And the session will be talking about detecting vulnerable SBP methods.
Now this from this onwards, we are going very, very practical.
OK, so whatever we are talking about, this is all about finding out the vulnerabilities, warning,
not finding out the real world vulnerabilities that some of them would be, you know, some of them
would be legacy or data, but they are still effective because at the end, you never know, you know,
even if organization or large enterprises still have outdated system.
And you just being a penetration tester, you just need one weak point, you know, and that's the reason
you shouldn't know.
All the all the points that are very, very important will be starting with starting with some basic
vulnerability and finding the technique.
And then we'll go to some advanced technique as well from skill injection, finding out the skill injection
to finding out some juicy funds, or finding out some crosseyed scripting vulnerability as well.
So this is what we're you know, even even by just by finding the exact methods, you can even find
out, you know, cross site tracing is what this is, again, a very crucial attack.
Well, and you finding out this kind of a vulnerability can be very, very effective as well.
So without taking much time, let's jump into it, go to the, you know, and map.
And what we are trying to understand is if we have a target as as Web application and if we get to know
what all methods are supported by the server, it becomes an easy job for us to talk about.
And we all know there are multiple methods used by the EDP.
And once your three way handshake we talked about earlier.
Right, the three way handshake on the DCP and once that has been accomplished, then the EDP handshake
has to messages.
I would say it basically starts.
So the client first send the message and this message is basically sent to a specific you are to get
the information about it.
So when you when you look at any message, you know, and that says, uh, that says, you know, get
on the tip method, that basically trying to get all the content on that specific what I so maybe it's
CNN dot com slash breaking news.
So that's the you what I you type on your browser and that's basically the message sent from your browser.
There are some post message which is used to upload and you know many more as well, like delete, but
please connect.
Now what we are trying to accomplish is we are trying to understand what are the different methods supported
on a typing machine.
And if we there are some vulnerable, there are some, you know, risky methods as well, which are
not supposed to be open on the public facing server.
If we get those, it would be easy for us to, you know, compromise that application server.
Now, let's started this way.
If you just get the get Borst and options method, it would be easy enough.
That's just the normal application.
That's where it would be difficult to compromise our probably to hack the entire website.
But if you get, you know, methods like dress, connect, put, delete, these are something which
are more risky methods which out of the even interest is something which can be used for crowd cross
sites tracing as well, which can be very, very helpful and makes the penetration job pretty much easier.
Now, let's make good use of it, because first try to find if if we have, what are the methods available?
So let's.
Do it and map minus B and let's scan for both Ed and 443 for SCDP initiatives and then let's make use
of a script that might hyphen hyphen script.
And the script name is as Deep Methods and our target machine.
It's that easy, right?
So the board.
What board?
We are trying to talk about it for four to three.
The script name is SDP Methods.
The purpose is to get the all you know, all the board supported by the DOGOOD machine you press enter.
It's pretty quick.
You get to know the and methods are this get had post options.
That's pretty specific right now.
The study methods on a target machine.
This will help you to understand what methods are available so that you can plan your penetration test
accordingly.
If you get some more vulnerable methods, that makes your job pretty easy and quick as well.
I hope you like the video.
We'll get you in the next one.