Let us continue with the application penetration testing in the previous videos, we saw how to exploit
the commanding general vulnerability individually and now in this lecture on what is the how to exploit
the failure, proven their abilities.
But before doing that, we need to configure the most important tool required in the Web application
penetration testing.
And most of the security experts also use this tool.
This is known as Bob Boxwood.
So what is bop, bop, bop, bop?
It is a set of tools for penetration testing of the applications.
It is developed by a company named as Pottsville BOP.
It aims to be an all in one set of tools, and its capabilities can be enhanced by installing different
add ons and plug ins.
It is the most popular tool among professional security researchers and bug bounty hunters, why people
prefer BOP's, it is because of it's more suitable choice or apps, and that is the ease of use now.
But it is available as a community addition, which is free, of course, and professional attrition
that costs around 400 dollars per year, and an enterprise edition that costs around 4000 dollars per
year.
This lecture will give you a brief introduction to the different tools offered by both sweet.
And if you are a complete beginner in the application penetration testing, this is the most important
lecture and you should please listen to this installation process above it very closely.
So let us get started.
Make sure that you have turned on your Linux machine and metastable machine.
Also, let us see how to configure Boxley.
So as you can see, I have called Linux open here, so the image or the file, which I have already
installed in Cali, has a preinstalled version of both.
Sweet.
So what you need to do is go to the applications and type BOPE, Suite B, you are P and there you go.
You can see the logo.
Just click and legba open.
If you are installing or opening a suite for the first time, it may take a couple of minutes to look.
Don't look anything, just click, OK?
But will start automatically.
So you just have to accept everything, click, accept and then click start.
Do not update, just click close and click start.
And start wait, the pope's DUI gets launched, the pope is available in Linux as well as in Mac and
Windows, but for this lecture and for the rest of the lectures, all of our ethical hacking codes,
you will see how to use Bob in Linux.
Now, this is the interface of the Xbox, which means we're going to use a community addition.
Most of the tools are not available and also are not required if you are a complete begin to expand
the window of book.
And now let us go to the first tool that is a spider.
It is a Web spider or chloro that is used to map the target of application.
The objective of the mapping is to get a list of end points so that the functionality can be observed
and potential vulnerabilities can be found.
Now spidering is done for the simple reason that more endpoints you gather during the recognition process,
the more attack surfaces you process, the next step is the proxy.
What is a proxy, Nebojsa?
It contains and intercepting proxy that lets the user see and modify the contents of requests and responses
while they are in transit.
For example, intercepting.
Suppose you are communicating with your browser.
Now you type search work it now when you hit the go button, we use it to catch that request, which
means the browser will send the request to upsweep.
You can modify the contents and then send it back to the server.
This is known as intercepting like a man in the middle it.
Now the proxy tag also lets the user send the request response under monitoring to another relevant
tool in Boxwood, removing the burden of copy and paste.
The proxy server can be adjusted to run on a specific loop back IP and a port.
And also the proxy can also be configured to filter out specific types of request response.
So in the proxy type you can see these are the following four types intercept A.P. history, websocket,
history and options.
We are interested in options.
The first thing is proxy listeners.
You can see the default IP address is one twenty seven point zero point one and the port is eighty.
What is the use of this IP?
This is a Lubeck IP address, so if you set your browser to send all the requests to this IP only,
what browser will do is that whenever you search for something to the server, the browser will first
send the request to the IP address that is mentioned in that browser.
And for Bobes, which we are going to mention this IP address in your browser, so automatically the
browser sends the request to it and then work through it will forward the request to the browser.
So just remember this IP address one twenty seven point zero point zero point one and postdated.
Now minimize the website will explore the rest of the tabs after some time up on your Firefox browser.
Including it's only to just go to applications and type Firefox.
In the Firefox, just go to preferences.
And scroll down to the last option.
Which is network settings, click settings, now you can see there are different options, no proxy
or reject proxy and manual proxy.
We are interested in manual proxy.
So just type one twenty seven point zero point zero point one and put eighty eighty.
And select option, use this proxy for all servers and then click, OK?
Now, what we have done is whenever we will sort something of a request will be directly sent to Bob
Sweet.
So let us try searching something just like Google.
Oh, but why we got an error because we have it all browser that, OK, berp is a good tool and we need
to trust berp so far that we will have to download the trust certificate provided by Bob.
So just open a new browser.
Open a new tab and just type that HTP.
Colon slash, slash berp B, you are being hit and you can see a certificate there, just click there
to download the certificate, click save file.
Now this certificate will tell Mozilla Firefox browser that, okay, Bob is a good tool and I can trust
Bob, so we will wait until it gets downloaded.
