Now let's set up our map to be able to set up Zillow.
We need to install a virtual machine the virtual machine name is OS broken web app.
This has many Web site.
Some of them are infected the secret injection and some of them are not and your responsibility or your
task.
We're going to do one together but also you're going to have to practice on the remaining web application.
So let me show you how to set up an app in a very easy way actually.
So Google and go to West broken with app and you can type here to download
and then you go to West Point site.
You can download it from here as well except here as they have more option into OS Web site OS broken
web app and as you can see you know this is some information about OS you go to the download here download
related latest latest release and they have different version.
I mean they have the ones that can work on virtual books one on tens or converter machine.
I prefer that use the virtual machine one.
So we're going to open the first one one point to version and inside this folder you going to find different
or is this just an iso image.
And as you can see if you check the first one for instance this is has extension of Ovi which is a virtual
box which you are not looking for a virtual box unless you have virtual box but I prefer to do like
myself and have the same lap.
So you'll be following a no problem can be showing.
So you should choose a zip file.
This is the VM or the virtual machine.
So click on this one and it will start the download process.
It's around I believe to be one point six something like that.
This is the file.
It's two point two G.B. but actually since I already downloaded so the file I already downloaded here.
So assume that you did download the file and in my case I downloaded the file and here you go.
This is the file that has been download the second step you can right click on it and you're gone.
You gonna uh extract the file so you click on the and extract the file on the same location.
Just make sure if you like Save the file on the C drives you have enough space on C and initially prefers
that you don't set anything on C save it on D or you on external hard drive you know.
But since I already I mean if I click on OK you're going to see that I already have the folder extract
from again cancel the process once the folder have been extracted it will be saved on the disk.
Here was period go
was
yeah.
Here we go.
And if you opens a file you're going to find many file including a virtual machine.
Now the next step that you need to do is to opens a VM where player you go opens a VM where player
and go to the Home tab and choose open a virtual machine not create open a virtual machine open a virtual
machine and then you go to the location of ESP so you go to the location of the OS folder and you're
gonna find the file here.
OS pop app you click on it and you click open and the West will show here so you right click on it and
you click power on.
This is how you set up your lab so I already let let me shut down so as to show you from the beginning
shut down.
Guest
now OS has the full user name and password.
So please write them down so as I told you once it's open it will show here you click on play virtual
machine and you're gonna see that it will request the user name and password.
By the way is the first time you Iran has been a virtual machine.
It will ask you Would you like to.
Did you copy it or move it.
It doesn't matter.
Just copy it or move it is the same.
This is only when you opens a virtual machine from the first time here.
And if you have any problem
downloading the virtual machine let me know.
I'll send you a dropbox link to download it.
So it's thought that was
and once you sought it.
Request username and password.
The user name is Root and the password.
Let me show two is OS broken app bro broken web app.
Just the
initial from each word.
So let me show it to
so the password should be here.
Username and password.
Here you go.
It's OS broken web application.
This is a password.
You better write it down and you can change it later on.
Not a problem but this is the default password so the user name is the root whine.
This one will be uh WASP broken web app and that's it.
Once you log in nothing need to be done on it.
Again
so rude.
And third was broken with.
So he look then you don't need to start a graphical interface you don't need nothing.
All you need to have is the IP of this computer so you type I f config
and you get the IP the IP here is 1 9 2 1 6 8 1 6 3 1 4 5.
This will be your website that you're gonna test.
So going to our Kelly linux machines and you're going to keep this from running and nothing else you
need to do it.
Now we have a web server that have many web applications some of them are infected some of that are
not now going back to our calendar next machine and let's see if the web application is up and running
or not.
So I'll cruise everything to start from the beginning.
So I was just testing everything so this is the
in next machines.
How can a machine open your browser and type the IP that for the OS.
So here you go.
You're going to type 1 9 2 1 6 8 2 2 1 6 3 1 4 5 and it will open the OS broken with each one of those
is a Web site that has a web application which you can test.
I mean in our case we're gonna take this one 0 US break.
This is a Web site that has a database.
It has a logging.
If you go here to log in page you know that you have different user to log in it has a homepage and
this will be our objective.
But we're going to do everything to this specific Web site.
And this is the you are all for this Web site.
Okay for yourself once you tested and you're comfortable you can try other Web site.
Try this one.
Try that one but you know get practice.
Not all of them are infected or they are infected with different kinds of problems some of them with
a secret injection some of them with a live fire right out of eyes some of them but you can practice
the secret injection and see if you get used to it or not.
So let's open our website and this would be our target now.
We have a Web site and we need to know if this Web site has a secret injection or not.
And if so can we dump all the information.
Can we get a valid user name and password that will allow us to log into the page.
Let's see how to do this.