All language subtitles for [English (United States)] Ethical Hacking Full Course - Learn Ethical Hacking in 10 Hours _ Ethical Hacking Tutorial _ Edureka [DownSub.com]

Hi guys, my name
is Aarya and I'm going

to be your instructor
for this course today.

So in this Ethical
Hacking full course video,

we'll be learning almost
everything that is required

for you to get started
as an Ethical Hacker.

So come let's quickly go
over the topics

that we are going
to be covering today firstly.

We're going to be going
to the basics of cyber security

and cryptography

where we'll be learning
the key concepts

of confidentiality
integrity and availability

and how the cryptography
Concepts also tie

into the whole picture next.

We'll be looking
at some cyber threats.

We be seeing

how the Cyber threads
actually affect our computer

and then we will also see
how we can mitigate them.

After which we will be looking

into the history
of ethical hacking.

We learn how this all began

in the Massachusetts
Institute of Technology.

And then we will be looking
into the fundamentals

of networking and ethical
hacking in this will be learning

the various tools

that are used

in ethical hacking and also
the network architectures.

These tools are used
in after this.

We will be having a look

into what the most
famous operating systems

that is there.

That is Kali Linux.

Kali Linux is used
by ethical hackers

and penetration testers all

around the world
will be learning

how to install this

on our local systems
will be learning the tools

that come along with it

and Bash we should be using
them after that.

We'll be learning
about penetration testing

and penetration.

Testing is a subset
of ethical hacking.

So in this we will be learning
about a tool called Metasploit

and using Metasploit
will be learning.

Learn more about vulnerability
analysis and how we

can install back doors
in different computer systems

and take advantages

of these vulnerabilities now
nmap is also another tool

that we are going
to be discussing in this course,

we will be learning

how we can use nmap
to gather information

from our networks and

how we can use this information
to our advantage after that.

We'll be learning deeply
about three cyber attacks

that are there
in this industry first

is cross-site scripting secondly
distributed denial of service

and thirdly SQL
injection attacks.

Now we be doing these attacks
ourselves on dummy targets

and learning more
about these attacks

and how they are orchestrated
and thus we will be learning

more about how we
can mitigate them.

If we actually become
ethical hackers now,

we will also be discussing

some very Advanced cryptography
methods called steganography,

which is basically used
for hiding digital code

inside images last but not the
least we will be also discussing

how you could become
an ethical hacker yourself.

So we'll be discussing
a roadmap will also

be discussing the job profiles
that are there in the industry.

Re and we will also
be discussing the companies

that are hiring for these job
profiles along with the salaries

that they are trying to offer.

Also, we won't be leaving
hanging right there will also

be discussing the 50 most
common interview questions

that come along
with these job profiles

so that you can snag

that job interview and if you do
like our content in the end,

please leave us a like,

please leave a comment

if you want to and do hit
the Subscribe button

so that you can
join our ever-growing

community of learners.

It can be rightfully said

that today's generation
lives on the internet

and we generally users
are almost ignorant as to

how those random bits of ones

and zeros Rich securely
to a computer.

It's not magic its work
and sweat that makes sure

that your packets reach to you
on sniffed today Ira ball

from at Eureka.

I'm here to tell you guys
about how cybersecurity makes

this all possible now

before we begin let me brief
you all about the topics

that we're going to cover today.

So basically we're going
to ask three questions.

Options that are important

to cybersecurity firstly
we're going to see why

cyber security is needed next
we're going to see

what exactly is cyber security

and in the end I'm going
to show you also a scenario

how cybersecurity can save
a whole organization

from organized cybercrime.

Okay.

So let's get started.

Now as I just said we
are living in a digital era

whether it be booking a hotel
room ordering some dinner

or even booking a cab.

We're constantly using
the internet and inherently

constantly generating data
this data is generally He

stored on the cloud

which is basically a huge
data server or data center

that you can access online.

Also, we use an array

of devices to access
this data now for a hacker.

It's a golden age

with so many access points
public IP addresses

and constant traffic

and tons of data to exploit
black hat hackers are having

one hell of a time
exploiting vulnerabilities

and creating malicious software

for the same above
that cyber attacks are evolving

by the day hackers
are becoming smarter

and more creative
with their malware's.

And how they bypass virus scans

and firewalls still
baffled many people.

Let's go through some
of the most common types

of cyber attacks now,

so as you guys can see I've
listed out eight cyber attacks

that have plagued us since
the beginning of the internet.

Let's go through them briefly.

So first on the list,

we have General
malware's malware is

an all-encompassing term
for a variety of cyber threats

including Trojans viruses

and worms malware
is simply defined as code

with malicious intent

that typically steals
data or destroy.

On the computer
next on the list.

We have fishing often
posing as a request for data

from a trusted third
party phishing attacks are sent

via email and ask users
to click on a link

and enter the personal
data phishing emails have gotten

much more sophisticated in
recent years making it difficult

for some people to discern
a legitimate request

for information from a false
one phishing emails often fall

into the same category as
spam but are more harmful

than just a simple ad
next on the list.

We have password attacks.

It's a password attack is
exactly what it sounds

like a third party trying
to gain access to your system.

My tracking a user's password.

Next up is DDOS

which stands for
distributed denial-of-service

DDOS attack focuses

on disrupting the service
of a network a darker send

High volumes of data

or traffic through the network

that is making a lot
of connection requests

until the network
becomes overloaded

and can no longer
function next up.

We have man-in-the-middle
attacks by impersonating

the endpoint in
an online information.

That is the connection
from your smartphone

to a website the MIT.

Emma docs can obtain information
from the end users and entity he

or she is communicating
with for example,

if your Banking online
the man in the middle

would communicate with you
by impersonating your bank

and communicate with the bank
by impersonating you the man

in the middle would then receive
all the information transferred

between both parties

which could include
sensitive data such as

bank accounts and personal
information next up.

We have drive-by downloads
through malware on a Ledge.

Emmett website a program

is downloaded to a user system
just by visiting the site.

It doesn't require
any type of action

by the user to download
it actually next up.

We have mail advertising

which is a way to
compromise your computer

with malicious code

that is downloaded
to your system

when you click
on an effective ad lastly,

we have Rogue softwares,

which are basically malware's

that are masquerading as

legitimate and necessary
security software

that will keep your system safe.

So as you guys can see

now the internet sure
isn't the safe place.

As you might think
it is this not only applies

for us as individuals.

But also large organizations.

They're having multiple
cyber breaches in the past

that has compromised the privacy
and confidentiality of a data.

If we head over to the site
called information is beautiful.

We can see all
the major cyber breaches

that have been committed.

So as you guys can see even
big companies like eBay,

AOL Evernote Adobe
have actually gone

through major cyber breaches,

even though they have a lot
of security measures taken

to protect the data
that they contain

so it's not only

that small individuals
are targeted by hackers

and other people

but even bigger organizations
are constantly being targeted

by these guys.

So after looking at all sorts

of cyberattacks possible
the breaches of the past

and the sheer amount
of data available.

We must be thinking

that there must be some sort
of mechanism and protocol

to actually protect us from all
these sorts of cyberattacks

and indeed there is a way

and this is called
cyber security in

a Computing context security
comprises of cybersecurity

and physical security.

Both are used by
Enterprises to protect

against unauthorized access
to data centers

and other computerized
systems information security,

which is designed to maintain
the confidentiality integrity

and availability of data is

a subset of cybersecurity
the use of cyber.

Cybersecurity can help prevent

against cyberattacks data
breaches identity theft

and can Aid in Risk Management.

So when an organization
has a strong sense

of network security

and an effective
incident response plan,

it is better able to prevent

and mitigate these
attacks for example

and user protection defense
information and guards

against loss of theft

while also scanning computers
for malicious code.

Now when talking
about cybersecurity,

there are three main activities

that we are trying to protect
ourselves against and they

are Unauthorized modification
unauthorised deletion

and unauthorized access.

These freedoms are

very synonymous to the very
commonly known CIA Triad

which stands for confidentiality
integrity and availability.

The CIA Triad is also

commonly referred to as
a three pillars of security

and more security policies
of bigger organizations.

And even smaller companies are
based on these three principles.

So let's go through
them one by one.

So first on the list we have

confidentiality confidentiality
is roughly equivalent

to privacy measures
undertaken to ensure

confidentiality are designed
to prevent sensitive information

from reaching the wrong people

while making sure
that the right people

can in fact get it access
must be restricted.

To those authorized to view
the data in question

in as common as well for data
to be categorized

according to the amount

and type of damage

that could be done.

Should it fall into
unintended hands more

or less stringent measures
can then be implemented across

to those categories?

Sometimes safeguarding
data confidentiality meanwhile

special training for those privy

to such documents

such training would typically
include security risks

that could threaten
this information training

can help familiarize ourselves.

Her eyes people
with risk factors

and how to guard against them
further aspects of training

can include strong password

and password related
best practices

and information about social
engineering methods to prevent

them from bending
data handling rules

with good intention

and potentially
disastrous results.

Next on list.

We have integrity Integrity
involves maintaining

the consistency accuracy

and trustworthiness of data

over its entire lifecycle data
must not be changed in transit

and steps must be taken
to ensure that data.

Cannot be altered by

unauthorized people for example
in a breach of confidentiality.

These measures include

file permissions and user
access controls Version Control

may be used to prevent
are honest changes

or accidental deletion

by authorized users
becoming a problem.

In addition.

Some means must be in place
to detect any changes in data

that might occur as a result

of non-human caused events
such as electromagnetic pulses

or server crash

some data might include
checksums even cryptography.

Graphic checksums for
verification of Integrity backup

or redundancies must
be available to restore

the affected data
to its correct State last

but not least is availability
availability is best ensured

by rigorous maintaining

of all Hardware performing
Hardware repairs immediately

when needed and maintaining

a correctly functional
operating system environment

that is free
of software conflicts.

It's also important to keep
current with all necessary

system upgrades providing
adequate communication bandwidth

and preventing the occurrences

of Bottlenecks are equally
important redundancy failover

and even higher availability
clusters can mitigate

serious consequences

when hardware issues
do occur fast in

as adaptive Disaster
Recovery is essential

for the worst-case scenarios

that capacity is reliant
on the existence

of a comprehensive Disaster
Recovery plan safeguards

against data loss

or interruption in connection

must include unpredictable
events such as natural disasters

and file to prevent data loss

from such occurrences
a backup copy.

He must be stored
in a geographically

isolated location,

perhaps even in a fireproof
water safe place

extra security equipments
or software such as firewalls

and proxy servers

and goddess against down times

and unreachable data you

to malicious actions such as
denial-of-service attacks

and network intrusions.

So now that we have seen what we
are actually trying to implement

when trying to protect
ourselves on the internet.

We should also know the ways

that we actually
protect ourselves

when we are attacked
by cyber organizations.

So the Step to actually mitigate
any type of Cyber attack is

to identify the malware
or the Cyber threat

that is being currently going on
in your organization.

Next.

We have to actually analyze

and evaluate all
the affected parties

and the file systems

that have been compromised

and in the end we have
to patch the hole treatment

so that our organization
can come back

to its original running State
without any cyber breaches.

So how is it exactly done?

This is mostly done by actually
calculating three factors.

The first factor is vulnerable.

Leti the second factor is threat
and the third is risk.

So let me tell you about
the three of them a little bit.

So first on the list

of actual calculation is
we have vulnerability.

So a vulnerability refers
to a known weakness of an asset

that can be exploited by
one or more attackers.

In other words.

It is a known issue

that allows an attack
to be successful.

For example,

when a team member resigns
and you forget to disable

their access to external
accounts change logins

or remove their names

from the company credit
cards this leaves.

Your business open

to both unintentional
and intentional threats.

However, most vulnerabilities
are exploited by automated tacos

and not a human typing
on the other side

of the network.

Next testing for vulnerabilities

is critical to ensuring
the continued security

of your systems
by identifying weak points

and developing a strategy
to respond quickly.

Here are some questions

that you ask when determining
your security vulnerabilities.

So you have questions
like is your data backed up

and stored in a secure off-site
location is your data stored

in the cloud if yes,

how exactly is
it being protected

from cloud vulnerabilities?

What kind of security
do you have to determine

who can access modify

or delete information from
within your organization next

like you could ask questions

like what kind of antivirus
protection is in use?

What is the license currents are
the license current?

And is it running
as often as needed?

Also, do you have
a data recovery plan

in the event of
vulnerability being exploited?

These are the normal questions

that one asks when actually
checking their vulnerability.

Next up is thread a thread
refers to a new or newly

discovered incident with
potential to do harm to a system

or your overall organization.

There are three main types

of thread National
threats like floods

or tornadoes unintentional
threats such as employee

mistakingly accessing
the wrong information

and intentional threats.

There are many examples

of intentional threats including
spyware malware advert companies

or the Actions of disgruntled
employees in addition worms

and viruses are categorized

as threats because they
could potentially cause harm

to your organization through
exposure to an automated attack

as opposed to one
perpetrated by human beings.

Although these threats
are generally outside

of one's control and difficult
to identify in advance.

It is essential to take
appropriate measures to assess

threats regularly here are
some ways to do so and sure

that your team members
are staying informed

of current trends

in cyber security so they
can The identify new threats,

they should subscribe to blogs
like wired and podcast

like the Tech janek's Extreme it

that covers these issues

as well as join
professional associations,

so they can benefit

from breaking news feeds
conferences and webinars.

You should also perform
regular threat assessment

to determine the best approaches
to protecting a system

against the specific threat
along with assessing

different types of thread
in addition penetration,

testing involves modeling
real-world threats in order

to discover vulnerabilities
next on the List,

we have risk.

So risk refers to the potential
for loss or damage

when a threat exploits
a vulnerability examples

of risks include
Financial losses as a result

of business disruption loss

of privacy reputational
damage legal implications

and can even include loss

of life risk can also
be defined as follows,

which is basically threat
X the vulnerability you

can reduce the potential
for Risk by creating

and implementing a
risk management plan.

And here are the key aspects
to consider When developing

your Management strategy firstly
we need to assess risk

and determine needs

when it comes to designing

and implementing a
risk assessment framework.

It is critical to prioritize
the most important breaches

that need to be addressed all
the frequency May differ

in each organization.

This level of assessment
must be done

on a regular recurring basis.

Next.

We also have to include

a total stakeholder
perspective stakeholders include

the business owners as
well as employees customers

and even vendors all
of these players

have the potential
to negatively impact.

Actor organization,

but at the same time
they can be Assets

in helping to mitigate risk.

So as we see risk management
is the key to cybersecurity.

So now let's go

through a scenario
to actually understand

how cybersecurity actually

defend an organization against
very manipulative cybercrime.

So cyber crime

as we all know is
a global problem

that's been dominating
the new cycle.

It poses a threat
to individual security

and an even bigger threat
to large International companies

Banks and government
today's organized cybercrime.

Part of Shadows
loan hackers of Fast

and Now large organized crime
Rings function like startups

and often employ
highly trained developers

were constantly innovating
new online adapt

most companies have

preventative security software
to stop these types of attacks,

but no matter how secure we are
cyber crime is going to happen.

So meet Bob,

he's a chief security
officer for a company

that makes a mobile app
to help customers track

and manage their finances.

So security is a top priority.

So Bob's company has
an activity response.

Platform in place that automates
the entire cybersecurity process

the ARP software
integrates all the security

and ID software needed
to keep a large company

like Bob's secured
into a single dashboard

and acts as a hub

for the people processes

and Technology needed to respond
to and contain cyber doll.

Let's see how this platform
works in the case

of a security breach

while Bob is out

on a business trip
irregular activity occurs

on his account as

a user Behavior analytic engine
that monitors account activity.

Recognize a suspicious Behavior
involving late-night logins

and unusual amounts
of data being downloaded.

This piece of software
is the first signal

that something is wrong

and alert is sent to the next
piece of software in the chain,

which is the
security information

and event management system.

Now the ARP can orchestrate
a chain of events

that ultimately prevents
the company from encountering

a serious security disaster
the ARP connects

to a user directory software

that Bob's company uses.

Which immediately Cognizes
the user accounts belong

to an executive

who is out on a business trip

and then proceeds
to lock his account.

The ARP sends the incident

IP address to threat
intelligence software

which identifies the dress

as a suspected malware
civil as each piece

of security software runs.

The findings are recorded
in the ARP s incident,

which is already busy
creating a set of instructions

called A playbook

for a security analyst
to follow The analyst

and locks Bob's a bounce and
changes his passwords this time.

The software has determined
the attempted attack came

from a well-known
cyber crime organization

using stolen credentials.

Bob's credentials were stolen

when the hacker found
a vulnerability in his company's

firewall software and use it to
upload a malware infected file.

Now that we know

how the attack happened
the analyst uses

the ARP and identifies

and patches all the things
the ARP uses information

from endpoint tool to determine

Which machines need
to be patched recommends

how to pass them and then allows
the analyst to push the batches

to all the computers
and mobile devices instantly.

Meanwhile Bob has to allow
the legal Departments

of the breach

and the ARP instantly
notifies the correct version

of the situation
and the status of the incident

after the attack is contained

and Bob's account
is secured the analyst

and communicates which data may
have been stolen or compromised

during the incident.

He identifies which
geography is jurisdiction.

And Regulatory Agencies cover

the users and informations
affected by the adapter.

Then the ARB creates
a series of tasks.

So the organization can notify
the affected parties and follow

all relevant compliances

and liability procedures
in the past a security breach.

This large would have
required Bob's company

to involve several agencies

and third parties to solve
the problem a process

that could have taken
months or longer.

But in a matter of hours
the incident response platform

organized all of
the people processes.

Has and Technology to identify
and contain the problem find

the source of the attack
fix the vulnerability

and notify all affected parties

and in the future Bob and
his team will be able to turn

to cognitive security tools.

These tools will read
and learn from tens of thousands

of trusted publication blogs and
other sources of information.

This knowledge will uncover
new insights and patterns

and dissipate an isolate
and minimize attacks

as they happen and
immediately recommend actions

for Security Professionals
to take Keeping data safe

and companies like pops
out of the headlines.

Cryptography is essentially
important because it allows

you to securely protect data

that you don't want anyone else
to have access to it is used

to protect corporate Secrets
secure classified information

and to protect
personal information

to guard against things
like identity theft

and today's video
is basically going to be

about cryptography now

before we actually jump
into the session.

Let me give you guys
a brief on the topics

that we're going to cover today.

So first of all,

we're going to cover
what is cryptography

through the help
of a very simplistic scenario,

then we are going to go through
the classifications of Rafi and

how the different classification
algorithm works in the end.

I'm going to show you
guys a Nifty demo on

how a popular algorithm
called RSA actually works.

So let's get started.

Now.

I'm going to take the help
of an example or a scenario

to actually explain.

What is cryptography.

All right.

So let's say we have
a person and let's call him Andy

now suppose Andy sends a message
to his friend Sam who's

on the other side
of the world now,

obviously he wants
this message to be private

and nobody else should Have
access to the message now.

He uses a public forum.

For example the internet
for sending this message.

The goal is to actually
secure this communication.

And of course we have to be
secured against someone now,

let's say there is
a smart guy called Eve

who is secretly got access
to your Communication channel

since this guy has access
to your communication.

He can do much more
than just eavesdrop.

For example, you can try
to change the message in itself.

Now this is just
a small example.

What if Eve actually gets access
to your private information.

Well that could actually result
in a big catastrophe.

So, how can an D be sure

that nobody in the middle could
access the message center sound.

The goal here is to make
communication secure and that's

where cryptography comes in.

So what exactly is cryptography?

Well cryptography
is the practice

and the study of techniques
for securing communication

and data in the
presence of adversaries.

So, let me take
a moment to explain

how that actually happens.

Well, first of all,
we have a message.

This message is firstly
converted into a Eric form

and then this numeric form
is applied with a key

called an encryption key

and this encryption key is used
in encryption algorithm.

So once the numeric message

and the encryption key
has been applied

in an encryption algorithm.

What we get is called
a cipher text.

Now this Cipher text
is sent over the network

to the other side of the world

where the other person
whose message is intended

for will actually use
a decryption key and use

the ciphertext as a parameter
of a decryption algorithm.

And then he'll get

what we actually send
as a message and

if some error had actually
occurred he'd get an arrow.

So let's see

how cryptography can help secure
the connection between Andy

and sound so
the protect his message

and the first converts
his readable message

to an unreadable form here.

He converts a message
to some random numbers

and after that he uses

a key to encrypt his message
after applying this key

to the numerical form
of his message.

He gets a new
value in cryptography.

We call this ciphertext.

So now if Andy
sends the ciphertext

or encrypted message
over Communication channel,

he won't have to worry

about somebody in the middle of
discovering the private message.

Even if somebody manages
to discover the message,

he won't be able
to decrypt the message

without having a proper key
to unlock this message.

So suppose Eve here
discovers the message

and he somehow manages
to tamper with the message

and message finally reaches
some Sam would need a key

to decrypt the message to
recover the original plaintext.

So using the key he
would convert a cipher.

X2 numerical value corresponding

to the plain text now after
using the key for decryption,

what will come out is
the original plain text message

or an adult now this error
is very important.

It is the way Sam knows

that message sent by Andy is
not the same as a message

that you receive.

So the error in a sense tells us

that Eve has tampered
with the message.

Now, the important thing
to note here is

that in modern
cryptography the security

of the system purely relies
on keeping the encryption

and decryption key secret
based on the type

of keys and encryption.

Algorithms cryptography

is classified under
the following categories.

Now cryptography is
broadly classified

under two categories namely

symmetric key cryptography
and a symmetric key cryptography

popularly also known as
public key cryptography.

Now symmetric key cryptography

is further classified
as classical cryptography

and modern cryptography

further drilling down classical
cryptography is divided into two

which is transposition cipher

and substitution Cipher on the
other hand modern cryptography.

He is divided into stream Cipher

and block Cipher
in the upcoming slides

are broadly explain all
these types of cryptography.

So let's start with symmetric
key cryptography first.

So symmetric key algorithms
are algorithms for cryptography

that use the same cryptographic
keys for broad encryption

of plaintext and decryption

of ciphertext the keys
may be identical

or there may be some simple
transformation to go

between the two keys the keys

in practice represent
a shared secret

between two or more parties

that can be used to maintain

a private information
link this requirement

that both parties have access

to the secret key is
not the main drawbacks

of symmetric key
encryption in comparison

to public key encryption also

known as a symmetric
key encryption now

symmetric key cryptography

is sometimes also called
secret key cryptography

and the most popular
symmetric key system is

the data encryption standards,

which also stands
for D EAS next up.

We're going to discuss
transposition Cipher.

So in cryptography

a transposition cipher
is a method of encryption

by which the positions held
by units of plain text,

which are commonly
characters are groups

of characters are shifted
according to a regular system

so that the ciphertext
constitutes a permutation

of the plain text.

That is the order
of units is changed.

The plaintext is reordered now,

mathematically speaking
a bijective function is used

on the characters position

to encrypt and an inverse
function to decrypt.

So as you can see

that there is an example
All on the slide.

So on the plain text side,
we have a message,

which says meet me
after the party.

Now.

This has been carefully arranged
in the encryption Matrix,

which has been divided
into six rows and the columns.

So next we have a key

which is basically
for to 165 and then

we rearranged by looking
at the plain text Matrix

and then we get the cipher text

which basically is
some unreadable gibberish

at this moment.

So that's how this
whole algorithm works

on the other hand

when the ciphertext Being
converted into the plain text

The plaintext Matrix
is going to be referred

and it can be done
very easily moving on.

We are going to discuss
substitution Cipher.

So substitution of single letter
separately simple substitution

can be demonstrated

by writing out the alphabets

in some order to represent
the substitution.

This is termed a substitution
alphabet the cipher

the alphabet may be shifted

or reversed creating the Caesar

and upstage Cipher
respectively or scrambled

in a more complex fashion.

In which case it is called
a mixed Alpha bit

or deranged alphabet

traditionally mixed alphabets
may be created by first writing

out keyword removing
repeated letters in it.

Then writing all the remaining
letters in the alphabet

in the usual order now
consider this example shown

on the slide using the system.

We just discussed
the keyword zebras gives

us the following alphabets
from the plain text alphabet,

which is a to z.

So the ciphertext alphabet

is basically zebras Then
followed by all the alphabets.

We have missed out
in the zebra word.

So as you guys,

Can see it's zebras followed
by s c d e f g h

and so on now suppose
we were to actually

encrypt a message
using this code.

So as you guys can see

on the screen,
I've shown you an example,

which is a message flee at once.

We are discovered
is being actually

encrypted using this code.

So if you guys can see
out here the F letter

actually corresponds to S.

And then the L letter
actually corresponds

to I out here then we actually
get the cipher text which is Si

a a is that you using the code

and the process that I just
discussed now traditionally,

the cipher text
is written out in blocks

of fixed length omitting
punctuations and spaces.

This is done to help avoid
transmission errors to disguise

the word boundaries
from the plain text.

Now these blocks
are called groups

and sometimes a group count.

That is the number of groups
is given as an additional

check now five-letter
groups are traditional

as you guys can see

that we have also divided
our ciphertext into groups

of five and this dates back.

Back to when messages
were actually used

to be transmitted by Telegraph.

Now if the length

of the message happens
not to be divisible by 5.

It may be padded
at the end with nulls

and these can be any characters

that can be decrypted
to obvious nonsense.

So the receiver
can easily spot them

and discard them next on
our list is stream Cipher.

So a stream Cipher is a method

of encrypting text
to produce Cipher text

in which a cryptographic key

and algorithm are applied
to each binary digit

in a data stream
one bit at a time.

This method is not much used
in modern cryptography.

The main alternative method
is block Cipher in which a key

and algorithm are applied

to block of data rather than
individual bits in a stream.

Okay.

So now that we've spoken
about block Cipher let's go

and actually explain what block

Cipher does a block Cipher
is an encryption method that

A deterministic algorithm

for the symmetric key
to encrypt a block

of text rather than encrypting
one bit at a time as

in stream ciphers.

For example, a common block
Cipher AES encryption

128-bit blocks with a key
of predetermined length.

That is either 128 192
or 256 bits in length.

Now block ciphers

are pseudo-random
permutation families

that operate on the fixed size
of block of bits.

These prps our function

that cannot be
differentiated from completely

random permutation

and thus are A reliable
and been proven to be unreliable

by some Source.

Okay.

So now it's time

that we discussed
some asymmetric cryptography.

So asymmetric cryptography also

known as public key cryptography
is any cryptography system

that uses pair of keys,

which is a public key
which may be disseminated widely

and private Keys

which are known
only to the owner.

This accomplishes
two functions authentication

where the public key verify is

that a holder of the paired
private key send the message

and encryption where only
the paired private key holder.

Decrypt the message encrypted

with the public key and
a public key encryption system.

Any person can encrypt a message
using the receivers public key

that encrypted message
can only be decrypted

with the receivers private key.

So to be practical

the generation of public
and private key pair

must be computationally
economical the strength

of a public key
cryptography system relies

on computational efforts
required to find the private key

from its paid public key.

So effective security

only requires keeping
the private key private

and the public key
can be a openly distributed

without compromising security.

Okay.

So now that I've
actually shown you guys

how cryptography actually
works and how

the different classifications
are actually applied.

Let's go and do
something interesting.

So you guys are actually
watching this video

on YouTube right now.

So if you guys actually go

and click on the secure part
besides the URL you

can actually go and view
the digital certificates

that are actually used out here.

So click on certificates

and you'll see the details
in the details.

Up.

Now as you guys can see
the signature algorithm

that is used

for actually securing YouTube
is being shot 256 with RSA

and RC is a very very
common encryption algorithm

that is used

throughout the internet then
the signature hash algorithm

that is being used is sha-256.

And the issue is
Googling internet Authority

and you can get
a lot of information

about sites and all
their Authority Key identifiers

or certificate policies
the key usage and a lot of thing

about security just from
this small little button audio.

Also, let me show you

a little how public key
encryption actually works.

So on the side,

which is basically
cobwebs dot CSV or UGA dot edu.

You can actually demo out
public key encryption.

So suppose we had to send
a message first we would need

to generate keys.

So as you can see,

I just click generate keys
and it got me two keys,

which is one is the public key,

which I will distribute
for the network and one.

Private key which I will
actually keep secret to myself.

Now.

I want to send a message
saying hi there.

When is the exam tomorrow?

So now we are going to encrypt
it using the public key

because that's exactly
what's distributed.

So now as you can see we
have got our ciphertext saw

this huge thing right
out here is ciphertext

and absolutely makes no sense
whatsoever now suppose we were

to actually then

decrypt the message we
would Would use the private key

that goes along with our account
and we would decode the message

and as you guys can see
voila we have hi there

when the exam tomorrow.

So we are actually
sent a message

on the internet in a very
secure fashion above that.

There's also our essay
that needs some explaining

because I had promised
that to now RSA is a very

very commonly used algorithm

that is used
throughout the internet

and you just saw it
being used by YouTube.

So it has to be common.

So RSA has a very unique way
of applying this algorithm.

There are many actual parameters

that you actually
need to study.

Okay.

So now we're actually
going to discuss Odyssey,

which is a very popular
algorithm that is used

for of the internet.

And you also saw

that it's being used
by YouTube right now.

So this cryptosystem is one
of the initial system.

It remains most employed
cryptosystem even today

and the system was invented
by three Scholars,

which is Ron rivest ADI
Shamir and Len adleman

hence the name RSA and we
will see the two aspects

of the RSA cryptosystem.

Firstly generation of key pair

and secondly encryption
decryption algorithms.

So each person or a party

who desires to participate

in communication using
encryption needs to generate

a pair of keys namely
public key and private key.

So the process followed
in the generation of keys is

as follows first,

we have to actually calculate

n now n is actually given
by multiplying p and Q

as you guys can see out here.

So p and Q are supposed to be
very large prime numbers so

out here P will be 35,

but Are some very
strong encryption we

are going to choose very
large prime numbers.

Then we actually have
to calculate Phi L Phi is you

can see the formula
goes is p minus 1

into Q minus 1 and this
helps us determine

for the encryption algorithm.

Now, then we have to actually

calculate e now he
must be greater than 1

and less than Phi

which is p minus 1

into Q minus 1 and there must be
no common factors for e +

5 except for one.

So in other words,

they must be co-prime
to each other.

Now to form the public key
the pair of numbers

n and E from the RSA
public Key System.

This is actually made public
and is distributed

throughout the network
interestingly though,

N is a part of the public key
and the difficulty

in factorizing a large
prime number ensures

that the attacker
cannot find in finite time.

The two primes that is p and Q

that is used to obtain n this
actually ensures the strength

of RSA now in the generation
of the private key.

The private key D is It from p q
and E for given n and E.

There is a unique number D. Now.

The number D is the inverse
of B modulo 5.

This means that D is a number
less than five such that

when multiplied by E.

It gives one.

So let's go and actually
fill up these numbers.

So n should be 35 out Hill

and if we generate them
we get the value of V,

which is 24,

which is basically 4 into 6,

and then we should also get It's
now he should be co-prime.

So we are going to give it 11
as 11 is co-prime to both.

So now for the actual encryption
part we have to put in p

and N out here

so he out here for us is 11

and N is 35 and then we
are going to pick a letter

to actually Cipher

which is a and then we're going
to encode it as a number.

So as you guys can see
we've encoded as

one and out here now.

After we've given the message
it's numerical form.

We click on encryption

and we get it now to actually
decrypt the message.

We are going to need d
and n now D for us was 5

and N was 35 so 5 and 35

and then we're going
to take encrypted message

from above and we're going
to decrypt this message.

So after you decrypt it,

we have the numerical form
of the plaintext

and then decode the messages
click here decode messages.

And as you guys can see we have
decoded the message using RSA.

So guys that's
how I receive Oaks.

I explained all the factors

that we actually use
in our essay from n25 to e to D.

And I hope you understood
a part of it

if y'all are still

more interested y'all can
actually research a lot

on our say it's a very
in-depth cryptography system p

and N now D for us was 5
and N was 35 so 5 and 35.

And then we're going
to take encrypted message

from above and we're going
to decrypt this message.

So after you decrypted we
have the numerical form

of the plaintext

and then decode the messages
click here decode message.

And as you guys can see we have
decoded the message using RSA.

So guys, that's
how I receive books.

I explained all the factors

that we actually use
in our essay from n25 to e to D.

And I hope you understood
a part of it.

If y'all are still

more interested y'all can
actually research a lot

on our say it's a very in-depth
cryptography system just

as pollution was a side effect
of the Industrial Revolution.

So are the many
security vulnerabilities

that come with the
increase internet connectivity

cyber attacks are exploitations

of those vulnerabilities
for the most part individuals

and businesses have found ways
to counter cyber attacks using

a variety of security measures.

And just Good Old Common Sense.

We are going to examine eight

of the most common
cyber security threats

that your business could face
and the ways to avoid them.

So before we actually
jump into the session,

let me give you how the session
will actually work.

We are going to discuss
the most 8 common cyber threats.

We're going to discuss
in particular what they are

how the threat works
and how to protect yourself.

Okay.

So now let's jump

in now cyber attacks
are taking place all the time.

Even as we speak the security of
some organization big or small.

All is being compromised.

For example,

if you visit this site out here
that is threat Cloud.

You can actually view
all the cyber attacks

that are actually
happening right now.

Let me just give you
a quick demonstration of

how that looks like.

Okay, so as you
guys can see out here,

these are all the places that
are being compromised right now.

The red Parts actually
show us the part

that is being compromised
and the yellow places

actually show us from where
it's being compromised from.

Okay, as you guys can see now

that someone from Madeline's
is actually attacking this place

and someone from USA
was attacking Mexico.

It's a pretty interesting site

and actually gives you a scale
of how many cyber attacks

are actually happening
all the time in the world.

Okay now getting back I think
looking at all these types

of cyber attacks.

It's only necessary

that we educate ourselves
about all the types

of cyber threats that we have.

So these are
the eight cyber threats

that we're going to be
discussing today firstly.

We're going to start
off with malware.

So malware is
an all-encompassing term.

Or a variety of cyber attacks
including Trojans viruses

and worms malware
is simply defined as code

with malicious intent

that typically steals data

or destroy something
on the computer.

The way malware goes about doing
its damage can be helpful

in categorizing what kind
of malware you're dealing with.

So let's discuss it.

So first of all viruses like
the biological namesakes viruses

attach themselves to clean files

and infect other clean files
and they can spread

uncontrollably damaging
a systems core functionality.

I'm deleting or
corrupting files.

They usually appear
as executable files

that you might have downloaded
from the internet.

Then there are also Trojans.

Now this kind

of malware disguises
itself as legitimate software

or is included in legitimate
software that can be tampered

with it tends to act discreetly
and creates back doors

in your security to let
other malware sin.

Then we have worms worms.

In fact entire networks
of devices either local

or across the Internet by using
the Network's interfaces.

It uses each consecutive
infected machine.

To infect more and then
we have botnets and such

where botnets are networks
of infected computers

that are made to work together

under the controller
of an attacker.

So basically you
can encounter malware

if you have some OS
vulnerabilities or

if you download some legitimate
software from somewhere

or you have some
other email attachment

that was compromised with

Okay.

So how exactly
do you remove malware

or how exactly do you
fight against it?

Well, each form of malware
has its own way of infecting

and damaging computers

and data and so each one

requires a different
malware removal method.

The best way to prevent malware
is to avoid clicking on links

or downloading attachments
from unknown senders.

And this is sometimes done

by deploying a robust
and updated firewall

which prevents the transfer
of large data files

over the network in a hope
to be doubt attachments

that may contain malware.

It's also important
oughtn't to make sure

your computer's operating system

whether it be Windows Mac
OS Linux uses the most

up-to-date security updates

and software programmers
update programs frequently

to address any holes
or weak points,

and it's important to install
all these updates as

well as to decrease
your own system weaknesses.

So next up on our list of
cyber threats we have fishing.

So what exactly is fishing

well often posing as
a request for data

from a trusted third
party phishing attacks

are sent via email

and ask Those to click on a link

and enter their personal
data phishing emails have gotten

much more sophisticated
in recent years

and making it difficult

for some people to discern
a legitimate request

for an information

from a false one now
phishing emails often fall

into the same category as
spam but are way more harmful

than just a simple ad

so how exactly
does fishing work.

Well most people associate
fishing with email message

that spoof or mimic Bank
credit card companies

or other Genesis
like Amazon eBay

and Facebook these messages look
at entik and attempt

to get victims to reveal
their personal information.

But email messages are

only one small piece
of a phishing scam

from beginning to end
the process involves five steps.

The first step is
planning the Fisher

must decide which business
to Target and determine

how to get email addresses

for the customers
of that business.

Then they must go
through the setup phase.

Once they know which business
to spoof and who their victims

are fissures create methods
for Living the messages

and collecting the data then
they have to execute the attack.

And this is the step.

Most people are familiar
with that is the fishes

and the phony message

that appears to be
from a reputable Source

after that the Fisher records

the information the victims
enter into the web page

or pop-up windows
and in the last step,

which is basically identity
theft and fraud the Fisher's use

the information they've gathered
to make illegal purchases

or otherwise commit fraud

and as many as 1/4 of
the victims never fully recover.

So how exactly can Can you
be actually preventing yourself

from getting fished?

Well, the only thing
that you can do is being aware

of how phishing
emails actually work.

So first of all,

a phishing email has
some very specific properties.

So firstly you
will have something

like a very generalized way

of addressing someone liked
your client then your message

will not be actually from a very
reputable source so out here

as you can see it's written
as Amazon on the label,

but if you actually inspect
the email address that Came

from its from management
at Maison Canada dot C A

which is not exactly
a legitimate Amazon address.

Third.

You can actually hover
over the redirect links and see

where they actually redirect you
to now this redirects me

to www.facebook.com zone.com

as you can see out here.

So basically, you know,

this is actually a phishing
email and you should actually

report this email
to your administrators

or anybody else

that you think is supposed
to be concerned with this also.

Let me give you guys
a quick demonstration.

Chinon how fishing actually
works from the perspective

of an attacker.

So first of all,

I have actually created
a phishing website for

harvesting Facebook credentials.

I simply just took
the source code

of the Facebook login page

and paste it and then made
a back-end code in PHP

which makes a log file
of all the Facebook passwords

that get actually entered
onto the fishing page now.

I've also sent myself an email.

As to make sure
this looks legitimate,

but this is only
for spreading awareness.

So please don't use
this method for actually

harvesting credentials.

That's actually a very
legal thing to do.

So, let's get started.

First of all,

you will go
to your email and see

that you'll get some emails
saying your Facebook credentials

have been compromised.

So when you open it,
it looks pretty legit.

Well, I haven't made
it look all that legit.

It should look legit.

But the point out here is
to actually make you aware

of how this works.

So as you guys can see
it says Dear client we have

strong reasons to believe

that your credentials
may have been compromised

and might have been used
by someone else.

We have locked
your Facebook account.

Please click here
to unlock sincerely

Facebook associate Dean.

So if we actually click here,

we are actually redirected
to a nice-looking Facebook page,

which is exactly

how Facebook looks like when
you're logging in now suppose.

I were to actually log
into my Facebook account,

which I won't I'll just
use some brand my

Like this is an email addres
gmail.com and let's put

password as admin 1 2 3

and we click login now

since my Facebook is actually
already logged in it will just

redirect to facebook.com

and you might just see me logged
in but on a normal computer

is just redirect you
to www.facebook.com,

which should just
show this site again.

Okay.

So once I click
login out here all

that the backend code
that I've written in PHP.

PHP out here will do is

that it's going to take
all the parameters

that have entered
into this website.

That is my email address

and the password and just
generate a log file about it.

So let's just hit
login and see what happens.

So as you guys can see
I've been redirected

to the original Facebook page

that is not meant for fishing
and on my system audio.

I have a log file

and this log file
will show exactly

as you can see are fished
out the email address.

This is an email addres

gmail.com and it's also
showed the password.

That is admin one two three.

So this is how exactly fishing
works you enter an email address

and you're entering
the email address

on a phishing website.

And then it just redirects you
to the original site.

But by this time you've already
compromised your credentials.

So always be careful
when dealing with such emails.

So now jumping back

to our session the next type
of cyber attacks.

We're going to discuss
is password adducts.

So an attempt to obtain

or decrypt a user's password

for illegal use is exactly
what a password attack is

Hackers can use cracking
programs dictionary attacks

and passwords Nippers

and password attacks
password cracking refers

to various measures used
to discover computer passwords.

This is usually accomplished
by recovering passwords

from data stored
in or transported

from a computer system password
cracking is done by

either repeatedly guessing
the password usually

through a computer algorithm
in which the computer

tries numerous combinations.

Nations under the password
is successfully discovered now

password attacks can be done
for several reasons,

but the most malicious reason is

in order to gain
unauthorized access

to a computer

with the computers owners
awareness not being in place.

Now this results

in cyber crime such as stealing
passwords for the purpose

of accessing Bank information.

Now today, there are
three common methods

used to break into
a password-protected system.

The first is a Brute
Force attack a hacker

uses a computer program

or script to try
to login with possible.

Odd combinations usually
starting with the easiest

to guess password.

So just think if a hacker
has a company list he or she

can easily guess usernames.

If even one of the users
has a password one, two,

three, he will quickly

be able to get in the next
our dictionary attacks.

Now a hacker uses a program

or script to try

to login bicycling
through the combinations

of common words in contrast
with Brute Force attacks

where a large proportion key
space is searched systematically

a dictionary attack tries
only those possibilities

which are most
likely to succeed.

Typically derived
from a list of words,

for example a dictionary
generally dictionary attacks

succeed because most people have
a tendency to choose passwords

which are short

or such as single words found
in the dictionaries

or simple easy predicted
variations on words

such as a pending a digit or so.

Now the last kind

of password attacks are used
by keylogger tax hacker uses

a program to track all
of the users keystrokes.

So at the end of the day
everything the user has typed

including the login IDs and
passwords have been recorded.

Added a keylogger attack
is different than a brute force

or dictionary attack
in many ways not the least

of which the key logging program
used as a malware

that must first make it
onto the user's device

and the keylogger attacks
are also different

because stronger passwords

don't provide much
protection against them,

which is one reason

that multi-factor authentication
is becoming a must-have

for all businesses
and organizations.

Now, the only way to stop
yourself from getting killed

in the whole password
attack conundrum is

by actually practicing
the Best practices

that are being discussed in the
whole industry about passwords.

So basically you
should update your password.

Regularly.

You should use alphanumerics

in your password and you
should never use words

that are actually
in the dictionary.

It's always advisable
to use garbage words

that makes no sense

for passwords as a just
increase your security.

So moving on we're going
to discuss DDOS attacks.

So what exactly is a DDOS
or a Dos attack?

Well, first of all,

it stands for distributed denial
of service and a Dos attack

focuses on disrupting
the service to a network

as the name suggests attackers

and high volume of data
of traffic through the network

until the network
becomes overloaded

and can no longer function.

So there are a few
different ways attackers

can achieve dos attack,

but the most common

is the distributed
denial-of-service attack.

This involves the attacker
using multiple computers

to send the traffic or data

that will overload the system
in many instances a person

may not even realize

that his or her computer
has been hijacked

and is contributing

to the Dos attack
now disrupting Services

can have serious consequences
relating to security

and online access many instances

of large-scale Dos attacks
have been implemented as

a single sign of protest
towards governments

or individuals and have led

to severe punishment
including major jail time.

So, how can you Prevent
dos attacks against yourself.

Well, firstly unless
your company is huge.

It's rare that you would be even
targeted by an outside group

or attackers for
a Dos attack your site

or network could still
fall victim to one.

However, if another organization
on your network is targeted now

the best way to prevent
an additional breach

is to keep your system as
secure as possible with

regular software updates
online security monitoring

and monitoring of your data flow
to identify any unusual

or threatening spikes in traffic

before they become a problem.

Dos attacks can also
be perpetrated by

simply cutting a table
or dislodging a plug

that connects your website
server to the Internet

so due diligence
in physically monitoring.

Your connections is
recommended as well.

Okay.

So next up on our list
is man-in-the-middle attacks.

So by impersonating

the endpoints in an online
information exchange the man

in the middle attack can obtain
information from the end user

and the entity he

or she is communicating
with for example So

if you are Banking online

the man in the middle
would communicate with you

by impersonating your bank

and communicate with the bank
by impersonating you the man

in the middle would then
receive all of the information

transferred between both parties

which could include sensitive
data such as bank accounts

and personal information.

So how does it exactly
work normally an MI t--

M gains access

through an unencrypted
wireless access point

which is basically one

that doesn't use WEP WPA or any
of the other security measures.

Then they would have
to access all the information

being transferred

between both parties by actually

spoofing something called
address resolution protocol.

That is the protocol

that is used when you
are actually connecting

to your gateway
from your computer.

So how can you exactly prevent
MIT am attacks from happening

against you firstly you have
to use an encrypted W AP

that is an encrypted
wireless access point next.

You should always
check the security

of your connection because

when somebody is actually trying
to To compromise your security.

He will try to actually
strip down the HTTP or hsts

that is being injected
in the website,

which is basically
the security protocols.

So if something

like this HTTP is not appearing
in your website,

you're on an insecure website
where your credentials

or your information
can be compromised

and the last and final measure

that you can actually
use is by investing

in a virtual private Network

which spoofs your entire IP

and you can just
browse the internet

with perfect comfort.

Next up on our list
is drive-by downloads.

So Gone are the days

where you had to click
to accept a download

or install the software update

in order to become infected

now just opening
a compromise webpage

could allow dangerous code
to install on your device.

You just need to visit or drive
by a web page without stopping

or to click accept any software

at the malicious
code can download

in the background to your device
a drive-by download refers

to the unintentional download
of a virus or malicious.

Software onto your computer

or mobile device
a drive-by download

will usually take advantage

or exploit a browser or app
or operating system

that is out of date
and has security flaws.

This initial code

that is downloaded is
often very small and

since its job is often simply
to contact another computer

where it can pull down
the rest of the code

onto your smartphone tablet

or other computers often
a web page will contain

several different types
of malicious code in hopes

that one of them will match
a weakness on your computer.

So What is this exactly what
But first you visit the site

and during the three-way
handshake connection

of the TCP IP protocol a back
in script is triggered.

As soon as a connection is made
by Al the last ack packet

is sent a download
is also triggered

and the malware is basically
injected into your system.

Now the best advice I
can share about overriding

drive-by downloads is
to avoid visiting websites

that could be considered
dangerous or malicious.

This includes adult content
file sharing websites,

or Anything that offers you
a free trip to the Bahamas

Now some other tips

to stay protected include
keep your internet browser

and operating system up-to-date
use a saved search protocol

that once you went to navigate

to a malicious site and use
comprehensive security software

on all your devices
like McAfee all access

and keeping it up to date.

Okay, so that was it
about drive-by downloads.

Next up is Mal advertising
or malvert izing.

So malvit sizing is the name
we in the security industry

give to criminally
Android advertisements

which intentionally,

in fact people and businesses.

These can be any ad

on any site often ones
which you use as a part

of your everyday internet usage
and it is a growing problem

as is evident
by a recent US Senate report

and the establishment of bodies

like trust and ads now whilst
the technology being used

in the background is
very Advanced the way presents

to the person beings infected
is simple to all intents

and purposes the advertisement
looks the same.

