Ethical Hacking with Parrot OS – From Linux Basics to Exploitation

[00:00] Welcome to this hands-on ethical hacking [00:02] crash course taught by cyber security [00:05] instructor Declan Middleton. Throughout [00:07] this course, you will learn the core [00:10] Linux fundamentals and essential command [00:13] line tools needed to navigate and audit [00:17] target systems effectively. From network [00:20] scanning and web enumeration with tools [00:23] like inmap, dur search and burp suite to [00:27] exploiting vulnerabilities and writing [00:28] your own automation scripts. You will [00:31] gain practical real world skills. [00:35] Everything is demonstrated safely and [00:36] legally inside a local CTF lab [00:39] environment. So let's dive right in and [00:42] get started. [00:42] >> This is power. It's very similar to Ki [00:45] Linux. Uh not much different really. Uh [00:48] the only thing that's different is [00:50] obviously the brand, the color scheme, [00:52] and maybe a little bit a few more of [00:54] these tools installed. So there's [00:57] striking similarities in both operating [01:00] systems, but again, it really doesn't [01:02] matter what you use. But for this video [01:04] and this showcase tutorial, I will be [01:06] using Power OS for this tutorial. [01:09] Everything's pretty basic, and I'm not [01:11] going to really walk through too much of [01:13] the Linux basics. Uh if you've seen them [01:16] if if you've seen my basic Linux [01:18] terminal commands in my other video, you [01:20] can go check that out. Um but let's just [01:22] do a quick walkthrough on the basics of [01:24] Linux again just for those who may not [01:26] understand. So this is a terminal. Uh a [01:29] terminal is a this window here. So if [01:32] you click this, this is a terminal and [01:34] it's a terminal emulator that emulates a [01:37] environment where you can navigate files [01:40] on your system. So for example, if I [01:42] type in ls, it's going to list the files [01:45] and folders on my machine. So that's [01:47] what the command ls does, right? And if [01:50] I want to change to my desktop [01:52] environment in the background, I can [01:54] type in change directory cd. That's what [01:56] it stands for. CD desktop, the folder [01:59] name as you can see right here. So if I [02:01] type in that, you can see I've it says [02:03] I've changed into this directory. And if [02:05] I type in ls, there's nothing here. So I [02:08] can create a folder by typing mkd make [02:11] directory and I'll just say folder and [02:14] there we go. You can see this folder [02:16] here has appeared on my desktop and if I [02:18] want to remove it I can type in remove [02:21] remove and then folder and then it's [02:25] gone. Okay. So by the way this means [02:28] recursive but it does remove the folder. [02:31] So anyways that's just the Linux basics. [02:33] I don't want to really show that again [02:35] because I've already done that in my [02:36] other videos. So you you guys you can [02:38] just search up Linux commands on Google [02:41] or you know watch another YouTube [02:43] tutorial or even my YouTube tutorials on [02:45] the basics of Linux uh Linux commands [02:49] etc. So you guys can go watch my [02:50] tutorial on how to do that and you can [02:52] replicate you can replicate what I've [02:54] done in my other videos into this video [02:56] as well because it's a terminal and you [02:58] can do everything with a terminal. So [03:00] again, this is a terminal and it allows [03:02] you to navigate and search and find [03:05] files on your system as well as run [03:08] commands and tools on the machine. So if [03:11] I want to run the popular tool inmap, I [03:13] can type in inmap and you can see here I [03:15] can go ahead and type in these commands [03:17] here to use the tool. So anyways, so the [03:20] first commands that we should run to [03:22] ensure that our system is up to date is [03:25] to run the following commands. pseudo [03:28] apt update-y [03:30] which means yes and let's type in and [03:33] and which is going to be the and [03:35] operator that will allow us to run a [03:37] second command. So we can do pseudoapp [03:39] upgrade like this. So go ahead and type [03:42] the following commands to run to update [03:46] our operating system for power os. So it [03:49] just updates the Linux distribution that [03:51] we are using which is power OS and it [03:54] allows us to ensure that all the [03:56] packages and dependencies are up to date [03:58] so that the tools are working the Linux [04:01] distribution doesn't have any bugs or [04:03] flaws or whatever the case is. It just [04:05] makes sure that we update everything [04:08] packages tools Python versions pip [04:11] versions whatever we're going to use [04:13] it's going to be up to date. So let's go [04:14] ahead and run this. It might ask for a [04:16] password and if it does that just enter [04:18] parrot if you're using the default [04:20] password parrot or you've got your own [04:22] password just enter that and and upgrade [04:24] it. So you can see here mine's already [04:26] fully upgraded. So go ahead pause the [04:28] video do that and then come back to the [04:29] video once it's finished. And again I [04:32] would like to address this. If you want [04:35] to continue learning I have a school [04:37] community for you to check out. The link [04:39] is in the description below. Everything [04:41] in this community is for educational [04:43] purposes and you can level up have [04:45] access to these courses which is [04:47] available within the community. If you [04:49] want ongoing further learning, these [04:52] resources will be linked below for you [04:54] to read and check out yourself. It's a [04:56] private community and you have access to [04:58] courses and resources for further [05:00] learning. Before we get into hacking [05:02] tools, it's important to understand how [05:05] to move around the system, create files, [05:08] manage folders, and read basic command [05:12] output because this is what you're going [05:13] to be doing most of the time. The [05:15] terminal might look intimidating at [05:18] first. It's just a way to control the [05:20] computer using text commands. So, I have [05:23] shown a tutorial before in my Kali Linux [05:26] video on basic Linux commands, but I'm [05:29] happy to run through it again just for [05:31] beginners and people who may not [05:33] understand too much about Linux. So, [05:35] every hacker uses Linux because every [05:37] command that you type in here, this [05:40] terminal performs a function. It [05:42] performs an action. So, if I type in ls, [05:45] you can see here it lists my folders and [05:47] directories, files, etc. So again, the [05:50] terminal might look intimidating at [05:53] first, but it's just a way to control [05:55] the computer using text commands. In [05:58] Power OS and most Linux systems, you [06:00] would use the terminal constantly. So [06:02] getting comfortable with the basics will [06:04] make everything else much easier. So the [06:06] first command I want to show you is ls. [06:08] So we can see that lists folders, files. [06:12] If I do ls-la, [06:14] I can see more detail including hidden [06:17] files, permissions, owners, file sizes, [06:20] and dates. If I want to print the [06:22] working directory, I can also type in [06:24] pwd, which shows me the current [06:27] directory I'm in. So, if I change the [06:29] directory to desktop and I type in pwd, [06:32] print working directory, it's just going [06:34] to tell me what like folder I'm in. So, [06:37] pwd tells me what folder I'm in. So [06:40] let's say I type in ls- a to see if [06:43] there's any hidden [snorts] files or [06:44] folders. Okay, there's nothing here. If [06:46] I want to create a folder, I can use the [06:49] mk dur command. So let's create a [06:51] folder. MK dur, which stands for make [06:54] directory. Let's call it folder. Folder [06:57] [snorts] [06:58] one. ls. There's our folder. Now if you [07:02] want to see where the folder is, we can [07:04] actually see here it's on our desktop. [07:05] Folder one. I can make another one. Go [07:08] ahead and make folder two. Have you done [07:10] that? Okay, let's create folder two. [07:13] There we go. We've got two folders on [07:15] our desktop. Let's go into folder one. [07:18] Let's type in ls. Obviously, there's [07:20] nothing in here. As you can see, if I [07:22] double click on here, we can see that [07:23] there is nothing in this folder because [07:25] we just created it. Let's actually [07:27] create a text file. So, if we type in [07:30] touch and then we'll just say uh let's [07:32] just say hello.ext. Now, if I actually [07:35] open that folder, you can see I created [07:37] a file called hello.ext. It's a text [07:39] file. Now, if I want to edit this file [07:41] and add something in it, obviously I can [07:44] open it and do it manually. But since we [07:46] are going to be working around in our [07:47] command line, we don't need to do that. [07:49] We can actually just do this. So, if I [07:52] type in now, most people use nano. And [07:55] if you've seen this before, nano is a [07:57] command to edit the text file. So, I [08:00] could do nano spacehello.ext. [08:03] And here we go. I can edit the file. So, [08:05] if I press enter, I can move down the [08:07] document. If I press tab, I can move [08:09] across the document. So if I say hello [08:11] there, hello there. Thanks for reading. [08:14] Haha, it's just a text document. Lol. [08:18] Almao, [08:20] nothing in Oh, nothing in here. [08:24] Subscribe. And if you don't subscribe [08:27] and if you don't subscribe, [08:30] I'mma hack you. [08:32] Okay, that was a joke. I'm not going to [08:34] say that. And by the way, if you want to [08:36] delete a line, this is what I want to [08:37] say. Oh, by the way, let me just do [08:38] this. If you want to delete a line, you [08:41] can press control K or command K if [08:45] you're on Mac. Well, I'm also on Mac. [08:47] I'm pressing control K. Um, so if you [08:49] press Ctrl K, you can delete a command. [08:52] Okay, that's great. Now, if you press [08:54] Ctrl X and then press Y to save it and [08:58] then press enter. There we go. So, let's [09:00] do that again. Nano hello.ext. So, we [09:03] can enter the document. We can read it. [09:04] Press Ctrl X to leave it. We don't need [09:07] to save it because we haven't made any [09:08] changes. Now, you can just play around [09:10] with that if you want. So, if I type in [09:12] ls, there's our file. Now, how do I read [09:14] the file without nano? So, we could do [09:16] cat hello.ext. So, if you just want to [09:19] print it in the terminal instead of [09:21] opening the document using nano, you can [09:23] just say catello.ext, right? Or any text [09:25] document. Uh, but you can't do it with [09:27] folders. Uh, hello there. Thanks for [09:29] reading. Haha, it's just a text [09:30] document. Text documents. I put I put an [09:33] s at the end. Lol. Okay. Anyways, so [09:35] there's our file. And by the way, if I [09:37] go out here and I show you, you can see [09:39] there is our text document. Hello there. [09:41] Thanks for reading. Now, if I make [09:42] changes here manually and I save it, you [09:44] can you can actually see that in here, [09:46] right? See? So, that is how we kind of [09:49] navigate around that. Okay. So, let's [09:51] just take a step back cuz I went a [09:53] little bit too fast. Okay. So, we [09:55] created two folders, right? I'm not [09:57] going to do anything with folder 2. I [09:59] just wanted to create it so you can get [10:00] comfortable using these commands. So if [10:03] I do ls, that's what's inside our file. [10:07] Now to go back outside the folder, we [10:09] can type in cd dot dot. So change [10:11] directory dot dot going backwards. Now [10:14] you can see we've got folder one, folder [10:15] 2. So let's just go back into folder one [10:18] ls. We can use nano to create text [10:20] files, right? We can also use touch to [10:23] create text files. But the thing is if [10:26] we want to view a file, I typically use [10:30] micro. So nano and micro is similar. [10:34] It's the same thing, but micro is better [10:36] because it has advanced features like [10:39] syntax highlighting. You can even add [10:41] plugins like customize plugins if you [10:43] want. But I I typically use micro for [10:45] doing stuff like this. It's the same [10:46] thing. You just press S and then you can [10:48] actually just press control Q. Uh it [10:51] says, do you want to save changes? I [10:52] just press yes. Um, so micro is probably [10:54] probably a lot easier than nano or [10:57] something like vim. Um, I'm not going to [10:58] really show vim to any Linux users out [11:01] there. I'm not going to show vim because [11:02] it might be too complicated for [11:04] beginners. Okay, so let's just take a [11:06] step back again. So if I open up my [11:08] terminal now, this is what I want you to [11:11] do. Go to your directory, your desktop [11:14] directory. Okay, that's great. Is there [11:17] anything here? ls folder one, folder [11:20] two. Let's create folder three just to [11:22] get comfortable. Now let's say I want to [11:24] remove these two folders here. I want to [11:26] remove folder two and folder three. So [11:29] you do this remove and then recursive [11:32] folder two. [11:35] You can see there I've only got folder [11:38] one and folder three. Now let's remove [11:41] folder three. [11:44] There we go. We've only got folder one [11:47] as you can see here. So, [11:51] we've got folder one and if I go into [11:54] folder one, we've got that text file as [11:56] you can see there. Let's remove the text [11:58] file and let's actually see what it [12:00] looks like in real time. So, before I [12:03] run this command, let's actually see if [12:05] it doesn't. There we go. It disappears. [12:08] It gets deleted. So, this is the power [12:10] of the terminal. The terminal is an [12:13] emulator that you can type text commands [12:16] in to receive an output to receive [12:20] whatever the computer you're telling the [12:21] computer to do. So the terminal does [12:23] that. The terminal is very useful to [12:26] type commands, receive an output, and [12:28] even like run hacking tools and [12:30] everything else that we'll get into. So [12:32] that's the the power of the uh terminal, [12:35] the command line. It's very helpful to [12:37] navigate through files to run programs [12:40] in the terminal to see errors or [12:43] whatever results we want to get or [12:45] whatever we want to do. So go ahead and [12:47] pause the video and go back a directory [12:51] and delete folder one. [12:54] Have you done that? Okay, great. So [12:56] let's type cd dot dot. Let's type in ls. [12:59] So we got folder one. Let's remove [13:01] folder one. And there we go. Folder one [13:03] has now been deleted. as you can see. So [13:06] that's just the basics of the command [13:09] line. So print working directory, we've [13:11] got desktop ls lists the files. LS- A [13:15] lists hidden files or folders. ls [13:18] space-la [13:20] let you see more detail about owner [13:23] permissions of the files or file sizes [13:25] and dates. As you can see here, you can [13:28] see the dates of the file, the user and [13:31] the permissions of that file. So if you [13:34] press Ctrl L on your keyboard, it clears [13:37] the terminal. So if you have like a [13:38] bunch of like terminal outputs and you [13:41] want to clear the terminal, you can type [13:44] clear like this, right? You can type [13:47] clear like that, but I don't do that. I [13:49] typically do Ctrl L. So I'll do that [13:52] again. Ctrl L. So instead of typing in [13:57] clear all the time, clear, you don't [13:59] need to do that. You just press Ctrl L. [14:00] Okay. Now, if you ever have access to a [14:03] Linux machine, but you want to show the [14:06] current logged in user, you can type in [14:10] who am I. So, I typically do this in [14:14] CTFs, the capture the flags. So, if I [14:17] ever get access to a Linux machine or a [14:19] Linux box or SSH session, I can type in [14:23] who am I. I can also type in to show the [14:25] computer's name. So, I could say host [14:27] name. So, host name, that's the [14:28] computer's name. So it would say [14:30] something like parrot or ki Linux or [14:32] yubuntu or you know whatever whatever [14:35] Linux distribution it's running which is [14:36] very helpful. But if I want to show even [14:39] more information about the system like [14:42] I'm talking about version here I'm [14:44] talking about the version of the the [14:46] kernel information. So if I type in [14:48] unnamer r it's going to list and show [14:52] system and kernel information. [14:56] Wow that was so amazing right? You [14:58] probably thought, "Wow, that was [14:59] amazing." Honestly, that that wasn't [15:01] really satisfying. But you can see here [15:03] we've got information about the Linux [15:05] kernel. Now, what is the Linux kernel? [15:07] The Linux kernel is the Linux [15:10] distribution operating system. So, we [15:12] are running parrot, which we got from [15:14] the host name command. So, if I type in [15:16] clear, press Ctrl L. If I type in host [15:18] name, that's the name of the computer. [15:20] If I type in unnamed- R, that's the [15:23] Linux, that's the power OS version of [15:25] this Linux system. Now another Linux [15:27] command which is very helpful is to see [15:30] what network interfaces and IP addresses [15:33] are on our basically on the system. If [15:35] you want to see what your IP address is [15:38] for this machine your computer your [15:40] parados machine you can type in IP space [15:44] and then just a so IPA will list. Now [15:47] this looks a bit scary but just scroll [15:49] up a little bit. If you see this inet [15:53] this would be your IP address. Now it [15:55] says local host right? This is just my [15:57] local host IP address of course because [15:59] it's actually shared uh it's sharing my [16:02] systems address. You can see your IP [16:04] address information here. Another [16:06] command to do this would be pseudo if [16:10] config which actually provides you again [16:12] the same thing same detail of your IP [16:16] address which would be here. It would be [16:18] here. So what I typically do to filter [16:21] out all this information, so when you [16:23] see all this information, it can be [16:24] quite hard to read and it can also be [16:27] quite overwhelming for some people. So [16:29] what you can do is type in pseudo if [16:31] config and then you can do pipe. So this [16:34] is like this pipe command. You could do [16:36] pipe and then do grip in net. So [16:40] essentially what this does, it just [16:43] filters out that keyword. So, for [16:46] example, have you ever been on a website [16:47] and you did like command F, you know, or [16:50] control F to like find a specific word [16:52] on a website? This is what the grip [16:55] command does on Linux. So, let's say I [16:58] want to just like grip this output. So, [17:00] I could do this again by doing grip and [17:02] then um 12, which is just local host, [17:06] right? So, it just filters out all that [17:08] information just to find this specific [17:10] thing here. So I could do grip look for [17:13] the keyword net mask and you can see [17:15] that it does the same thing. If I type [17:17] in L, you can see every any word that [17:20] includes L in it. So that's what the [17:22] grip command does. Another command that [17:24] I want to show you is the ping command. [17:28] P I N G ping. If I type in ping-h [17:32] this is going to bring us a help menu to [17:35] understand how we can use this command. [17:38] So we can see here again a lot of [17:40] options. So these on the left is what [17:43] you call arguments. Arguments allow you [17:46] to run the tool the way you want it to. [17:49] So for example, if I use this argument [17:51] when I run the tool, this is what it [17:53] does. If I want to use this argument [17:55] here, I can set this seconds between [17:58] sending each packet. So anyways, let's [18:00] actually see what this tool does. So if [18:02] I type in ping and then you want to get [18:04] an IP address of something, this command [18:07] basically tests internet connectivity. [18:10] That's all it does. So if you want to [18:12] ping let's say a website to see if it's [18:14] running or if you want to ping uh your [18:16] own web server to see if it's running, [18:18] it basically sends packets like just [18:20] basic packets to see if it's up and [18:22] running and it will come back with the [18:23] result. So for this example, I'm going [18:25] to use my modem as the web server. Well, [18:29] it's not a web server. It's basically my [18:30] modem. it's my router. If my router is [18:33] running, I can ping it. If