Hi, and welcome back to the Deep dive
into Network. Assessments by Avicii console. This
is section for advanced network
security techniques. In this video, will take
a look at exploring Apache, web server and Rose.
So let's iPhone in
here. We should, I
use the ipde Dr, And we have
a number of network adapters, but I'm connected on
ethernet zero and this is why I shall I be.
So I'm going to copy this on what
you want to do is Saphris. Can I wanted you to see
what are there? Any let's say for example
web servers or no sitting at work to
Dash p o t
t e d t 443 Allen tiresome
that so that's it. We're going
to perform the sky and small.
I so understand just take a few
seconds actually Complete because it's looking for specific Portage
open within our
Network range.
To the scan is complete on. Let's take
a look at some of these. So we can see. Even
though. It's showing Port, 80 + 443 on
these systems to Porters filtered. Let's take
a look at this specific IP address, which is 19216 85611.
Are we seeing? Port 80
is actually open. So that's copied
us IP address. Like so we can
use a tool such as a Nick to Nick to
allows us to actually look for vulnerabilities.
Any sort of sense of information or
let your sense of direction. Maybe leaking
on this web application or
his web server, free and simple
to use and to use
Nick to begin. Simply Titanic 2. Yd.
Each and specify
or Target and let's hit enter.
I'm Nick to will actually identify if
there's a horse named it will check for with a port. It is
open to look at is is profiling the
actual web application for us. So let's give this
a few seconds to complete. Almost completed will analyze
the results a little bit to do. Okay. So
Nicholas completed. Let's curl up and let's
take a look at some of the results that we got. So you
can see the see what type is Apache. 2.2.8., It's
running. Only you going to be system each of
these symbols, which is a plus
icon, soda, plus some bulbs. It's point
out, some type of important information that we
will need to actually take into account
for some type of vulnerability that may exist. For example,
let's take a look at this point
to / P3. And
for the peach P PJ somehow something
seems to be wrong here. It was found.
Well, how do you say is a bad thing from you? This is a good
thing. However, let's take a look at these
particular her references, these references,
give us information. I hate this
song type of peach, be potential, sensitive
information that is being revealed at
this URL. So we can take
the IP address and piece this portion and
Joshy Bill. Entire URL to
find out what is being late or what seems
to be sensitive. Another saying
it's supposed to take a look at this one. This one is
simple. This one is /. Duck / on.
This is some type of sense of direction. Maybe browsable.
So, what we can do, we can open up
a web browser. Let's enter IP address
of Target, likes to type t. O
c, / dancer and look
at is we have access to some sensitive directory,
which regular person should not
have asked.
620 NE on a price with some should not have
access to go down food and we can see if I use
a directory. This might be very important. It might
allow a tractor or let's say a
hacker to perhaps add new user.
So probably scripts at these locations, and look
how much rulers available such things should not
be available. Now the thing with Nicholas,
Nicholas can all the directory off
the server. I look for any sort of vulnerable to
that may exist to each of these points is
something that we need to read and provides a
description on what seems to be the
issue or security weakness.
Furthermore, we can use a built-in Corolla.
What is a tool known as derb? And
Herb allows us to actually a spider
Ivan. Kral website, looking
for some soda. Rectory actually really, really
easy to use. All we need to do is pacified herb on
the actual URL because specified wordless an
additional options. If we see needed more
about to get started, we can simply c, d, i
r v i specified
at Target. I pee and it answer.
Oh, I can, you specify HTTP colon
slash
slash as recommended on it?
Sit until I look. It's actually testing various URLs.
And once we
get a cool 200, it mean to see the actual
web results such as a web page is actually
available. So this will take a few minutes to
complete on. Another thing to remember,
is if we get any tree, one is
most likely a redirecting me to
say, for example, this URL exist.
How do you get a true on switch mean? Three.
One is a redirect screwing up.
We have a lot of sensitive. Direct
result of being reviewed. The cool thing. Is
there. A box really need these lengths hyperlinks. We
can simply click on. Let's see we to copy
link address open a browser
once more
Let's pieces inside here. I hit answer
and look what we got. We actually go to Peachtree apartments
at the beach. So yes, we can
import and tribulations, export considerations, or even
make adjustments here. Let's have a walk
to deserve such as a security professional. What
its network security Social Security, or even information
security going to each of these? Let me
reveal sensitive information. For example, look
at this one possibility. They may
be passwords pops. There might be sensitive user
accounts. Can right-click. Let's copy
to selection wants more. I do go to a
web browser, right? Click on, go on the
actual access, some type of
sense of direction. However, we can even look for additional vulnerabilities
within each of these are trees. So while
there's so much diarrhea trees, that we can browse.
You need to take your time on Google true, the
results of the room and actually look to see whether some
of these directors should be accessible by authorized
users on the Once Upon a Time. Supposed
to be accessed by unauthorized users should
be restricted.
In this video. We took a look at discovering a
web application. You're so take a look at crawling web
servers on how we could use a symbol to such
as food derb and even Nick
to to look for security vulnerabilities, only
tired, web, application in the next video will
be discussing the conclusion of this course. I hope this
for your husband found her for you, and I will see you in the
next one.