Same as any other
but has been placed by criminal

like you can see
the mint at out here.

It's really out of place.

So you could say it's been made
by a criminal now

without your knowledge
a tiny piece of code hidden deep

in the advertisement
is making your computer go

to the criminal servers
these and catalog details

about your computer

and its location

before choosing which piece
of malware to send you

and this doesn't need
a new browser window

and you won't know about it.

So basically you're redirected
to some criminal server.

Neither injections takes place
and voila you're infected.

It's a pretty dangerous
thing to be in.

So how exactly can you
stop ma advertising.

Well, first of all,

you need to use
an ad blocker,

which is a very must
in this day and age you

can have ad blocker extensions
installed on your browser

whether it be Chrome Safari

or Mozilla also regular
software updates of your browser

and other softwares

that work very fertile
to your browser always helps

and next is some common sense.

And yeah, Advertisement
that is about a lottery

that's offering you free money
is probably going to scam you

and inject malware to

so now we click on those ads.

So the last kind
of cyber attacks.

We are going to discover
today and discuss

about is Rogue software.

So Rogue security software is
a form of malicious software

and internet fraud that misleads
users into believing

that there is a virus
on their computer

and manipulates them
into paying money

for a fake malware removal tool.

It is a form of scare
where that money.

Lets users through fear

and a form of ransomware rock
security software has been

a serious security thread
in desktop Computing since 2008.

So now how does a rogue
security software work

these cams manipulating users

in to download the program
through a variety of techniques.

Some of these methods
include ads offering

free or trial versions

of Security Programs
often pricey upgrades

or encouraging the purchase
of deluxe versions,

then also pops warning

that your computer
is infected with the virus

which encourages you to clean.

It by clicking on the program

and then manipulated
SEO rankings that put

infected website as the top hits

when you search these links then
redirect you to a landing page

that seems your
machine is infected

and encourages you a free trial
of the Rogue security program.

Now once the scareware

is installed it can steal
all your information slow

your computer corrupt
your files disable updates

for Less timet
antivirus softwares

or even prevent you

from visiting legitimate
security software vendor sites.

Well talking about prevention.

The best defense
is a good offense.

And in this case
and updated firewall makes sure

that you have a working
one in your office

that protects you

and your employees
from these type of attacks.

It is also a good idea
to install a trusted antivirus

or anti-spyware software program

that can detect
threats like these

and also a general level
of distrust on the internet

and not actually believing
anything right off.

The bat is the way
to go teen is infected

and encourages you a free trial
of the Rogue security.

Program now once the scareware
is installed it can steal all

your information slow
your computer corrupt

your files to siebel updates

for Less timet antivirus
softwares or even prevent you

from visiting legitimate
security software vendor sites.

Well talking about prevention.

The best defense
is a good offense.

And in this case
and updated firewall makes sure

that you have a working one
in your office that protects you

and your employees
from these type of attacks.

It is also a good idea
to install a trusted antivirus

or These fiber software program

that can detect
threats like these

and also a general level
of distrust on the internet

and not actually believing
anything right off.

The bat is the way
to go the key word

of this video is
ethical hacking course,

but in reality,

it's just an expansive video
on the fundamentals

of ethical hacking.

There is no such thing

as an ethical hacking
course to be honest

because snow course

can teach you a discipline like
ethical hacking all the best

that you can do

and creating content
for ethical hacking is

that you can tell people

about the fundamentals
are followed in this discipline.

Okay.

Now before we start
let me just give you

a general idea of the topics

that I intend to cover
throughout this video.

Okay now to be honest,

we're going to cover a pretty
broad range of material.

We are first we're going
to be going over

footprinting and recognitions
where you get an idea.

What's involved in
the ethical hacking engagement

that you're working

on and information

about the Target that
you're engaged with?

Then we're going to talk
about networking fundamentals

and here we're going to get
our hands dirty with buckets

and the understanding

of dcpip at a deeper level
and also understanding

how the different protocols work
and why they work that way now.

We are also going
to be talking about cryptography

where we talk about different
cryptography key ciphers.

We're going to deal
with web encryption to SSL

and And TLS we are also going
to talk about certificates

and the creation of certificates

and how they actually

operate we will also talk
about public key cryptography

and we are also scanning
an enumeration so nmap

and dealing with Windows servers

and using SNMP and ldap
and all that sort of stuff.

Then we're going to be
talking about penetration

where we deal
with different ways

of getting into systems and also
go over using Metasploit,

which is an exploit framework,

and we're going to talk
about how to Use Metasploit

and you actually
get in the systems

and make use of the exploits

that they have then we're going
to talk about malware's viruses

and worms and rootkits and all
of that sort of stuff.

We're going to take a look
at the different pieces

of malware and how you
would pull that apart

in order to understand

what is doing and potentially

make use of that malware during
an ethical hacking engagement.

Then we're going to talk
about different types of denial

of service attacks
or dos attacks

and the difference
between a denial-of-service

attack and Distributed
denial-of-service attack,

and there is a difference there.

So we're going to go
over this docks now.

We're also going to go
over web application hacking

and the types of tools

that you would use during

web application hacking and
the different vulnerabilities

that web applications have

and how to make use
of these exploits

and those vulnerabilities.

We're going to talk
about Wireless networking

how to probe wireless networks

what wireless networks are doing

and how to secure
wireless networks.

We're also going to talk

about a little bit
about detection vation.

And to be honest with you,

the direction of Asian kind
of comes up in a lot

of different areas
through the many of the topics

that were also

going to talk about
programming programming tax

and how to protect oneself
against programming attacks.

Okay.

So that was the number of topics

that we are actually going
to cover through this video.

Now the approach

that I'm going to be taking
in the series of videos

is whenever possible.

We're going to be going
to use a Hands-On approach.

So we're going to show you
the actual All tools I'm going

to make use of and the tools
to do some sort of demonstration

and how they actually work.

I am a big believer

in getting your hands dirty as
the best way to learn anything.

So as we go through
the series of videos,

I strongly encourage you
to get access to the tools

that I'm going to
be demonstrating wherever

possible and dig in and get
your hands dirty along with me

and there are places

where we're going to be going
over some theoretical material

and I'm not a big fan
of PowerPoint slides,

but That are necessary evil

and order to convey
certain types of information.

So wherever possible I'm going
to minimize their use,

but you will run across places

where they're just a necessity
and we're going to have to go

through some slides

where in order to get
some particular points

across they are primarily
of a theoretical nature.

So that's the process
that we will be taking

through this video
and I hope you have fun

as you go along the way.

Okay.

So let's begin now
the first topic

that we're going to tackle is
what What is hacking?

Okay, so let us take a trip

to the early days
of hacking the start

with now the internet
engineering task force

is responsible for maintaining
documentation about protocols

and very specification
and processes and procedures

regarding anything
on the internet.

They have a series of documents
called the request for comments

or the rfc's and according
to RFC one three eight nine.

It says a hacker is a person

who Delights in having
and Intimate understanding

of the internal workings
of a system computers

and computer networks

in particular while
the expression hackers

may go back a long time

and have many different
connotations are definitions.

As far as computers.

Go.

Some of the earliest
hackers were members

of the tech Model Railroad Club

at the Massachusetts
Institute of Technology

and what those people did
and the various things

that they did and were involved
in a detailed and Steven Levy's

book called hackers
for Our purposes now

for our purposes
would be talking

about other types of hackers.

Although the spirit of
what we do goes back

to those early days.

Now, the definition of hacking

or hackers has changed
particularly in the 1980s

and in part as a result
of a couple of people

namely Robert T Morris
who was a Cornell graduate

who Unleashed a
piece of software

that was called a worm on
what was an early version

of the internet Forum went
on to cause a lot of damage

and create a lot of downtime
on Systems across the country

and across the world.

Now the Morris worm did end up
resulting in something good.

However, that is
computer Emergency Response Team

at Carnegie Mellon
was created primarily

in response to the mall swarm.

Now, there's also Kevin mitnick
was another well-known hacker

who was responsible
for various acts

of computer crime
over a couple of decades.

He was the first
convicted in 1988.

So the definition of hacker
or hacking move from something

benign to something
far more sinister.

In popular culture now,

we see hacking or hackers
in all sorts of popular culture.

We've seen them in hacker movies

called War Games also
the movie hackers.

Of course.

You also see in The Matrix
movies where you can see

if you look really closely

that they are using
a tool called nmap,

which we will get into the use
of in great detail later on

as we go on now.

It's the movie sneakers
and the movie SWAT fish

and on television

in other Into other places
you can see the agents

at NCIS regularly doing
things like cracking

complex cryptography in just
a matter of seconds or minutes.

So what is hacking really

well hacking is about
a deep understanding

of something particularly

with relation to
computers and Computing.

It's also about exploring and
the joy of learning new things

and understanding
them very clearly

and being able to manipulate
those things in ways

that maybe other people
haven't before it's all

about digging into problems.

To find out Solutions
in creative and interesting ways

and sometimes finding problems

where there weren't
problems previously

and that's a little bit
about what is hacking.

Okay.

So now that we have talked
about what exactly is hacking

and how the meaning

and conditions of that word
has changed over time

how it came into existence
how it was coined.

Let's go over the reasons
that people normally hack.

Now you may want
to hack just for fun

as discussed previously
hacking is a tradition.

It goes back several decades

at MIT even preceding
the computer too late definition

of hacking now MIT has a long
and storied history of hacking

and sometimes have
a computer to lated nature

which in this case
happens to be true

and sometimes a fan

on computer-related
nature instance.

Now here you can see

that MIT is home page
has been hacked

or you might even say
the faced indicate

that Disney is buying a mighty.

This was an April Fool's
Day prank and 1998.

Eight.

And again, this is just
the kind of hacking

that it would do for fun.

Rather.

Now.

Sometimes you might want
to hack just to prove

a political point or any point
for that matter in this case.

Again, Bill Gates had donated
some money to the MIT

which allowed them
to have a new building

and he was coming
to MIT to visit

and give a talk
about Microsoft Windows

and its systems.

And as you can see the the
Windows systems are installed

in the entryway at the

Or hacked to be running Linux
instead and you can see here.

That ducks.

The penguin is saying welcome

to the William Edge
Gates Building again that

some students who decided

that they wanted to make a point
about Linux and Microsoft

and windows to Bill Gates

and they thought hacking was
the best way to go about it.

Sometimes you have just
for the challenge.

Here's an example again at MIT

where some students turned
the facade of a building

into a Tetris game board.

Now, this was
a reasonably difficult hack

and the students went

after it just for the challenge
of completing it and it just

so they could have
some pride of ownership

and to be able to say

that they were able
to pull this off,

you know, the things
that teenagers do to show off

to other teenagers.

It just increases with increase

in scale now in spite
of its difficulties

and its challenges and all
the obstacles and planning

that have to go into it.

They were able to pull it off

and now they have
those bragging rights.

So that was one Them and one
of the instances

where somebody would hack just

for the challenge and
for the fun of it.

Now, sometimes you want
to hack to prevent theft

and this is where we get

more specifically in
the computer-related hackings.

You see a lot of Articles
and stories in the news

over the last few
years about cybercrime

and here is an example
of data theft compromised

and a few than
one-and-a-half million cards

for Global claimants.

So there are some attackers

who got into this
company global payment

and they were able to pull
out about a million and a half

credit card numbers
during the intrusion there.

So what you may want to do
is you may want to learn

how to hack in order
to find these holes

in your systems or applications
or employer systems

so that you can fix these holes
and prevent these compromises

from happening because of
the reputation of hit

that your company takes

where were things
like these happen.

You have the risk of completely
running out of business.

So just to protect
our job to protect Company

and protect your own
desire of business.

You may just want
to learn to hack

and that's a very good reason.

Now, you may also want
to find all the problems

that exist in your system

for putting them out
and deploying them

so that you can keep
these attackers from getting in

and stealing critical
or sensitive information.

Sometimes you may want to hack
to get there before the bad guys

and the same sort
of idea is the last one

where we're just going to talk
about and it exactly is

ethical hacking now.

We were just talking Talking
about how sometimes

you may want to hack

into your own system

before publishing it
out to the public.

Let's take Internet Explorer.

For example.

Now Internet Explorer was
actually published the public

with some critical
error in the code.

And these flaws were heavily
exploited by people

who actually found them.

Now a number of people
in the world go out looking

for these flaws

and they call themselves
security researchers

and they get in touch
with the vendors

after they found a flaw
or a bug and work.

The vendors to get it fixed

what they end up with is
a bit of reputation.

They get a name for themselves

and that name recognition
may end up getting them a job

or some speaking engagements
or book deal

or any number of ways
that you could cash in

on some name recognition
from finding the sort of bugs

and getting them fixed.

If you want to get there
before the bad guys.

You may think you're
helping out a vendor.

You may want to just
make a name for yourself.

If you want to find
these sort of bugs

before the bad guys do

because think about the bad guys

finding then is they
don't announce them

and they don't get them fixed

and that makes everybody
a little less secure.

Finally may want
to protect yourself

from hacked computer companies
and fight cyber criminals,

and this is new headline
from June 18 2012,

and we're starting
to see these sort

of news headlines show up

as companies are starting
to retaliate against attackers

in order to retaliate
against attackers.

Now in order to
retaliate against Dockers,

you need to be able
to The same sort

of skills and techniques
and knowledge and experience

that those attackers have

and where your company
may want you to learn to hack

or the company may want
to bring in people

who are skilled
at these sort of activities

so that they can
attack the Dockers

and hopefully you end up
with more Steely exterior

and you get a reputation
for not being a company

that people wanted to go
after those are several reasons.

And there you go.

I gave you around a bunch

of reasons as to why
you may want to hack.

Back for fun prove a point take
yourself to protect the company

to not run out of business

and along with another
bunch of reasons.

Okay.

So now that we have talked about
why you would want to hack.

Let's move on to the types
of hackers that exist.

Now we're going to be talking
about the different types

of hacking and the first
step of Hawking

that I want to discuss
is ethical hacking

and ethical hackers,

which is really

what we're going to be talking
about for the rest

of these lessons now
an ethical hacker is Buddy

who thinks like
a black hat hacker

or things like somebody

who is intent on breaking
into your systems

but follows a moral compass

that's more in line
with probably the majority

of the population.

So their intent isn't to do
bad things their intent

is look for bad things
and get them fixed.

So that bad things don't happen
ethical hackers aren't out

to destroy anything
and they're not out

the break anything

unless it's deemed
to be acceptable as a part

of the engagement
and also necessary.

And in order to demonstrate
a particular vulnerability

to the organization that
they're working with so

that's an ethical hacker

and there's a certification

that's available
from the ec-council.

It's a certified ethical
hacker and you know,

if you find
certifications valuable

and this sort of thing is
what do you want to do?

We're seeing a set
of certified ethical hacker

may be something you
might want to look into now.

Let's talk about
black hat hacker.

There's a plenty of cases
of black hat hackers

through yours and
let's talk about a guy.

In particular called
Kevin mitnick.

This guy right here
is a particularly

good example probably

because he was a black hat
hacker for a lot of us years.

His goal was to cause
mischief to steal

where necessary and just
to be engaged in the lifestyle

of being a hacker

and doing whatever was necessary

to continue doing
whatever it craw doing

whatever he was doing it
cross moral boundaries

or ethical boundaries.

And so Kevin mitnick here was
involved for well over a decade

and computer crime

and was finally
picked up by the FBI

and he was charged

and prosecuted and he
was eventually convicted

of some of the activities
that he was involved with now

you may be able to argue
that Kevin is a gray hat hacker

and as well and a gray
hat hacker is somebody

who kind of skirts

the line between black
and white hat Hawking

and white had Hawking
is really what

an ethical hacker is so instead
of saying ethical hacker.

You could say white hat hacker.

It's the same idea

of white hat hacker is somebody
who acts for good

if you Think of it like that

if you want to think
of it as a good versus evil

and what they're really
doing is they're in it

for the technical challenge.

They're looking to make
things better make things

more efficient improve them
in some way on the other hand.

The black hat hacker is out
for the money for the thrill.

It's really criminal activity

and a gray hat hacker is
somebody who may employ

the tactics and technique
of a black hat hacker,

but have sort of a white hat

focus in other words
they're going to do Do things

that may be malicious
and destructive in nature,

but the reason they're doing
it is to improve

the security posture
of an organization

that they're working

with so you can see

there's actually a book
called gray hat hacking.

It's a pretty good book
and it details a lot

of the tactics and strategies

and techniques will be going
over in subsequent lessons

in this video.

Now one other type of hacking

that I want to talk about is
a thing called hacktivism

and you'll find hacktivism
all over the place

and Example in the last year

or so and certainly in recent
memory is called loves security.

Yeah, you heard that right?

It's called loves security
and you can argue

that lulls is actually
a response to another type

of activism and
organization called Anonymous

started hacking companies

like Sony to protest
their involvement in a lawsuit

regarding a PlayStation
3 hacker now allow security

was supposedly testing
the treatment of anonymous

or was hacking in support
of this group Anonymous,

so they hacked number.

Of companies and the things like
pulled information usernames

and passwords from the databases
at these companies and they said

that the reason was to shine
a light on the security

of these companies

and also theoretically
embarrassed the companies

with their weak
or poor security postures

and the problem with that

that they were doing this
through were posting information

that they had found online

and that information
often included details

about customers for
these particular corporations.

And for an ethical hacker
a white hat hacker

that would cross the boundary.

Of causing harm.

So there's no reason

for me as an ethical hacker
to post information

in a public forum about somebody

because I could be doing
damage to them.

But in this case law security
and Anonymous specifically lot

of security were engaged
in the form of hacktivism

and what they were doing
was not only damaging

to the corporation

that certainly was detrimental

to those people so
different types of hackers

and different types
of hacking we've got

ethical or white hat hacking.

You've got black hat gray hat
and then we finally got Mmm,

it's really the goal

and the means that vary
from one to the other.

Okay.

So now that we've discussed
the types of hackers.

Let's also discuss the skills
necessary to become one.

So what we're going to discuss

in this part are
the different skills

that are required

or will be learned as
a part of this video.

So initially just

for basic Computing you
need a basic understanding

of operating systems
and how to work them.

There are going to be several
fundamental types of tasks

that I won't be going
into any detail at all

or and you need to know
how to run programs.

And do things like open
up a command prompt

without me walking you
through and how to do that.

So I am going to assume

that you have some basic
understanding of how to do

these sorts of tasks.

Also, you need an understanding
of the basic system software

and you'll need a basic
understanding of how to use

command line utilities.

There are a number
of tools and programs

that we're going to be going
through this video

and many of them use
the command line now

whether it's on Windows

or Linux still need
to be familiar with typing

and being able to run programs
from the command line

and the various command
line switches and parameters

that those programs are types

of programs are going to use now
from a networking perspective.

You need a basic understanding

of some simple
networking Concepts.

You need to know
what cables are and switches

and hubs and how systems
are networked together.

You don't really need
a deep level of understanding.

I'll be going
through some protocols

as reasonably deep level

because I think
it's important as

an ethical hacker to understand

what's going on
at the protocol level

so that you can know
better what you are.

Going and how to achieve
the goals and tasks

that you have before you so
we're going to be going

over some protocols.

So just understanding
what protocols are

and how they go together.

They all sort
of things are necessary

from a networking perspective.

Now, we're going to also be
learning a bunch of life skills.

Yes, there are some life skills
that it's important to have.

I think the most important one
is the ability to accept failure

and persevere and by that.

I mean you're going to be just
running across several things

that just don't work
the first time around

and it's going to take
a little bit of time

and stick-to-itiveness to plug
away and keep going

until you get something to work.

And the way that you get
things to work is having

an ability to problem solve

and sometimes solving
problems requires being

a little creative.

Sometimes you need
thing out of the box

and come out a problem

from a different perspective
in order to find a solution

throughout the course
of this video.

You're going to run
across a lot of sticky problems

through the course of learning
about being an ethical hacker

and just doing the work.

Because it's not a simple.

So here's a little recipe for
how to do this now go follow

this recipe every time and
you're going to be successful.

Every situation is different.

Every system is different.

You're going to run across
some pretty sticky problems

and you're going to have to just
wait and get your hands dirty

and keep failing and failing
and failing and failing

until you find a way to succeed.

So I think those skills are
very necessary to learn

how to be an ethical hacker
digging through some

of the material
that will be going over in this.

Yo, as far as what you
are going to be learning

you're going to be learning
about how to use a lot of tools.

You're going to learn
networking and by that.

I mean we're going to be talking
about different Protocols

are evolved involved
in networking systems together,

you're going to learn
about security and security

postures security is the heart
and soul of ethical hacking.

It's why we do ethical hacking

in order to make systems
and networks more secure

than they were previously.

That's the goal
from a networking perspective.

We're going to be talking
about how to read packets

from Network captures.

You're going to be going
into TCP IP related protocols

and fairly significant amount

of detail and they're
going to understand

how protocols interact
with one another.

So we're going to do all

that and the reading packets
is going to be really important

and we're going to do
a fair amount of that

in addition to just
fundamental approach to learning

how to read packets
in several lessons.

We're going to read packets
as a way of understanding

the different tools

that were using

and how they're going to learn
tactics and methodologies

and you get to learn Learn
to use the information

you've gathered in order
to get more information

and information is really
what is this all about?

You can't do much anything
without information

and sometimes it takes
a fair bit of digging in order

to find that information

and what you're going
to learn is the entry points

and the Stepping Stones
to get the information

that you need.

And then once you
have that information,

you're going to be learning
about ways to exploit it

in order to get deeper
into the dark.

You're going to learn
security awareness.

We're going to talk about risk
and understanding risks

and vulnerabilities primarily
recognize the difference

between a vulnerability

and an exploit and there's
a significant difference.

There is so security awareness
and understanding what a risk is

and how that impacts your Target

and it's going to be key

to a lot of things
that we talked about.

So it sounds like a lot
we're going to cover a fair bit

of ground not all
of it at a deep level.

Sometimes we are going
to skim the surface

but there's an an awful lot
of material to be cover.

So let's get started

into talking about the different
skills are required

or will be learned as a part
of the series of video.

So initially just
for basic Computing you

need a basic understanding
of operating systems.

So it sounds like a lot weird

that we're going to cover
and fair bit of a is going to be

at a very deep level

and sometimes we're just
going to skip the surface

but there's an awful lot
of material to cover

so let's get started.

Okay, so that was all
about the skills

that we are going to develop.

Throughout this video
and that might be necessary

for you to become
an ethical hackl.

Now.

Let's talk about
the types of attacks

that you might be dealing
with ethical hacker yourself.

So now we're going to be talking
about the types of attacks.

Now one type of attack

that you'll find common
particularly in cases

of hacktivism, for example,

or cases where people are trying
to make a particular point

or just be a general pain is

this idea of defacing defacing
goes back for quite a while.

It's the idea.

In of sort of digital graffiti

where you've left your mark
or your imprint behind

so that everybody knows you were
there primarily a website thing

and it's really just making
alterations to something

that used to be pretty common
a long time ago.

Now it's very particular
for businesses or people

or just organizations
in general to have

their homepage has been replaced
by this other thing

that was along the lines
of hey, I was here

and I took over your web page.

We also have a pretty common one

for certainly has been common
over the years.

And it's a pretty good part
towards quality exploits

in high-profile vulnerabilities.

And that's buffer overflow.

Now a buffer overflow is
a result of the way programs

are stored in memory

when programs are running
they make use of a chunk

of memory called a star

and it's just like
a stack of plates

when you put a bunch

of plates down when you pull
a plate off you're going

to pull the top plate
you're going to pull the old

displayed you're going to pull
the one that was on top.

So the same thing
with the stack here,

we're accessing memory

and This has to do with the way
functions are called in memory

when you call the function
a chunk of memory gets thrown

on top of the stack and
that's the chunk of memory

that gets accessed

and you've got a piece
of data in memory,

but in that stack and
that's called a buffer

and when too much data
is sent and try to put

into the buffer it
can overflow now the bounds

of the configured area
for that particular buffer.

It can overflow the bounds

of the configured area
for that particular buffer.

Now the way stack Are put
together we end up

with the part of the stock

where the return address
from the function is stored.

So when you overflow
the buffer you have

the ability to potentially
override that return

at which point you
can control the flow

of execution of programs.

And if you can control the flow
of execution of the program,

you can insert code

into that memory that could
be executed and that's

where we get buffer overflow
that turns into exploits

that creates the ability to get
like a command shell

or some other useful thing
from the system

where the The buffer
overflow is running.

So that's a buffer
overflow in short.

Sometimes.

We also have
format string attacks.

And sometimes these
can be precursors

to buffer overflow formats.

Now format strings come about

because the C programming
language makes use

of these format strings

that determines how data
is going to be input or output.

So you have a string
of characters that define

whether the subsequent input

or output is going
to be an integer or

whether it's going
to be a character

or whether it's going
to be a string

or a floating-point
that sort of thing.

So you have a format string

that defines the input
or the output now

for programmer leaves
of the format string

and just gets lazy
and provides only the variable

that's going to be output.

For example, you have
the ability to provide

that format string.

If you provide
that format string

what then happens is
the program starts picking

the next piece of data

of the stack displays them

because that way we
can start looking at data

that's on the stack

of the running program just
by providing a format string

if I can look at the data I
may be able to Find information

like return address

or some other use
of piece of information.

There is also a possibility

of being able to inject
data into the stock.

I may be able to
find some information

like a return address

or some other useful
piece of information.

There is also a possibility
of being able to inject data

into the stack.

I may be able to
find some information

like a return address

or some other useful
piece of information.

There is also a possibility
of being able to inject data

into the stock using
this particular type.

Now moving on to our next type
of attack is a denial

of service a denial of service.

This is a pretty common one

and you'll hear
about this a lot.

This is not to be confused with
the one that I'll be talking

about after this and that is
a distributed denial of service.

So this one that you see is

that this is a denial
of service attack

and a denial of service
is any attack or action

that prevents a service
from being available

to its legitimate
or authorized users.

So you hear about a ping flood
or a syn flood?

That is basically a syn packet

being sent to your machine
constantly or a Smurf attack

and Smurf attack
has to do something

with icmp Echo requests

and responses using
broadcast addresses.

That one's been pretty
well shot down

over the last several years.

You can also get a denial
of service simply

from a malformed packet
or piece of data

where a piece
of data is malformed

and sent into a program.

Now if the program
doesn't handle it correctly

if it crashes suddenly
you're not able to use

that program anymore.

So therefore you are denied.

The service of the program
and thus the denial of service.

Now, as I said a denial
of service is not to be confused

with a distributed
denial of service.

And I know it's
pretty trendy particularly

in the media to call it
any denial-of-service DDOS

or any denial-of-service DDOS.

Now it's important to note

that any denial of service
is not a DDOS a DDOS or

as you might know
a distributed denial

of service is a very specific
thing distributed denial

of the service is a coordinated
denial-of-service making use

of several hosts
in several locations.

So if you think about a botnet
as an example a botnet

could be used to trigger
a distributed denial of service,

but I've got a lot of bots

that I'm controlling
from a remote location

and I'm using all
these boards to do something

like sending a lot of data
to particular server

when I've got a lot of system
sending even small amounts

of data all of that data
can overwhelm the server

that I'm sending it to

so the Behind a distributed
denial-of-service attack is

too overwhelmed resources

on a particular server

in order to cause that server
not to be able to respond.

Now the first known
DDOS attack use the tool

called stock Old Rod,

which is German for barbed wire
the stock Old Rod came

out of some work that a guy
by the name of mr.

Was doing in 1999.

He wrote a proof
of concept piece

of code called tfn,

which was the
tribe flood Network.

Let me just show that for you.

So you can see

on the Wikipedia page
the try flat Network

or tfn is a set
of computer programs

that is used to conduct various
DDOS attacks such as icmp

flood syn floods UDP flowers
and small for tax.

Now.

I know many people
don't really consider

Wikipedia really good source
of any sort of knowledge,

but it's a good place
to start off.

So if you want to read
about all these types

of attacks like icmp floods

and what exactly is
a syn flood you can always do

that from It's
not that bad place.

Of course, you should use
Wikipedia as your final

Rosetta Stone moving on.

So this program called Old Rod,

which was it was used to attack
servers like eBay and Yahoo!

Back in February of 2000

so that tack in February
of 2000 was really

the first known distributed
denial-of-service attack,

which is not to say

that there weren't denial
of service attacks previously So

to that there were
certainly plenty of them,

but they were
not distributed now

this means If there
weren't a lot of systems

used to coordinate

and create a denial-of-service
condition and therefore

we get distributed
denial-of-service attack.

So that's a handful
of type of tax

and some pretty common attacks

that you're going to see
as an ethical hacker

when you become
an ethical hacker

or if you're trying
to become an ethical hacker,

you should always know
about these types of attacks.

Okay.

So in this lesson,

we're going to be talking
about penetration testing

and some of the details
around how it works

and Logistics and specifically
things like scope so,

Exactly is penetration testing.

So well, not surprisingly.

It's testing to see
if you can penetrate something

which means you're going
to check to see

whether you can break
into a particular thing.

Whether it's a server or
in applications depending

on the type of Engagement.

You've got you may have
the ability to try to break

in physically to a location

but primarily but you're
going to be doing

with penetration testing

is you're going to be trying
to break into systems

and networks and applications.

And that's the kind
of what It's all about

and this may actually involve
social engineering attacks.

So it may require you
to make a phone call

to somebody and get them
to give you their username

and password or some other type
of social engineering attack

where maybe you send a URL
via a crafted email.

Sometimes it's just strictly
a technical approach.

We're running scans

and you're running Metasploit
and you're gaining

access that way or maybe
some other type of Technology.

Application sort of connection,

sometimes it's physical access
that you need.

So in order to get access
to a particular system,

if you can get physical access
then maybe you can get in

so that was all about

that's what exactly
penetration testing is.

It's checking whether you
can get into a system

whether it be physically
or on a network.

So what are the goals

of penetration testing the goals
would be to assess weakness

in an organization
security postures.

We want to figure out
what they're vulnerable

so that they can go and fix
It's these problems you want

to help them understand
their risk positions better

and what they can

or may be able to do
to mitigate those risks

and ultimately you want
to be able to access systems

in a particular way
to find weaknesses.

So those are really
sort of the goals

of penetration testing now
from a result standpoint

when you're done you're testing
what you are going to do.

Well, you're probably going to
generate a report and by that,

I don't mean you're going
to run some automated tool

and you're going
to get it to generate.

The report for you,

you're actually going to give
that to the client.

You're actually going to give
you a report to the client

and then they're going to write
you a really large check.

So that's not really
how it works.

You're going to write a report
detailing the findings

in a detailed way

so that it includes
what did you do to find out

what you actually found out

and how you can actually
mitigate that particular risk.

So you should really include
remediation activities in order

to fix this vulnerabilities

that you find and it's
pretty easy to walk

around saying hey,

that's a problem
and that's problematic.

And that's a problem.

That's really not a lot of value

in that where there's
a value is that hey,

that's a problem.

And here's how you
can go about fixing it.

So let's talk about the scope
of penetration testing.

So firstly you want
to actually realize

how big is the breadbox
and how specifically what is it

that the you two of the two
of you have agreed

that being you
the ethical hacker

and the other guy being
the authorized person to give

you permission to ethically
hack specifically agree

that you can do
penetration testing.

And you can Target them as
an organization or decline

and what you have agreed
to our any exclusions

or any sort of areas

that they say you're not allowed
to touch so anything so

like if they've got
a database server,

maybe there's a lot
of really sensitive data on it

and there's a little hesitant

and they may put don't touch
this thing clause in the school.

So there are a lot
of different reasons

why they may exclude
areas from the scope

and if they exclude them
then trust their reason

and listen to them

what They have to say
in terms of this is

what we want you to accomplish.

So along those lines you
really need to get sign off

from the target organization.

Now, we've talked
about this before

and this is certainly all
about the ethics then trust

and it's also about legality

because if you do something

that you don't have
permissions to do you

could be prosecuted for that.

So definitely get the scope
very clear in writing

and with signatures attached
to it as to what you can

and what you can't do

and always get approval
from the right people

and make sure you get Buddy

who has the right level

of permissions and is
the right level of management

so that they can sign off
on its understanding

and accept the risk

that is associated
with a penetration test.

So let me talk a little bit
about security assessments

and how they differ
from penetration tests.

The security assessment
is a hand

in hand approach with clients.

So you would walk in doing
a collaborative thing

where you're a trusted partner
and you are live with them

and your goal
isn't to penetrate them

and point out all the things.

That are really bad,

but it's to get a full
assessment of the risk

that the organization is exposed

to and you would probably
provide more details about fixes

that maybe you would
in a penetration test.

Now what we're going to do
is we're going to walk in

and make sure

that the policies

and procedures they have
in place are really

what they need
for the organization

and the risk appetite

that they've got
and we're going to make sure

that the policies
and procedures have controlled

that can tell us

whether they are being
actually adhere to or not.

Procedures and policies
are being followed

a security assessment is
probably a little bit

more comprehensive

than a penetration test

and you would look
at more factors to assess

the security postures
of the organization

in their overall risk

and you would tailor the output
based on the risk appetite

and what they're most interested
in and that's not to say

that I'm going to tell them
what they want to hear.

But if there's something
that they know and I know

that they're just
not going to do

I'm not going to be making
a big deal out of it

because they're already
Eddie aware of it

and I'll make a note
of it in the report just

for a complete the sick,

but I'm not going to go out
in a lot of details.

So it's really kind of

a hand hand collaborative
approach where again,

you're not just saying

that they want us to say we're
providing some real security

and risk guidance
towards her activities

and other things

so it may provide
an unrealistic view.

So you've got a week.

Let's say to do
this penetration test

against your target.

Now, you're going to have
to go in you're going

to have to get setup.

You're also going to have
to start doing a bunch

of scans and make sure

that Gathering information

and screenshots and data
for your reports

you're going to have to do
all sorts of activities.

Also during the course
of that week.

You're going to be engaged
in probably beginning

to write your report

and getting a sense of
what is going to say

and what's going to be in it.

If you don't actually
get any major penetration

during the course of that week
the organization may feel

like their code and code secure.

That's one of the reasons
why penetration testing

while really sexy
and show is nice and all

but if an organization walks
out of it it believing

that in a week,

you didn't manage to get
no get the Keys of the Kingdom.

They might must be secure
that's really misguided view

because I'm dedicated skilled
and motivated attacker

isn't going to just take a week
or some portion of that fee.

They're after something
they're going to dedicate

themselves to do it
and really go after it.

So just because you didn't find
a penetration in some subset

of week doesn't mean

that they're secure and Illman
and in vulnerable to attacks.

It just means
that during the course

of that particular week
and The circumstances

that were in place you
can get a penetration

that was really
significant or major.

That's all it means.

It doesn't mean anything
beyond that and

if an organization
walks away feeling

like the secure they're going

to end up not fixing
the real vulnerabilities

that may be in place

that could expose them
to significant risks.

So that's penetration
testing its corpse its goals

and how it differs
to security assessments now,

it's time to go
over foot reading.

So what is footprinting well
for printing is getting an idea.

Via of the entire scope
of your target.

That means not just the scope

that you were given

which may be an address block
or it may be a domain name

that even maybe a set
of a truss blocks.

Now, what you want to do
is you want to figure

out all the information

that's associated with that
in great detail

as you can possibly get so you
want the list of domain names

as you're going
to go through this

you probably want some sort

of database or Excel
spreadsheet or something.

Track of all the information

because you're going to have
a lot of it at the end.

You want to be able
to find information quickly.

So having some sort
of in a notepad going

with your notes or

as I said spreadsheet
or a database.

So if you can get organized

in that way you want to keep
all those sorts of things down.

So in this case,

I want to do
some search on suppose.

Let's say Eddie
record dot go now.

I need Network block.

So so far we found out
that just made up IP addresses

because I'm just
putting information down,

but I need never be Block,

so you may have one IP address
that you can find externally

or you're going to want to hold

range of internal clocks and you
can do a little bit of digging.

If you aren't provided those you
want specific IP addresses

for critical systems web
servers email servers databases.

If you can find any
of these things

of those sorts and you
want system architectures

and what kind of stuff are they
running are they running Intel

are they running windows?

Are they running
some Unix systems?

What are they running?

What kind of Access
Control lists they have.

These are going to be To get
but you may be able to guess

them and you can guess
these by doing Port

can so what sort of responses
you get back from the port scans

with the filters and are
what you don't get back.

We'll tell you about
if there's an IDs

around or some you want
to do a system numeration,

or you can get access

to a system somehow you want
to know usernames group name.

So on so the basic idea

of footprinting is
gathering information now

if you can get access to system
somehow you want to no use

Names group names so you want
system banners routing tables

SNMP information if you
can get it DNS host names

if you can get those now,

this is for both internal
and external on the side.

If you're doing
an internal penetration test

or ethical hacking engagement.

You want to know the networking
protocols that are out there.

Are they using TCP IP,

or are they using some UDP

or are they on ipx
or SPX the using decnet

or appletalk or are they
using some sort of split DNS?

In other words?

Do they have internal DNS?

So was that give different foam

for the external and will it
give different information?

If you want to check for
remote access possibilities now

in the foot printing process

you want to be very exhaustive
you might want to try

and take out email addresses
server domain name Services.

I mean IP addresses
or even contact numbers

and you want to be very
exhausted with your approach.

You don't want to miss
anything out because

if you do that,

you can continue

and also provide some some
launching points for additional.

Tax or test that you
may be able to do but this

is definitely a starting point
of the types of information

that you need to have

as you go about
footprinting your target.

Now next thing

that we are going to see
is very interesting.

This is one
of the many common tools

that are out there
on the internet and

that is the Wayback machine
or also known as archive.org now

while it might not give you all
the information that you need

but it gives certainly
gives you a starting point

and what we're talking about
here is the Wayback machine

or archive.org so Just
give you a quick look

at what archive.org looks like.

Okay.

I already have it open out here.

So audio what you can see is

how a website look
like around some time ago.

So for example,

if you want to look at
with Google look like

so you just have to search
for Google out here and wait

for results to come back.

Okay.

So we see that Google goes
way back to 1998.

So that was the last capture
or the first capture other.

It was the first capture
by the Way back machine

and we can see

that it has a screenshot
of November 11th

and how Google looked so,

let's see what Google look
like in November 11th of 1988.

So this is what Google look

like it was there was
actually nothing to it.

It just said welcome to Google
Google search engine prototypes

and it hasn't link.

So yeah, this is what the Google
search engine look like.

It had a Stanford surge.

It had a Linux urge

and you could do
all sorts of stuff.

You could just put
the results now.

I'm trying to tell y'all is
you can see the evolution

of the website should time
to the Wayback machine

and this gives you rather
in informated look

into how website
has actually evolved.

Okay.

Now that we know what
for printing is

and how it falls into
the hole recognition process.

So let's go over a couple
of websites to do a little bit

of historical thinking
about companies and the types

of infrastructure

that they may be using

and this information
of course is useful

so that we can narrow
down our Focus.

Us in terms of what we want
to Target against them

for attacks now over time
we've improved our awareness

about what sorts

of information we may want
to divulge so several years ago

you may have gone to a company's
website and discover

that you could get
email addresses and names

of people in positions

that you may find relevant

and there were all sorts
of bits of information

that could be used
against the company

and over time we have discovered

that those are pieces

of information probably
don't belong in a website

where they can be used
against the company

and so they've been pulled
off now The used to be also

that Google had the ability
to pull up information

that it had cash so far.

For example,

if a website is
no longer available or

if it was temporarily
down and offline.

There was a little cash button
that you can click

when you did
and the Google search

and you could pull up
that cast information.

So even though the website
wasn't available you can still

get information from Google's
servers now Google's remove

that so we don't have
that ability any longer.

However, there is
an internet archive

that we can Use so this thing
is called the Wayback machine

and I have it open out here.

So it's archive.org / web.

So archive.org is a website

that gives us information
about other websites

and how they look
like in years ago

and by so I'm going to go
to the Wayback machine

which you can see is
at the archive.org

and I'm going to go and try and
search for Eddie record dot go.

So now we're going
to take a historical look

at Eddie record dot goes website

and you can see we've got
some years and they've got

information going back up

to Thousand thirteen,

so let's look at what
this website looked

like when it was just 2013.

Okay, there doesn't seem
to be any snapshots out here.

I wonder what's going on.

Okay.

So let's go 2014 and
the first snapshot seems to be

on the September 12th of 2014.

Actually.

It's on May 17 to so
let's see what

that looks like.

Okay.

So this is what Eddie
regular look like back in 2013

or other 2014 September
12 2014 to be actually exact

now you can see

that the we have
some live classes

and all this pictures there

and they've got this weird
picture of the sky

and here I don't know why
that was a thing back in 2014.

Now we can browse more
advanced screen shots

or rather the screen shots
that were taken later on and see

how this company has evolved
with this infrastructure

and the way it actually
lays out its content.

Okay, so it still hasn't evolved

but I can go a couple
of years ahead and see

what this has actually
evolved into so

if I would go to December 2016,

so this is what it looked
like in 2016 and we can see

that they've added
this weird box out here

about brides and courses
they have other search bar

that kind of looks weird,

but it's mostly
because my Internet is slow

and it's not loading
all the elements.

They've also changed

how they've actually laid
out the courses we can also.

Oh see a change
in the prices, I guess.

So, yeah, this tells us

about how it evolves
as complete website.

Now this other website I want to
talk about is called net crap.

Now next craft does

internet research including
the types of web servers

that companies run and they
have a web server service.

You can see here as we scroll
the Apache server service has

sixty four point three percent
of the internet Market,

of course,

and that's followed by Microsoft

with 13% interesting information
may be useful information,

but even more useful
than that is looking.

But different companies
Run for the websites

and you can see here.

Okay.

So let's try and search
for Eddie Rekha dot code here.

So let's just put
in the website URL

and that net craft
generate the site report.

So as you can see

that some stuff
is not available.

You know that the net
block owner is

by Amazon Technologies name
server is this thing right here?

DNS admin is
AWS DNS host Master.

We also have the IP address
we can go for a wire look up.

Up the IP on virustotal
you can do that.

There is no IPv6 present.

So that's some information

that we can see so we
can obviously opt-out not

Target IPv6 ranges.

Then there's also reverse DNS

then we also have a bunch
of Hosting history.

So this is a history
of it and we know

that it's hosted on a Linux
system with an Apache web server

and it was last seen

and this was when it
was last updated.

So this is some very
useful information.

You can also get information
on If like Netflix,

so if you just type, okay

I said I just
spelled that wrong.

So let me just change
from the URL out here.

So if you go and die for
netflix.com and you'll see

that it will show you
all sorts of information.

So as you see that it's
on an e WS server.

It's Amazon data services,

Ireland and this is
all the hosting history

that it goes along

with it has some send the
policy Frameworks domain-based

message authentication

and Reporting confirmations.

And there's all sorts

of information that you
can get about websites

and web servers from net craft.

So the Wayback machine

long with net craft make up
for some interesting tools

that are available
on the internet from which

you can do a little bit
of your reconnaissance recess.

Okay.

Now that we have gone
over net craft

and the Wayback machine now,

it's time to actually

get to know how to use
the little information

that the side actually provides.

So what the next topic

that we are going to go
over is using DNS to get

more information now we're going
to be Going over to land.

This is called
who is and the utility

that is used to query
the various Regional internet

registries the store information
about domain names

and IP addresses and let
me just show it to you

about all the internet
registries are there.

So I have Aaron dotnet open

out here and these are
the internet registries

that provides the isps

and looks over the Internet
control as a whole.

So here we have afrinic we
have up next we have Aaron

we have lacnic
and we have ripe NCC

so These are all the regions
and all the different types

of stuff that they support
all the different countries.

You can look at the map

that it is pouring out
here by just hovering

over the providers.

So as you can see all
these Brown region

out here is Africa

after Nick then we have up next
which is black or grayish thing,

which is India and Australia

and quite a lot of issue
then we have iron

which is a lot of North America
in the United States me.

Then this lacnic
which is mostly the Latino side,

which is a South American part.

Then we have the rest of Europe

which is ripe NCC
and this is the part

that ripe NCC is providing
internet to okay.

So that was all
about the internet registries.

Now, let's get back to the topic

and that is using DNS
to get more information.

Now for this we are going to
be using a Linux based system.

So I have a bunch of running
on my virtual machine

out here and let me
just log into it.

So firstly we are going
to be using this Square.

I recalled who is that looks up

these internet registries
that I just showed you.

Let me just quickly remove this.

Okay.

So for acquiring information

from the regional internet
registries that I just talked

about you can use

who is to get information

about who owns
a particular IP address.

So for example,

I could do who is and
let's see I could do

who is Google or rather
netflix.com and we can get

all sorts of information
about Netflix so we can see

that we Of the visit markmonitor
then let's see.

Let's go up and look
for all sorts of information

that has been given to
us by this who is query.

So as you guys can see I just
went a little bit too much.

Okay.

So registry domain ID,

we have the domain ID
where it is registered as

a registered URL is markmonitor.

Okay.

So this is for marking actually
now the creation date is 1997.

So you haven't realized Netflix
been around for a long time

and it's been updated on 2015.

And registry expiry date

as we see is 2019 that's going
to actually go off this here.

Then this is all
useful information

so we can see all sorts
of domain status

the name server URL the DNS SEC
that it says unsigned.

This is very useful information

that is being provided
by very simple query.

Now, if you want to know who
owns a particular IP address,

so let's see if we get back
the IP address out there.

We should have got
back the IP address,

but it's kind of lost on me.

So To get back the IP address
also for a domain name service.

So, you know,

so you could use
this command called dick.

So your dick netflix.com.

Now as you guys can see

that it has returned a bunch
of multiple IP addresses

at these are all
the IP addresses

that Netflix's so I
could do something like

if I was trying to check out

who all the certain
IP address and for example,

I have got one
of these IP addresses,

but let's just assume
I don't know

that actually belongs to Netflix

so I can go who is
50 4.77 dot hundred and eight to

and it'll give
me some information

so As you guys can see
it is giving us a bunch

of information as to who this is
and how it is happening.

So we see that it is

from Aaron dotnet and so
we can very smartly assume

that it's from the North
American part know

we can also see
that it's in Seattle.

So our guess was
completely right.

So it also gives us a range.

So this is
something very useful.

So if you see we now have
the rain age of the IPS

that might be being
used by this guy.

So we indeed have 54 and it
says it goes up to the 54.

There's also 34 lat now.

Let's check that out and see
what information we get set

who is and let's check it out.

What was the IP

that we were just seeing
is 34.2 49.1 25.1 67.

So 34.2 49.1 65 I don't know.

Let's see.

You can also put in
a random IP address.

It don't really matter

and they'll give
you the information.

So let's see is this

and some IP address even
this seems to be an error

and IP address
and it's also based in Seattle

and we got
a bunch of information.

So that's how you can use the

who is query

and the query do actually
get all sorts of information

about the domain name service
and get information

from a DNS basically.

So now let's go
over some theoretical part

that Is for DNS.

So using DNS to get
information so firstly

what is the domain name service?

And why do we need?

So a domain name service is
a name given to an IP address

so that it's easy to remember.

Of course you it's easy
to remember names

and demonics rather than a bunch
of random weird numbers.

