Hello everyone.
This is saga from UB degree and in this lecture we go to talking about the difference between the source
code review and fuzzing.
These are the two terms which you will hear a lot in this industry and they depend on the type of penetration
testing you are doing.
So the application penetration testing can be done in three major types which are the black box testing
the white box testing and the gray box testing.
Then you're doing invite books testing for example let us suppose that this page I just open this is
the website and I want to test it and invite books testing.
I will get the source code of the website itself.
So the source code is the code which is making the website.
Now I can go ahead and review the code and I can see.
All right.
Is there anyone elevated in this code.
Is there anyone David in this code right.
I can find one David Ortiz by watching the code itself.
That's called the source code review.
So even if I just go ahead and switch the security to lo and ISIS a moment right and let me just open
anything like this one.
Yes.
If it's a password changing form.
Right.
Let's try to see the source code now being invite books penetration test I have access to this.
I can see that password new it takes the password from user password confirm it takes the information
possible from user and do the password match it checks that the new password equals confirmation password
and then it simply go ahead and change the password in the database.
So if everything works it just shows you that the password was changed.
There is a problem.
It gives you an error right now.
This is how I can try to find out if it is the one admitted in this or not.
There is a one riveted in this right.
There is a vulnerability that how is this Web site going to make sure that this password request was
created by the user not by a hacker group we're talking about.
This one revealed in the course itself.
This sort of vulnerability.
But right now just understand that source code review means you have access to the source code and you
are able to view and compare things in it.
This was a part of white box penetration testing.
What happens in great books is that you get some part of sort of score let's say you get some parts
of your score and you get some information or you are in middle of having a source code or not having
a source code.
It can be any kind of metal that's agreeable.
What happens is black box is that you don't have access to the source code.
For example you have access to Facebook website.
You don't have access to its source code.
So if you want to test it you are going to test it using the fields.
Right.
They have a logging field.
They have it password.
That's video you're going to test it.
Right.
When you try to input a lot of different things.
So let's say I try something here that's I try to make some exploit here.
I try to add some or here.
I try to exploit this application that is called fuzzing.
I am trying to force this application.
I'm trying to give malicious inputs to make known intentional outputs write malicious inputs to get
non intentional outputs.
This is called fuzzing the difference between both of them were that in the source code review.
You have the source code and fuzzing you are just you're just doing hidden trial kind of things.
So this was all about source code review versus fuzzing.
I'll keep the series going to them.
Have a great day.