-: How would you attack a website?
You can use the methods that we've learned so far
into attacking a website because we said
a website is installed on a computer
so you can try to attack it and try to hack it
just like another computer, so you can try
to use the server side attacks,
try to see the web server installed the operating system
all the other applications and see if you can use
if any of them has any vulnerabilities,
and if you can use any of them
to gain access to the computer.
Another way to that is to use
the server side attacks and the client side attacks
because websites are managed by humans
so there must be humans managing these websites and
mandmaintaining them, so if you managed to hack any of
the administrators of this website,
then you probably be able to get
their username and a password
and then from there, log in to their admin panel
or to SSH, to any services
that they use to manage their website.
If both of these ways fail, then what you can do is
you can try to test the web application 'cause
as I said, the web application is just an application
installed on that website.
So your target might actually not be the web application
maybe your target was just a person using that website,
but you will never be able to get,
gain access to that person's computer.
So what you do is, you go to his website
hack into his website,
and from there go to your person.
So, all of these things that we're talking about
they're all interconnected then you can use one of them
to privilege and then
make your way to another place or to another computer.
So, in this section
we're not gonna be talking about the server
and the client side attacks
because you've already learned that.
What we're gonna be talking about is the
testing the security of the website application itself.
So my target is gonna be this Metasploitable machine.
And if we do one ifconfig on it
you'll see it's IP is 10.20.14.204
and all the websites files are stored
in a directory called: var/www
and you can see that we have my our php.info
and we have mutillidae, dvwa and phpMyAdmin
so if we go to the Kali machine or to any machine
and try to go
any machine on the same network, obviously,
and try to go to,
let's open the browser,
and if we go to
10.20.14.204
you'll see we have a website here
made for Metasploitable.
So as you can see, a website is just
an application installed on the web browser.
And, you can see that you can access
any of these websites right here
and use it and test it's security.
Another thing is the DVWA uses a username and a password
to log in, and the username is: admin
and the password is: password
and once you put that, then you can log in.
You can also modify the security settings
so if you go on the DVWA Security
I'm gonna be setting it to low,
and I'm always gonna be using as low
in the upcoming sections because we're only
this is just an introductory course, so
we're only gonna be talking about
the basic ways of discovering
a web application vulnerabilities.
And the same with the mutillidae web application.
So if we go to it here,
make sure that your security is set to low,
so my security is set to zero right here.