-: So far in the website hacking section,
we learned how to gather information about a target website,
how to discover a number of vulnerabilities
in the web application
and how to exploit these vulnerabilities to gain access.
I actually cover more vulnerabilities
and more advanced techniques in my website hacking course.
This is just an introductory course to most hacking fields,
without diving too deep in any.
Check out the bonus lecture,
the last lecture of the course for more information.
But in all of the previous lectures,
I knew what kind of vulnerability I'm going to use.
And that's because I'm teaching you
these specific vulnerabilities.
So people usually ask me at the end of the section,
so how do I know which vulnerability to use,
or how do I know which vulnerability to try?
And the answer is try all of them.
I only try a specific vulnerability per lecture
because I've already done my tests and I've already,
and I already know what to try and what to show you.
So I don't waste your time,
but if you're pen testing a specific website,
you're going to have to try every single vulnerability
that you learned.
So the basic methodology would be to,
first of all, gather as much information as possible
about the target, as usual;
discover all of the sub domains,
all of the hidden directories,
all of the web applications installed on it.
And then for every domain or sub domain,
we're going to click on every single link.
We basically want to use every single feature of the website
and get an understanding of how this website works.
So when we break it,
we know we actually broke this and it might be vulnerable.
Then for every link for every page that we browse,
we're going to try all of the vulnerabilities
that we learned by testing the parameters in this page.
And what I mean by the parameters is the input boxes
that you see on the page.
And you want to test the data that is sent over the URL
after the equal sign.
So let me show you a quick example of what I mean.
Let's assume that you're trying to discover vulnerabilities
in google.com.
You're going to come to google.com.
We're going to discover every single sub domain
on google.com.
So you're going to have to go to accounts.google.com,
adsense.google.com, and so on.
And for every page that we get in here,
we're going to click on every single link.
So for example, we have the "how search works" link in here.
We're going to open it in a new tab
and we're going to come to it.
You'll notice that in this page, again,
we have more links.
So we're going to have to click
on every single link of these.
And then for every page that we get, we're going to,
first of all, try to use it
to see what the page does to get an idea
of the features that this page has.
And then we're going to try to discover the vulnerabilities
that we learned by manipulating the inputs.
So we're going to first play with the inputs
in here in the URL.
So you can see this URL.
We have FG is equal to one.
So after the FG equals one,
we can actually try to inject stuff.
We can test for SQL injections.
We can test for XSS and so on.
And we can also go ahead and test this input box for XSS.
Google was actually vulnerable to an XSS,
and they paid a huge bounty,
I can't remember what it was,
to the person that found it.
So don't think that these vulnerabilities don't exist
in big websites like Google.
So the main things we'll be testing is the input boxes
and the things that we see after the equal sign.
And you'll basically have to test literally
every single vulnerability that you learned, like I said.
There is no way to know by simply looking at a page
that it's going to be vulnerable to an SQL injection
or to an XSS, for example.
Now, in other cases, you might have websites,
like zSecurity here, for example,
where if you click on a link,
you'll actually not see the equal sign in the URL.
So you won't see the data that is being sent
to the server in the URL.
This does not mean that this web application,
this page, does not send data
to the server side application,
but it's just more hidden and harder
to see the data that is being sent.
You can actually see the data
that is being sent and manipulated using a proxy.
So Burp Suite is a really popular pen testing framework
that actually comes with its own proxy
where you could intercept requests sent
from this current page to the web server.
So you can actually get more parameters
and be able to test these parameters
for the vulnerabilities that we learned.
And you'll also be able to use it
to bypass certain types of security measures.
Now we actually cover Burp Suite
and I cover a lot
of other more advanced web application vulnerabilities
and techniques, like I said, in the website hacking course.
I don't cover them here because this
is an introductory course to ethical hacking in general.
And the goal of this course is to introduce you
to most ethical hacking fields
without diving too deep in any.
So if you want to learn more
about web application pen testing, about Burp Suite,
about OS top 10 vulnerabilities,
then check out the bonus lecture.
It includes that course and to see all of the other courses
that are applicable to you.