it's down, I [18:35] can also ping it, but it's obviously not [18:37] going to bring it back a response. It's [18:38] going to say that the host is down. So, [18:40] if I type in pseudo net discover, I can [18:43] basically see what devices are on my [18:45] network. So, net discover is a command [18:48] to see what devices are around you on [18:51] the network, on your current network. [18:52] So, whatever Wi-Fi network you connect [18:54] to and you type in net discover, it's [18:57] basically network discovery. Network [18:59] discover. It's going to discover all the [19:01] devices on your network or on a network. [19:03] And it's also going to supply the [19:05] information about the IP address, the [19:06] MAC address, and even maybe the host [19:08] name. So, you can see there some of them [19:10] may be unknown. Um, but you can also [19:12] just like grab it and probably inmap it, [19:14] which we'll look at later. Um, but here [19:16] is my modem. That's my modem address. [19:18] That's my router, which is giving me the [19:20] internet connection. So, if I do ping [19:23] 192.168.1.1, [19:26] uh, it says the network is unreachable. [19:28] Let's do pseudo. network is unreachable. [19:31] Why is that? I can see why that's [19:32] happening because it's not actually. So, [19:34] this is a perfect example. If I try and [19:36] ping this, it says network unreachable [19:39] because my Power OS machine is actually [19:41] not really connected to the internet [19:43] just yet. Uh, so I'm not actually [19:45] connected to the Wi-Fi yet. It says I'm [19:47] wired, but the virtual machine is [19:49] actually bridged. Uh, it's not bridged. [19:51] So, I don't actually have a IP address [19:53] assigned to my machine because I'm not [19:55] connected to the router yet. So this is [19:57] actually the response that you would get [19:58] if the network is down or if a website [20:01] is down. It just means that your device [20:03] doesn't know where to send the packets, [20:05] right? So this usually points to a [20:06] missing IP address, a disabled network [20:09] adapter or a invalid default gateway. So [20:12] my device needs to know which router to [20:14] use. Uh basically so I can try and [20:17] verify my default gateway to connect to. [20:20] So, if I type in IP route show or [20:23] actually that's probably not going to be [20:24] best because if I do if config like we [20:27] saw earlier, um you can actually see [20:29] here that it's just local host. So, I [20:30] don't actually have an IP address [20:32] assigned to me yet. So, I might need to [20:34] kind of renew my connection. So, there's [20:36] a lot of like other network commands [20:38] that we can do uh to connect to the [20:40] Wi-Fi, you know, through our terminal, [20:42] but that's not for this tutorial. I will [20:44] just do it manually. So, I've got it [20:46] working. So if I type in IPA A, we can [20:50] still see that now I have a assigned IP [20:54] address to my machine of course. Um but [20:57] this is actually your local host one, [20:59] right? But if I do pseudo ping [21:02] 192.168.1.1 [21:04] which is my router and I press enter now [21:06] it's going to send packets to the router [21:08] and it's going to bring it back to see [21:10] if the router is running. So now since [21:13] I'm connected properly, the packets are [21:15] being sent and it's bring being brought [21:18] back uh giving me the response that okay [21:21] 64 bytes from 192.168.1.1 [21:25] is up and running. So it basically sends [21:29] bytes packets and it receives it back. [21:31] It comes back to you to give you [21:33] information if it is running or if it's [21:36] down. That's just to test the network [21:38] connectivity. So that is what the ping [21:40] command does. So you can see there 44 [21:43] packets transmitted, 44 received, zero [21:47] packet loss. That is brilliant. So it [21:51] gives us some basic information about [21:54] the address ping statistics. [21:57] That's brilliant. So you can do this [22:00] with a website or you could also do this [22:03] with a address on your network. The next [22:05] command that I want to show you is a [22:07] Linux command to actually see what [22:10] commands you've already ran. So, kind of [22:12] like how you would go in a website or [22:15] like your browser, right? If you open up [22:17] your browser and you go to browser [22:19] history, you can see all the websites [22:22] you've browsed and been on. The same [22:25] thing is for Linux. So if you type in [22:28] history in your terminal and you press [22:31] enter, you can see all the commands that [22:33] we've typed in the terminal so far. This [22:37] is very helpful for us because we can [22:39] actually when we're on a Linux machine [22:41] or a device, we can type in history to [22:43] see what previous commands were running [22:45] or have been running or ran on the [22:48] machine. So as we can see here, these [22:50] are all the commands that we ran prior [22:52] at the beginning of the video. Now, it's [22:54] got 723 commands that I've actually ran [22:57] before this video. Pretty cool, right? [22:59] So, that's what the history command [23:01] does. It just shows previously used [23:04] commands. The next command that I want [23:06] to show you is a command called man. Man [23:09] stands for manual. So, the man command [23:13] in Linux is actually a manual command, [23:16] meaning you can open up any command with [23:18] a manual. So let's say I want to learn [23:21] about how the ls command works better. [23:24] So you can type in man space ls and it's [23:28] going to give you a manual list of what [23:31] the ls command does. So we can see here [23:34] the name of the Linux command is ls [23:37] which stands for list directory contents [23:39] and we can read more about it. It lists [23:41] information about the files the current [23:43] directory by default sorts entries [23:45] alphabetically. So you can read about [23:48] like more of like ls commands you can [23:50] run and what the ls command does. So in [23:53] order to leave this you can just press [23:55] shift colon and then press q to quit. So [23:59] let's say I want to learn more about the [24:01] history command. So if I type in man [24:04] history we can understand how Linux [24:07] commands work with the manual Linux [24:09] command. It's just a very helpful way to [24:11] understand a command or to understand [24:14] something on Linux if we do not [24:17] understand it. So the man or manual [24:19] command is very helpful because we can [24:21] learn about other commands better. So I [24:24] want to know let's say n mapap. I want [24:26] to open the manual for the n mapap [24:28] command. So if I type in manual for the [24:31] mm mapap command, it's going to tell me [24:32] everything about what the map command [24:35] does or what this tool is about. So in [24:37] MAP if we run the in MAPAP command, it's [24:40] a network exploration tool that probes [24:42] ports and we can read more about it. So [24:45] anyways, that's the manual command. If [24:47] we want to update a Linux operating [24:49] system to ensure that nothing breaks, we [24:52] can type in pseudoapp [24:54] update. Now I did show you this in the [24:57] beginning. Pseudoapp update basically [24:59] runs as a pseudo privileged user and [25:02] then the apt command is a command that [25:06] updates the operating system. So apt is [25:09] a package manager for this Linux [25:12] distribution. So what is a package [25:14] manager? A package manager manages [25:17] dependencies packages on the current [25:21] system or folder or directory. So the [25:24] apt or apt command is a package manager [25:27] that we can use to update the current [25:30] operating system. As you can see here, [25:33] [snorts] all packages are up to date. [25:35] That's great. So all the packages are on [25:38] our system are up to date. All the [25:39] Python programs, the Python, the Pearl, [25:43] the whatever else, right? It's all up to [25:45] date. That's great. So if I type in [25:46] pseudoapp [25:48] upgrade. So I want to upgrade installed [25:52] packages already. I can type in upgrade. [25:55] But there's nothing to upgrade. [25:56] Everything is upgraded and everything's [25:58] updated. So that is all the commands [26:00] that we need to do. Okay. So now that [26:02] we've looked at those commands, let's [26:05] dive a little bit more into files, [26:08] folders, and permissions. We have [26:11] already done this a little bit. Um but I [26:13] want to kind of go a little bit more [26:15] into detail with you know the types of [26:18] um ways to not only create these files [26:22] write into files uh but like copy and [26:25] move files and a whole other bunch of [26:28] other commands that I want to show as [26:29] well. So we already learned how to make [26:33] a directory. Uh we've also learned how [26:36] to create a folder. Did you know that [26:38] you can create a empty file uh using the [26:42] echo command in Linux? So the echo [26:46] command is a very helpful command [26:48] because because we can actually echo [26:50] something into a file. Um so for [26:53] example, if I type in ls, let's go to [26:55] our desktop. So cd uh desktop, we can [26:58] see there's nothing here. Um but if I do [27:00] echo and then strings, these are this is [27:03] what you call a string. So a string is [27:05] basically where we can um add text into. [27:09] So in order to add a string you do [27:11] double quotations. You can also do [27:13] single quotations but it has to be [27:15] inside the string here or else it's not [27:17] going to work. So we could do hello [27:21] parrot OS and then we can type in [27:24] notes.ext. So notes.ext text doesn't [27:27] exist. But essentially what we are doing [27:29] is we are echoing we are writing this [27:32] piece of text here into a new file that [27:36] it's going to automatically create [27:39] called notes.ext. So if I press enter [27:42] you can see in the background it has now [27:44] created a nodes.ext file. And if I type [27:47] in cat we can read the file. I I put js [27:50] I mean text. There we go. Hello parrot [27:53] OS. So that is a very helpful command [27:55] because if we want to instead of doing [27:57] everything manually where we have to [27:59] drag something and copy it and then go [28:01] back to the file and open the the text [28:03] file and paste it, all we can do is just [28:05] type an echo and then paste whatever you [28:07] want to paste. It could be a very long [28:09] long long thing. It could be like a long [28:11] as uh string here that you can just echo [28:14] straight into nodes.ext. And also if you [28:17] want to so you can see here it says [28:18] hello par. This is the top text, right? [28:21] But if you want to add another line, you [28:23] can do this as well. So if we do [28:25] nodes.ext, we can see there it's added [28:28] it on the second line. Um, so if you [28:31] want to change the first line, uh, let's [28:34] just clear this. Let's do echo. So cat [28:37] note.ext. So that's what it shows there. [28:40] If you want to remove the first line and [28:42] add something else, we could do echo [28:45] removed the first line nodes.ext. So [28:49] make sure that you have a single uh [28:52] write operator here and then if you [28:54] press enter you can uh cat the file you [28:58] can you can see that it removes the [29:00] first line and second line uh that's [29:02] amazing. So yeah echo the echo command [29:04] is very helpful because it creates a new [29:06] empty file with data which is a string [29:09] which is text into that file which is [29:11] very helpful because it writes that text [29:14] into a file. Uh, another helpful command [29:17] is to let's say that we want to copy [29:20] this file. So, instead of doing this, [29:22] what most people will do is literally [29:24] just like rightclick this and copy it [29:26] and paste it to create another version [29:29] or like a copy of this file. Instead of [29:31] doing it manually, what we can do here [29:33] in the terminal since we have the file [29:35] here displayed already is we can say cp [29:39] which stands for copy copy the nodes.ext [29:41] file into a new uh nodes.ext file. There [29:45] we go. So now you can see there is two [29:48] text files that have been created. And [29:50] if I do notes.ext, you can see that's [29:53] the first one. And if you want to see [29:55] the second one, you just do cat new [29:57] nodes.ext. And you can see you can echo [30:00] something new into the new nodes.ext [30:05] file and cat it as well. [30:09] You see that? It's different. Pretty [30:12] cool, right? So, let's go ahead and uh [30:14] delete these. Now, by the way, if you [30:16] want to delete more than one thing, this [30:19] is a very helpful command. Let's just [30:20] say that there's so uh many like text [30:24] files, right? Let's just say that [30:26] there's like a bunch of text files. Um, [30:28] in order to remove all these text files [30:30] or to remove all these files in a [30:32] directory, we can type in remove dash [30:34] recursive. Uh, what is the we can type [30:37] in remove recursive recursive force or I [30:41] like to simplify it by saying remove [30:43] fully to it's easier to remember. So [30:46] remove remove fully. So recursive it [30:48] tells the command to go into the file or [30:52] take the file and basically remove [30:55] everything to do with it. and force is [30:57] it just ignores like the permission of [31:00] the file or whatever. You just force [31:02] delete it. So that's what it stands for. [31:04] That's why I say remove fully um because [31:06] it's just a lot easier to remember. So [31:08] anyways, let's say that there's a bunch [31:09] of text files. I want to remove all [31:10] these text files, specifically text [31:13] files. Be very careful here because it [31:15] can be very dangerous. But if you put [31:17] this asterisk, I think that's how you [31:19] say asterisk. Oh, what is it called? I [31:21] just Okay, let's just say star. Can't [31:23] even say it properly. So if we put [31:25] asterisk, do not press enter. Please do [31:26] not. Do not do not do not. And if you [31:29] accidentally did, press Ctrl C quickly. [31:31] Um, but anyways, this is very dangerous [31:33] because it can actually like delete your [31:35] whole operating system. Like I'm just [31:37] talking about the Linux operating [31:38] system. It can delete stuff. Um, so we [31:40] we don't want to do that. What we want [31:41] to do is uh remove remove fully asterisk [31:45] and then uh text. Um, so it specifically [31:49] removes any file uh associated with the [31:52] text file type. So uh and by the way [31:55] this if you were to do this without it [31:57] and you were to run this you still need [31:59] to have permission to run it. You can't [32:01] just delete everything automatically. [32:02] That's why we are not a pseudo user. If [32:05] we were the root user uh basically [32:06] meaning if we were the administrator uh [32:08] and we accidentally ran this by itself [32:10] it would delete the whole system um the [32:12] whole kernel which is very bad. But [32:14] that's why we are not a root user. We [32:17] are just a default user here running [32:18] remove uh recursive forcefully or remove [32:21] fully uh specifically removing the text [32:23] files. So if we do this, there we go. If [32:26] I type in ls, you can see all the text [32:29] files are gone. So it's a helpful way to [32:31] instead of deleting things manually, you [32:33] can just type in remove remove fully and [32:35] then the star.ext or anything. It could [32:38] be js. It could be dot whatever or it [32:41] doesn't even have to be that. anything [32:42] that's ending with a specific number or [32:44] letter, it can just delete the whole all [32:46] of them. Right? So, it's a very helpful [32:48] automatic uh way to delete everything [32:50] that you want to delete. Now, I've just [32:52] created a uh rename me.ext file because [32:56] we we're going to rename it. So, the way [32:58] that we can actually rename uh this text [33:00] file, basically moving it. So, if we [33:03] type in move, this is basically the move [33:06] command. We can move the file to a [33:07] different directory or folder, but we're [33:10] not going to do that. Instead, we're [33:11] just going to say rename. And by the [33:13] way, uh, one helpful thing is if you [33:16] don't want to type this out fully, you [33:18] can just type in the first couple of [33:20] like characters here, letters, and then [33:22] press tab, and then it automp completes [33:25] for you. So, if you have like a long [33:26] like folder name file, you can just [33:28] press tab automatically, and it already [33:31] autompletes what you're going to type, [33:33] which is very nice. So, move this file [33:35] to, and let's call it something else. uh [33:38] new name uh text. There we go. So, if I [33:42] do ls, you can see it changed its file [33:45] name, which is very helpful. You can do [33:47] the same thing with folders, too, by the [33:49] way. But anyways, let's delete this. Uh [33:52] let's just do remove new name.x. [33:55] Brilliant. Everything is looking good. [33:57] This is such a good tutorial so far. [33:59] Please do not forget to like and [34:00] subscribe. Anyways, let's continue. So [34:02] you can see here I ran ls to list all my [34:05] main folders within my home directory of [34:08] my user. But a very helpful command to [34:12] see like a file type or whatever we can [34:17] run this command called file and then [34:21] add a file name to understand what type [34:24] of file it is. So if I type in for [34:27] example this this is a python file. Uh [34:29] this is a Python program called [34:31] Penelopey um which I'll get into a [34:34] little bit later but it is a py file. [34:37] It's a Python file. So we can actually [34:40] run file and then the file name to [34:44] understand what type of file it is. So [34:47] we can see here the file name and it [34:49] says here that this type of file is a [34:52] Python script. So the file command is [34:55] very helpful on Linux because it can [34:58] help you identify the file type if you [35:01] do not know what it is. Sometimes the [35:04] files or just regular files that may [35:08] have been created does not necessarily [35:10] have to have a text file type. So if you [35:13] want to identify what type of file it [35:15] is, you just use the file command with [35:17] the file name uh of whatever the file [35:20] is, right? to [snorts] identify it. Now, [35:23] another command that we can take a look [35:26] at is let's say if I go into this [35:28] directory here, I got to make sure it's [35:30] capital live py. So, this this is like [35:34] this is just like an exploit thing uh [35:36] for a vulnerability and an application [35:38] that I did for a CTF lab. In this video, [35:42] I'm just going to show you this command [35:43] called uh du. Right? So du basically [35:47] shows the folder or file sizes within a [35:51] current directory. So du-sh [35:55] with the asteris asteris or the star [35:58] symbol. We can actually see it lists all [36:01] these files. It lists all the files and [36:03] folders and text files and it tells us [36:06] here on the left side of the screen of [36:08] the terminal the size of the file or the [36:11] sizes in the current directory which can [36:13] be helpful in some cases. So, DU stands [36:17] for disk usage and it's basically used [36:20] to estimate and display the amount of [36:22] disk space used by files and directories [36:25] on a Linux system. It just helps us [36:28] identify which files or folders consume [36:32] the most space. Now, I've got a hidden [36:36] text file somewhere on this Linux [36:40] system, but how can I try and find this [36:44] hidden text file on my Linux system? I [36:48] don't know where it is. It's going to [36:50] take me forever to find it. You know, I [36:53] would have to browse it manually to find [36:55] it, right? No, I'm just kidding. You [36:57] don't have to do that. What you can do [36:58] in the terminal is use this command [37:02] which is very helpful. You can use this [37:04] command on Linux called find. Find [37:08] basically finds the file. So in order to [37:10] use this, you have to specify if you [37:13] want to search the whole system. Um if [37:15] you know the file's name, you can try [37:17] and find it and it will locate it in a [37:20] specific directory on the system [37:22] automatically for you. So in order to [37:24] use this find command to find this [37:27] hidden file, we have to search through [37:29] the entire system. So we could do [37:32] something like find slash and then the [37:36] name of the file which was called [37:39] hidden.ext. So if you already know the [37:42] name of the file, that's very helpful [37:44] because then you can find you run