I will go back to another episode on how the heck so today we'll be discussing the use of Black Widow.
So it is a Web application, hacking web application testing tool that he can use.
And it is PYT on base.
And of course, it will actually help you get her open source intelligence information, do fuzzing
on open web application security, project vulnerabilities.
So if you are trying and thinking about securing your Web servers, are you running some Web application
service over the Internet?
Look up a web, stop and think about your application, security framework and lifecycle and how you
can actually protect a lot of your sites.
And of course, moving on, we can actually see a very nice logo over here.
So, of course, this is a python and two key capabilities.
One is actually finding out more information about a Web server in question, and two is actually about
using it to do fazing to find vulnerabilities on a Web application server immediately.
So that is really helpful and useful in terms of speeding up the Web application penetration testing
onto any Web servers.
So without further ado, let us get started on today's tutorial.
So over here we're running and I can open up terminal and of course, I can zoom in a little so it's
easier for me to see.
And I can go ahead and go into the Black Widow directory that I have downloaded.
So once you do get Klown, you can actually go in straight there.
So, of course, once we see the Black Widow, we can enter all the see all the information.
So I can do a Klatt Black Widow and we can see all the information regarding the source code of Black
Widow on Piton.
So if you have time, I really encourage you to read through some of these really, really interesting
source code of this.
Attacking tools is going to be very helpful in terms of learning about building your own security tools
and so on.
And it is not that hard, actually.
So anyway, moving forward to speed up the process of Turrill, the first thing we do is actually go
into pseudo Wighton and of course we can actually enter Black Widow, followed by Deshu.
And you go to enter the protocol of http dub dub, dub dot Loy Yang, young dot com, some testing on
my own website just to find out if we can see any interesting information on the site.
So go ahead and hit enter on debt and of course you will be prompted with the administrator password
on colonics hit enter on that and you will be crawling through the entire site looking for static and
dynamic you URLs and helping you speed up the process of crawling through the web server immediately.
And this is really helpful because all this data is also going to be saved in site, US share and so
on.
So wonderful way for you to actually find out a lot of information regarding any Web servers.
So the first thing you want to look out for, once we're in here, we can actually see that we have
a lot of information and a lot of repeats of the Eurail else based on the different kind of payloads
they're using.
So here we can see external dynamic you URL.
So this is for you to subscribe into the channel if you haven't already.
So of course, scrolling down, we have the YouTube link, we got a link in laying Facebook and so on.
So go ahead and have me on Facebook.
And if you have any questions, there is a lot more interactive.
And of course this is some of the articles of the population many years back.
And I just left it there.
And of course, I was also looking a lot into Klout, a lot into enterprise service, but service oriented
architecture and so on.
So, of course, we can see a lot of links here and we can scroll down further and you can actually
find a lot of juicy information on other websites whenever you do all this crawling.
But remember, doing all these scans could actually get into trouble, especially if you're probing
for some of this information in a different manner.
And of course, it is a gray area because all these are actually publicly available information.
And at the same time, you're using it to do actually tasks on the Web server looking out for information.
So it could be misconfiguration of the website, misconfiguration, a Web server.
The administrator accidentally leave out some of the critical data information out onto the Internet
that could also be cropped by some of these search engines.
So, of course, scrolling all the way down, this is actually really helpful, especially look over
here.
We can see that this site is most likely running on WordPress and it is running on this specific team.
And of course, this is actually giving you a lot of information about what the website is running on
and potential ways for you to actually think about how you could actually go after the website.
And, of course, scrolling all the way down, we are trying to find out more all the information that
could be useful for us to look out for and potentially do some penetration testing on.
So, of course, we are finding out more information, like a Vansickle injection, how to hack browser
exploitation, social engineering framework and so on.
And of course, all these are the links that are published before.
And you can go and take a look at it for some of these tutorials.
And of course, you're scrolling down.
All this information has been compiled for you and is being placed into a text file so you can easily
share it if you're doing.
Penetration testing in a group and an next to take a look at is actually on the inject X so we can enter
NWSL and here we can see inject X, Y, and of course, I have a Web application server running and
I can enter, I have config and we can see the IP addresses one I two one six eight one on one for.
So moving forward, what we will do is actually open any of your favorite web browser and we can surf
into the web application server.
So all you gotta do is enter one or two, one six eight one to one four hit enter on debt.
And of course here we can click on Mutely Day and we can go into a top 10, a one injection SQL injection,
extract data like on user information.
So it could be any Web application server running on any Web farms.
And here we can see like a username and password and we can enter one to three, one to three click
on view account details.
So this is a typical Web application server that you have a request on.
And of course, here we got a response of authentication error, that username and password.
So what we can do is copy the whole of your URL.
And of course, we can go back to Black Widow, do a dot slash and jack acts.
That Python followed by you on the perimeter of the Web page to click Boort hit enter on that.
And it will actually force the parameter into the site, telling you about all the information that
you can potentially get and all the vulnerabilities that we can discover.
So here, very quickly, based on the payload, we can find out all the vulnerabilities.
So the first one, we get a cross site scripting file and we got a sequel injection file and we got
a sequel injection again.
And of course, we get a Linux directory traversal.
And of course, we have a Linux local file inclusion, renwood file inclusion.
So with all this information in mind, we can actually immediately copy the Eurail with the payload
and we'll be able to find out a lot more details.
So, for example, over here we got the vulnerable user L and I can just copy the link address and we
can go into a new tech and all I got to do is paste and go and immediately we can find out all the users
inside the Web application server.
And from here we can do a lot more probing capabilities to expand our penetration testing.
So moving down, we can also see a Linux local for inclusion.
So here we can actually also copy the information and of course, we can copy the Lync address.
So it is the same.
We can hit enter on debt.
And of course this is the same, but we have a different payload here is using a popular vessel and
here we are looking at a local file inclusion, meaning that a local file from and not a directory is
available to this web application access.
And of course, finally, we also have a remote file inclusion, meaning that we can actually use this
to look up out of false outside of this Web application server so we can copy the link address, paste
the information over here, and we can see that a particular payload is being included inside his Web
server and that is dangerous to.
So, of course, here we can see the information on and so on so we can copy the details.
And of course, we have pasted over here.
So this is the payload.
And based on the information here, we can enter DDP and we can see test dot, Arachne, dash scanner,
dot com and we can do a F again.
Our AI mi five hit enter on that.
And of course we get the same payload likewise over here.
So it has been invaded into the Web application server.
So I hope you've learned something valuable in today's tutorial.
And I remember like sharing subscribe to the channel so that you can be kept abreast of the latest cybersecurity
tutorial.
Thank you so much once again for watching.