-: In this section, we're gonna be talking about 2 2
web application penetration testing. 3 3
Before we can start talking about that, 4 4
we need to understand what is a website. 5 5
Just like I said before, 6 6
a website is just an application installed on a computer. 7 7
That computer probably just has better specs 8 8
than your computer, 9 9
but, fundamentally, it works exactly 10 10
just like another computer. 11 11
It has an operating system 12 12
and it also has a number of applications 13 13
to allow it to act as a web server. 14 14
The main two applications that it probably has is 15 15
a web server and a database. 16 16
A web server is like Apache, 17 17
and a database is like MySQL. 18 18
The web server, basically, understands and executes 19 19
the web application. 20 20
Your web application would be written in PHP or Python, 21 21
in any programing language, really. 22 22
The only thing is that the web server 23 23
needs to be able to understand 24 24
and execute this web application. 25 25
The database contains the data used by the web application. 26 26
All of this is stored on a computer called the server. 27 27
The computer is connected to the internet, 28 28
and it has a real IP address, 29 29
so anybody can access that computer and can ping it. 30 30
The web application is executed by the web server 31 31
which is installed on your server, on your target. 32 32
Therefore, any time you request a page 33 33
or you run the web application, 34 34
it's, actually, executed on the web server, 35 35
and it's not executed at the client's computer. 36 36
It gets executed at the web server, 37 37
and then it sends a HTML page which is ready to read 38 38
for the target person or for the clients. 39 39
Let's have a look on an example. 40 40
Let's say you're on the phone or on your computer 41 41
and you wanted to go to facebook.com. 42 42
So, you type in facebook.com into your URL. 43 43
This will be translated using a DNS server 44 44
to an IP address. 45 45
There is a server that translates every name, 46 46
.com, .edu, or any website with a domain name, 47 47
so this is a domain name, 48 48
to its relevant IP address. 49 49
So, you request facebook.com, 50 50
the request goes to a DNS server, 51 51
it translates facebook.com 52 52
to the IP where Facebook is stored, 53 53
and then it'll go to the IP address of Facebook, 54 54
it'll execute the page that you wanted 55 55
using all of the applications that we spoke about, 56 56
and then just give you a ready HTML. 57 57
What you get back is just a markup written in HTML, 58 58
which is a markup language, 59 59
of the result of executing the program. 60 60
The program gets executed on the server, 61 61
and then you just only get the result. 62 62
This is very important because 63 63
in the future if we wanted to get anything executed 64 64
on the web server, 65 65
if we wanted to get a shell, a reverse shell, or a virus 66 66
executed on the target computer, 67 67
then we need to send it into a language 68 68
that the web server understands. 69 69
For example, PHP. 70 70
Once you execute it there, 71 71
it'll be executed on that computer, not on your computer. 72 72
Regardless of the person that accesses the page, 73 73
the web shell that you're gonna send, 74 74
if it's written in PHP, 75 75
in a language that the server understands, 76 76
it's gonna be executed on the server 77 77
and not on your computer. 78 78
Therefore, it'll give you access to the server, 79 79
and not access to the person who accessed that server. 80 80
JavaScript, on the other hand, 81 81
there are some websites who use JavaScript. 82 82
JavaScript is a client-side language. 83 83
If you manage to find a website 84 84
that allow you to run JavaScript code, 85 85
then the code will be executed by the clients. 86 86
Even though the code might be injected into the web server, 87 87
it'll be executed on the client-side 88 88
and it'll allow you to do things to the client computer 89 89
and not to the server. 90 90
It's very important to separate 91 91
between a client-side language and a server-side language.