the [37:45] find command. Search through the entire [37:48] search through the entire system with [37:51] the name that you've provided to search [37:53] for this file. Now if I run that, you [37:57] might see a bunch of like other stuff. [37:59] It's going to say permission denied, [38:00] permission denied. It's basically [38:02] searching through all these directories [38:04] and folders to find that specific file [38:06] name. And uh unfortunately it doesn't [38:09] look like we actually found it. [38:10] Obviously we don't have permission. So [38:12] maybe we should try and run as pseudo. [38:15] And let's see if that makes a difference [38:18] um at all. So let's try again but with [38:20] pseudo meaning we have root privileges [38:23] to search through the system to find [38:25] this file name. There we go. Look at [38:26] that. Here's the hidden.ext file. It's [38:29] in the opt directory. Let's type in cd / [38:32] opt [38:34] optional directory ls. There it is. [38:37] There's the hidden text file. Is there [38:38] anything in it? Yes. It says subscribe. [38:43] And again, I would like to address this. [38:46] If you want to continue learning, I have [38:48] a school community for you to check out. [38:51] The link is in the description below. [38:53] Everything in this community is for [38:55] educational purposes and you can level [38:57] up have access to these courses which is [39:00] available within the community. If you [39:01] want ongoing further learning these [39:04] resources will be linked below for you [39:06] to read and check out yourself. It's a [39:08] private community and you have access to [39:10] courses and resources for further [39:12] learning. We're going to do something a [39:15] little bit exciting here. We're going to [39:17] take a look at a little bit of some uh [39:19] bash scripting which I'm pretty sure you [39:22] may or may not be familiar with. So [39:24] there's a thing called Bash, right? And [39:26] it's basically a Linux scripting [39:29] language. It's actually just a regular [39:31] uh scripting language or programming [39:33] language that you can use to basically [39:36] automate stuff. Pretty cool, right? So, [39:39] um, let's actually go ahead and just [39:41] remove this hidden file, uh, off my, uh, [39:44] out of my optional directory. I don't [39:46] need it. I'm going to go cd back to my [39:48] home directory and back into my desktop [39:50] directory. Um, so we can do some stuff. [39:52] So, now let's create a file called uh, [39:57] let's just call it program.sh. [40:02] So, we're just calling it program.sh. [40:06] Uh, it's just a regular program. You can [40:08] call it whatever you want, right? You [40:10] can even just call it script, right? So, [40:12] let's just create a basic script here. [40:14] Okay. [snorts] Or or let's just do Yeah, [40:16] let's just do script. So, we've got our [40:18] script here, script.sh. Now, let's go [40:22] ahead and edit this file uh to add some [40:26] bash code. So, the really cool thing [40:29] about bash is that we can do uh a lot of [40:32] things. Basically, we can automate [40:34] things. We can automate stuff. We can [40:35] even automate commands. So instead of [40:38] doing everything manually, we can just [40:39] add or program a script to do it for us [40:42] with u basically bash. So let's say that [40:45] we want to list a file. So we could [40:47] literally just do ls- a, right? And just [40:50] save it and then press q. You can also [40:53] do that with nano if you want. So if I [40:55] do catch uh script.sh, [40:58] we can see we've just got this line uh [41:01] this this command here ls- a uh in this [41:05] sh script. Now we can go ahead and run [41:07] it by doing this uh dash oh sorry dot [41:10] slashcript.sh [41:12] or you could do bashcript.sh [41:16] permission denied. Okay. So this is [41:18] exactly what I want to show you. So if [41:19] this happens to you it's because the [41:22] file type this file is uh doesn't have [41:24] the permissions to run. So let's give it [41:26] permissions. So the way that you do this [41:28] is you basically do chod [41:31] where we actually change the permission [41:34] or the common permission for executable [41:36] scripts. Uh we could give the owner [41:40] which is the user um read and write [41:42] access right? So we can read it, write [41:44] it, run it. Um so we could do chod uh [41:48] 755. Uh there's specific codes that you [41:52] can use. So you could do 755 777. uh [41:55] we're just going to do 755 with the [41:57] script name. So if you do that and now [42:00] if you run it dot /script.sh sh. Now you [42:03] can see that it successfully listed the [42:06] files uh within the current directory [42:08] which is literally just that right so [42:11] let's go ahead and edit our script so it [42:13] basically automates this by running the [42:14] command that's in here so if we want to [42:16] like let's say hm let's let's do this so [42:19] we've got the script right but I want to [42:20] create five or seven folders here on my [42:23] desktop just to show you you can just [42:25] you can just do this make directory [42:27] folder one or just do folder one and [42:30] then folder two folder Now, by the way, [42:33] you don't have to do that. U there's [42:35] other ways to do that, but let's just [42:36] say make folder 2 blah blah blah. Now, [42:38] let's save that. Now, let's go ahead and [42:41] run it again. There we go. It created [42:43] two folders automatically for us. So, [42:46] bash scripting is very helpful because [42:47] we can actually uh script stuff or add [42:50] uh Linux commands within the bash script [42:52] to basically automate uh what we want to [42:55] run. It doesn't have to be Linux [42:56] commands. You can actually write bash [42:58] code, bash scripting to actually script [43:00] it. So I found this devdocs.io/bash [43:03] io/bash which is basically a it's a [43:07] website where you can read more about [43:09] the programming language itself right [43:11] you can actually search up any uh [43:13] programming language here it could be [43:14] Python you have to change in the URL so [43:16] it could be Python it can be JavaScript [43:20] whatever but look we are just taking a [43:22] look at bash so documentation is [43:24] important what is documentation [43:27] documentation it's everything to do with [43:29] the programming language it's like a [43:31] manual this is like the bash Bash manual [43:34] page for learning about the bash [43:36] programming language or scripting [43:38] language uh to understand it better. So [43:40] we can go to any of these areas and [43:43] actually look at what is all of this [43:46] about. So shell syntax is when this [43:49] shell reads input blah blah blah. So you [43:51] can read more about it. Um but we can [43:52] actually look at the bash code itself. [43:55] So you can actually see some bash code. [43:57] Um, we can even take a look at what we [43:59] can do or even uh write some basic bash [44:02] scripts here. By the way, you got all [44:04] these bash commands. By default, Linux [44:06] uses bash. Anyways, so for example, [44:08] let's go to this link here from W3 [44:11] schools where we can learn more about [44:14] bash. You can see here we've got some [44:15] basic stuff here like this example using [44:19] variables. So, some basic bash scripting [44:21] here. I'm just going to go ahead and [44:23] copy that. Go back to my script here. I [44:26] just copied those examples from W3 [44:28] schools. Um, but you can actually go [44:30] ahead and uh just take a look at the [44:32] basics if you want to search it up. But [44:33] we can see here this is just some basic [44:36] bash script here. Um, so we can actually [44:39] see here we can assign a value to a [44:41] variable. Um, this is just a basic if [44:44] statement. An if statement allows you to [44:47] basically when you run a program it goes [44:49] like so if the function does this then [44:53] echo this or do this else if it could do [44:56] this an if statement is really cool [44:58] which we'll dive into in this video uh [45:00] with Python not so much with bash but [45:02] bash is very uh a good way to script and [45:05] automate stuff as well. So obviously [45:07] this is number 15. Number is equal to [45:11] 15. Uh if the number is greater than 10 [45:14] then echo number is greater than 10. [45:16] We've got this little script here uh at [45:19] the top. We've got variables here at the [45:21] top. So we got a variable is just a [45:24] stored value. Right? So a variable holds [45:28] data holds a value. So we can call a [45:30] variable anything. It could be called [45:32] anything. So for example, this is a [45:34] variable called name. name is equal to a [45:37] string uh which is world. So this could [45:39] also be anything test, [45:42] right? Um echo hello name. So it's just [45:47] going to echo hello and then the [45:50] variable which is this hello test text. [45:53] Um let's actually change this say hello [45:55] Declan [45:57] Middleton. [45:59] If I go out and I run the script, uh, it [46:03] says command not found. Okay, so we've [46:06] got an error. Okay, let's take a look. [46:08] Line three, line 8, line three. [46:18] It's probably this. [46:20] Yeah, there we go. So, [snorts] you got [46:22] to remember, you got to make sure that [46:23] this doesn't have any spaces here. Okay, [46:25] there we go. So, now let's run it. It [46:27] says hello Declan Middleton number is [46:30] greater than 10. So you can do whatever [46:33] with bash. Bash is very helpful. You can [46:35] add a bunch of Linux uh bash commands in [46:37] here to run multiple folders and files. [46:40] Uh you can even store your scans or [46:43] outputs into files. So you can write a [46:45] bash script that automates repetitive [46:48] tasks like scanning or creating files or [46:52] folders in a specific directory or [46:53] moving stuff around. So you just manage [46:57] system operations in this Linux [47:00] environment. Now in relation to hacking [47:03] of course we can use bash scripting to [47:06] automate security tools. We can run [47:10] security tools and perform security [47:12] testing using bash scripting so that we [47:14] don't have to repetitively [47:16] run the same command over and over again [47:19] you know. So this is just a example [47:23] beginner bash script. I just got cooking [47:26] here. So, basically what this bash [47:28] script does, it just does basic recon uh [47:31] on a specific target. It could be like [47:33] an IP address which checks to find [47:36] common ports and things like that. So, [47:38] it could just be a URL, but you can see [47:40] here it checks to see if the target is [47:42] online using ping like I showed you in [47:44] the beginning. And you can see I'm using [47:46] if conditionals basically saying, well, [47:47] if the target is online, then echo [47:50] online. else if the target is not online [47:52] please print on the terminal or echo on [47:54] the terminal that the target does not [47:56] respond to the ping uh basically the [47:58] target is not online we can also check [48:00] for common ports so I've added this here [48:03] a list of ports to check through and so [48:06] basically with this ports variable for [48:08] every port in ports checking this [48:11] variable for every port that's in the [48:13] ports all of these ports uh run this [48:15] command so that's what it's doing it's [48:16] running this line of code and then if a [48:19] port is open. If any of these ports show [48:22] here that it's open, then echo open port [48:25] and it displays the port variable [48:30] and echo checking HTTP headers. Uh, I'm [48:33] not really going to do that. So, let's [48:34] just delete this and just say, you know [48:37] what, recon. So, [48:40] like I showed you in the beginning, [48:42] let's remove [48:45] uh folder. [48:47] I'll just say remove uh fold folder one [48:51] uh folder [48:54] two. [48:55] Now I want to call this script. Now [48:58] let's use the move command. Move [49:00] script.sh to recon.sh. [49:04] So it's just renaming it. There we go. [49:06] Now it's renamed. So it's a recon [49:08] script. So we're going to run recon.sh. [49:11] Enter target IP or or domain. Um it's [49:14] just IP. So, we could just let's just do [49:17] my router. [49:20] There we go. It's going to do a ping [49:21] request and it's checking to see if [49:23] those if there's any ports that is open. [49:25] And yes, there is. Look at that. So, [49:27] port 53, port 80, which is running a [49:30] HTTP [49:32] uh web server. So, that's very nice. [49:35] It's running HTTPS. We've got port 8080. [49:38] So, these ports are open uh which we'll [49:41] dive into later about ports. So a port [49:44] is just a open service. That's all it [49:46] is. So it could be a website server [49:49] running. Basically ports have specific [49:51] numbers associated to that service. So [49:54] for example, port 80 and port 8080 is [49:58] associated to a web server. Port 53 is [50:01] just basically the domain name system, [50:05] the DNS. So right now all of this [50:07] information here is just to tell us that [50:09] a website is running on that IP address. [50:12] So if we actually go to that IP address, [50:15] uh it might show a website on that port. [50:17] So pretty helpful. So again, this script [50:21] does not do anything advanced or [50:23] malicious, but it simply demonstrates if [50:26] I go back to recon.sh, SH. It just [50:30] demonstrates how simple a script can [50:34] automate something so repetitive like [50:37] typing in like for example the ping [50:39] command or endmap command, you know, but [50:41] you want to like loop through all the [50:43] ports and check to see if it's open, you [50:46] know, you can use bash scripting to [50:48] automate stuff to reduce the amount of [50:52] repetitive tasks that you do as a [50:54] ethical hacker. checking if a host is [50:57] online, testing testing ports, viewing [51:00] HTTP headers. Uh tools like end mapap do [51:03] this much better, but writing a small [51:06] bash script helps you understand what's [51:08] happening behind the scenes. And again, [51:11] I'm going to say it again, it's good to [51:13] automate stuff as well with bash. By [51:16] [snorts] the way, you can also do the [51:18] exact same thing [51:20] with Python, which is what I recommend [51:23] because Python and Bash is pre-installed [51:26] on every Linux system, including Mac OS. [51:30] So, that's great. Let's save that. Let's [51:32] quit it. Let's clear the terminal. Ctrl [51:34] L. Let's list it and let's uh remove it. [51:39] Recon.sh. [51:41] Pretty cool, right? So, that was that. [51:44] So a command that I want to dive a [51:46] little bit more into is the pseudo [51:49] command. So pseudo is [51:54] pseudo is a command to become a [51:58] privileged user. So like an [52:00] administrator. So for example, if you [52:02] are on Windows and you open something at [52:05] administrator, it means it's the highest [52:08] user on the system. So for example, you [52:11] can see I'm just basic user. But if I do [52:13] sudo and then sue, it opens a root [52:19] shell. [52:20] So we can see now we are the [52:24] highest user on the Linux system. And [52:27] you can see this is the basic root [52:30] directory for the root user. So the main [52:33] user is separate from the root user. So [52:36] if I go back to the home directory, [52:38] let's go back to my user directory [52:40] because this is my user folder. But now [52:42] as a privileged user, as the root user, [52:46] we can do a lot of things. But you got [52:47] to be very careful because the root [52:49] user, you know, you don't want to [52:51] accidentally run a command and it [52:52] destroys everything as the root user. Uh [52:54] because this is the highest user on the [52:58] system. So if you want to exit this root [53:00] shell or this root session, you can just [53:02] type in exit and then it just exit that [53:06] user. What if you want to create another [53:08] user? Well, we have to be pseudo to do [53:11] that. So let's do pseudo sue. Let's [53:13] become the root user. Let's actually add [53:15] another user. So if I go back a [53:17] directory here, you can actually see [53:19] that there is no other user but user. [53:22] Wow, that's amazing. But now let's let's [53:25] create another user by using the add [53:29] user command. So if we type in add user [53:33] and then the name of the user, I'll just [53:35] say student because you're watching this [53:37] video and you're learning from it. So if [53:39] I do add user student, we create a new a [53:43] new user account for that user. But we [53:46] also have to create a password for that [53:49] user. So we can say let's just say [53:51] password 1 2 3. And by the way, it's not [53:55] going to display it, but if you press [53:56] enter, it will work. So password 1 2 3. [54:01] There we go. It says enter the new value [54:03] or press enter by default. So we can add [54:05] our full name, room number, workphone, [54:08] home phone. So this just stores on the [54:09] Linux system. You don't actually need to [54:11] include that. Uh is this information [54:14] correct? Yes. So there we go. So if I [54:16] type in ls, it's already created a new [54:20] user for that user. So because if I go [54:22] to student now, it's created a default [54:25] user for everyone for that user. So that [54:28] user has their own desktop, their own [54:31] documents folder, their own downloads [54:33] folder. Everything else it's associated [54:35] to that user and that user alone. So, [54:37] let's go back. We've got two users. [54:40] We've created a user by using the add [54:43] user command, which is cool. And by the [54:45] way, if you want to give it a practice, [54:47] you want to give it a go, just pause the [54:49] video and create another user if you [54:51] want to. Now, the password for my other [54:54] users's account, this one here, is just [54:57] password 1 2 3. But let's say that you [55:01] want to change the password for that [55:04] user. So we can use a command called [55:09] password or password. [55:12] It's literally just like this uh pass WD [55:17] password. So we need to do pseudo [55:20] password and then the user's name. So we [55:23] can say student in this example. Now we [55:27] can add a new password. So let's add a [55:30] new password. Let's say test 1 2 3 test [55:36] 1 2 3 password updated successfully. So [55:41] it's no longer password 1 2 3 because if [55:44] I if I try that if I want to switch that [55:47] to that user and I do Sue. So Sue is [55:50] basically switching to that user. So Sue [55:52] uh student now I'm that user. Pretty [55:55] cool right? So if I go to directory we [55:57] can see everything about it. I'm this [55:59] user. Now, if I want to do uh pseudo [56:02] sue, it's going to say password. And if [56:04] I do password 1 2 3, guess what happens? [56:07] It's not going to work. Look, watch. [56:09] Sorry. Try again. Okay, let's try our [56:11] new password. Test 1 2 3. Oh, you can [56:15] see. So, the password did work, but I [56:18] can't become a pseudo user because I [56:21] haven't given this account pseudo [56:24] privileges. So if the student tries to [56:28] become the administrator or the root [56:30] user of the Linux system, they cannot do [56:32] that because I need to add them in the [56:35] pseudo file so that if they run the [56:38] pseudo sue command, they can become the [56:40] root user. So they don't have permission [56:41] to do that. [56:43] So anyways, I've typed in exit and now [56:46] we are back. This is pretty nice. This [56:48] is actually pretty fun to do. Now let's [56:52] say that we want to add that user to the [56:55] pseudo group so that the user can become [56:57] root if they type in pseudo sue. So we [57:00] can say pseudo user mod- [57:03] a g and then pseudo student. [57:07] There we go. So if I do if I switch to [57:10] that user as you can see I'm this user [57:13] now. And if I try to become the root [57:17] user, it's going to say password test [57:20] one, two, three. Yes, I am root now. [57:24] Look how amazing Linux commands can be [57:28] to switch privileges, to switch [57:32] permissions. It's amazing. Linux is very [57:35] flexible in the way that we do things as [57:38] ethical hackers. Now, the final command, [57:41] let's delete the user. So, how do we do [57:44] that? Do we just delete the uh [57:47] directory? I mean, the directory can be [57:49] deleted. Um, but the problem is it's not [57:51] going to remove the user, so that's not [57:53] going to work. Um, deleting the folder [57:55] is not going to work. It's still the [57:56] user is still on the system. Um, so the [57:58] way that we can do that is type in [58:00] pseudo dell user. So, delete user and [58:04] then the user's name. So, we can delete [58:09] the user