Now, this was mainly

so that we can map names
to IP addresses and we can get

the a bunch of information
from the host name resolution.

So that's the purpose
of IP addresses now

we Also be looking at
how to find network ranges.

Okay.

Now before we get
onto actually moving on

to how to find out
the network ranges,

let me just show you
how you can also use

who is so who is suppose
you want to know the domains

with the word feu in it.

So you could go

who is fool and this
will give you a whole bunch

of things but hafu exist
and all the sorts of foods

that there is on the internet.

So that was
one interesting flag,

and if you want to know

how to use more about Who is
you could just go - - hell?

Yes.

Yeah.

So this is all
the types of stuff

that we can do with who is

so you can set the host
we can set the board

that we want to search for then
we can set with the elf laughing

and find one level
less specific match

and we can do an exact
match to an inverse

look up for
specified attributes.

Then we can also set the source
we can set verbose type

and we can choose

for request template
with this bunch of stuff.

Can do so you could suppose say

who is verbose and suppose
any record dot coal

and I'll give you
a verbose version

of the right database
query service objects

aren't RPS out format
the right database objectives.

So, okay.

Let's try something else
like who is netflix.com?

Okay, I'm sorry.

I was supposed to be were both
and I kept doing Edge silly me.

So you do V and that will give

you a much more like this
is the right database again.

And I think
I'm doing something wrong.

Okay, just for that thing.

OK V and tight okay,

or let's just see
that's let me just show you

how to use video primary
keys are returned.

Only primary Keys.

Okay.

Let's see.

Let's try that out.

Okay, so it seems to be

that this is a ripe
database query service

and objects are
in our PSL format.

So it won't really
work for that thing.

And it also says

that no entries found
because this error

so this is for
some layer lessons.

So for now,

I hope I gave you a good idea
of how to use Hue is

like you could Just go ho is

then some IP address 192.168.1.1
or some Gabriel just like that

or you could just go
for a domain name service

like Facebook and get all sorts
of information about Facebook

when the query actually
returns you something.

Okay.

So let's move on

to network range is now now
in this part of the video.

We are going to be going
over the utility called who is

which is used for getting
information from the DNS.

Now, let me just show
you a website.

Get out here.

So this is the regional
internet registries.

So the internet registries
are used to store information

about domain names

and IP addresses and there are

five Regional internet
registries first is iron,

which is responsible
for North America.

So that would be the US and
Canada then we have laugh make

which is responsible
for Latin America

and portions of the Caribbean

then there's ripe

that's responsible for Europe
and Middle East

and Central Asia.

There's afrinic which is
responsible for Africa.

And finally we have up next

which is responsible
for Asia Pacific Rim.

So, that's the Regional internet
registries and as I said

who is responsible
for acquiring information

from the various
Regional internet registries

as you can use who is to get
information about who owns

a particular IP address,

for example, let me just open
up my Ubuntu system.

Let me clear this out first.

So as I was just saying,

for example, you could go
who is facebook.com.

Okay.

So as you guys can see
we could find out

pretty quickly about who owns
a particular IP address.

So for example,

I could do who is
in just go facebook.com

and tells me about who it
belongs to a also gives you

who owns a particular IP address

and who's responsible
for them from the information.

You can get email addresses.

I belong to
a particular company.

This one has an email address

for Tech contact
of Ip reg address it

so you can get all sorts
of email addresses

attack contacts and all sorts
of stuff out there

the Database contains
only.com and dotnet

and all sorts of information.

Now.

I want to query
a different IP address

and different information

belongs in the different
Regional internet registries,

of course,

so if I want to go
to a particular database,

I will have to use
the minus H flag

so I could do who is Aaron net
and remember the IP address

and I'm going
to query that again.

And of course I get
the same information back

because I went there

so you could just go

who is Edge and then follow it
with an IP address.

So something like 30 4.25

the 176 the 98 so that's
just some random IP address.

I just made up and it says
that who is option?

Okay.

So it's a it's a capital H.

Okay.

So let's see

that and we get all sorts
of information back from that.

So area a Darren and all sorts

of stuff now I
can get information

about domains as well.

So if I can query
something like netflix.com

and I can find out that this is

that actually Netflix

and there's an
administrative contact

and the technical content that I
need to see the difference.

Main server so service

that foot have
authority of information

about the DNS entries
for that particular domain.

You can also see
other information like

when the record was created

and whole bunch
of different phone numbers

that you contact an
additional storing information

about IP addresses
and domain name.

Sometimes it will
store information

about particular host names

and there may be other reasons
why you would store a hostname

or particular information

about hosting on
the system where the one

of the rare rirs now

if I want to wanted to look
up something specifically So

once I have found

that I could know do a look up

on who is supposed say
something like who is full.

So let's say who is fool.

Now if you already don't have

who is installed you
can easily install it

by just going up to install

who is on your Unix system
and that should do the trick

and then you can start use
this really Nifty tool.

Okay, so that was all

about using who is now let's get
on to actually using

how to Network ranges
for a domain.

Okay.

So now let's talk about how we
are going to be going over

and fighting next ranges.

So suppose you bought it
at engagement and you only

know the domain name

and you don't know much

beyond that and you're
expected to figure out

where everything is
and what everything is.

So how do you go
about doing that?

Well use some of the tools that
we either have been talking

about or will soon be talking
about in more detail.

And the first thing
I'm going to do is I'm going

to use a domain name
that you record.com

and I'm going to look up at you
like a DOT go and see

if I get get an IP address back.

So let's just head over there
and go poo is Eddie record

or not cool,

or we could use
the host keyword.

So as you see we get
an IP address back

and that is 34 the to dander

to 30 the 35 and that is
the IP address and you see

that I've got back
an IP address.

So here's just an IP address

and I don't know what
that IP address belongs to

and I also don't know
how big the network range

or network block is

that's associated
with so what I'm

Do is a who is and I'm going
to look up with Aaron

who owns it IP address

so you can basically go
who is 34.2 10.2 3935.

So as you guys can see

that gives us a bunch
of information and

who is now this doesn't seem to
have a very big Network range,

but unlike something
like Netflix.

So suppose we were

to do something like host
netflix.com and see See now.

We have a bunch of IP addresses.

So suppose we will do
who is let's see

who is 52.99 the $40 147

now I'm expecting Netflix
to be a much larger company

and have a better.

Yeah now see we get net range.

So this is the network range
that we're talking about.

So we had a random IP address

and now we have found
the network range.

So that's how
Find network ranges

and this can be very useful.

So this gives me evidence

that netflix.com has a presence
on different addresses.

The one I have also

located by looking up
that particular host name.

So I've got one address
here that I can look at.

Let's take a look at the website

because let me
different address.

Now if I didn't have
that I could also go

and do something
like an MX flag.

So let's see I could go dig

and this will give us
all the male's so dig MX.

And let's see.

Let's see what MX
does actually you go help

so we could do dig -
Edge for a list of options.

So these are all the options
that we have and the one

that we're going to use
is something like this.

Do you think MX and we say
something like netflix.com.

So these are all
mailings and mx's

that we have gotten from Netflix
and this is information

regarding it's still
producing information.

That's a big thing to produce.

Okay.

So as I was just
saying you can use

the MX flag I could get back all
the mail handlers in this case

and their mail is being handled
by Google and let's see wait,

let's go until then
it's going to tell me

that Google is not particularly
surprising and other things

that you can do is check
for different host names

since I'm assuming DNS
probably doesn't allow

Zone transfers since most DNA.

Has servers don't anymore,

although they used to you
may have to start guessing

so I could do something like
Web Mail said we find out here.

So it's showed us a dump of all
the ascending memory stuff.

Okay, so that was all

about finding Network
ranges now moving on

to our next topic is using
Google for recognizance.

Now some people also call
this Google hacking now,

if you know how to use Google

to exactly Target and find
what you are looking for.

Google is an excellent tool
for recognitions purposes.

And today.

I'm going to show you
how you could use Google exactly

for your searches.

So first of all,

let's go Open a tab
of Google so open up here.

So let's go to google.com.

Ok.

So now we're going to be talking

about how we can use Google to
actually gain some information

or some targeted information.

So this is in general called
Google hacked now

when I say Google hacking
I'm not meaning

by breaking into Google
to steal information.

I'm talking about making use
of specific keywords

that Google uses to get
the most out of the queries

that you submit.

So for example,

a pretty basic one is the use
of quotations you go things

in order to use Civic phrases.

Otherwise Google will find pages

that have instances

of all those words rather than
the word specifically together

in particular order.

So I'm going to pull this query
up and this shows a list

of let me just show it to you.

So you go index off now.

This is showing us an index
of all the films now.

This is basically all
those index of size

that you want.

So as you guys can see the show
this index of all sorts of films

that are there now you
can Use index of and you see

that we have also

an index of downloads
or something like that.

-.com such download

and it is an index
of all sorts of stuff.

Now you can go into some folder
and check them out G Jones.

You weren't EG Perico.

I don't know what these are
but some sort of self.

And this is how you
can use Google Now.

Let me just show you
some more tricks.

So you can use this
suppose you're using Google

to find for something
like a presentation

so you could use something
like file type.

DP DX and it'll search
for every type of file there.

That is Peabody.

Okay.

Let's try some other
side PVD so config.

Okay.

So this brings up all
the types of files

that have some configs in them.

So some gaming configuration

as we see this initial
configuration of Liverpool.

Now, you could also use
something like the sing and URL

and you can use
some other route.

And this will give
you all the things

that route in their URL.

So King rude and Digital Trends

and how to root Android
so fasten the root

and suppose you want
to say something like all

in file type or suppose.

You want some extension
so so dot P BTW the pptx.

Does that work?

Let's search for
JavaScript files.

Okay.

I think it's JS.

Okay, that doesn't seem
to work either.

This shows us all the things
that she estimate.

No, it's just external JS.

I'm doing this wrong.

So you could use file type.

So let's see file type
and we go see doc.

So these are all the documents

that you could find
at the file type thing.

And you could also
do GS, I guess.

Yeah.

This is give you all
the JavaScript files are there.

So this is how you can use
Google to actually narrow

down your searches

to suppose you want
a particular set of keywords,

and we want to make sure we get
the password file from Google.

Okay.

So now let's go

into more details
about the various things.

You can find
using Google hacking.

Now while Google hacking
techniques are really useful

for just general
searching in Google.

They're also useful
for penetration testers

or ethical hackers.

You can narrow down information

that you get from Google you
get a specific list of systems

that may be vulnerable

so we can do things
like look for are pages

that do in the title error.

So I'm going to get
a whole bunch of information.

So suppose like we go in title
and we say error So

as that we get
all sorts of stuff

and we can do
the mines Google part.

So if you don't mind is
Google not show you the stuff

that's from Google.

So we get a variance
documentation pages

about different vendors
and the errors

that they support.

So here's one doc
about Oracle about Java error,

but you know something more
specific we may be able to get

errors about all sorts
of other stuff.

So this is how you could use
the Google hacking technique

to your own advantage
of your penetration tester.

Now, let's also show
You something called

the Google hacking database now.

This is very useful
for an ethical hacker.

Now on the Google hacking
database was created

several years ago by
a guy called Johnny Long

who put this Google hacking
database together to begin

to compile a list of searches

that would bring
up interesting information.

Now Johnny has written a couple
of books on Google hacking.

So we're at the Google
hacking database website here

and you can see them talk

about Google Docs
and all sorts of stuff.

Now you can see

that we can do all sorts
of search like and you

are Elsa BC B SP this brings up
some portal Pages now out here.

You can bring up some password
APS password and URL.

Now this will give
you all sorts of stuff

on Google suppose you go and URL
like a PS password.

Now, you can get all sorts

of stuff like which have
passwords in their URL.

So maybe you can just guess
a password from there to now

that was Google hacking

so Google hacking
entries and they also,

Number of categories

and that you can look through
to find some specific things.

So you may be interested
in of course

and you will search
specific information that you

may be looking for with regards
to specific product.

For example, let me
just show you XY database.

These are all
the certain types of stuff.

You can go through out here.

And as you see we have all sorts

of sound like is
an SQL injection thing.

This is something
regarding Pier archived ours.

So these let you get a foothold
in the some password cracking.

Alms and you can do
some Brute Force checking

and you can see here

if it talks about the type
of searches and what it reveals.

You can just click here
on Google search engine

will actually bring up
Google fit a list of responses

that Google generates.

So let's look at this one here.

This type is a log.

So this is something
about cross-site scripting logs

and we can also
see some party logs

if I was not wrong

so some denial-of-service POC
and we can see a bunch of stuff

and if you continue
to scroll down there,

Our interesting information

in here so somehow
somebody's got a party log

that has a lot of information.

They've got it up
on a website and basically

bunch of information

that you can see you can also
get some surveillance video

sometimes and you can look
into them and this basically

how you could use Google.

So it's basically a list of
queries that you can go through

and this is a very useful site

if you are a penetration tester
and looking for some help

with your Google
hacking terminologies,

so that's it for

Or Google hacking now.

Let's move on.

Okay.

So now it's time
for some networking fundamentals

and what better place
to begin with dcpip.

Now we're going to be talking
about the history of dcpip

and the network

that eventually morphed
into the thing

that we now call the internet.

So this thing began
in 1969 and it spun

out of this government
organization called arpa

which Advanced research
projects agency and they

had an idea to create
a computer network

that was resilient
to a certain type

of military attacks

and the idea was
to have This network

that could survive certain types
of war and warlike conditions.

So our percent out this request
for proposals to BBN,

which is Bolt beranek and Newman
and they were previously

and acoustical consulting
company and they won

the contract to build

what was called the arpanet.

The first connection
was in 1969.

So that's where we get the idea

that the internet began
in 1969 and the internet

as we call it now Then
Shall We Begin but arpanet it

and often it has a long history

that goes goes through NSF net

in 1980s and after arpanet
was sort of decommissioned

and a lot of other networks
were folded into this

this thing called nsfnet

that then turned into
what we now call the internet

and once a lot of other
networks were connected

into its first protocol
on the arpanet

initially there were
18 to 22 protocols,

which is very first protocol
defining communication

on arpanet and it
was called 1822 protocol

because BBN report
1822 which describes

how it works shortly
and after that.

It was just think all
the network control program

and the network
control program consisted

of arpanet host-to-host protocol
and an initial control protocol.

Now, they're certainly
not a direct correlation

or an analogy here.

But if you want to think

about it in particular
where you can say

that the arpanet host-to-host
protocol is kind of like UDP

and initial connection
protocol or ICP.

It's kind of like TCP.

So the host-to-host
protocol provided

a unidirectional flow control
steam stream between hosts.

Which sounded a little bit
like UDP and ICP

provided a bi-directional pair
of streams between Two Hosts.

And again, these
aren't perfect knowledge.

He's but the host-to-host
protocol is a little I bit

like UDP and ICP is a little bit

like TCP now now
the first router was called

an interface message processor
and that was developed by BBN.

It was actually
a ruggedized Honeywell computer

that had special
interfaces and software.

So the first router wasn't
Roundup built piece of Hardware,

but it was actually
an existing piece of hardware.

Especially published
for this particular application.

So Honeywell had this computer
that they made out and BBN took

that and made some specific
hardware and faces

and build some special software

that allowed it to turn

into this interface
message processor,

which passed messages
over arpanet from one location

to another so

where did I become
hint here in 1973?

So I became in here
as well in 1973

as I just said and a guy
but name of Vint Cerf

and another guy by the name
of Robert Kahn took.

The ideas of NCP and
what the arpanet was doing

and they tried to come up
with some Concepts

that would work for the needs

that the arpanet had
and so by 1974.

They had published a paper
that was published by the IEEE

and they propose
some new protocols.

They originally proposed
the central protocol called TCP

later on TCP was broken into TCP

and IP to get away
from the monolithic concept

that TCP was originally
so they broke it

into more modular protocols
and thus you get TCP and IP.

So how do we get to our version?

Or which is ipv4

since that's the kind

of Internet that we're using
right now version 6 is coming

and has been coming
for many many years now,

but you're still
kind of version for

so how did we get here
between 1977 and 79

and we went through version 0
to 3 By 1979 and 1980.

We started using version 4 and

that's eventually became
the de facto protocol

on the internet in 1983

when NCP was finally shut down
because of all the hosts

on the arpanet,

but we're using TCP IP.

By that point in 1992 work began

on an IP Next Generation
and for a long time,

although the specifications

in the rfc's talked
about P&G eventually

and I PNG became known as IPv6.

You may be wondering
where ipv5 went.

Well, it was
especially purpose protocol

that had to do something

with streaming and certainly
not a widespread thing.

One of the differences
between ipv4.

And IPv6 is

that IPv6 has a 128-bit address
which gives us the ability

to have some Recklessly
large numbers of devices

that have their own unique
IP address IP V4 by comparison

has only 32-bit addresses.

And as you probably
heard we're well

on our way to exhausting
the number of IP addresses

that are available
and we've done a lot

of things over the years
to conserve address space

and reuse address space

so we can continue to extending
to the point till

where we completely
run a 5p V4 addresses.

Another thing about IPv6
is it attempts to fix

on the inherent issues and IP

and some of those has to do
with security concerns

and there are certainly
a number of flaws and ipv4.

I'm going to start working
on IP Next Generation or IPv6.

They try to address some
of those concerns in some

of those issues and they
may not have done it perfectly

but it was certainly an attempt

and IPv6 attempt to fix
some of the issues

that were inherently in IP.

And so that's the history of
TCP IP still very reach today.

Okay.

So now that we've discussed
a brief history on TCP IP

and how it came about
to the TCP IP version

4 Cisco's the model itself.

Now we're going to be
discussing two models.

And those are the OSI model
and the TCP IP model.

Now as I said will be talking
about the OSI and TCP models

for Network protocols
and the network Stacks OSI.

First of all is the one

that you see out here is the one
on the left hand side

of the screen and OSI stands for
open systems interconnection.

And in the late 1970s,

they start working on a model
for how a network stack

and network protocols would look
originally the intent was

to develop the model
and then developed protocols

that went with it.

But what ended up happening was

after they develop the models
TCP IP started really taking off

and the TCP IP model was

what went along with it
and much better

what was going on with TCP IP,

which became the predominant
protocol and as a result

The OSI protocols
never actually got developed.

However, we still
use the OSI model

for teaching tool as
well as way of describing

what's going on
with the network stack

and the Applications

you'll often hear people talking
about different layers.

Like that's a little too problem

or render layer
3 space now continuing

through these lessons.

I'll refer occasionally
to the different layers.

And when I do that,
I'm referring to the OSI model.

So let's take a look
at the OSI model starting

from the bottom.

We have the physical layer,

which is where all the physical
stuff lives the wires and cables

and network interfaces

and hubs repeaters switches
and all that sort of stuff.

So all that's all physical stuff
is sitting Sitting

in the physical layer now

sitting Above This is
the data link layer.

And that's where
the ethernet protocol

ATM protocol frame relay.

Those are things live.

Now.

I mentioned the switch

below the physical
the switch lives at layer 1,

but it operates at layer 2.

And the reason it
operates at layer 2 is

because it looks
at the data link address

and the layer
to our physical address

and that's not to be confused
with in the physical layer.

It does get a little
mixed up sometimes

and we refer to the MAC address

now the MAC address is
not the physical address.

I'm talking about it

is the message
authentication code dress

on the system as
so the MAC address

on system as a physical address

because it lives
on the physical interface

and bound physically.

However that Mac address

or media Access Control
address lives at layer

2 at the data link layer
the network layer,

which is right above at layer 3.

That's why the IP lives
as well as icmp ipx

and from ipx SPX

to the protocols from novel
routers operate at layer 3.

Three and at layer 4 above that
is the transport layer.

That's the TCP UDP and SPX again
from the ipx SPX suit

of protocols number
of that is the session layer

and that's layer 5 and

that's a plot of SSH as well
as several other protocols.

Then there's a
presentation layer

which is a layer 6 and
you'll often see people refer

to something like jpeg
or MPEG as examples of protocols

that live on that layer then
there's a presentation layer,

which is the final layer

which is layer 6 and you'll
often see people refer

to something like Jpeg,

or MPEG as example the protocol
that live at that layer

and then the live at that layer
which is the presentation layer.

Finally.

We have Leo 7,

which is the application layer
and that's actually TP FTP SMTP

and similar application
protocols whose responsibility

is to deliver and use
the functionality.

So that's basically
the OSI model and

that's the seven layers
of the OSI model

and there's some important
thing to note here.

That is when we
are putting packets

onto the wire the packets
get built from Top.

Top of the Stack Down

by from the top of the stack
to the bottom of the stack

which is why it's called
a stack each layer sits

on top of the other

and the application layer
is responsible for beginning

the process and then

that follows through
the presentation session

and transport layer and down
through the network data link

until we finally drop it on
the wire at the physical layer

when it's received
from the network.

It goes from the bottom up

and we receive it
on the physical

and gets handled
by the data link

and then the network
and till the application layer.

So basically when a packet
Coming in it comes in

from the application goes
out from the physical

and then we're going out also,

it goes from the physical
through the data link,

then the network
transport session presentation

and application and finally
to the Target system.

Now what we're dealing with is
an encapsulation process.

So at every layer on the way
down the different layers

add bits of information
to the datagram all the packet.

So that's when it gets

to the other side
each layer knows

where it's demarcation pointers.

Well, it may seem
obvious each layer.

Talk to the same layer.

On the other side.

So when we drop a packet out

onto the wire the physical layer
talks to the physical layer

and in other words
the electrical bits

that get transmitted by
the network interface

on the first system are received

on the second system
on the second system.

The layer two headers

have report by the first
system get removed

and handled as necessary.

Same thing at the network layer.

It's a network layer
the puts the IP header

and the network layer

that removes the IP header
and determines what to do

from there and so
on and so on again

while it may seem obvious

It's an important
distinction to recognize

that each layer talk
to each layer

while it may seem obvious.

It's an important
distinction to recognize

that each layer talk
to each layer.

And when you're building
a packet you go down

through the stack

and when you're receiving
you come up to the stack.

And again, it's called a stack

because you keep pushing things
on top of the packet

and they get popped
off the other side.

So that was detailed

and brief working on
how the OSI model is set up

and how the OSI model works now,

let's move on to the VIP model,

which is on the right hand side
and you'll notice

that there's a really
big difference here that being

that there are only four layers
in the TCP IP model

as compared to the seven layers
of the OSI model.

Now, we have
the network access layer

the internet layer the transport
layer and the application layer

in the functionality.

Now, we have the access layer

the internet layer
the transport layer

and the application
layer the functionality

that the stack provides is
the same and in other words,

you're not going
to get less functionality

out of the TCP IP model.

It's just that they've changed
where And functionality decides

and where the demarcation point
between the different layers are

so there are only four layers
in the TCP IP model,

which means that a couple
of layers that have taken

in functions from some
of the OSI models

and we can get into that right
here the difference

between the models
at the network access layer

in the TCP IP model

that consists of the physical

and the data link layer
from The OSI model.

So on the right here,

you see the network access layer

that takes into the account
the physical and the data link

layers from The OSI model

and the Left hand side similarly

the application layer
from the TCP IP model

and compresses all
the session presentation

and the application layer
of the OSI model

on the right the very
top box the application layer

and Compass has
the session presentation

and application layer
and on the left hand side

that of course leaves
the transport layer to be

the same and the OSI model.

They call it the network layer
and then dcpip model.

It's called the internet layer
same sort of thing.

That's where the IP lives
and even though it's called

the internet layer as
compared to the network layer.

It's Same sort of functionality.

So those are the really
big differences between OSI

and dcpip model anytime.

I refer to layers
through the course of this video

that I'm going to be referring
to the OSI model and in part

because it makes
it easier to differentiate

the different functionality.

If I were to say live
on function in the TCP IP model,

you would necessarily know

if I was talking
about a physical thing

or a data link thing

since there's more granularity
in the OSI model.

It's better to talk about
the functionality in terms.

Terms of the layers
in the OSI model

and that's the predominant
model The OSI model

and the TCP IP model

for Network Stacks Network
protocols and applications.

Okay.

So now that we've discussed
the TCP IP model.

Let's go over some
another important protocol

and that is UDP.

So what do you see out here

on your screen right
now is Wireshark

and we'll be going
over the users of our shark

and what it's useful for
in the sock upcoming lessons.

But for now, let me
just show you a UDP packet.

Okay.

So before we get

into the analysis of the packet
while it's still filtering,

let me just tell you
a little bit about you to be

so UDP is a protocol and
the TCP IP suit of protocols.

It's in the network layer.

That's a network layer
in the OSI.

So similar reference model
the IP network layer carries

the IP address

and that has information
about how to get back is

to his destination

the transport layer sits
on top of the network layer

and that carries information

about how to differentiate
Network layer applications

and that information about
how those Network application

gets differentiated is
in the form of ports.

So the transport layer has ports

and the network layer has
in this case an IP address.

And UDP is a transport layer
protocol and UDP stands

for user datagram protocol

and often call connectionless
or sometimes unreliable.

Now unreliable doesn't mean

that you can't really rely
on it unreliable means

that you can't just

that what you sent
is reaching the other side.

So 1 means actually
that there's nothing

in the protocol that says
it's going to guarantee

that the data Will Graham
that you send or the fact

that you send is going to get
where you wanted send it.

So the Tikal has no sort
of safety feature like that.

So you shouldn't use
this protocol that is used to be

if you want some sort
of safety net.

And if you needed that type
of safety net you

would have to write it
into your own application.

So basically UDP is
a fast protocol and that's one

of the reason why it's good.

It's also on the reason
why it's unreliable

because in order to get
that speed you don't have

all of the error
checking and validation

that messages are getting there.

So because it's fast it's good

for things like games
and for real-time voice

and video anything
where speed is important.

And you would use UDP.

So right here.

I have a packet capture.

So I'm using Wireshark capture
some buckets and let's check out

UDP packet so out here you see

that there are some freedoms

that says 167 bites on bio
167 bites have been captured

but we're not really interested
in the frame part.

You're interested in
the user datagram protocol.

But so here you can see

that the source board is
one eight five three

and the destination
Port is Phi 2 0 8 1

now it has a length
and it has a checksum and Tough.

So as you guys see
out here, well,

we don't really see
a bunch of information

what you only see
is a source port

and the destination port land
and there is also a checksum

so you to be doesn't come
with an awful lot of headers

because it doesn't need any

of the things that you see
in the other packet headers.

The only thing it
needs is to tell you

how to get the application
on the receiving host.

And that's where
the destination Port comes in

and wants the message gets
to the destination.

The destination needs to know

how to communicate back
to the originator

and that would be
Through the source port

or a return message.

So a return message
would convert The Source port

to a destination port

and send back to that board

in order to communicate
with the originator.

So we have a source port
and destination port

and the length is

a minimal amount of checking
and to make sure that

if the packet that you received
as a different from the length

that specify in the UDP header,

then there may have
been something wrong

so you won't may want
to discard the message to check

for more messages.

So the checksum also make sure

that nothing in the middle
was tampered with although it's

if there's some sort
of man in the middle.

Attack or something like

that a checksum is
pretty easy to manufacture

after you've altered the packet

so you can see here
in the message

that there's a number
of UDP packets some of them

just UDP the one look

and happens to be
from some Skype application,

I guess so talking
to Skype servers

and we've already got
the DNS now DNS also

needs some Fast Response times

because you don't want
to send a lot of time looking

up information about service
that you're going to before

because just to go to them.

So DNS server through all
throughout their queries

on to the Using UDP hoping
to get fast sponsors.

They don't want to spend a lot
of time setting up connections

and during all the negotiating

that comes at the
protocol like TCP.

For example.

So here you see
that the DNS is using UDP and

what we've got here is another
UDP packet for Destination

and all sorts of stuff

so you can see it out here

so you can see the checksum.

It's unverified checksum status

so you can check out all sorts
of stuff using Wireshark.

So that was about UDP
or The user datagram protocol.

Okay.

So now that we're done
with the user datagram protocol.

Let's talk about
addressing mode.

So addressing modes is

how you address a packet
to your different destination.

So there are three kinds
of addressing mode.

The first kind of addressing
mode is unicast.

This is pretty simple
one to understand.

So there is one destination
and one source

and the source sends
the packet to the destination

and it's it depends
on the protocol

that you're using
to actually address.

So if it's something

like TCP IP your Using
a bi-directional stream.

So the blue computer can talk
to the red computer

and the red computer can talk
back to the blue computer,

but you can also use
a UDP stream which is

like One Direction stream.

So it's not sure
if I'm using the correct word.

So it's a stream that
in One Direction.

I guess I'm driving
home the point here.

So if it's UDP only
blue is talking

and when blue stops
talking then read can talk,

but if it's dcpip blue and red
him talk simultaneously

at the same time now moving
on there's also so

broadcast now broadcast means

that you are sending
your bracket to everybody

on the network.

So broadcast messages
are very common

from mobile network providers

so many get those
advertisements saying something

like you have
a new postpaid plan

from Vodafone or as hell
or something like that.

Those are broadcast messages.

So it's one server
that is sending out

one single message to all
the other systems now,

there's also multicast now.

The cast is like broadcast

but selective now
multicast is used

for actually casting yours
your screen to multiple people.

So something like screen share

and you're doing it with
multiple people is multicast

because you have the option
to not show particular computer

what you are actually sharing.

So those are three modes

of addressing unicast
broadcast and multicast.

Okay now moving
on let's look into the tool

that we just used once and UDP.

That is why sure.

So what exactly is wash off?

So this utility called
Wireshark is a packet capture.

Usually meaning that
it grabs data.

That's either going out

or coming in of a specific
Network and there are a number

of reasons why
this may be useful

or important on the reason
why it's really important is

what's going on in the network
is always accurate.

In other words.

You can't mess
around with things

once they're on the network
or you can't lie about something

that's actually on the network
as compared with applications

in their logs,

which can be
misleading or inaccurate.

Or if an attacker gets
into an application they

may be able to alter the logging
now several other behaviors

that make it difficult to see
what's really going on

and the network
you can really see

what's going on.

Once it hits the wire.

It's on the wire and you
can't change that fact now

once it hits the wire

so we're going to do here
is a quick packet capture.

So let me just open up
our shop for you guys.

So as you guys can see

I have already washed
Shock open for us.

Let me just remove
the CDP filter that was there.

So why shock is Cheering.

So let's go over the stuff
that you can see

on the screen some important
features of our sharks

so that we can use it later.

So what I'm doing here

is a quick packet capture
and I'm going to show some

of the important
features of Wireshark

so that we can use
it later on now

when we're starting to do
some more significant work.

I select the interface
that I'm using primarily,

which is my Wi-Fi,

and I'm going to be go over here
and we'll bring up a Google page

so that we can see
what's happening on the network.

So let me just quickly open
up a Google page

as you guys can see
It's capturing a bunch of data

that's going on here.

Let me just open
up a Google base

and that's going
to send up some data.

Let's go back.

So it's dropping a whole bunch
of stuff of the network.

I'm just going to stop
that going to go back

and go back and take a look
at some of the messages here.

So some of the features
of a shock as you can see

on the top part of the screen.

It doesn't window

that says number time Source
destination protocol length

and info and those are
all of the packets

that have been captured
in the numbering starting from 1

and the time I'm has to do
with being relative to the point

that we've started capturing
and you'll see the source

and destination addresses

and the protocol
the length of the packet

and bytes and some information

about the packet
the bottom of the screen.

You'll see detailed information
about the packet

that has been selected.

So suppose I'm sales selecting

this TCP packet out
here so we can go

through the frames frame also

has an interface ID
is encapsulation type

and all sorts of information.

Is there about the frame
then we can look

at the source Port
destination Port see Stumble

the flag said the check sums,

you can basically check
everything about a packet

because this is
a packet analyzer

and a packet sniffer.

Now, you'll see

some detail information
about the back of that.

I'll be selected.

So I'm going to select so
the selected this TCP IP packet.

We see that in the middle frame
and says frame 290.

It means that it has
a 298 lat packet and the packet

that was capture 66 bites and we
grabbed 66 Bisons 528 bit later.

So you what do you see
out here was source

and the destination In
Mac address of the layer

to layer address

and then you can see
the IP address

of both source and destination

and says it's
a TCP packet gives us

a source Port destination port

and we can start drilling down
into different bits

of the packet and you can see

when I select a particular
section of the packet down

at the very bottom you can see

what's actually a hex dump

of the packet and on the right
hand side is the a sky.

So this is the hex hex dump

and is the a sky that
you're looking at.

What's really cool
about varsha gate is

it really pulls the packet
into it's different layers

that we have.

Spoken about the different
layers of the OSI

and the TCP IP model

and the packets are put
into different layers

and there's a couple
of different models

that we can talk about with that

but were shocked
does really nicely.

Is it demonstrate
those layers for us

as we can see here.

It is actually four layers

and in this particular packet
here we can also do something.

So I've got
a Google web request.

So what I want to do here is
I want to filter based on HTTP,

so I find a filter.

So let's see
if we can do an http.

And what I see here
is says text input

and it's going to get an image.

That's a PNG image.

And this is a request
to get the icon

that's going to be displayed
in the address bar.

So you also see something
called our pouch here,

which I'll be talking
about very soon.

So let's just filtering
be done now in the web browser.

It's a favicon dot Ico
that can do here.

I can select analyze
and follow TCP streams.

You can see all
the requests related

to this particular request

and it breaks them
down very nicely.

You can see we've sent
some requests to Spotify

because I've been using
spotify you actually listen

to some music then you
can see all sorts of stuff.

Like this was something
to some not found place.

So let's just take
the Spotify one and you can see

that we get a bunch

of information from
the Spotify thing.

At least you can see
the destination The Source,

it's an Intel core machine.

So the first part

of the MAC address the first
few digits is lets you tell

if it's what what is vendor ID
so Intel has its own member ID.

So F 496 probably tells us
that it's that's an Intel Core.

So why shock does this
really neat little thing

that it also tells us
from the MAC address what type

of machine you're
sending your packets

to from the back address itself.

So it's coming
from Sophos foresee

and going to an Intel Core
in the type is ipv4.

So that was all about Bioshock.

You can use it extraneously
for packet sniffing

and pack analysis.

Packet analysis come very handy

when you're trying
to actually figure out

how to do some stuff
like IDs evasion

where you want to craft
your own packets

and you want to analyze packets

that are going into the IDS
system to see which packets

are actually getting detected
its as some intrusion

so you can craft your bucket
and a relative manner

so that it doesn't get actually
detected by the idea system.

So this is a very Nifty little
tool will be talking about

how you can craft your own
packets just a little while,

but for now, Now,
let's move ahead.

Okay.

So now that we're done with
our small little introduction

and a brief views
on history of our shop.

Now, let's move on
to our next topic for the video.

That is DHCP.

Okay.

So DHCP is a protocol

and it stands for dynamic
host configuration protocol.

So DHCP is a network
management protocol used

to dynamically assign
an Internet Protocol address

to any device on the network

so they can communicate
using IP now DHCP.

Means and centrally

manages these configurations
rather than requiring

some network administrator to
manually assigned IP addresses

to all the network devices.

So DHCP can be implemented

on small or small local networks
as well as large Enterprises.

Now DHCP will assign new
IP addresses in each location

when devices are moved
from place to place

which means Network
administrators do not have

to manually initially
configure each device

with a valid IP address.

So if device This is
a new IP address is moved

to a new location
of the network.

It doesn't need any sort
of reconfiguration.

So versions of DHCP
are available for use

in Internet Protocol version
4 and Internet Protocol

version 6 now

as you see on your screen
is a very simplistic diagram

on how DHCP works.

So let me just run
you down DHCP runs

at the application layer

of the TCP IP protocol

stack to dynamically assign
IP addresses to DHCP clients

and to allocate
TCP IP configuration information

to It's TB clients.

This includes subnet mask
information default gateways

IP addresses domain name
systems and addresses.

So DHCP is a client-server
protocol in which

servers managed full

of unique IP addresses

as well as information about
line configuration parameters

and assign addresses
out of those address pools now

DHCP enabled clients send
a request the DHCP server,

whenever they connect
to a network the clients

configure with DHCP broadcasts
a request the DHCP server

and the request Network.

In information for local network
to which they are attached

a client typically
broadcasts a query

for this information immediately

after booting up
the DHCP server response

to the client requests

by providing IP configuration
information previously specified

by a network administrator.

Now this includes
a specific IP address as well as

for the time period also

called Lee's for which
the allocation is valid

when refreshing an assignment

a DHCP client request
the same parameters

the DHCP server May assign
the new IP address based

on the You said by
the administrator now

a DHCP server manages a record

of all the IP addresses it
allocates to networks nodes.

If a node is we are located
in the network the server

identifies it using its media
Access Control address now

which prevents accidental
configuring multiple devices

with the same IP address now
the sap is not routable protocol

nor is it a secure one DHCP

is limited to a specific
local area network,

which means a
single DHCP server.

A pearl an is adequate now
larger networks may have a wide

area network containing multiple
individual locations depending

on the connections
between these points

and the number of clients
in each location.

Multiple.

DHCP servers can
be set up to handle

the distribution of addresses.

Now if Network administrators
want a DHCP server to provide

addressing to multiple subnets
on and given Network.

They must configure
DHCP relay Services located

on interconnecting routers

that DHCP request
to have to cross

these agents relay messages.

Between DHCP client

and servers dscp also lacks
any built-in mechanism

that would allow clients
and servers to authenticate

each other both are vulnerable
to deception and to attack

where row clients can exhaust
a DHCP servers pool.

Okay.

So let's move on
to our next topic

and that is why use DHCP.

So I just told you

that DHCP don't really have
any sort of authentication

so it can be
folded really easily.

So what are the advantages
of using DHCP

so The sap offers quite
a lot of advantages

firstly is IP address management
a primary advantage

of dscp is easier management
of IP addresses in a network

with the DHCP.

You must manually
assign IP address,

you must be careful
to assign unique IP addresses

to each client

and the configure
each client individually

the client moves
to a different network.

You must make model
modifications for that client.

Now when DHCP is enabled

the DHCP server manages
the assigning of IP addresses

without the administrators
intervention clients.

And move to other

subnets without panel
country configuration

because they obtained

from a DHCP server
new client information

appropriate for the new network
now apart from that you can say

that the hcp also

provides a centralized
Network client configuration.

It has support
for boot TP clients.

It supports of local clients
and remote clients.

It supports Network booting

and also it has a support
for a large Network

and not only for sure
like small-scale networks,

but for larger Works as well.

So that way you see DHCP has
a wide array of advantages even

though it doesn't really
have some authentication.

So because of these advantages
DHCP finds widespread use

in a lot of organizations.

Okay, so that winds
up DHCP for us.

So let us go into the history
of cryptography now.

So let me give you
a brief history

of cryptography now cryptography

actually goes back several
thousand years before shortly

after people began to find ways
to communicate there are some

of Who were finding ways
to make the understanding

of that communication difficult

so that other people
couldn't understand

what was going on.

And this led to the development
of Caesar Cipher

that was developed
by Julius Caesar

and it's a simple
rotation Cipher and by that,

I mean that you rotate a portion

of the key in order
to generate the algorithm.

So here's an example.

We've got two rows
of letters and

that are alphabetical in order

and means we basically wrecking
the alphabets down

and the second row
is shifted by three.

Letters so Abby is a z actually

because if you move that way B
is a z from the first row

gets shifted back the second row

and then the letter
D becomes letter C

the there's that's an example
of how encryption works.

So if you try to encrypt
a word like hello,

it would look completely
gibberish after it came

out of the algorithm.

So if you count the Letters
Out you can see that letter H

can be translated
to little a letter L.

So that's a Caesar Cipher.

Now you must Little things
like rot13 which means

that you rotate the 13 letters
instead of three letters.

That's what we
can do here again,

and this is just
a simple rotation Cipher

ourseives the cipher that's

what of course the rod stands
for its rotate or rotation.

Now coming forward
couple thousand years.

We have the Enigma Cipher now,

it's important to note
that the Enigma is not the word

given to this particular Cipher
by the people who developed it.

It's actually the word
given to it by the people

who were trying to crack
it the Enigma Cipher

is a German Cipher,

they develop this
Cipher and machine

that was capable of encrypting
and decrypting messages.

So they could messages

to and from different
battlefields and waterfronts,

which is similar
to the Caesar Cipher

sees a use it to communicate
with his Butterfield generals

and the same thing.

We're with the Germans.

You've got to get messages
from headquarter down

to where the people
are actually fighting

and you don't want
it to get intercepted

in between by the enemy.

So therefore you use encryption

and lots of energy
was spent by the allies

and in particular the British
trying to decrypt the messages.

One of the first instances

that we are aware of

where machine was used
to do the actual encryption

and we're going to come ahead
a few decades now into the 1970s

where it was felt

that there was a need for
a digital encryption standard.

Now the National
Institute of Standards

and technology is responsible
for that sort of thing.

So they put out a proposal for
this digital encryption standard

and an encryption algorithm.

What ended up happening
was IBM came up

with this encryption algorithm

that was based
on the Lucifer Cipher

that it was one of their people
had been working on on a couple

of years previously in 1974

and they put
this proposal together

based on the Lucifer Cipher

and in 1977 that proposal

for an encryption
algorithm was the one

that was chosen to be
the digital encryption standard.

And so that came
to be known as Des over time

and it became apparent

that there was a problem

with this and that was it
only had a 56 bit key size

and while in the 1970s

that was considered
adequate to defend

against brute forcing
and breaking of course.

By 1990s.

It was no longer considered
adequate and there was a need

for something more and it
took time to develop something

that would last long
for some long period of time

and so in the meantime
a stopgap has developed

and this stopgap is

what we call the triple Des.

The reason it's called
triple Des is

you apply the Des algorithm
three times in different ways

and you use three different keys
in order to do that.

So here's how triple Des Works
your first 56 bit key is used

to encrypt the plain text just

like you would do

with the standard
digital encryption standard

algorithm but changes
and you take that Cipher text

that's returned from
the first round of encryption

and you apply the decryption
algorithm to the cipher text.

However, the key
thing to note is

that you don't use the key
that you use to encrypt you.

Don't use the first
key to decrypt

because otherwise you'll get
the plain text back.

So what you do is
you use a second key

with the decryption algorithm

against the cipher text
from the first round.

So now you've got
some Cipher text

that has been encrypted
with one key and decrypt it

with Second key and we take
the cipher text from that

and we apply a turkey using
the encryption portion

of the algorithm to
that Cipher encryption portion

of the algorithm
to that ciphertext to receive

a whole new set of ciphertext
obviously to do the decryption.

You do the third key

and decrypt it with
the second key you encrypt it.

And then with the first
key you decrypt it.

And so you do reverse order

and the reverse algorithm at
each step to apply triple Des.

So we get an effective key size
of about one sixty eight bits,

but it's still only
X bits at a time.

Now I said triple Des
was only a stopgap.

What we were really looking

for was Advanced encryption
standard once again

and niste requested proposals

so that they could replace
the digital encryption standard

in 2001 after several thousands
of looking for algorithms

and looking them
over getting them evaluated

and getting them looked
into this selected an algorithm

and it was put together by
a couple of mathematicians.

The algorithm was called

rijndael and that became the
advanced encryption standard.

Or AES, it's one
of the most advantages

of AES is it supports
multiple key lens currently

what you'll typically see is

as we are using 128-bit keys.

However, AES supports
up to 256 bit key.

So if we get the point

where 128-bit isn't enough
we can move all the way up

to 256 bits of keying material.

So cryptography has
a really long history.

Currently.

We are in a state where we

have a reasonably stable
encryption standard and AES,

but the history
of cryptography shows

that with Every set

of encryption eventually
people find a way to crack it.

Okay.

So that was a brief
history of cryptography.

Now.

What I want to do
is let's go over

and talk about a yes
triple des and Des in themselves

because they are
some really key cryptography

key moments in history

because there's some really
key historic moments

in the history of cryptography.

Now, we're going to talk

about the different types
of cryptography key ciphers

and primarily we're going

to be talking about
this triple des and AES now.

This is the digital
encryption standard.

It was developed by
IBM in the 1970s.

And originally it
was cryptography Cipher

named Lucifer

and after some modifications
IBM proposed it as

digital encryption standard

and it was selected by
the digital encryption standard

ever since then
it's been known as dis.

Now one thing

that cost a little bit
of controversy was

during the process of selection

and it's a requested
some changes and it hasn't been

particularly clear but changes
were requested by the NSA.

There has been
some speculation that wondered

if the NSA was requesting

a back door into this
digital encryption standard

which would allow them to look

at encrypted messages
in the clear.

So basically it would
always give the NSA

the ability to decrypt
DS encrypted messages.

It remained the encryption
standard for the next couple

of decades or so.

So what is this and
how does it work?

Basically?

It uses 56-bit Keys rather
than the stream Cipher.

It's a block Cipher and it uses
a 64-bit blocks and a 1998 -

was effectively broken
when a desk

If the message was cracked

and three days a year
later a network

of ten thousand systems

around the world crack
the best encrypted message

in less than a day

and it's just gotten worse

since then with modern
computing power being what it is

since this was actually created

we already have come
to the realization

that we needed something else.

So Along Came triple Des

now triple DES isn't
three times the strength

of desk necessarily it applies.

There's just three times
and what I mean by that is is

what we do is we take a plain
text message then let's call

that P and we are going to use
a key called K 1 and we're going

to use that key to encrypt
a message and use a key

that will be will call K1

and we're going to use
that to encrypt the message

and that's going to result
in the ciphertext

and we will call the c 1 so c 1

the output of the first
round of encryption.

We're going to apply
a second key and we'll call

that K2 with that second key

and we're going to go
through a decryption process

on see one

since it's the wrong key.

We're not going to get
plain text out on the

And what we're going to get
is another round of ciphertext

and we will call this c 2
what we do with c 2.

We are going to apply a third
key and we will call this K 3

and we're going
to encrypt ciphertext c 2

and that's going to result
in another round the ciphertext

and we will call that c 3.

So we have 3 different Keys
applied in two different ways.

So with Chi 1 and Chi 3 we
do a round of encryption

and with key to we do
a round of decryption.

So it's an encrypted Crypt
and crypt process

with separate keys while
that doesn't really healed.

A full 168 bit key size
the three rounds of encryption

yields an effective key size of
a hundred and sixty eight bits

because you have
to find 356 bit keys.

So speaking of that technical
detail for triple Des.

We're still using the test block
Cipher with 56-bit keys.

But since we've got
three different Keys,

we get an effective length
of around 160 8.

Bits triple Des was really
just a stopgap measure.

We knew that if test
could be broken triple desk

surely we broke in
with just some more time again.

And so the nest was trying
to request a standard

that was in 1999.

And in 2001 this
published an algorithm

that was called a s
so this algorithm

that was originally

called rijndael was
published by nist as

advanced encryption standard
some technical specifications

about a s is

that the original drained
all album specified

variable block sizes
and key lengths

and as long as those lock sizes

and key lengths were
multiples of 32 bits.

So 32 64 96,

and so On you could use
those block sizes and key lens

when a s was published

a specified a fixed
128-bit block size

and key length

of 128 192 and 256 a yes
with three different key lengths

but one block size and

that's a little bit of detail
about desk triple des and AES.

So when a s was published

a specified fixed
128-bit block size

and a key length
of 128 192 and 256 bits.

