Original subtitles

1

Hello and welcome to the course.

2

Now, the best way that we can start this is by explaining what even is penetration testing.

3

Most of you will know this, but let's still cover it as a refresher, at least.

4

So whether we're talking about network penetration testing or website penetration testing or something

5

as simple as a single device penetration testing, all of this has the same part inside of their name

6

penetration testing.

7

So what is it?

8

Well, we can refer to it as an action that we apply to enumerate and discover new vulnerabilities,

9

as well as exploit them and take control of our target system.

10

Now, most of you might or might not know, but penetration testing is constructed of couple of stages.

11

Let's say we have our hacking machine on the left and the target device that we are trying to gain access

12

to is on the right.

13

This device can be anything from a PC to a mobile phone to a website application.

14

It doesn't really matter.

15

The process of penetration testing goes the same way we start off with gathering information.

16

We want to know as much about our target as possible.

17

Why, what this allows us to better plan out our attack later on, gathering information can be done

18

both actively and passively.

19

Active information gathering is gathering information by interacting with the target, while passive

20

information gathering means that we get all of our information without ever interacting with the target

21

in any way.

22

For example, we can get information about Facebook by Googling it and reading about it on another site,

23

like Wikipedia that is considered passive information gathering.

24

After this comes scanning, now, scanning is a deeper form of information gathering, and it's done

25

actively, which means we directly interact with the target in order to find out more information about

26

it.

27

Usually this will be the information of technical nature, like what technologies does the target run,

28

what is their website made of if they have one, which post they have open and so on and so on?

29

We finished scanning by performing vulnerability analysis winnability.

30

Now, this is just us finding security holes in the target system with the help of information that

31

we gathered.

32

After that, we can successfully exploit the target by using different methods and attacks.

33

These are the main steps to penetration testing.

34

There are other steps, of course, that come after, like maintaining access on the target machine

35

and covering tracks.

36

But these steps that we mentioned are crucial now that we covered and went through the basic steps of

37

penetration testing and what those steps are.

38

We can also say that penetration testing can be divided into two main groups.

39

We got network penetration testing, which could, for example, be let's say a company gives you their

40

IP ranges of their networks and we're supposed to perform a penetration test on all of their devices

41

to see if there are any security issues.

42

Those devices could be anything from computers, mobile phones to printers, and for the second group,

43

we can say that its website application penetration testing.

44

Here we perform various different tacks to determine whether the website that we are attacking is properly

45

coded and secured, and website penetration testing is something that will put the most focus on inside

46

of this course.

47

This is because this field is becoming bigger and bigger every single day due to millions and millions

48

of websites that are online and available right now on the Internet, the search for people to secure

49

and protect them is rising every day.

50

You might have also heard of a term called bug bounty.

51

This is pretty much the same thing.

52

It's mostly referring to discovering bugs or also known as vulnerabilities inside the Web page and backboned

53

is something that we'll discuss a little bit more in the next video.

54

But before we get to it, let's mention what are the two main things we need to perform, bug bounty

55

or website penetration testing.

56

So we will need a virtual machine and a wonderful Web page.

57

Now we will install a virtual machine to create our own hacking lab or environment that we will use

58

to perform all of our attacks.

59

But as you may notice, to be able to perform a penetration test on the website, we will need a website.

60

Right.

61

Luckily, there are many vulnerable Web pages that we can run within our local network on the virtual

62

machine that are useful for practicing different attacks and discovering different bugs.

63

And that is also why we need to cover virtual machines now, don't worry, we will cover installing

64

all of these from installing our own machine that we will use to hack to installing machines with a

65

vulnerable webpage.

66

And trust me, it's not that hard as it might sound like.

67

Nonetheless, now that we mention some basics of penetration testing, let's discuss bug bounty in the

68

next video, SIDOR.