Hey, guys, welcome back to another episode on how the heck so we're back to a Web application penetration
testing series and here we have a running and we are looking into the fall of upload vulnerability.
So as you can see here, based on a previous tutorial, we actually went through WiFi so swiftly.
Give us a weaponized Web shell so you can download briefly over here Eidos of Zip Fall or using Bitcoin
on your terminal.
So once you have WiFi running, you can actually create a payload and then you upload a payload into
the site.
So once as you can see over here, we have hackable its payload that has been placed into the website
that would then give us a weaponized web shell.
So going back into terminal.
All right.
So here I have terminal and have navigated to the WiFi tree folder.
So all we get to do is enter WiFi, followed by the URL of the payload that has been uploaded into the
target machine, followed by the password.
So go ahead and hit enter on debt and now we're in.
So we have the weaponize web shell.
All right.
It gives us a more control into the Web application system.
So what we will do now is to learn about creating back doors that would then give us an access to Shell
inside the system.
All right.
So what we will do now is to enter, for example, back door, followed by reverse TCP.
And what I can do is open up and not a terminal colonics I can enter in order to get the IP address
or to call a Linux machine.
So in this case, we have the IP address of one or two one six eight zero one zero six.
And what I can do is to start up a net cat so that we have a connection and gain access to Shell so
I can enter and see the shell that I've followed by two point number of say nine nine nine nine.
Go ahead and hit enter on deck.
So this will start the Netcare and on the right site.
All I got to do is now enter discolor Linux IP address followed by the number.
So in this case, one nine two one six eight zero one zero six Lullabye Port ninety nine.
I go ahead and he'd enter entering that.
All right.
All right, so over here, sometimes it took a couple of tries for us to get a stable connection.
All right.
Because there could be error binding the socket, as you can see on the left side.
All right.
Now, we'll call Linux terminal, as you can see over here under Netcare.
We actually have SRH dash free dot to running so I can enter.
Who am I?
And he says w w w dash data right in I can enter, for example, iPad D.R and you can see that we have
gained access to zero and we can see all the network interfaces and we have the IP address of one or
two one six eight zero two one two.
So we pretty much a shell right now into the hacked it application system.
All right.
So we can do everything we want.
We can upload falls, we can download files, we can further our tax using pulse exploitation methods
as part of the cyber attack into the Web application system.
So once again, I hope you have learned something valuable in today's tutorial and you have any questions
before you leave a comment below.
And I'll try my best to answer any of your questions.
Aerolite, share and subscribe to the channel so that you can be kept abreast of the latest cybersecurity
tutorial.
Thank you so much once again for watching.