Hello everyone and welcome back to about 20 of my learned ethical hacking course.
In this part I'm going to show you things to look out for when downloading applications.
So this is on some more of the cybersecurity side of due diligence and watching out for certain things.
So like I said cybersecurity and ethical hacking is a lot of your own like I said due diligence.
So basically it's up to you and how you handle situations and what you do to look out for things and
how you can prevent them.
So it's up to you really can't just ignore things.
You've got to be wary yourself so it can be a little bit confusing to the person who doesn't really
know much about computers.
But hopefully this video should clear a few things up if you're not really familiar.
So I'm on the sandbox Windows 10 machine so this is not my separate laptop like in the hacking demo.
This is just a virtual machine running Windows 10.
And if you remember from this course recreate the car image exit of JPEG.
So if you followed the video and created your own one then you should have your own payload.
But it looks like a image apart from the icon because the icon didn't resize properly but it still looks
like an image because you get a preview like this is a real image.
And this is a fake one.
So you see the dot J dot jpg extension so it sort of mimics a real image.
But the thing you can do to look out for this is if you go to properties and I'll open properties on
both
so she can see straightaway it says type of file application.
But on the real image.
So this is the real image which is this one here.
It says JPEG so GP G so you know straightaway that this is an actual image file but if you look at this
one it has type of file application that you see even though it's got dodgy peg at the end it still
says application.
So you can go to details and see the description on the type of file it is.
And if you go to details on the image scroll down and you can see it's got dimensions and pixels so
as you can see there's much more detail with the image that goes into detail but like the pixels the
height.
But on the application it doesn't.
So these are few things to look out for and the sizes and all the thing so as you can see here the size
is only one hundred and fifty K.B. on this one it's 956 K.B..
So for an image depending on obviously the size and the quality note if you go to like four K images
then yes that will be higher but the average is around a hundred K.B. for an image.
So this is a lot larger which isn't unusual and the other thing you can check out for we go to your
Windows 10 machine and type Resource Monitor be open Resource Monitor then we can actually monitor connections
coming in and out of this computer searching table on the browser here.
So let's go to Facebook and if we go to Facebook and we go back to this resource resource manager or
monitor we go to network then you can see all the alcohol connections.
So if you can see here Microsoft Edge CPR you see now this remote addresses
so if you run the payload if we run this payload
official it now it's not going away it can suck on and listen for connection because we haven't got
our Kelly machine open now.
The image is still going to open and we close out now.
We go back to our resource monitor and see this image exit jetpack.
But if you noticed here it says remote address and it's got a port now it's running port 80 because
that's what we tell the payload to do.
But if you noticed here it's got temp barked order actually.
And it's also got a call image that J pack this is the payload.
I know you can see the remote address is an IP address yes the remote port is 80 so that's not really
suspicious.
However the remote address is the most suspicious part because it's sending a connection out to 1 9
2 0 1 6 they don't want to don't want to wait.
Now that's the IP address on my column machine.
And just to prove this in a way if we go to Facebook.
So let me just refresh the refresh the browser and we look for Microsoft Edge so we've got a few remote
addresses from Microsoft Edge which is the browser that I'm running here and it's using pull 443.
So if you wanted to make your payload useful or three That's actually fine to make it less suspicious
80s found in 88 years or so.
OK well it's the remote address server open CMT because we're on Facebook I'm going to ping Facebook
to get the IP address of the servers ping Facebook dot com.
So it's going to just ping it.
Press controls see to stop the.
And as you can see here there's an IP address of the server that we were pinging.
So this is the IP address of Facebook.
Now this may be different for you depending on where you live the area and the closest serve to you.
But for me it's thirty one dot 13 dot 94 36.
And if you notice here the IP address is corresponds to this.
So that proves that we are actually connected to Facebook and it's genuine the local adjust.
Just your IP address.
Well like I said the the one with the image you can just find it.
I think it's closed itself but we rare.
I might reopen and show you but you've seen it.
If it shows you it's gone off because we weren't actually listening for connection so it just dies after
a few seconds.
Well you've just got to look after the rules address and if it's not the same address as a Web site
server and if you don't type if you type this in and go get the IP address of the Web site you're on.
So this could change if you're on Facebook if you're on YouTube it'll change if you're on Google.
But it's got to correspond so you can just do a little test by typing and then the URL.
Then you've got the IP address to make sure it corresponds to the remote address down here on what ever
application you are using.
So this will change for Chrome if using Chrome I think it would just say Chrome or XY but you get the
idea.
So that was a for this short video if it did help please leave a like comment if it stuck with anything.
I'll be happy to help subscribe for future content and I will see you in the next video.