-: How would you attack a website? 2 2
You can use the methods that we've learned so far 3 3
into attacking a website because we said 4 4
a website is installed on a computer 5 5
so you can try to attack it and try to hack it 6 6
just like another computer, so you can try 7 7
to use the server side attacks, 8 8
to use the server side attacks, 9 9
try to see the web server installed the operating system 10 10
all the other applications and see if you can use 11 11
if any of them has any vulnerabilities, 12 12
and if you can use any of them 13 13
to gain access to the computer. 14 14
Another way to that is to use 15 15
the server side attacks and the client side attacks 16 16
because websites are managed by humans 17 17
so there must be humans managing these websites and 18 18
mandmaintaining them, so if you managed to hack any of 19 19
the administrators of this website, 20 20
then you probably be able to get 21 21
their username and a password 22 22
and then from there, log in to their admin panel 23 23
or to SSH, to any services 24 24
that they use to manage their website. 25 25
If both of these ways fail, then what you can do is 26 26
you can try to test the web application 'cause 27 27
as I said, the web application is just an application 28 28
installed on that website. 29 29
So your target might actually not be the web application 30 30
maybe your target was just a person using that website, 31 31
but you will never be able to get, 32 32
gain access to that person's computer. 33 33
So what you do is, you go to his website 34 34
hack into his website, 35 35
and from there go to your person. 36 36
So, all of these things that we're talking about 37 37
they're all interconnected then you can use one of them 38 38
to privilege and then 39 39
make your way to another place or to another computer. 40 40
So, in this section 41 41
we're not gonna be talking about the server 42 42
and the client side attacks 43 43
because you've already learned that. 44 44
What we're gonna be talking about is the 45 45
testing the security of the website application itself. 46 46
So my target is gonna be this Metasploitable machine. 47 47
And if we do one ifconfig on it 48 48
you'll see it's IP is 10.20.14.204 49 49
and all the websites files are stored 50 50
in a directory called: var/www 51 51
and you can see that we have my our php.info 52 52
and we have mutillidae, dvwa and phpMyAdmin 53 53
and we have mutillidae, dvwa and phpMyAdmin 54 54
so if we go to the Kali machine or to any machine 55 55
and try to go 56 56
any machine on the same network, obviously, 57 57
and try to go to, 58 58
let's open the browser, 59 59
and if we go to 60 60
10.20.14.204 61 61
10.20.14.204 62 62
10.20.14.204 63 63
10.20.14.204 64 64
you'll see we have a website here 65 65
made for Metasploitable. 66 66
So as you can see, a website is just 67 67
an application installed on the web browser. 68 68
And, you can see that you can access 69 69
any of these websites right here 70 70
and use it and test it's security. 71 71
Another thing is the DVWA uses a username and a password 72 72
to log in, and the username is: admin 73 73
to log in, and the username is: admin 74 74
and the password is: password 75 75
and once you put that, then you can log in. 76 76
You can also modify the security settings 77 77
so if you go on the DVWA Security 78 78
I'm gonna be setting it to low, 79 79
and I'm always gonna be using as low 80 80
in the upcoming sections because we're only 81 81
this is just an introductory course, so 82 82
we're only gonna be talking about 83 83
the basic ways of discovering 84 84
the basic ways of discovering 85 85
a web application vulnerabilities. 86 86
And the same with the mutillidae web application. 87 87
So if we go to it here, 88 88
make sure that your security is set to low, 89 89
so my security is set to zero right here.