So a lot like regular pin testing, you first have to gather information at the reconnaissance, you
know, on the target web application, a website before you attack it.
And we can achieve this using a variety of scanning tools that we can use on a colonics machines that
come by default.
For the most part, these Web application scanners can actually take an IP address and automate scanning
to discover potential vulnerabilities.
So two very similar Web application scanning tools.
I personally like myself.
I use each one for specific purposes, but they are called Zap Emberg.
O.W. is actually made zap and Burp is its own standalone application.
Are very, very similar functionality.
But they have some features between them that, you know, that separate them apart.
And like I said, I use for specific things and we're going to be using berp and I use that for certain
things.
And that's what I'm going to show you guys as well.
And they typically can discover the same information and perform some of the same functions, but some
people prefer one over the other.
But it is worth noting that Bert has the paid edition with a lot more features.
Well, that is 100 percent free because otherwise he just wants people to make more secure applications
and that's why that is free.
So let's actually go over and check out that, OK?
So back in our colonics machine so you can just touch the you can just click on the icon over here and
you just type in zap and it should come up.
The should already be installed on the system.
If it's not, you can just go online and, you know, go install that.
So just a few seconds, let it load up.
So one zap opens up.
You're going to get this right here.
You can go ahead and no, don't worry about persisting recession.
So this is the interface of that.
So it's very honestly straightforward.
It's not too complicated.
I mean, you might see a lot of icons right now, but you really get used to it.
You really do.
Sibylla, what I use that for is just the automated scanning feature.
So you want to click right here when you see automated scan, it already has a copy right there for
you.
So what we're going to do, we're going to put the the the IP address for our metastable machine that
one six eight five six one two four.
And we're going to scan actually, let's just get this address and just see what happens right here
so you can keep all this other stuff the same and you just hit attack.
And what is going to do is going to go through and it's doing all kinds of different things.
It's going to map out.
It's going to map out the words, I see what you are ls exists is going to scan specific parts like
pages that it finds for security vulnerabilities.
And you just want to give it time so you can see like right here found almost a thousand new URLs.
And because this little machine has a lot of it has a few different things posted on it to make it acceptable
for you to practice on.
So you see this finding a lot of your URLs and it's only through scanning those and it's going to pop
up with alerts over here and it shows you all the different vulnerabilities that it's finding and is
updating in real time.
So like, for example, you see private IP disclosure right here.
You can read about it.
It shows you exactly where it happens, like right here, shows you where the code that it happens.
And then it gives you a little bit of detail on a private IP address has been, you know, found in
HCB response body.
So that's interesting information.
There's a lot of different things like crosseyed scripting protection.
Is it enabled if you want to look at some of these pages that have this, to have that flag this and
see if they're maybe potentially susceptible to cross scripting, which we're going to go over some
of that.
And it just keeps it keeps on finding stuff like memory.
It doesn't matter floatable.
So it's very exploitable.
So when you do that, when uses in a real well, you might actually you might not actually find a ton
of vulnerabilities, but it can find some definitely
important or useful information for when you're going through and trying to find bugs and vulnerabilities
in a Web site.
Also, if you click on very weak sites, you hit the little area right here and it has it kind of like
in a hierarchy format and you can see the different sites that you've actually scanned.
So this has our one four address.
And this show is sort of where what what is this and what they found there, all the different things
like that, a lot of good information.
So you really want to be able to look through this kind of stuff, started to take some notes and figure
out, hey, this a vulnerability here, maybe I should check that out.
Very, very useful tool.
So one other thing that you can do.
We're going to do this with berp.
But you can also capture any requests that you send out and actually modify them before the Senate sends
a very interesting feature, you do that with this section right here and we're going to go over that
with Berp.
We're not going to use that word Zapotec, throw it out there that you actually can, you know, capture
your HTP request that you're actually sending out and actually modify them, you know, as you need
or as you see fit, you know, maybe to get past security features.
So we're going to go over that in.
So that is a very good tool or points on a lot of different vulnerabilities and is definitely something
that you want to have in your tool kit when you're doing web application testing.
OK, so one of the thing I wanted to show you guys really quickly, so the application that we're going
to be attacking against and learning how to hack websites, but is the dam vulnerable Web application?
And you can find that at the IP address of the machine, then put a fossilize devoir.
So I launched an attack on this one and it found some very interesting stuff down here.
So you can kind of check it out.
So McGray here, this is a directory browsing.
So, you know, it's possible to the directory listing.
So directly, directory listing may reveal, you know, hidden scripts like files, backup source files,
ATC, and they may have sensitive information and it gives you the information on where you can actually
do that.
So it's points where he is the URL up.
DeVita was like DeVita way.
So let's open up a Web browser and let's actually go ahead and try this out to see if it actually worked
out.
So Web browsers open when I said I want to succeed or fail safes, I want to force Azis DV enter and
the what up.
Oh hey, we found a directory listing, so that's pretty cool.
So now we can actually, you know, browse the directory, probably download files, see what's on here.
So it's pretty useful.
That's pretty neat.
So automated the entire process of finding something like this.
And honestly, this is all things you might find out a while, to be honest, in the real world.
So a lot of people had their thing set up very, very insecurely.
You will be shocked.
So, yeah.
And then like like just like before Erra disclosure, that's usually an issue of all kinds of different,
like, you know, maybe cross site request forgery is going to work for the page that it was found here.
So very useful to information leaks, all kinds of stuff, so very useful tool.
You definitely want to make sure that you have this in your tool kit when you're actually doing your
initial scanning for Web apps.