-: So the first thing we're gonna look at
is the server side attacks.
And again, these are the attacks
that don't require user interaction.
You can use these attacks with servers, so web servers
and stuff like that.
And you can also use it against normal computers
that people use every day.
The reason why I'm gonna be using it
against my metasploitable,
which runs Unix and which is more of a server
than a normal personal computer,
is because if your target uses a personal computer,
and if they're not on the same network as you,
then even if you get their IP address,
their IP address is gonna be behind the router,
so they'll probably be connecting behind, through a router.
And therefore, if you use the IP to try and determine
what operating systems run on it and what applications
are installed, you will not get much useful information
because you're only gonna be getting information
about the router and not about the person,
because the person is hiding behind the router.
Whereas, when you're targeting a web server
or a server in general, then the server will have
an IP address and that IP address,
you can access it directly on the internet.
So, these ways of gathering information
that we're gonna look at now will work
if the person is on the same network and if the person
has a real IP.
So if you can ping the person,
even if it's a personal computer, if you can ping it,
then you can run all of the attacks
and all of the information gathering methods
that we're gonna explain now.
In my example, I'm gonna be targeting
my metasploitable machine here.
So, if I do IP config, or if I do ifconfig,
you'll see that my IP is 10.20.14.204.
And if I go to my caddy machine,
I should be able to ping it.
Now if I can't ping it,
then we won't be able to do anything.
And as you can see,
we're getting responses back from the machine.
Therefore, we can try and test it security.
So again, you can use these attacks
and you can use these approaches
against any computer that you can ping.
So if it's a personal computer or if it's a server
of any kind, as long as you can ping that direction,
or you can ping that person, then you can use these attacks
and these methods that we're gonna talk about
in the server side attacks.
So it's gonna work against websites, web servers, people,
normal computers, as long as you can ping them.
And just to convey this idea,
now, we see the metasploitable machine right there.
So it's just a normal machine.
It's a normal virtual machine that I can use right here
to do anything I want.
I can list, I can even install a graphical interface,
and then I'll be able to do, just use it
just the way I use my (unintelligible) machine.
But at the same time, it has a web server.
So if I try to navigate to it from here,
you'll see that I actually have a web server here,
and it has websites that I can actually read and stuff,
and browse, but we're actually gonna have a look
on these websites and see we can pentest them
in the future.
So, everything is a computer.
If you can ping that IP,
you can use the server side attacks.
It mostly works against servers
because servers always have real IP's.
And also, if the person is in the same network as you,
then you can ping them
and you can do all of these attacks as well.