So finally, we're going to get into the actual hacking part.
I know you're impatient.
No, I'm just kidding.
I know you're eager and that's a good thing.
So you've got the idea of web and Web applications and the interconnectivity and all that, the specifications
and how all the standards work and what they actually mean to us.
So now it's time to start practicing real hacking in the lab now, following a methodology like the
old WASP testing guide is really useful.
And for the most part in these guides, you will see testing procedures that are divided into different
stages, such as reconnaissance, exploitation and reporting.
So here when I was creating course, I pretty much did the same and divided the Web penetration testing
procedures into seven different stages.
And these are mostly acceptable in a field.
You can start from wherever you want to.
I don't want to force you, but to me, I really do advise you to follow along sequentially every part
and then perform all of the different steps.
Because you have to remember, your aim is to identify as many bugs as you can as a penetration test
your.
So that way you can cover every aspect of the application, no stone unturned, so to speak.
So let's get started with information gathering.
Reconnaissance and discovery.
So information gathering or or reconnaissance or discovery, it all means the same thing to us.
It's to me the crucial stage of pen testing.
So allow me to identify this face like this.
It's a phase in which we will extract information regarding the target that we're attempting to hack.
And then this information can be anything directly or indirectly about the target application or the
customer.
Remember the video about attack surfaces when doing a weapon test?
We need to explore all the possibilities of breaking into the Web application.
That's why we need to know about the application database server as well as the users, so the more
information we gather about the target, the more options we will have while we're testing.
Now, to be more specific, this phase includes.
Identifying the IP addresses, subdomains and related information, accumulating information about the
target Web site from publicly available resources such as Google being, yeah, archive dog and shodan.
Identifying people related to the target with the help of social networking sites such as Facebook or
Twitter, spidering the Web application and creating site maps to understand the flow of the application.
You really should consider any information gathered at this stage important.
Because even a small bit of information that looks like it could be nothing may help you exploit in
the later stages of the test, the success of the penetration test depends on the quality of the information
gathered in this stage.
Cool.