So now you can see in the downloads I have downloaded the C A certificate.
Now go to your browser.
That is the Mozilla Firefox.
Again, go to preferences.
Scroll down.
Did you get a certificate authority?
In privacy, go to privacy and security, go down, scroll down, and at the end you can see Certificate's
now click view certificates and then click import.
Now, these are the also advocates already present inside import that certificate, which we have just
downloaded, only big trust, key to identify the websites.
If you want, you can identify email users, but I will prefer to identify websites.
Click OK and then click OK.
Now we have told the browser that OK, Bob is a good tool and we can trust book.
So now go to Bob Sweet.
In The Intercept.
Intercepted off certain that intercept on and now go to Mozilla Firefox browser and there type Google
dot com.
You can see the tablets, the loading, and voila, we got the request in our book.
Now, this is the request which we have intercepted in BOPE suite.
You can see the first icon is get that is HTP matter.
It is using a get a parameter, get better host.
That is our browser is trying to contact to whom.
Google com user agent.
That is Mozilla Firefox.
Then accept accept language encoding.
We've also got cookie and everything.
So now just click forward request.
And then go to Mosiello again, click forward to forward everything that we have got to keep on going
forward till we get further requests.
And you can see we have finally got Google dot com, so this is how you intercept requests in bulk,
sweetie.
Now go to Boxwood and done the intercept of the next tool that we're going to see is the intruder.
It is basically, officer, what is fuzzing fuzzing is basically randomly trying different values and
then trying to get output that is known as fuzzy.
Now, this tool is used to run a set of values through an input point, the values are run and the output
is observed for success or failure, and the content length, usually an anomaly, result in a change
in the response code or content length of the response box, which allows brute force, a dictionary
file and single value attacks for its payload position.
Now, the intruder is primarily used for three major types of attacks brute force attacks on password
forms, bane forms and other such forms.
The dictionary attack on password forms, feels Escalon connection, etc. and finally, testing and
attacking rate limiting flaw in the Web application.
The fourth, which you're going to see, is the repeater tool.
Repeater lets a user send requests repeatedly with manual modifications.
It is used for verifying whether the user supplied values are being verified.
If users of their values are being verified, how well it is being done, then what values is the are
expecting in an input parameter?
How does the server handle unexpected values?
Is input sanitisation being applied by the server?
So basically, instead of bringing the server every time, you can just send the request to repeater
tab and then analyze the request and response simultaneously to see how exactly the algorithm behind
the application is working.
The fifth tool is the sequencer.
The sequencer isn't entropy checker that checks for the randomness of the tokens generated by the Web
server.
Now these tokens are generally used for authentication in sensitive operations like cookies and cookies,
that if tokens are examples of such tokens, ideally these tokens must be generated in a fully random
manner so that the probability of appearance of each possible character at a position is distributed
uniformly.
So this is how Sequencer works, it is basically used to do everything related to cross site request
forgery and cookies.
The next comes Decoder Decoder lists the common encoding methods like you are a XHTML, Base64, Hecks,
etc..
This tool comes handy when looking for chunks of data in values, for parameters or headers.
Let us try one thing now.
You can see at the right corner there is a tab and code as to just click the encoders and just type
you are in.
Now, in the first box here, type random letters type hello.
You can see the URL is encoded, and if you copy this URL, if you copy this form and pasted in a browser
to attack different passwords, that it may bypass the firewall of the server.
And we are going to see how this decoding is very useful in upcoming lectures.
Next is the extender box, which supports external components to be integrated into the tools to enhance
its capabilities.
These external components are called BAPS.
These work just like the browser extensions and thus can be viewed, modified, installed and installed
in the extender window.
The next is project options, any other options, which are basically different options, which you
can set while using the works with.
Compare function, let's you to do a vulnerability level comparison of between different data.
So if you have two items and if you want to compare between the two requests or responses, you can
just paste the two items in the two tabs and then hit the compare button to see what similarities are
in there and what are the differences.
So basically, if you want to analyze different incoming requests by intercepting them, this computer
tool is very handy.
So this was all for today's lecture.
But before closing it, you need to do one important thing.
So just click the close button for the sweet.
And now try searching something.
Let's try switching cybersecurity.
Just like Zibo and hit Enter.
We have got a little while, but our bobsledders close, you are right, we didn't change the proxy.
So again, go to preferences, scroll down, go to network settings, click no proxy, click OK, and
then try searching again.
There we go, we have a.
So before closing bobes, we make sure that you changed the proxy settings.
This was all for this lecture and in the next lecture, we will see how to exploit the file, upload
vulnerability and what is meant by available vulnerability.