Now, let's translate this into our example, so in our example, we're going to be targeting demitasse
floatable machine, so our Web server is going to be demitasse floatable machine and we're not going
to be using Adient as server.
So we're not going to be using a name like Facebook.
Dot com will be accessing the website directly using its IP address.
So like we've seen before, if we just go here to our ATM machine at Tiepin if config.
You'll see that my IP is 10, 20, 14 to 14, and if I go here to Miami to exploit to my Cali machine,
you'll see that if I type in 10, 20, 14 to 14.
You'll see that I can access my mother's floatable machine, so the Web server here is the metastable
machine itself.
The Web applications are Matilde, APHC, my admin, DeVita and all of these.
So these are Web applications.
And when we click on them, you can see, for example, here it's written in.
So it's written in this programming language.
It's also using my e-mail server, which can be accessed through my admin.
So these are just technologies used on the Web server.
But the Web server itself is the most exploitable machine here.
So when you put the IP address, when you put 10 2014 to 14, we're actually accessing the meta exploitable
machine and inside the metastable machine, we have technologies, we have interpretor that's running
code.
We have a Web server and a database.
And these are running the Web application for us, which is Mattilda and all of them.
So no one, these components leave us to knowing how we can hack a website, so there is more than one
thing that we can exploit to gain control over our website.
Now, the main thing, the obvious thing that you think of is the Web applications.
So it's the thing that you always interact with, for example, and Facebook.
It's where you search for stuff and where you upload pictures, where you write posts.
All of these things are handled by the Web application because it's the thing that you click, the things
that you interact with.
So, for example, if I go here on a day and I start browsing the Web page, this is my Web application.
So every time I click on something, it's being handled and executed by the Web application on the Web
server.
So if I could exploit this Web application in some way, if I could gain access to it, if I could connect
to the database, because obviously this Web application connects to the database, then I'll be able
to maybe gain control over the website and maybe even gain access to the Web server and then get access
to other websites on the same server.
We'll talk about all of that later in the course.
The other way of gaining access to websites is using the computer itself.
So let's say you came, your target was divi and you couldn't get and you couldn't find any exploits
in the Web application itself.
You tried everything.
You tried all the exploits that we're going to talk about and you just couldn't get in.
Then your other option would be to exploit the programs installed on that computer because we said a
Web server, the website is installed on a normal computer, just like your home computer.
So if you couldn't get in using the Web applications, what if there is one of the programs installed
on the Web computer, on the computer itself, has an exploit, has a buffer overflow or remote execution
exploit?
What if the Web server itself or the database program, the program that's running the database itself,
had a remote route exploit that allows you to just gain access to the whole Web server, including all
the websites inside it?
So this will be really cool if you could get it.
If you couldn't find anything wrong with the applications installed on the Web server, on the operating
system, then you could target the humans because we know websites are managed by humans.
For example, Facebook, you can target Mark or you can target the admins of Facebook, for example.
These admins obviously have more privileges on that website than you, and then they might be able to
upload sensitive files to that website and then you can control it and hack it by hacking into one of
those people.
So instead of maybe the website is very secure and the server is very secure and there is no way that
you can get in.
But you can always exploit the humans using social engineering attacks and Clydeside attacks to gain
control or hack one of the people that manages the Target website and then maybe gain access to it.
Now, this course will be concerned with the Web application penetration testing sites, concerned with
the first step, with the first approach.
So we're going to learn how to discover and exploit a large number of vulnerabilities that can be finally
found in the Web application itself.
We're not going to be talking about server side attacks.
So the attacks that exploit the operating system and the applications installed on the operating system
itself of the Web server, and we're not going to be talking about the client side attacks, about attacking
humans and hacking their accounts and then gaining access to the website.
All of these these to the last two sections are actually covered into my general ethical hacking course.
So I have a course called The Ethical Hacking from Scratch with which covers those two aspects.
Therefore, in this case, we're going to be focusing on the Web application penetration testing site.
So on how can the websites based on the Web applications installed on that website?