploit a sequel injection flaw and know what the database management system
‫is, suppose that it's Oracle.
‫Then we just use the keywords and methods of Oracle makes sense.
‫Hypertext markup language HD html is the standard markup language for creating Web pages and web applications.
‫The building blocks of HTML pages are HTML elements, and HTML elements are delineated by tags written
‫using angle brackets.
‫Browsers do not display the HTML tags, but use them to interpret the content of the page.
‫Here you'll see some of the HTML elements important for us, and you can see here how to reach resources.
‫Input fields.
‫And tags to use scripts.
‫This is a simple HTML page example, if you look at the source of this page, you will see the page
‫source contains the tags shown in the second frame.
‫Each one is for header bigger and bolder.
‫P is for the paragraph.
‫U L is to start a bulleted list.
‫L I is for the list items you URL.
‫Uniform Resource Locator is a reference to a web resource that specifies its location on a computer
‫network and a mechanism for retrieving it.
‫The components of a typical URL R scheme is the protocol used by the application.
‫Schemes occur most commonly to reference web pages, but are also used for transferring files, emailing
‫and many other applications.
‫Host consists of either a registered name, hostname or an IP address.
‫A typical hostname consists of subdomain, domain and top level domain name.
‫Port is separated from the host name by a colon.
‫This is the port number where the application is served.
‫If it's not given that if all port numbers are used, the default port numbers are eighty four HTP.
‫Four four three four TDPs and 21 for FTP.
‫Path is usually organized in hierarchical form that appears as a sequence of segments separated by slashes.
‫Query is separated from the preceding part by a question mark and contains a query string.
‫A query is most often a sequence of attribute value pairs separated by a delimiter, and the delimiter
‫might be an ampersand or semicolon.
‫Parameters, which will probably determine the response are sent to the server in this section fragment
‫is separated from the preceding part by hash.
‫The fragment contains a fragment identifier providing direction to a secondary resource, such as a
‫section heading in an article identified by the remainder of the Yuri.