So we've got with a S3
different key lens,

but one block size.

And that was a little bit

of detail about this triple des
and AES will use some of these

and doing some Hands-On work
and the subsequent part

of this video.

Okay.

So now that I've given
you a brief history

of how we have reached
to the encryption standards

that we're following today.

That is the advanced
encryption standard.

Let's go ahead

and talk a little bit more
about this triple des and AES.

So this is a digital
encryption standard.

It was developed by IBM
in the 1970s and originally it

it was a cryptographer
xi4 named Lucifer

and after some modifications
IBM proposed it as

the digital encryption standard.

It was selected to be
the digital encryption standard

and ever since then
it's been known as Tes

or deaths one thing

that caused a little bit
of controversy was

during the process of selection
the NSA requested some changes

and it hasn't been
particularly clear

what changes were
requested by the NSA.

There has been some sort
of speculation that wondered

if the NSA was requesting
a back door into this.

It'll encryption standard

which would allow them to look
at encrypted messages

in the clear.

So basically it would
always give the NSA

the ability to decrypt
this encrypted messages.

It Remains the encryption
standard for the next couple

of decades or so.

And what is this and
how does it work now

tests Remain the digital
standard for encryption

for the next couple of decades.

So what does it do
and how does it work?

So basically it uses

a 56 bit key rather
than a stream Cipher.

It's a block Cipher and it
uses 64-bit blocks and in 1998,

if you know there's
was effectively broken

when a des encrypted message
was cracked in three days

and then a year later
a network of 10,000 systems

around the world crack
the Des encrypted message

unless and a day

and it's just gotten worse

since then with modern Computing
being what it is today.

Now since this was created

and broken we knew
we needed something

and what came in between
Advanced encryption standards

and this is triple
Des now triple

Des is Three times the strength
of this necessarily it's really

there's applied three times

and what I mean by that is
we take a plain text message,

then let's call

that P and we are going
to use a key called K

1 and we're going to use
that key to encrypt the message

and that's going to result
in the ciphertext one.

So we'll call that C1
now c 1 is the output

of the first round of encryption

and we're going to apply
a second key called key

to and with that second piggy.

We are going to go through
a decryption process on C1 now

since it's the wrong key we are.

Not going to get the plain text
out of the decryption process

on the other end.

We are going to get
another round of ciphertext

and we're going to call
that c 2 now with c 2.

We are going to apply
a third key and we are going

to call that K 3 and we're going
to encrypt ciphertext c 2

and that's going to result
in ciphertext C 3

so we have 3 different Keys
applied in two different ways.

So what Chi 1 Chi 3 we do around
of encryption with key to we do

around a decryption.

So it's basically an unencrypted
decrypt encrypted process

with three separate keys,

but It does really is
it doesn't really healed

a 168 bit key size

because ineffectiveness it's
basically 256-bit keys

that are being used to race it

whether it be
three different keys.

So ineffectiveness,

you could say
that it's the 168 bit key,

but it is not the same strength
because people realize

that triple Des
can be easily broken

because if this is broken,

you can do the same thing
with three different ways

whether whatever key
that you use

so it just takes longer time.

To decrypt if you
don't know the tree

and if you are just using
a Brute Force attack,

you know that triple
Des can be broken

if this can be broken.

So triple Des was literally
a stop gap between Des and AES

because people knew

that we needed something
more than triple des and for

this the NISD

or the National
Institute of Standards

and technology in 2001.

They chose a s as the algorithm

that is now called
Advanced encryption algorithm.

So it was originally called
the rijndael algorithm.

And the main thing
about the rijndael algorithm

and advanced encryption
standard algorithm.

Is that the rijndael

algorithm specifically
States in its papers

that it has available block size

and available key size
as long as they are

in multiples of 32.

So 32 6496 like that.

But what AES does differently is

that it gives you one block size

that is 128 bits and gives
you three different key sizes

that is 128 192 and 256.

So with AES three
different key lens,

but one block size.

Okay, so that was a little bit
more information on a yes this

and triple des

and we are going
to be using this information

in some subsequent lessons
Okay now moving on.

Okay.

So now that we've discussed
the different history of

cryptography and more important
cryptography algorithms.

Let's discuss the different
types of cryptography.

Now, the first type of
cryptography I'm going to talk

about is symmetric cryptography
and by symmetric cryptography,

I mean Key is the same
for encrypting or decrypting.

So I use the same key

whether I am encrypting the data
or decrypting data.

Well things about symmetric
key cryptography is

that the use a shorter
key length then

for asymmetric cryptography,

which I'll get into
a couple of minutes.

It's also faster
than a symmetric

and you can use algorithms
like d EAS or a s

as those are both symmetric
key cryptography algorithms

and you can use a utility
like a a script.

Let me just demonstrate

how a symmetric key
cryptography works.

So for this we can use
a tool called a a script.

So in a a script is
actually available for Linux

and Windows and Mac
all the systems.

So I'm using it

on the Windows one and I'm using
the console version.

So first of all,

I have a text file
called text or txt.

So let me just show that to you.

So we as you guys can see

I have this thing called text
up txt now to do text or txt.

All I let me just show
what x dot txt contains.

So as you guys can see
it has a sentence.

The quick brown fox jumped
over the lazy dog.

So that's the sentence

that has all the alphabets
in the English language rather.

So now we are going
to try and encrypt it

so we can use
something like a SIDS

because both of them

are symmetric key ciphers
symmetric key algorithms rather.

So we are using AES
in this case.

So what we're going
to do is say s script

I'm going to encrypt it

and we're going to give
you the password

of let's say Pokemon.

We're going to call it
Pokémon and regarding

do Do text Dot txt.

We're gonna encrypt that file.

So now we have
encrypted that file.

Let's go see we must
be having a new file.

So this is called text
or txt that a yes.

So that is our encrypted file.

And this is what we would
generally send over the network

if we are sending it to anybody.

So let's assume
the person who's received.

It also knows
our encryption algorithm.

I mean encryption
algorithm and the key

that goes along with it.

So let's try to decrypt it
now now before I decrypted,

let me just show you What
an encrypted message looks

like so this is

what the ciphertext look
like a snow text Dot txt.

The AES.

So yeah,

as you guys can see
the windows control control

you she'd everything

but if I were to go here I
will just go into the file

and just ever notepad
plus plus you'll see

that it's a bunch of crap.

You really can't make out
anything what is being made?

Here we come.

Really decipher much.

So that's the point
of using encryption.

Now if you were to decrypted,

all you have to do is
a script we turned the crib.

We're trying to give
the password is going to be

what was the password
Pokémon I'll K

so and we're going to try
and create text txt.

The AES.

Let's dir that again.

Okay, so that just the crypts
are message for us.

So this is

how you would use a script
for encryption and decryption.

So that just
description and that's

how you would use symmetric key
encryption to encrypt a file

for this example symmetric key

uses the either a stream
Cipher or a block Cipher

and the differences
between stream or block ciphers.

Is that block takes a block
of bits at a time

and it's a fixed length.

For example 64 bits

if I were to use
a block Cipher with 64 bits,

I would need to take him 64 bits

before I could
start encrypting now

if I didn't have 64 bits

to encrypt I would have
to fill it with padding

in order to get
up to 64 bits a stream Cipher

on the Other hand

it will encrypt a bit at a time.

So it doesn't matter
how many bits you've got.

You don't need
to have some multiple

of the block length in order
to encrypt without padding.

And another type of cryptography
is a symmetric now asymmetric

as you would expect users
to different keys.

And that's where we have
public key and private key

a symmetric key cryptography
uses a longer Keelan

and also has more computation

and the encryption
process is slower

with a symmetric key encryption

and the encryption process

is slower than with
a symmetric key encryption

while the For symmetric key is
for signing documents

or emails for example,

but I would have
the private key sign something

and the public key would be used
to verify a signature

and another reason

for using a symmetric key
encryption is to ensure

that you got it from
who actually sent it

since you've got two keys.

You always knew who
the other end of the equation is

where it's symmetric
key senses just one key.

If you can intercept
the key you can decrypt

and also encrypt messages.

And so if somebody can figure
out the key you can break

into a communication
stream using symmetric.

Turkey and scription
so asymmetric gives you

the advantage of ensuring

that the other end is who
the other end says and they are

since they're the only ones
who should have the private key

and in this particular
instance in practice.

However, however hybrid
encryption models tend

to be used and that's

where you would use

a symmetric encryption to
encrypt asymmetric session keys.

So basically you
encrypt the message

that you are sending using
symmetric key encryption

and then you

when Changing the key

with somebody else you use
a symmetric key encryption.

So this is going to be
a slower process.

You probably won't want
to use it for a smaller files

in order to do that.

Fortunately the file example
that I have is a smaller one.

So I'm going to try
and generate a key right now.

So for this we have to head over
to our Ubuntu system.

So let's see.

Let me show you how public
key encryption actually works

and we are going
to first create a key.

So let me just clear
this out for you.

First of all.

Let's create a file and
let's call that text Dot txt.

Now.

If you see we are going to edit
text or txt to have some file.

So have some text in it.

So there seems to be
a warning with the GDK.

I'll just use Echo instead.

So now let's see
if that is in our file.

Okay.

So let me just show you
how a symmetric key encryption

or public key
cryptography works.

So first of all,
we need a text file.

So let me see do we
have a text file?

So there seems to be
a text Dot txt.

So let's see what
this text Dot txt says

so it says that this is
a random text file.

Now, what we want to do is

we want to create
a public key first,

so I'm going to use
openssl for doing this.

This so we go openssl

and we are going to use it

with our say so we're trying
to generate a key.

So generous e and we're going
to use this tree to use this

and we're going to Output it
into file called private key.

So we are also going
to be using a 4 0 9 6 bit.

So this is going
to be our private key.

So this will create a private
key using RSA algorithm.

So let it work its way out.

So first of all,

it's asking me
for the past three days now,

so since You can protect
your keys with the passphrase.

So I'm just going
to use my name.

Okay.

So now we see

if we LS and we have
a private key, I guess.

Yep.

So we have this private key.

Now.

We're using this private key.

We are going to generate
a public key.

So for this I'm again
going to be using open SSL

and open SSL is unix-based.

So you will need a Unix system.

So you go are say utl.

That's RC utility.

And what we want
to do is encrypt

and we want the public key

in and key and we want
to use the public key

that we just generated.

I'm sorry guys.

So we are going
to be using Odyssey.

So first of all,

we need to generate
a public key.

So for that we use
the private key.

So we will give the private
key as an argument

after the in flag.

So private key and we are trying
to get out a public key.

So pop out and we're going
to call public dot key.

Okay, so there seems to be Okay.

I messed it up a little I
forgot to give the output

so you go out and then
you use public key.

So it's asking me
for a passphrase

and now it's writing
the are sticky and

since the password was correct.

We have a public key to so

if you see now we have
a public key and a private key.

So we are going to encrypt
our file using the public key.

So we go openssl
and we go RS a utl.

And we go and crypt
and we can do pump in.

So we are going
to use the public key

and we want to put
the text at the XT

as the file to be encrypted.

So text Dot txt.

And what we want to Output
is an encrypted file.

So encrypted Dot txt.

Okay, I call it open SL L
need to go and edit that out.

Yeah, so that makes
it a correct command

and now we have
an encrypted file.

So let's see Alice and yep
encrypted dot txt.

So if you just cut that out,

so we see it's
a bunch of garbage

and we really can't read it

unless we decrypt it so
or decrypting the key.

All we have to do
is again use openssl.

Let's clear this out
first so openssl.

And we are going to be using
the RC utility again.

So RSA utl.

We're going to
decrypt this time.

So we go with the decrypt flag

and then we are going
to be giving the inky

and that is going
to be the private key

and what we want to decrypt
is encrypted the txt.

And what we want output it is
as let's say plain text txt.

So it's going to ask me
for my past rays,

which is mine.

Name and I've entered
the passphrase and now

we have a plain text Dot txt.

Now.

If we are to go and LS we see

that we have a plain
text txt out here just

with light info dot txt.

Let me just cut that out.

So plain text D XD.

So this is a random text file.

And if you go up we see

that it was a bunch
of garbage and before that.

It was a random text file.

Now, you can also run
this command called

if plain text Dot Txt text txt.

So this give you a difference
in the text rings.

So it's zero so it gives you
that's the difference.

So both files are the same

and that's how public
key cryptography works

and how symmetric
key cryptography works.

Okay.

Now moving ahead
of cryptography.

Let's talk about certificates.

Okay.

So now that we're done
with cryptography.

Let's talk about
digital certificates.

So what is
a digital certificate?

Well, a digital certificate
is an electronic password

that allows a person
or can ization to exchange

data securely over the internet
using public key infrastructure.

So digital certificate

is also known as
a public key certificate

or an identity certificate now
digital certificates are a means

by which consumers

and businesses can utilize
the Security application

of public key
infrastructure public

key infrastructure comprises
of the technology to enable

and secure e-commerce and
internet based communication.

So what kind of security does
a certificate provide so firstly

it provides identification

and Authentication Asian
the person or entities

with whom we are communicating
I really who they say they are

so that is
proved by certificates.

So then we have confidentiality
of information within a message

or transaction is
kept confidential.

It may only be read

and understood by
the intended sender.

Then there's Integrity
there's non-repudiation

the center cannot deny
sending the message

or transaction the receiver
really get to non-repudiation

and I'll explain

how non-repudiation comes
into digital certificates.

So digital certificates
are actually issued

by By authorities
who are business

who make it their business to
actually certify certify people

and their organization
with digital certificates.

Now, you can see these
on Google Chrome now,

let me just open
Chrome for you guys

and you can see it out here.

You can see certificates

and you can go into the issue
of statements and you can go

and all sorts of stuff

so you can see it's issued
by encrypt Authority X3.

So that's an issuing authority
for digital certificates.

Now that was all about
the theory of certificates.

Let's go and see
how you can create one.

Go to create
a digital certificate.

We are going to be using
the openssl tool again.

So first of all,

let me show you
how to create a certificate.

So we are going to be using
the openssl tool for that.

So first of all,
let me clear the screen out.

So in this case, I'm going
to generate a certificate

Authority certificate.

So I'm doing an artistic
key here to use

inside the certificate.

So first of all,

I need to generate
a private key.

So to do that as I had just

showed you guys we can use
the openssl tool ego openssl

and Jen are say and we're going

to use test three then
Ouches and let's call it c

a DOT key and we're
going to use 4 0

9 6 this so I'm doing
an RSA key here to use

inside the certificate
some generating private key and

the private key is used as
a part of the certificate

and there's a public key
associated with the certificate.

So you've got public and private

key and data gets encrypted
with the public key

and then gets decrypted
with the private key.

So they are mathematically
linked that the public

and private key

because you need one for the end
of the communication the

and the other for the the other
end of the communication

and they have to be linked
so that the data

that gets encrypted

with one key catch
to be decrypted with other key.

So this is asking
for a passphrase

and so I'm going to be giving

my name as a passphrase so that
has generated the key for us.

So now I'm going to generate
the certificate itself.

So I'm going to be using
the openssl utility.

So first of all,
you say openssl nice a request,

so it will be a new request

and it's going to be
An x.509 request it's going

to be valid for 365 days.

And let's see the key
is going to be see a DOT key

and we're going
to Output it into CA

or let's call it at Eureka dot

c r t so this is certificate
that I'm producing in the name

of the company that
I'm working for.

So that is at Eureka.

So it says it's unable
to load the private key.

Let me just see
as the private key existing.

I had a previous.

Private key.

So let me just remove

that doesn't have
a see a DOT key seems

like I put the name differently.

So let me just try
that again openssl

and we do request

so we are requesting

new certificate and
it's going to be x509

and it's going to be there
for 365 days and key is He

apparently that's
where it's cold out here.

So and it's going to be out
into Eddie record CRT.

That's another so
let's enter the past three.

So it's my name.

So now it's going to ask
me a bunch of information

that's going to be
inside the certificate.

So let's say it's asking
the country name

against let's put in the state.

Okay.

So iin State Province
named some states.

So Bangalore look ality.

Let's say white Field
organization name is Eddie.

Rekha unit name brain
Force common name.

Let's leave that
out email address.

Let's leave that out too,
and we have a certificate.

So if you go and list
all your files,

you'll see that there is
a certificate called any record

or CRT out here,

which is highlighted.

Okay.

So now if you want
to view this file,

you could always use the openssl
you can always use the openssl.

Utility, so you say you want to
read an extra five nine request

and you wanted to text

and what you want
to see is at Eureka CRT.

Okay, so that
is the certificate.

So you see

that it has all the signature
it has signature algorithm.

It has all the information
about the certificate

and it says signature issuer is
cin and state Bangalore

and location right field.

I wreck up reinforce velocity.

It has all sorts of information.

Nation so that was all

about digital certificates how
who issues digital certificates?

Where are they useful?

So this is
basically non-repudiation.

So nobody can say
with this certificate that

if this certificate is included
in some sort of website

and that website tends
to be samples malicious

and there's a complaint
now the website can go

to a court of law and say
they didn't know about this

because the certificate

that was included had
their private key and

private key was only supposed
to be known to the company

so that Non-repudiation
you just don't deny

that you didn't do it.

Okay, so that was all
about certificate not moving on.

Okay.

So moving on we're
going to be talking

about cryptography caching.

And while the word
cryptography is in

the term cryptography caching
and it does lead to believe

that there is encryption Vault.

There is no encryption involved
in a cryptographic hash.

There is a significant
difference between hashing

and any sort of encryption
and that is primarily

that encryption is
a two-way process

when I encrypt a piece of data
or a file or anything else.

So what I'm doing
is putting it into a state

where I expect it to be able
to get it back out again,

in other words

when I interrupt a file
expect it to be able

to decrypt the file and get

the original contents hashing

is a one-way function
on the other hand.

Once I've hashed piece of data
or file there is no expectation

and ability to get
the original piece

of data back hashing
generates a fixed length value

and different types

of hashing will generate
different length values.

For example, md5 will generate
a different length value

than sha-1 And they're
both hashing algorithms,

but they generate
different length values

and the resulting value
from a hash function

should be no relation at all
to the original piece of data.

As a matter of fact,

if two inputs generate
the same hash value

it's called the collision and
if you can generate collisions,

you may be able to get a point

where you can generate
a piece of data

that are going to generate
the same hash values

and that leads you to
the potential ability to break

the particular hashing algorithm

that you're using.

So what we can use hash is

for well one thing we can use
hashes for file in text.

T we can run a hash

on a file and get
a value back and later.

We can check

that the value make sure
if it's the same

if it's the same I can be sure

that the same file was hashed
in both instances.

So let me just show you
an example of what I just said

that if we Hash
a file we will get

the same hash every time so
remember the certificate

that we just created.

Let me just log in again.

So we are going

to Hash this certificate and it
will create a certain hash

and we are going to see

that every time
we hash it we are.

Being the same hash

so we can use this command
called md5sum and we can do

Eddie record or CRT.

So this is the harsh produced

after you've hatched
at your record or CRT.

So if I do an md5 again,

so md5 is a hashing algorithm

that you should move so
at your record or CRT

and it will produce

very similar has let's see
a sha-1 works like this.

So sha-1 and you record or CRT?

Okay, Xiao Chuan

is sha the shuffle
in the shower you tools back?

Courage.

Okay, so I proved
my point that but md5

if it is cryptography
hashing algorithm.

We are getting
the same hash back.

So if you are able
to produce the same hash

that means you have broken
the algorithm in itself.

So if you run md5 on the knocks,

you can get a version
of md5 and md5 summation program

on Windows and Mac OS

where with the utility
md5 is does the same thing.

So I just showed you
the file and I hashed it

and another reason we use
hashing is we are storing

passwords so password.

Stored after hashing,
we hashed passwords.

And the reason
for hashing password is

so you're not storing
the password in clear text

which would be easily seen in

if you got it protected
with low emissions

if I hashed password
every time I hash the password,

I'm going to get the same value
back from the same algorithm.

So what I do is store
the hash and some sort

of password database
since it's a one-way function.

You can't get the password
back directly from the hash.

Now what you can do
with most password

cracking programs do
some variation of this

and you just generate hashes
against list of words.

If you look at a hash value

that matches the one
in the password

once you get the hash

that matches the one
in the password, you know,

what password is there

and here and we come back
to the idea of collisions

if I can take
two different strings

of characters and get
the same values back

and it's easier
to crack the password

because I mean not necessarily
get the password with the hash

that I get back from particular
string of data is the same

as that I get from
the original password,

then it doesn't matter
whether I know the password

because the string of data

that I put in is going
to generate the same hash value

that you're going to compare
when Login and this hash value

will just give you

that as valid and you
will be able to login.

So suppose the password
that you chose

while making your account is dog

and the dog word
produces this hash value

and if I were to like hash cat

with the same algorithm
and if the other

than was prone to collisions,

it might produce
the same hash value as dog.

So with the password cat I
could open up your password.

I mean I could open
up your account.

So that was all
about hashing and hashing.

Rhythms, let's move on.

Okay.

So in this part of the video,

we are going to go
over SSL and TLS

or SSL and TLS are ways
of doing encryption

and they were developed
in order to do encryption

between websites web servers
and clients or browsers.

SSL was originally developed by
a company called Netscape and

if you don't remember
Netscape eventually spun

off their source code
and became Mozilla project

where we get Firefox

from so back in 1995 Netscape
released version 2 of SSL,

and there was a version one,
but nothing was Done with it.

So we got the version 2 of SSL
and that was used for encryption

of web transmission
between the server

and the browser
to do a whole number

of flaws between the server

and the browser now
SSL version 2 had a whole number

of flaws and SSL to has
the type of flowers

that can lead to decryption
of messages without actually

having the correct keys

and not being
the right endpoints

and so Netscape released
SSL version 3 in 1996.

And so we get SSL
3.0 which is better

than 2.0 but it still hurts.

Some issues and so
in 1999 we ended up

with TLS now SSL is secure

socket layer and TLS is
transport layer security.

They both accomplished
the same sort of thing

and they're designed
for primarily doing encryption

between web server
and web browsers

because we want to be able
to encrypt the type of traffic.

So let me show you what kind
of traffic looks like.

So first of all,

let me open bar shop
and out here.

I already have a TLS scan
ready for you guys

that you can see we have
all sorts of TLS data

so you can see

that here's my source
and it's 32 and destination

is sound 6 1 2.

4050 9.46 doing
a client key exchange

and the chain Cipher suspect
and Krypton handshake message

and then we start
getting application data.

So there are some other
steps involved here

and you're not seeing all of it

with this particular
Wireshark capture

because again, you know,

we get fragmented packets

and at some point it
starts getting encrypted

and you can see it anyways

because wash out

without having the key
can decrypt those messages

but one ends up happening

is the client sends a hello

and the silver is
Ponce with a Hello

and they end up exchanging
information as part

of that now including
version numbers supported

and you get random number

and the clients going to send
out a number of surface suits

that may want support and order
and it can support the server

and it's going to pick
from those sweet of ciphers.

Now, then we start doing
the key exchange and then

do the change Cipher spect
and from the client and server

and eventually the server
just sends a finished message

and at the point

we've got this encrypted
communication going on,

but there's this handshake

that Zone between the two
systems and there's a number

of different types
of handshakes depending

on the type of end points

that you've got.

But that's the type
of communication that goes on

between servers and the client
one important thing

about using SSL and TLS is

as I mentioned some
of the earlier versions had

vulnerabilities in them
and you want to make sure

that the server's
aren't actually running those.

So you want to run some scans
to figure out the type

of calls and ciphers
that different systems you

so for this we can use
something called SSL scan.

So this is available for Unix.

Not really sure.

If there is something

that is similar
for Windows or Mac,

but on Unix based system that is
Linux we can use SSL scan.

So let me just show
you how to use

that clear as far out.

So what we can do is run
SSL scan again suppose

www dot Ed u-- record dotco.

So we're doing Isis can hear

against the website
and you can see it's going out

and probing all
the different types of ciphers

after you know on this system
start with SSL V3

and are going to TLS

version 1 and we could force
as a substantive try

to do an SSL V2.

If I scroll back up here
I get the surface I

Firs which is SSL version
3 it's using RSA

and it's using RSA
for the asymmetric.

Now in order to do
the key exchange and

once we get the session key
up we're going to do use AES

256 and then we're going

to use the secure hash algorithm
to do the message authentication

or the Mac.

It's something calls the hmac

for the hashed message
authentication code and

what it does is simply
hashes the MAC address

that you would check one side
against the other to make sure

that the message
hasn't been fitted

with in transmission.

You can see here all
the different types

of Cipher suits that are
available peers TLS running rc4

at 40 bits using md5.

So that would be
a pretty vulnerable type

of communication to use
and between the server

and the client 40-bit
Cipher using rc4 is

a low strength Cipher and we
would definitely Recommend

that clients remove those
from the support of ciphers

that they have on their server.

All that configuration
would be done

at the web server as well as

when you generated your key
and your certificates normally

certificates would be handled
by a certificate Authority.

Now, you can also
self-signed certificates

and have those installed
in your web server

in order to Communications
with your clients

that the challenge with that is
browsers today warned when they

see a certificate against
the certificate Authority

that is entrusted of it and it
doesn't have any certificate.

Aditi tall so
you'll get a warning

in your browser indicating.

There may be a problem
with your certificate

if your clients
are Savvy enough and

if the users are Savvy
enough you may be able

to make use of these self
fine self-signed certificates

and save yourself some money,

but generally it's
not recommended simply

because clients are starting
to get these bad certificates

and when they run across one

that's really a problem
a real Rogue certificate.

They're going to ignore
the certificate message

in the browser
and just go to the sites

that could have malicious
purposes in mind and may end up

compromising the clients
or customers or users.

That's SSL and TLS

and how they work and negotiate
between servers and end points.

Okay.

So now that we've talked
about TLS and SSL.

Let's talk about
disk encryption.

Now this encryption
is actually something

that was not really difficult to
do but sort of out of the reach

of normal desktop computers
for a really long time.

Although there have long been
ways to encryption of files

and to a lesser degree
maybe entire disks

as we get faster processor
certainly encrypting

the entire disks

and being able to encrypt

and decrypt on the fly
without affecting.

Performance is something

that certainly comes
with Within Reach

and it's a feature

that shows up in most modern
operating systems to one degree

or another now these days
we are going to look

at a couple of ways here
of doing disk encryption.

I want to tell you
about one of them first

and it's not the one I

can show I can't really show
the other one either.

So with Microsoft

their Windows system have
this program called BitLocker

and BitLocker requires
either Windows Ultimate

or Windows and price.

I don't happen to have

either version so I
can't really show it.

You but I can tell you

that BitLocker has ability
to entire disk encryption

and they use a s

for the encryption Cipher
and the thing about BitLocker is

that they use a feature

that comes with most modern
systems particularly laptops.

Lll strip in them

that's called The Trusted
platform module or TPM.

The TPM chip is part

what it does is
it stores the keys

that allows operating system

to be able to access the disk
through this encryption

and decryption process and they
use a pretty strong encryption

Cipher which is a yes,

but you have to have
one of the cup Well

of different versions
of Windows in order

to be able to use BitLocker

and it's one of those things
you would normally run

in an Enterprise.

And so that's why they included
in on its Enterprise version.

Now on the Mac OS side

they have this thing called
file Vault and you see

in the system preferences
on the security and privacy.

If you go to filevault you
can turn on filevault now I

if you have the little button

that they're says
Stone on file wall,

then you can turn
on the file wall

and it would ask you
about setting up keys

and it works similar
to Those BitLocker now

pgp happens to have the ability
to do disk encryption

and you can see

that in the case of this
you burned the system.

They've got a package called
gde Crypt which is a GUI

that allows you to map and mount
a created encrypted volume

so I could run G decrypt and put
help me set up the process

of encrypting the volumes
have got on my system.

Now this conscription
is a really good idea

because when you are working

with clients the data is
normally very sensitive.

So as I mentioned

And you can always use things
like BitLocker and windows fault

or other search software's
for disk encryption.

So what I mentioned before
is now not only possible.

It's very much a reality
with current operating systems.

Now, let's talk

about scanning now
scanning is refers to the use

of computer networks
to gather information

regarding computer systems

and networks canning

is mainly used to security
assessment system maintenance

and also for performing
attacks by hackers.

The purpose of network
scanning is as follows,

it allows you
to Nice available UDP

and TCP Network Services running
on a targeted host.

It allows you to recognize
filtering systems

between the users
and the targeted host.

It allows you to determine
the operating systems

and used by assessing
the IP responses.

Then it also allows you

to evaluate the target
host TCP sequence numbers

and predictability to determine
the sequence prediction attacks

and the TCP spoofing now
Network scanning consists

of Network Port scanning as

well as vulnerability scanning
Network Port scanning refers

to the method of sending
data packets via the network.

Through computer system
specified Service Port

this is to identify
the available Network Services

on that particular system.

This procedure is effective for
troubleshooting systems issues

or for tightening the system
security vulnerability scanning

is a method used to discover
known vulnerabilities

of computing systems
available on network.

It helps to detect
a specific weak spot

in an application software
or the operating system,

which could be used
to crash the system

or compromise it
for undesired purposes.

Now Network Port scanning as
well as vulnerability scanning

is an information.

Rings technique,

but when carried out
by Anonymous individuals

are viewed as a pollutant
attack Network scanning process

is like Port scans

and pink stripes

and return details

about which IP address map
to active life hose

and the type
of service they provide

another Network scanning method
known as inverse mapping gathers

details about IP addresses

that do not map to Live host

which helps an attacker to focus

on feasible addresses
Network scanning is one

of the three important methods
used by an attacker

to gather information
during the footprint stage

and the attacker makes a File

of the target organization
this includes data

such as organization's
domain name systems

and email servers in additions
to its IP address range

and during the scanning stays
the attacker discovers details

about the specified IP addresses

that could be accessed online
their system architecture

their operating systems

and services running
on every computer now

during the enumeration stays

at a collects data including
routing tables Network user

and group names simple
Network management protocol data

and so on.

So now let's talk About
intrusion detection evasion.

So before we get
into IDs Salvation,

let's talk about
what exactly is an IDs now

an intrusion detection system
or IDs is a system

that honor does Network traffic
for suspicious activity

and issues alerts
when such activities discovered

while anomaly detection and
Reporting is primary function

some intrusion detection systems
are capable of taking actions

when malicious activity
or anomalous traffic is detected

including blocking traffic sent
from suspicious IP addresses,

although intrusion detection
systems monitor Network

for Ali malicious activity they
are also prone to false alarms

or false positives

consequently organizations need
to fine-tune their IDs product

when they first install them

that means properly configuring
their intrusion detection

system to recognize
what normal traffic

on the network looks

like compared to potentially
malicious activity

and intrusion prevention
system also monitors

Network packets for potentially
damaging Network traffic,

but we're an intrusion
detection system responds

to potentially malicious traffic
by logging the traffic

and issuing warning

notification intrusion
prevention systems response

to such By rejecting the
potentially malicious packets.

So there are different types
of intrusion detection system.

So intrusion detection system
come in different flavors

and detect suspicious activities
using different methods.

So kind of intrusion detection

is a network intrusion
detection systems

that is nids is it deployed
at a strategic point

or points within the network

where it can monitor
inbound and outbound traffic

to and from all the devices
on the network.

Then there is host
intrusion detection system

that is at IDs

which runs on all computers
or devices in the network.

With direct access
to both the internet

and the Enterprise internal
Network SIDS have an advantage

over any ideas in

that they have may be able to
detect anomalous Network packets

that originated from
inside the organization's

or malicious traffic

that nids has failed

to detect hid s may also be able
to identify malicious traffic

that originates from
the host itself as

when the host has been
infected with malware

and is attempting spread

to other systems signature
based intrusion detection system

monitors all packaged
traversing the network

and compare them

against database of
signatures or attributes.

I've known malicious threats
much like antivirus softwares.

So now let's talk
about into IDs evasion.

Okay.

So now let's talk
about IDs evasion.

Now IDs is
an intrusion detection system

as we just spoke about
and instead it detect exactly

the types of activities that
we are engaged in sometimes

and sometimes you may be in
called in to work on a Target

where activities are known

and should be known
by The Operators

or the operations people
involved in monitoring

and managing the network
and the idea being not only

do they want to assess
the technical controls

that are in place,

but they also want
to assess the operational

procedures and ensure

that the systems and processes
are working the way

that they are supposed
to be working.

Now when you are engaged
with the Target

that you are in full cooperation

with you don't need to do
these types of vision tactics.

All these techniques
may be actually avoided

but if you are asked
to perform an assessment

or a penetration on a Target

where they are not supposed
to see your activities,

then you need to know

some different techniques
to evade detection from an IDs.

So we're going to talk about
a couple of different things.

That you can do.

So one thing that you can do
is manipulate packaged to look

a particular way.

Now for this there is
a tool called packets.

So packet is a really good way
to actually manipulate traffic

and by actually manipulating
the contents of a packet

like you can specify
the destination and source.

So it's a really useful tool

to set up a package
look a particular way.

One thing it can do is allow
you to spoof IP addresses

so I could set
the source IP address here.

That was something completely
different from mine now

from Using TCP or UDP?

I'm not going to see
the response back.

And in this case TCP.

I'm not even going to get
the three weeks connection me

because responses are going
to go back to the source IP.

But what you can do

is an additional two spoofing
you can set a particular ways

that a packet may look

like changing the type
of service or by changing

the fragmentation of set or by
different flags settings

at me allow you through an IDs
without maybe getting flagged

and it may also allow
you to a firewall now

it's a slim possibility
but it's a possibility.

Now.

Another thing you
can do is use packets

to generate a A lot
of really bogus data

and what you might do is hide
in the noise generated by packet

so you can could create
some really bogus packets

that are sure to set
of ideas alarms

and then you can run
some legitimate scans underneath

and hopefully be able to get
some responses different

from mine now
from using TCP or UDP.

I'm not going to see
the response back.

And in this case DCP,

I'm not even going to get
the three weeks connection me

because responses are going
to go back to the source IP.

But what you can do

is an additional two spoofing
you can set up a particular ways

that a packet may look

like changing the type
of service or by changing

the augmentation offset or by
different flag settings

at me allow you through an IDs
without maybe getting flagged

and it may also allow
you to a firewall now

it's a slim possibility
but it's a possibility.

Now.

Another thing you can do is
use packet to generate a lot

of really bogus data

and what you might do is hide
in the noise generated by packet

so you can could create
some really bogus packets

that are sure to set
of ideas alarms

and then you can run
some legitimate scans underneath

and hopefully be able
to get some responses.

Kali Linux is the industry's
leading Linux distribution

and penetration testing

and ethical hacking
it offers tons

and tons of hacking
and penetration tools

and different kind
of software's by default.

It is widely recognized
in all parts of the world even

among window users
who may not even know

what Linux has well
to be precise Kali Linux

was developed by offensive
security as the rewrite

of backtrack backtrack just
like Kali Linux was a lie.

Linux distribution

that focused on security it
was used for digital forensics

and penetration testing purpose.

But the question here is why
should you choose Kali Linux

when you have other choices like
parrot security operating system

back box black art
and many more out there.

Let me list are few reasons as

to why Kali Linux is
the best choice first

and foremost it offers more than
600 penetration testing tools

from different kind
of security fields

and four and six secondly.

Kali Linux is customizable.

So if you're not comfortable
with current Kali Linux tools

or features or
graphical user interface,

you can customize
Kali Linux the way you want.

It is built
on a secure platform.

The Kali Linux team
is actually made up

of small group of individuals.

Those are the only ones
who can commit packages

and interact with repositories.

All of which is done using
multiple secure protocols.

So color Linux is definitely
a secure platform,

although penetration
tools tend to be

In an English colony includes
multilingual support this way

more users can operate
in the native language

and locate the tools

that they need for the job

that they are doing
on Kali Linux

and lastly Kali Linux just

like back truck is
completely free of charge on top

of all this benefits

Kali Linux offers different
installation options one way

of installing Kali Linux is

by making a collie
bootable USB drive.

This is the fastest way

of installing Kali Linux
and the most favorable as Well,

we will discuss why in a while.

You can also install
Kali Linux using

hard-disk installing Kali Linux

on your computer using the hard
disk is a very easy process,

but you should make sure

that your computer has
compatible Hardware.

You can also install Kali Linux
alongside your operating system.

It could be Windows or Mac,

but you should exercise caution
during setup process

because it might mess up

with your default
bios settings lastly.

You can use different kind
of virtualization software.

Just VMware or watch

a box to install Kali Linux on
your preferred operating system.

Well apart from all this you
can also set up Cal Linux

on Advanced risc machines

or a RM like Raspberry Pi
trim slice cube truck

and many more.

So there you go guys.

Now if you know what
color Linux is and why it

is a leading Linux distro
for ethical hacking

and penetration testing
in today's session.

We will explore different ways
to install Kali Linux.

Let's get started
then all Your I said

that the fastest method

for setting up Kali Linux is
to run it live from a USB drive.

But why first of all,
it's non-destructive,

it makes no changes
to the host systems hard drive

or the operating system
that it is installed on.

So once you remove USB your
operating system will return

to its original state.

Secondly.

It's portable.

You can carry color index
in your pocket

and can run it whenever you
want just in few minutes.

It's customizable.

You can create your own.

Kali Linux ISO image and put it

into USB drive using
a simple procedure

which we will discuss
later and lastly.

It's potentially persistent.

You can configure

your Kali Linux live USB drive
to have persistent storage

so that the data you
can collect is saved

and you can use it
across different reboots.

Now.

Let's see how to create
a bootable USB drive

on Windows guys.

Actually the process
is very simple.

It's just a three step process.

First of all,
you need to plug your USB.

USB drive into an available
USB port on your Windows PC

next you need to note down
the destination drive.

It uses one set mounts.

For example, it could be
F drive after that.

You will have to download
and launch a software

called win32 disk imager
on the software.

You'll have to choose
color Linux ISO file

that needs to be
matched and verify

that the USB drive

to be overwritten is
the correct one lastly.

Once the Imaging is complete.

You need to safely
eject the USB drive

from Windows machine.

So, like I said,
it's very simple, right?

Well, I'm not going to show
you a demo on this one

because like I said,

it's very easy, and I'm sure
you guys can pull it off.

If you have any doubts.

You can post them
in the comment session.

We'll get back to you.

And as for the demo part will
be doing for installations here.

First of all,

we'll see how to install
Kali Linux using VMware

on Windows operating system.

Then we'll see

how to install Kali Linux on Mac
using virtualbox moving on.

We'll see how to install

Kali Linux tools on
different Linux distributions.

I'll A showing
how to install it on Ubuntu.

Well, the procedure is same for
every other Linux distribution.

So you can go ahead and use
the same procedure

for the Linux distribution

that you're using
and lastly we will see

how to install Kali Linux

on Windows 10 using
Windows subsystem for Linux.

So, I hope it's clear

that what we'll be learning
in the session.

Let's get started with
the first demo in this demo.

We'll see how to launch
Kali Linux using VMware.

So guys you can install
Kali Linux using

any virtualization software.

It could be VMware
or virtualbox in this demo.

I'll show you
how to install it using VMware.

So first of all,

obviously we'll have
to install VMware light.

So just type of VMware
and it's the first link

that you find you can go
ahead and download

VMware Workstation Pro

you have it in the downloads.

Here you can download
workstation player as well

or you can download
VMware Workstation Pro now.

Once that is downloaded.

You will have to download
a curl Linux ISO image

so that you will have to go
for official Kali Linux website

just type for Kali Linux

and it's the first link you
can see downloads option

here click on download

and yeah,

you can see different
download options here you

have color Linux light
for 64-bit as well as 32 bit.

And then there is
Kali Linux 64-bit and 32-bit

and you have Great images
for VMware and Wachtel boxes.

Well suppose you want to skip
the entire lengthy procedure

of installing it and you
want to just use the image,

then you can go ahead and use
this color Linux

64-bit for VMware

or virtual box same goes
for the 32-bit as well.

But since we are focusing
on installing right now,

let's just go ahead
and download ISO file

and install it from
the beginning until last step.

I have already downloaded it.

So I have an ISO file
downloaded on my computer.

So all you have to do is
just click on the torrent link.

It will be downloaded.

Let's open VMware then so
as you can see,

I have the embed workstation
Pro installed here.

So I already have two about to
Virtual Machine installed

on my VMware Workstation.

As you can see on the home page
three different options.

It says create
a new virtual machine

or open a virtual machine
and connect to remote server.

So if you want to
create a color index

or any other washing machine
from step one,

you can use this create
a new virtual machine option.

Well, if you have an image of
and watch the machine already,

and if you want to just
use it and avoid

installation procedure.

Then you can go
ahead and use this open

a virtual machine option

while just click on this
create a new virtual machine

and click on next
as you can see here.

You have an option which says
installer disc image file.

ISO file.

You'll have to attach
your so click on browse.

Let's see where I've stored
my color Linux as you can see.

I already have it here
and there's one file here.

Let me click on that and open

so I don't bother
about this at all.

It usually shows that
and then click on next year.

So it's asking

which operating system
will Be installed

on this virtual machine.

I wanted to be Line-X.

So make sure you select
Linux 64-bit and click

on next you have an option
to name your virtual machine.

Let's say Kali Linux.

And where do I want to store it

in my documents under watching
machines color next sure

and click on next.

It says it already exists.

Let me try this one.

Then let's take our Linux one
and next Yeah,

so basically Your Kali Linux
will need about a 20 GB.

Let's assign some 40 GB are
that's the maximum this size

that you can a lot

while you can a lot more
than that as well.

But minimum it needs about 20 GB
and you have an option

with Stay Store virtual disk as
a single file or multiple files.

Let's just select store
virtual disk as a single file

toward complications
and click on next here.

So as you can see,

you can review your virtual
machine settings here.

You have an option to make
changes to the settings.

You can make changes right now,
or you can do it later.

It as well.

Let's just go ahead
and make changes now.

Click on the customize
Hardware option here.

Well as for the memory
for this virtual machine,

it totally depends

on what you're using
virtual machine for

if you're not using
it for heavy works.

Then you can assign
least amount of memory.

Let's say I want
to assign about 2GB.

There we go.

And as for the processors number

of processors 1 and the number
of core processors,

you can choose as
many as you want.

Let's say to this
will increase the performance

of your virtual machine,

so and again,

Totally depends on whatever
you want to choose and yeah,

we have already attached
the image network adapter you

can set for not USB controller
and sound card.

You can retain
the default settings.

And as for the display click
on accelerated 3D Graphics sense

what color Linux has
a graphical user interface

and it says 768mb is
the recommended amount of memory

that you can use for graphics.

So let's go ahead and select
that and click on close.

Well, you can actually
make all the settings

after installing color index.

As well no problem there.

Once you've done
that click on finish here,

as you can see,
my color Linux image is ready.

For installation.

You have two options to power up

as you can see you have
this option here.

You can click on that to power
on this virtual machine,

or you can go ahead
and click on this.

Let me click on this.

So once you click on that,

you should be greeted
with this Kali boot screen

as you can see,
there are a lot of options here.

We did discuss live
option earlier, right?

So if you don't want

any trace of Kali Linux
on your operating system,

you can go ahead and use
live option here.

You have live

USB persistence mode and live
USB encrypted persistence

as well suppose.

You want to store some data
and save it for later

the boots you can use
live persistent option here

and most of the time
people get confused

with this installing
graphical install.

Just don't go ahead
and click on it.

Style option do it only

if you are well versed
with command line interface.

So basically that install option
is for command line interface.

So you will be greeted with Kali
Linux command line interface

since if you're doing it

if you're using Kali Linux
for the first time go ahead

with graphical installed select
the graphical install

and click enter.

So as you can see,

it will start
mounting storage devices

whole installation process
might take about 10 minutes.

So it's prompting you

to select a language so select
your preferred language,

then you control location.

Let's say English

and click on enter
and it's asking you

for the country location
just give United States

and enter and I want
the keyboard to be configured

with American English.

You can choose
any native language.

Like I said earlier it supports

multilingual or it
supports Get the languages.

So go ahead and choose it,

but it might complicate the way
you use Khalil mix later.

So you can always go ahead
and stick out with English only.

Well, it doesn't matter.

So as you can see
it's configuring the network.

So it will detect the ISO file
and load installation component

and then prompt you to enter
the hostname for your system

while in this installation.

Let's just enter Kali
and click on and off.

You can give the name you want
and next it's asking you

for the domain name suppose.

You have set
up virtual machines.

Jeans, and if you want to give
all of them a domain name,

you can assign
a domain name as well,

but it's optional.

Let's not give any domain name
here and click on enter.

The next thing it does is it
will prompt you for the password

that you'll have to enter every
time you launch your Kali Linux.

So just give some password
of your choice.

And click on continue.

The best thing about callanetics
is you can set up date

and time as well.

You can make it
later as well,

but you can choose it here.

So just click on Eastern
of whichever choice you like

and click on enter.

So the installer will now prob

your disk and offer you
four different choices,

as you can see,

it says guided use entire disk
guided use entire disk

and setup lvm,

which is logical volume
manager same thing,

which is encrypted and manual.

So if you are an expert,

if you already use
this color index

before you can go ahead

and select any of this three
options from the bottom.

That's he'll be a more manual
or encrypted lvm.

Otherwise, you can always

go ahead and choose guided
use entire disk option here

if you are a beginner

and click on enter so This
is the disk partition.

Where'd all the data will be
stored and click on continue.

It's asking if you want
to stores all files

in one partition,

or if you want
to make partitions.

So depending on your needs,

you can go ahead and choose
to keep all your files

in single partition,

which is default or you
have separate partition

for one or more
of the top-level directories.

Let's just choose
the first option

and click on enter.

So once you've done
that you'll have

one last chance to review
our disk configuration.

Once you're sure

that you've given correct
details click on enter here.

It's asking if the changes
that you make to Kali Linux

should be written
to the disk or not.

So say yes.

So we did start partition
and install the washing machine.

It took a while but

as you can see installation
is almost done.

It's asking me to configure
the package manager.

Well, if you select
no in the session,

you will not be able
to install packages

from Cali repositories later
and click on continue.

So suppose if you want
to install other repositories

or updates later on you
can always go and click on yes.

Otherwise, it's always otherwise
you can go for know as well.

Now it's going to configure
the package manager

will install package manager

and configure it then it
will install GRUB boot loader.

And it's asking

if you want to install GRUB boot
loader to master boot record.

Definitely.

Yes so select.

Yes and click on continue.

So it's asking to select
the device manually.

You can click
the select the device.

So yeah, guys we're done here.

So you can finally click

on continue option to reboot
your new color installation.

So as you can see

the entire process took
about 10 to 11 minutes.

So yeah, let's go ahead
and click on continue here.

It's gonna finish
the installation.

So guys as you can see
the installation process

from the step where we
select the language

till the last step is same.

It's just the medium on which
you are installing is different

for example, right now.

We use VMware later on.

I'll show you
how to use virtualbox.

But once you color Linux image
is ready to boot the rest

of the installation process
is similar to this.

So it's finished installing.

It's loading the image.

So if you have done

everything right during
the installation process

and according to
your needs your land up

in this page use a name.

So we've given
at this Scully right kli

and password as you can see
it showing an error.

It says the didn't work.

Please try again.

