Generally, a web penetration test is conducted as a black box test, that means that you're only going
to have an IP range or your URL and then you will display the application in your browser.
And then start the test, so that point, you don't have the code and any of the other resources of
the application, so it's not even possible to view and analyze the code in a situation like that.
And let's say even if it is possible a person won't be able to have a comprehensive information on the
applications code because Web developers can build an application over several different languages,
frameworks and databases for technologies.
So it is rare to have knowledge about all the technologies that the application is built on.
OK.
So that's why I said before, while conducting a web penetration test, we will need to understand the
basic web technologies, but we don't need to be masters in them.
But it is why in the next few minutes, we are going to cover some of these technologies.
Web browsers, the web browser or simply browser is software, right.
Takes you anywhere on the Internet.
It's great.
It's better than a limo.
I love it because, of course, you're watching this course right now in a browser.
Now, they request Web pages over HTTP and display them into a human readable content, will call it.
So despite the fact that they're used every day, a lot of people don't really care to understand how
they work.
I mean, it's kind of like driving a car for the most part.
Everybody gets in a car and turns a key and vroom, off they go.
No, what he thinks about the engine or what's happening in it or any of the other systems because they
don't have to.
It makes sense for regular users.
However, what if you're a mechanic?
All right.
So it's pretty much the same for us as a web penetration tester.
We need to know more about browsers because they are the first point that we touch in a Web application.
In fact, I believe they're like a battlefield.
I mean, stick with me here.
We've got privacy, interface security, all kinds of other options that are very important while using
a browser.
But in this video, I'm just going to show you how they work and how to use them in a penetration test.
Right.
So, anyway, Web browsers, they come in many different flavors and they're designed to run on different
operating systems.
Now, you've probably heard of the most popular Web browsers.
We've got Google Chrome, Mozilla, Firefox, Microsoft Edge or Explorer Opera.
And then in addition to these big players, some many others exist.
Max Thorn and Vivaldi, brave torch epic.
And they all have different features with their pros and cons, so for me, I've been using Firefox
from the very first day that I started pen testing, but and I'm still using it today.
I like working with Firefox.
It has a simple interface that you can control almost anything from.
And also, it has many useful add ons, and I'm going to use them while I conduct a penetration test.
Now, when you install an ad on generally, you will get an icon on the toolbar like I have here, or
you can go to an ad on this list.
And in this window, you can manage your add ons.
But for you, you can choose any of the known browsers that you want to for this course, you probably
already have.
But now let's come to the main question, how does a Web browser actually work?
All right, so I'm going to tell you briefly.
Basically, a browser uses a protocol such as HTP to retrieve data from a network.
The browser can point this data from the URL, which is the address of a specific page or any other
asset.
And to be viewed by a Web browser, this data should be presented in HTML success and JavaScript.
Now, right, click on the page.
Click view page source.
And here is the source of the page.
Of course, this is not the actual code of the developer.
We'll get to that topic a little later, but for now, pretty much you can think of what you're looking
at on the screen as a translation of the code of the developer.
So let's have a look at it.
It consists of HTML, she says JavaScript.
Now, another super feature is web developer tools.
Now, all pretty much all known browsers have this feature, I don't want to go out on a limb and say
every single one.
It's mostly developer oriented, as the name would suggest.
So we're going to use this as well, especially when we're viewing the HTTP messages and dealing with
document object models.
So I don't want to make an advertisement for Firefox, but my point is that all browsers have a long
story.
I won't tell you or go into the browser history or you, yeah, what's also called the browser wars,
you can figure that out for yourself.
You probably already have a favorite browser.
But obviously these days, the browser market is still developing and I think it will continue to develop,
at least for my lifetime anyway.
Point to that story is features are constantly being added.
So, of course, you can visit the website called The Evolution of the Web.
So you can view these improvements.
Unfortunately, it's not updated as frequently as perhaps you might want, but at least it'll give you
a pretty good idea as to how these improvements all came to be.
It also shows the evolution of the Web browsers, but also I just wanted to have a look at the page.
At the moment, so if so, you do want to have a look at browser's more carefully, the general design
of the browser is explained in these documents and it's very good.
Well, it's long, but it's a pretty well explained document, so let's scroll down.
And I want to talk about this image a little bit more.
So let's analyze this figure a little bit.
User interface, this includes the address bar, the back forward button bookmark menu, all this and
every part of the browser display except the window where you see the requested page.
The browser engine marshals' actions between the UI and the rendering engine.
The rendering engine is responsible for displaying the requested content, for example, if the requested
content is HTML, the rendering engine parses e-mail access and it'll display the parsed content on
the screen.
And different browsers use different rendering engines, for example, Firefox uses Geko now for networking,
for network calls such as HTTP requests using different implementations for different platforms behind
a platform independent interface JavaScript interpretor that's used to parse and execute JavaScript
code.
And guess what?
Each browser has its own JavaScript interpreter.
For example, Firefox uses Spider Monkey.
What about the UI back end used for drawing basic widgets like combo boxes and windows?
Data storage, this is a persistent layer, so the browser may need to save all sorts of data locally.
For instance, cookies and browsers also support storage mechanisms such as local storage index, DB,
Web ESKIL and filesystem.
We're going to get into some of the local storage attacks later in some of the other sections.
OK, so it's important to choose the right browser for you while we test due to the different rendering
engines, each browser can sometimes treat HTML success and just codes in different ways.
So that's why it's important to figure that out is can affect obviously accomplishing some of the web
attacks.
So this point, I want to emphasize that it's always good to know which Web browser is, well, the
most widely used in whatever the target users environment is.
I remember several times and some of my customers use a much older browser versions due to some compatibility
reasons.
So that means that if I test this application with a newer Web browser, I might get different results.
Right.
And I won't be able to accomplish some of the attacks that I wanted to purvey.