1 00:00:00,150 --> 00:00:05,670 What's going on, you guys ever need to here with Section 10 of my beginning to explore ethical hacking 2 00:00:05,670 --> 00:00:06,150 course? 3 00:00:06,180 --> 00:00:06,480 All right. 4 00:00:06,660 --> 00:00:11,130 So in Section ten, we're going to be going over website and web application hacking. 5 00:00:11,130 --> 00:00:18,330 So we went over how to infiltrate networks, how to hack into computers, but now how do we hack into 6 00:00:18,330 --> 00:00:19,560 websites and web apps? 7 00:00:19,860 --> 00:00:26,430 This is going to be a skill that you definitely need if you want to become a very reputable and respectable 8 00:00:26,430 --> 00:00:27,800 professional ethical hacker. 9 00:00:27,810 --> 00:00:28,070 Right. 10 00:00:28,290 --> 00:00:33,810 As usual, just as a quick introduction, like I said in this section, we're going to be going over 11 00:00:34,800 --> 00:00:40,400 exactly how you can hack into websites and web applications using a variety of tools and tactics. 12 00:00:40,440 --> 00:00:46,320 So more specifically, we're going to talk about the other VSP top 10 webapp vulnerabilities. 13 00:00:46,320 --> 00:00:47,430 Very important to know. 14 00:00:48,060 --> 00:00:53,100 We're going to be talking about Web applications scaling to different tools that we use for those. 15 00:00:53,310 --> 00:00:57,060 Well, let's talk about Esquibel injections, croci scripting. 16 00:00:57,600 --> 00:01:02,580 We're going to talk about directory traversal vulnerabilities, content injection, which kind of goes 17 00:01:02,580 --> 00:01:07,050 across the scripting and a few other Web application vulnerabilities. 18 00:01:07,200 --> 00:01:09,460 And we're going to get some hands on practice with this, OK. 19 00:01:09,870 --> 00:01:15,960 So just as a quick disclaimer, anything that you learn from this section is purely for educational 20 00:01:15,960 --> 00:01:19,230 purposes and is meant to be used for ethical hacking only. 21 00:01:19,590 --> 00:01:26,160 I do not advocate or approve of anyone utilizing these techniques to perform malicious actions against 22 00:01:26,160 --> 00:01:30,450 any device or network unless given permission to do so prior. 23 00:01:30,960 --> 00:01:36,810 OK, so now let's talk about the O.W. is the top 10 Web application vulnerabilities. 24 00:01:36,810 --> 00:01:45,210 OK, so these are pretty much every few years or so the WSP, they go through and determine, you know, 25 00:01:45,240 --> 00:01:48,670 what the top vulnerabilities to where applications are. 26 00:01:48,690 --> 00:01:50,130 So this is the typical chart. 27 00:01:50,370 --> 00:01:53,420 So as of like 2015, these are the top 10. 28 00:01:53,850 --> 00:02:03,960 So you're going to see the most Web applications are vulnerable to one or more or all of these 10 items 29 00:02:03,960 --> 00:02:04,300 are here. 30 00:02:04,920 --> 00:02:10,500 So just to go down the list very quickly, injection is ranked as the number one, which is pretty much 31 00:02:10,500 --> 00:02:11,580 what it sounds like. 32 00:02:11,790 --> 00:02:17,040 It's when you inject malicious code into a website and as possible, a lot of the times, because certain 33 00:02:17,040 --> 00:02:24,600 checks are performed when input is given to an application, and therefore it can allow you to inject, 34 00:02:24,600 --> 00:02:26,010 you know, like malicious code. 35 00:02:26,700 --> 00:02:32,400 Broken authentication just refers to the authentication method being broken for some reason, like maybe 36 00:02:32,400 --> 00:02:38,130 someone can log in with a with a blank password or a blank username or there's something wrong with 37 00:02:38,130 --> 00:02:44,370 the authentication sessions aren't configured correctly. 38 00:02:44,370 --> 00:02:46,650 All kinds of different things that could be so broken. 39 00:02:46,650 --> 00:02:48,750 Authentication is definitely a big thing that you'll see. 40 00:02:49,890 --> 00:02:52,520 Number three will be the sensitive data exposure. 