Hello everybody and welcome to the website.
Penetration Testing section.
Now before we begin with explaining some of the basic terms and things you'll need to know we.
Let me just show you where you can download the intentionally impermeable machine the tool used as the
pen testing machine.
So you just go I'll open up your Google Chrome and type this thing into your search bar which is a CPS
source forge dot net slash projects.
That's o w o ASP e w a when you type that it will lead you to this page where you basically just click
here on the download.
Once you click here on the download it should start downloading the one point seven gigabytes large
fire zip file which you which will take some time to install but once it does the process of installing
the virtual machine itself is rather easy and fast.
So since I have already this zip file installed on my Windows 10 host machine I will close this installation
process or downloading process.
You just wait for it to finish and you will basically end up with this file right here on this file.
This file right here which is the OS the broken web apps we end one point two point seven Zi file as
you can see is a file and it is zipped it is the size of one point sixty nine gigabytes and once you
get this file you want to extract it.
So just extract it to any folder you want and you will get all of these files right here.
Now you might be asking why we have all of these in the case right here.
Well we only are interested in the first one which isn't any type of s 0 0 1 0 0 2.
You will use only this one.
And I will show you how to make the virtual machine right now so open up your little box.
Once you extracted all of these files you just go here on the new.
And here you type here the name of your regular machine you can name it call us if you want to.
You sure you pick the Linux and here you pick the open to a 64 bit so find one to 64 bit and just type
your next cannot create the machine folder that's been burned.
OK.
So all that we have this machine so can just type your old USB one and here you can leave it on five
hundred and twelve megabytes it doesn't matter.
So this week you're next.
And under the hot disk you go to the use an existing root or hard disk and you try to find that they
just show you if you open up the extracted folder you want to click on the first one which is the always
broken web apps minus S.L. one dot we indicate.
So you pick that one and click here open and choose.
Once you choose that just click here on create and you created your virtual machine
so in order to start your work machine just click here on start.
And basically it will finish the process of installation the vector machine by itself.
So we'll just wait for it since it doesn't take that long.
After that it will prompt you with the user name and password for the virtual machine which while this
is installing let me write you into the note that file.
So the user name will be where is the equal sign will be route and the password will be a W B W eight.
So once and prompts you with the user name and password just type these two right there.
Now this also as well as not applicable is not a good machine it was basically it is basically a command
line machine so you will all be able to execute comments from here as we can see it prompted us to log
in.
So always be w a log in type here load.
And as a password type here or w e w h o w b.
And once you do that it will locking into your command line and the only thing we want to do from here
is basically consumer our IP address in order to be a part of our local network.
Now be careful you don't expose this machine to the untrusted network as it is a machine full of possibilities.
So if you can just keep it in host only or on the net but in my case I will just put it on the pitch
debtor since I will perform scans from another machine that is also on the bridge adapter.
So we want to make them both belong to our local host.
So in order to do that first of all just close this machine.
So you need to close it up here.
OK.
Go on to the settings for that machine basically which is do the same thing that we did for our clinics
go under network find Bridget adapter and choose your network interface.
Once you do that also make sure cable connected is checked and click here OK and you are set to go.
So right here if we type here if we open up our machine I'll show you what things do we get from it
and in the next lectures I will teach you some of the basic stuff you need to know in order to continue
my testing now just wait for it to blow it up.
And once you get it will prompt you with the name and password.
And once he does that we are good to go.
Our machine is up and running bunch of open vulnerable programs that we can test.
So here you can see it is starting a bunch of these programs
palm cat web server and here it even says in all these cases you can use a root as user name and password.
Always VBA.
So in case you forgot you can just read it from up here and type here the password and it will log in
to you to your command line.
So if we type here once again I have config we will have IP address one wanted to that 168 the quantum
9 which belongs to our local network now.
Let me show you what happens when we receive that IP address.
So just go onto your card machine or from your host machine.
It doesn't even matter.
Open up your Firefox and type here the IP address of your machine.
It will lead you to this page and you will see a bunch of these options right here which you can click
on for example if we go all last right here you will get a bunch of as you can see malicious file execution
information leakage in proper error handling.
This is just a bunch of programs running for you to test and we will cover most of them not all of them
since that will take a lot of time but most of them you can even see somebody log in pages as we can
see authentication required.
We have no idea how to get in here.
But we will find out soon enough as we can see Apache tomcat.
It gives us the version a bunch of vulnerable problems that we will test in the future videos.
But until then you can experiment and see what kinds of things we have right here.
And we will test them later on after I finish explaining some of the basic stuff you need to know in
order to continue.
So this sit for this lecture will cover the HDP protocol in the next lecture and I hope I see you there.
Take care.