Welcome back, everyone.
This session is about understanding the application vulnerabilities gap.
OK, when I say scanning, it's about performing the performing, the penetration testing or even the
ethical hacking as well.
So before this is no one particular related to the hacking.
But this is what has been followed by security testing professionals, practitioners as well.
So whomever it's a part of cyber security in a way, but it is important to understand how the other
side of the house really looks like.
You know, you need to understand what kind of practices are being used by the cyber security professional
to protect their protect their Web application, because from the ethical hacking point of view, we
don't have any framework.
We we are not really tied with any specific rules or framework or structure.
We can keep making use of any possible methods.
But on the other side, the cyber security professional follows certain guidelines, certain frameworks,
certain strategies.
And that's what we are actually going to talk about.
So if you look at the Web application already scanning or probably you can say testing as well, we'll
be talking about some of the practices.
So on that initiative is the is a non-profit organization, which is nothing but open Web application
security projects where the job of this organization or institution is to find the vulnerabilities in
a Web application that's mostly known vulnerabilities and submitted as top 10 vulnerabilities.
So for what usually we would find a you know, as a part of as a part of activity, this the stop invulnerability
and all these security testing professionals or cybersecurity professionals make use of this for the
vulnerability assessment and penetration testing point of view.
This is immediately used as a part of the best practices, because if you are if you are done with this,
this, then then security patches, fixes and everything, you are good but good.
But mostly 90, 95 percent purchase online.
OK, so that's what I believe in.
And as I told you, it's a nonprofit organization.
Every every every every time they come up with some sort of a list of 10 vulnerabilities.
And on the right hand side, you couldn't get to see that top 10 vulnerability of 2013 and 2017 is.
But based on the trend, based on the track trend as well, the kind of attack that happened in the
past and kind of attacks has happening now.
The the the ranking changes as well.
If you see the ranking has been changed from 84 to 85, which has been much.
So if you find a one this is injection in 2013.
The first one of the latest was about indication that the broken authentication then A3 was crossette
scripting and if all was insecure, object references and S7 was the missing functional level access
control, which has been much to be broken access control right now.
Now that you would find as a part of 2017 as a top down top three, you are probably going to rank three.
You will find sensitivity to exposure, whereas you will find crosseyed scripting has been moved to
rank seven.
Right?
So this is what happened and this gives you the priority about which one to fix.
First, when you when you are ready with your applications now you have to start securing it, OK,
or maybe if you are a third party security testing organization and company, outsource it to your organization.
And guess in that case, also, if you start your activity and you know, the customers are the client
says, OK, see, we have to go live another seven days and we just want to make sure we are good from
good from our security point of view.
Right.
So in that case, what you could what you could really start with is you can start with the injection
you need to find if the application if this specific target application.
Has got any injection vulnerability or not, this has got any broken authentication one.
No, it is not.
And then it can start with the rest of the perimeter.
Right.
So this is how it really helps.
And then as a follow of testing practices, this is what we'll be talking about, a decision because
of why being an ethical hacker, we should really follow this.
That's the first question, because if you follow this trend, you understand this is what I have to
start first, and this is where we'll have to make use of all this vulnerability that there will be
five one five vulnerabilities that will be focusing more, because this is where most of the organization
fails, taking care of their weaknesses, their application weaknesses.
So from the ethical hacking point of view will be they'll be forced five of the staff, five vulnerabilities.
Then there will be, you know, a different technique as a part of penetration testing.
Where will it be going random and will be making use of some advance hacking techniques as well.
So this is something which will keep making use of it throughout the session, first as information
gathering and thus Fosdick testing practices on this.
And this is mainly for from the security testing point of view.
OK, but this is also important from the data hacking as well, because once once you start when you
start hacking any application, you have to first see if the application is hackable through the through
the known vulnerabilities or through the OS on top.
Then when everything goes not and if they clear if the application can clear all those tests, then
you can go to the rest of the stuff.
I'm not saying this is this is what you are supposed to follow, but I'm saying this is what you could
actually start with, because this is where this actually saves a whole lot of time.
All right.
Information gathering.
You could probably start seeing if you if you can gather the domain name, IP address, email address,
use information just by getting the website that domain or IP address and all those information, either
by passive scan or after Skype.
All right.
So invasive scan, we don't really hit it.
We don't send any probes to the target machine.
We don't really even let the application know that we are trying to get some information about it.
In the the active scan.
We might send some proofs.
OK, then it comes the input output from manipulation.
And this case we try to understand, is there any standardization happened from the application or not?
And I say sanitisation.
It's all about it's all about is there any additional precaution has been taken care by the application
or not that could lead to a severe one of these like Eskil injection crosseyed scripting as well, even
in the cross site scripting that could be reflected, that could be stored, could be, Dombey says,
but then the authentication related challenges and this would be very, very, very different approach
because in this situation the attacker might get set right.
Or the attacker might have to spend like your years as well just to get the right password.
But from now on, that application has been pretty much advanced where they have started making use
of no maximum number of items that you can make on any target website.
They started making use of multifactor authentication, Two-Factor authentication, where you get an
OTB or probably you get an authenticated dot b all this stuff.
Right.
Biometric options are also available on the stuff.
So that's where we can make use of brute force attack before the attack as well.
So from the security testing point of view, the security testing folks will keep checking if the system
is infected from system, can be compromised by any brute force attacks, ESKIL injection and all stuff.
In fact, that's what the hacker would be doing as well in this point.
Right.
And if you go on the authorization, this is where the security testing folks will be testing.
If a normal user can get that privilege, escalation to an admin, use it or not.
So that's where it will be testing about Bodrov as a privileged escalation of this stuff.
Right.
And in fact, ethical hacker would be doing the same thing.
He would also be testing if he can penetrate in the network and.
He had he if he's a normal user, can he get the legislation to the next level?
And then this session management system management session management is all about where you can hijack
this issue.
OK, but the decision is being happening, maybe Skippy's and whatever it is.
Right.
So this is all about security practices, which is being used and which is being used by security testing
professionals and being delivered and presented by Auvers.
OK, so from the ethical hacking point of view, will be will be going to these five steps in much more
detail.
And this will make us pretty much confident as a part of security testing, professional and rest.
What ever you would be doing would be considered as the advanced hacking technique and wearing the security
testing professional, even one we knowing about it.
Right.
And that's where the magic really happens.
So if the hackers keep making use of this five vulnerabilities, right.
This is what the security professionals would also be knowing.
Right.
Because as an as a periodic audit program, they keep testing all these five parameters.
That could be a couple of more hours based on the guideline.
They keep testing it.
Right.
So if you being an ethical hacker, just stick to those five methods, you might end up losing the grip
on your you know, on your capability.
You the think hacker would be the one who's go who goes beyond those well known vulnerabilities.
And that's what will be covering up it as well as we go further.
I hope you got the idea, but he's got you in the next session.
Thank you.