Hey, guys, welcome back to another episode on How to Hack.
So over here I have D.V. W8 running, which is a vulnerable Web application system.
And of course, over here we have one particular vulnerability, which is follow up.
So as you can see here, we have vulnerability for upload and it says choose an image to upload.
So what happens is that a lot of sites may have the option for us to select, say, photos, videos,
to upload text messages and certain business applications that allow us to upload Excel sheets and so
on.
So the list goes on.
And of course, in this case, what we are doing here is to upload a payload that gives us a connection
to the Web application system and be able to do all sorts of post exploitation following from this particular
upload.
So as we can see here, all we got to do is to go ahead and open up a terminal.
All right.
So over here, I got to Tumblr running and you have to be able to install Wi-Fi.
All right.
So I can go ahead and share with you if we.
So if Lee is actually a weaponize web show, so it gives us a lot to way excess and creation of a payload
that we can upload to a Web application system, or as you can see over here, and all you got to do
is just download it from the code so you can download a zip or you can do a get clone.
And once you have it, you can navigate into the folder.
So in case I can navigate into the folder.
All right.
So once you're in, we can actually look at all the files has been downloaded.
And of course, the primary one for us will be Wolfley Dot P..
All right.
So it's a python fall that could help us then create the payload in which we will upload into the vulnerable
Web application system.
All right.
So all you got to do is enter briefly.
All right.
So what we need to do now is to firstly create default.
All right.
We have to firstly create a file on the payload that we upload into the Web application system.
So all you gotta do is enter WiFi, generate Willowby password and follow by default name.
So in my case, I'm going to put payload FB hit enter on debt and has created a fall, or in this case
we have seven hundred and fifty one bite size.
And of course we have over here payload.
OK, so what we can do next is that we can now go back into the vulnerable application system and we
can click on upload.
All right.
We can clearly browse and we can go and select payload and want to select it.
Click upload indices over here to fall has been successfully uploaded and it's uploaded to this particular
location.
So once it's been uploaded, all we got to do is to go back into WiFi and we can actually connect into
the Web application system using this.
All right.
So again, using WiFi briefly.
And now what we need to do is to basically enter the IP address or the URL one or two, one six eight.
Not zero, not two.
One, two.
All right.
In this case, would have to slash.
All right.
Vulnerabilities all hackable, sorry, hackable slash.
All right.
And as you can see over here, uploads.
Payload hit, enter on that, all right, followed by password.
And now we are in so we now have access to the father uploaded, it gives us a weaponized web shell
that we can do all sorts of commands and instructions inside the system.
All right.
So what can we do?
All you got to do is enter help and it will listo.
All right.
All the commands that you can actually issue into the system.
So in our case, we can look at.
But for a sequel net scan net, I have config.
So all these are the different things that we can look at.
So I can go in Internet, underscore I have config hit, enter on that and will be able to see the IP
address.
So we are in so we have zero and we have the IP address over here.
OK, so what else can we do.
We can also look at for example.
All right, over here we can upload files, we can look at Back-Door TCP reverse TCP sys extension system
information.
So let's go ahead and enter system on Infl and we can see all this information.
All right.
The version decline IP to server name.
All right.
We can look at the document route to sell all these different details and data can be easily accessible
from briefly.
All right.
With a weaponized shell over here.
All right.
So thank you so much once again for watching.
And I hope they will learn something valuable in today's tutorial.
And if you've any questions, feel free to leave a comment below.
I'll try my best to answer any of your queries like share and subscribe the channel so that you can
be kept abreast of the latest cybersecurity tutorial.
Thank you so much once again for watching.