In this lecture I'd like to highlight a very important note when it comes to website penetration testing
websites are installed on web servers on normal computers like we said before these normal computers
have IP addresses and using the IP address we can access our target website.
Now in many scenarios your target web site will or your target server will contain a large number of
Web sites so it have the Web site that you're looking for that you're targeting but it'll also contain
other websites on the same server.
So on the same file system.
What this means is if you for example could not find any vulnerabilities in your target web site you
can try to hack into any other web site that is installed on the same server.
If you could do that then you'll be able to gain access to the server getting access to the Sarovar
basically means you have access to all the other Web sites because the server is just a computer and
you can literally just navigate to the web that you want to hike and gain access to that Web site.
So if you're trying to hack into a website and you couldn't find any exploits then the next step will
be trying to hack any other web site that exist on the same server.
So what I mean by exist on the same server is they have the same IP address.
So let me show you here an example.
I'm going to be shown an example of Zayde dot com so my blog because there is a lot of Web sites on
the same server.
And if we look here on Iraq optics dot com and I came down here two names pointing to the same IP address.
You can see all of these Web sites exist on the same server as Zayde dot com.
So if you could manage to hack into any of these websites you'll be able to navigate from the front
of that Web site and then into a dot com and then gain full access to my Web site so let me just show
you here if I copy any of these domain names for example we have this one really bothers me and I'm
just going to go onto my terminal
now.
I've already if I do a ping
Zayd does can you'll see that this is my IP address on my website and if I do a ping on one of the Web
sites that exist and it's for now we're using really bothers me.
So if I go Pinki Riva with me you'll see that both Web sites have the same IP address.
This means that both Web sites are installed on the same computer.
And if we could hack into one of them we can literally just navigate from that Web site into the other
from our military tertio or from our ph Richelle or any type of shell that we're using.
Another way of finding web sites on the same domain is using bank and it's a really simple way.
So if if you just go on being
and I'm just going to put IP and then I'll put the IP of my target website again you'll see all the
other websites that exist on the same server as your target website.
So you can literally hack into any of these Web sites and from there hack into my web site and gain
access to it.
This is very important because in many cases your target could be very well secured but the server itself
is not secure so you can manage to hack one of the other websites and then navigate through the server
to your target.