41 00:02:52,530 --> 00:03:00,330 So a lot of the times developers may expose sensitive data like, you know, maybe from databases instead 42 00:03:00,330 --> 00:03:03,750 of just from lack of security and kind of ties into these other ones. 43 00:03:04,380 --> 00:03:10,980 Or they may also leak out sensitive data on accident, you know, via things like comments or just different 44 00:03:10,980 --> 00:03:11,820 parts of the code. 45 00:03:11,850 --> 00:03:16,410 So number four, it's called an XML external entities. 46 00:03:16,650 --> 00:03:26,310 So when you attack on amount and it's easy, it's pretty much when an application that parses XML input 47 00:03:27,150 --> 00:03:34,770 is attacked and the attack occurs when XML input contain a reference to an external entity is processed 48 00:03:34,770 --> 00:03:37,020 by weakly configured XML parser. 49 00:03:37,290 --> 00:03:43,320 So this allows attackers to actually be able to take advantage of that and, you know, exploit it and 50 00:03:43,470 --> 00:03:45,390 take over potential, take over the server. 51 00:03:46,500 --> 00:03:52,010 Broken access control is the next one and broken access control is pretty much what it sounds like is 52 00:03:52,020 --> 00:03:58,020 when maybe like a regular user can escalate the privileges or have access to do things that they shouldn't 53 00:03:58,020 --> 00:03:58,740 be able to do. 54 00:03:59,040 --> 00:04:02,010 So it's kind of like broken authentication or something is just wrong. 55 00:04:02,310 --> 00:04:07,800 And a security misconfiguration kind of ties into those other ones, just having things figured on the 56 00:04:07,800 --> 00:04:09,240 server and application. 57 00:04:09,240 --> 00:04:15,240 And it just allows users to do things that they should not be able to do. 58 00:04:16,230 --> 00:04:18,390 The next one is going to be croci scripting. 59 00:04:18,900 --> 00:04:20,790 This is part one of the most popular ones. 60 00:04:21,390 --> 00:04:30,540 Crosseyed scripting is pretty much when you're sending malicious data into either into the URL and it 61 00:04:30,540 --> 00:04:33,540 gets executed or into a page. 62 00:04:34,020 --> 00:04:40,470 And every time the page loads, the malicious code may excuse us croci scripting and it's pretty much 63 00:04:40,470 --> 00:04:43,320 when developers don't. 64 00:04:44,380 --> 00:04:50,170 Chet, you know, they don't sanitize the input into the application, so it causes major issues and 65 00:04:50,170 --> 00:04:55,750 causes, including one of the biggest vulnerabilities out there, insecure serialisation, is exactly 66 00:04:55,750 --> 00:05:02,220 what it sounds like when decentralizing data is just done in a very insecure manner and allows attackers 67 00:05:02,710 --> 00:05:03,800 just to take advantage of it. 68 00:05:04,240 --> 00:05:08,110 The next one kind of speaks for itself using opponents and vulnerabilities. 69 00:05:08,680 --> 00:05:16,630 So a lot of applications have like third party dependencies and these dependencies may have known vulnerabilities 70 00:05:16,810 --> 00:05:19,070 and those are attack vectors for hackers. 71 00:05:19,300 --> 00:05:26,290 So if a developer uses a component that has known vulnerabilities and a hacker finds out that Kapone 72 00:05:26,290 --> 00:05:28,440 is being used, they could take advantage of that. 73 00:05:28,780 --> 00:05:31,860 So that's something that developers need to keep in mind. 74 00:05:32,200 --> 00:05:35,010 And then number 10, insufficient logging in monitoring. 75 00:05:35,020 --> 00:05:40,450 And this is an issue because if you don't log or monitor what's going on with the application, you 76 00:05:40,450 --> 00:05:41,440 never know what's happening. 77 00:05:41,440 --> 00:05:45,930 You know, you could be getting attacked on an hourly, daily basis. 78 00:05:46,080 --> 00:05:52,480 You never know if you're not logging, you know, access in terms or specific traffic that's coming 79 00:05:52,480 --> 00:05:56,510 into the application or the server, then, you know, you're not going to know what's going on. 80 00:05:56,530 --> 00:05:58,960 So that's definitely a major vulnerability. 81 00:05:59,200 --> 00:06:04,180 And it doesn't allow you to actually figure out that there may be an issue or it won't allow you to 82 00:06:04,180 --> 00:06:05,230 figure out what's going on. 83 00:06:05,230 --> 00:06:08,170 And if you do discover an issue when an attack is going on.