This is mostly
because if first time

when you log in you

should use word root as
your default username.

But later on

once you have already logged
in you can change the username

according to your need so root

and password you can use
the same password

which you set
during installation.

In process so as you
can see login is successful

and here I go my Kali
Linux is up and running

so I can start using cullinan X
according to my needs.

So once you've done

that you can go ahead
and install VMware tools

so that you can maximize it
full screen and all that stuff.

You can also go ahead
and change the date

and time settings.

As you can see here can go
for the settings option here

and do the settings

and you can start using

Color Linux for hacking and
penetration testing purposes.

So it's as easy as that guys.

So please Please go
ahead and try installing it.

Well, if you find any errors
during installation process,

let us know
in the comment session.

We'll get back to you
as soon as possible.

Now.

Let's move on
to our second demo.

Now.

We'll see how to launch Cullen X

on Mac operating system using
virtualbox in the previous demo.

We use VMware and now
we'll be using virtualbox.

But actually I'm not using
any Mac system here

operating system,

but I'll show you
how to install using virtualbox.

The procedure is very similar.

So all you have to do is
on your Mac operating system.

Go ahead and click a
for Should box download.

So this is the
virtualbox official page.

You can go ahead and click
on downloads here.

As you can see you have
different options here.

It says windows

for Windows operating system
OS X host line X and solar host

since if you're using
Windows then go ahead

and select Windows host.

But as for Mark,
you'll have to select this.

It's mostly a DOT exe file.

Once you've done
that you can install virtualbox.

It's just click
on next next next

and it will walk out

and provide settings
according to your need.

I already have
installed virtualbox.

It's the next thing
you do is similar as

what you've done with VMware.

Go ahead and download
official Kali Linux image.

Make sure you don't download
any duplicate versions

of ISO file from other websites.

Make sure you download it
from original website.

If you want to do it
from the beginning

go ahead and install
ISO file your torrent

or you can just go ahead

and download just the image
for Wii virtual box here

for 64 bit and you have option
for 32-bit as well.

I've already done that.

So let me open my Virtual box.

Yeah artists the procedure
for VMware and watch

the box is almost seen
just slight difference.

Let me maximize
the screen for you guys

as you can see I already have

and watching machine
launched up here.

I haven't powered it up yet.

Anyway, I'll show you
how to install new one.

Just click on new' option here.

This is your
virtualbox homepage guys.

So click on New Year
and just give a name.

We've already given

color Linux all you're right
for the virtual machine.

So let's give it
some of the name.

Let's say capital K L line.

Unix and choose the type
of operating system

that's line X and here 64-bit -

64-bit according to
your operating system needs you

can go ahead and choose it 32

but as well click
on next and again,

like I said earlier

depending on what you're doing
on color Linux operating system

or virtual machine you go ahead
and design the memory

since I'm just showing you

how to install I'm not assigning
much memory you have.

So let's just retain
the default ones it to 4mb.

That's 1 GB and click on next

and it's asking you have
a three options here.

Of not to add virtual artists
create virtual orders now

and you can go ahead and add
a virtual hard disk,

you use an external
virtual hard disk.

Go ahead and select
the second option click

on create and use
virtualbox image.

Like I said earlier
we downloaded ISO image,

right and it's an ISO file
with extension dot

is oh, so basically it's nothing
but image so click on next

and I want to the storage

on physical hard disk
to be assigned dynamically

and click on next.

So this is the name
of the virtual machine

which we just gave all your
it's asking you to choose

the path wherever you want
to store your virtual machine.

Let's say documents

and watching machines click
on open and save

so that's the part of setup.

And as for the memory call

you always needs you
to assign at least 20 GB.

So let's go ahead

and give 20 GB you
can always assign more than that

and click on create.

So this is the one we
just created right?

It's ready.

Just click on settings
before you power up.

You'll have to make
certain settings.

So if you want to change name

or type and version
you can always go ahead

and do that here.

We don't have anything
in advance is just the folder

where your virtual machine
with this Toad go for systems.

We won't be using
any floppy disk are so right.

So on ticket or uncheck it and

yeah, this is memory

if you want to go ahead
and change or assign more memory

because the performance

of your virtual machine
is not that great.

It you can go ahead and do
that for the process

of make sure you enable
this extended features.

So basically if you want
to increase the performance

of your virtual
machine the number

of processors you assign
should increase Well for now

since I'm to show you

how to install and just going
to assign one you have option

to increase to say to like that.

And as for the display,

you can enable 3D acceleration
display storage settings.

This is the most
important one right now.

We don't have any image attached
to your so click on this empty

and click on the CD image

that you see here
and choose watch.

And attach the image or die.

So Fire torrent file,

which you just downloaded
click on open and audio

no settings default
Network by default.

You can always set it for Nat

since we're using only one
watching machine ha but

if you want to use a cuddle in X
with any other motion machine

like Metasploit able to you can
go ahead and use this host-only

adapter option here
because when you use Nat

and when you have
two virtual machines,

both of them will be assigned
with same IP address,

which will definitely a problem.

L'm because both

of these virtual machines
need to interact right?

So, yeah.

Well, I'm just saying all
this video information

so you can go ahead
and click on host-only adapter

if you using 2 virtual machines

and you want them
to interact as for now,

I'm just retaining
it Nat and rest

you can you don't have to make
any changes and click on OK

once you've made all
the settings click

on this or you can go ahead
and click on start option.

Are you can light click
on it and start Again,

like I said,

the installation process from
Step One is very similar to that

whether using VMware.

So again, you'll be greeted
with Kali boot screen and you

have multiple options again.

I'm not repeating
the entire thing here.

So go ahead and click
on graphical install.

And if you're a pro
and using command line,

you can always go
for install option.

And if you want to just use it
for one time purpose,

you can always go
for live option here.

That's all guys.

I'm sure you can catch
it from here, right?

Because it's almost similar
to the ones we did using VMware

if you have Here are just go
back and take a look at it.

Yeah, well, like I said,

I showed you on how to use
virtualbox to install Kali Linux

on Windows operating system.

Well, let's aim
for the Mac as well.

You just have to download your
stuff there instead of Windows.

You have another option
with this operating system.

You can dual boot
your color Linux

with Windows or Mac.

It's not as easy as
these installation process

because it will involve
you setting the BIOS to changes

that you get to see

when you power up
your computer initially.

Make sure you refer to color
Linux official documentation

and make sure you've done
the installation properly

so that you won't mess
up your default settings.

So guys we are done
with two ways

of installing Kali Linux one
on Windows and one on Mac.

We saw how to install it using
VMware as well as virtual box

in the third part will see

how to install Kali tools
on any Linux distribution.

It could be Ubuntu Fedora
peppermint operating system

or any other version
or distribution of Linux.

The procedure is

actually similar in
every Linux distribution.

So if you follow up
on one Linux distribution,

you can go ahead and do it

on the Linux distribution
of your choice or the one

that you use One thing
you should remember is

that Kali Linux is not for
the Dai Li line X purposes.

Well, it's only
for ethical hacking

or web application penetration
testing for these purposes.

So guys will be using
a tool called Catalan.

Let me spell it for you guys.

It's Ka T WL iron.

So let's just search for that.

There we go.

It's a script that helps you
to install Kali Linux tools

on your Linux distribution
of your choice.

So it's usually
the GitHub script.

So click on the first link
that you find.

So for those of you

who like to use penetration
testing tools provided by

Kali Linux development team.

You can effectively do

that on your preferred Linux
distribution using this tool

which is Catalan
or Ka t oo a lion.

So as you can see once you've
installed Catalan properly

on your operating system,

you should be greeted
with this page.

I'll show you how to do that.

What about it?

So the purpose of asking you

to see this page is to take
a look at prerequisite hours.

So first thing you need
to have a python of version

2.7 or above installed
in your operating system

and you need a line
exists efficient system.

It could be Ubuntu
or it could be Fedora

or peppermint any other
planets distribution.

I have a bun to here.

I'll be using
VMware Workstation Pro.

It's already open but let
me just go back.

All you have to do is
search for one, too.

And click on the first link.

So as you can see there are
a lot of options yet

for to install a bin
to just click on this

and you'll be able
to download a file ISO image.

I've already done that.

I'm not doing it again.

Let's go back
to VMware Workstation

as you can see.

I already have my Ubuntu
operating system installed

installing a window is
it's very straightforward.

So just take a look
at the instructions

that you need to know when
you're installing Ubuntu once

you've done the installation,

which should look
something like this.

So let me power up.

I've been to operating system.

So as you can see,

once you install your land up
on this page and it's asking

for the password you
set up this username

and password during
the installation process.

So don't worry about it.

Click on enter.

So let's say you are
a Unix lover you

like using your next platform.

But right now you want to use

certain tools for performing
application penetration,

testing and ethical hacking.

You just don't need
all the tools.

You need few Tools

in that case instead of
installing color index

on your operating system
installing only certain

color Linux tools will be
The best option right for that.

Like I said earlier
will be using cut Olin.

I have a set
of four five commands

that you need to use
to install Catalan Festival.

You need to have get
on your operating system.

Let me check
if I have it or not.

Anyway, I have these five
or four set of commands

which will be using
I'm going to attach them

in the description below.

So if you want you can use them

as you can see install
get First Command.

It says unable to use it

because have to login
as a root user.

So let me just it's asking
for the password.

Yeah now I'm a root user.

So let me try the command again.

That's apt-get install Kit.

Yeah installing get it's just
going to take few minutes.

But while this is happening,

let's go ahead
and explore cartoon

to let me go for Firefox here.

Let's search for Carter:

so it's the first link guys
like I said earlier,

so let me scroll down

as we saw the should be
the home page

and we did take a look
at the requirements.

So let's just go back and see
if it's done.

It's still happening.

So one thing is make
sure you have a python

or version 2.7 or above.

Otherwise the entire thing
won't work at all.

Yeah guys it's done.

Now.

We are done with the first step.

We need to install a we need
to clone the cartel in right?

So what you do?

Like I said,

I have a command right
here just copy this

and place it over
there control C.

Let's go back to terminal and it
makes your skin for you guys.

Yeah.

And based so basically
I'm cloning it here

and the next command is
I'm copying the python file

to this directory and click on

until it's done.

It's just quick process now,
we'll have to change permissions

so that we have access
to use Catalan for that.

Basically.

We are giving
execute permission.

So chmod plus X. Make sure
you take a look at that +

x + enter we are audio
is now our cut line

is installed say a lion,

so as you can see It's

already the first thing
that you should do is

before you upgrade
your system essays.

Please remove all the color
like repositories to avoid

any kind of problems.

So as you can see it shows
you like five options here.

First one is
Azad Kali repositories

and update next view categories.

Like I said,

Kali Linux is 600
plus tools, right?

So you have different
tools categorized

under different headings.

Then you have
classic menu indicator.

It's nothing here
as you can see.

I have a small icon here.

If you click on that,

it'll just show
you different menus.

That's all and if you
want to install color menu

for easy access you
can do that as well.

So let me just click one
under one that says add

color Linux repositories update
remove and view all kundan's.

So let's try removing them.

Let's drive with
adding repositories.

It is there are certain
duplicate signatures removed

and all that.

So let's just try to remove

like they suggested earlier
have been deleted now one.

So if you guys want to go ahead

and update the repositories
already existing ones,

you can go ahead and do that.

I'm not doing it now

because it's going
to take a while.

So if you want to go
back just click back.

It's as easy as that.

Now, let's say I want
to view categories

and install one to love it
as you can see.

There are like number
of fusion number

of categories here.

So I have web application
penetration tools your

have password attacks.

I have exploitation tools.

Well, if you are interested,

there's an introduction video
of what is Kali Linux

by director in the south.

Security playlist.

So go ahead and take
a look at that.

We have explained

like about five to six popular
tools in Kali Linux.

Anyway getting back
to today's session.

Let me just say for

as you can see it lists all
the web application tools.

So if I want to install
all those there's an option

that's zero, but let's
just say I want an install

a tool called SQL map.

I'm sure you might
have heard SQL map.

If not, it's okay.

It's a tool which you
use for checking out

vulnerabilities at a present
an application database system.

So anyway, it asks
inside the number of the tool

that you want to install.

Let's say 27.

So as you can
see it's installing.

So it's as if you said guys so
once you just done installing,

I'll get back to you.

Any tool I just
showed you how to use

how to install SQL map

which is there
in web application tools.

You can go ahead and do

that for other different types
of tools as well suppose.

You want to install
all the tools.

You can go forward 0 as
in click on zero option.

So there you go guys.

I just showed you
how to install one tool

so you can go ahead and do
that for any kind of stool

under any category.

So if you just want
to go back click pack

and go for other types of tools,

let's say eight there you can
see so whatever different time

of exploration tools you
want you can go ahead

and install them.

Let me just click back

and the back sometimes when you
try to install all the tools,

you might get an error saying

that's the file doesn't exist
or depository doesn't exist.

All you have to do is go
for one First Option here.

As you can see here
you have option two

which is update.

So update your repositories.

Make sure the Kali Linux mirror

which is present for
the updation as the right one.

Once I've done
that you won't get any errors.

All the tools will
be installed properly.

So suppose you want to get
back from these cattle

and easy just press control C.

And yeah as you can see
it says goodbye.

So that's as easy as it is to
use colonics tools on any kind

of Linux distribution

while I've showed you on a bun
to the procedure is same

on any other Linux
distribution guys.

So there we go guys.

I've done with
three things first.

We did on Windows
using VMware then

on Mac using virtualbox
and third I showed you

how to install Kali
Linux tools on any kind

of Linux distribution.

And finally, there's
one last demo here.

We'll see how to
install Kali Linux

or Windows operating system
using Windows subsystem

for Linux feature.

So, let me get back
to my operating system.

We won't be needing
VMware Workstation anymore.

So guys will be using
a feature called

windows subsystem for Linux,

which is By default present
in all the current versions

of Windows 10.

This is actually for those

who prefer using Color Linux
command line interface.

So make sure to listen
to me properly.

Oh use this option only

if you are a pro in using
command line interface

or if you have any experience
using command line interface.

Otherwise just go ahead and use
VMware watch the box

and install Kali Linux graphical
user interface option.

So yeah, this windows subsystem

for line X allows you to run
Linux distributions as subsystem

on your Windows
operating system this

Her is really a new feature.

It exists only in Windows 10.

So you need to use
latest version of Windows

10 to perform this demo
or use this option.

And in addition to that.

We also have
other prerequisites,

especially we need
to have git installed

or you can go ahead
and zip the file

which is Windows subsystem
for Linux files normally

but having it is
also a nice day.

Secondly, you need
to have python

of version 3 or above make sure
you've installed Python and set

up the path to check

if your python is installed
properly or not just sake.

Go via command prompt
and just type a python version.

It should show

you wasn't properly only
then you can be sure

that your python
is properly installed.

As you can see for made showing
three point six point seven,

which is definitely above three,

and it's properly installed
in the path is set.

The first thing you
need to do is enable WSL

or Windows subsystem for Linux.

Just go for the control panel
and there click on programs

and turn Windows features

on or off make sure
not to touch any other features.

It might mess up
your operating system.

So scroll down.

It's usually at the bottom.

Bye.

For let's never nibbled a few

using it for the first time you
need to enable it.

So first thing you
do is enable it

as you can see here.

It says windows
subsystem for Linux.

Make sure you enable it check
mark it and click on OK.

Once you have done
that run your command prompt

or terminal as an administrator.

All you have to do is
right-click on it and click

on run as administrator.

And yes now will be
enabling based distribution.

That is like I said windows
subsystem for Linux allows

you to run a line X
distribution as subsystem.

Right, but for that
we need to enable

this base distribution for that.

You need to install
the base distribution

or any kind of Linux
distribution that you need.

So just use LX run and install.

So once you type

that this is the output
which you get it says,

it's the Legacy Windows system
for Linux distribution.

So you can go ahead and install
other Linux distribution

which are available
in Microsoft store.

But unfortunately Kali Linux
is not available,

but it doesn't matter right.

We're anyway installing
it using the procedure.

Just click on why
here saying yes,

I've already installed.

So it's showing
Legacy Windows system

for Linux distribution
is already installed

on my system for you.

It might take a while
after installing.

The most important
thing is it lasts

for you to set up a password

and username don't skip
that step wait for a while

and make sure you set
up the password and use

an improperly only then
entire thing will work out

once you've done
that we are done here.

You can close
the command prompt.

The next thing you need
to do is install git

I already have it installed.

It's very easy install
dot exe file and click

on installation process.

It's very straightforward
and open git bash.

Yeah before that.

Let me go ahead and create
a folder called text here.

And as you can see it stored
on my desktop right now,

it's empty.

Anyway, let me go back
to get here and CD desktop

TST all your Venable
windows subsystem for Linux.

But now we have to download
the script right for that.

Search for Windows subsystem
for Linux Witcher.

And the first link is
the GitHub link click on that.

There you go guys.

It says windows subsystem
for Linux distributions,

which are it is the purpose
is to let you easily download

and install Linux distribution

as subsystem on your
Windows operating system.

So as you can see you have
different options here

for the base operating systems.

So yeah copy this link
here control see see

and go back to git git clone

and paste the link which you
just download it paste it.

It shouldn't take very long.

It's done guys.

So now if your check
your test folder

Windows subsystem for Linux
will be downloaded properly.

Let's just go back and check
that here is our test folder

as you can see windows subsystem
for Linux is already there

now open your command prompt.

CD let's go for the text file.

And if you search

for the directories under
that you can see WSL here.

Now, let's go for that as well.

You can just press stop
directories under that

so as you can see the two things
the most important things is

this get pre-built dot p y

and install py

this KET pre-build py will fetch
Kali Linux Docker files

and installed our py
will install Kali Linux for you.

I already have it installed.

But I'll just show you
how to do it.

So go back to the browser
and type talk a file.

Click on the second link.

I just wanted few

to copy the command easily
so that you won't make mistakes.

This is the one

which you'll have
to copy to fetch

the color index dog of files.

So you can just copy this part
and go for command prompt.

Let me maximize this for
you here you can say so

if you remember I said
python is masked.

So make sure you install

it properly and set
up the path White.

And get pre-built.

Let me just people dot
pi and copy it.

As you can see it's installing.

It's going to take
probably like 2 minutes.

So it says it's done

at says it's safe to this file
in the text folder.

Let's go back and check
if that's happened.

Here's a test folder
under WSL you have python

as you can see you
have python folder.

Is it folder
of Kali Linux installed

or fetched you'll have
to install it now,

right?

So let me now just type python.

This is the command
that you want to use

that's installed on pie
and stalled out pie

and copy this or just type
and enter tab lutefisk stabbed

and click enter.

So as you can see
it took a while

but it did install right now.

All you have to do is
it's installed so you

can close the CMD and open
your command prompt and run it

as an administrator click.

Yes.

Let me maximize the screen
you'll have to set

the root password are
the default user as brute so

set default the command

that you need to use
hit default user as root.

As you can see it's now set
to root and click Bash.

Done guys, right now.

We are running

on Callie operating system
on command line interface

if want to make sure

if you're actually running
on Curry just type

Cat ATC and issue.

It shows that
Kali Linux rolling.

So as you can see we

have successfully installed Kali
Linux command line interface

or how to use command line
interface on Windows using

Windows subsystem for Linux
and I'm telling it to you again

just use it if you know

how to use command line
interface very properly.

Otherwise Might be

a little overwhelming
subpoenas the fault.

It's the command that you need
to use hit default user as

root as you can see.

It's now set to root
and click Bash.

Done guys, right now.

We are running

on Callie operating system
on command line interface

if want to make sure

if you're actually running
on Curry just type Cat ATC

and issue its shows
that Kali Linux rolling.

So as you can see we

have successfully installed Kali
Linux command line interface

or how to use command line
interface on Windows using

Windows subsystem for Linux
and I'm telling it to you again

just use it if you know

how to use command line
interface very properly.

Otherwise It might be a little
overwhelming for beginners.

So now it's time

that we go through
the command line basics

of any Linux terminal.

Now, the Linux terminal
is a very powerful tool.

It allows you to move around
the whole operating system

through the files and folders.

It allows you to create files.

She's their permissions change

how they behave

and a bunch of other things you
can do filtering you can grab

stuff the specific stuff
from a specific file

and there's a bunch
of interesting thing

that you can do

and as an ethical hacker
you will be working

with Knox distribution
most of the time

whether it may be Kali Linux

or some other thing
like Peridot s

but you will be working
on enough most of the time

because it's a powerful tool
for networking analysis

and scanning and
all sorts of stuff

that you want to do
as an ethical hacker.

So the First Essential step
is to actually know

how to use the tool

that is available to you
and that is out here,

which is the terminal now

as I'm running this
on a virtual machine,

you might find it

that my execution times
a much slower and that is

because I I have
a very very slow laptop

because my virtual machine
is actually eating up a lot

of my Ram and I have a bunch
of other processes

that are also rendering

I do this on my free time.

So let's go ahead and go
through the commands

that we are going
to actually go through now.

Let me actually make
a list of commands

that I want to teach you guys.

So let me see

if leafpad is available
firstly leafpad is

basically a text editor.

So the first come on

that we're going
to start off with is CD.

CD stands for change directory
now at this moment.

We are in the root directory

as you guys can see we can print
the current working directory

with the single PWD and that is
a current working directory

as you see it's called route

and suppose we want to change
directory to the home directory.

So all you have to do
is CD which stands

for change directory

as I just said
and specify the part.

No CD / home.

Okay.

So once we're in home,

I want to make
a list of commands

that are used on the CLI
that I want to teach you guys.

Guys, so what would I do
I would firstly see

if any files are available
that I can edit.

Okay, so these files

are available, but let's create
a new file for ourselves.

So firstly let's do
Nano list dot txt.

Now.

What Nano does is
now we'll open up

a small command line text editor

now come online text editors

are very much used
by ethical hackers

because they save
a bunch of time

if there's always switching
between GUI and command-line

because you'll be doing a bunch
of stuff on the command line

and Will you want to write
something you're always

switching to gooey?

It's a waste of time
and you want to see

if I'm as an ethical hacker.

So you can use this thing
called a command line editor

and it can basically do most of
the stuff a GUI editor would do.

Now you say Nano
and the name of this file.

So now basically
has created this file now

and it has opened up
this new fresh window,

which overrides the command line

that we were in The Bash
and this is a place

where you can actually edit

what goes in the file
now, let's see.

See the list of commands
that I'm going to teach you.

I'm going to teach you LS LS
will be the list of files.

We did CD.

We saw a PWD.

So that was a print working
directory will be looking at

how you can copy stuff
at the CP command.

Then we will be looking at MV

which is basically move then
we will be looking at cap.

And that's an interesting one

and also less which is
another interesting thing

and we'll be looking at grep

which is actually
used for graphing

or grabbing things from files

that You might want
to see you'll see

what I mean and a short

while we will see echo which
probably does what you think.

If you have any experience
with the Linux,

then we'll be doing touch

and we'll be doing make
their which is make directory

and then we'll do
in ch own chmod

then all the most
dangerous commands has RM

and then you can do man.

Let's help.

Okay.

So these are
the list of commands

that we are going to go through

in this As part of the video so
suppose I was making this video

and I want to
save the somewhere.

So you see down here.

There are a bunch of options
that are sure to you.

Now this cat it sign
might be not really thinking

that the shift 6
1 it's not shift 6:00.

It's actually a controlled
so cat it is controlled

and then G of course means G.

So if you go Control G,
it will actually get help.

Now.

What we want to do
is save the file

and that is control.

Oh and that is right out.

So what we want
to Who is a control?

Oh, and now it's going to say

if we want to name
the file list at the XD

and we want to name
the file and it says

that we have written
down 15 lines.

So that's how you save a file.

Now.

All you want to do
is exit out of you.

Okay.

So first let's go LS and let's
go through whatever there is.

So LS showed us the list
of files that are there

in that directory.

Now Alice can also
show you the list

of files in a directory.

Curry with the paths

that you specify
likewise ALS VAR.

It'll show me everything
that is involved.

Okay, there are a lot
of interesting things like bar.

So let's head over twice CD /
bar and you hit enter

and now we are
in the folder bar.

So now to actually demonstrate

how powerful analysis we have
a few Flags now to see the flags

of any command you
can just do - -

help universally throughout
the Unix one line so out here

you see some information

that is Stuff to read
but if you go on top

and scroll out here,

you'll see all the flags

that you can use
with the command.

That is LS and
how you can use them

so you can see

what you use and you can read
a little bit about it.

So if you use all it ignores
entries starting with DOT,

so suppose we were to do LS

in why let's see so
it shows us like this now

if you do LSL,

it'll show a long list
with more information.

So these are the permissions
Options that you see out here

we will be seeing

how we can change

the permissions of a file
soon enough and this is

who owns the file the user

and the user group
is the file number.

I guess.

I'm not sure which is

when the created the name
of the file is the time

when the file was
created, I guess.

Okay.

So that's how you get
very detailed information

about all the files now.

That's another thing you
might want to use with ALS

and that is the 8X
so you can go LS

a and it will show you all.

Of the hidden files also.

So now you see some two files
that were not shown out here.

Our file is begins from backup.

But when we do LS, / I mean -

La we see two more files
at this Dot and Dot so let's see

if we can move into that CD dot
so we can't even move into that.

So that's interesting.

So these are hidden files.

So these are not seen
two random users

and we can actually
do stuff with them.

We will see how we
can use hidden.

Hours later on.

So if you want to show
hidden files through LSU,

all you have to do is LS and -
La so that was all about LS.

So let's move back to /home
where our list of commands

that I want to show you
always so silly home.

Let's Alas and see
what was it called,

its called list and suppose.

I want to see the condensed
of list or txt.

All I have to do
is say list dot txt.

Now.

It shows us whatever
this file is containing.

It will read it out for you.

Done CD we've done LS

and its various forms

we've done PWD now it's time
to do CP CP is basically used

for copying files from one place
to another so suppose.

I want to copy this address file

that is there into
some other directory.

Let's save our so all I would
have to do is CP name Dot txt.

And then you specify
which location you want

to actually copy it
to so CD / VAR.

So this is where I want to copy
my file to and you hit enter

and it's Copied but
that was a very small file now.

We can actually check
if it was copied

before I move on and pour
some more knowledge into you.

So let's go into VAR.

So CD / VAR hit enter
and you're involved again

and you CLS and now
you see a name dot txt.

So let's remove
name dot exe from here

because I want to copy
it again and show y'all

a difference between a flag
that I'm going to use right now.

So the -

and letters that you
use are called flag.

Technically in the
Linux terminal RG.

So let's go back to home now
instead of the name of the file

and moving back home.

Just like I did you can type

out the complete name
of the file out here.

So you could have gone
CD slash home slash name

Dot txt and copy to slash bar.

But this time

what we're going to do is
we're going to use a hyphen V,

which is basically used

for a verbose output
of whatever you're doing.

So most of the commands

that we're going
to using will have a -

V with them.

So, let's see how this
actually affects the output.

So what we're going to do
is we want to copy so sleepy

and verbose and we want
to copy the file name Dot txt.

And we want to copy it
to the folder called VAR, right?

So now you'll see

that it will give us
what is being moved rather

that is named Dot txt.

And where it is being moved
to so this is a very good way

of knowing what is
actually happening because

if you do it without the verbose
And suppose name not the XD was

just 20 GB file
and you just don't know

if it has finished or not.

So if it's a 20 GB file

that is continuously update you
on where what is being copied.

So basically all you
have to do is type -

V if you want to know

where your files being copied
and the exact part.

Okay, so that was about
how you can copy files

from here and there now,

what was the next command
that we want to see so cat.

So, let me just go and see
the next command

that is there so list at the XT

so after God I want
to show less Okay.

So we've done CP we
also have to do MV.

Now as you guys can see

that CP is basically
a copy copy is

as you would expect it leaves
a copy of the file that

in the original directory

while also maintaining
a copy in the directory

that you specified.

But if you want to move
the file completely,

all you would have to do
is use the command MV.

So MV is for moving
the file now,

let's see what all goes with MV

so you can type help

and as I said you get
the verbose option

And you get suffixes
you can force things

to happen to suppose.

You don't have the permission do
not problem before overwriting.

So it'll give you a prompt
and you can completely

overlooked the problem
with the F thing.

Let me just show you
how that looks like.

We'll be doing a verbose

and we will be coughing the
address dot txt file and okay.

So every time I've
been actually typing

so you can do address
or txt by just pressing Tab

and it will auto complete
so address or txt to / -

bar now, it will show you

that it is actually renamed
addressed at the XD

to VAR dress dot txt.

Now.

If you go and do LS
out here you will see

that address dot txt is
not actually he go

but if we were
to move to VAR,

so CD / far, okay.

I've also been
typing out commands

that have been previously using

and you can simply toggle
through all the commands

that you've used by
the up and down keys.

So LS MV MV V help I did CD home

and I have to go through all
this just to prove a point.

It's a seedy bar.

We want to change that now.

We're in the variable folder.

And we also want to see
what we have out here.

So address should be
out here and Alas and

as you guys can see addressed
at the XT is the first file

that has come up and it
is basically the same file

and it can prove that to you
by just getting the file

and as address txt.

And you see

that is some random address
for some random person.

Okay now, Let's quickly clear
out a file or window.

You can do that
with the control l

or you can just type or clear.

Now.

What we want to do
is move back to home.

So yeah

City home.

Okay.

So now that we're
back at home again.

Let's get out our next file.

So let's start the XT

and after move I wanted to go
through cap now cat

as you guys can see is printing
out the contents of a file

and there's also less

which does something
very similar to cat.

So, let's see what it does.

So if you go less

and you list.txt you actually
see the contents of the file

in a completely new window,

which overlays on
the previous window

and this is a very neat way
to actually see the contents

of a file which is true less.

If you want to keep
your main command line interface

not so cluttered which cat
clatters it completely.

So if you want to get out
of this place this less place

and all you have
to do is press q

and Q gets you back and

as you see nothing was printed
out on our main interface.

So this is a very
cool way to actually keep

your command line interface neat
and tidy when you're doing work.

Okay, so crap,

so grab is used for actually
filtering out stuff from file.

So suppose we want to see

whether a command has
some verbose option

to it or not.

So now I know

that MV has a purpose command
but suppose I didn't know

that so MV - - helped then
you use the pipe sign.

So what the pipes Means

is you have to take
this command the First Command

and then you five nine and two
the second come on

and you want to see graph -

V if that exists.

Okay, so let's see
grab for both.

Yep.

So a verbose exists
and that is -

be and that's - -

verbose so explaining
what is being done.

So what happened out
here is basically

we took this first command

and then we filter it

and filtering is done
through the piping.

So basically think
about you taking some Ian

and pipelining it
through something else

which funnels it
out of this command

which is grip

so you can use MV /

help in conjunction with a bunch
of other commands just

on correct and I'll leave
the creativity up to you.

So grab is basically
used for getting

what you want from a file

and graph is used very very much
throughout the source

of this video through
this Kali Linux tutorial

that you're going
to be watching.

So that is a very
easy way to see

if you have a particular option

or let me do Against also
so CD / VAR now,

we're in the bar folder.

And let's LS.

We actually have name dot txt.

Now.

Let's also go into backups
OCD be and tapped and

that brings us back up folder

and we're now in the backup
folder Let's do an LS out here.

Okay, so we have
a bunch of files.

Okay.

We have some password dot back.

No see if you have cat
and you go password got back.

You can see the entire thing.

Now what?

What if you didn't want
this entirety of it or

if you want something

in particular you
want to be very neat

so you can do that same command.

You can pipeline it

and you can see grab and you
want everything with no login

so we can see

that there's a bunch of things

that say no login

and we only want those
and these are all the things

that say no login in them and

it's a much less a list
and it gives us a very

particular list that
you are looking for.

So that is how you use crap.

So now let's head back.

To home.

Okay, I've done wrong.

And again, let's see

what the next Monday's so
now let's start the XD.

So we've done crap.

We now have to do Echo Echo

and then touch OK let's go
back a few we press q

and we get out of there.

So what did I have
to teach again?

I'm such a dummy
we have do Echo.

Okay.

So what does it Echo used
for so suppose you will say Echo

and open code hello world.

It would basically do
what the man says that is.

Echo whatever you say now,

it'll say Echo hello world
and that will basically

Echo whatever you typed out
in the conditions.

That is Hello World
spelled very wrong.

Okay now suppose you want
to actually put this into a file

so you could do
Echo hello world.

Let's spell it properly
this time and you want

to answer in the file.

We had a phone number I guess
for number dot exe.

Yep, and we can Echo
it at that thing.

Now that was done now.

Let's see.

What is it phone
number DOT txt phone.

Dot txt and it says hello world

so you can basically input
text it to a certain file

with the echo command and
that's how you do it.

Okay.

Now let's also see

how you can make directories and
that is with the make directory.

Come on.

So, okay.

We also have to do
touch before that.

I forgot now Dodge is used for
quickly creating files so touch

for you could save touch
and then the file name

so we can create
a name file again

name dot exe or or
that will create a name dot txt.

Let me just show it
to you and I sell

and we have a name dot txt.

We can also create
multiple files with touch

and you could say file1 file2

and file 3 so like this

you can create multiple
files and let me just LS

that out and show it
to you and let cell

and we have five on file
to open files three now.

We can also create a directory.

So make dir and the name
of the directory.

So suppose you wanted to say All
your movies in One Directory,

they make directory movie

and now you have
directory called movies

and you can also
move into movies.

So CD movie.

Okay, so that's
how you create directories

and you can move into them with
the change directory folder.

Now, let's see what
the next command was.

So CD and dot dot so
fit CD dot dot you can move back

to the previous folder
if I'm already know told you

that and since we're in movies
we can just go back to home

with CD dot dot after now.

Let's see what else is there,
so Cat list Dot txt.

And okay now CH own

chmod now CH own will be
a little tough to show

because we don't have any sort
of a user or here.

The root user is the only user

that we have on this virtual
box and set up but

if you want to change
the ownership of a file,

so let's see

so you can see the ownership
of a file through the LSL.

Come on and you see
that root and root.

So this is owner name.

And this is the owner group and
they're mostly the same thing.

So our next command app

you're going to actually
see is called CH own.

So let's see how CH own
is actually used CSU own

is used for changing
the ownership of a file.

So a actually don't remember
how to use CH own.

So if you actually don't
remember or you're getting stuck

somewhere just use
the help function.

So if a command
line argument symbolic,

so let me just go
through this one.

So this is how you use it owner
and then call them group.

Okay, and then the file name

so you go CH own

and then you want to say
the name of the owner

and the group you wanted
to belong to that is root

and rude and then you
specify the name of the file.

So suppose I
won't change file one

that already belongs
to root and root

so it doesn't really matter

because I don't have

any other username to actually
change the ownership to

so this is how you
would normally change ownership.

So let me just show you

where you can see the ownership
and that is LS -

L and I'll share the root
and root you see on file

one is basically
this is the owner.

This is the owner group.

They're normally the same thing
and the same name,

but if you had
some different owner

like a guest you could change it

by actually using the CH

own method the command methods
are different things.

I always get confused
because of the programming.

Okay.

Now the next command

that is left is called
chmod to actually show you

how chmod works.

Let me show you
an interesting file.

So suppose.

Let me just do this once okay

now Echo what you want to Echo?

Oh is let's Echo.

Hello world and let's put
that in quotation.

And we want to put
this in test now

once we've done that lets

Alas and we see

that we have
a test file out here

and we want to move test to test

our sh so tested sh
is the executable file

that is used in bash scripting.

So we move test to test
out sh the way you

actually execute batch files
on your command line is with .

+ / she say dot slash
and if I press T,

and I press tab.

You see that there is no options
that's coming up.

That is because they're start
sh is not an executable file

to test out sh is don't have
the executable permission.

So let me just show
that to you LS and you see test

or sh it doesn't
have the executable.

Now you see movie
it is executable.

I don't know why
it is a directory.

So it is an executable
you can move into it.

So it's blue and color.

So the way you I actually

can make this an executable is
by changing his permission.

So the way you do

that is chmod and basically
you change it to an executable.

So plus X that is
making an executable.

If you do plus RL
make it readable.

And if you do plus W
will make it writable also,

so if you do plus X
and do tests or SSH

and now you go and do LSL,

you'll see that SSH
has become green

because it is an executable file
now and now if you do dot slash

and you press T,

you get that Sh,

if I press tab,

so now it is
an executable file.

And if I executed it

presses out hello world
under the my screen.

So that's how you
can use the chmod

or which is basically the change
of emissions of files

and we'll be changing
permissions of files

throughout the course of
this video will be very useful

for us and you'll see

as we go along with this video.

Okay.

So the next thing

that I want to show
you only to our left

and I remember those now

and it is RM + RM is used
for actually removing.

A files so you
should be very careful

while using RM or any sort

of removing command
on a Linux system

because once you
remove something it is

very difficult to get it back
in as almost The Impossible.

It's not like Windows
where it's basically

just disappeared in
front of your eyes,

but it's still there in
the memory cluttering it all up.

That's why Linux
always Trump's Windows.

That's one of the reasons

and make a video
on that later on.

But for now,
let's focus on our M.

Now.

We can remove file one.

So, let's see so file one
is going to be removed.

So if he LS no,

you see 506 this but let
me show you our M.

And if I do movie

it'll say cannot remove
movie is a directory.

But if you go into the help menu
I bet there will be an option

that you can just
forcefully should move it.

So our M force will just
remove so our n /r

and you can do movie

and it will recursively remove
everything and if you go Hill

and do The LSL you'll see

that there is no movie.

He directory anymore.

And that is how you
can remove movies.

Now that problem

that you see out there is
actually a safety measure

because once you
remove a directory

and it's not retrievable,

that's a very sad scenario

and you don't want to get
yourself in such a scenario

in whatsoever possibility.

Okay moving on so on so forth

that was all about the RM folder
now you can do RM

and address of anything.

So RM, I know we moved
in address that the x

t so in The VAR folder
we can go our M VAR

and dress Dot txt.

And that will remove address
out the XD from the folder

of our let me just
show you that work.

So CD bar and LS and you see

that there is no address
or txt out here.

Okay, another way to get
help for any command

that you want is man
and suppose you want

to see what RM will show
everything about our M

that is there to show
to you show you

how to use use it'll give you
a description schnapps has named

remove files and directories.

It's a very useful way so out
here you see is the manual page.

So that is where means man

and you can press
line one nature.

You can press Q to quit.

So that's very much helpful.

OK guys.

So that was all
about the command line interface

and how we can use it to go
about the operating system

and change file permissions
copy fires move files

and a bunch of other stuff now
it's time to get on

with the interesting stuff

and that Is firstly we're going
to be learning how you

can actually see Anonymous
with proxy James OK guys.

So now that we are done
with the command line Basics.

It's time that we move
forward with proxy James.

So before we move forward
with proxy chains,

let us head back to PowerPoint
presentation and see what

exactly proxy chains are.

Okay.

So proxy chains now

as the name suggests
proxy chains are basically

a chain of proxies now,

where is the proxy used

a proxy is used whenever
you want to anonymize?

Has yourself on the wire
or the network?

You do not want to know or you
do not want to others know

what the source IP address was
for your client system

and to do this.

All you have to do is send
your package through a bunch

of intermediaries systems

and these intermediaries systems
carry the bucket out

and they transmit it
to the Target system.

And this is much
slower and let's see

how we can use this
in Kali Linux.

No in combination with tour
to in order to anonymize.

Pick not only
on web browsing traffic,

but rather instead on
all networks related traffic

generated by pretty
much older applications,

but you can also change
this in the settings.

Now, what we're going
to do is we're going

to open up the proxy
chain configuration file

and we're going to
understand all its options

that are available.

So to do that.

All you have to do is say no
you go into the ETC folder

and then you go
for the proxy chain

that conf and what
do you see out here?

Is in a new editor

and we had spoken
about Nano editor

when we were discussing
the CLI part.

I hope you haven't skip that now

what do you see
out here is a bunch

of instructions and options.

So let me just zoom in
into the Squall line interface

and now you can read
everything much well,

so what proxy jeans is well,

it gives you the ability
rather to draw out your traffic

through a series
of proxy servers

and stay Anonymous
in such a fashion by hiding

behind them or by having
them forward your request.

So it looks like
On the other side

that your requests are coming
from them as opposed

to you now surprisingly enough.

There are large amount
of these proxy servers out there

that you can use but they're
not very stable, you know,

they go up and down

and they're not very fast so
far specific targets,

they can be useful
but not for brute forcing

and not for any sort
of computing attack.

So suppose you're doing
something to certain Target

for trying to log in
or you're already logged

in you can definitely do it
through proxy chains,

and it will be reasonably fast
and reasonably stable.

As well, but

if you're doing some sort
of mass scanning

or your brute forcing a password

or something of a kind
of a proxy chain with a list

of proxies selected
from the internet,

especially the free proxies.

It's not going to work.

I mean it's going to work out
eventually in a technical sense,

but it will consume more time
than you can spare and by that.

I mean it can be
very very long time.

It can take about months
or two to do a simple scan.

So that's not an option and
there are other ways of doing

that but for the time being
I just want you to know

how you can use proxy jeans

and How you can configure
it and actually

because it's really useful

and I use it fairly
often a lot of people do

and it's a fantastic
piece of software.

So first off we have
the types of proxies.

So you see yes EDP socks
for and socks5 now,

they are fundamental differences
between these protocols

and you always want to find
yourself a socks5 proxy

as that's the best possible one

and that has the ability
to anonymize all sorts

of traffic scdp.

Well as a name it says
it's for HTTP traffic

and socks for Or is very similar

to Socks by but it
does not support IPv6 protocol

and it does not
support UDP protocol.

So this can be sucks for

and can be rather problematic
and you always want to make sure

that you're using socks5
wherever and however any way

down below you have
these other options,

which we will go over.

So basically how you
enable these options is

that you don't need to type
some complex lines of code

or anything of any kind

basically you all you have to do
is just leave the hash out here.

I'll show you so suppose we want

Do actually activate
Dynamic jeans option.

So all we have to do
is delete the hash.

But let's put
in the harsh right now.

So after you delete the harsh,

all you have to do is save
the file and the option

is enabled this hash presents
a commented out line meaning

that the system reading
this will ignore

if there is Harsh and

if there isn't hash it
will take it into consideration

and interpret it according you.

Anyway what we have
here are statements

which allow us to specify

how we want our traffic
to be routed the First

off we have Dynamic
chain Dynamic chain is a some

and is an option

which you will find
people using the most it

is most commonly used option

and a preferable want
to at that and honestly,

I think it's the best one
out there primarily

because it's the most stable one

and here's why now suppose
you have a b c d proxies.

So those are some servers
with IP addresses

with open ports.

And if you have
a strict chain policy,

which is enabled
on this computer right now

as you see if you have
a strict chain policy,

we can only be able
to access any site

on Internet in general
by going through ABCD.

So you have to go
through all of them

and you have to go through them
in that specific order.

That is ABCD and that's
not always a good thing.

I mean if you're paying
for 5 proxies,

that's not a problem

because they will
always be operational

and they will always be up

and why not that's
not a bad idea or an option

but there are however people

who use proxies for free and
they don't tend to pay for them.

Why would you pay for like
five proxies for simple scan

or something of that kind?

They're not free
and the a cost money and they're

rather expensive also,

but still, I mean the act
of paying itself identifies you

and kind of diminishes
the amount of anonymity you have

on the internet.

So some complex payment methods

can still be used
to actually anonymize yourself,

but it's fairly simple
to just use a dynamic chain.

So firstly we're going
to go ahead and uncomment

the dynamic chain option

and we're going to comment
out the strict chain option.

So strict chain will
no longer be used and I

will be using Dynamic chains.

And one more thing to note here.

Is that if you want
to use Rocky chains

in combination with door

if you want to Route
all your traffic

through the Tor Network
not just web traffic.

You must be
enabling Dynamic chains.

I mean, there's a chance

that it will work
with strict genes.

But give the instant
instability of door nodes.

It is highly unlikely.

You will need Dynamic jeans
and that is why I'm using them.

Anyway, if you're using
Dynamic changes just

give you the ability to go

from ABCD to your desired
destination by not having

to adhere to any order.

So let's say C is down
and you would go a b d

and it Woodworking
with no problems,

even if P was down
you would go to a d

and you would go and still
reach the destination.

So as long as one single proxy
is functional it's going to work

and you don't require
any specific order to do

it down below now down

below you have some other
options to so first is

random chains now random chains

in effect are basically

the same thing as
resetting your service.

I mean if you're
resetting your door,

you will be now assigned
new IP address in Taurus

is your new IP address
every 10 minutes or so.

Anyway with the random.

You can specify a list

of ips and then you
can tell your computer.

Okay, I want you to try

and I want you to connect
to this point and

every time you connect every
time you transmit the packet,

I want you to use
a different proxy

and we can do that as well.

And that's one of the options
definitely and you can see okay.

Use this is phone five times

and then change to another one
or some kind of like that.

There are a lot of options
to specify their family

the chain length
any way down below.

There's quite mode.

You don't really need
that then that's proxy.

DNS requests.

No leak from DNA.

Stata, this is very important.

You cannot have any DNA sleek
and let me explain to you what

DNS leaks are and even

though somebody cannot get
your particular IP address.

They can get the IP address
of the DNS server

that you are using and

that DNS servers do is resolved
main domain to the IP address

and vice versa.

So for example,

if you type in youtube.com,

the DNS server of your local
ISP provider will resolve

that into some sort
of IP address that YouTube has

and it will make a request.

No problem and you
do not want that happening

because Is your local DNS server
will be discovered

and that is information

that can be used

in order to figure out
your personal IP address.

And when that is done
your physical location

is pretty much compromised.

And that's an oval

and you definitely
need proxy DNS here.

It might slow you down a bit,

but without that you're
practically not Anonymous

and it's just a matter of time
before somebody finds you now,

if you go down below we have
some other options here,

but we're not really interested
in them at the moment.

What we here are for the formats

for entering proxies and I'm
going to leave it at that.

So what do you see out here
is first the type of the proxy

that is sucks 5 then the IP
address then the port number

and then two words

that Islam has secret
and then juice to Hidden.

Okay.

So now what you see out here
as I just said is

how you would actually write
down your proxy chains.

And now as I had already
also said you always want

to be using socks5 and you
don't want to be using HTTP

because they're not really

that safe and socks5
doesn't support a lot of Anyway,

and this is the IP address
of the proxy server

that we will enter a few
of them manually later on

and this here is the port number

that you see on which
the proxy server is listening

and that port is open
over here these two words.

Now what some proxy server

especially paid ones will always
have a username and password

so you can just type
them here in plain text

and fortunately it is assumed

that only you and you alone
have access to this computer

besides this file
and besides this file

is you not know.

Everybody can read
this file anyway,

so if you can just type
in the username here

and password here,

you will gain access
to a certain proxy

that you have chosen
or that you have paid for.

Anyway, these are
just some examples

and we won't actually
be using these proxies

or anything of the kind.

We need to go down
below here here you see

and at the end of the file.

So if I just press
enter a couple of times,

there we go.

So here is only one proxy active
at the moment and says socks

for and all traffic is routed
here through Tor by default.

So That to tour now and tardy
for listens on the sport.

So this 9:05 is report is white
or listens on now,

what we want to do is we want
to add socks5 proxy address.