completely. And we can also add [58:12] another command but I'll just do this [58:14] one first. So pseudo delete user student [58:18] right and I'll say and and like run [58:21] another command uh let's do pseudo dell [58:25] user student pseudo which basically will [58:28] remove that student's privileges after [58:32] they are deleted completely. So we can [58:35] see the reason why it's not working is [58:37] because we are already the student. You [58:40] see that we are already the student. So [58:42] let's go out of student and let's try [58:45] that again. So let's try pseudo d user [58:49] student [58:50] and pseudo dell user student pseudo. The [58:54] user student does not exist. User [58:56] student does not exist. Okay. No, that's [58:58] great. That's brilliant. So it did do [58:59] it. Okay. That's that's good. It worked [59:01] the first time. So it did delete the [59:03] user, but the problem is the fold is [59:05] still there. So we can actually just [59:06] delete that manually. Um, so we can just [59:08] say remove uh remove fully or whatever [59:13] terminology you want to use. Remove [59:16] student that removes the folder. So [59:19] yeah, there we go. Pretty amazing, [59:20] right? And again, I would like to [59:23] address this. If you want to continue [59:26] learning, I have a school community for [59:28] you to check out. The link is in the [59:30] description below. Everything in this [59:32] community is for educational purposes [59:34] and you can level up have access to [59:36] these courses which is available within [59:38] the community if you want ongoing [59:41] further learning. These resources will [59:43] be linked below for you to read and [59:45] check out yourself. It's a private [59:47] community and you have access to courses [59:49] and resources for further learning. [59:51] Let's go exit so we don't mess around [59:52] with root. And uh yeah, there we go. [59:54] That was that was basically the basics [59:56] of adding a user, deleting a user, [59:59] switching permissions for the user. So, [60:02] we're getting familiar with Linux now. [60:04] This is great. We're getting familiar [60:06] with Linux and how it operates and how [60:08] it works. We added a user. We deleted a [60:10] user. We added a user to a group. We [60:13] removed a user from a group. Now, one [60:16] more command I want to show you. I don't [60:19] want you to run this, and I'll show you [60:21] why. So there's a command that you can [60:24] run called please don't do this. If you [60:27] type in pseudo reboot, this will reboot [60:30] your whole operating system. So it [60:32] doesn't delete anything. It just reboots [60:33] your computer uh your Linux [60:35] distribution, right? Not your main [60:37] computer uh because we are inside a [60:39] virtual machine, but it just goes ahead [60:41] and reboots the system. So that's all it [60:43] does. It just reboots the Linux kernel. [60:45] So if you type in pseudo reboot and if I [60:47] press enter, it's going to reboot as you [60:50] can see. So it's going to go ahead and [60:51] reboot. It just went black. Okay, you [60:53] can see UTM is now showing. Um, so I [60:55] just rebooted uh everything like the [60:57] whole operating system. So I need to go [60:59] back to my Linux uh DRO here. As you can [61:03] see, it's going to show up now. All [61:04] right, we are back. So it it fully [61:07] rebooted. That's amazing. So yeah, [61:09] that's it. Just restarts the system. Uh [61:11] so we learned quite a bit so far. Now [61:14] let's continue by taking a look at some [61:16] ethical hacking and penetration testing [61:19] tools that you may use in real world [61:23] security testing. We'll go through each [61:25] tool in this order and briefly explain [61:29] what it does. So these are the tools [61:31] that we are going to be taking a look [61:33] at. So the most obvious one is inmap dur [61:36] search fto [61:38] whatweb search burpuite and just python. [61:42] So, first I'm just going to briefly [61:45] explain what these individual tools do [61:48] before we start taking a look at it into [61:51] more detail. N MAPAP is a network [61:54] scanning tool used to discover hosts, [61:57] open ports, running services, and [61:59] sometimes service versions. What this [62:02] means is is that when you use the tool [62:04] endmap, you can scan an IP address of a [62:08] particular host and it will bring back [62:11] information of software on that machine [62:14] that is running on that machine with the [62:17] service version of that software. And [62:20] the reason why this is so useful for us [62:23] as ethical hackers is that we can search [62:26] for vulnerabilities in these versions. [62:29] Dur search however is a web content [62:32] discovery tool. So end mapap is a [62:35] network scanning tool. Dur search is a [62:38] website testing tool. It finds common [62:42] directories, hidden directories, files, [62:44] admin panels, backup paths or other [62:48] links on a website. This tool called [62:51] fuff, which actually stands for fuzz [62:54] faster, you fool, is actually pretty [62:57] funny. FUF is commonly used for web [63:00] fuzzing just like how dur search does it [63:03] but fuff can actually go into more [63:05] detail on brute forcing specific [63:08] requests or parameter discovery which [63:11] we'll dive in a little bit later. Nectto [63:14] is a website vulnerability scanner. So [63:18] it does everything similar to what DUR [63:20] search does. But Nikto actually checks [63:22] for outdated software or files that is [63:26] misconfigured or if there's any security [63:28] issues on the website associated to a [63:31] version of a plugin or software or [63:34] whatever that the website is using like [63:37] an outdated PHP version. Necto is going [63:40] to provide us information on this [63:42] vulnerability or on this security issue. [63:46] So, Nectto is very good at finding these [63:48] flaws on a web application. So, Nectto [63:52] is a web vulnerability scanner. What [63:56] webe however is a fingerprinting tool. [64:00] Uh, what web is a tool used by ethical [64:04] hackers [64:05] to identify technologies running on a [64:08] website. So, for example, if you type in [64:10] what web and then a website name, it's [64:12] going to provide you information about [64:14] that website, about what the website's [64:16] using, uh is it using PHP, is it using [64:19] JavaScript [64:20] libraries, is it using uh frameworks or [64:24] CMS platforms, plugins, it will provide [64:27] you that information. Search let you [64:30] search for known vulnerabilities that is [64:33] public. So you can find public exploits [64:36] for a vulnerable piece of software using [64:40] search exploit which allows you to [64:42] search the exploit DB database from the [64:45] terminal to find known public exploits [64:48] for vulnerable software. Burp Suite is a [64:51] web application testing tool or software [64:55] used to intercept, inspect, modify, and [64:59] replay HTTP requests between your [65:02] browser and a website. We'll dive into [65:05] this a little bit later. [65:07] And last but not least, it is Python 3. [65:11] Python is installed basically on most [65:14] systems, but Python itself as a [65:16] scripting language is really good for [65:18] ethical hacking, for scripting, [65:20] automating, exploit development, passing [65:23] data, and building custom security [65:25] tools. So, without further ado, let's go [65:29] ahead and let's start with end mapap. [65:32] Let's go ahead and try this out. I've [65:33] got a vulnerable machine running on my [65:36] network. But the first thing I want to [65:38] do is help you set up your vulnerable [65:42] web server machine that we are going to [65:45] be doing in this course. So the machine [65:47] that I'm going to help you set up is [65:50] going to be this vulnerable web machine. [65:54] You can set this up by downloading it [65:57] from the link in the description. You [65:59] can either use virtual box or VMware to [66:02] run this vulnerable web machine [66:05] and this machine is called explorer. So [66:08] we are going to use a public [66:11] intentionally vulnerable vulnix CTF [66:15] machine in a local lab environment. This [66:19] is completely safe and legal to do [66:22] because it's a capture the flag machine. [66:25] Its whole purpose is to be hacked. It's [66:28] to practice your skills as a ethical [66:31] hacker to identify security [66:33] vulnerabilities in a vulnerable web [66:36] server website or machine. So, we're [66:39] going to set this machine from Volux [66:42] called Explorer. We're going to download [66:45] the VM and set it up in Virtual Box so [66:48] that we can actually continue with this [66:50] video. If you just want to continue to [66:52] watch the video without actually [66:54] participating, that's completely fine [66:56] and you can still learn by doing that. [66:59] But if you do want to follow along and [67:01] download the machine, you can continue [67:03] to watch what I'm about to do next, [67:06] which is show you how to install it and [67:07] set it up. By the way, the credit goes [67:10] to the person who made this vulnerable [67:12] machine for us to learn from. This is [67:15] for educational purposes only. I'll [67:18] leave a link to the Volix machine in the [67:21] description below. If I did not link it, [67:25] please remind me in the comments to [67:27] ensure that I've linked it. All right, [67:29] let's continue. So, as of right now, I [67:32] am on my Windows 11 machine and I've [67:35] just downloaded the Explorer virtual [67:38] machine that we will be basically [67:40] hacking into. So, we can see it's [67:41] downloaded and I've got Virtual Box [67:44] right here uh with Power OS, but I'm not [67:47] going to need this because I'm not uh [67:49] doing Power OS on here. I've got Power [67:51] OS on my M1 MacBook Air uh using UTM. [67:55] Okay, so we've already set this. Um so, [67:58] what we can go ahead and do is uh open [68:00] this file. Uh we I don't think it's [68:04] exported. I don't think so. Yeah, you [68:07] can see there it has not been exported. [68:10] What I can do is just copy this, go back [68:11] to my folder, paste it in, and copy the [68:15] file, the OVA or OVF file that I will [68:19] open here. So, you'll see now. Okay, [68:22] zoom in. So, this Explorer one is the [68:25] one that we want to open. So, we can [68:26] just double click this and that will go [68:29] ahead and import it into Virtual Box for [68:32] us to do uh the machine. So, let's go [68:36] close that. There we It says importing [68:38] appliance. And so that's going to go [68:40] ahead and import it. There we go. Uh [68:42] let's go to settings really quickly on [68:44] the Windows machine. Let's go to [68:46] settings here in the virtual box [68:48] manager. Go to network. Make sure that [68:50] it's bridged. Uh which should be [68:52] automatically by default. And uh there's [68:54] not nothing else to change. Uh yeah, [68:57] there's nothing else to change. So you [68:58] can just go ahead and just double click [69:00] it. Just run it. Or you can click it and [69:02] press start. It's powering up the [69:04] virtual machine instance. So this will [69:07] be on our local network. You can see you [69:09] can actually have to change the network [69:11] adapter uh just in case. Uh by default [69:14] this would not happen to you. Uh but [69:16] it's because I have to actually select [69:18] it through the virtual editor which you [69:20] can see the adapter type which I'm [69:21] already using. Um so this won't happen [69:24] to you. Uh invalid settings detected. [69:27] I'm not sure what's invalid. So, I've [69:29] just realized why this isn't actually [69:32] setting up properly on Virtual Box and [69:35] it's not actually configured properly [69:38] during installation. So, I guess some of [69:41] or whatever packages weren't installed [69:43] properly wasn't configured with Virtual [69:45] Box software. So, what I might need to [69:48] do quickly is just completely uninstall [69:52] uh Virtual Box. [69:58] So, I'm going to go ahead and uninstall [70:00] Virtual Box completely. Just going to go [70:03] ahead and uninstall it. So, I'm just [70:05] installing Virtual Box again. You can [70:07] see here I'm downloading the latest [70:09] version. Okay. So, let's go ahead and [70:11] run this. It's the same same flow. So, [70:14] it's it's not going to be hard to do at [70:16] all. You can see here. Uh I can accept [70:21] the terms and conditions blah blah blah. [70:24] Go next. It says warning network [70:26] disconnection. That's fine. Um, missing [70:29] dependencies. Okay, so this is exactly [70:32] what the core issue was. So, all you do [70:35] to fix this issue is just download the [70:37] latest Python version uh for on their [70:41] website. Just go ahead and run the [70:43] Python installer to install Python. Uh, [70:47] launch ready and ready. Yeah, let's do [70:49] that. So, it's going to go ahead and [70:50] install Python. There we go. Done. And [70:54] now we can use it. Add to your path. [70:56] Yes. Uh, install C Python. Yes. [71:02] Okay, there we go. So, it's installing [71:04] the latest version of Python. View [71:05] online help. No. All right, there we go. [71:09] So, now it's installed. [71:12] Um, okay. So, I guess we might need to [71:14] install this package here called Win32 [71:17] API, which we can do in cmd uh command [71:21] prompt because it's installed. So we can [71:23] do pip install pi win32 and this is [71:26] going to install it globally on the [71:28] system meaning uh it's going to be able [71:30] to work. So you can see it says [71:31] downloading installed the packages uh it [71:34] says warning the scripts blah blah blah [71:36] uh which is not in path consider adding [71:39] this directory in your path. Let's just [71:41] see if this works. If it doesn't I'll [71:42] add it in my path. Um so we can just [71:45] decline this uh and just click finish. [71:48] Let's run that installation again with [71:50] virtual box. It's actually good that we [71:52] actually going through these errors just [71:54] in case if anyone actually goes through [71:55] these errors uh just like how I am uh [71:58] because then you can actually see how I [72:00] fix it. So yeah, let's go next. Install [72:03] uh hopefully this will fix it uh because [72:06] we have installed the packages needed uh [72:10] for Oracle Virtual Box software. You can [72:13] see there it said installing network [72:15] driver. everything to do with uh network [72:18] connectivity. Uh Oracle Virtual Box has [72:20] now been installed. Uh so let's go ahead [72:23] and finish that off. I don't think we [72:24] need to import the virtual machine [72:26] again. Uh but if we do, we'll do it. [72:29] That's fine. Uh we can actually go ahead [72:31] and uh well, we've got the Explorer uh [72:34] machine downloaded. So we can just close [72:35] this tab. It's on our computer now. So [72:38] I'm just waiting for the uh virtual box [72:40] to open. I'll just click it again. Okay, [72:42] there we go. So it is now open. And uh [72:44] you can see there it says aborted. But [72:46] if I click settings, hopefully this [72:48] would have fixed the issue. Yeah, look [72:50] at that. It says invalid settings. Uh [72:52] you know that invalid settings option is [72:54] not there anymore, which is good. And [72:56] also it opened twice cuz I clicked it [72:58] twice. Okay, so let's go ahead and run [73:01] it and see if it works. Powering VM. [73:06] There we go. It is now successfully [73:09] working. running the vulnerable virtual [73:13] machine that we will be attacking and [73:15] learning from in this course. This is a [73:19] safe legal environment for you to [73:21] practice your ethical hacking skills in. [73:23] So, this is just one virtual vulnerable [73:26] machine that you can download and try [73:27] out. So, you can see there we've got the [73:29] IP address of the machine. That's our [73:31] local host, but it's going to assign an [73:34] IP address to this virtual machine, [73:37] which you'll see it change now. and then [73:39] we'll know what IP address we can map [73:42] scan uh on our power to OS machine. Uh [73:45] just keep in mind it might take some [73:47] time to actually uh assign an IP [73:50] address. Sometimes it takes a little [73:52] while, sometimes it's instant um [73:55] depending on how I don't know what is [73:57] happening. So I think I don't know if [73:59] that's another problem. Hopefully not. [74:01] Um let's have a look. So, if we go to [74:03] network, uh, yeah, so everything's, [74:05] yeah, everything's actually using my [74:06] correct or actually, no, it's not. Um, I [74:09] have to select this one because it's my [74:10] specific adapter. Uh, yeah. So, make [74:13] sure that you select your adapter [74:15] correctly. So, you can just click okay. [74:18] Um, I don't think it's going to change [74:19] it now. We might need to reboot it. Um, [74:21] so let's go ahead and do that. Power off [74:23] the virtual machine. I I I do apologize [74:25] if this is really timeconuming, but this [74:27] is a necessity. So, let's go ahead and [74:29] run it again. Uh, there we go. So it's [74:32] powering the VM up again and uh now we [74:35] should actually have a assigned IP [74:37] address to this virtual machine. Uh [74:39] which is pretty simple and [74:40] straightforward. So you can see it's [74:42] loading the Linux kernel uh the DBN [74:44] machine which has all the uh vulnerabil [74:47] uh vulnerabilities. Uh it could be a [74:50] website application u whatever the case [74:52] is. There we go. We've got 192.168.1.56. [74:56] So there we go. It has assigned an IP [74:58] address uh for us to basically perform [75:02] enumeration uh port probing and even you [75:06] know investigating whatever this web [75:09] server is running. Uh and by the way you [75:11] can also you can also install power OS [75:13] alongside your Windows machine here as [75:15] well with virtual box or VMware uh to [75:17] also try it out. So it's the same [75:19] method. All right let's get back to our [75:22] power OS machine. Let's open up the [75:24] terminal. Now let's apply what we've [75:26] learned so far in this course so that we [75:30] can understand what we need to do and [75:32] how to do things. So the first thing I [75:34] want to do is to ensure that the host [75:37] the vulnerable web server that I will be [75:40] hacking into in this course is actually [75:42] live and running on my local network. So [75:45] ping 192.168.56. [75:48] Yes, it is up and running. That's great. [75:52] So now this is a good start. Seven [75:55] packets transmitted. That's amazing. So [75:58] that's great. It's up and running. We [76:00] can start doing the MAPAP scans. [76:03] So to start off with N MAPAP here, [76:07] we're going to say NAPAP-H just to get a [76:10] understanding of the help menu manual [76:12] here uh to see what types of scans we [76:16] can do. So you can see the basic [76:18] examples down here. But what I want to [76:21] do is let's just start off with some [76:23] basic MAP scan. So we could do this. So [76:26] we can type in MAP1 192.168.1.56 [76:29] which is the IP address of the target [76:31] machine. And we can just press enter. [76:34] Now when you press enter, it's just [76:35] going to go ahead and scan this IP [76:38] address to see if there's any ports, [76:40] services or software that is running on [76:42] this machine for us as an ethical hacker [76:45] to gain a better understanding on what [76:47] we can leverage from. So right away we [76:50] got two ports that is open. We got port [76:52] SSH and port HTTP. [76:56] So port 22, port 80. 