OK, so now let's talk about searching and understanding exploits, so the next step in launching an
attack, you know, after we're actually looking through, you know, we went through into detail nothing
just because that's something that doesn't really require an exploit, just something that you could
just go and do.
So, but when you get past that or maybe Tonette is an open, you're going to want to search for an
exploit to use.
So typically, you're going to be using public exploits to compromise systems.
You're not going to be creating on your own exploits unless you, you know, become like a super, super
elite, you know, level of hacker.
You become like a security researcher.
And that's something that you do.
It's a very advanced skill and it's definitely something I encourage you to do.
But when you're typically when you're penetration testing, ethical hacking assessments and successful
companies, you're typically going to be using public exploits because your job is to uncover was there
and what someone else could exploit.
It's kind of outside of the scope of this course, you know, to actually create exploits.
But you can take some of the skills and actually create, in a way, your own kind of exploits.
So and you can search for these exploits in a variety of ways.
And we're going to go over, you know, each one of these.
So the first is exploit Debe, so this is a website with literally thousands of public exploits and
you can download all of them, you can visit the site and just search for the excuse that you want pretty
easily with the search function.
And he gave you just like a little search bar at the top of the page.
I believe that we already went before too long for the Google hacking stuff.
So you can just search up there and under the explicative section, you can search and find stuff that
you want to like.
For example, you can search like Windows seven or Firefox, find exploits related to your search terms
so that your URL just once again for you guys have it is xiphoid DB dot com.
So let's actually switch over to our Callear machine, browse to this site and actually try to find,
you know, like an exploit that we could potentially use for exploded by this political machine.
OK, so back into the machine.
So I loaded up the Exploit DB Web site.
So as you can see, it's pretty safe for this is a listing believe this looks like a listing, like
the latest exploits that have been uploaded to the website.
So you take a look at those if you want.
But what we want to use is this search box.
So you had the option here to check, you know, if it's been verified or not, which means it's been
verified, you know, that it actually that actually works when you when you would use it, because
some of these that have expired, they may work.
I mean, I work.
And it might be something that you have to, like, modify yourself.
So be careful with those ones of the not what's called EDI, EDB verified and just be careful with those.
So when I want to do is use a search box right here.
So that's for example.
So we remember that there was an FTP service that was called V as afte PD.
So this type of GSF, the D, there we go.
And I remember specifically I forgot the t v e f so we remembered the version actually looks right here.
Hey Vince ftp PD two point three point four backdoor come in execution and it's a Métis boy, which
is something that I'll go ahead and talk to you guys about as well so we can just click into this one
and read a little bit more about it.
So let this load and it's going to give us information, actually show us the expertise, so it's a
part of the display framework, which is pretty much like a hacking made easy tool.
And I'm going to get into that with you guys as well.
But so this one is already going to be available to you on your colonics machine because colonics already
has just one.
And so what you're going to want to do, like, you know, here, like, for example, you can I believe
that you can still download X when you use it, but it will require my display.
So it's better to just launch something like this from a display we're going to get and how to do that
stuff later.
So we actually launched this one in a little bit later on in this section.
You can go ahead and look at look at the exploit, kind of get a feel for what's going on.
It has pseudocode in here.
So you kind of understand what's telling you kind of like what's going on.
You also just want to make sure that you're not getting anything that's malicious.
Like if you're conducting a test of someone's network, you definitely want to make sure that you read
over these things and make sure that they're not, you know, doing anything that will harm, you know,
your client systems.
So this is actually verified and it will be good to go before they go over any name at this point.
So I do that in a little bit.
But just remember, you can just search for exploits here.
Let's search for another one that we might be able to find the CI.
So something I was just like for example, like, I don't know, like from there we go on, let's say
I see.
So as you can see, there's very specific growing regions, you know, those exploits that are available.
And some of these are going to require measures where you'll see that.
But also other times you're going to see that you could just download these things and just run them
from the command line.
So that's something that, you know, we'll get into as well.
But this is a great option for you guys to actually be looking for your public exploits.