Instructor: Now in the next lectures, 2 2
we're gonna start talking about server side attacks. 3 3
I'm gonna teach you what a server is, 4 4
and we're gonna talk about that in details. 5 5
But before we jump into this, 6 6
we need to have a computer or a machine 7 7
that acts as a server so that we can try to hack into it. 8 8
So similar to the way that we had a Window's machine 9 9
to practice attacks that we can launch against normal users, 10 10
we need to have another virtual machine 11 11
that behaves like a server, 12 12
so that we can practice server side attacks against it, 13 13
and see how we can hack into servers. 14 14
So the machine that we're gonna use 15 15
is called Metasploitable and it's a virtual machine 16 16
that's built on Linux. 17 17
And it contains a number of services 18 18
that's typically used by servers. 19 19
It also contains a number of web applications 20 20
that act exactly like normal web applications 21 21
and use the same technologies used by normal servers 22 22
and normal web applications, 23 23
so we're gonna install this machine. 24 24
And then in the future, 25 25
we're gonna use it as a target 26 26
to learn how to hack into servers, 27 27
and how to hack into websites. 28 28
You can download this from the following link. 29 29
Now, I've also included this link in the resources 30 30
of this lecture, 31 31
which you can access from the top left of each lecture. 32 32
If you click on this link, 33 33
you'll get this page 34 34
which will allow you to download Metasploitable 35 35
Before you can download it, 36 36
you're gonna have to fill your information in here. 37 37
So I'm just gonna fill up anything for a company 38 38
and anything for a phone number. 39 39
Now, one thing I'd like to note 40 40
when it asks you for your email, 41 41
if you use a normal Gmail account like this one 42 42
and tries to download 43 43
you'll see that it's gonna say, 44 44
this must be a valid company email. 45 45
So if you do not have a company 46 46
you can use a fake email in here, 47 47
all you have to do is just write a name 48 48
at any company name you want. 49 49
So I'm just gonna say is Zaid@imaginarcompany.com. 50 50
Now don't use imaginary company as well, 51 51
because I don't want a lot of people 52 52
using the same fake email. 53 53
But the idea is you just wanna use a name 54 54
at some other name.com. 55 55
And this will allow you to bypass all of this. 56 56
And once you click on submit, 57 57
you go to the download page. 58 58
And if we click on download Metasploitable now, 59 59
it'll download it for me. 60 60
Now, once it's downloaded, 61 61
you're gonna have a zip file. 62 62
And I've already downloaded this. 63 63
So I have the zip file right here. 64 64
Sorry, not this one, like this one. 65 65
So once you uncompressed it, 66 66
you'll get this directory 67 67
double click it and you'll see the following files. 68 68
So we're gonna create a new machine here, 69 69
in virtual machine and I'm gonna call it Metasploitable. 70 70
And this is going to be a Linux machine. 71 71
And I'm gonna hit continue along, 72 72
and I'll only gonna give it a gigabyte of RAM 73 73
should be enough. 74 74
And then I'm gonna use remember with Kali Linux, 75 75
we created a new virtual hard disk. 76 76
With this, we're gonna use an existing one. 77 77
The reason for that is because, 78 78
the image that we have right now is actually 79 79
it's designed for VMware Player. 80 80
So what we're going to do is we're gonna import 81 81
the hard disk file or the hard disk image in here, 82 82
so that we're gonna have an already installation 83 83
without having to install it, 84 84
the way we installed Kali Linux. 85 85
So we're just gonna use an existing virtual hard disk file. 86 86
And I'm just gonna navigate, 87 87
to select what it is. 88 88
I'm gonna go into the Metasploitable directory 89 89
and I'm gonna select the .VMDK file. 90 90
So it's this file right here. 91 91
I'm gonna click on open, and create. 92 92
So we're gonna start this machine right now. 93 93
Okay, so the machine has run now it's completely installed. 94 94
As I said, you don't really need to install anything, 95 95
we just imported a ready installation already hard disk. 96 96
So it's asking me for the username, 97 97
and the username is msfadmin. 98 98
And the password is the same, so it's msfadmin as well. 99 99
Now you might notice once you start typing the password, 100 100
you'll see nothing displayed on screen. 101 101
This is a security feature 102 102
so that the password is not visible to people beside you. 103 103
So once you get asked for the password, 104 104
type msfadmin, and then hit enter. 105 105
Now I've actually already typed it. 106 106
So now when I hit Enter You'll see it's gonna log me in. 107 107
Now this machine already has a terminal interface, 108 108
as you can see here. 109 109
And it's giving you a warning 110 110
that you should never expose this machine 111 111
to external internet connection 112 112
because it is a vulnerable machine 113 113
it is designed to be vulnerable. 114 114
Now, right now it's only inside our lab, 115 115
it's on the installed as virtual machine. 116 116
So literally nobody outside our lab can access it. 117 117
So this is a really good way of using it. 118 118
Now this is if the machine is installed. 119 119
As I said in the future, 120 120
we're gonna talk about how we're gonna try 121 121
and hack into this machine. 122 122
Again, don't be intimidated by the terminal. 123 123
We're gonna be using it a lot 124 124
and we're gonna learn how to use it step by step. 125 125
So at the moment, just we have this installed, 126 126
and we're gonna move on to the next step. 127 127
And we will talk about this, 128 128
once we actually need to use it in the future. 129 129
So if you wanna turn off this machine, 130 130
all you have to do is just typing power off and hit Enter. 131 131
I was telling you that you need to be root. 132 132
So, again, I'll talk about this later 133 133
for now sudo power off. 134 134
So just run the command like this. 135 135
And it's asking you for the admin password. 136 136
And that's it, it's going off now. 137 137
And here we go, the machine is off.