So what you want to do
is just type in socks5

and the same IP address socks5

and you want to be keeping the
spacing correct just use tab.

So 127 dot 0 dot 0 dot one
and then you want to specify

the port number the
also so now 0 5 0 so

what you see out
here the 127. 0.021.

This is the loopback address
of your computer.

So this is for any
device communication and

if you're paying
this address and

if you're paying yourself
basically and usually

people think this address
in order to make sure

that the IP protocol
is set up correctly,

even though they don't have
internet connectivity.

So let's just type

in 1.27 dot 0 dot 0 dot one and
the same port number and 9:05.

So now we have to press Ctrl o
to save our You can save

on the same name

and we're o 65 lines of course
down and that's written

and now you have to press Ctrl X
and you exit out.

So let's press Ctrl L
and clear our screen now,

we just edited
our proxy change configuration

in a very neat environment.

So to go ahead and type
in our service door status.

So we want to check
status of our daughter.

So service tour still this so
torturous could not be found.

Sound so do we have
the torturers installed?

Okay sewed.

Our service is not installed.

Just give me a little moment
quickly install it.

Okay.

So now that we have set

up our broccoli
jeans configuration file

and we have put in a sock

5 proxy chain giving
it the torch service.

Now, what we need to do first
is start up our tour service

now to actually check

if the car is running or not or

if the door service
is running or not.

Let me just clear that out.

We need to go service
to our star.

And you see it
says it's inactive.

So what do you have to do
is say service to our star

and that will start
the tour service.

It might take some time
depending on the system

that you're using and what are
their it has started it for me.

Now what you have to do
to actually use proxy chains

before you go to any website.

So all I have to do
is say proxy chains,

then you specify the browser
that you're using.

So we're going
to be using Firefox

and you could say something
like www dot Duck duck duck

on so now here you will see

how your ping is
being transmitted to.

Dr. Go.com when I say thing,

I mean your packets
and your requests,

I'm sorry for my vocabulary.

So now your packets
are going to be directed

through a bunch of IP addresses,

but we haven't actually
put a bunch of you just

have put the loop back
for the Tor Network.

So we will let our do the rest
of the things for us.

Okay, so depending

on your system this
might take a little bit.

Of time to actually open up.

Okay.

So let's go ahead and see

what's actually happening
on the terminal

while this thing is loading up.

Okay, as you can see
it's going through a bunch

of proxies out of here

and some are denying it
and some are saying it's okay.

So as you guys can see most of
the time you might give tonight

and it will be a less
number of occasions

and that is exactly
what we're looking for

because primarily we have gone
a great extent for the anonymity

and what do you want
to do is stay like that.

So this is basically
how you Use proxy chains.

Now if this computer
just decides to open

up talk go.com on Mozilla.

I could actually show you
some interesting stuff

but it seems my computer
has kind of given up

on actually opening duck Taco
it still waiting for dr.

Goes actually confirmation,
but that's about it.

So this is how you can actually
configure proxy chains.

I'm really sorry

that my computer
isn't working right now,

so well and nothing
is actually opening on Mozilla.

It's mostly because
my Ram is over.

Loaded.

I think I should go
ahead and get myself a new Ram.

But for now,
let me just also say

that we can put
some custom proxy lists

and instead of just
saying let me just go ahead

and open up that file again

as you guys and see out here.

I'm going to end this right now

because my computer can't really
take all this pressure.

See it's like so hard.

Okay.

Let me just quit out of that and
let me just open up a new one.

Now as I had said

that you can put up
some custom proxy lists,

not really gonna do that.

But let me just show you.

You can do that you go.

No and you go cetera and proxy

so you basically have to go
into the proxy chain.

Okay, so I think I
should put this can yeah

now if you just go in
and edit out here,

all you have to do is
setup Dynamic jeans

and you can go online and search

for free proxy list and
that will give you everything

that the port number
to the IP address.

Let me just show it to
you free proxy server.

Our list.

So all you have to do is search
for free proxy server list

and you can see out here
the proxy Davis scbs

and you basically want to find

a soft fire proxy to find
self a proxy just add

that into your keyword.

And once you find
those proxy addresses,

all you have to do is take
down this IP address

and followed by the port number

and you go ahead

and just put it down
in this configuration file

and then you hit control.

Oh and you just save it
and And you just go back.

So that was all
about proxy chains and

how you can set up Roxy change
to set make yourself.

Very Anonymous.

I'm sorry hold muscle, uh,

pardon work that's still
sad state of my computer

but moving on let's go ahead
and study about Max changes.

OK guys.

So that was all
about proxy chains.

Let's move ahead
to match changer.

Okay.

Now before we go into the tool
called Mac changer,

let's just see

what a Mac addresses now
Mac address actually stands

for media Access Control
address of the device

and is a unique identifier
assigned to a network interface.

Stroller for communication
purposes now a Mac addresses

are used as a network address

for most IEEE a certain
ethnic Technologies,

including ethernet Wi-Fi
and Bluetooth.

Now in this context
Mac addresses are used

in the medium Access
Control protocol sub layer

and as typically represented

as Mac addresses are
not recognizable as six groups

of two hexadecimal digits each.

Now, these are separated

by a colon and the first
three hexadecimals are

actually the organizationally
unique identifier.

So they actually
represent your vendor

and the next three Hexadecimal

is actually represent
your network card unique.

Okay, so when you are
actually on a network you

are recognized on something
called an ARP table.

Let me just show
you the ARP table

how you can see it.

Let's go in.

So the password is root
still an ARP table is

basically an address
resolution protocol table.

And well, this is
a virtual machine

and it doesn't really
know many machines

on the local network.

But if I were to go

on my Windows system and show
you my ARP table, let's see.

Okay, so if I show
you the ARP table

of my Windows machine
and on any machine

that has a TCP IP protocol
suit installed you

will have this command

as working called are
and you gave the -

A and now you see

that your IP address
or somebody else's

IP address is actually map
to physical address.

Now.

The MAC address
is very commonly used

in the our protocol and this is

how you are actually
identified on a network.

Now sometimes what you want

to do is be unknown
on this network.

There are various reasons
why you want to do that.

Let me just give you an example
of a very malicious.

Reason that was done
in my college.

So we asked students would
actually change the MAC address

of our own computer
to the professor's computer.

So we would somehow look up
the professor's IP address

and then come to know
about his Mac address

and then we would spoof
our Mac to be his Mac address

and then we would do
some tripe sort

of malicious activity
on the college internet

and then internet administrators

of our college
would come to know

that that Mac address
is doing some sort

of malicious activity and

that Mac address
would get permanently banned

for that session on the call.

Dish Network so basically

our professor would not be able
to use a wireless projectors

that he would use to actually
show us as presentations

and we end up
getting a free class.

Now.

I am not actually
promoting any sort

of bad activity like this.

I have just experienced this
in my own college life.

So that was something
but there are many other reasons

that you might want to spoof
your Mac now Mac changer

is an amazing tool
for actually spoofing your back.

So first of all,

how do you come to know
your Mac address?

So let's see you go ifconfig.

This will give us
our Mac address.

Now this dress

that you see out here is
the MAC address of this machine.

So you can also check
out the MAC address

by going Mark changer,

then let's type
in the help options.

And this will show us
how to get the MAC address.

So if you see
there's a show flag

so we can go Mac changer

and you can put the S and then
you put the interface now

the interface is
where it's working.

So at 0 is where we are.

Actually getting we
don't want the loopback one.

So at 0 and this will give
us the MAC address.

So I can't Mac address is
zero eight zero zero two seven.

Let's see if that was
the same one shown.

Where is that matter?

It's okay.

So if a 0 a 0 0 to 7,
so, I'm sorry.

This was the MAC address.

I selected the wrong thing.

What I was showing you is
the IPv6 address and you can see

that's very very long.

So, this is our Mac address.

Now what you might want to do
to change your Mac address.

Well, let's see with V
we can get the version

with s you can show
we can do the E.

And as I said,

if you remember that the first
three bits is about the vendors

so you can also get
the vendor list by going - L.

So you go -

L and this will give you
a list of Mac addresses

and which rendered
the belong to so sometimes

if you don't know the vendors

that are actually
being used on the network

of your college, for example,

and you want to
just stay Anonymous

and not raise any Flags.

Lakhs of Suspicion

so you could hide yourself
as a Cisco router.

So suppose your college
was using all sorts

of Cisco routers
and you decided that today.

I'm going to put myself
as a Cisco router

and I'm going to screw
around with the network.

So it would not raise any Flags

before you actually decide
to do some malicious activity

in some deeper inspection

of your Mac address people
would actually realize

that you are actually
spoofing the dress

and after some investigation
they put Andy take some time

to actually reach to you
and how you spoofed it,

but the And of Ginger Mac
is not raising any flags

and that is exactly
what you should try to do.

So Mac changer is also
very useful for getting the list

of all the Mac addresses
and the vendor IDs.

Now, let me just clear
the screen out quickly.

So we go clear and let's
bring back the help.

So we go matching
injure and - help.

Now, what we want to do is give
ourself a random Mac address

now Mac changer,

so that is Done
with the our flag

and we want to do it on F 0.

So once you run

that you will be given
a new Mac address.

So our new Mac
address is f6c 649

now you can verify
that by running ifconfig.

Now we could just do ifconfig

and you see our new
maxi dress is an ether

so we could also do something
like this ifconfig

and you could grab eater.

So that's just telling
you the MAC address

and this is completely new also.

You can show it to
the Mac changer tool itself.

Okay, so we need
to give it the e0.

I've got that now.

You see that this is
our current MAC address

and this is a permanent
Mac address and their two

are completely different.

Sometimes you also might want
to actually change your Mac

when your laptop is
or your system is booting up

because you might want
to stay Anonymous all the time.

Who knows and sometimes
you might think

I'll actually change it
when I want change it,

but let's face it we

We are forgetful as human beings
and we tend to forget things

that we are supposed to do.

So what else is better

than to actually automate
the whole process yourself

and forget about remembering all
these stupid nitty-gritty stuff.

So you can tell Linux

or cardigan enough
to actually change.

Your Mac address on boot-up
is use this tool called crontab

now crontab is actually used
for scheduling tasks on Linux.

So let me show you
how to do that firstly.

Let's clear our screen
and go crontab

and go Health now.

You see it's
a pretty small and menu.

So first we start
with it you flag that user

this file is going to work
for then we got the E flag,

which is for editing crontab
users the users crontab list

and you can see the list
of users crontab and let's see.

So do we have
any crunch all this?

So there is no crontab
at this moment so we can set

up one for ourselves
by going to the E.

Then there's the r

which is delete users crontab
and I want to tell you all be

very careful when treating
anything of that sort

because once you delete
something from The Knocks

that I've already said

that it It is very

very difficult to actually
retrieve it back.

You might get fragmented pieces
of what you had actually deleted

and that will only leave you
with sadness and Devastation.

Now, what you want to do is go
through crontab and press e

and this will bring us to select
an Editor to change later

on select editor.

So we'll do it Nano.

So what do you have out
here is the readme file

of crontab and if you read
this entire thing you will get

how to use crontab completely.

But if you have any sort

of doubts even after reading
it you can leave them down.

The comment section below now.

What do you want to do
is actually set up a crontab

so that you can change

your Mac address whenever
you reboot your computer.

So all you have to do
is say at reboot

what you want to
done is Mac changer,

and if you remember we want
to run the MAC address

and we want it on eat zero.

So that's done.

Now.

All you have to do
is save this thing.

So you go control.

Oh and that will write
it out you crontab

and you press enter

and you have ridden on one line.

Now you go control X
you have X is it out?

So now let us clear the screen
by pressing Ctrl L

and enter and let's go
ahead and get our Mac address.

So if we go ahead and run

that are Mac address
is set to f6c 649.

So just remember the first few
letters have 66 and 49 now.

Let me just reboot my computer
and you will see

after I reboot and run ifconfig
again with gravity table.

We will see a different
Mac address now rebooting

my take some time

because I'm actually
using Of washing machine

but still now it's given
problems with the Firefox.

But let's hope this
won't take much time.

Okay.

So now that our computer
has booted up

and we have actually opened
up a terminal let's go

in and type ifconfig and
let's get in our ether

that is the MAC address.

So if you remember
the MAC address now,

you see that it has
completely changed and that's

how you can spoof
your Mac address

on our local network.

And this will basically help you

in staying Anonymous
on our protocols and anything

that actually laughs your IP
address to the MAC address.

Okay.

So that was all
about math Changers meet you

in the next section.

So in this section,
we will be talking

about wireless encryption
protocol cracking.

So that is basically
Wi-Fi cracking now Wi-Fi

in today's day and age uses pins

or passwords to normally
encrypt the data usage.

Basically, if you want to access
the wireless access point,

you need a password

or a PIN to actually
gain authorization now

this authorization Chicken
is done using a for a handshake

which we will try to capture
using a tool called aircrack-ng

and then we will try
to crack into the password

using a wordless
generator called crunch.

Now, you can use aircrack-ng
to crack WPA and WPA2.

There's also another protocol
called WEP or WEP

and that is not normally
used these days.

If you find anybody using

that you should always advise
them to actually upgrade to WPA

or WPA2 because Wei.

EP is actually very
easily cracking these days

and people are generally
punished for using WEP

by hackers all around the world.

Okay.

So now you can actually go ahead
and go into a terminal

and type ifconfig to actually
look at your network card name

as you guys can see out here.

It's called wlo one.

So the first step

that we need to do to actually
go into the process

of Wi-Fi cracking is set
up our network access card

or our access point.

Monitor mode so

as you guys can see out here
after typing ifconfig.

It shows me

that my Wi-Fi access
God is wl1 interface.

Now our process of cracking
passwords is pretty simple.

What we want to do
is actually monitor

for all sorts of access points
that are nearby to us.

Once we have chosen
the access point that we

want to actually penetrate
into and find the password.

What you want to do is run
a narrow dumps can on it

and then we will try
and D authenticate any device

that is connected
to the access point now

one assumption out here

is that the password
is saved in that device

and it will automatically
try to re-authenticate

itself with the access point

and we want to catch and log
this re-authentication process

which will actually have
a four-way handshake

between your device
and the access point.

So this is basically

the procedure we are going
to follow now another thing

that you need to know
before actually using

this process to gain
any access to any Is

that you need to know a little
bit about what the password is?

Maybe it could be length
or it could be something

like a specific character
at a specific place.

Maybe you know
a series of characters.

So you just can't really guess
the password out of thin air.

That is not how cracking Works

unless you have
some unlimited potential

of processing power
in that case.

You can very well brute force it
and just find the password,

but if you are not somebody who
Has unlimited processing power

and you're trying
to use aircrack-ng.

You need to know a little bit
about the password.

Also before we proceed

with this wireless
encryption protocol cracking.

What I want to say is
if you want to get

into somebody's Wi-Fi network,

or you want to actually
test for vulnerabilities.

It's better that you test
for router vulnerabilities.

Then actually cracking
a Wi-Fi password

because you're more likely

than not to find
more router vulnerabilities

than actually successfully
Like a Wi-Fi password

if you don't know
anything about it,

if you don't know anything
about the password

just go ahead and run
some vulnerability tests

on the router itself and more
often than not you will just

find something you can abuse.

Okay.

Now let's talk
about the two tools

that I'm going to be using.

Now these two tools.

One of them is already
installed on Kali Linux,

but if you are not using
this on Carly,

you can also use this
on any Linux based system.

So what you have
to do is download

and All aircrack-ng,

which is easily installed

with the command
apt-get install aircrack-ng

and you also have to install
this word list generator

called crunch now crunch
is easily downloadable

by just Googling the name

and the first link
will be a sourceforge link

and all you have to do
is go inside that

and install it and
once you've figured out

how to install crunch
you can make sure

that its installed.

Now once you have installed both
the software's you can check out

if the manual pages
are opening up.

Let me just open the manual page
of aircrack-ng and show you

that it has been
properly installed.

Now as you guys can
see the manual page

of aircrack-ng opened up

and the manual page
of crunch is also opening up.

So that means both
of our software's

have been successfully
installed on our system.

Now before we go ahead.

Let me just show you
how crunch actually works

so crunch is basically
a wordless generator.

What you would do is you try

and generate a word list
with given characters.

So what you can see out here
is I've typed in crunch 3/5,

so Means the minimum length is 3
and the maximum length is 5

and I've given it
a series of numbers.

So it will use these numbers
and generate all the words

that are possible
from length 3 to length 5.

So the way we are going
to use crunch in conjunction

with aircrack is

that we are going to use crunch
to generate the word list.

And then we are going
to pipe the word list

through aircrack-ng

when we are actually
trying to capture and crack

what we will capture
in a certain log file now.

What you want to do
first is actually put

your network interface card
on a monitor mode.

Now you can do

that by typing in ifconfig
and then the interface name

which happens to be wl1 and
first you have to put it down.

So I've config wl1 down now
to put your interface card

into monitor mode.

You have to type in IW config

and you go the name
of the interface

and then you go mode monitor.

Okay, it seems
I've spelled it wrong.

So let me just do it once again.

So that has put
our network interface card

into monitor mode

and what we need to do
after that is we need to start

up our network interface.

So all we have to do is type
in ifconfig wl1 up now.

Once it is up and running you
can check by typing in ifconfig

that indeed your network
interface card is up

and running don't worry
is running in monitor mode

if it's up and running

what we want to do next
is pretty important

to the whole process.

So what we want to do now.

Now is check for some services

that might still be running
in the background

that might hamper
with our whole scanning process.

So we do this by actually typing
in the command Area 1 and G

check and then the name
of the interface.

So as you guys can see nothing
is exactly running right now.

But if there were any process
running you would only add

a command airmon-ng check

and instead of writing
the interface name.

All you have to do is say kill.

It will kill any processes now

if you see Any process named
the network administrator

you want to kill
that process first separately

and then kill
any other child processes.

You may need to actually
run this command few times

before all the processes

are killed and then
you're good to go.

Okay.

So now that we have finished
killing all the subprocesses.

What we want to do is run

and error dumps can on
the network card.

So that is WL 1.

So for this we go Aero dump -

Angie and then we put in
the name of the interface.

And this will start the scan

that will look
something like this.

So after you run
the aerodrome scan

on your interface,

what do you see out here is
a result of all the access point

that is found out
to the monitoring mode.

Now if you see we have a bunch
of columns out your first

of all we have the bssid column.

Now, the bssid column is
basically the MAC address

of all the routers
that are found.

No, every router obviously
has a MAC address.

So those are the MAC address

that is tied
to the router names,

which is shown by the SSID then
we How the pwr column we have

the beacons column we have
the data packets column.

Another important column
is a channel column.

It's important know

which channel your router
is working on.

Then we can see the cipher
column the authentication

so out here we can see
the encryption that is used.

So most of it is using WPA2.

So what we will be cracking is
basically WPA2 so from this is

what you need to recognize
is basically the Wi-Fi router

that you want to crack into now,

I'm performing this particular
test at my office.

Is and I don't really have
the permission to actually

go in and test them
for these vulnerabilities.

I'm not a security
analyst off here.

So I don't really

have the permissions
to penetrate into them.

So what I have done is I
have run a similar test

at home using my own Wi-Fi

and I will show you
the results for that.

But for this working example,

you will see the scans
that I'm running in this office.

So as we intend to stay ethical

what we are going to do out
here is we are going to capture

whatever we find in our office.

For on the educational purposes,

but when we are doing
the actual cracking step

that is the last step
of this whole procedure.

I'll be running it on a file
that I had generated at home

as I just said

because I have four missions
to do whatever I want

with my own Wi-Fi and passwords.

Okay.

So for this example,

I'm going to pick this wi-fi
that is called attract of Wi-Fi

and it's running
on channel number 6.

So what do you want to pick
from here is the bssid

and the channel number

we need to remember
these two things first the bssid

and Channel number now.

What do you want to do after
that is open up a new window

on your terminal
and login as root.

Now what we want to do here is
run a separate Arrow dumps can

on this specific bssid
and check for all the devices

that are actually connected
to this access point.

Now we do this by running

the command airodump-ng
and while we're doing this,

we also want to capture
all the scan outputs

that we actually get
into a certain file.

So we will be actually storing
it in a file called capture

and then we just have
to pass in the bssid

and the interface We also
have to specify the channel.

So let's see what the channel is
1 so the channel is Channel 6.

So that's what we want to do

and we specify the Channel
with the - see Flags.

So after you have identified
the MAC address,

all you need to do is copy
it down and place it

with after the bssid flag.

Okay, so we're going
to run our Command out here

and we just want to say
our file is going to be

well test out capture.

Now that our scan is
up and running.

All you want to do is wait

till someone is actually
connected to this access point.

So I forgot to mention this

for this process
to actually work properly.

Somebody needs to be connected
to that access point

because what we are going to try
and do is disconnect.

That certain device
and let them reconnect

and capture that log file.

Okay, so it seems

like nobody is actually
connecting to it.

So at this time I'm going to do
is go back to our Aerodrome scan

that we had run

on a network interface and look
at some other Mac address

or other access point
to actually penetrate

into and let's see

if something has actually
connected to that.

Okay, so

oh la la now
what do you see out here is

that somebody has actually
connected to this access point

and his Mac address can be seen
under the station stab.

Now.

What we want to do is run

the authentication broadcast
message on that station

and the authenticate that guy.

No to actually run
the the authentication process.

All you have to do is go ahead

and open up a new terminal
window again and let

this can be running
in the background.

Don't use any
scanner this moment.

Okay.

So the information

that they need to
remember is the bssid

or rather the Mac ID
of the station now,

you also want your monitoring to
be running on the same channel

so that your the authentication
message is being already

broadcast on the same channel

so we can do that easily
by going airmon-ng

and saying WL One
and you can say start

on specify channel.

So what we want to be doing
is running this on Channel 6,

then we want to go and use
the third suit of tools

that is are replay now are
replay is used for broadcasting

the authentication messages
and all sorts of stuff.

Now you can see all this
in The Help menu also

and you can do
that by typing in - -

help if you go down you see

that you can send
the authentication message

using the - 0 Flag

and that's exactly
what you're going to do.

Then we stay zero again

because we wanted
constantly send a broadcast

of the authentication.

So it's looping
basically and until

and unless we stop the scan.

Nobody will actually
be able to access the Wi-Fi.

So it's basically
like a small toss attack

and then we want
to specify the bssid.

Okay, so it seems
like I forgot the whole a tag

before the bssid and
that should get it working.

Okay, so it seems

like I have copied
some wrong bssid I guess.

So, let me just go ahead
and copy that once properly.

Okay.

So now that we have
the proper bssid

as you guys can see

we are running the
authentication broadcast message

on that particular
network access card,

and now you want to run this
for around a couple of minutes

so that you become sure

that all the devices
have disconnected.

Now while this is happening

what you're doing is basically
sending a Dos attack

to that small little Wi-Fi and
you want to catch the handshake

that occurs between devices
and the router

that it is connected to
while reconnecting themselves

Okay.

So now that we've let's can run
for a couple of minutes.

Let us just stop it.

Let's stop this
others can too now.

If I go and list out
the files on my desktop,

you should see

that there's something
called the test capture.

Now, the test capsule is given
to us in various formats.

We have the capture format,
which is just capture - 0 1.

Cap and then we
have test capture CSV.

We have a Kismet CSV.

So it gives you a bunch

of formats to actually
run your cracking on now

if you remember I
had told you all

that I have already
generated a similar.

At home, basically

when I was trying to crack
into my own home password,

so I will be running
the tests on that file

or the cracking procedure
on that file.

And that is the last step
of this whole procedure.

So, let me just go ahead
and move into that folder.

So I go see these can now
as you guys can see out here

if I list down the files

if you can see a Capture
One Dot Capture One Dot CSV.

This is Kismet CSV
and this and that XML.

So I was not lying when I said

that I have already
done this at home.

So we are going to run out.

Cracking process on
capture with 0 1.

Cap now.

Let me just tell you guys
the password for my home.

Wi-Fi is sweet ship
346 so you can say

that I know the entire password,

but I'm going
to act like somebody

who only has a general idea
of what my password look like.

So let's say I know

that my password
contains tweet ship

but I don't really know the last
three numbers or letters

or whatever they may be.

Okay, so we are going
to use crunch once again

to generate a list of words

that might include Egypt
346 and let me just open

the crunch manual for once now

if you go down
in the crunch manual

what you'll see is the -

t so as you guys can see
there is a pattern

that is pit specified
like after it at the red God

and Then followed by
four other ad rates

and all the ad rates

will be replaced by
a lowercase character.

Now you can remove
other eight and use a comma

and be replaced
with an uppercase character

or you can use percentages

which in case it
would be numbers.

Or you could use the caret sign

in which case it
will insert symbol.

So when you know the length
of the password

and also a certain degree
of few letters,

you can use the hyphen T flag.

So that is exactly

what we are going to use
with crunch out here

for this example.

So, let me just remind
you guys that the password

for my home Wi-Fi
is we chipped 346.

Now what we can do
is we can ask crunch

to actually generate something
that looks like sweet ship 346.

So what I could do is say crunch
So the minimum length is 12.

I already know

that and the maximum
length is also 12 now.

Let me just input
in the pattern.

So we put in the pattern
after - tea.

So now I'm going to show you
how long it can take.

So we are just
going to say sweet

and then put in some ad rates

and then also get a try
and guess in the numbers.

So after you've put

in the pattern you want
to also input which letters

and numbers it could be

and I'm just going to input
my entire keyboard out here.

Now, what you want to do is pipe
this command through aircrack-ng

is cracking procedure.

Okay.

So now what we want to do is
type this command to aircrack-ng

and we want to write

from a rather read
from the capture file.

So what we go is -
W and then -

and then the capture file name.

So capture 0 1.

Cap and then we also
have to specify the essid

which is given to the E flag
and the essid for my home.

Wi-Fi is Nest away
underscore cc105.

So that's actly
what I'm going to type in

and this will start
the cracking process on my Wi-Fi

from the captured file.

So as you guys can see
this is going to take

a long long long long time

and I'm not really actually
going to complete it.

So in this time,

I'm actually just going to try
and explain why this is

not very feasible
on a virtual Network.

So basically this
is not feasible

because at this moment
why computer is using

all four of its course
and all the memory

that is possible.

So what this means is
on a virtual box.

This is not really possible
your virtualbox don't really

have that much power.

If you are using a 4 core
processor computer only two

of its maximum course
can be actually allotted

to your virtual box
machine above that.

You can't really give
it the entire memory

because that will make
your computer crash.

So if you want to do
something like this,

it's better that you install
Kali Linux as a dual boot or as

your own daily driver
and then you can do this.

So this is why I have not done
this on a virtual machine

and instead downest
on deep in Linux,

which is my daily
driver operating system.

Now as you guys can see
this constantly trying

to actually guess the password

by actually going
through all the permutations

and combinations.

That is basically it's taking
in all the words generated

from crunch piping it
into the current command.

That is the aircrack-ng command
and is comparing everything.

So what I'm going to do is
I'm actually going to end this

because this will take
a very very very long time.

And what we're going to do is
we're going to actually try

and shorten the command
of the or the amount of guessing

that you're trying to do.

So, let me just try and do that.

So as you guys can see out here,

I have reduced
the number of alphabets

that might be actually tested.

But even in this case,

this will take
a humongous amount

of time and let me
just show that to you.

So as you guys can see
the test is running running

running and running

and and there's not really
much you can do you can just

let this run go out
for a cup of coffee

and then come back

and you might still
see that drawing.

It really depends
on what the password is

and how much time
it takes to crack it

and how much processing power
you have directly affects

how much time this will take
so let me just show you guys

that this is taking
a bunch of time.

Okay.

So now that I have
fast-forwarded a lot

into the scan you can see

that I have tried
almost two one two,

seven six zero eight keys.

So that's more
than a million Keys.

That's 2 million keys

that have tried so and it
still hasn't reached at 3:46.

So what we're going
to do is just to show you

for demonstration purposes that
this procedure actually works.

Let me just shorten
guessing even more.

So what we want to do
is this time we want

to just guess the numbers

so We'll modify
our Command accordingly.

So we just put in

sweet chip and let the algorithm
just guess at 3:46 part.

So we're going to
remove the alphabets

from the guessing scope also

and as you guys can see

the password is almost
immediately guessed

because only 456
keys were tested.

And as you guys can see it shows
that the key was found

and it's sweet ship 346 now
let me also show you

that it works with the guessing
of letters just

because I don't think of did

that letters are also guest
and not just numbers.

So let me make it just gets
the P part that is sweet.

She and then it should
guess B and then 346.

So let me just show you that and

as you guys can see it guesses
it almost immediately

after just going
through 15,000 Keys.

Okay, so that brings
us to the end

of this wi-fi cracking tutorial

and also to the end
of this video

which was regarding ethical
hacking using Kali Linux.

I hope you guys had
a bunch of fun learning

about Mac changes proxy chain.

And a bunch of stuff that we did
like Wi-Fi password cracking.

I hope you practice these
procedures and methodologies

that have thought you only for
your own educational purposes

and not use it to harm anybody
or do anything harmful with it

because let me just tell
you very seriously

that you can be prosecuted
by the law.

So let's end this video
on a good note by saying

please practice this
for only educational purposes.

Let me just show you that and

as you guys can see it guesses
it almost immediately

after just going
through 18,000 Keys.

Okay, so that brings
us to the end

of this wi-fi cracking tutorial

and also to the end
of this video

which was regarding ethical
hacking using Kali Linux.

I hope you guys had
a bunch of fun learning

about Mac changes proxy chains
and a bunch of stuff

that we did like
Wi-Fi password cracking.

I hope you practice these
procedures and methodologies

that have taught you only for
your own educational purposes

and not use it to harm anybody
or do anything harmful with it

because let me just tell you
when he sees this.

You that you can be
prosecuted by the law.

So let's end this video
on a good note by saying

please practice this
for only educational purposes.

If you are a hacker
pentester security researcher

or just another person

who picks Google in front
of friends to look cool,

then it's likely

that you must have already known
about some Linux distros,

which are particularly
made for them.

Today.

We're going to explore
one such Linux distro parrot.

Security OS one of
the leading Linux distribution

and penetration testing
and ethical hacking.

So let's quickly go
through today's agenda first.

We will Begin by discussing

how Linux distributions are
suitable for ethical hacking

and different type
of Linux distros

that are available
for ethical hacking

and penetration testing.

Then we will begin
with our today's topic

which is parrot security OS

we will discuss
its features its history.

If or not parrot security OS
is suitable for you.

Moving on we will see

how particular day
OS is different from Kali Linux

and then I'll show you

how to install parrot security
OS using VMware software

and finally we'll end
the session by taking

a look at few popular
parrot security OS tools.

So I hope agenda
was cleared you guys.

Let's get started
then a security

focused operating system is
a hacker's best friend

as it helps a hacker
to detect the weaknesses

in computer systems
or computer networks.

whether you want to pursue
a career in information security

or you are already working
as a security professional

or if you are just interested
in this specific field

for fun or decent Linux distro,

that suits your purpose
is always a must now

if you're wondering

what a line X destroys
it is a Linux distribution

that has been curated to perform
security related tasks on most

of the time a lonex distro will
have a line X base of the Ubuntu

or Debian flavor and the usually
Some custom tools pre-installed

in it as well.

As you guys know
line X is the best choice

for Security Professionals
for obvious reasons.

And hence.

Most of the Destroyers
are usually built on it

a line X distro can help you

in performing analysis

ethical hacking then iteration
testing digital forensic task

and various other
auditing purpose,

but guys apart
from these destroys.

There are other open
source tools as well that you

can bundle and use as
per customer requirements,

but using these destroys
have lot of advantages.

Like first default,

they save a lot of time and
effort that you need to spend

when you are dealing
with customer requirements.

Secondly the help
beginners to easily start

with security testing

without having to get
into the nitty gritties

of operating system.

And lastly the most

popular reason is you have
great pool of distros

that you can choose from most

of the time Kali Linux is
the obvious first choice

of operating system
for every new hacker.

If you ask me why
the obvious answer would be

because Kali Linux is lot
of cool things it comes bundled.

With the curated collection
of tools moreover.

These tools are organized
into easy-to-navigate menu

and a Lifeboat option.

That's very new be user-friendly
as an it's very friendly

to new ethical hacker,

but guys cullinane X is
in the only distribution

which is targeted at pentesters.

There are many exciting
Alternatives that may better

fit your use case.

Anyway, let's begin
our discussion with Kali Linux.

It was developed by
a fancy security as a rewrite

of backtrack Kali Linux distro.

Those tops the list
of best operating system

for ethical hacking purposes.

And then there is
parrot security OS

which is our today's discussion.

It is a mixture
of Frozen box operating system

and Kali Linux.

It's the second most popular
operating system vertical acting

and penetration testing is well,

and then you have
back box Linux.

It's a win to based operating
system with its focus mainly

on security assessment
and penetration testing.

Then you have been
to and excellent

hacking operating system
with wide variety of tools

that you can choose from Apart

from this you have deaf clinics
blackout lining cyborg backtrack

and many others.

But as for today's session,

we will be discussing
about parrot operating system

that it OS is the second most

popular Linux distro vertical
hacking after Kali Linux.

It is a comprehensive
portable security lab

that you can use for cloud
penetration testing computer

for insects reverse engineering
hacking cryptography

and many other
security purposes.

Now a little bit about
his history the first release

of parrot OS appeared
in April 10 2013.

Originally it was developed
as part of Frozen box.

Now it has grown
to include a community

of Open Source developers

Professional Security Experts
Advocates of digital rights

and Linux enthusiasts
from all over the world.

Well compared to others
para sacar TOS promises

a lightweight operating system

and it's highly efficient along
with its plethora

of Recognize tools you also
get the opportunity to work

and surf anonymously

which is like a granted wish
to an ethical hacker

or any penetration tester
will learn about other features

in the later part
of the session.

So moving on since its release
in 2013 parrot has grown rapidly

and currently offers

many different flavors targeted
towards different use cases.

For example,

like I said,
we have para security.

It's the original parrot OS

and is designed
with penetration testing.

Forensics hacking development

and privacy in mind then
you also have parrot home

which is targeted
towards desktop users.

It strips out
the penetration testing packages

and presents are nicely
configured Debian environment.

Then you have parrot
are it's focused

on wireless penetration
testing borrowed Studio.

It's designed with
multimedia Creation in mind.

Then you have parrot
Cloud the most popular

it Target server applications
giving the user access

to full suit of penetration
testing tools included

in part security.

But it doesn't have
a graphical front end

like we do in Paris
security moving on.

We also have parrot iot.

It's designed for low
resources devices such as

orange Pi Raspberry Pi

and you have pine
64 and many others.

So it's true

that pallet security was
doesn't have large community

of users behind it
as Kali Linux dust,

but the distribution
has been gaining a lot

of momentum recent years.

So things could be
very different just a year

or two from now.

So let me convince you more.

Let's just discuss A features
of parasitic rtos.

Let's start with
the system requirement.

It's based on Debian 9.

It runs on a custom

hardened line X 4.5 kernel
uses a mate desktop

and light DM display manager.

It requires a minimum
of 256 MB RAM

and works with both 32
and 64-bit systems as well as

a are incompatible version apart

on this parrot OS can also
be installed on cloud

and updated to perform
cloud-based security.

So basically it
runs on Debian 9.

It is compatible with 32
as well as 64-bit systems

and a RM systems as well

and it requires a minimum
of 256 MB RAM.

So those are the system
requirements moving on it

also supports anonymity.

It offers a tool called and non
surf including anonymization

of entire operating system.

It comes with custom-built

anti-foreign sick tools
interfaces for gpg and crisp

that up originally it also

supports Bose encryption tools
such as Elle UK has truecrypt

and veracrypt and many others
moving on it also supports

forensic boot option
to shut put Ottomans

plus many more it braces

Falcon programming language
multiple compilers debuggers

and Beyond it also
provides full support

for developing Frameworks
for embedding systems

and many other amazing features.

So Guys, these are
few features of para todos.

So basically parrot
operating system supports

and Amity it offers different
kind of cryptography tools.

It also supports forensic mode
and it also provides opportunity

to develop Frameworks
for embedded systems

and many other amazing
features moving on

before you go ahead and use
parrot OS there are

some important considerations

that you need to take
a look at first

of all parrot towards provides
general purpose features,

like any other normal
operating system,

but guys before you go ahead
and use para Todo es there are

some important considerations

that you need to take
a look at first.

Of all it provides
general purpose features,

like any other normal
operating system does

but at its core it
is still tuned for security

and foreign six.

Now, let's see
how different parrot OS is

from other distributions.

Bharat is different from
a general-purpose distribution

because it does not try
to hide its features.

For example, there is a tool
called parrot update reminder.

It's simple yet powerful program
using this program.

You can check for system
upgrades once a week,

but instead of hiding
the upgrade process behind it.

This part like any
other operating system.

It shows the user
the full update process

from the APT output.

So you can see the upgrade
process going on.

Secondly parrot was designed

to be a very comfortable
environment for Security Experts

and researchers.

It includes many basic
programs for daily use

which other penetration
testing distributions usually

exclude part security includes
its own sandbox system.

I mean, it provides a secure
distribution user applications

and parrot are protected
to Emmett the damages in case

if the system
is compromised anytime.

So this way no harm is caused.

So like we discussed earlier
it also supports Digital

four and six digital forensics
experts need an environment

that does not
compromise their proof.

So pirate comes
with Autumn and functions

which are disabled by default

to all of four and six
Acquisitions to perform

in a very safe way.

So before you go ahead

and choose any
of these operating system,

make sure you check
out their features.

The services they offer
and make sure that

if they are suitable
for the task,

which you want to perform
but as for Peridot s

these are its features
we discussed earlier

and these are the certain points

that you should take
into consideration

before you go ahead and use it.

Now if you're wondering who

the parrot security
is made for well,

it's made for Security
Experts digital forensics

experts engineering
and IIT students researchers,

you have journalists and
activists as well in the list

and you have the new be
hackers police officers

and special security.

Institutions.

So basically if you ask me
it's suitable for a student

or the entry level
Security Experts as well.

So first, I'll show you

how to install para
sacar TOS on VMware.

So basically when it
comes to installation,

you have two options,

you can install
parrot security OS

alongside your operating system
using dual boot option

or you can install it using any
of these virtualization software

like virtual box or VMware.

Ask for today's session.

I'll show you
how to install it using VMware.

So let's get started
with our installation.

So, where is this search
for the pirate security West

and it most probably the first
link that you find on the net.

This is particle
TOS official website

as you can see,

there's a little bit
about its history.

Its features.

It says it's based on Debian.

It's designed for security
development and privacy in mind.

It also includes
a laboratory for security

and digital forensics experts
along with that it also focuses

if you want to develop
your own software

and all that and it's

project goals mostly a security
privacy and development.

This is the Which you should
consider important development

unlike other operating
systems its features.

It secure lightweight

when compared to Kali Linux
or any other operating systems

and it's a free source.

So go ahead and explore it.

So as for the download options,

you can go for
security addition here

and the download menu here you
can see other options as well.

It says home edition security

and other bills we discussed few
of the flavors of pirate.

Orsolya.

We discussed pirate home
part are part student

when you lose any weight

If you're concerned
with parrot security four point

five point one is a current
version that's running.

So you have two options
here to download.

First of all take
a look at the size.

It's 3.7 GB and 5.9 GB.

So make sure whichever
you want you downloading it

depending on your operating
system requirements.

And as you can see,
this is a lifeblood installer.

I so this is
a virtual Appliance.

You can choose any of these

if download is taking
a little longer

than you expected.

Maybe you can go
for mirrors or a torrent.

So I've already installed it.

I'm not doing it I have What is

a file as well as the Soviet
format installed as well?

Next thing we need
to do is install VMware.

So VMware VMware
Workstation Pro.

So you have
a download option here.

You can go ahead
and download it you have

for the free option yard
also have VMware Player.

I guess fate here.

I go the Ling sorry
about that here in the downloads

so you can go
for a workstation Pro

or you can also go
for workstation play

or hear any of this

with civil suits you have
he downloaded it.

It's going to take for a while.

And then all you have
to do is install click

on next and finish
the installation process.

So before you start
your virtual machine,

make sure you have
your parrot OS image ISO file

or Ruby a format
which ever is of your choice.

And then here we go
VMware Workstation homepage.

Yeah, as you can see

I already have a pirate
OS operating system installed

your or washing machine install
your this is I have install

it using ISO file.

It's very easy.

I'll show you how to do it.

But if you have ovf format,

all you have to do is click
on this file menu.

Open and as you can see,

I have a particle T over here
and click and import it.

That's all click select it
and click on open.

So I'm not going to show you
how to do that.

So it's very
straightforward process.

That's it.

This is my ISO file.

Let me show it to you again
how to install it.

Anyway current file

or you can just go for create
a new virtual machine.

Yah, click on next
and attached ISO file browse.

I have it in my
local this T here.

I have a pair of security
and open next it selinux it did.

Bian latest version
which is 64 bit and click

on next give any suitable name
for your virtual machine.

Let's say parrot
secured t Okay,

Wes and click on next.

Let's assign about
40 GB it again.

Depends on what you want to do.

If you're doing heavy tasks.

Maybe you can assign more disk.

So as it a store-bought
shall discuss a single file

or split into multiple files.

I'm going to choose single file
click on next and you

And always go ahead

and make this customize Hardware
settings earlier or later,

but you can do it now as well.

Customize Hardware.

I have not connection as

for network adapter
memory 5 to well,

let's just say 2 GB and not

yeah, we set processors.

I'm just designing one
for now cool and clues.

You can see the changes

which are made
are displayed here.

Once you're satisfied

with your settings with that
you made click on finish.

You're good to go your cigars.

System is been displaying
your so like I said,

you can always make
settings later on.

You have the set it question
machine setting options here.

Just click on this.

Let me maximize
the screen for you guys.

So as you can see the parrot
security ISO is very flexible.

There are quite a few options
you have live mode.

You have terminal mode
you have Ram mode.

So basically live mode is just
a standard live USB boot option

just like you can see

while you're installing
Kali Linux suppose.

If you don't know
how to install Kali Linux,

there's a video on how to
install it as well by durocher.

You can refer to that
in the the clacking playlist.

Okay, so coming back.

Sorry about that you
have Have a persistence

more encrypted persistence
foreign six mode

and all that terminal mode.

As you can see is
out of the live boot option.

But without graphical user
interface the most popular one

among new hackers,

or if you're the first time
user is install option

with a graphical user interface.

So it's almost familiar
with Kali Linux users.

If you want to get a feel
of parrot security

if analyst features,

maybe you can give
for live mode,

but if you want to get just

started then you can always
go for install mode.

I'm going to click on that
and click on standard install.

So it's mounting all
the installation tools

and all that.

So once the machine is booted
up you'll be asked to select

your preferred language
the broad menu select

the graphical installer options

and click on let's say English

and United States
American English.

So then the loader

will automatically install
some additional components

and configure your network
related settings.

It might take a while.

So basically then
the installer should prompt

you for a host name
and the root password.

Let's give some root
password give the password

of your choice reenter
the password for verification.

And now it's gonna ask you

to set up a user apart
from the root user.

So let's just say
test user continue.

I'm going to keep it
as tests continue

and choose a password
for the new user

which is different

from the root user password
that you'll have to remember.

What so just give this new user

a passport continue
re-enter the password?

Okay.

Let me just go back
and my mistake.

Let me try it again.

Select your time zone.

So basically after
you've set your password,

it's asking you
for the time zone.

Let's say central eastern.

So now the installer
will provide you four choices

about the partition of the disk.

The easiest option

for you is to use guided use
entire disk option

which the first option here
experienced users can always go

for manual partitioning method

for more granular
configuration options.

So yeah Gaiden partitioning

I'm going to select
that guide use entire disk.

This is the disc
we're going to store

so it's asking

if you want to store all files
in one partition or different.

Let's just say all files in one.

Mission and hit on continue.

So now we will have
to confirm all the changes

to be made to the disk
on the host machine be aware

that continuing will erase
the data on the disk.

So after that you can just click
on finish partitioning

and writing disk thing.

It's asking if you want
to write the changes

to the disk, obviously.

Yes.

So click.

Yes.

So once aren't confirming
the partition changes

the installer will run
through the process

of installing the files let it
install the system automatically

this may take a while.

So I'm we'll meet you guys
once installation is done.

So once installation
is done It'll ask you

if you want to install
the GRUB boot loader

on your hardest just say yes

and click on enter device

manually or sorry
just click the device,

which is already there go back.

The installation process
is now almost complete.

So guys the
installation is done.

Once the installation is done.

You can see the machine boots

you intimated desktop
environment as an if you

have chosen to install
option will be presented

with a light DM login screen.

So basically you'll have
to enter the password

and the which is set up
for the test use earlier.

Not the root password.

Please do remember that.

I'm sure you remember
setting up a password

for the user right
that password and login.

So here we go.

So guys here we are
as you can see

the machine boots you into
the mate desktop environment.

Let me pronounce it
M80 you can call it

whatever you want mate
or mate desktop environment.

So as you can see,

it's very good looking apart

from that parrot Security
will automatically detect

when updates are available

and prompt you to update
the system as soon as you

install it here.

It's not showing it to me
because I've already updated it,

but Otherwise, all you can do
is just go to the terminal here.

You can see terminal option
here right go to terminal there

and just say sudo apt-get update
last me for the password.

How'd it go?

Might be a matter of updated
in another virtual machine.

Anyway, I installed
the other one as well.

Maybe it's in that anyway,
I'll update for you.

So let me just minimize this
while it's updating.

Let's go ahead
and do other things.

So it's almost done I guess.

Yeah, as you can see
it's almost updated

and it says 116 packages

more can be upgraded and if I
want to have to run update list,

if you want to see
which of those packets

are have to just list out
those using app command.

Yo, I'm not showing
you two guys.

So anyway when you're making
you First make sure you system

always stays updated.

Okay, let's go back
to exploring parrot towards so

as you can see
system is laid out

in a very straightforward manner

with a collection of tools that
you might be familiar with.

If you're using Kali Linux

before the menu system is
almost similar to Kali Linux

and it's very easy to navigate
the real differences

that parrot security is meant
to be used as a daily driver as

in your regular operating system

through the other things
as well to prove

that you can see you have sound
and video options here a lot

of Grabbing languages options
as well you have system tools

and you have Graphics included
you have office applications

of software's you have base.

You have math writer

and planner just like any other
normal operating system.

So while you can use color index
as a desktop workstation,

it is really is a penetration
testing distribution first.

I'm talking about Kali Linux.

So with curly you need
to build the system

towards being a daily use system

as in you start using
Kali Linux you need to modify

or you need to customize it in.

Your way that you make
it more plausible or easy

for you to use
for the daily purposes,

but that's not the case with
parrot security OS its interface

and everything is so good.

It almost appears
like a normal operating system

and it is like a very
normal operating system.

So you have
your penetrating distance

which are there and along
with that you have

your day-to-day applications are
also there in this now talking

about the system requirements

the default palette
Security install uses

about 300 13 MB of ram.

So as you can see here you
can see The squad little bar.

It's like a task manager,

which you can find it in
your windows can click on that.

It will show you all
the progress that's going on.