80 is a HTTP. And [77:00] we can see here that what what is HTTP? [77:03] It's a website. So right away when we [77:05] perform the MAB scan now we understand [77:07] that on this machine there is a web site [77:10] running. So it's running a web server. [77:12] The website is hosted on the web server [77:14] and we can actually go to this IP [77:16] address with this port number and there [77:19] will be a HTTP website to take a look [77:21] at. So let's do that. So if I open up my [77:23] browser and I go to 192.168.1.56 [77:28] uh on port 80 colon port 80. Just type [77:30] in that. There we go. It works. This is [77:33] the default web page for the server. The [77:35] web server is running but no content has [77:38] been added yet. So, we're going to take [77:39] a look at some other tools like that [77:42] we've spoke about like dur search to see [77:45] if we can do some directory scans to see [77:47] if there's any other, you know, files or [77:49] directories or other webs uh other web [77:51] pages on this website application for us [77:54] to take a look at. But what I want to [77:56] focus on is strictly on MAPAP just right [77:59] now so that we can better understand the [78:01] types of scans we can perform to get [78:03] more information about it or just better [78:05] scans to do really. So, let's go back to [78:06] our terminal with end mapap. Honestly, [78:09] in MAPAP is the greatest thing that's [78:11] ever been around. Okay, so that was [78:13] pretty basic. All we did was literally [78:15] just type in end mapap and then just the [78:17] IP address. Now, these types of scans is [78:20] really basic of course, but what are [78:22] other scans that we can do to this IP [78:25] address? Well, we can do types of [78:28] service scans. So we can do like nm [78:30] mapap- sv and then the IP address which [78:34] will allow us to perform service version [78:38] scanning. So it just detects service [78:40] versions like the version of whatever [78:43] service is open. So it helps us better [78:45] understand, you know, if we copy that [78:48] service and we search it up on Google, [78:49] we might come across a a vulnerability [78:53] or maybe some sort of like a metas-ploit [78:55] module or other script that we can do to [78:58] enumerate it or maybe even gain access [79:00] to it. So nmap- [79:02] sv this is an argument which we supply [79:05] to the MAP tool with the IP address. So [79:08] if we run this, it's probably going to [79:10] not really give us a version. Uh maybe [79:12] it's going to give us a SSH version. [79:14] It's probably going to Yeah, there we [79:16] go. So, we can see right away this type [79:17] of MAP scan has provided us a version of [79:20] what SSH is running on this box. Uh it [79:23] even tells us that it's a DBN Linux [79:25] machine. And as for HTTP, it's using [79:28] HTTP 2.4.65. [79:30] So, it's really helpful to actually use [79:32] these types of scans to better [79:34] understand what we are looking at when [79:36] we're doing a penetration test. So, [79:38] yeah. So you can do map- sv with the IP [79:41] to get service version to understand it [79:43] better. And uh if you just want to like [79:46] if I do -p and then just type in the [79:48] ports like if you if you know your port [79:50] numbers if you know your port numbers [79:52] you can just type in the ports that you [79:53] want to specifically um select to find [79:56] to see if any of these three ports are [79:59] open. So basically what I'm doing is is [80:01] checking custom ports. So port 22, port [80:03] 80, port 443, port 443 to see if any of [80:06] these three ports are open. Now [80:08] obviously we these two ports are open. [80:10] Uh port 443 however is not. I can also [80:13] do 8080. You can be very selective here. [80:15] You don't have to add these. And by the [80:16] way um I'll show you a different scan [80:18] that we can also do to scan all types of [80:20] ports. So that's going to go ahead and [80:22] run and also provide us with the service [80:24] information. So we can see here I've [80:26] just added these ports to the list to [80:29] see if it is open. So 443 the state of [80:32] this port is closed because it's not a [80:34] HTTPS website. It's using HTTP which is [80:37] a insecure uh website application [80:40] because they didn't have SSL uh [80:42] certificates. Port 880 um that's closed. [80:45] So it's just a HTTP proxy but that's [80:47] closed. So port 8080 can also be a web [80:49] server which is also running um similar [80:51] to port 80. In this case there is [80:53] nothing here. And by the way I think [80:55] what I want to do really quickly is [80:57] instead of typing the IP address out all [81:00] the time we can actually see the name of [81:02] the machine here. It says explorer.hub. [81:05] hub, right? And then here's the this IP [81:08] address associated to this name. So [81:10] explorer.hub. What I want to do is is [81:13] just copy explorer. Um I think I've [81:16] already done this. So if I if I go to [81:18] pseudo micro etc hosts. So go into this [81:21] file configuration file. Um it looks [81:24] like it's empty. Why is that? My [81:26] terminal isn't responding. Let me close [81:28] it. I don't know why that did that. [81:29] That's weird. Um let me just have a [81:31] look. Cat etc host. Okay, so I haven't [81:35] done it. So, what I want to do is just [81:37] edit it really quickly. Uh, pseudo micro [81:40] etc hosts. I don't know why it does [81:42] that. That's so annoying. Hang on. I'll [81:44] use nano. I have to use nano uh [snorts] [81:46] etc host. All right, let me quickly just [81:48] fix this. Let me delete these ones. Uh, [81:50] controll K. Get rid of those. So, add [81:53] the IP address of the machine at the [81:55] bottom. So, 192.168.1.56 [81:58] and it's called Explorer. [82:01] Think I spelled that correctly. [82:03] Explorer.nyx, [82:06] which is just you can add it as a custom [82:09] domain, right? You can even do.io or [82:11] whatever. It doesn't really matter. I do [82:13] nyx because that's by default the vulnix [82:16] machine. Vx. So I just do nx nyx. And [82:20] then I just press controll x uh yes. [82:22] Press y press enter. Now it is save as [82:26] you can see there. So what this [82:28] basically does is if we go to this URL [82:30] now, it's actually just going to load [82:32] the domain. So that this is the IP [82:34] address. This is the domain that we've [82:35] just added. So it's just easier to copy [82:37] and remember. So if I actually go here [82:38] and paste in uh this address like this [82:42] explore.nyx [82:44] like this, you can see now that it's [82:47] literally just using this as the domain [82:50] pointing to this IP address. So this is [82:52] remember this is on your local network. [82:54] So, no one can actually go to this [82:55] domain because it's in your your hosts [82:58] file which is only localized for you. [83:01] All right, let's clear that. Let's close [83:02] this. We're not going to do anything [83:04] there. We're still doing MMAP scans. So, [83:06] if I go back to the MAPAP scans now, we [83:08] can just do this explorer [83:10] NYX. And it'll still do the same thing [83:13] because it scans the domain, it scans [83:15] the IP address, it knows what it's [83:17] scanning because it's in the etc hosts [83:20] file. So, that's great. Uh so another [83:23] scan that I commonly do is S C and then [83:29] obviously SV. And by the way you can [83:32] also do it like this for shorten. Um so [83:34] you can do SV and then explorer get rid [83:37] of the HTTP. So basically what this scan [83:40] does the - S just runs basic like safe [83:45] scripts. So, NM MAPAP has like script [83:47] modules that you can specifically run to [83:49] see if the machine has a particular [83:51] vulnerability or something like that. [83:53] And then this is just scanning the the [83:55] versions again. So, which we already [83:57] know. So, these are like just different [83:59] types of scans that you can do. Yeah, [84:01] you can see here it's actually provided [84:02] us a little bit more detail here because [84:05] we did - SC as well. And this is [84:07] actually really good. Do you know why? [84:08] Because look, it says HTTP title. Site [84:11] doesn't have a title. Um but you can [84:12] actually see here it's actually provided [84:14] us a directory. So sometimes end mapap [84:17] it also checks for like any directory or [84:19] robots.ext uh on the site. So you can [84:22] see here it fetched the robots.ext file [84:24] on the website. So basically robots.ext [84:27] just allows you to when you add it on a [84:29] website or you've built your own website [84:31] before you can add a a sitemap or [84:33] robots.ext text file to ensure that no [84:35] bots can find these files or have access [84:38] to these directories when they navigate [84:40] it to on the website. But we can [84:42] actually see here that in this robots [84:44] text file we've got a exter [84:48] which is actually a directory. So again [84:50] if I go to the browser now check this [84:52] out. This is this is pretty cool. So if [84:54] I go to the browser and I type in ext [84:56] explorer [84:59] there's a look at this. It's a web page [85:01] now. Now it's actually a login page. Now [85:05] we don't know what the credentials are. [85:06] Now this is like where we get to like [85:08] brute forcing or maybe even like [85:11] password guessing, you know, like admin [85:13] admin or whatever. Um, so we have to [85:15] like figure out what we can do here. We [85:17] could also try and perform some sort of [85:20] SQL injection or whatever the case is, [85:22] whatever we want to do. JavaScript [85:24] frameworks. You can see there we've got [85:25] some JavaScript frameworks here. 3.4.0. [85:28] You can actually search this up to see [85:30] if it has any vulnerabilities or maybe [85:32] like cross-ite scripting or whatever, [85:34] but that's a whole different thing. [85:36] We're still focusing on some MAPAP [85:37] stuff. So, those are the types of scans [85:39] you can do. Now, if I do dash A, [85:44] like - capital A, this is a aggressive [85:48] scan. So, essentially what this does, it [85:50] it scans aggressively. And by the way, [85:52] it's probably not best practice to do [85:55] this because when it scans aggressively, [85:57] it can actually the IDS systems on the [86:00] other machine that they may have set up [86:02] or the firewall can definitely detect [86:05] these aggressive scans because it's [86:07] quite noisy. So the aggressive scan just [86:10] goes like full-on tryhard mode to try [86:12] and find as much information it can from [86:15] the scan. So OS, the operating system [86:17] type, the service version detection, and [86:20] common scripts. So it it really goes [86:22] hard like tryh hard mode as if you were [86:25] like playing PUBG like you full tryh [86:28] hard mode. That's kind of what this [86:30] argument does here. And if you want to [86:32] scan all types of ports, not just common [86:34] ones, but every single port that may [86:36] exist, you can do dashp and then just [86:39] dash again. So -p dash will scan all [86:42] types of ports. So if I supply the IP, [86:46] oh sorry, the domain which is the IP [86:48] address, you can also do that. it's [86:50] going to go ahead and do it. As you can [86:52] see here, and by the way, it doesn't [86:53] automatically give us an output. So, if [86:56] yours is still like this, it just [86:57] doesn't give you an output and it just [86:59] takes forever. You can actually just [87:01] press the up arrow key on your keyboard [87:03] to see how long it's going to take to [87:05] scan. So, you can see there it's about [87:07] 15% done. Uh you can see how long it [87:10] will take and it'll also give you the [87:12] time remaining. So, it's going to take a [87:13] while for these aggressive scans. So, we [87:15] don't we don't need to do this. I just [87:17] wanted to show you, but it's really [87:18] cool. So aggressive scans do take long [87:20] and it's very noisy, you can do a full [87:23] port scan like this, which won't take [87:25] too long. But if you want to see what [87:27] the scan is doing while it's running, [87:28] you can add another argument called -v [87:31] for verbose. And if you enter that, it [87:33] can just tell you uh what information [87:35] it's found already while still scanning. [87:38] So that is what the -v does. And -p dash [87:42] scans all types of ports like I said. So [87:44] you can see here it's finding all this [87:45] information and blah blah blah. So [87:47] that's amazing. Now let's do a full like [87:49] MAPAP like a proper N map command scan. [87:53] So let's do N MAP- SC c-- SV- [87:57] N. So O N uh allows you to save the [88:01] output into a normal text file. So [88:03] basically - allows you to save it to [88:06] save the scan into a text file. So we [88:09] could just say inmap basic.ext [88:13] basics.ext [88:15] or something like that or MAP basic.ext [88:17] text. Okay. Explorer.nyx. [88:22] Find common scripts. Find the service [88:25] version and save it into a text file and [88:29] supply said IP address or domain. And [88:32] you can see right away it's going to go [88:34] ahead and scan it. And it's going to [88:36] take the scan results and put it into [88:38] the text file endmap basic.ext. So all [88:42] this information you see here, if I [88:44] clear the terminal, it's gone. If I type [88:46] in ls, we've got it right there. So I [88:48] can just say cat and map tab.ext. There [88:52] we go. Boom. Look at that. It's saved it [88:55] in a text file. So that's how you save [88:58] scans. You save reports, things like [89:00] that. It's really helpful. All right. So [89:02] one more scan I want to show you is a [89:05] more stealthier scan. So, you're [89:07] probably thinking, well, Declan, you [89:08] know, if it's an aggressive scan and [89:10] these scans are noisy, what can we go [89:12] about or what can we do about it if we [89:14] want to do like a anonymous scan? So, [89:16] this usually involves spoofing your [89:19] identity using decoys or routing your [89:22] traffic through proxy chains or maybe [89:24] like the tour network, you know. So, I I [89:27] will show you what decoys are first. So [89:30] essentially if I type in m apps s. So if [89:32] I do everything I did before but I do - [89:35] ss this is a stealth scan. So this is [89:38] like a synac request. So - ss is a [89:42] stealth scan. If you want to learn more [89:44] about these types of scans like I said [89:46] you can type in n mapap-h for the help [89:48] menu. So you can see the different types [89:50] of arguments like we were running [89:52] before. So you can play around with [89:54] these different types of arguments here [89:56] to understand what types of scans you [89:58] can do. Another one that we can uh take [90:00] a look at here which is in the end MAPAP [90:02] tool itself is firewall/IDS [90:05] evasion and spoofing. So these are just [90:07] different arguments to perform spoofing [90:09] techniques when doing end mapap scans. [90:11] So we've got decoys which is great. We [90:14] can spoof a source address but we're [90:16] going to just take a look at this [90:18] argument parameter here. Uh what's very [90:20] nice is that with the timing and [90:22] performance tab in the IMAP scan tool, [90:24] you can see the different like arguments [90:26] or methods we can actually add here in [90:29] the tool as well. So scan delay like the [90:31] how many seconds like delayed between [90:33] each scan or probe, the minimum minimum [90:36] rate that it scans or the max rate that [90:38] it's sends packets. This is some very [90:40] helpful commands that we can run during [90:43] an MAP scan. So if I do let's say nm [90:46] mapap- s- d I have to kind of add a [90:51] decoy. So I could do rnd colon 10. So [90:55] this command performs and instructs m [90:57] app to use a tcp sin stealth scan while [91:02] generating 10 random IP addresses. This [91:06] command here with the decoy method or [91:08] the decoy argument in inmap allows you [91:11] to add decoys. So, if I do 10 or five or [91:15] two, I'll do 10. It's going to send like [91:17] while it's doing the scan, it's going to [91:19] it's going to send out 10 like decoys [91:22] like spoof decoys of an IP address. I [91:26] would recommend not adding anything [91:28] above 100 or 50. I recommend 10 is [91:33] probably the best range. And the reason [91:35] why I say this is because it can [91:36] accidentally flood the target system and [91:39] trigger bandwidth alarms, which you do [91:42] not want to do. So, this will send 10 [91:44] decoys while you're scanning to mask [91:46] your actual location by routing, which [91:49] is pretty interesting. And then you can [91:51] supply the end map address. Like I said, [91:53] this is just for educational uh purposes [91:56] here. I don't want you to do anything [91:57] malicious to any real world application [91:59] without permission. I'll just show you [92:01] like what hackers actually do to hide [92:03] themselves. But actually this is a [92:05] really interesting way as an ethical [92:06] hacker and penetration tester to [92:08] understand end mapap scanning [92:09] techniques. You know instead of doing [92:11] this what most hackers would do before [92:13] running a command like end mapap or sql [92:15] map or whatever hacking tool is they [92:17] will use a tool called proxy chains. So [92:20] this tool proxy chains version 4 which [92:22] is the latest proxy chains will okay it [92:25] says it says command not found the [92:27] oldest version here is proxy chains 3.1 [92:29] but the latest version is version 4. So [92:32] proxy chains allows you to mask your [92:35] actual location by routing all your mAP [92:38] traffic through the tour network or set [92:41] a socks proxy. So that's that's also [92:44] pretty interesting. So that's how [92:45] hackers sometimes get away with things. [92:48] uh not all the time, you know, like [92:50] occasionally using proxy chains or [92:52] running decoys with proxy chains, you [92:55] know, it will be a very slow scan if you [92:56] do that because it will take forever. [92:58] But if you really want, you know, quote [93:00] unquote anonymity, I don't know if this [93:02] would be the best method, but I would [93:04] say it's good enough or decent enough to [93:07] um definitely send out some decoys, but [93:09] you don't actually have to do that. It [93:10] would be recommended to if you just want [93:12] to do like an anonymous scan on [93:13] yourself. Uh R&D will send out decoys [93:16] like I mentioned. And uh if I run that, [93:18] you requested a scan type which requires [93:20] root privileges. So you can see here I [93:22] can't send out decoys yet. So I have to [93:24] do pseudo then run it. Then it's going [93:26] to send out decoys uh to that web server [93:30] while we're performing uh this MAP scan. [93:32] You can see there it's about 76% done. [93:35] Uh you can see here it's performing a [93:37] sin stealth scan running decoys 10 [93:40] decoys masking my IP address or while I [93:43] do the scan essentially. So you can do [93:45] more research on what R&D is and the [93:48] decoys that you can do. But this is a [93:50] pretty basic MAPAP tutorial with this [93:52] course. So yeah, pseudo- ss-d [93:57] r&d10 with the domain or IP address will [94:00] definitely do a good job at getting that [94:03] information. So anyways, we already know [94:05] these in MAPAP results because we've got [94:07] a MAP basic text file that we exported [94:09] into by running mAP- [94:13] N and then the file name.ext. This will [94:17] save your MAPAP scan into a file using [94:20] this argument here, this parameter. And [94:23] we can type in the IP address to scan, [94:25] right? So it will save that data. It [94:27] will save that scan in the text file. [94:29] Um, you can also do it like this. A lot [94:31] of people do this. I've seen it before. [94:33] So, let's say I take this command, [94:35] right? Uh, I do this n map.ext. That [94:38] still works if you add this write [94:40] operator. This will just save it into a [94:42] text file. So, you can just say save. [94:44] Oh, no, don't do that. Save into a text [94:46] file called mAP.ext. Right? So, you can [94:48] do it like that or you can, like I said, [94:50] I do it like this. - mAP.ext. [94:55] Okay. So, let's move forward. Let's now [94:58] move into web enumeration because we got [95:01] information about the target machine. We [95:03] know what it's running. It's running a [95:04] website. So now we are going to focus on [95:08] web enumeration basics. So let's get [95:11] started with that. So what are some [95:14] tools that I showed you in the beginning [95:16] or that we were going to use? I showed [95:18] that we were going to use a tool called [95:21] what web which we can use in the [95:23] terminal. Um, but you know, the best [95:25] thing to do is also use Weapalizer. You [95:27] know, if you just want to stick it in [95:29] the browser. Uh, what Webb and [95:30] Weapalizer aren't the same thing. [95:32] Weapilizer just pulls information [95:34] already from the website. And same with [95:36] what web, but it just does it in the [95:37] terminal. So, let's type in what web and [95:39] then the address of the website, which [95:41] is explorer.nyx. [95:44] There we go. So, what webb will pull [95:46] that information from the headers on the [95:48] website and it will tell us what [95:50] versions or what service it's using. [95:52] It's kind of like what MAP does, right? [95:54] Because it does banner grabbing. It [95:56] fetches that HTTP server information um [95:59] to provide us, you know, like everything [96:00] like this, like Apache version, uh the [96:03] type of Linux or computer or machine [96:05] it's using and also the IP address and [96:07] country and all this other information [96:09] that you may get during the scan. So [96:11] that's just what web. And if you want to [96:12] do more stuff with what web, you can [96:14] just type in what web-h [96:16] and