Hi and welcome back to another episode on How to Hack.
So over here I have open Web application security project running.
So this is, again, a vulnerable Web application server that we will be doing a penetration testing
on.
And what we are going to do today is really to understand all of the process and the logical steps that
take place, doing a normal registration, doing a normal check to understand the entire customer journey.
So when you are entering a website for the first time, you do not go ahead and start unloading all
of your payloads and pushing all your payloads and using all those different security scripts that you
have created and start injecting them onto a site that is not the first thing to do.
The first thing you do is to map out the entire site.
And how do you go about mapping out the entire site?
How you do that is by going to what a normal user would do using a customer journey, perspective,
understanding where are the places, the pages, the technology to check out process, the user registration
process?
What are the scripts?
Are you trying to gather as much information as you can and understand and comprehend how the entire
website was built?
So what do I mean by that specifically?
So, for example, if I go onto the top right corner and I click on a cow and I click a log in over
here, I can say click on not yet a customer so I can zoom in a little so it's easier for you to see
so I can register a email, for example.
I can just enter a an email address and I can enter the password so I can go ahead and create the user.
So what we're trying to do here is to understand the whole process for a normal user, a normal registration,
a normal log in a normal checkout.
And we can look, of course, and try to identify where are the areas where there could be some missing
steps.
There could be some places where they could have written to could poorly or incorrectly.
OK, so let's choose the security question.
And of course, we can enter the answer and we can click on register.
So of course, this registration completed successfully.
You can now log in.
So let's go ahead and log in to the site.
So again, we are logging into the site and we are just trying to have a look and feel of how the whole
navigation process work.
And I can click onto Add to Basket.
So on the previous on a previous tutorial, we actually went into the web developer and we look at all
the application programming interfaces that was being called.
So over here we can just continue clicking at the basket and so on while we try to understand how it
works so we can click onto your basket and we can see that we have two items so we can go in and click
on checkout and we can add new address, for example, so I can enter, say, Singapore.
I'm from Singapore and can enter my name mobile number.
So I'm just going to give something, you know, whatever.
So we're just trying to fill out the information since this is a task environment, but of course,
an actual penetration testing.
You want to fill in details as though you are a real client, as though you're real customer coming
to the site, doing a checkout, trying to understand the whole process for the site.
So City, again, I want to to Singapore, Singapore again and click on Submit.
OK, so once we have added all this information in OK, I can click on to continue.
OK, so we are seeing all this information being placed into the database, but of course we do not
know what kind of database you're using.
Could be on Microsoft SQL, could they be on Mongo DB, could they be on Pastorale sequel.
We're thinking, we're analyzing, we're trying to go through that process to know what kind of database
Dick could be using.
OK, so we can identify based on certain behaviors coming from the Web page.
All right.
So let's say, for example, stand a delivery click and continue.
And of course, we have a wallet balance.
We have a coupon.
We have at payment options.
We can click on credit card, for example.
We can click on all these different details.
And again, we are seeing all these different data.
So let's go ahead and see, for example, add on some credit card details.
So, again, I want to add to sixteen digits.
All right.
A spot of credit card.
All right.
So we got sixteen digits so we can just select expiration date month and all those different details.
Click on Submit.
So we got a cut that is ending the five, six, seven, eight has been saved.
All right.
So we can see all those details.
All right.
So we got all this data, all this information so we can review this order before it is being finalized.
Check on that.
And the moment you click on this, we realize that the continue button is not enabled.
So let's go ahead and click and continue so we can see the delivery address.
We can see the payment method and we.
You see all this data, so let's go ahead and click, place your order and pay.
All right.
Says thank you for your purchase.
You can do a status update on track orders, your order be delivered.
So we see all these details, all this data, and we can see there is a button over here.
So this is for Twitter Tweeter sharing.
And we have another button on between all their confirmation so we can actually click on that.
And this creates a other form.
So sometimes these order forms are being hosted inside the Web application server.
So there is a Web application server could create files and it could create in a particular folder.
And in this case, for example, if I go under the URL.
All right.
So we can see from the Eurail so I can actually go on a magnifier so it's easier for you to see.
So let me turn on magnifier for you.
And we can see over here we have the IP address, OK?
And we have point number and we have to you URL.
So we got FTP.
So let's go ahead and go into this particular URL.
Let's see.
We can find anything.
All right.
So we backspace on it and hit enter and we realize we're in, we're inside a folder that is being used
to store information and we can see this order over here.
If we click on that, this was the order that we had.
OK, this was the order that we had.
And if I go back onto the Web page and I actually log out from this page, OK, if I go to log in and
I can do a sequel injection that we have done before in one of the tutorials because I use a semicolon
or one equal one.
All right.
So we use a single quote or one equal one for a semicolon and just enter anything for the password.
Click log in.
So now I'm logging in with the administrator account and likewise we were at FTP.
Right.
So let's go ahead and go back to FTP and are we still able to access it?
And the answer is yes.
The answer is yes.
We can see someone else's order in site to site.
All right.
So without even beginning our discovery of the directories inside a site to map out the site, we already
quickly identify one of the misconfiguration on the Web application server, and which is that they
allow users to actually explore the directories inside the server.
OK, so this is definitely a misconfiguration.
All right.
So anyone with access to this site will be able to access into this particular folder and FTP.
So this, again, is going to be just one of the tutorials that we'll be going to expand further as
part of a Web application penetration testing series.
So, once again, I hope you've learned something valuable.
And if you like what you've just watch, remember to like, share and subscribe to channel so that you
can be kept abreast of the latest cybersecurity.
Tara, thank you so much once again for watching.