Hey, guys, welcome back to another episode on How to Hack, and today we'll be discussing about insecure
logging via Web, what?
SWEPCO is a vulnerable Web application platform for us to test on WSP top 10, which is open Web application
security project top 10.
And we have been doing a number of tutorials as part of our Web application penetration testing series.
So as a result of this on number three, which is sensitive data exposure, we have in login.
So over here, it's very important for us to be able to protect the data both addressed as well as in
transit addresses, because when a hacker is able to gain unauthorized access into the database, whatever
they pull out, all of the tables will just be jibberish data unless they have the encryption key.
And at the same time, for data in transit, we need to encrypt them so that whoever is in the middle,
men in the middle attack that we have seen in the previous tutorials is that it will allow the hackers
the ability to see all of those data.
It is being transmitted to and fro between the browser as well as the Web application system.
So, for example, if you join into a wireless connection and wireless connection belongs to a hacker,
so you will be able to see all those data it is sent to and fro, especially if encryption is not enabled.
So over here, we will learn about using packet sniffing on the Web browser.
So over here we have the lesson and it says click the login bottom to send a request containing login
credentials of another user, then write these credentials into the appropriate fields and submit to
confirm.
Try using a packet sniffer to intercept a request.
So there are a couple of options that we can use.
And the first option I want to demonstrate to you over here is using the web developer function.
So you go to top right corner on the menu, clicked on it, click under a web developer and click under
network.
So go and click on that and it will begin tracking everything that is being sent between your browser
as well as your Web application server.
So in this case.
All right, we can actually click on our login and we can click on POS and we can see over here we have
a dot dot MVC.
All right.
So he's to follow five matya.
Not a lot.
And we can look at these parameters and we can look at a response.
So, of course, the response is requests made it post, not support it.
But if you look at the parameters over here in this case, immediately we can see those data is being
sent to and fro into the Web application system.
And of course, in this case, we have the user name Captain Jack and a password as black per.
So this very quickly demonstrate how the hackers could have seen all those data that is being transmitted,
especially if they are not encrypted.
All right.
Which is why we can see the JSON fall here on Perimeter's and we can click on submit.
All right.
And immediately say is congratulations.
You have successfully completed the assignment.
So, once again, thank you so much for watching.
And I hope you learned something valuable in today's tutorial and the like.
Sharing subscribe the channel so that you can be kept abreast of the latest cybersecurity.
Thank you so much once again for watching.