there we go. So you can do these [96:19] types of scans here. It says scan the [96:21] local network for HTTP websites. So you [96:23] can do that if you want. Obviously we [96:25] don't need to do that, but it just shows [96:26] you like the power of this tool. You can [96:28] also perform an aggressive scan. Um but [96:30] you have to supply the address here. So [96:32] - a version 3. The method of the [96:35] aggressive scan detects the exact [96:37] version of whatever. Right? You can read [96:39] more about these scans and also the [96:41] types of arguments you can use here as [96:44] well. But we're not really going to look [96:46] too much into what web. That was just [96:48] the basics. So it's kind of similar to [96:50] what MAP would do by performing banner [96:53] grabbing. It just allows you to detect [96:55] web technologies. Another command that [96:57] we can use is curl to fetch HTTP [97:02] response headers to see what the [97:04] website's using. This is kind of like [97:06] what what web already does, but we can [97:09] also just use it with curl just in case [97:11] you don't have what web installed. So if [97:14] we supply the address, [97:19] you can see it still does the same [97:21] thing. The type of server which is [97:23] Apache. It's using Apache. It's running [97:26] DBN Linux. The HTTP version. And it does [97:29] this by fetching the response headers in [97:32] the HTTP request. Let's actually go onto [97:36] the web application to see the [97:39] robots.ext [97:40] file. So during the MAP scan, it did [97:43] find this and we navigated over to this [97:46] directory to see if it was a valid [97:49] directory, which it is. It's a valid [97:52] file path, which we can navigate to on [97:54] this web application. You can also do [97:56] sitemap.xml, which I don't think. Yeah. [98:00] So on this machine, it doesn't have a [98:01] sitemap.xml, but it does have a [98:04] robots.ext. [98:05] It's good to check both just in case. [98:08] Let's use the directory search tool [98:11] called dur search to find other [98:13] directories on this application if there [98:15] is any. So copy the URL. Go back to your [98:18] terminal and type in dur search-u [98:22] which stands for URL. Paste it in. Now [98:25] you can just run it like this if you [98:27] really want to and it will still work. [98:29] You can see that it's trying to see if [98:31] there's other directories or files on [98:33] this web application. But you can see [98:34] here we are getting 403 meaning we don't [98:37] have access to this directory. It's [98:39] forbidden. But you can see how fast this [98:41] directory scan goes. But let's press [98:43] Ctrl C and press quit and also quit [98:46] without saving. Let's run this command [98:49] again. But before we do that we can [98:51] supply an argument called crawl. So [98:54] crawl which will crawl the web [98:57] application. we can say exclude status [99:00] which means exclude status codes like [99:03] 403. So it basically means don't show [99:06] these types of uh responses while [99:09] scanning. So it could be 404 503 like [99:12] like an invalid gateway. Um we can also [99:15] do 301. It's a good practice to do that. [99:18] So anyways, it's going to go and perform [99:20] a directory scan by doing crawl and it's [99:23] going to exclude these status codes [99:25] which won't show up during the scan. [99:28] So if now if I go ahead and run it now, [99:30] you can actually see when I run it [99:32] again, we don't see those 403 responses. [99:35] It's just scanning until it finds a [99:37] valid directory or file path. But we [99:40] already know that the only file path on [99:42] this web server is /extplorer. [99:45] You can see there it found the [99:46] robots.ext text which we have already [99:49] taken a look at which had the valid file [99:51] path. [99:53] Another tool I want to show you is a [99:55] tool called fuff. [99:59] So fuff stands for fuzz faster you fool. [100:03] And we can see we've got different [100:04] parameters here arguments that we can [100:06] use in this tool. [100:11] So fuff is similar to dur search in a [100:14] way. It does the exact same thing of [100:17] performing directory fuzzing. [100:20] So we can actually do the same thing as [100:22] we did with dur search but with f. So we [100:26] can do f w. So we can specify the word [100:30] list which is user share [100:32] word lists. You can select sec lists if [100:35] you want. So I'm going to go to I'll do [100:39] discovery. I'll do web content. [100:44] And then we can see here we've got a [100:46] list of directories for us to choose [100:48] from. [100:50] But instead of doing these, what I will [100:52] do instead is just the basic uh word [100:55] list that we will use [100:59] from derb [101:03] which is just a common word list [101:06] directory that we will perform when we [101:08] are fuzzing. So again let's do the same [101:11] thing. [101:13] So specify the URL and also ensure that [101:17] you type in fuzz at the end of it to [101:19] tell this tool to fuzz the location of [101:23] what we are brute forcing or fuzzing. So [101:25] we can see we are doing fuff word list. [101:28] Here we're specifying the word list and [101:30] then here we are specifying the URL and [101:32] telling the tool to fuzz the end end [101:35] location of the URL to find and fuzz [101:37] directories. [101:40] So you can see that is what it looks [101:41] like. And if we run it, you can run it [101:43] like this. But you can see while it's [101:46] performing a directory fuzz scan, we can [101:49] see that we've just got white text on [101:52] the screen, which makes it very [101:53] difficult to see. But you can also use [101:56] FUF to filter out these request scans [101:59] here. So we can filter out by words or [102:01] lines. So I'll show you what that does. [102:04] So if you want to see a colored output, [102:06] we can do dash c for colored. And now [102:09] you can see that we've got coloring, but [102:13] let's filter out by 10. And by the way, [102:15] you can see this because when it scans, [102:18] it says status 43. You can also filter [102:21] that out if you want, but I'm going to [102:24] filter 10. And it's going to go ahead [102:26] and fuzz until it finds a correct [102:28] directory. As you can see here, we've [102:31] got index.html, and we've also got [102:33] robots.ext just like how we found on dur [102:37] search. So it's a very similar way of [102:39] performing directory scanning. But what [102:42] I really like about FUF is that you can [102:43] also perform subdomain enumeration. So [102:47] you can check for any subdomains which [102:50] I'll show you now. So instead of doing [102:52] it like this, we still specify the URL, [102:55] but we can say host [102:59] fuzz. This is where we fuzzing. We're [103:01] fuzzing the beginning of the URL, which [103:03] is where the subdomains would be. And I [103:06] don't think there is any subdomains on [103:07] here, but that this is a good practice [103:09] to check for subdomains just in case [103:12] there is. So now if I go ahead and run [103:14] it, it's going to give us a lot of like [103:16] 200 requests, right? Like status 200. [103:20] But let's go let's actually go ahead and [103:22] filter that out because those are just [103:24] false positives. So let's go ahead and [103:26] do that because we won't truly know what [103:28] the subdomain is until we get a response [103:30] back. So you can see it's just [103:32] performing subdomain enumeration and you [103:35] can see that nothing came back. So that [103:36] means that there is no subdomains. So [103:38] that's how you perform a subdomain which [103:40] is very nice. And also let's go back to [103:43] this scan as we did previously with [103:46] directory fuzzing. Not subdomain [103:48] fuzzing, directory fuzzing. Let's [103:50] actually add another one called dash e. [103:53] So we can specify the extensions for the [103:56] tool to look for. So we can say okay [103:59] while it's fuzzing find anything with [104:01] the text uh or maybe HTML or maybe [104:07] PHP. [104:08] So anything with that end of the URL so [104:12] text or HTML it's going to find that in [104:15] the request and it's just going to [104:16] filter that out for us. As you can see [104:18] there index.html [104:21] it's going to find any file type that is [104:23] just a text file or a PHP file. So we [104:26] can we can specify the extensions that [104:28] we want to look for specifically which [104:31] is very nice. Now onto the next one. We [104:35] will be taking a look at Nectto. [104:38] So Nectto is a web security tool that [104:43] finds web vulnerabilities which is very [104:46] nice. So if we come up here in the tool [104:48] we can specify the host with the H [104:51] argument. So we can do this nectoo [104:56] necto-host [104:58] and then we could just supply the URL [105:05] and you can see it's already going to go [105:07] scan it and find any vulnerabilities [105:09] associated to it. It's going to check [105:11] the headers. It's it's already found the [105:13] robots.ext the Apache version. So, it's [105:16] a very loud vulnerability scanner, but [105:20] it's very helpful in finding these flaws [105:23] or vulnerabilities that you may come [105:25] across. So, think like end mapap, but [105:28] for websites. This is kind of like what [105:31] Nikto does. So, it really tries to dig [105:35] deep to find any loopholes or anything [105:37] that kind of exposes itself. So, I'm [105:41] going to go ahead and press Ctrl + C [105:43] because we're not going to be doing a [105:44] lot with Necto at all. I think the best [105:47] thing to do is just check out what this [105:48] web application entails. [105:52] So, if we go back to this login page [105:55] here, [105:56] we can see that we can't log in. We need [105:59] to know the username and password, which [106:03] we don't actually know. See, login [106:05] failed. Try again. [106:08] So, if I keep pressing login and login [106:10] and login, it doesn't look like it has [106:12] rate limiting. So, we could try and just [106:14] brute force this with the FUF tool, [106:17] which I can actually show you. But [106:19] first, what I need to do is, you know, [106:21] when you type in something on this web [106:23] application and then you press the login [106:25] button. This sends a request. But what [106:28] we need to do is we need to actually [106:30] copy that request so that we can send it [106:33] over and over again until we get a [106:35] successful login. So in order for us to [106:38] kind of play around with this, we need [106:40] to use a tool or actually a software. Uh [106:43] it's a program called Burp Suite. So if [106:46] I come here to the menu and I go to web [106:48] application analysis. [106:51] Uh yeah, here it is. Web application [106:54] proxies. Burpuite. So let's go ahead and [106:56] open that up. So Burpuite is a software [106:59] that allows you to perform these [107:01] requests, but you can actually see what [107:03] the request does. See, I'll show you now [107:06] once this loads up. It's very helpful [107:08] and a lot of hackers use uh Burp Suite [107:12] because it helps you analyze a web [107:14] application in a much wider scale. So, [107:17] if I go to the proxy tab, you can see [107:19] that the interceptor is on. So, let's [107:21] actually use this browser instead. Uh [107:24] because this is what we're going to be [107:25] needing. So, let's just close that. I [107:26] don't know why that's opening. We don't [107:28] need that. Uh let's go ahead and copy [107:29] this URL cuz this is the URL we're going [107:31] to. You can see there's already a [107:33] request coming in, but let's just [107:34] forward that. We don't need anything [107:35] with that. So, let's go ahead and open [107:37] up this browser. It says the login key [107:40] ring. Okay, so we can just type in [107:41] parrot. All right, there we go. Let's [107:43] just move this along. [107:47] All right, let's paste that in to go to [107:50] this URL. And you can see here we can [107:52] already see the request coming through. [107:54] So, the request won't send until we [107:57] click forward. So, it's kind of like a [107:59] man in the middle. It's like our proxy [108:03] only allows to forward this request when [108:05] we click the forward button. So if I [108:07] click the forward button now you can see [108:09] here we get the request of what this is [108:12] uh about. So we got the cookie [108:14] information. We've got index.php option. [108:17] So this is a PHP application. So let's [108:20] forward that request. And you can [108:22] actually see here here we are again on [108:24] the web app but we don't actually know [108:27] the credentials. So like I said, we need [108:29] to actually copy this request. So I know [108:32] this is very difficult to see. So let me [108:33] just uh let me forward this. All right. [108:36] So you see this. Let me try and make [108:38] this a little bit bigger here for you to [108:40] see. I've just made it a little bit [108:42] bigger here so that on the video you can [108:45] see it. So if we go to the proxy tab, [108:46] the interceptor is on. So this captures [108:49] any request coming through this browser [108:52] here through the proxy. So in order for [108:55] the request to go forward, we have to [108:57] press the button forward. We can also [108:59] drop the request if we don't want it to [109:01] go through. Anyways, let's forward this. [109:04] So you can see here if I do test test [109:07] and I click the button log in, we can [109:10] see here it says please wait. So the [109:12] request hasn't gone through yet. We can [109:14] see the type of request happening behind [109:16] the scenes. You can see this is a post [109:18] request and you can see the type of [109:20] request that is being sent. So we we've [109:22] got option which is the web application [109:24] action login. Uh username is test and [109:28] password is test. So what I want to do [109:30] here is I want to reuse this request. So [109:35] if you go to repeater, if you if you [109:37] rightclick and you send to the repeater [109:38] tab, the repeater tab just allows you to [109:41] repeat the request over and over again. [109:43] So if I go to the repeater and I click [109:46] send, you can see in the response tab [109:49] that we get a response, but it says [109:51] login failed. Try again. Success is [109:53] false. If I do like change the password [109:56] again and again, you see we're going to [109:58] have to do this manually. But the thing [110:00] is I don't want to do it manually. I [110:01] want to automate this. So we can [110:02] actually use fuff to do this. Um, which [110:05] is very nice. So if I send that again, [110:06] you're obviously going to see in the [110:08] response that the login has failed [110:09] because we don't have the correct [110:12] credentials. [110:13] So the best thing that we can do is [110:18] first of all let's let's see if it let's [110:20] just do user enumeration. Let's see if [110:22] we can actually figure out okay so it [110:25] says okay login failed try again. Um so [110:29] we don't actually know what the user is. [110:30] We have to actually figure that out [110:32] first. Uh, it could we could try admin [110:34] admin or just admin and then test 1 2 3 [110:39] login failed. Try again. Let's go back. [110:41] What did the response say? It says login [110:43] failed. Okay. Yeah. So, it just says [110:46] login failed. But you can do this with [110:48] fuff. So, that's what I'm going to show [110:50] you. So, go ahead and actually go to the [110:52] request, copy this request. Let's copy [110:56] this. There we go. I'm going to copy [110:59] that. I'm just going to shrink this for [111:01] now. [111:03] I'm going to go to the terminal [111:06] and I'm going to save it. So I'm going [111:08] to say micro. I'm going to call it [111:10] explorer [111:12] request or justre. You can call it [111:14] whatever. I've just called it request [111:16] like this. And I paste it in. Now this [111:19] is the request that we have here. So I [111:22] can send this over and over again. But [111:24] what I want to do here is go to the [111:26] username field, change this to fuzz. Oh, [111:29] we can we can do fuzz user [111:33] like that. And then we can also do [111:36] here uh password fuzz pass. So f pass [111:42] fuzz user and fuzz pass. I can just save [111:45] that and press quit. Ctrl S and then [111:49] controll Q to quit. So that's the that's [111:53] the uh request here. [111:56] So what I want to do is I want to supply [111:58] this within the tool [112:01] of fuff. So if I type in fuff, you can [112:03] actually do this with the request [112:06] parameter here. So look, it says here [112:09] this is a cluster bomb technique. So [112:11] request request protocol and the path to [112:15] the word list associated with the [112:17] keyword. So we've got the request and [112:20] this is going to be a clust bomb uh [112:22] technique or brute force. So file [112:24] containing the raw HTTP request right [112:26] and then the request proto uh the [112:29] protocol. So by default it's HTTP. So we [112:33] can say fuff uh the request is explorer [112:40] request like that. Then we can say [112:43] request [112:46] protocol. Yeah. So request protocol [112:48] let's copy that. Let's just paste that [112:51] in. So request protocol is HTTP like [112:54] this. And then we Oh yeah, we also have [112:57] to specify the mode as well. So we can [113:00] say dash mode it says okay so dash mode [113:05] it would be a cluster bomb. So we would [113:07] actually have to add that. So dash mode [113:10] is cluster bomb technique and then we [113:14] can supply the word list which has to be [113:17] a password list. So we could use the [113:19] rocky.ext. I think we've got one [113:21] actually. Um, so if I go to cd or sorry [113:24] ls user share word list, we've [snorts] [113:28] got a rocky.ext file. So let's use [113:30] rocky.text. It's it's by default share [113:33] word list and then rocku.ext. [113:36] But we have to do colon and then fuzz or [113:40] sorry fuzz user and then we have to [113:44] repeat this again. We can also do slash [113:46] user share word list. So basically I'm [113:49] using the word list against the [113:52] parameter that we've added in the [113:54] request to tell the fuff tool to brute [113:56] force this end user and also the [114:00] password. So rockview text fuzz [114:04] password. [114:07] Uh let's see if this works. Actually it [114:09] seems to be frozen right now cuz it [114:12] first has to actually brute force uh [114:14] whatever the user is. So it's going to [114:16] take a long time for this even to [114:18] happen. [114:20] So but the cluster bomb technique will [114:22] basically try every username and [114:25] password with the rocky.ext file. But it [114:28] just shows you like the capabilities of [114:31] the FUF tool, how you can repeat a [114:34] request and try to brute force into a [114:37] login page with FUF. [114:40] So FUF can perform domain enumeration, [114:43] subdomain enumeration, directory [114:45] fuzzing, and also brute forcing with the [114:47] cluster bomb technique. But this would [114:49] take a long time anyways. So for the [114:52] sake of this demo, [114:54] let's just do let's go back to our [114:57] request [114:58] and let's just take a guess on what the [115:02] username is. So I'm just going to say [115:05] that the username is admin. And if I [115:08] press save. So I'm just guessing that [115:10] maybe it's admin admin. Maybe it's admin [115:13] password 1 2 3. I don't know. I just I'm [115:15] just want to I want to get past this [115:17] demos just to show you the capabilities [115:19] of the fuff tool. So we can say username [115:22] is equal to admin, but we can still keep [115:24] this the same fuzz password. Uh we don't [115:27] have to call it fuzz password, but it's [115:29] just best practice to understand what it [115:31] is called. So if I save that and if we [115:34] get rid of the fuzz user, we don't [115:36] actually need that anymore. We don't [115:38] need that. We just got fuzz password. We [115:42] can still keep it like this. So if we [115:43] run it, it's just going to take the [115:44] existing uh username. So hang on, let me [115:48] just refresh. So it's going to take the [115:50] existing username, which is admin, and [115:52] it's just going to use the word list uh [115:54] to go through to guess the password with [115:56] that user. Let me try and reconnect to [115:59] it. Oh, there we go. Maybe [snorts] that [116:01] was the issue. Maybe the reason why it [116:02] wasn't sending through was because it [116:04] was just not connecting properly. I [116:07] don't know. I could do the same thing [116:09] here with the cluster method. So, if I [116:13] perform this request, oh, okay, we