-: Now you have enough information
to go ahead and try to gain access
to other systems.
To computers, servers,
web servers and stuff like that.
And in this section
we're gonna be talking about
gaining access to computer devices.
And what I mean by computer devices
is anything
and the reason behind this,
I wanna get this through,
I wanna get this idea through,
is that any electronic device you see
is a computer.
So a phone, a TV,
a laptop, a web server,
a website
a network, a router,
all of these things are computers.
All of them have an operating system
and they have programs installed
on these operating systems.
And usually,
in most cases,
these computers are used by a user.
So you have an operating system,
they have programs installed
on that operating system
and they have a user
who uses and configures this system.
So, I'm gonna be talking about
how you gain access to computers
in this example
and actual personal computers
so the name that people call it usually.
A computer,
so it's gonna be,
we're gonna have a target
of a Windows device
and we're gonna have a target
of a Linux device.
But the concept is always the same.
Getting access to computer devices
is always the same.
So you can apply the same concepts
if you are targeting a phone,
if you are targeting a tablet,
if you're targeting a web server
and we will be targeting
web servers as well.
But I will be talking about it
just like a normal computer.
This is very important to understand.
Every device you see
is a computer
and it works just like your personal computer.
So I can set up a web server
on my computer.
I can make it look like a website
and make it act as a website,
I can make it act as a TV
and I can make it act as anything I want
and literally TV's and all these things
are just simpler computers
with less complicated hardware in them.
So, we're gonna be talking about
attacking these devices
from two main parts
or from two main sides.
The first approach
that we're going to use
is the server side.
So in this side
it doesn't require any user interaction.
We're gonna have a computer
and we're gonna see how we can
gain access to that computer
without the need
for the user to do anything.
For the user who uses that computer
to do anything.
This mostly applies to web servers
and applications
and devices
that don't get used much by people.
So people basically configure them
and then they run automatically.
So, all we have is gonna be an IP address
and we're gonna see how we can test
the security
and gain access to that computer
based on that IP.
So, our main way of getting in
is gonna be the operating system
that that runs
and the applications installed
on that system.
The second approach that we're gonna try
is the client side attacks.
So this approach will require
the client or the person
who uses that computer
to do something.
To do something
that something could be
a number of things.
It could be installing an update,
it could be opening a picture,
it could be opening a Trojan,
so we're gonna learn
how to create a Trojan,
how to create Backdoors,
how to use social engineering
to make the target person
do something
and when they do that action,
we will gain access to their computer.
Information gatherings
can be crucial in this case
because we actually need to know
the person that we're targeting.
After all of that,
I'm gonna talk about
the post exploitation.
So what you could do
after you gain access to this computer,
regardless of the method
that you gained access to it.
So you could have used a server side exploit,
you could have used
a client side exploit
or you could have
just got physical access.
The person left their desk
and you got in.
So, we're gonna see how you could,
what can you do
once you have access to your target.
How you could further exploit that target
and increase your privileges
or target other computers in the same place.