Original subtitles

Now let's translate this into our example.

So in our example we're going to be targeting dimittis floatable machine.

So our web server is going to be dimittis portable machine and we're not going to be using a DNS server

so we're not going to be using a name like Facebook dotcom will be accessing the Web site directly use

an IP address.

So like we said before if we just go here to our portable machine I type in ifconfig you'll see that

my IP is 10 20 14 to 14.

And if I go here to my to upload it to my tally machine you'll see that if I type in 10 20 14 to 14

you'll see that I can access my portable machine.

So the web server here is dimittis Teutul machine itself the web applications are limited the page my

admin DVD.

And all of these so these are why applications and when you click on them you can see for example here

it's written in BHB.

So it's written in this programming language.

It's also using a wide scale server which can be accessed through ph my Oddment.

So these are just technologies used on the web server but the web server itself is the meat asteroidal

machine here.

So when you put the IP address when you put 10:24 into 14 we're actually accessing the floatable machine

and inside dimittis voidable machine we have technologies we have interpretor that's run in PH.

We have a web server and a database.

And these are running the Web Application for us which is Matile today DVD.

And all of them so when these components leave us to no one how we can hack a website so there is more

than one thing that we can exploit to gain control over a website.

Now the main thing the obvious things that you think of is the web applications.

So it's the thing that you always interact with.

For example in Facebook it's where you search for stuff and where you upload pictures where you write

posts.

All of these things are handled by the web application because it's the thing that you click the thing

that you interact with.

So for example if I go here on Matile day and I start browsing the web page this is my web application

so every time I click on something it's being handled and executed by the web application on the web

server.

So if I could exploit this web application in some way if I could gain access to it if I could connect

to the database because obviously this web application connects to the database then I'll be able to

maybe gain control over the Web site and maybe even gain access to the web server and then get access

to other web sites on the same server.

We'll talk about all of that later in the course.

The other way of gaining access to Web sites is using the computer itself.

So let's say you claim your target was the VW 8 and you couldn't get in.

You couldn't find an exploit in the web application itself.

You tried everything you tried all the explosives will go to talk about and you just couldn't get in.

Then your other option would be to exploit the programs installed on that computer because we said our

web server or the Web site is installed on a normal computer just like your home computer.

So if you couldn't get in use and do web applications what if there is one of the programs installed

on the web computer on the computer itself.

How does an exploit has a buffer overflow or remote execution exploit.

What if the web server itself or the database program the program that's running the database itself

had a remote root exploit that allows you to just gain access to the whole web server including all

the Web sites inside it.

So this will be really cool if you could get it if you couldn't find anything wrong with the applications

installed on the web server on the operating system.

Then you could target the humans because we know Web sites are managed by humans.

For example Facebook you can't target mark or you can target the admins of Facebook for example.

These admins obviously have more privileges on that website than new.

And then they might be able to upload sensitive files to that Web site and then you can control it and

Hockett by hacking into one of those people.

So instead of maybe the Web site is very secure and the server is very secure and there is no way that

you can get in but you can always exploit the humans using social engineering attacks and client side

attacks to gain control or hack one of the people that manage that Target Web site and then maybe gain

access to it.

Now this course will be concerned with the web application penetration testing that's concerned with

the first step with the first approach.

So we're going to learn how to discover and exploit a large number of vulnerabilities that can be fine

found in the web application itself.

We're not going to be talking about server side attacks so the attacks that exploit the operating system

and the applications installed on the operating system itself of the web server and we're not going

to be talking about the client side attacks about attacking humans and how can their accounts and then

gain access to the Web site.

All of these these two the last two sections are actually covered into my general ethical hacking course

so I have of course called them an ethical hacking from scratch work which covers those two aspects.

Therefore in this course we're going to be focusing on the web application penetration testing sites

so on how can the websites based on the web applications installed on that Web site.