First of all,

it says the pirate gnu
Linux system in the release

and the colonel

all the information
about your ISO file

and you have made
desktop environment here

in the hardware,

which is this and the presser
it's based on available space

and all that when you
click on the processes,

it shows all the processor
which are currently

running sleeping just
like your task manager.

And your Windows
operating system.

So yeah, like I said,

it requires about 200 13 MB
of ram approximately around that

but of course,

this is only system
related process running

when compared to Kali Linux.

It's very lightweight
callanetics install requires

about 600 4 MB of RAM

and that too only with system
related process running.

So, like I said,
it's a very lightweight system.

So yeah, the bar is

a task manager it
lists all the processes

that are running and all that
you obviously have a terminal

which I showed earlier
the Cool thing with terminal is

that it goes
with their interface.

Other than that.

It's pretty much
like any other normal dominant.

And then there is a pure ends
of the interface.

I mean my first reaction
when I saw it was wow, amazing,

right when compared
to the plain Kali Linux.

So yeah, you get
to use cool collection

of wallpapers as well.

You have change
desktop background here you

have fonts interface and see
you have quite a lot

of collection of wallpapers

and you can go ahead and add
your Customs as well.

That's all about the interface.

And like I said,

it's like any other
normal operating system.

So it comes with a lot
of programming languages

and a bunch of text editors.

You also have IDs as well.

It uses plume as
your default text editor.

So that's it

when talking about the normal
operating system not talk

about the performance
almost all of his know

that color index is a bit laggy

and when you run it
on a low-end system,

sometimes it's like a nightmare

when you have Have
Brute Force attack going on

in the background.

Are you doing something else?

It's gonna be worried say stock
or it's very slow but imperative

it's very lightweight

and doesn't like much
as you can see,

it's smooth now talk
about Hardware requirements.

Pretty much both Kali Linux

and your parrot required
high end Hardware,

but Pat, it needs
low specification Hardware

as compared to Kali.

So if I have to conclude

and one board parrot is
a good-looking distro.

It's very lightweight
its resource friendly

and Want to know

how much resources
consuming and all

that you can always go
at click on the little bar,

which is available there.

Click on the resources.

You can see the CPU is

tree memory Network history
file systems and all that.

So basically it's
a good-looking distro

lightweight resource friendly.

All this features apart tight.

Security Os Os has pretty good
collection of features as well,

which we discussed earlier.

It comes like what hell
lot of tools,

but if you see the sections,

there are a lot of other things
which are not in Kali Linux.

So the most A pointed
tool here is

that in Kali Linux is supposed
want to say private

when you're doing hacking
or any other stuff.

You have to install
a non serve tour

and then enable them
or proxy chain.

You also have the option
of proxy chains to stay yourself

Anonymous on the system
by you doing hacking

or pen testing or anything,

but with parrot OS you already
have an answer of pre-installed.

All you have to do is click
on the start button.

So let me show you
how to stay Anonymous.

So this is one
of the best feature

and Palette security OS
it has proxy change.

As well as an unsafe to make
yourself an anonymous

so you can go for this announcer

of and click on and on
Star talk before that.

You can check your IP
of your system.

So it says 1.65 1.73
doesn't just remember

it don't have to note
it down anywhere.

Well, not 651 76 now now

if I go and enable
this first of all L ask you

for the administration
passport give that Okay.

So basically once you
enter the password,

I'll ask you

if you want an answer
to kill the dangerous process

which that can be D anonymize
you are clear cache files

or modify your IP table rules
and all that.

It'll ask you

if you want to do
that just say yes.

So basically as
soon as you click on S,

as you can see the notifications
here the tool will attempt

to kill dangerous processes
that can be anonymous you

anytime it will clear
your cache files.

It will modify
your iptables modify your

Of config file disable your IPv6

and only allow you
the outbound traffic through top

as you can see it's a store
is running started for you.

Imagine doing all
this stuff by yourself.

If you don't have
an answer fly can call it an X.

This would be quite a bit
of effort manually,

but with the script
already present here,

it's just a click away.

So parrot security
also includes a seminal script

for i2p as well apart from that

once you've enabled
you can also check

like I said your IP address now.

So as you can see it says Global
Anonymous proxy activated dance,

like no one's watching encrypt
like everyone is so

basically it's saying
the surf is started out.

As you can see my IP address
has been changed it

for something of 160 something.

But right now it's 182.

So on and on surf has made
me Anonymous now,

I can do whatever you want
in an anonymous mode.

So that's all I wanted to show
you here now back to Firefox.

It has quite
a documentation part.

Well, it's still

in the creation stage here
is you can see documentation.

It's not all that well prepared
or created yet.

So if you have any minor dot
you can go ahead and refer

to the Documentation party.

Oh, so here you go.

Okay, then let's go
back to the Destro.

One thing that you can point out
about parity with is

that it has a lot
of cryptography tools such as

it has Zulu script Zulu mount
a graphical utility

that will help you mount
your encrypted volumes.

Then there is something
called Crypt Keeper.

It's another graphical utility

that allows you to manage
encrypted folders and much more.

These agilities
makes confidential.

LT easily accessible anyone
with the minimal experience.

I mean if you do not have
any idea about cryptography you

can easily start learning your
that's what I meant.

So it just doesn't stop

with cryptography or a non surf
you have lot of other tools

which you might not find
and color next.

So let me show
you guys that part

as you can see you have lot of
tools you have most used tools,

which is Armitage.

You have Wireshark Zen map
over a span all

that then you have
wireless testing tools.

Give me a second.

Yeah, post exploitation this set

of tools mostly you can't find
them in the Kali Linux.

You have OS back door
towards webpack dough tools.

You have web Covey
bleep and all that

and you have something called
social engineering kit.

If I'm right.

It should be
in the exploitation tools.

Whereas exploitation here

how you can see a social
engineering tool kit just click

on that password.

So it is started up all that.

So if I just click one,

you have a lot of options
the update set configuration you

have Social Links.

Attacks you have different type
of attacks here.

You have power
shell attack vectors.

You have mass mailer attack

you have phishing
attack vectors and all that.

So basically you can click
on that and enable all

that acts not going to show you
in this demo how to do it.

This is just the basic
introductory video

about Peridot s.

So, let me just
close the terminal

while there are common tools
like you have nmap.

I'm sure you know
how to use nmap.

Let me just show you anyway

and then map is one
of the scanning tools.

You can find it
in information guy.

Drink, I'm short and map
is you're here to one

of the basic tools.

Okay, let's just explore and map
and Demetria here.

Let me just show you

how to use nmap first just

click and map you have
all the help or then

map configuration options
are displayed in front of you.

If you don't have to use
just go through them.

It's pretty easy
a simple example.

I'm already using the one
which is already there.

Just say scan me
dot nmap dot orgy.

Okay your aegyo making
spelling mistake again.

Sorry about that.

It's gonna take a little while.

That's all while it's scanning.

Let me just show
you another tool,

which is Dimitri.

It's a deep magic
information gathering tool.

It has ability.

So here it is.

It should be in the information

gathering only you
have your here goes.

So basically, like I said,

it has ability to gather as
much information as possible

about a hose subdomains.

It's email and
formation TCP port scan

who's look up and all that.

Let's just check out.

Then map scanning is done.

Here is the terminal.

Yeah, it's gonna take
a little while.

So once the scanning is done,

it's going to show you
how many seconds it took

what are the pores

which are open
and the close personal

that now about the material
you can enable it

from your dominant,

but you can also do it
from here information gathering

and click on the me.

Try password.

So let's say Huh?

Here we go.

So let me maximize.

All you have to do is
you have lot of options here.

You have W,
which performs a who's look up

you can do it online as
an using Firefox as well.

You have a lot of websites

where you can gather
all the information

once you have your IP address

or and all that
and you have retrieved

and crafts outcome information
on host perform search

for possible subdomains
email address and all that.

So basically you can give
all this options in one go.

Let's say TR y - -

option taste output
your host or text or to

the file specified by -

oh, so I just press click 0,
let me just gives pseudo.

Let me just check
if I've given any file here.

I do have a file
called test dot txt.

Okay.

So like I said
in the iPhone option,

it will save your output to
the dot txt file out of the file

specified by - no option.

So basically just
specify the filename

where you want to store
the all the scan info.

Whoa, and the website
where you want to website

of whose information
you want to scan.

So let's say the blue
dot pinterest.com.

Here you go.

It started scanning.

Let me just scroll up.

The host name and the host
IP addresses showing

once you have IP addresses,

you know can gather almost
all the information.

It's also showing the places
where it's coordinated.

It's created lost modified.

You have sources you
have address here

and then yeah last modified
created sores and all that.

So basically it's showing a lot
of information here.

Similarly.

You can using Dmitry

or a deep magic information
gathering tool you can actually

gather information about any
other website you want to know.

Let's just check out
if in map is done scanning.

So see as you can see it's done.

So I've given a website name
here instead of that.

You can go ahead
and give the IP address

which is this one

and it will show you
the same results as you can see.

There are a lot of ports
usually nmap scan is

about more than thousand votes
as you can see.

It says 992 of the clothes pose
and these are the open ports

and suppose you want to know
more information about each Port

because basically if your hacker
if you try to hack something you

don't need information
about all the ports.

It's basically the One port
which you want to so to know

that you can there are
a lot of options

which are provided by a map.

If you want to know more
about by and Map There's

and video and I'd wake up
playlist all about in map.

It's under network security.

So you make sure
to take a look at that.

So while you are taking a look
at particular device,

make sure you go ahead

and watch a video
on Kali Linux as well.

So you will know
how different Heroes

and color index are

though they are similar
in few parts.

So that's it about system
as in parrot OS so

like I said, it's

On good-looking distro,

which is lightweight
when compared to Kali Linux

and lot of tools lot
of unique tools as well.

When compared to Kali Linux and
it's very smooth away smooth.

Oh apart from all
these good things.

There are a few things

that are problematic
with part ways.

First of all,

like you don't find
our search body.

Oh, that's not a problem.

But that's one demerit

you can say and it's
also a little problematic

when it comes to launching your
application the process LL slow

and like Carla lineage.

So guys, this is your
parrot OS so basically Lee

this was a crisp video

on what parrot devices
it's review its features

and all that and make sure
to watch a video on pero no es

versus Kali Linux.

So Linux has been known
for its various distributions

that cater to various needs one

of the most famous
distributions is Kali Linux

that is a penetration
testing oriented distribution,

which was built to bring

about much-needed Corrections
in its previous.

Duration known as
backtrack OS now

since the release of Kali Linux.

It has gone

under various iterations
in the form of updates

while other penetration testing

and security related
distributions were also

being developed all
around the world.

So in this session,

we will compare Kali

to One Source distribution that
has come under the spotlight

and that is parrot OS
so today in this video.

I will first be giving you
guys a brief introduction

to what exactly is Kali Linux.

And then I will also give
a brief introduction to

what parrot OS is then
we will be comparing Kali

versus parrot according
to various parameters.

So let's move ahead now.

Let me give you guys
a brief introduction

to what Kali Linux is.

So Kali Linux is a penetration
testing and security

focused operating system

as the name suggests Carly has
a Linux kernel at its core above

that the creators
of Carly Marty are Oni

and Devon Kearns.

Added the latest injection
packages to help pentesters.

Save some time Kali Linux has
developed according to the DB

and development standards

and it was developed as
a refined penetration test

during distribution.

That would be served as

a replacement for backtrack OS
currently the development

of Carly is being handled
by offensive security,

which is the organization

that provides prestigious
certifications, like oscp osce

and Os WP over the years.

Carly has developed its own cult
following with people

who swear by the word and by
the power provided by Kali

while I may not be
such a staunch believer

in Kali Linux.

There are plenty of reasons
for want to use curly for one.

It's absolutely free.

Secondly.

It comes pre-installed

with tons and tons
of penetration testing tools

and security related
tools above that.

It can be completely customized
according to your needs

as the code is
an open-source get tree

and The whole code
is basically available

to the public to be tweaked.

Also the kernel

that runs Kali Linux comes with
the latest injection packages.

And it also comes
with gpg signed packages

and repositories above that.

Kali Linux has
some true multi-language support

and it was developed in
an extremely secure environment.

Also Carly supports a wide range

of wireless devices now
at this moment Callie

may seem like a very
useful operating system.

But as you guys might
remember the great quote,

From Spider-Man create

power comes with
heavy resource utilization

according to the official
documentation of Carly

the system requirements
are quite heavy

on the low-end Kali Linux

needs a basic of at
least 128 MB of RAM

and a 2 GB hard disk space
to set up a simple SSH server

that will not even have
the GUI of the desktop

on the higher end.

If you opt to install
the default genome desktop

and the Kali Linux
full meta package.

You should really Aim
for at least round 2 gigs of RAM

and around 20 GB

of free hard disk space
now besides the RAM

and hardest requirement.

Your computer needs to have
CPU supported by at least one

of the following architectures
them being amd64 i386

and Armel and AR M HF
and also arm 64 now,

even though the official
documentation says 2GB

of RAM is enough.

I have personally
faced numerous lag

and stutter issues

when running Carly
on a virtual machine

with 6G EB of allocated Ram

which in my opinion
is a definite bummer.

Now, let's take
a moment to discuss

about parrot OS so parrot much

like Carly is also a deviant
based distribution of Linux.

When I see Debian based,

it means that the
code repositories adhere

to the Debian development
standards para Todo es 2 comes

with its own arsenal
of penetration testing

and security related tools.

Most of these tools are
also available on Carly.

No, but it was first
released in 2013

and was developed by
a team of Security

Experts Linux enthusiasts
open source developers

and Advocates of digital rights.

The team was headed
by Lorenz of Elektra

and part is designed
in a very unique way

while the operating system
has everything that is needed

for a security expert.

It doesn't present itself

to be a daunting learning
experience for beginners

who want to set foot into
the world of ethical hacking

and vulnerability analysis.

But it OS can be very well
used as a daily driver

as it provides all

of the necessary tools
to complete day to day tasks.

So who exactly is peridot
s made for well,

first of all,

it is made for Security Experts
and digital forensic experts.

It can be also used by
engineers and IIT students

who are enthusiastic
about ethical hacking

then parrot OS can be also used
by researchers journalists

and hacktivists and last

but not the least
but it OS is also meant

for these officers and
special security institution.

Okay.

So now let's take a moment

to actually discuss
the system requirements

that one might need
to run parrot OS

so the system requirements

for Bharat is much
more forgiving than Kali Linux

on the CPU side.

You need an x86 architecture
with at least 700 megahertz

of frequency and architecture.

Why is you need i386 amd64

or AMD 486 which is basically
the X86 architecture

or are male and Armature

which are basically iot devices
like Raspberry Pi on the side

of ram you need at least 256 MB

on a nine three eight six
architecture three a 20mb

on an amd64 architecture

and as a general
documentation 512mb

of RAM is generally recommended
by the parrot zik OS people.

On the GPU side parrot
OS is very surprising

as it needs.

No graphic acceleration.

That means you can run this

without a graphic
card on the side

of hard disk space pirate
OS needs at least 16 GB

of free hard disk space
for its full installation.

That is for G 4 gigabytes
Left 4 gigabytes

lesser than Kali Linux and for
booting options both Kali Linux

and parrot OS have
the Legacy BIOS preferred.

Now comparing two operating
systems when it comes

to Parrot OS and Kali Linux

that are both operating systems
meant for similar purposes

that is penetration.

Testing.

In this case.

It becomes really tough.

Most of the factors in such
cases boil down to a matter

of personal taste rather
than an objective comparison.

Now before we move ahead
with the comparison,

let me list out
a few similarities that you

might have noticed between
the two operating systems.

So first of all,

both operating systems

are tuned for Operating
penetration testing

and network related tools

and both operating
systems are based

on Debian development standards
both of the operating system

Support 32 and
64-bit architecture

and both operating systems
also support Cloud VPS

along with iot devices.

And of course,

both of them come pre-installed
with their own arsenal

of hacking tools.

Now, let's get down
with the differences.

The first criteria

of differences that we are going
to discuss is Hardware.

Points now as you guys
can see on the slide.

I have put down the system
requirements of parrot OS

on the left hand side

and I have put down the system
requirements of Kali Linux

on the right hand side.

So as you guys can see parrot OS

and Kali Linux both need
1 gigahertz dual-core CPU

when it comes to Ram parrot
OS needs much lesser arm

than Kali Linux,

but it needs 384 MB of RAM
for its minimal running time

and Kali Linux needs
a 1 gigahertz of RAM.

The other hand in terms of GPU,

but it OS doesn't really
need a graphic card

as it has no need

for graphical acceleration Kali
Linux on the other hand.

If you're trying to run
the genome desktop version,

you will certainly
need a graphic card

on the other hand pirate OS need
16 GB of free hard disk space

for its full installation

and Kali Linux needs
20 GB of free space.

So basically parrot OS is
a much more lightweight version.

So we see that parrot
OS definitely wins

against Kali Linux

when it comes

to Hardware requirements due to
its lightweight nature not only

does it require lesser Ram
to function properly,

but the full installation is
also pretty lightweight thanks

to the use of the mate desktop
environment by the developers.

So basically if you're having
an older Hardware configuration

on your computer pirate
OS should definitely

be your choice.

Now the next parameter
that we are going to compare.

The two OS is in is look
and feel now this section.

Be boils down
to personal choice personally.

I prefer the minimalistic look

that is given by parrot OS
the interface of parrot OS

is built using the Ubuntu
mate desktop environment.

There are two clear
sections on top you

see a pain which contains
applications places systems,

which is much like Kali itself,

but it also gives
some cool information

about CPU temperatures
along with the usage graph

and the bottom pane
contains the menu manager

and the work station manager,

which is a brilliant addition

to the Linux system Kali Linux
on the other hand follows

the genome desktop interface

while it still
has the functionality

that is offered by para Todo es.

It doesn't provide
the same clean and refined

look in my opinion.

If you don't know your way
around a collie interface,

it is pretty easy
to actually get lost.

Now, the next parameter

that we're going to compare
them is hacking tools now

since both these
operating systems are

For penetration testers
and ethical hackers.

I think hacking tools is
the most important criteria

that both the operating systems
are going to be compared in so

when it comes to General tools

and functional features para
Todo es takes the price

when compared to Kali Linux
pirate OS has all the tools

that are available in Kali Linux
and also it adds his own tools.

There are several tools
that you will find on parrot

that is not found on Kali Linux.

Let's take a look
at a few of them.

So the first on that you
see is called Wi-Fi Fisher

now Wi-Fi fish oil is
a rogue access point framework

for conducting
red team engagements

or Wi-Fi security testing using
Wi-Fi Fisher penetration testers

can easily achieve a man

in the middle position
against the wireless clients

by performing targeted
Wi-Fi Association attacks.

Wi-Fi Fisher can be further

used to mount victim
customized web phishing attacks

against the connected clients
in order to capture credentials

or in fact the victim

With some sort of
malware another tool

that is seen on parrot
and is much appreciated

that is not seen

on the Kali sign is called
a non surf now being anonymous

for a hacker is the first step
before hacking a system

and anonymizing a system

in an ideal way is
not an easy task.

No one can perfectly
anonymize a system and there

are many tools available
on the internet that see

that they are no no my system
one such tool is

a non surf now, announce.

So of is pretty good

as it uses the tour iptables
to anonymize the whole system.

Also, if you guys
have not already realizes

tour also also comes
pre-installed on parrot

while it has to be externally
installed on Carly.

Now these things that you see

that Wi-Fi Fisher Tor Browser

and announcer surely
they can be imported

and download it on curly
but they don't really come

pre-installed and that is
what counts right now.

So since pirate OS
also Is designed

with development in mind
it also comes pre-installed

with a bunch of useful compilers
for various languages

and ideas for their
respective development,

which is completely absent
on the Kali Linux side.

So for this part of hacking

tools parrot OS definitely takes
a price now the next thing

that we are going

to compare both y'all both
these operating systems is

release variations now
both operating systems come

with a variety of variations,

but part OS has
much more diversity

in terms of variety.

So let me just explain
what I mean.

So as you guys can see
on the left-hand side,

I have listed down
the release variations

that are available
for parrot OS now aside

from the full editions,

which is both provided
by parrot and Kali.

They also both provide the light
additions on parrot side

and the light Edition
on Carly side.

They are both basically
the same thing.

We're in minimalistic tools
are actually pre-installed

and you can Install and
customize the operating system

according to your own needs.

If you don't choose to customize
the operating system,

you can very well use
it as a very lightweight

and portable operating system.

So Peridot a slight addition

and Carly light additions
are two flavors

of the operating system.

Now, this is

where the difference is
such differences start.

So parrot os are
Edition also exist.

So this is an addition

that is used
for wireless penetration,

testing and wireless
vulnerability testing.

So basically anything
Thing Wireless parrot

OS erudition does it faster
and does it better then?

There's also parrot
OS Studio Edition,

which is used for multimedia
content creation Yes.

You heard that right part
it OS can also make content

for your social media.

So if you're thinking
about using part OS

for marketing as well as
security deposit OSU has

definitely your go-to
operating system Carly

on the other hand aside
from its light version

and full edition offers.

Some desktop interfaces

like the E17 KDE and xfce
the Ubuntu mate and the lxde.

So these are
basically just skins

that run over Cali

and basically make
Ali look a little different

from one another you
can check out all

these different customizations
on the khari documentation.

Other than that Callie
has also support for cloud

and iot devices in the form of
the Armel and arm HF releases.

These releases are
also available in parrot over.

ESO para Todo es
doesn't stand down.

So as you guys see Peridot s

provides you a lot
of diversity in the variety

that it is offering.

So in my opinion parrot
OS also takes the price

in this section.

Now the main question remains

which of these two distributions
is better for beginners Well,

it is to be duly noted
that both these distributions

are not exactly
meant for beginners.

If you want to learn about Linux
as an operating system,

you're better off using
something like Go bond

to or deepen.

This also doesn't mean

that you cannot learn
the basics on parrot

or Kali on the other hand.

If you are already knowing
the basics of Linux

and want to get your hands

on an operating system
to learn ethical hacking.

I would personally recommend
using the parrot SEC OS light

addition this is

because the light version comes
with the bare minimum

of networking tools.

This means as you learn

your ethical hacking concept
slowly you could develop

or install tools one by one.

Instead of being overwhelmed
with a whole bunch of them

from the beginning not only
does this allow yourself

to evolve as an ethical hacker

and penetration tester,

but it also makes sure
your fundamentals are built

in a methodical manner.

Now, I recommend parrot OS /

Carly for one other
reason to that is

because the default user
for Callie is Route.

This makes the environment
a whole lot more aggressive

and mistakes tend to be punished

and a whole lot more difficult
to deal with So this means

that parted OS is generally
the winner in my opinion.

When you get hired as
a penetration tester

or a security analyst one

of the main rules
is vulnerability assessment.

So what exactly is
vulnerability assessment?

Well, I've already possessed
man is the process of defining

identifying classifying

and prioritizing vulnerabilities
in a computer system application

and network infrastructures

and providing organization
doing the assessment

with the necessary
knowledge awareness

and risk background
to understand the threats

to its environment
and react appropriately to them.

So vulnerability is a situation

that can be taken
advantage of by a hacker

or a penetration tester

for their own misuse or actually
for fixing the issue.

So while I'm ready assessment
has three steps.

So the first step is actually
identifying the assets

and the vulnerabilities
of the system.

The second step is actually
quantifying the assessment

and the third is reporting
the results now vulnerability

assessment is only a small part

and Pen testing is
an extended process

of vulnerability assessment

when testing NG
or penetration testing

includes processes like scanning
vulnerability assessment

and itself exploitation research

and Reporting whatever
the results are.

So in the industry
was the most widely

used Frameworks when penetration
testing is Metasploit.

So Metasploit is widely used
in penetration testing

as I just said and also used
for exploitation research.

So some of you might ask

what exactly is
an exploit research well

in this world there
are tons of exploits

and the way to approach each
Of them is ever so different.

So what we have to do
is exploit all the research

that is available to us

and we have to find
the best way to approach them.

So suppose, for example,
you have a secure shell login.

So the best way to actually
approach secure shell login

until my knowledge is

that you have to get
a backdoor access

to this from the port numbers

that you can scan
via nmap or eczema.

Okay.

So without wasting
much time at looking

at prop and presentations,

let's actually get started as
to how we can use Metasploit.

So So Metasploit is a freely
available open source framework

that is widely
used by pentesters

as we just discussed.

So to actually
install Metasploit,

which is easily available
on Linux and windows.

I guess.

Let me just check it out.

So you go on your browser

and you time Metasploit
downloads now you just

visit the first link and

as you guys can see it says
it's the world's most

used penetration testing tool

and then you just download
the Metasploit framework

by clicking the
download button here.

So y'all might also
find Pro version

which is a paid thing.

And this has a little bit
of extra features

like group support

and actually helping a company
work as an organization,

but we don't actually need

that and practicing
our pentesting abilities.

So for that you just go ahead

and download Metasploit
framework and install it

on your system above

that there is another thing I
want to get make you guys aware

of and that is Metasploit table.

So when actually
been testing we need a server

or a website to actually
pen testing zone.

So normally this is

a very illegal thing to do
with our permission.

Ian so Met exploitable
has actually created

a server with a lot
of vulnerabilities on it

and it's called Metasploit
able to somet exploitable

to is easily downloadable
from this link

and it's a virtual box file.

So you guys must have
a virtual machine software

on your system to actually
set this thing up.

I'll also go through

how to actually set
up Metasploit herbal

because it has a lot

of configuration and network
management to go with it.

So we'll get to that later.

But for now,

let's get started
with Metasploit table.

So before that Metasploit herbal
is written in Ruby

and if you all know
Ruby coding and y'all know

how to make exploits

y'all can also always contribute
to the Metasploit community.

So Metasploit is one of the most
widely used pen testing tools

in the industry.

So what exactly is Metasploit?

Well, it's a framework

and what a framework is is it's
actually a collection of tools.

So these tools are majorly used
for penetration testing

and exploitation research
now one might ask

what Exactly is
exploit research.

Well, there are tons
of exploits out there

and there are tons of ways
to actually approach them

and this only comes to us

from thorough research as
to how we can approach each

and every exploit
in their best way.

So talking about Metasploit.

Well, it's open source and free
and it's also written in Ruby.

So if you guys know
Ruby coding and know

how to make exploits
y'all can always contribute

to the Metasploit framework now
talking about the download part.

Well y'all can easily
download Metasploit

from its download page,

which is -

Floyd.com download I'll
be leaving the download link

in the description.

And once you're
on the download page,

you'll see two versions
one is the free version

which is the original
Metasploit framework

and it's the core framework
that everybody works on

and then there's Metasploit Pro

which comes with
a 14 day free trial.

So Metasploit Pro actually
has a few extra features,

which is great
for an organization.

Like it helps
you work as a team,

but if you're a guy

who's just practicing pentesting
like me Metasploit framework,

Work the free version is
the absolute way to go now.

Also when pentesting

you all will also need
Metasploit table now met

exploitable is an intentionally
vulnerable Target machine

for actually practicing
your medicine flight skills

on so we will go

over the installation
of Metasploit table later.

But for now, let's go
over Metasploit table.

So once you guys
have actually downloaded

the link y'all can actually
install it on your systems

and Metasploit actually
has three interfaces.

So we are going to be using
the command line interface.

Or the msf console
in other words,

but you all can also use the GUI
interface which is called

Armitage if I'm not wrong.

So let's get started.

So first of all,

I've already actually
downloaded Metasploit

and install it on my computer

and y'all can just do the same
by pressing the download button

as you guys can see so
just start up Metasploit.

All you have to do
is go on your terminal

and so to start a Metasploit
all you have to do.

Do is go on your
terminal on Linux?

Well, we're starting
upholstery SQL Server

because first of all
the postgresql server

is the basis of all
the Metasploit exploits

that are stored and starting it
will just make it run faster.

So we go service post
gray SQL and start

so that's the start of a service

and indeed it has so next thing
you want to do is go in

and type msf console.

And that's going to take
a little bit of time

because I was very slow computer

and it's going to start
up our Metasploit free.

So as you guys can see you got
a big banner out here.

It says Metasploit cyber mesial

and it's the banner changes
every time don't get worried.

If you have a different banner
and the main thing is

that you should see
this msf thing out here.

So this means we are
in the msf Shell right now,

which is the
Metasploit framework shell.

So let's get started by
actually curing our screen.

So first things first
the first command that you

might want to run on a deployed
is the help command.

So help will tell us everything

that we can do
with this framework.

So as you guys can see
there are a bunch of commands

and the descriptions
to go along with it.

Y'all can give it a quick read
and find the things

that are interesting to you.

So as you guys can see
Banner is display

an awesome Metasploit Banner
y'all can change the banner

as you guys can see there are
a lot of Juicy commands

like there's a banner command,

which I just had used.

So if you go and die panel
will give you a nice cool Banner

about Metasploit and there
are other commands

which work very similar
to Linux like CD.

Changes the current directory
you can change the color

by toggling colors

and then you can connect to
the host and all sorts of stuff.

So Metasploit has
a bunch of exploits.

So before we go further,

I want to make you guys aware
of three important terms

regarding Metasploit.

The first is a vulnerability and
we had already discussed this

that a vulnerability
is a situation

which can be taken advantage
of by a system or a person

who axis so the second
part is an exploit.

So what exactly is
an exploit Yeah,

well an exploit is a module

which is a bunch of code written
in Ruby on Metasploit

that is used to Target
different vulnerabilities.

And the third thing
is a payload.

So a payload is
the action that you do

once you actually have access
to somebody system.

So basically suppose
you have hack somebody

and you've gained access
to their system.

Now the activities you do
after gaining access

is defined as the payload so
we just spoke about exploits

and I told you guys

that Metasploit has
a bunch of Right.

So how do we see all
the exploits that are there?

So you go show exploits.

Well, as you guys

can see we've loaded
up a bunch of exploits

which is basically
all the exploits

that Metasploit has
to offer at this moment.

So let me just increase
the screen a bit and let's cruel

completely to the top.

Yep.

So as you guys can see

show exploits give us
a bunch of exploits

and shows the name a description
a disclosure did and the rank.

So the name and description is

as it says it's the name
of the exploit and it's

a short description about it.

The disclosure date is

when the extract was actually
released by Metasploit

and the rank is

how it has fared
against the vulnerability.

It was released for
since it was actually released.

So as you guys can see
ranks range from Great good

and stuff and we have
a bunch of exploits.

So as you guys can see
there's an Android exploit.

There's a Samsung Galaxy
knocks Android exploit.

There are bunch
of Windows exploit

Adobe Flash exploit FTP exploits
MySQL exploit asp.net exploits

and a bunch of other stuff.

So as you guys can see there are
a bunch of exploits to use

and it can get confusing

and rather Troublesome
to search for the exploit.

You actually want to use so

as A pen tester you can always
go for the search keyword,

which is basically suppose,

you know that you
have a MySQL server

which has a bunch

of vulnerabilities and you
want to test those out.

So you simply go
search my SQL now,

I'll search the database
for all the exploits

that are related to mySQL
and present them to you.

Okay, so we have our results.

So as you guys can see
we have a bunch

of MySQL related module system.

Now at this makes it very easier
if you are a pen tester

and you're looking
for MySQL exploits

now suppose you choose
your exploit and let's see,

let's choose.

Which one do we
want to use today?

We're going to just use
this MySQL hash dump.

So to actually use
this we have to copy

the knee so double click on it
and it'll just select it and New

go Ctrl shift C
in your terminal

so that copies it and so

if you want some more
information about it,

you can always go info

and then just paste
in the name of the exploit.

So this gives us a bunch
of information actually

gives us all the information
you need about the exploits.

So it gives you the name
that it's a MySQL password.

Hash dump its module name
is Ox Terry scanner

and all this stuff.

It's licensed by Metasploit.

Framework in itself
and it has a normal rang

and these are all the options
that you might need to set

when actually using the exploit

and this also gives you
a small description.

So it says this module
extracts the user names

and encrypted password hashes
from a MySQL server

and stores them

for later cracking so seems
like really cool stuff.

You can do with ice cubes server
and its password database.

So if you actually
want to use this

so you have to use
the use keyword.

So we go you Who's
and control shift V?

So as you guys can see
it's denoted in red out here

that we are indeed and exploit
that we want to use.

Now.

The first thing you want to do

when you're using
an exploit is you want

to go and say show options.

Now as you guys can see
these are the options

that we actually need to set
before using the exploit.

Now the options can be necessary
or they can be optional

like so there's
a password field out here,

which is not really necessary,

but will help your exploit

if you actually provide it
but you need to provide

the our hosts

which is the targeting
host machine and the port

and the threads is already
set now suppose you want

to set the our hosts

so you can just go set.

Host and you can set it
to whatever IP address

you want like suppose you want
to address 192.168.1.1 56 some

of that sandwich.

I will set the our hosts.

You can also set the number of
threads now threads are actually

what the threads mean
and parallel processing

that mean how many parallel
threads you're gonna run

so that you have
faster computation.

So this means new need GPU power

if you have multiple threads
running So let's set

threads 234 now

so we've set the threads 30

and then you can go
show options again and see

that you have indeed
actually set your options.

So we've set the threats to 30
and our host has also been set.

So that was all about how you
can get into a module know

get some information
about a module and

how can also use them or you

so once you're done
using the module

or once you're done
setting up the options,

You can go ahead and run
the command run or even exploit

and this will start actually
running exploit on the system

that we want to now of put
in a very arbitrary IP address.

So and that not have
MySQL Port running

so our exploit feel now

once you have desiderio exploit

and you want to go
back to the main msf.

Unix shell just go
ahead and type back.

It's as simple as that so

that brings us back
to the msf command line.

I'm so let's go ahead
and clear our screen now.

Okay, so it's time
to do something interesting.

So to do that.

First of all,

we need to go ahead

and actually download
Metasploit able to so

download Metasploit able to do
you have to go on this link.

I'll leave the link
in the description.

So or rather you can just
go on your browser

and type in Metasploit able
to download so met exploitable

as we had earlier discussed
is a Linux based distribution

and It's mostly meant

for actually practicing
your pen testing skills.

So basically it has a bunch
of ports open on it.

So it's basically
just for your he's

so that you don't go ahead

and test it out
on some valid website

and then get thrown into jail

because that's a very
illegal thing to do.

So go ahead and download
Metasploit able to and then

also download Oracle virtualbox
machine Oracle virtualbox.

So you all can
also easily download

that from www.virtualbox.org.

And this is

because you should never run mad
exploitable to on a system

that is connected to a network.

You should always use it
on a virtual machine

because it's Protected
Their Faith so

that nobody else can access it.

So to actually set
up Metasploit table.

Once you've downloaded
it you go ahead

and open up your virtual box.

So out here you have
to go into Global tools

and you create a host only
network manager now already

created a host only network
manager and then you go ahead

and enable the DHCP server
by pressing this out here

like enable then you go back

and you just go new you give it

a name like whatever
you want to name it.

I have already named
mine Metasploit with to

as you guys can see.

So we're going to call this demo

for just demonstration purposes
choose a type to be Linux

and it someone to 64-bit click
next give it a gig of RAM

and you are going to use
an existing virtual hard disk

so out here you just click
on this button out here

and Browse to the place

where you actually downloaded

and unzipped your Metasploit
will download file.

Then you get this virtual
machine disk file,

which is with vmdk file

and you just go ahead
and load it up.

So I'm not going to do

that again because that's just
going to eat up my Ram

and I've already
installed it up to you.

So that was all
about the installation

and the configuration.

So now let's get started
and let's start playing

around with Metasploit.

So once you're done downloading

and installing Metasploit table
on your computer,

all you have to do is
Is go ahead and start it up

in your virtual box machine
and the login ID

and the password both are msf.

Admin.

So first of all,

we need the IP address
of our Metasploit double server.

So we go ifconfig
and this gives us the address.

So as you can see out here
are addresses 192.168.1.2 6.

101.

So once you've go ahead
and started a Metasploit herbal,

it's time that we go ahead and
exploit all the vulnerabilities

that is presented to us by meds.

Able to so do that.

Let's head back
to our Linux terminal again.

So once we have the IP address
that was 192.168.0 6.11

if I am correct,

so let's go

and quickly get a little bit
of information about that.

So who is 192.168.1.1
6.1 o 1 so this will give us

who is on Metasploit able to
and will give us a bunch

of information as to To
how the server is set up

where is set up?

The ports are open
and various other things.

So as you guys can see
this gave us a complete

who is so to get
some more information

about our Metasploit.

Double Servo.

We're going to be using nmap.

Now.

If you guys don't know about
how to use nmap you can go out

and check my other video
on the playlist of made

a pretty good and map tutorial.

So we go and map -

F - s and V which is
steel version and we give it.

the name or the domain name
server and 2.16 856 R11

So we've got a juicy result
out here and we can see

that there's a bunch
of stuff open.

So as you guys can see
there's the FTP poor open,

which has a version
of vsf tpd 2.3.4.

There's also openssh,
which is for .7 P1 DPN.

There's also tell languages
almost miserable to have talent

running on your computer.

Then there's SMTP.

There's HTTP and there's
a bunch of ports open

as you guys can just
see on your screen.

So it's We actually used
Metasploit like a pen tester

to go ahead and test
out these vulnerabilities.

So let's choose
these FTP things.

So we have this fdp out here.

So from the version number,

which is given to us by
the steel version flag

on and map we know
that it's using vsf tpd 2.3.4.

So we can easily search for
an exploit of the same version.

So as a pen tester you
would go search V SFTP D 2.3.4.

So this should give
us all the exploits

that are available for
this particular vulnerability.

So as you guys can see
after a long search

from the search vsf tpd,

we found a vulnerability

or an exploit that can take
advantage of the binary.

So it's time we
actually use this.

So first of all,

let's get some info
about this so info.

Let's copy down this thing

and then let's get
some info about this.

So as a small module description

says this module exploits
a malicious back door

that was added to be
SFTP D download archive.

This backdoor was introduced.

In the vsf tpd, 2.3.4,

tar.gz archive between June 30th
and voila voila.

So we have the options
of setting in our host.

It has an available targets
provided by these guys,

and it's a pretty good
exploit in my opinion.

So let's go ahead and use it.

So we go use
and love the exploit.

So it's visible to us

that again entered
exploit module which is eunuch /

FTP SFTP D 234 back door.

So what we're going to do is
we are going to actually

gain a backdoor access
to our met exploitable system.

So to actually make
this more believable.

So if you guys go into
your Metasploit herbal system,

so you guys can see

that That you are
in the root directory

so you can gain some root access

by going sudo Su
and going msf admin.

So we're now
root user in the msf.

Admin or rather
the Metasploit will console.

So if we go LS we can see
the various files and

if you go sleepy / home

when the home directory now and
if you do LS out here we can see

that there are a bunch of stuff.

So there's an FTP folder.

There's a hack Folder there's
a times of admin folder

and the service in this user.

So that's five folders

if you guys remember so now

what we're going to do is
we're going to gain

some back door access
into the system

and we're going to create
a bunch of folders

in the home directory.

So let's get on doing that.

So to do that we head back
to our marriage like terminal

and we go show options

as we had already
entered are exploited.

So go show options.

So as we see the options

that we have to provide is
the ER host and port number

now the port number
has already been set

because it's 21.

That's where FTB runs

or other TCP runs and we now
just have to set the host.

So to set the host we have
to just put it in the IP address

of our Metasploit herbal server.

So if I remember
correctly it set our hosts

to 192.168 / 56 Art 101.

So that has said are our hosts
so we can again check

that if we've done it correctly
by going show options.

And we indeed
have set our hosts.

Now.

All we have to do
is run the exploit.

So we go and hit run.

So as you guys can see
we have actually gained

a back door service
has found and handling

and the command shell session
has started now you

might be confused as to why
do I have this blinking line?

Well, this blinking
line actually means

that you are inside
the Metasploit herbal server.

That means we have already
gained the backdoor access

and is taking line denotes

that we are on the terminal
of Metasploit able to now

if you don't guys
don't believe me,

let's do some experimenting.

So as I had said,

I'll create a bunch of folders
in the home directory.

So let's change
the home directory first

or rather first.

You can also do a
who am I and instead you

that you're the root user
next you go and do CD / home

and I'll change
the home directory.

Now, let's make
a bunch of folders

like make directory.

This is a test.

So that should have
made a directory.

So let's go into
that directory CD.

This is a test.

So we're already
into the directory.

This is a test.

Now.

Let's make a file
called targets Dot txt.

So that creates 12.

So just to see

if you have actually
done it properly.

Let's go back
to our Metasploit herbal.

So Now in the home directory
you go and type in LS again.

Okay.

So let's type in LS and see so

as you guys can see
we have created.

This is a test folder

and it's already available
then so let's go

and move into that folder.

So this is a test and we
are already in that folder.

So I'm we are also
created a text file

which was called targets.

So that was LS

and it should give us
a Target start txt.

So as you guys just saw
we gained a backdoor access

into a remote system
through a vulnerability

that was available
to us on the FTP.

Port so we first did

that by scanning
the entire domain name server

of Metasploit table by nmap

and gaining some intelligence as
to what ports are running

and watch boats
are actually open

then we found out
that the FTP port is open.

Then we went on to Metasploit
and we found out exploit

that vulnerability very
successfully we found out

how to use the exploit

some information about
that exploit and in the end,

we actually executed at months

and we are already
in that folder.

So and we are also
created a Text file

which was called targets.

So that was LS

and it should give us
a Target start txt.

So as you guys just saw
we gained a backdoor access

into a remote system
through a vulnerability

that was available
to us on the FTP Port.

So we first did that by scanning
the entire domain name server

of Metasploit table by nmap

and gaining some intelligence as
to what ports are running

and what sports
are actually open.

Then we found out
that the FTP port is open.

Then we went on to Metasploit
and He found out exploit

that vulnerability very
successfully we found out

how to use the exploit

some information about
that exploit and in the end,

we actually executed at months.

Now you guys must be wondering

what exactly is and map
and why should I learn it?

Well and map is
a network scanner

that is widely used by
ethical hackers to scan networks

as the name suggests.

Now, you might wonder why
do I need a network scallop?

Well, Let me give
you an example.

So suppose you have a Wi-Fi

that has been set up
in your new house

and you realize

that your data is being actually
consumed at a faster rate

than you are using it.

Now.

You have suspected

that it's your pesky neighbor
who keeps on connecting

to your Wi-Fi and eating
up all your data.

So to actually confirm
all your doubts.

What you want to do
is a network scan

and nmap is a pretty
wonderful tool to do

that now nmap runs on Linux.

Mac OS and windows

and I'm mostly going
to be running this on Linux

because that's what I do most
of my penetration testing

and network testing on

so let's go ahead and get on

with the installation
of nmap on your computer.

So what you do is go
apt-get install and map now

for this you have
to be logged in as root.

If you're not logged in
as root just add pseudo

before this whole command
and it will install it now.

I already have nmap
installed so Um,

not really going to install
it again and again,

so let's just go ahead and just
do a few scans on our website

that is www.eddecosta.com

and we are going to see
what we get back as results.

So first of all,
let me just show you

how you can scan a certain
domain name servers or DNS.

So at map we are going to use
a flag all the time now,

let me just tell
you what our flag.

So if you just go
to nmap and type - -

help this will give you
all the flags and options

that are available
to Actually use on any map.

So if you are actually stuck
and you can't remember stuff,

let's go in and type and Mom -

help and it will give you all
the stuff now Network scans

generally take a long time.

So I'm going to be using
the fast mode most of the time.

So for fast mode,

all you have to do is type
in any record dot go and sit

and wait for this
can't get over now

when the scan gets

over you will see a bunch of
information and let me just wait

till that information pops up

and then we will talk
about the information together.

Okay.

So as you guys can see
our scan has been completed

it took 13 .71 seconds
to actually do the scan.

Now as you guys can see it shows
us the port's the states

and the services now the porch
is basically the port number

which are service

that is also bind it
to is working on so we can see

that SSH service is working

on port number
22 SMTP on 25 actually

Beyond 80 our PC by 911 and Sgt.

BS on 443 so that is

how you can use nmap
to scan a certain website.

Now if you see and map
has also given us

the public IP of the DNS

because what nmap does
is it looks at the DNS

and then translate it to an IP

that is recognized
to that DNS server.

So nmap.

Also Returns the public IP.

So what we can do
also is and map -

F and 34.2 10.2 30 and Dot.

35.

Okay.

So as you guys can see

that our command also works
when we put in the IP address

and it produces
the same results.

Now we can also scan

for multiple hosts now
suppose you are on a network

and you want to scan
for multiple hosts now.

You don't really want to run
different commands for that.

Now what you can do is just go
in and type and map and a bunch

of IP addresses like 192.168.1.1
and Or 1.2 and 192.168.1.3

and what this will do is it
will draw the net Maps scan

on these three
different IP addresses

and you did this
in just one command.

So that's a way
that you can do this.

Now.

You can also know about

how much of your scan is left
by just pressing the up button

so that will tell you

and give you a constant update
on how your scan is going like -

32.4% Dot and 4.7 now

and also show you kind
of the time remaining.

Okay.

So till this port
scan is going on.

Let me just tell you
about the states now States

can be of two types
open closed and unavailable.

Sometimes you will see that
it is unavailable and that's

because some sort of 5
all or something is running out

there states can also be closed
in that case mostly

and math will not return
you any result

unless you're explicitly finding
something of the closed state.

So that was a little trivia
on States and how they work.

How much are Scott has done

so a scout is dot 81% takes
around another 20 seconds.

It should be done soon.

Now.

This scan could be significantly
made faster with just EF tag,

but I really want to give
you all a good look

into how this works.

97 98 99.

Okay.

So as you guys can see
this is our result.

It gives us a bunch
of ports and services now

as I just said this thing
can be also closed

and also unable Available.

So open and closed
we see both the examples.

Okay, so that was about
how you can scan multiple ports.

So you can also scan multiple
boards with this command

as I will show you.

So what I do not one six eight
dot one dot one to Thirty.

Now what this will do
is basically scan everything

from 192.168.1.1 to 192.168.1.2
up to 30 like that.

So this is a very useful way
of actually scanning.

Tubal IP addresses.

Let me just show you
how that works.

Since we have used the a flag,

this is going to work
considerably faster now

as you guys can see out here.

This had taken around
a hundred nineteen seconds.

So that's round two minutes now.

This will take
a considerably less a time.

So, let's see this was done
in 29.91 seconds,

and we'd it 30 IP addresses.

So we see that -

F surely speed ins
the whole scanning process now,

you can also give nmap
a Target list now,

let me Could Target list
so targets D XD.

We just got it out for you.

So that's starting it now.

All I want to do
is edit this file.

So, let me just edit
that file and put

a 192.168.1.1 192.168.1.2
192.168.1.3 192.168.1.5

for 192.168.1.5 or 15.

Boom Rose.

Sit now, all we have
to do is save it.

So that saves it and control
X to actually access it.

Now, you can go ahead and view
what is a target set txt.

So as you guys can see this is
what isn't Target such cxt.

And now you can just pass it
to end map with the IL flag

and you could say that nmap
is going to actually

scan all the IP addresses

that are in this file.

So let that just run.

So this will take
a little bit of time

because it's five IP addresses

and it's really radical
the fast boat 83%

of our work is done.

Okay.

