Hello and welcome to the course.
Now, the best way that we can start this is by explaining what even is penetration testing.
Most of you will know this, but let's still cover it as a refresher, at least.
So whether we're talking about network penetration testing or website penetration testing or something
as simple as a single device penetration testing, all of this has the same part inside of their name
penetration testing.
So what is it?
Well, we can refer to it as an action that we apply to enumerate and discover new vulnerabilities,
as well as exploit them and take control of our target system.
Now, most of you might or might not know, but penetration testing is constructed of couple of stages.
Let's say we have our hacking machine on the left and the target device that we are trying to gain access
to is on the right.
This device can be anything from a PC to a mobile phone to a website application.
It doesn't really matter.
The process of penetration testing goes the same way we start off with gathering information.
We want to know as much about our target as possible.
Why, what this allows us to better plan out our attack later on, gathering information can be done
both actively and passively.
Active information gathering is gathering information by interacting with the target, while passive
information gathering means that we get all of our information without ever interacting with the target
in any way.
For example, we can get information about Facebook by Googling it and reading about it on another site,
like Wikipedia that is considered passive information gathering.
After this comes scanning, now, scanning is a deeper form of information gathering, and it's done
actively, which means we directly interact with the target in order to find out more information about
it.
Usually this will be the information of technical nature, like what technologies does the target run,
what is their website made of if they have one, which post they have open and so on and so on?
We finished scanning by performing vulnerability analysis winnability.
Now, this is just us finding security holes in the target system with the help of information that
we gathered.
After that, we can successfully exploit the target by using different methods and attacks.
These are the main steps to penetration testing.
There are other steps, of course, that come after, like maintaining access on the target machine
and covering tracks.
But these steps that we mentioned are crucial now that we covered and went through the basic steps of
penetration testing and what those steps are.
We can also say that penetration testing can be divided into two main groups.
We got network penetration testing, which could, for example, be let's say a company gives you their
IP ranges of their networks and we're supposed to perform a penetration test on all of their devices
to see if there are any security issues.
Those devices could be anything from computers, mobile phones to printers, and for the second group,
we can say that its website application penetration testing.
Here we perform various different tacks to determine whether the website that we are attacking is properly
coded and secured, and website penetration testing is something that will put the most focus on inside
of this course.
This is because this field is becoming bigger and bigger every single day due to millions and millions
of websites that are online and available right now on the Internet, the search for people to secure
and protect them is rising every day.
You might have also heard of a term called bug bounty.
This is pretty much the same thing.
It's mostly referring to discovering bugs or also known as vulnerabilities inside the Web page and backboned
is something that we'll discuss a little bit more in the next video.
But before we get to it, let's mention what are the two main things we need to perform, bug bounty
or website penetration testing.
So we will need a virtual machine and a wonderful Web page.
Now we will install a virtual machine to create our own hacking lab or environment that we will use
to perform all of our attacks.
But as you may notice, to be able to perform a penetration test on the website, we will need a website.
Right.
Luckily, there are many vulnerable Web pages that we can run within our local network on the virtual
machine that are useful for practicing different attacks and discovering different bugs.
And that is also why we need to cover virtual machines now, don't worry, we will cover installing
all of these from installing our own machine that we will use to hack to installing machines with a
vulnerable webpage.
And trust me, it's not that hard as it might sound like.
Nonetheless, now that we mention some basics of penetration testing, let's discuss bug bounty in the
next video, SIDOR.