might [116:15] need to filter that out. So, let's [116:17] filter that. Um, okay, we need to filter [116:20] out by one. Okay, let's try that. [116:25] I mean, come on, really? [116:28] So if I go ahead and run this again, you [116:32] can see here it's going to try all those [116:34] combinations. And you can see we have [116:36] successfully brute forced this login [116:39] page because now you can see it says [116:41] login admin and password is admin. So [116:45] the username is admin and the password's [116:47] admin. So let's go ahead and try that. [116:50] Admin. So we've got admin admin. We have [116:54] successfully logged in. Look at that. [116:57] That's brilliant. We have successfully [117:00] logged into the application. That shows [117:02] you how beneficial tools like FUF and [117:06] Hydra can be to get rid of the manual [117:09] labor when doing security auditing or [117:13] brute forcing or fuzzing. It just saves [117:14] a lot of time so that you don't have to [117:17] manually brute force a login page. you [117:20] do it with existing tools to try and [117:22] fuzz the application [117:24] to get a successful login response. So [117:27] that's brilliant. We are now logged into [117:29] the application. And again, I would like [117:32] to address this. If you want to continue [117:34] learning, I have a school community for [117:36] you to check out. The link is in the [117:39] description below. Everything in this [117:41] community is for educational purposes [117:43] and you can level up have access to [117:45] these courses which is available within [117:47] the community. If you want ongoing [117:50] further learning these resources will be [117:52] linked below for you to read and check [117:54] out yourself. It's a private community [117:56] and you have access to courses and [117:58] resources for further learning. Burpuite [118:00] like we've looked at before let you see [118:03] and understand the HTTP requests in your [118:08] browser. In ethical hacking, this helps [118:10] you test how web applications, web apps [118:13] handle input sessions, sessions, forms, [118:17] cookies, and parameters that you can try [118:20] and manipulate or abuse when resending a [118:24] request. It just allows you to test how [118:26] the web app is set up. So, we can see [118:28] this thing is called ext [118:32] explorer. I want to try and see if [118:34] there's any search exploit. [118:38] Uh, let's search extra. [118:42] So, okay. So, I don't I don't actually [118:44] have [118:46] search explore installed. No, I don't. [118:49] Pseudo app install. [118:56] So, I'm going to go ahead and install [118:58] exploit DB so I can actually use the [119:02] tool search exploit to search if there's [119:04] any vulnerabilities or exploits [119:07] associated to extra for this web [119:10] application. [119:14] So, you can see here, look at this. So, [119:17] we've got a file upload. Oh, wow. Look [119:20] at that. Okay, so wait, what version is [119:22] this? How can we see what version this [119:25] is? [119:26] It doesn't actually tell us. So, it says [119:28] explorer [119:30] um home. So, we're on the homepage right [119:33] now. This is like the website directory. [119:36] This is like all the all the code to [119:39] make the website work. But what I want [119:41] to see is the version. [119:46] What type of version is this? But [119:48] anyways, this could be vulnerable to [119:50] file upload. So, we got configuration [119:52] file here. [119:55] Log out. Admin. This is the admin. Okay, [119:57] this is interesting. Oh, we can also [120:00] change the password. What does this do? [120:03] Oh, look at this. Your version extra [120:06] 2.15. [120:09] So, we've got this in Explorer. It says [120:11] explorer 2.1 arbitrary file upload with [120:15] metas-ploit. That's interesting. [120:18] So, I don't think this exploitation [120:19] module is going to work because it's [120:22] behind another version. So that's for a [120:24] different version, but we have 2.1.15. [120:27] So we could just try and do it manually, [120:30] which is completely fine. So we could [120:32] try and upload a file upload attack. So [120:35] you could try and use a thing called [120:37] pony shell. [120:41] So we're going to try and use this. So [120:42] pony shell is a basically a reverse [120:45] shell. Um, but it it basically just [120:48] spawns a session for us so that we can [120:50] actually browse around on the victim's [120:54] server or the target server I should say [120:57] because this is an educational video. So [120:59] let's go to shell.php and all you need [121:01] to do is just copy everything that you [121:03] see here. Just go ahead and copy it. And [121:07] if we So if you copy all this code and [121:10] you go to explorer, if we go to new, [121:13] we're going to call this let's just call [121:14] it shell [121:17] uh file. Yep. Let's create that. So [121:19] we've already created it. It also needs [121:21] to be a PHP file, actually. So let's [121:24] let's probably let's get how do we get [121:26] rid of this? Let's delete that. Oh, we [121:28] can actually rename it. Okay. PHP. There [121:31] we go. And uh let's paste that in. So, [121:34] we got the pony shell. Uh, and now if we [121:36] save that, now if we actually go and [121:39] navigate on the server to, uh, [121:42] shell.php, [121:44] look at that. We are actually on the [121:47] main machine. So, it basically sets it [121:50] up as a webshell, but on the website. So [121:53] when we actually go to this crafted [121:55] directory here, uh this directory, [121:58] sorry, this file here, we can actually [122:00] go ahead and use pony shell to navigate [122:04] on the server. So we got robots.ext, [122:06] which is what we looked at earlier. We [122:08] can even go back a directory or we can [122:10] actually try to or even better, we can [122:12] even try and spawn our own bash session [122:16] from our terminal to browse around on [122:18] the server. [122:20] But look at this. We are actually on the [122:22] main machine right now, just on the [122:24] browser. If the admin finds this file on [122:26] their own web application, that may be [122:29] of a concern. But this is pretty cool [122:32] though. It just shows you how different [122:34] ways you can get access to a web server [122:38] through file upload vulnerability. You [122:41] see, what we could have done was [122:42] uploaded a custom PHP file so that when [122:45] we run it, just by going to the URL, it [122:48] spawns it on our terminal. But instead [122:49] of doing that, we just use pony webshell [122:52] to just spawn the shell on the web [122:55] server. So that when we can go to this [122:57] directory, we can interact with the web [122:59] server on the web page, [123:02] which is very nice. [123:05] So we can go to home. Nothing there. [123:10] This is pretty cool though. Anyways, so [123:12] yeah, we've basically hacked this web [123:14] application. So when you use search [123:16] exploit, [123:18] it doesn't automatically hack anything. [123:20] It helps you research known public [123:23] vulnerabilities. Always read the exploit [123:25] carefully and understand the affected [123:28] version and test only in a legal lab [123:31] environment. Now the last thing that [123:33] we're going to focus on in this course [123:36] is [123:37] Python scripting. Now, we looked at a [123:40] little bit of Bash in the beginning, but [123:42] I've gone ahead and created a basic [123:45] Python script that we're going to be [123:46] taking a look at. So, you can see here [123:49] I've created a Python's project [123:52] directory in the documents directory, [123:54] which you can go ahead and do. And you [123:56] can see here I've got basic.py. [124:00] Now, obviously, if I enter basic.py, [124:04] there's nothing in here. So, we're going [124:05] to take a look at the basics of Python. [124:07] That's why it's called basic.py. Pi. Um, [124:09] so we can just get familiar with what we [124:11] are doing. Now you can use nano, you can [124:14] use micro, you can use vim or you could [124:16] use vscodium up the top here. You can [124:18] just go here, click open folder, [124:22] python projects. And there we go. You [124:25] got your Python program. Just trust the [124:28] authors. There we go. And we can write [124:30] our Python code in here if you really [124:32] want to. So, for the sake of this, I'm [124:35] just going to use the text editor here [124:36] because it's got syntax highlighting. [124:38] It's also got suggestions. And we've [124:41] also got a terminal here as well. Uh, [124:45] view terminal. Here we go. So, the [124:47] terminal we can also run while we are [124:50] coding. We can run it in here. So, this [124:52] is good. This is a good start. So, to [124:54] check the Python version is to type in [124:57] Python 3 version. This is how you check [125:00] what Python version you have. Now you [125:02] can run Python 3 in the terminal just [125:04] like this but it just opens up [125:06] interactive mode which allows you to [125:08] actually just write Python code within [125:10] the terminal here. In order to exit this [125:12] you could just type in exit. Uh but you [125:15] can just you know do stuff in there. [125:16] Interactive mode is very helpful for [125:18] some things like one of the things that [125:20] you can use with interactive mode in [125:22] your terminal with Python is that you do [125:24] not need to save a file or run a entire [125:26] script. Python just reads your code, [125:29] evaluates it and prints that output. [125:32] or waits for the next line. So you can [125:33] just test and prototype things within [125:36] the interactive console here with [125:38] Python, but you have to write everything [125:40] line by line. So instead of doing it [125:42] like this, we're just going to write it [125:43] in the text editor so we can actually [125:44] have a full view of what we are coding [125:47] with libraries and stuff like that. Just [125:49] going to clear this terminal here. Just [125:52] going to press Ctrl L there. I'm going [125:54] to shrink this. So we're going to use [125:56] the terminal to run the program and [125:58] we're going to use the text editor to [126:00] write the program. So let's just get [126:02] started with some basics. So in order to [126:06] print something out in the terminal when [126:08] we run a Python program, we can type in [126:10] print. [126:12] So this print method allows you to print [126:15] anything out to the console. You can use [126:17] double quotations or single quotations [126:21] in the method here. So you can say, "Hi [126:24] there. How's it going?" [126:28] And if you press Ctrl S, or you can just [126:30] go to file and then save and you go [126:33] ahead and run Python 3 basic.py, [126:37] it's going to run the Python program, [126:39] and it's going to read line by line of [126:40] what you've got in the text file, your [126:42] Python script. So we're running this [126:45] method to print to the console saying, [126:48] "Hi there, how's it going?" You can add [126:50] anything in here because it's a string. [126:52] So you can add this string in double [126:54] quotations or single quotations. It [126:56] doesn't matter. Um so that's how you do [126:58] this which is very nice. Hi there. How's [127:00] it going? So printing allows you to just [127:03] print the console. It's very helpful for [127:04] when you run a Python program and you're [127:06] doing certain behaviors and methods [127:08] within the script because then you can [127:10] print what that response is. So for [127:12] example, let's say I send a request to a [127:15] website to get information about it and [127:18] then I bring it back that information [127:20] and say print information found and then [127:22] I just like print out what the [127:24] information is. So I can use print to do [127:25] that. Um another thing I want to show [127:27] you is variables. So variables [127:31] are something like this. So I can say [127:33] name is equal to declan. You can put [127:36] your name here. Name is equal to declan. [127:40] So this is a variable. With variables, [127:42] it can be anything. A variable is just a [127:45] stored value or stored data type. So a [127:50] variable stores information. So that's [127:52] what you call upon later. So you can say [127:55] name, house, address, whatever. So name [127:58] is equal to declan as in a string. And [128:02] in order to bring it here to say let's [128:05] say like hello and then name. Obviously [128:11] this is not going to work. I'll show you [128:13] why. So I enter name is equal declan [128:16] hello name. It's going to basically [128:18] print out what this data what this [128:21] variable is holding which is this data [128:24] string here saying declan. Now if I run [128:28] this it's just going to say hello name. [128:31] And you see it doesn't say hello Declan [128:32] because we forgot one more thing. In [128:34] order to call that variable within a [128:36] string, you can just take away the [128:37] string and put it here. And then you can [128:39] just add a little comma there. So if you [128:42] say hello name now, it will say hello [128:46] Declan. So you got to make sure that the [128:49] variable isn't just in the string like [128:51] this because if it's if it's in the [128:53] string here, the program doesn't know [128:55] what to call because it's in a string. [128:58] So it's just a string. it just reads it [129:00] as a string. It doesn't read it as a [129:01] variable. So, it doesn't see that you're [129:03] trying to call it. But what you can do [129:05] is you can do this. If you go to the [129:07] beginning here, this is another way of [129:09] doing it. Um, so you could do it like [129:11] this as I showed you, [129:13] which will call the variable. [129:16] Or you could do it like this. So, if I [129:20] do this, you can add a f in the [129:22] beginning. You could just say [129:25] name [129:26] like this. [129:28] See if I run this again, [129:31] it works the same. So there's different [129:34] ways of doing it. I prefer this method [129:36] like of doing it. So this is a Python F [129:40] string format. So basically what this [129:42] means is formatted string literal. F [129:46] strings just provides a a concise way to [129:50] embed expressions inside string literal [129:54] by prefixing the string with f using [129:58] curly braces here to call the variable. [130:00] So it's a very efficient way of doing [130:02] it. You can do it both ways. I prefer it [130:04] this way just in case like you have [130:06] multiple variables to call upon or other [130:09] methods that you want the behavior of [130:11] the program to do. So it's very nice to [130:14] do that. So again, if I run this again, [130:16] it still does the same thing. So it just [130:18] says hello Declan. It calls the name [130:22] variable in the print method using the f [130:25] string literal here. What you could do [130:27] as well, you can do a thing called [130:29] string concatenation, [130:32] which is like this. So you could do [130:34] hello. So if I get rid of the if string [130:37] literal and I do hello and then name [130:39] plus name. You can also do it like this. [130:41] So this is what you call string [130:43] concatenation. [130:45] It just basically joins strings or joins [130:48] whatever data you want to put together. [130:52] So it's basically a simple operator plus [130:55] operator here to call this variable. So [130:57] it just says hello in a string and then [130:59] plus the variable that you want to call. [131:02] So if I run that, there we go. It does [131:04] the same thing. So you can add some [131:07] space there as well. But you see it does [131:09] the same thing. Again, multiple ways of [131:13] doing it. I, like I said, I prefer this [131:15] way of doing it because it's just nice [131:17] and easy to read. [131:20] So, yeah, that's the basics of variables [131:23] and string literals. A variable in any [131:26] programming language, especially Python, [131:29] it's just a name that you give it that [131:31] acts as like a reference to something [131:34] that is stored in memory. So you can [131:36] create a variable the moment you assign [131:38] a value using an operator or you can [131:41] create a variable to store data like a [131:43] string or whatever it could be. So for [131:47] example in a in a real world practice [131:49] scenario we could do something like [131:51] this. So I'm just going to go ahead and [131:52] comment this out. So I just I did [131:54] control a to select everything and then [131:56] I pressed controll slash to comment it [131:59] out. So when you comment things out in [132:02] Python like this it's not going to run [132:03] anything. So if you comment out the line [132:05] of code, the Python program will not [132:08] read that commented line out. So it's [132:11] not going to read that line because it's [132:12] commented out. So what I want to do is [132:15] for example, if we do target is equal to [132:18] input, this is another method that we're [132:20] going to take a look at. So input, we'll [132:23] say enter target. Uh let's just say I [132:27] don't know IP as an example for [132:29] educational demo. So we say print and [132:33] then we'll say [132:36] uh target oh let me use this target is [132:42] and then target [132:45] see look this is just like a example of [132:48] how we can actually use these. So the [132:50] input method actually is like a [132:52] variable. So this is a variable. This [132:54] target is a variable. And we're using [132:56] the input method to capture the string [132:59] data that is put into this variable. And [133:01] then we basically just call it by [133:02] calling the print method to print it to [133:04] the terminal. So we can say print uh or [133:07] python 3 basic.py enter target IP. So [133:10] I'll just do mine. This doesn't do [133:12] anything. There's no there's no [133:13] functions here. It doesn't scan. It's [133:15] just basically storing the string data [133:17] and printing it to the terminal. So I [133:19] can just say just some random IP like my [133:22] modem on my network and you can see [133:25] there it says target is. It just prints [133:28] it on the terminal target is and then [133:30] the string that we stored in here with [133:32] the input method. It's just like a very [133:35] nice way to store values and call it. So [133:37] you can see how you would put this into [133:39] practice. Um which is also very nice. So [133:43] the next thing that I want to look at [133:45] here is a thing called if statements. [133:57] So if statements are also known as [134:00] conditionals. Basically it just allows [134:02] you to structure your program concisely [134:06] to understand what needs to be ran next. [134:09] So for example, if I have a port that is [134:12] open on my network that is port 80, I [134:16] can use an if conditional saying if if [134:20] the port [134:22] is equal to 80, then we can print saying [134:26] that this is a HTTP [134:31] servers [134:32] detected. [134:37] else [134:39] print [134:41] different [134:43] port. So you can see here if the port is [134:46] on port 80 if the port is equal to port [134:49] 80 then print HTTP service detected [134:52] otherwise say different port. Now if I [134:54] run this okay I forgot to add a another [134:58] equal there. So if I run this now [135:01] there we go it says HTTP service [135:04] detected. So if this port was something [135:07] else like port 22 and it's not port 80, [135:11] it's going to say different port. So you [135:14] can change things based on what the type [135:17] of condition is. So if the port is equal [135:19] to 80 or if the port is this, then do [135:23] this. So you're basically telling the [135:25] program what to do based on a situation. [135:28] So for example, if I get a response from [135:30] the website, print this. Otherwise, if [135:34] there's no response coming from the [135:35] website, the request didn't send [135:37] through, then say this. So, if [135:41] statements kind of structure your code [135:43] the way that the program should [135:46] function, the the way that it should [135:47] work. In Python, [135:50] an if statement is used to make [135:52] decisions in the code. It checks to see [135:55] if a condition is true or false and only [135:58] runs a specific block of code if that [136:01] result is true. So if the response of [136:03] the website is found on port 80 then we [136:07] can say website found port 80 is open [136:10] else different port you know something [136:12] else. The next thing that I want to show [136:15] you here is so that's if statements. [136:18] Let's take a look at loops. [136:21] So loops in Python are this. So for [136:25] example let's say that I'm looping [136:27] through ports. So let's say for port in [136:31] this array. So array is basically where [136:34] you can store data. So I'm just going to [136:37] say port 21 22 port 80 and port let's [136:41] say 443. [136:44] I'm going to say print [136:47] checking port. [136:49] Now you can do it like this like I [136:52] showed you or you can do it the way that [136:55] I like to do it which is import and then [136:58] come back here and put the f you can put [137:00] the f here [137:02] and save it. So now if you run this [137:04] Python program you can see right away it [137:07] checks to see what ports are in this [137:09] array. So this is what looping does. So [137:13] looping just loops whatever is in the [137:14] array as you can see here. So for every [137:17] port that's in this array, we can check [137:19] to see if it is open. So you can see [137:21] it's like just checking the port. But [137:23] this doesn't do anything. It just prints [137:25] to see if that port is open. But we can [137:27] actually code some logic to say, okay, [137:29] check to see if these ports are open. [137:32] And we can use like a library called [137:34] sockets to print out on the terminal to [137:36] check to see if port 21 or port 22 or [137:38] port 80 is open, which is very nice. So [137:40] you can see how you can actually apply [137:42] that logic. All right. All right. So, [137:43] what I'm going to do is I'm just going [137:44] to delete everything that I I have up [137:46] here. You don't have to do that, and I [137:48] don't recommend that. I suggest you save [137:50] what you have already. And also take [137:52] notes as you go along. What I want to [137:53] show you next is a thing called import [137:56] modules. [137:57] So, import modules is modules that are [138:02] basically programmed by someone else, a [138:04] another programmer or maybe a team of [138:07] programmers, who knows? You can import [138:10] libraries in your code such as socket, [138:13] you can import OS, you can import [138:16] requests, you can import whatever. So [138:19] these are just uh different libraries [138:21] that you can import into your code which [138:23] basically means that you don't have to [138:24] do everything from scratch. You can use [138:27] existing libraries that have already [138:29] been made to implement in your code to [138:31] test things. So I can say import socket [138:33] and then I can say uh print socket get [138:36] host name host name like this. So this [138:39] is a method in the socket library which [138:41] you have to learn more about. Every [138:43] library that you use in your code they [138:46] all have different documentation on how [138:48] to use it. So you just have to search up [138:50] for example if I want to learn more [138:52] about requests I have to go search up [138:54] the requests library and learn about [138:56] that too. It's very helpful though. So [138:59] you can say import socket and then just [139:00] get host name and essentially what this [139:02] does it just tells me what my device [139:04] name is basically on my network. Um so [139:07] basically socket.gethost name of my [139:10] machine which is just parrot. So that's [139:12] what other devices on the network would [139:14] recognize me as. So that's also pretty [139:17] nice. And when you import packages so [139:20] when you import these libraries and you [139:21] try and run your code sometimes it will [139:23] say that oh you know package not found [139:25] like you need to install it. So if you [139:28] ever get that, you can actually install [139:29] these libraries uh by doing this. So pip [139:32] 3 install and then the library name. So [139:36] let's say requests, you can do that and [139:38] it will go ahead and install it. But by [139:40] default, it's already installed on Power [139:42] OS because Python is used most of the [139:44] time anyways for everything. Python is [139:46] pre-installed on Linux, but if you ever [139:48] do get that, that's how you install it. [139:49] But you have to install it within a [139:51] virtual environment with Python. So [139:53] that's pretty cool. So let's actually [139:55] get a basic example of like a good [139:58] program. So let's import requests [140:02] and let's say URL is equal to [140:06] http exploreryx [140:10] like the machine that we've been doing [140:12] in the beginning and so URL is the [140:14] variable and let's create another v [140:16] variable here. Let's make another [140:17] variable here called response is equal [140:19] to requests.get [140:21] which is a method. to get the URL and [140:24] let's just try and see if the response [140:27] status code uh comes back and also let's [140:31] print response headers. So basically [140:34] what this will do is if there is a [140:36] response it's going to basically perform [140:38] a get request to this URL and print out [140:41] the status code to see if it is valid. [140:42] So if we go ahead and run this there we [140:45] go. It means that this website is [140:48] running and it's actually giving us [140:49] information such as uh the server type. [140:52] So this is all in the headers of the web [140:54] application which is again very nice. [140:56] And we can also see the status code here [140:58] which is 200 meaning the website is up. [141:00] It's running. So you can you can apply [141:01] if statements like if the response uh [141:05] status code is equal [141:08] to 200. So the response 200 then you can [141:12] just print [141:14] like this print [141:17] uh let's just get rid of this. You can [141:19] do that but I'll just print uh website [141:23] is up and running [141:29] like that. Or you can just say website [141:31] is up. Okay let's just do that. There we [141:34] go. Website is up. You can see that [141:36] right there. And if the website is not [141:38] up, you can just say else, you know, if [141:40] the website doesn't come back, you can [141:42] just say website [141:45] down, [141:48] but it's up, so it's not down. But you [141:50] get the point. It's It's really nice of [141:53] how you can do things like this. So [141:54] website is up. It's running. That's [141:56] great. Uh, print website down. And you [141:58] can also like stylize it if you want. [141:59] Like I tend to do this a lot in my [142:01] scripts, like when I code in Python. [142:03] It's just like, [142:05] you know, it just creates like a nice [142:07] visual flare when you look at it. You [142:08] know what I mean? So I can just like run [142:10] that. It says website is up. You know, [142:12] it just makes it look cool. So that's [142:14] how you do it. So if the status code is [142:16] equal to 200, meaning the website status [142:18] code is up and running, we say that the [142:19] website is up. Else if it's not, the [142:21] website's down. So you can see how we [142:23] can actually apply that logic in our [142:26] code, which is very clean and easy to [142:29] understand. Now, what I want to do is [142:31] let's actually create a basic recon [142:35] script. So, I'm going to go ahead and [142:37] just delete everything cuz that was the [142:39] basics that I wanted to show you. Now, I [142:42] only have basic.py, but I want to rename [142:44] it. So, let's move basic.py and call it [142:48] recon.py. [142:51] There we go. So, basic.py is not a [142:54] thing, but recon.py is. So, we're going [142:57] to create a basic recon script. So, this [143:00] is going to be interesting. So, you [143:02] know, buckle up, put your seat belt on. [143:03] This is going to get really good. So, [143:05] we're going to use libraries to help us [143:07] in our code. So, let's use the socket [143:10] library and the requests library. So, [143:12] we're going to use the socket library to [143:15] maybe test uh to see if there's ports [143:17] open, maybe. And we could even use [143:20] requests to see if the website is up and [143:22] running, you know, just like how we did [143:24] before, but a little bit more in detail. [143:26] So let's go ahead and do that. Let's [143:27] just say import socket import request [143:33] like this. And so let's actually, you [143:36] know, structure this properly. So we're [143:38] going to use functions. And by the way, [143:40] the first thing that I want to do is [143:42] just say if [143:44] main [143:47] um oh sorry not main name [143:51] uh is equal to [143:55] main like this then run a function. So [143:59] I'll show you what this does in a [144:01] second. I add this at every single line [144:03] of my Python code at the very end [144:05] because basically it tells the program, [144:07] hey, this is the first function that you [144:09] should run throughout the entire script. [144:12] So, first let's create a function and [144:14] let's call it banner. So, the banner is [144:18] the first thing that the person looks at [144:20] when they run the tool. So, I'm pretty [144:22] sure you've ran tools like metas-loit or [144:24] SQL map and things like that. They have [144:26] a banner. It's just like a little little [144:29] logo for the tool. It just makes it nice [144:31] and easy to like, oh wow, you know, like [144:34] visually instead of just looking at [144:35] white text and, you know, there's no [144:39] banner really, but we're just going to [144:41] have a simple text, right? So, let's [144:43] just do print [144:45] [clears throat] [144:46] uh simple reconcript [144:49] tutorial tutorial. There we go. So, [144:52] that's our banner. Now, what I do want [144:54] to run, let's create another function [144:56] called get IP, [145:00] right? Which I'll show you more about in [145:03] just a moment. In fact, yeah, we'll get [145:06] back to that in just a moment. Let's do [145:07] main. So, we're going to create our main [145:10] function that we're going to run. We're [145:12] going to call the banner function and [145:14] the main function. So the banner would [145:16] run, but the main function runs and [145:18] executes the banner function when the [145:21] program runs. [145:24] And we're going to say target is equal [145:27] to input. [145:30] And we're going to say enter target [145:32] domain. Just like that. Or maybe maybe [145:36] let's kind of help people understand [145:38] what it is. So we can say enter domain. [145:43] Uh let's just say [145:46] example [145:49] example.com [145:52] and we can [145:54] oh sorry example.com like that [145:58] and add some spacing. So that's the [146:00] target and the URL can be uh input is [146:04] equal to oh sorry not input equal to is [146:07] this [146:09] enter URL [146:12] example [146:14] and then we also give here an example [146:16] which is exampample.com. [146:20] So these two inputs is what the user has [146:23] to input for you know to continue to run [146:26] other functions that we'll be running in [146:28] just a moment. So we can say print. So [146:30] you just got to plan out how you want [146:32] the script to work and run. So we can [146:34] say resolving domain [146:37] just to make it look cool. And this will [146:40] run when we actually have another [146:42] function which is getting information [146:44] about the domain and also the URL the [146:47] headers. So we're going to have two [146:49] functions. So we got get IP which is [146:51] what I want to create and we're going to [146:53] pass this target variable as a parameter [146:56] to that function. So let's actually [146:58] create it. So let's say def get uh ip [147:02] here and we don't need and what we are [147:06] passing in here is a custom variable [147:08] called the domain and we can just say [147:11] try this. So this is the try uh method [147:15] try catch method in Python try except [147:19] method in Python is we try this and then [147:22] do something else. So it's similar to [147:23] the if statement but it's just a better [147:25] way of structuring the code as well. So [147:27] we could say IP is equal to socket [147:30] gethost [147:32] host name and then we just say domain [147:34] right? So that's the domain and we can [147:36] say print [147:38] uh let's use f we could just say uh [147:41] let's do plus and then just say IP [147:44] address [147:47] and then pass in the IP. Can you see [147:49] what we're doing? So this is the IP [147:50] address variable and we're saying socket [147:52] get host name of the domain which is the [147:54] domain in here. So target is input. We [147:57] capture this string variable in this [147:59] input method. Store it in this variable. [148:02] Call this me this function with this [148:04] variable in it as the domain. And we say [148:07] IP is equal to socket.gethostname [148:09] method. And we print out what the IP [148:11] address is of that domain. And if it [148:14] doesn't connect, we can say expect [148:17] except. So try except socket [148:22] dot [148:23] error like this. [148:26] Print [148:31] [snorts] [148:34] could [148:36] not resolve donate [148:41] like that. So obviously if you run this [148:42] it's not going to do anything yet [148:43] because we're still uh busy writing some [148:47] stuff but you can run things to see like [148:51] where you would get an error if there is [148:54] any error. So it looks like we got a [148:56] syntax. What is that invalid syntax? Um [149:00] it could be it could be this. This is [149:02] probably invalid. So I would have to oh [149:05] maybe wait what could be invalid? Oh I [149:08] see I see the issue. It's this here. [149:11] There we go. So now if I run that, it's [149:14] okay. There we go. So now we've got a [149:15] different error which is if statement on [149:17] line 25. We go to line 25. Uh yeah, so [149:21] this here hasn't actually called the [149:22] function yet. So we could just say main [149:25] for now. We don't actually have to have [149:26] that just yet. Well, actually, yeah, [149:28] that'll be good that we do cuz that's [149:30] the main function we want to run. Uh so [149:32] we got here simple recon script [149:33] tutorial. That's the banner. Enter [149:35] domain example. So we could just say [149:37] http [149:38] uh let's do exploreryx [149:42] uh enter URL. Okay, well that was the [149:45] URL. So actually my bad. So let's run [149:47] that. So let's do explorer. So that's [149:49] the domain and then the URL which is [149:52] explorer [149:54] nyx. So get host name takes no [149:56] arguments. Okay. So we need to finish [149:58] off the rest of the script here because [150:00] we also need to get the headers as well. [150:02] So that's what I want to do next. I can [150:05] see the issue right. So get IP [150:10] of the to [150:14] also get headers. Let's actually create [150:16] that function next. Let me fix that once [150:19] we are done. So let's just continue [150:21] because I want to write the rest of the [150:22] script out. So get headers. Headers is [150:25] in the URL. So, we're going to say URL [150:28] and then we're going to say try this [150:31] response [150:32] is equal to requests.get [150:36] URL just like we did before. Let's [150:38] actually add a timeout. [150:41] So, timeout is equal to five. [150:45] And let's just say print f [150:48] status code. [150:51] Oops. [150:52] Status [150:55] code [150:57] here is response dot stat oh status [151:04] code [151:06] just like that status code. There we go. [151:09] Finally. So we are printing the status [151:11] code and then we're going to print out [151:13] the headers just to make it clean [151:18] while we are running the code here. So [151:21] we could say headers [151:23] like this. Uh we can also display it [151:26] like that. Yep. And then so for every [151:28] header so it's going to go loop through [151:31] that header and it's going to print the [151:32] header. So we're going to say for every [151:33] header value in oh oops in the response [151:39] in the request headers. So in the [151:41] response headers items [151:45] I'm going to say print [151:48] f [151:50] head header [151:52] and then also print the value which is [151:56] what you're going to see when it [151:58] [clears throat] is printed. And then [152:00] let's add this ex accept. [152:04] Okay, don't add that again. except [152:05] requests do exceptions. [152:10] So this is basically saying if there's a [152:13] request failure [152:15] meaning if there's a request that [152:17] doesn't get received or doesn't come [152:20] through it is an error and we can just [152:23] say print [152:26] uh error connecting [152:30] connecting [152:32] to website [152:36] like this. Let's actually go back and [152:38] add this. So we can actually call [152:40] whatever that error is. So like this in [152:43] the in the string so that we can [152:44] actually read what the error is. So this [152:46] is looking good. This is actually well [152:48] structured the way that I like it. But [152:50] we actually need to call it down here in [152:51] the main function. So we're going to say [152:52] print [152:54] getting http headers like this. And then [152:58] we can call that function saying get [153:01] headers here which is also calling the [153:06] URL parameter. There we go. So let's [153:09] actually go ahead and let's just see [153:11] what errors we have in this code. Okay. [153:14] Enter the domain. So exploreryx [153:19] http [153:21] explorer nyx. [153:24] Okay. So we got some errors here. So [153:26] soccer.host Host name takes no [153:27] arguments. It takes no arguments. And [153:29] then also on line 33, get IP target and [153:32] main H. Okay, let's actually take a look [153:34] at these errors. [153:39] So we got get IP target. Yep. [153:45] And then the domain [153:48] at the top here. So get host. Oh, sorry, [153:53] not host name. It's host by name. Sorry, [153:57] I realized that I used the wrong method [154:00] here. So, it's get [154:02] get host [154:04] sorry get host by name. Right. Okay. I [154:09] think that is right. We can also check [154:11] the documentation. We can go on the [154:13] website and look at the library modules [154:15] to see if we are using it correctly. So, [154:18] we can say explorer NYX. [154:21] Explorer NYX. [154:24] So, get headers URL. So, the other error [154:26] is gone. Uh, did you mean yes, I did [154:29] mean that. So, we made a slight syntax [154:32] error. Uh, just a spelling mistake here. [154:34] So, let's add that. There we go. I fixed [154:36] it like a boss. So, I fixed that error. [154:39] Let's run. Uh, what is this error on [154:42] line 36? URL. [154:45] Get headers URL. [154:48] Uh, we have it displayed there. It [154:50] should work. So, let's try that. [154:52] Explorer NYX. [154:55] Uh, http explorer [154:59] NYX. [155:01] Uh, value. Did you mean value on line [155:04] 22? You see, I typed too fast. [155:07] Oh, yes. I did mean value. What in the [155:10] heck? Value. There we go. Sorry, I made [155:13] a spelling mistake there. All right, [155:15] let's try this again. So, explorer.nyx [155:18] NYX [155:20] http [155:22] exploreryx [155:25] Hey, there we go. So, it worked. All [155:28] right, look at that. [155:30] So, let's just do this again. So, recon [155:33] Explorer [155:36] NYX httpernyx. [155:40] So, we enter the domain, which is the [155:43] the domain of the website, and then we [155:45] enter the website URL. So, it's going to [155:47] pull the IP address to see if it's up [155:50] and running. It's going to get the host [155:51] name by name, the domain, and it's also [155:54] going to print the headers. So, if I run [155:56] that, it says resolving domain. IP [155:58] address of that domain is 192.168.156. [156:02] Getting HTTP errors. We can see the [156:04] status code is 200. And it displays the [156:07] headers. You see it loops through the [156:09] values of the headers and displays the [156:11] value, the text of the headers, the [156:13] header value. So the headers is this and [156:16] then the value is the value given in the [156:19] headers. So this is a very clean way of [156:23] utilizing Python scripting to save a lot [156:27] of time when we do a lot of the manual [156:29] work. Right? So using Python is very [156:32] helpful to program things like this [156:34] because it helps automate things when [156:36] you do ethical hacking. If you've gotten [156:38] this far in the course, please don't [156:40] forget to leave a like and subscribe. [156:42] Considering that this course is getting [156:44] a little too long, I'm going to go ahead [156:46] and end it here. Thank you for watching [156:48] this video and I'll see you in the next. [156:51] And again, I would like to address this. [156:54] If you want to continue learning, I have [156:56] a school community for you to check out. [156:58] The link is in the description below. [157:01] Everything in this community is for [157:02] educational purposes and you can level [157:05] up, have access to these courses which [157:07] is available within the community if you [157:09] want ongoing further learning. These [157:12] resources will be linked below for you [157:14] to read and check out yourself.