So as we see our scan
has been completed now,

what do you see out
here is scan results

for whatever we had provided
and targets dot txt list.

So that's how you can also
provide and map input file

and it will give you the results
for all the targets

that were specified in the file.

Now, let's go ahead

and talk about a little bit
on Port scanning.

So nmap is also A brilliant tool
for scouting boards.

And if you have
a server or web site,

you know that there are
65535 ports out there

or every silver and almost 99%
are unused so sometimes kind

of ports is really
at the society.

Now you can scan boards
by just using the pflag

and specifying the port number
and this is how you would do it.

And if you just specify
the IP address after that,

so I'm going to use
w-w-w dot Ed u-- record.

Go and what you can also do is

this will scan only
the port number 20,

but you can also scan
from port number 20 to 25.

You can also put in comas
and tell and lap.

You also want to scan all these

are the port 80 is HTTP
and 443 is HTTP,

so you can surely do that.

So let me just go
ahead and run this.

Okay, so that gives us
an information on the boards

that is there now
something about ports.

Also you suppose, you know.

You want to scan
for some HTTP Port

so you can just say and map
and with the -

be you can just say

that I want to scan
the HTTP board www dot Ed u--

red card dot go so that will
just go ahead and do that.

And as you guys can see

that give us a result
and you can also add

in stuff like MySQL FTP
and stuff like that.

So let me just see show you

how that rods okhttp
is done poor Sgt.

Okay, so as you can You
guys can see these artboards

that are running and it gave us
according to the day.

Now.

If you want to scan
all the ports,

you can use - P -

and the IP address
at www.deeptrekker.com.

Now this generate
takes a lot of time

because you're basically
doing 65,000 scan.

So I'm not really
going to do that.

I'm going to quit this out.

Another thing

that I want to show you all
that generally takes a lot

of time to actually
execute is called something

like an aggressive scam.

So as you guys can See out here.

I have done an aggressive
scan on Ed Eureka.

So do that.

All you have to do
is and map - A

and then you go
Eddie record dot go.

So let us see how much time

did this take to actually
execute this deck 459 seconds

that's long time for scan,

but it gives us a bunch
of other information.

For example, it gives
us the traceroute.

So what is the traceroute first
of all so traceroute

is the route taken by a packet
to to actually reach the clients

and the target cell.

So as you guys can see our back
it had 22 hops first went

to the first stop was
to the Gateway router

that is 192.168.1.1.

Then when to the Airtel lease
line then rent this IP address

that went to the pslv SNL dotnet

and it went to London
New York the Chicago

and the went all the way up to
wherever this thing has hosted

that was some information

and then there is
some other Information

given to us like the TCB open

TCB rap program version
sport type sport States

and all sorts of other
information is given about

in an aggressive scan

another scan that I
have previously also done

and kept for y'all is

because it takes a lot of time
and I have done something

called this service
version so and map -

s and V where V Capital will
give you the service version.

So it tries to actually
guess the word.

Asian of the service
that is running.

So for example on TCP Port it
tells us it is postfix SMTP D

or the Apache.

It's Apache HTTP D.

You can see all sorts
of versions that are here.

Another thing and map
is generally brilliant

is for guessing
the operating system

that is running.

Oh, I have already done
this can previously

because this takes
a humongous amount of time

that I don't really have and
that is three eighty six point

three four seconds

and this can together
basically took me.

In ten minutes,

and I don't really
have that kind of time

for explaining all this stuff.

So as you guys could see
out here the OS get is

kind of os detail is fortunate

for the gate it kind of
tries to guess the OS

upon the time to live

that is in the response
from the packets

that it sends.

So - SVP - oh and -

A are some really
cool stuff stuff

that you might want to know.

Another thing that you
can do is trace route

as I had just told y'all
and y'all can do Trace.

Trout separately.

So you go - -

traceroute and then you say
the name of any sort of website.

So suppose.

I want to know
how I reach netflix.com.

So I go netflix.com and this
will give me a trace route

that shows me how my packet
actually reaches the flicks.com.

Okay.

So this is basically
it was a direct one hop.

Okay, so that was surprising
all the other hand.

If I were to do this
on Eddie record dot

go it would take A bunch
of hops to actually reach

that it is by just
take some time to run.

Okay, so it's 94 percent down.

I'm just waiting
for it to get completed.

Okay.

So this gave us a hop and
as you guys can see we took

twenty two hops to actually
reach a direct cannot go

and it's the same process you go
through a bunch of IP addresses

and then you reach
this thing called you

as West do compute
that Amazon AWS.

Okay, so that was

about traceroute now just
to end this tutorial.

Let me just tell you guys

that you all can also save
a file to add map.

And that is basically save
all whatever you found

from a search into a file
and let me just show you

how to do that.

Now.

Sometimes when you are working
as a security analyst you

will have to perform Network
scans on a wide area network

that is huge.

It's basically huge
these cards take a lot of time

and you don't really have
the space or your command line

to actually store

that and see that in the parade.

That is feasible.

Little for analysis.

So what do you want to do
is actually save it in a file.

So what you can do
is say Ed map.

Oh n and then you

can see the other file we
could say results Dot txt,

and we could save this in file.

So w-w-w dot Ed u--
Rekha dot go.

So whatever search result

is going to be generated
is going to be stored

in this file called
results dot txt.

Now.

This file need not exist.

List from before it will just
be created by and map

and now you see if I do LS.

We have a Target
or a results dot txt.

Now if I just cut out that file,

let me just less it
actually results Dot txt.

And what you see out here
is an nmap scan result

that is stored.

Another thing that I would like
to show you all before I end

this at map tutorial
is a verbose mode.

So for verbose mode is basically

when we were pressing
up arrows to see

how much of our scan is done.

You can basically do
that for postponed.

Take all - F + -

V for verbose and you
could say www dot Ed u--

record Dot and this
will basically give

you a verbose mode of
what is actually going on.

I'll tell you everything
and boom roasted there it's done

and we have finished
our and map tutorial

and now you see if I do LS.

We have a Target
or a results dot txt

if I just cut out that file.

Let me just less it
actually results Dot txt.

And what do you see out
here is an nmap scan result.

That is Stored a lot of thing

that I would like to show
you all before I end this

at map tutorial
is a verbose mode.

So for verbose mode is basically

when we were pressing
up arrows to see

how much of our scan is done.

You can basically do
that for postponed.

So you go - F + -

V for verbose and you
could say www dot Ed u--

record Dot and this
will basically give

you a verbose mode of
what is actually going on.

I'll tell you everything
and boom roasted there it's done

and We have finished
our and map tutorial.

So first of all,

what exactly is
cross-site scripting?

Well cross-site scripting

refers to client-side
code injection attacks

where in an attacker

can execute a malicious script
also commonly referred

to as a malicious payload
into a legitimate website

or web application now xss is
amongst the most rampant

of web application
vulnerabilities and occurs

when of Web application
makes use of something

like a nun validated

or unencoded user input
within the output

that it generates Now
by leveraging xss

and attacker does not Target
a victim directly instead

an attacker would be exploiting
a vulnerability within a website

or something like
a web application

that the victim would visit

and essentially using
the vulnerable website

or the web application
as a vehicle to deliver

a malicious script
to the victims browser.

Now while exercise
can be taken advantage

of within a virtual box script
ActiveX and Flash

unquestionably the most
widely abused is Javascript.

This is mostly

because JavaScript
is the fundamental

to any browsing experience all

the modern sides today have some
JavaScript framework running

in the background
now xss can be used

in a range of ways
to cause serious problems.

Well, the traditional is uses
of exercise is the ability

for an attacker to steal.

Session cookies allowing

an attacker to probably
impersonate a victim and

that Justin's and that
just doesn't stop there.

So exercise has been
used to wreak havoc

on social websites spread

malware website defa commence
and fish for credentials

and even used in conjunction

with some clever social
engineering techniques

to escalate to even
more damaging attacks.

Now cross site scripting
can be classified

into three major categories.

So the first is reflected
cross-site scripting.

The second is stored or
persistent cross-site scripting

and the third is dom-based
cross-site scripting so

out here Dom refers
to the document object model

that is used file
web application building.

So let's take a moment
to discuss the three types

of cross-site scripting.

So the first one we're going
to be discussing is reflected

cross-site scripting Now

by far the most common type
of cross-site scripting

that you'll become.

Because is probably reflected
cross-site scripting here.

The attackers payload

is a script and has
to be part of a request

which is sent to the web server
and reflected back in such a way

that the HTTP response
includes the payload

from the HTTP request Now
using a phishing email

and other social engineering
techniques the attacker layers

in the victim to inadvertently
make a request to the server

which contains the cross
site scripting payload,

and then he ends up
executing the script

that gets reflected and cute it
inside his own browser.

Now since reflected cross-site
scripting isn't really

a persistent kind

of attack the attacker
needs to deliver

this payload to each victim

that he wants to serve.

So a medium like a social
network is very conveniently

used for destination
of these attacks.

So now let's take
a step by step.

Look at how cross-site
scripting actually works.

So firstly the attacker
crafts a URL containing

a malicious string
and sends it to the victim.

Now the poor victim
is tricked by the attacker

into requesting the URL
from the website,

which is running
a I respond script

and then the website
includes the militia string

from the URL in the response.

And then in the end
the victims browser executes,

the malicious script
inside the response sending

the victims cookies to
the attacker silver.

Okay.

So at first reflected xss
might seem very harmless

because it requires a victim
himself to actually send

a request containing
a militia string now

since nobody would be
willingly attacking himself.

So there seems to be

no way of actually
performing the attack but

as it turns out there are
at least two common ways

of causing a victim

to launcher reflected
cross-eyed attack on himself.

So the first way is

if the user or targets
a specific individual

and the attacker can send
the malicious URL to the victim.

For example using email
or for example instant messaging

and then trick him
into visiting the site.

Secondly if the user
targets a large group

of people the attacker
then can publish the link

or the malicious URL

or his own website
or social media,

and then he'll just wait
for visitors to click on it.

So these two methods are similar

and both can be very
successful with the use

of a URL shortening service
like one provided by Google.

So this masks the militia
string from users

who might otherwise identifier.

Okay.

So that was all about
reflected cross-site scripting.

Let's move on to store
cross-site scripting now.

So the most damaging type
of cross-site scripting

that is there today
is persistent or stored

cross-site scripting installed
cross-site scripting attacks.

It attacks.

I'm sorry installed
cross-site scripting attacks.

The attacker is injecting
a script into the database

that is permanently stored
on the target application.

So a classic example

is a malicious script
inserted by an attacker

in the comment field or on
a blog or a forum post.

So when a victim navigates

to the affected webpage
now in a browser

The cross site scripting
payload will be served.

As a part of the web page just

like any legitimate
comment would be now.

This means that the victim
will be inadvertently ended

up ending up executing
the malicious script.

Once the page is viewed
in the browser.

Now, let's also take
a step by step.

Look at how cross-site scripting
in the stored version works.

So the attacker uses one
of the websites form to insert

a malicious string into
the websites database first.

Now the victim unknowingly
request the page

from the website

and then the website Glued
some malicious string

from the database
in the response

and then sends it to the victim.

Now the poor victim
will be actually executing

the malicious script
inside the response

and sending all the cookies
to the attackers server.

So that's basically

how stored or persistent
cross-site scripting works.

Now it's time for the last type
of cross-site scripting

which is document object model
based cross-site scripting.

So dom-based cross-site
scripting is an advanced type

of cross-site scripting attack.

So which is made possible

when the web applications
client-side script writer uses

provided data to
the document object model.

So basically it means

that data is subsequently read
from the document object model

by the web application
and output it to the browser.

So if the data is incorrectly
handled in this place

and attacker can very
well inject a payload,

which will be stored as a part
of the document object model

and then executed

when the data is read
back from the Dome.

No, let's see how
that actually happens.

So first attacker craft
the URL containing

a malicious string
and sends it to the victim.

Now this victim is again
tricked by the attacker

into actually requesting
the URL from the website.

This is like the primary step

in actually performing
cross-site scripting.

Now the third step is

that the website receives
the request but does not include

the militia string
in the response.

Here's the catch of
dom-based cross-site scripting.

So now the victims browser
executes the legitimate script

inside the response.

Causing the malicious script
to be inserted into the page

that is basically
into the inner HTML attributes

and the final step is then
the victims browser then

executes the malicious script
inserted into the page

and then just sends

the victim the cookies
to the attacker silver.

Now if you guys
must have realized

in the previous
examples of persistent

and reflected cross-site
scripting those server inserts,

the malicious script
into the page,

which is then sent as
a response to the victim now

when the victims browser
receives the response it assumes

that the malicious Ripped
is to be a part

of the pages legitimate content

and then automatically
executes it during page load as

with any other script would be
but in a Dom base attack,

there is no malicious script
insert it as a part of the page.

The only scripts

that are being actually
automatically automatically

executed during the page load is
legitimate part of the page.

So that's the scary part.

So the problem is

that this legitimate script
directly makes user input

in order to add
HTML to the page.

So the militia string

is inserted into the page
using Nice chairman,

so it's pastas sgml.

So mostly people
who are actually in servicing

or surveying any server for
cross-site scripting attacks.

They will not be actually
checking the client side.

So it's a very subtle difference
but it's very important.

So in traditional cross site
scripting the militias

JavaScript is actually executed

when the page is loaded as
a part of the HTML server

and in dom-based
cross-site scripting

the militias JavaScript
is executed at some point

after the page has
already been loaded.

Because the page is
legitimate JavaScript treating

user input is using it
in an unsafe way.

So now that we have actually
discussed all the three types

of cross-site scripting

that is varied that is
widely available today.

Now, let's see
what can actually happen

if cross-site scripting will

if you were actually a victim
of cross-site scripting,

I'm sorry.

So, let's see what can happen

if you actually were a victim
of cross-site scripting.

So the consequences of
what an attacker can do

with the ability
to execute JavaScript

on a webpage may not immediately
stand out to you guys,

but especially

since browsers like Java
like Chrome run JavaScript

in a very tightly controlled
environment these days

and JavaScript has
very limited access

to users operating systems
and user files.

But when considering

the JavaScript has the access
to the following

that we're going
to discuss we can only see

how creative JavaScript
attackers can get.

So firstly with malicious
JavaScript has access

to all the same objects

that the rest of the web page
has so this includes a thing

called cookies now

cookies are often used
to store session tokens.

And if an attacker can obtain
a user session cookie,

they can impersonate that user
anywhere on the internet.

Secondly JavaScript can read
and make arbitrary modifications

to the browser's
document object model.

So your page will
just be incorporated

with all sorts of scripts

and viruses without You even
knowing from the server side now

JavaScript can be used

with the XML HTTP request
to send HTTP request

with arbitrary content
to arbitrary destinations.

And the most scary part is

that JavaScript and modern
browsers can leverage HTML5 apis

such as accessing a user's
geolocation webcam microphone

and whatnot and even

specific files from
the users file system.

Now while most of these apis
require the users to opt

in cross-site scripting
with in actions

with some very

clever social engineering
can bring an attacker

of very long way now
the above in combination

with social engineering

as I just said allows

an attacker to pull
off Advanced attacks,

including cookie theft
keylogging fishing

and identity theft to now

critically cross-site scripting
vulnerabilities provide.

The perfect ground

for attackers to escalate
attacks to more serious ones.

So now that we understand what
cross-site scripting attacks are

and how damaging they can be
to your application.

Let's dive To the
best known practices

that are actually followed to
prevent them in the first place.

So the first mechanism
that is used is called escaping.

So escaping data means

that taking data and application
has received and ensuring

that it's secure before actually
rendering it for the end user.

Now by escaping
user input key characters

in the data received by
a web page will be prevented

from being interpreted

in any malicious sort
of way now innocence

your censoring the data
or webpage receives in a way

that will disallow characters
especially those brackets

that begin the HTML attributes
like in HTML and I'm G

so these will be stopped
from being rendered

which would otherwise cause harm
to your application

and users and database,

but if your page doesn't allow
users to add their own code

to the page A good rule of thumb
is We need to escape any

and all HTML URL
and JavaScript entities.

However, if you
are running a forum

and you do allow users
to as Rich text to your content,

you have a few choices.

So firstly you will need
to carefully choose

which HTML entities
you will escape

and which you won't
or buy replacement format

for raw HTML such as markdown

which will in turn allow
you to continue escaping all

the sorts of HTML characters
now the second method

that is normally used
is called validating input

And so validating
input is the process

of ensuring an application
is rendering the correct data

and preventing malicious data

from doing harm to the site
the database and the users.

So while whitelisting and input
validation are more commonly

associated with stuff
like SQL injection,

they can also be used as
an additional method

of prevention for
cross-site scripting attacks.

So input validation
is especially helpful

and good at preventing
cross-site scripting in forms

as it prevents a user
from adding special.

Characters into the fields
instead of refusing

the quest completely.

But in fact valid
input validation is

not the primary method of
prevention for vulnerabilities

such as cross-site scripting

and even SQL injection
for that example,

but instead they help to reduce
the effects should an attacker

actually discover such
a vulnerability in your system.

Now the third way to prevent
cross-site scripting attack

is to sanitize user input.

So sanitizing data
is a strong defense

but should not be used alone

to battle cross-site
scripting attacks.

It's totally possible.

Will that you find the need
to use all three methods

of prevention in working towards
a more secure application.

Now as you guys might notice

that sanitizing user inputs is
especially helpful on sites

that allow HTML markup to ensure
data received Can Do no harm

to users as well
as your database

by scrubbing the data clean
of potentially harmful markup

and changing the
unacceptable user input

into an acceptable format.

OK guys.

So that was all the theory about
cross-site scripting it's time.

Demo right now.

So for the demonstration now,

I'm going to be showing
you guys the three types

of cross-site scripting

that we have discussed
throughout the course

of the session.

So not only will this be
a rather interesting to see

how cross-site scripting works
on a vulnerable web application,

but it will also give

us a better understanding
of cross-site scripting

in itself now to perform
cross-site scripting is

a very big crime.

So we really can Target
any random web platform website

or web application
for that matter.

So keeping that thing in mind I

have chosen the broken
web application project.

So this is brought
To Us by a wasp

which stands for open source web
application security project.

The broken web application
project or Bebop is

a broken web application

that is intentionally vulnerable

and it incorporates
a majority of the known bugs

that are out there
and it is widely used by

security enthusiastic students

and practicing ethical hackers
to mostly practice

and nurture their skills
in the right direction.

Okay, so to get started
first of all,

we need to download a few
files and get things ready.

So first of all,
we will download the broken web.

Ation project

and I'll be leaving
the download link

in the description just in case
you guys want to practice

in your own free time.

Secondly.

We need to download
a virtual box.

Now after we have
both the files ready

and we have it installed

and we have our broken
web application installed

in the virtual machine.

We are good to go.

Now.

I've already done
all that boring job

and actually installed
the broken web application

as you guys can see.

I'm already running

the owasp broken web application
on my virtual.

And this is the Oval
Office virtual machine.

So as you guys can see
it's based off Linux

and if we go ifconfig,

it'll give us the IP address
that it's running on.

So as you guys can see,

it's running on 192.168.1 46.4
so If we just head over there,

yeah, I've already open that up.

We get a portal.

So for this
particular demonstration,

I'm going to be using the broken
web application project

and also webgoat.

So first of all,

let's head over to the broken
web application project.

So we'll be greeted
with a login screen out here

and the credentials
for this is B and Bug

as you guys can see,

so just go and enter login
after you enter the credentials.

Okay, so y'all will be
welcomed with a place

where you can choose your bug

and you can also choose
the amount of security

that you want to practice with.

So since this is
a very simple demonstration,

I'm going to set
the security too low.

And the first thing

that we're going
to test is actually

reflected cross-site scripting.

So reflected cross-site
scripting mostly has things

to do with the get request

when we are actually
coding on the back end.

So, let's see.

First of all we go ahead

and choose reflected cross-site
scripting for the get method

and we go and press hack.

Now will be presented
with a form.

Now form is a very good way

of actually showing
reflected cross-site scripting

because normally when
an attacker will be trying

to attack you he'll be trying
to send you a form or any way.

You can actually input

something into the his
soul so interestingly

if we go and just in put nothing
into these two fields

and just go will see
the URL change out here.

So firstly you guys see

that it's the fields are
very clearly visible

and These are the two fields
and that means

that it's an uncoded input.

So this is a very rich place

to actually practice
your web vulnerability

and penetration testing skills.

So if I were to hackl,

I would try and run
a script out here.

So if I were to go script

and I've already
practiced a few out here

as you guys can see,

so if you go script alert,

this is an example
of reflected xss.

Yeah, and if we go and just
end the script out here.

This is going to actually render

the JavaScript input
as a part of the page

and we are going to get
an output because of this.

So that's how reflected
cross-site script

is actually working.

So as you guys can see
we the what am I saying?

As you guys can see
the web application has actually

rendered our JavaScript
and now we can see

that reflected cross-site

scripting is actually
working out here.

So now you guys
must have realized

that in a practical scenario.

This form must be
sent to the victim

and must be tricked
into filling the form

for the attack to be successful.

Also in more practical scenarios

where sites are
also having forms.

They're going to be putting
filters to the Of

the input parameters such

that you cannot run
JavaScript in them

and you cannot also input
any unencoded inputs into them.

So that was all
about reflective JavaScript.

I mean reflected
cross-site scripting.

So now let's move
on to store cross-site scripting

which is the most dangerous form
of cross-site scripting.

Okay, so as I had discussed

the comment sections are
normally the best place

for actually stored
cross-site scripting.

so as you guys can see out here

if we already have
a few comments

that had added for practicing
now in store cross-site

scripting the attacker
is normally attacking the data

that is stored.

So basically we are going
to inject the script

into the database
into the server.

So if the script has
some malicious intent

and it can do
a multitude of thing

if it has a malicious intent
will not get into that.

So for that reason,

let's first add
a normal comment out here.

So let's say

if this was blog
I'd say good job there.

Like I said
or something like hey,

man, nice work.

If you go and
press submit, okay,

it's showing this is
an example of persistent

cross-site scripting

because I had already
inserted malicious script.

So this is that script out
here the second input but just

for demonstration purposes.

Let's go in and put it again
so we can also input raw data

that is unencoded input
in the form of script.

So let's go alerts.

Unless his print hello world.

So if we go and press submit
so at first ones

that other cross-site script
and then it will say

that this page isn't working.

So this is also a very
good example now we

have two scripts actually
running on this page.

So the first one is

actually this is an example of
cross-site scripting persistent.

So that was the second one
and then comes the hello world.

So that's actually two scripts
running back to back.

So anybody if I were
to actually come back

to this side any other day

and these comments
existed It would just

get automatically executed
from the database

because just because we
are referring to it.

Okay, so time for
dom-based cross-site scripting

and I was using this application
for the first time yesterday

and I realized

that there is actually
no way that we

can actually test dom-based
cross-site scripting you.

So to actually test
on base cross site scripting

we are going to be using
this thing called webgoat.

Now the login credentials

to webgoat is guests
for the username

and guests for the password.

I'd already logged in
so it didn't ask me.

So now if we go out here

and go on the cross
site scripting in xs/s,

you will also see
that there is no options

available for actually donbass
cross-site scripting this is

because it's under
a acts security or Ajax

if you might pronounce
it that way.

So in this is
under a acts security

because if you guys remember
we had just discussed

that don't be cross site
scripting is a client-side

cross-site scripting.

So things like a normal script
would normally be checked

on the server side.

But when we are talking
on client side,

we are talking about languages
like HTML a acts etcetera

so you can put your scripts
in HTML form.

So suppose we were to go
so let's input a script first.

So suppose you have
to go script.

Hello world now.

If we go and submit the solution
nothing actually happens

because we are actually putting
in encoded in puts out there.

It's the Dom that is unencoded.

Now if we were to actually go in
and input in a language

that the client-side actually
understands for example HTML,

so we immediately get a result.

So first of all,

it's going to actually
manipulate the inner

HTML attributes of this site.

So if we go image
and we put a source now,

let's not give the source
anything and on alert

on are urado on an error.

We're going to run
some simple JavaScript so alert

And we can say this is
an example of dom-based xss.

Now as soon as I end
end the image tag,

this is going to get done
because the client side

is always rendering
the client-side page.

So watch this.

Sorry, I think
I miss type somewhere.

Let's go again so image.

Unless you something I've
already used and you can see

that it says hacked and out.

He'll we've not even
press submit solution.

So out here you can see

that as soon as we completed
it is again saying hacked so

that means as soon as you
complete the query or

the client-side HTML language,

so that will completely

trigger the cross-eyed
payload image tag.

This is going to get run

because the client side
is always rendering

the client-side page.

So watch this.

I'm sorry.

I think I miss type somewhere.

Let's go again so image.

Okay, let's use something I've
already used and you can see

that it says hacked
and out here.

We've not even
press submit solution.

So out here you can see

that as soon as we
completed it is again saying

that so that means as soon
as you complete the query or

the client-side HTML language,

so that will completely
trigger the cross-eyed payload

firstly let's go

or what does and DDOS means now
to understand a DDOS attack.

It is essential to understand
the fundamentals of a Dos attack

does simply stands
for denial of service?

The service could be
of any kind for example,

imagine your mother
confiscate your cellphone

when you are preparing
for your exams to help you study

without any sort of distraction

while the intentions of
your model is truly out of care

and concern you are being denied
the service of calling

and any other service offered
by your cell phone now

with respect to a computer
and computer networks.

A denial of service
could be in the form

of hijacking web servers
overloading ports,

which request rendering

them unusable the dying
Wireless authentication

and eyeing any sort of service

that is provided
on the internet attacks

of such intent can be performed
from a single machine

while single machine attacks
are much easier to execute

and monitor their also easy

to detect and mitigate
to solve this issue.

The attack could be executed
from multiple devices spread

across a wide area.

Not only does this make
it difficult to stop the attack

but it also becomes
near impossible to point out.

The main culprit such attacks
are called distributed denial

of service or DDOS attacks.

Now, let us see how they work
the main idea of a U.s.

Attack as explained

is making a certain service
unavailable since everything

that is attacked is
in reality running on a machine.

The service can
be made available.

If the performance of
the machine can be brought down.

This is the fundamental
behind dose and DDOS attacks.

Now some dos attacks
are executed by flooding servers

with connection requests

until the server is overloaded

and is deemed useless others
are executed by sending

unfragmented packets to a server

which they are unable
to handle these methods

when Muted by a botnet

exponentially increase
the amount of damage

that they are doing

and their difficulty
to mitigate increases in Leaps

and Bounds to understand more
about how these attacks work.

Let us look at the different
types of attacks.

Now while there are plenty of
ways to perform a DDOS attack.

I'll be listing down
the more famous ones.

These methodologies have become
famous due to their success rate

and the Damage they
have caused over time.

It is important to note
that with the advancement

and Technology.

The more creative minds
have devised more

devious ways to perform.

Dos attacks.

Now the first
type of methodology

that we are going to discuss
is called ping of death now

according to the TCP IP protocol
the maximum size

of the packet can be
65,535 bytes the Ping

of death attack exploits
this particular fact

in this type of attack.

The attacker sends packets

that are more than
the max packet size

when the packet fragments
are added up computers

generally do not know

what to do with such
packets and end up freezing

or sometimes crashing
entirely then we come

to reflect on the docks
this particular attack.

Iraq is more often than not used
with the help of a botnet.

The attacker sends a host

of innocent computers
a connection request

using a botnet which are
also called reflectors.

Now this connection
that comes from the botnet looks

like it comes from the victim
and this is done

by spoofing The Source part
in the packet header.

This makes the host
of computers send

an acknowledgement to
the victim computer

since there are
multiple such requests

from the different computers

to the same machine this
overloads the computer

and crashes it this type

of attack is also known
as a Smurfette.

Another type of attack is called
mail bomb now mail bomb attacks

generally attack email
servers in this type

of attack instead of packets
oversized emails filled with

random garbage values are sent
to the targeted email server.

This generally crashes
the email server

due to a sudden spike in load
and renders them useless

until fixed last

but not the least we
have the teardrop attack.

So in this type of attack,

the fragmentation offset field

of a packet is abused
one of the fields

in an IP header is a fragment
offset field indicating

the starting position or offset.

Of the data contained
in a fragmented packet

relative to the data
in the original packet

if the sum of the offset

and the size of one fragmented
packet differs from that

of the next fragmented packet
the packet overlap now

when this happens a server
vulnerable to teardrop attacks

is unable to reassemble
the packets resulting

in a denial
of service condition.

Okay.

So that was all the theoretical
portion of this video now,

it's time to actually perform
our very own DDOS attack.

Okay.

So now that we finish
the theoretical part

of how DDOS actually works

and what it actually is
but it's different types.

Let me just give you guys
a quick demonstration on

how you could apply a denial

of service attack

on a wireless network
anywhere around you

like this could be
somewhere like Starbucks

where you're sitting
or this could be a library also

or your college
institution no matter

where you're sitting
this procedure will work.

So the first thing we want to do
is actually open up a terminal

as because we were Be doing
most of our work

on a command line basis.

Now for this
particular demonstration.

We will be actually using
two tools first is aircrack-ng,

which is a suit of tools

which contains aircrack-ng
airmon-ng a replay

and G and airodump-ng.

So these are the four tools
that come along with it.

And the second one

that we'll be using
is called Mac change of okay.

So let me just put
my terminal on maximum.

So you guys can see
what I'm actually writing out.

So first thing we want to do
is Actually log in as root.

So let me just do that quickly

because we need to login as
root because most of the stuff

that we're going to do right now
will need administrator access.

Now.

If the first thing we
want to do is check out

our wireless network cards name

and we can do that easily
by typing ifconfig.

Now, you can see

that my wireless card is called
WL 1 and we get the MAC address

and we also get the IPv6 dress.

So that's my wireless network
card and we'll Actually setting

that up in monitor mode now

before we actually go in
to start up our Network

are in monitor mode.

Let me just show you
how you can install

the two tools that I just spoke
about that is aircrack-ng

at Mac changer.

So do install aircrack-ng.

You can just go app get

install aircrack-ng hit enter
and this should do it for you.

I already have it installed.

So it's not going to do
much to install mac changer.

You could just go
the same command

that is zap get
install mac changer

and you can check

if both the tools
have been installed properly

by opening the manual pages
by typing man aircrack-ng

and this will open up
the manual page for you.

And let's also do
the same format to ensure.

So what we're going
to do first is set up

our network interface card
into monitor mode.

So to do that,

all we have to do
is type ifconfig,

and we need to put
a network interface card down.

So we go.

Wlo one down and with
the command IW Go mode monitor.

Don't forget to specify

the interface that
you're working on.

So IW config WL 1 mode Monitor

and all you have to do
now is put it back up.

So what we are going
to type is ifconfig.

Wl1 up.

You can check the mode
it will see managed

if it's monitoring mode.

So as you guys can see
it says mode managed,

so that's how we're going
to go ahead so you can check

that just for your own purposes

so we can also check for only.

Wlo one by
specifying the interface.

Or you could also check
the mode only by passing it

through a pipe function
and that is using grep mode.

So IW config wl1 crap and mold.

Well mode begin
to the capital M.

So that's how you
would probably return it.

So as you guys can see

that has returned
the mode for us icon

along with the access point
and the frequency.

Okay, so that was
a little fun trivia on

how you could fetch the mode
from a certain command

that like iwconfig
by passing it through a pipe

and Open your list mode crap
basically means grab.

Okay, so now moving on we
will get to the more

important stuff now so
firstly we need to check

for some sub processes

that might still be running and

that right actually interfere
with the scanning process.

So to do that,

what we do is airmon-ng check

and then the name
of the interface now

as you guys can see I have
the network manager

that is running out here
and we need to kill that first

and that can be easily
done by going kill

with the PID after that.

You can run
a general command called.

Old airmon-ng check

and kill so whatever it finds
it will kill it accordingly

and when it produces
no results like this,

that means you're ready to go

as there are
no sub processes running

that might actually
interfere with us

can now what we want to do
is we want to run a dump scan

on the network interface card

and check out all
the possible access points

that are available to us.

So as you guys can see
this produces a bunch

of access points and they come
with their be ssids there.

So have the power
which is the pwr

that is the power of the signal
and let me go down back again.

So yeah, you can see the beacons
you can see the data you can see

the channels available
and what the bssid is.

It's the Mac ID

that is actually tied
in with the essid

which basically represents
the name of the router.

Now, what we want to do
from here is we want

to choose which router
we want to actually dose.

Now, the whole process
of dosing is actually

we will continue Sleety
authenticate all the devices

that are connected to it.

So for now I have chosen
Eddie Rekha Wi-Fi to actually

toss out and once I send it
the authentication broadcast,

it will actually

the authenticate all the devices
that are connected to it.

Now this the authentication

is done with a tool
called are replay

which is a part of
the aircrack-ng suit of tools.

Now.

Let's just see

how we can use are a play
by opening up the help command.

So we go - -

help and this opens up
the help command for us.

Now as you guys
can see it shows us

that we can send a D'Orsay.

Gation message by tapping into -

0 and then we need
to type in the count.

So what we are going
to do is type in -

0 which will send
the DL syndication message

and now we can dive 1 or 0.

So 1 will send only
one the authentication message

while 0 will continuously
Loop it and send a bunch

of the authentication messages.

We are going to say zero
because we want to be sure

that we are the authenticating
everybody and we can also

generally specify the person.

We also want to specifically
the authenticate but for

this demonstration,

I'm just Just going to try
and the authenticate everybody

that is there.

So what we are going to do is

we are going to copy down
the MAC address or the bssid

as you would know it

and then we are going to run
the authentication message.

Now as you guys can see
Rd authentication message

is beginning to hunt
on Channel Nine.

Now as you guys know
and as I already know

that our bssid or Mac address
is working on Channel 6 now,

we can easily change the channel
that are interface.

Working on by just going
IW config WL 1 and then Channel

and then specifying the channel

as you guys can see our chosen
router is working on Channel 6.

So that's exactly
what we're going to do.

Now as you guys can see it
immediately starts sending

the authentication codes
to the specified router

and this will actually
make any device

that is connected
to that router almost unusable.

You might see that you are
still connected to the Wi-Fi,

but try browsing the internet

with them you will never be able
to actually Each any site

as I'm constantly

the authenticating
your service you will need

that for a handshake
all the time.

And even if it completes you are
suddenly the authenticated again

because I'm running
this thing on a loop.

Now, you can let this command
run for a few moments

or how much of a time you want
to DDOS at guy for well,

this is not exactly a DDOS

because you're doing it
from one single machine,

but you can also optimize
this code to actually looks

like it's running
from several different machine.

So let me just show you
how to do that.

We are going to write a script
file to actually optimize.

Is our code lat
so this script file

will actually automate
most of the things

that we just did
and also optimize a little

by changing our Mac address
every single time.

So we become hard
to actually point out.

So the first thing
that we want to do is

we want to put our wireless
network card down and maybe

that's not the first thing
that I want to do.

Just give me a moment
to think about this.

I haven't actually thought
this true I'm doing

this on the Fly.

Okay.

So the first thing

that we're going to do
is we're going to start

a while loop that Is going
to continuously run

until we actually
externally stop it.

So we go while true
and then we're going to say do

and the first thing
that we want to do

is send out the authentication
message and we are going

to send a it around 10
the authentication messages

and we want to run it
on a specific bssid.

So that is the bssid
that had copied.

So let me just put in that

and then we just put
in the interface

is it supposed to work on now?

What we want to do
after that is You want

to change the MAC address

after we have sent
all these 10 packets.

So what we will need to do
is put down our wireless network

and as already
discussed we can do

that with ifconfig wlan0 down.

And now what we want to do
is change our Mac address

so we can do

that with the simple tool
that we had installed

and saying Mac changer -

are so let me just open up
a Quick Tab and show you guys

how much Ginger actually works.

Now you can already check

out my other video called
the ethical hacking course,

which actually covers
a lot of topics

and Mac changer is just one
of them and you can check

how to use it in depth
in that video.

But for now, let me just give
you a brief introduction

how much change it works the Mac
changer will basically give you

a new Mac address

every time let me just open
up the help menu for you guys.

So as you guys can see
these are the options

that are available to us.

We can get a random Mac address.

We can also tell to show
our Mac address and we also

have to specify Interface

when we want to show
us the MAC address now,

let me just generate
new Mac address.

So you see our chair
that interface up

or insufficient permissions
is being shown.

So this means we always have
to put down our interface first.

So let me just do that
quickly ifconfig wlan0 down.

And now what we want to do is
give ourselves a new Mac address

and boom roasted.

We already have
a new Mac address

as you guys can see
from the new Mac part.

Now if you put back are
in network interface card,

and then try and show up
Mac address again weeks.

See that our current
MAC and are from red.

Mack are two completely
different Mac addresses

and of current MAC
and the new Mac I identical.

So this is how you
can actually generate

new Mac addresses to spoof
your own identity on the while

and that is very
useful in this case

because the person

you're attacking will be
so confused as to what to do

because your Mac address
is changing every time

and there's no real solution

to the situation
that you're creating for them.

At least.

I don't know of any solution.

If you do know
how to stop this for yourself.

Please leave it.

Down in the comment
section below and help

the world a little bit.

Now.

We wanted also get to know what
our Mac address is every time.

So let me just type my function

through the whole thing
and let me just try

and grab the new Mac address.

So my changer are wl1

and grab Mark and then we
want to put our Rental Car

in the monitor mode

and then we also want to put
up our network interface card.

Now, what we want to do
out here is optimize it

so we can be
attacking constantly.

So let us Put a sleep timer.

So this will make
our program sleep

for a particular amount of time.

I'm going to make
a sleep for 5 seconds.

So after every 5 seconds,

it's gonna send
that particular bssid.

Then the authentication messages

then just going to bring
down my interface card.

It's gonna change
my Mac address.

It's going to put back
the interface card

in the monitor mode
and sleep for 5 seconds.

And then repeat
the entire process

and to end the script.

Let's just say done.

So that will denote
when Loop is done now.

Let me just save it
Ctrl o control X to exit

and there we go.

Okay.

So first of all to actually run

this need to give it
some more permission.

So as you guys can see
we already have it.

Let me just put it
in a much more readable format.

Okay.

So as you guys can see our doors

does sh doesn't really
have execute ability

so we can do
that with command chmod.

So I'm going to give it
some executable permission.

So chmod One plus X
and then the name of the file.

So this will actually
change our dos dos SSH

into a executable bash script.

Okay.

So it seems that we
have done some error.

So let's just go back
into our bash script

and check for the error
that we have probably done.

So now -
does a jet d'eau start sh.

Okay.

So the thing
that I am missing is

that I forgot -

A that I'm supposed to put
before putting the bssid

and the are replay
Angie part of the code.

So let me just go ahead
and quickly do that.

Okay.

So now that that is done.

Let me just save it
and quickly exit and see

if this thing is working.

Ok.

So now we are trying
to work out our script

now you guys should know

that this Erica Wi-Fi
is my company's Wi-Fi

and I have complete permission
to go ahead and do this to them.

Also.

My company's Wi-Fi
is kind of secure.

So every time it senses

that ADI authentication
message is being sent.

I ain't like that.

It kind of changes the channel
that it is working on.

So these guys are
really smart smarter

than me most of the time

and this time I'm just going

to try and force them
to work on Channel 6.

So let me just go
ahead and run my script once.

Okay, so let me just check that.

They're still working
on Channel 6 Yep.

They're still working
on Channel 6.

Let me just check my script
once if it's correctly done

if I have the perfect Mark ID.

Let me just copy in the Mac ID
just to be sure once again,

so they go.

Copied it.

Let's go into the script
and let's face it out.

Okay.

So now that that is done

and we have mac IDs
and everything set up properly.

Let me just show you
how to run the script so you go

Dot and backward slash
and then you said -

does SH now.

I see that our thing
is working on Channel 8.

So this will definitely
not book and say

that the SSID is not so
what we need to do

as I have showed you guys

earlier we can go aw config wl1
and change the channel 2.

Channel 6.

Oops, I channel
to channel it again.

This will not work.

I'm sorry.

That was my bad.

So now that we have changed
it to channel 6,

you can see that it is sending
everything immediately.

Okay.

So that is actually running
our script very well.

And as you guys can see
the security measures

are taken by my company.

It will not always
work on Channel 6.

It will keep rotating now
until it finds the safe channel.

So it really can't find
a safe Channel.

I was always be dosing
on Channel 6 and It will run.

Sometimes it won't run sometimes
but mostly with unsecured Wi-Fi

that is running at your home.

Mostly this will work
a hundred percent times.

So let me just stop this

because my company
will go mad on me

if I just keep on dancing them.

So this brings us to the end
of a demonstration.

This is how you can
always toss your neighbors

if they're annoying you

but remember if you're caught
you could be prosecuted.

So this was about
how the device works

with DDOS actually is
and the different types

and how you can do one
on your own with your own system

by my company.

It will not always work on
Channel 6 will keep rotating now

until it finds the safe channel.

So it really can't find
a safe Channel.

I was always be dosing

on Channel 6 and it will run
sometimes it won't run sometimes

but mostly with unsecured Wi-Fi

that is running at your home.

Mostly this will work
a hundred percent times.

So let me just stop this

because my company
will go mad on me

if I just keep on dancing them.

So this brings us to the end.

To off a demonstration.

This is how you can
always dose your neighbors

if they're annoying you

but remember if you're caught
you could be prosecuted.

So this was about
how the device Works

would beat us actually is

and the different types and
how you can do one on your own

with your own system.

In early days

of Internet building websites
were straightforward.

There was no JavaScript.

No back-end know CSS
and very few images

but as web gained
popularity the need

for more advanced technology

and dynamic websites group this

led to development of common
Gateway interface or CGI

as we call it and
server-side scripting languages

like ASP JavaScript PHP

and many others websites changed
and started storing user input

and site content.

Databases each and
every data field of a website is

like a gate to database
for example in login form.

The user enters the login data

and search failed
the user enters a search text

and in data saving form the user
enters the data to be saved.

All this indicate
data goes to database.

So instead of correct data,

if any malicious code is entered
then there are possibilities

for some serious damage
to happen to the database

and sometimes to the end.

Fire system and this is what
SQL injection is all about.

I'm sure you've heard
of SQL SQL query language

or SQL is a language
which is designed to man,

you plate and manage
data in a database

SQL injection attack is a type
of cybersecurity attack

that targets these databases
using specifically

crafted SQL statements
to trick the systems

into doing unexpected
and undesired things.

So by leveraging

an SQL injection vulnerability
present in web.

Or the website

given the right circumstances
an attacker can use it

to bypass web applications
authentication details as

in if you have login

and password user can

or attacker can enter
just the user ID.

Skip the password entry
and get into the system

or it can sometimes
retrieve the content

of an entire database.

He can also use SQL injection
vulnerability to add modify

and sometime delete records

in a database
affecting data Integrity

while using this vulnerability.

Attacker can do unimaginable
things this exactly shows

how dangerous and SQL
injection can be now.

Let's check out how a typical
SQL injection is carried out.

Well, let's start with
non-technical explanation guys.

Have a simple analogy here.

So first let's go through this.

Once you understand
this you are easily able

to relate this with what
SQL injection attack is.

So anyway first imagine

that you have
a fully automated bus

that functions based

on the instructions given by
human through a standard web.

Well that for might look
something like this.

For example the for might say
drive through the route

and where should the bus stop

if when should the bus
stop this route and

where should the bus stop
and this condition?

That's when should the bus stop
or the user inputs.

This is where you will have
to enter the input

into the form now after putting
some data into the field.

It looks something
like this drive through Route

77 and stop at the bus stop

if there are people
at the bus stop.

Well, that looks
simple enough, right?

So basically you're the human

or the person is trying
to give 3 instruction

that is per should
stop at Route 77.

It should stop at the bus stop

if there are people
at the bus stop.

Well, that sounds harmless
now imagine a scenario

where someone manages
to send these instructions

which looks something

like this drive through Route 77
and do not stop at the bus stop

and ignore rest of the firm

if there are people
at the bus stop.

And now since the bus
is fully automated.

It does exactly as instructed.

It drives up Route
77 and does not stop

at any bus stop even
when there are people waited

because the instruction says
do not stop at the bus stop

and ignore the rest of the form.

So this part which is

if there are people
at the bus stop is ignored

we were able to do this

because the query structure

and the supplied data
are not separated properly

so that Automated bus
does not differentiate

between the instructions

and the data it simply does
anything that it is fed

with are asked to do well
SQL injection attacks are based

on the same concept attackers

are able to inject
malicious instructions

into good ones all of which
are then sent to database server

through web application

and now the technical
explanation and SQL injection

needs to conditions to exist

which is a relational database
that uses SQL and a user.

And put which is directly
used in an SQL query.

Let's say we have
an SQL statement

a simple SQL statement.

This statement says
select from table users

where username is so-and-so
and password is so

and so basically you
can think of it as a code

for a login form.

It's asking for the username

and the password
this SQL statement

is passed to a function

that sends the entire string
to Connected database

where it will be passed executed
and returns a result at the end

if you have noticed First
the statement contains

some special characters, right?

We have asked her
to return all the columns

for selected database row

and then there is equals
to only riddance values

that match the search string

and then we have
single quote here

and here to tell
the SQL database

where the search string
starts or ends.

So for user you

have starting here and in
here and for password here,

so basically a pair now
consider the following example

in which a website user is able
to change the Use of this user

and password such as
n log in form.

So if the values are put
into user and password,

it looks something
like this select

from users table.

The user name is Dean
and password as Winchester's

and the SQL statement
is simple enough.

It's very direct.

So if there is a user called
Dean with password Winchester's

then all the columns

of table users are
extracted now suppose

if the input is not properly
sanitized by the web application

the attacker Can easily insert
some malicious SQL statement

like this the username
might be Dean

or 1 is equal to 1

and then you have double hyphen
followed by password is equal

to Winchester's so basically
along with the data the user

or the attacker
has tried to enter

a malicious SQL statement
disguising it as a data here.

So guys, you need
to notice two things here.

First one we have or 1 is equal
to 1 it's a condition

that will always
be true therefore.

It is accepted as
a valid input by application.

For example, if Dean
is not a valid user or

if there is no user called Dean

in the database application
would consider the next value

because there is or in

between our next value
is 1 is equal to 1

which always returns true.

So basically our input will be
something like this Dean or true

and if there is no user called
Dean the next input will be true

and it will be taken
as an input value

and values will be displayed.

So the next part
which has double -

I'm sure you know
what double -

represents Droid.

Basically, it's commenting
the next part of the SQL query.

So it instruct the SQL passer

that the rest
of the line is a comment

and should not be executed.

So the part that's
password part will be ignored.

So basically what we're trying
to do is we're trying

to bypass the password
authentication here.

So once the query executes
the SQL injection effectively

removes the password
verification resulting

in an authentication bypass
by using double life,

and we're commenting
rest of the comment.

And before that using
one is equal to one

which is translated to true.

We are trying to enter
the database without even

giving an invalid value.

So the application will most
likely log the attacker in

with the first account
from the query result.

And as you guys know most
of the time the first account

in a database is

that if an administrative user
so basically by doing nothing

or basically by giving
some random data here

the attacker was able
to extract the admin details,

it sounds very dangerous, right?

So that's all an SQL
injection attack is all about