Whatever one, this is a niche and this is the new section entirely, you know, interesting section
where it will be going with the application hacking so far.
We have learned about the other end points related hacking as well.
Very.
And we have talked about the windows, windows hacking.
In fact, here we'll be talking about Web application hacking.
So before we go into it, let's go through some introduction and let's look at some of the numbers,
statistics, the motivation and other stuff as well related to hackers than mine and everything.
All right.
So the first thing that is very, very important to understand is why.
First of all, why we need to secure it.
Because being a hacker, being an ethical hacker, our job is to have been warned.
But there has to be a reason to have security solutions to it.
Right.
So I understand why people are looking for Web applications, security.
And of course, if people are looking for application security, then only they would hire an ethical
hacker to penetrate, to hack and secure them after that.
Right.
So why the security is really that important?
Because the company itself because in the past, around 10, 15 years, if you have noticed a lot of
news, this is all organizations have been in the news for not so good reason.
There has been multiple data breaches.
And many of the organizations that you see, these are the large embassies were and they have faced
a lot of they have faced breaches.
And then following to that, they have faced the penalties as well.
And, of course, the biggest lulus of customer trust, loss of business, the loss of trust from their
vendors, third party, everything.
And that's why they keep improving their security afterwards.
Now, that's the idea, right?
There has been multiple attacks.
Breaches happened in the past as well.
Now, there are there are some stats which talk about what attempt has been taken so far and how how
secure the moment really looks like.
But it doesn't read that key so far.
If you look at these stats related to 98 percent of the WordPress, vulnerabilities are due to the plugins.
WordPress is, of course, very much popular.
Right.
So it said that 90 percent of the plugins are Wallabadah to the plug ins are basically has the vulnerabilities.
In fact, the WordPress platform itself is not that weak, but the challenges comes.
And when we start added up, we start adding multiple plug ins to it, which are not really that authorizer,
which are not really that tested.
And that becomes a challenge for us, but even for anybody who holds their application or sensitive
information on it.
Right.
So if you look at the other sites, in fact, FBO reported three or 300 percent increase in the number
of cybercrime cases during the covid-19.
Of course.
Of course, that accurate.
And that's new.
Right.
So in the do in fact, during the situation itself, there has been multiple attempts based on the covid-19
subject line, the phishing campaign that has been attempted and many other stuff as well.
On an average, 30000 new websites are getting hacked every day.
In fact, this news is also very much recent based on defaults.
And this is also one of the stats and of course, many others as well.
Right.
So this gives you an idea that no matter how much security we keep deploying, hackers are always after
the organization where the and where the juicy stuff really resides, where they can actually find some
information or they can actually compromise those target.
And they know that they can get a really good, good, good returns in terms of ransom or in terms of
any other values.
Right.
It's or maybe it could be any other, you know, the average when we even talk about some other security
or some other challenges.
Well, you know, about user I.D., how, how, how if you look at from the hacker point of view, if
they thought about hacking any of the user information or any of this site and retrieving somebody else's
information or impersonation or any sort of stuff, let's get an idea how secure it is.
In fact.
So.
This is basically a chat about what are the different best practices or I don't say best practice,
but I'll tell you what are the buzzwords being used by any of the normal home user or, in fact, anybody?
Right.
So if you look at the passwords, the the one two three four five six, this is the password which is
being used by more than 2.5.
That's the number that is the number of users who used it so far.
And just guess how much time would it take to crack this password?
Absolutely.
Less than a second.
I'll tell you how exactly it's going to work.
When we lost a brute force attack dictionary attack in the later section and then later lecturer's,
well, you get to see you can quickly crack a password, which is of one, two, one, two, three,
four, five, six, three.
Number of times it's got exposed.
That's the number.
And if you look at these, what these are the these are the password, which is being majorly used.
And of course, you can check it out the stats as well, which has been only online available to picture
one password.
This is highly being used.
This takes only less than seconds.
And of course, this is the, again, widely used password do.
Right.
So that makes their job even more easier and far before they can think of compromising the target.
The thing of why not to compromise the user itself or maybe the admin credential of the big game if
they were very much lucky, they didn't even get the access to the admin account.
If the admin has such passwords, such rete password, in fact.
All right.
So let's understand a couple of more stuff.
Why hackers are after your Web application or Web sites.
What's their what's their thought?
What what are they actually looking for?
The first thing that the images are of very interesting stuff.
But this makes sense when based on their motivation.
Right.
So the first thing that they have motivation is about sensitive information.
They are looking for sensitive information that this information could be of credit cards, account
credentialled personal information or anything.
But what they actually going to do after this, once they get the credit card information, they can
buy any, any, any stuff of using your credit card and all this stuff.
This is now very much regular and this is keep happening every other day.
Right.
Although there are some security measures that other countries make use of it, like Two-Factor and
many others, some countries still don't make use of it or some organization because they think that
they if the customer lose the flexibility, they may lose the customer as well.
Right.
So still, the second is the intellectual property.
The hackers are also offer the organization intellectual property.
Why are they looking for it?
It means only the state sponsored actors for maybe political reason or maybe any other reasons as well.
But it could be even a competitor as well who is looking for certain information.
Some, you know, organizations secret document as well or customer databases.
But it could happen, right?
Malware delivery medium for this purpose.
The hacker, the hack motivation of hackers to make use of your website just as a medium so that this
site can be used for sending and receiving or receiving all the command and control signals.
And so even if the anybody did take the, you know, the website, they will not be they will not be
able to track who is the hacker.
Right.
So they can use your website as a medium as an attack vector.
And that case, they don't really they look for a small and medium sized website, not really, you
know, large organization who has a lot of services on it becomes difficult to compromise their site
as well.
And this is important for sending some ransom command and control center, crypto mining and all the
stuff, lots of code just for fun to simply just for fun or in any way when somebody just learned hacking
and they just want to see how the world really looks like.
And that's why I even I insist all of my students want to draw their own lab before going into the real
world and never try hacking or trying to find any vulnerabilities of any of the site because it's completely
illegal to scan or to do any kind of testing or perform any kind of hacking for.
Out their permission.
All right, so people do that, of course, and the thing that nobody can trace it, and that's that's
what the point is.
So I hope this was information I will catch in the next lecture where it will start with some basics
of SCDP and the start moves gradually moving into Web application.
Hacking is well done.
Then keep learning and we'll get you in the next one.
Thank you.