So far, the website hacking section, we learned how to gather information about a target Web site,
how to discover a number of vulnerabilities in the Web application, and how to exploit these vulnerabilities
to gain access.
I actually cover more vulnerabilities and more advanced techniques in my website hacking course.
This is just an introductory course to most hacking fields without diving too deep in any.
Check out the bonus lecture, the last lecture of the course for more information.
But in all of the previous lectures, I knew what kind of vulnerability I'm going to use, and that's
because I'm teaching you these specific vulnerabilities.
So people usually ask me at the end of the section, so how do I know which vulnerability to use or
how do I know which vulnerability to try?
And the answer is try all of them.
I only try a specific vulnerability per lecture because I've already done my tests and I've already
and I already know what to try and what to show you.
So I don't waste your time.
But if you're testing a specific website, you're going to have to try every single vulnerability that
you learned.
So the basic methodology would be to, first of all, gather as much information as possible about the
target.
As usual, discover all of the subdomains, all of the hidden directories, all of the Web applications
installed on it.
And then for every domain or subdomain, we're going to click on every single link.
We basically want to use every single feature of the website and get an understanding of how this website
works.
So when we break it, we know we actually broke this and it might be vulnerable then for every link,
for every page that we browse, we're going to try all of the vulnerabilities that we learned by testing
the parameters in this page.
And what I mean by the parameters is the input boxes that you see on the page and you want to test the
data that is sent over the URL after the equal sign.
So let me show you a quick example of what I mean.
Let's assume that you're trying to discover vulnerabilities in Google dot com.
You're going to come to Google dot com.
We're going to discover every single subdomain on Google dot com.
So you're going to have to go to accounts that Google dot com ad sense that Google dot com and so on.
And for every page that we get in here, we're going to click on every single link.
So, for example, we have the How Search Works link in here.
We're going to open it in a new tab and we're going to come to it.
You'll notice that in this page, again, we have more links.
So we're going to have to click on every single link of these.
And then for every page that we get, we're going to, first of all, try to use it to see what the
page does, to get an idea of the features that this page has.
And then we're going to try to discover the vulnerabilities that we learned by manipulating the inputs.
So we're going to first play with the inputs in here in the URL so you can see this URL we have FFG
is equal to one.
So after the FGB equals one, we can actually try to inject stuff.
We can test for ESKIL injections, we can test for access and so on.
And we can also go ahead and test this input box for Exercice.
Google was actually vulnerable to Unsuccess and they paid a huge bounty.
I can't remember what it was to the person that found it.
So don't think that these vulnerabilities don't exist in big websites like Google.
So the main things will be testing is the input boxes and the things that we see after the equal sign.
And you'll basically have to test literally every single vulnerability that you learned.
Like I said, there is no way to know by simply looking at a page that is going to be vulnerable to
an injection or to an exercise, for example.
Now, in other cases, you might have websites like this security here, for example, where if you
click on a link, you'll actually not see the equals sign in the URL.
So you won't see the data that is being sent to the server in the URL.
This does not mean that this Web application, this page does not send data to the server side application,
but it's just more hidden and harder to see the data that is being sent.
You can actually see the data that is being sent and manipulated using a proxy.
So sweet is a really popular testing framework that actually comes with its own proxy where you could
intercept requests sent from this current page to the Web server so you can actually get more parameters
and be able to test these parameters for the vulnerabilities that we learned.
And you'll also be able to use it to bypass certain types of security measures.
Now, we actually cover burps with and I cover a lot of other more advanced Web application vulnerabilities
and techniques.
Like I said in the website hacking course, I don't cover them here because this is an introductory
course to ethical hacking in general.
And the goal of this course is.
To introduce you to most ethical hacking fields without diving too deep in any so if you want to learn
more about Web application testing, about perhaps read about our top 10 vulnerabilities, then check
out the bonus lecture, it includes that course and to see all of the other courses that are applicable
to you.