Web application penetration testing before we can start talking about that we need to understand what
is a website and just like I said before a website is just an application installed on a computer the
computer probably just has better specs than your computer.
But it fundamentally works.
Exactly.
Just like another computer so it has an operating system and it also has a number of applications to
allow it to act as a web server.
So the main two applications that it probably has is a web server and a database a web server is like
Apache and the database is like my.
And these are the web server basically understands and executes the web application.
So your web application will be written in BHB or Python and you program language really the only thing
is that the web server needs to be able to understand and execute this application.
The database contains the data used by the web application.
So all of this is stored on a computer called the server.
The computer is connected to the Internet and it has a real IP address.
So anybody can access that computer and can get.
So the Web the web application is executed by the web server which is installed by what is installed
on your server on your target.
Therefore any time you request the page or you run the web application it's actually executed on the
web server and it's not executed at the client's computer.
It gets executed on the web server and that it sends a hash DMO page which is ready to read for the
target person or for for the client so let's have a look on an example and let's say you're on the phone
or on your computer and you want it to go to Facebook dot com So you type in Facebook dot com into your
your app.
This will be translated using a DNS server to an IP address.
So there is a server that translates every name dot com dot you or any web site with a name with a domain
name.
So this is the domain name to its relevant IP address.
So your request Facebook dot com their quest goes to a DNS server.
It translates Facebook to the IP where Facebook is stored.
And then you go to go to Facebook to the IP address of Facebook it will execute the page that you wanted.
Using all of the applications that we spoke about and then just give you radiation out.
So what you get back is just a markup routine in hastier mail which is a markup language all of the
result of executing the program so the program gets executed on the server and then you just only get
the result.
This is very important because in the future if we wanted to get anything executed on the web server
if we wanted to get a shell or a virtual or a virus execute on the target computer then we need to send
it into a language that the web server understands.
So for example we.
And once you executed there it will be executed on that computer not on your computer.
So regardless of the person the artist is the page the this the web show that you're going to send if
it's written in ph be in a language that the server understands it's going to be executed on the server
and not on your computer therefore it will give you access to the server and not access to the person
who accessed that server
javascript.
On the other hand there is some websites use javascript and Javascript is a client side language.
So if you managed to find a web site that allow you to run javascript code then the code will be executed
by the clients.
So even though the code might be injected into the web server it will be executed on the client side
and it'll give you it'll allow you to do things to the client computer and not to the server.
So it's very important to separate it between a client side and server side language.