Everybody and welcome to the next video.
In this video me going over browsing as an active reconnaissance.
Now this is going to be a very very short video because most of what you're going to be looking for
when you're browsing are certain issues or vulnerabilities that you are looking at maybe specifically
or a certain part of the web app is piqued your interest based on what you've seen before.
What what's important here is that when you browse a site you're instinctively looking for certain things
or things that can be used in a certain way or maybe used in a certain way.
And this takes time to develop.
It's not a skill you're going to have like.
Like that it's there.
There are some skills like this where they just have to be developed over time.
You just need to understand what you're looking for.
And there's no better way to do that than to wait until the next module so we can kind of go over specific
types of attacks.
However there's a few things I do want to show you when you're looking at a Web site.
So if we take a look at this we go over.
This is Mozilla Firefox but Chrome has has a alternate one as well.
So we go up to the top here and go to web developer you'll see something called network.
Now you can look at the source with Inspector you can work with the console to interface the web app
directly.
However in our case we gonna look at the network.
So we go ahead and run this
we can see that it loads a lot.
So these are every call the Web sites made when it starts to load.
And this is everything from every single image to specific javascript.
So if we click on this we could see the exact content or the request that was made.
So if we go down here we see a post request as an example.
So it's setting.
Let's see here Ajax slash busy.
So this is a post and setting a cookie
No sniff.
OK.
So this gives you an idea of what the web app is doing.
Now this is just happens to be what Facebook is doing on the front page.
But when you start looking at a specific web app you might see some weird calls occurring such as when
you are going to log in maybe the the front page has a two factor authentication setup and it's meant
to go to the two factor side once it's done but if it's making an API call when you submit the form
that you're not authenticated for.
So if you give it fake credentials as an example and it tries to make that call and it gets a response
back saying you know does this user have to factor authentication or does the user exist and you're
not logged in that means you found an API call that you can use to the Web site directly and enumerate
do it every user on the system to see if it's present or not.
So you can get an active list of users at any given time.
So it's important to look at what's being sent back and forth on a on a Web site.
However some places like for example like this this is one web request that has quite a few.
Sixty two requests total that were made just by refreshing the page so it can be overwhelming and this
might not be your best source.
Sometimes just browsing through the web app seeing what options you have here what happens if I change
the actual value.
So if we go into inspector as an example and we take a look at this right.
So if we Inspector we can use this to highlight a specific thing.
Then we go in here.
We can see.
OK.
Birth date we scroll down here we see we got our values.
So what happens if we changed this value to 13 when we submitted it.
So now the value of December right here has a value of 13 when it's selected.
So when it sends it back to the database it's going to set it as a 13 month.
Can.
Can the the request actually or the server handle that.
If it doesn't.
How does it react.
So sometimes you might be able to do different things like that by changing options or just taking a
look at some hidden elements that they might have on the page specifically.
So if we look at this hidden element as an example it looks like a place holder and it just holds looks
like some base from information about an event from an event listener from javascript.
OK but every web site's going to be a little different.
It's good to take a look at through this but what I want you to kind of focus on when you're browsing
a Web site is what features are on the site are there is there a search field.
Is there an uploads option anywhere whether it's your user icon or just images.
General Word documents.
Can that be bypassed.
What API calls are happening like we just looked at looking at the source.
Sometimes developers in custom applications will leave comments in there that aren't seen by the browser
but still visible from the client's perspective.
Where are the log and prompts.
Is there an app and log in prompts.
What parameters are being passed in the U.R.L..
So when you're browsing a site sometimes the parameters might be numbers so what happens if you change
it to a negative number or you put a weird character in there.
So there's a lot of options that you have to look for and that you're going to test for when you're
browsing.
But like I said this is gonna be a quick video.
I just want to get that out there that it is a it is a skill set that you will build over time when
you're looking to a web app you will be like Oh this looks weird I wonder if I did this and then you
try it and see whether it works or not.
That builds up over time.
Don't worry too much about this specifically.
Just browse browse the Web sites when you have like for example your your routers logon page just browse
the look at the source code of the logon page.
What do you see there.
Do you see anything interesting.
Is there any comments that were left over.
What happens if you put fake credentials in there what request is being made.
So just play around with it get some more get familiar with browsing things and looking at it from a
securities mindset not just as a user's mindset.
That's all I'm going to go over in this video.
We'll talk about more about individual attacks against a web app in the next module.