Hey everybody.
Welcome to next video.
We're gonna be talking about a lateral movement with web servers.
So when you attack a machine you essentially own the web service at that point so you can change any
of the files you want.
So let's say on this machine right here we've gone.
We want to see var w w e metal we'll do this right.
If you look here we have an index page.
So we do Cat index in this case it's just redirecting us and echoing welcome.
And if it got the redirect it goes ahead and redirects to a different page.
Now that was from a vulnerability for another a previous video.
But you can see here we have access to the index page.
We can change whatever we want.
So what's important to understand here is that depending on the web application that you compromised
if users are logging in you can take it where when they actually enter their credentials and hit submit.
You can just have it log those to a file and then continue on the normal path of the Web site.
So now you've got credential harvesting you can do spear phishing from an internal application and keep
in mind that most enterprises there send mail on local linux machines is approved and white listed by
their email service provider because that allows the service applications or custom scripts to be able
to send emails without getting caught into the spam.
And this is a very powerful place to be from a red team's perspective because what the spear phishing
credential harvesting you can even redirect users put up a warning and saying you need to now log into
this location over here this is being deprecated and then you redirect them to the same server just
on a different page that maybe replicates an internal log in page then they start giving you different
credentials or it might say hey please you upload your SSA private key you know there's a lot a lot
of things you can do with this.
And it's important to know when you compromise a web server check the logs of the web server find out
what pages people are visiting most.
What are some scripts visiting most.
And just try to abuse that as much as possible.
It's very very powerful to own a web application that is unknown to the users that you've actually compromised.