Speaker: In the previous lectures,
we learned the basic methodology of server side attacks.
So we learned the basic methodology of how
to test the security of servers.
We learned how to do that manually
and then we learned how to do it with Nexspose using tools.
So before moving to the next section,
which is the client side attacks,
I want to spend one more lecture
just reflecting over everything that we've done so far
and just going over the steps that we used in order
to discover and exploit vulnerabilities in servers,
because testing the security of servers
or running servers side attacks is more
or less always the same.
Let me show you what I mean.
So we're always gonna have to start
by discovering information about our targets,
and we're gonna do that by discovering the open ports
and the running services
and we're gonna do that using Nmap as we showed earlier.
Then once we have a list of all of the servers
and the running services as we can see in here,
for each one of these entries,
so for each one of these ports
and for each one of these services,
we're gonna go ahead and search for vulnerabilities
and we're gonna do that using Google
and using websites such as Exploit DB, and so on.
We're gonna look for vulnerabilities in the services.
If we do find vulnerabilities,
we're gonna see if they are exploitable
cause sometimes the exploitation might not be public
and if it is, we're gonna try to exploit it
or verify this vulnerability, and once done,
we're gonna write a note of it in our report
and we will talk about Pen Test reports
at the end of the course.
So as you can see, the steps are always the same.
You're always gonna use Nmap to discover the open ports
on the running services, you're always gonna look
for vulnerabilities in each one
of these services using Google
or other vulnerability websites like Exploit DB.
The only difference is,
is going to be finding and verifying these exploits
because using them could be slightly different
as we've seen previously and a lot of the time
when you find vulnerabilities that are not available
in Metasploit and so on,
the exploit itself will include documentation on how
to use it and if you can find it again,
you can look for it on Google and learn how to exploit it.
So although it looks very simple,
this is really always gonna be the methodology that we use
when approaching server side attacks
and this will always be the basic steps you'll use in CTF's,
such as Hack The Box and Try Hakimi.
You'll always start with an Nmap scan,
you'll always gonna try to discover vulnerabilities,
search for them, try to exploit them,
and verify your findings.
So although it sounds very simple,
I just wanted to make one more lecture,
just so that you know and so that it's clear
that it's really as simple as this
and the only things
that could be different are the exploits themselves,
which you might have to do a bit of research
to learn how to exploit them, but there is no way for me
to cover all possible exploits,
there is literally thousands and thousands of exploits.
What I'm trying to do here is just teach you how
to actually search for exploits and exploit them yourself
or search for information and apply it to yourself
and give you the basic proper methodology
of how to approach server side attacks.
Now, if you go throughout the whole list of the ports
and services that you discovered,
and you could not discover any exploitable vulnerabilities,
then the only hope
for you is to actually try client side attacks
and this is what we're gonna cover in the next section.