Hi guys, my name

is Aarya and I'm going

to be your instructor
for this course today.

So in this Ethical
Hacking full course video,

we'll be learning almost

everything that is required

for you to get started

as an Ethical Hacker.

So come let's quickly go

over the topics

that we are going

to be covering today firstly.

We're going to be going

to the basics of cyber security

and cryptography

where we'll be learning

the key concepts

of confidentiality
integrity and availability

and how the cryptography

Concepts also tie

into the whole picture next.

We'll be looking
at some cyber threats.

We be seeing

how the Cyber threads

actually affect our computer

and then we will also see

how we can mitigate them.

After which we will be looking

into the history

of ethical hacking.

We learn how this all began

in the Massachusetts
Institute of Technology.

And then we will be looking

into the fundamentals

of networking and ethical

hacking in this will be learning

the various tools

that are used

in ethical hacking and also

the network architectures.

These tools are used

in after this.

We will be having a look

into what the most

famous operating systems

that is there.

That is Kali Linux.

Kali Linux is used

by ethical hackers

and penetration testers all

around the world

will be learning

how to install this

on our local systems

will be learning the tools

that come along with it

and Bash we should be using

them after that.

We'll be learning
about penetration testing

and penetration.

Testing is a subset
of ethical hacking.

So in this we will be learning

about a tool called Metasploit

and using Metasploit

will be learning.

Learn more about vulnerability

analysis and how we
can install back doors
in different computer systems

and take advantages

of these vulnerabilities now

nmap is also another tool

that we are going

to be discussing in this course,

we will be learning

how we can use nmap

to gather information

from our networks and

how we can use this information

to our advantage after that.

We'll be learning deeply

about three cyber attacks

that are there

in this industry first

is cross-site scripting secondly

distributed denial of service

and thirdly SQL

injection attacks.

Now we be doing these attacks

ourselves on dummy targets

and learning more

about these attacks

and how they are orchestrated

and thus we will be learning

more about how we

can mitigate them.

If we actually become
ethical hackers now,

we will also be discussing

some very Advanced cryptography

methods called steganography,

which is basically used

for hiding digital code

inside images last but not the

least we will be also discussing
how you could become
an ethical hacker yourself.

So we'll be discussing
a roadmap will also

be discussing the job profiles

that are there in the industry.

Re and we will also

be discussing the companies

that are hiring for these job

profiles along with the salaries

that they are trying to offer.

Also, we won't be leaving

hanging right there will also

be discussing the 50 most

common interview questions

that come along

with these job profiles

so that you can snag

that job interview and if you do

like our content in the end,

please leave us a like,

please leave a comment

if you want to and do hit

the Subscribe button

so that you can

join our ever-growing

community of learners.

It can be rightfully said

that today's generation

lives on the internet

and we generally users

are almost ignorant as to

how those random bits of ones

and zeros Rich securely

to a computer.

It's not magic its work

and sweat that makes sure
that your packets reach to you
on sniffed today Ira ball

from at Eureka.

I'm here to tell you guys

about how cybersecurity makes

this all possible now

before we begin let me brief

you all about the topics

that we're going to cover today.

So basically we're going

to ask three questions.

Options that are important

to cybersecurity firstly
we're going to see why

cyber security is needed next

we're going to see

what exactly is cyber security

and in the end I'm going

to show you also a scenario

how cybersecurity can save

a whole organization

from organized cybercrime.

Okay.

So let's get started.

Now as I just said we

are living in a digital era

whether it be booking a hotel

room ordering some dinner

or even booking a cab.

We're constantly using

the internet and inherently

constantly generating data

this data is generally He

stored on the cloud

which is basically a huge

data server or data center
that you can access online.

Also, we use an array

of devices to access
this data now for a hacker.

It's a golden age

with so many access points

public IP addresses

and constant traffic

and tons of data to exploit

black hat hackers are having

one hell of a time

exploiting vulnerabilities

and creating malicious software

for the same above

that cyber attacks are evolving

by the day hackers

are becoming smarter

and more creative

with their malware's.

And how they bypass virus scans

and firewalls still

baffled many people.

Let's go through some

of the most common types

of cyber attacks now,

so as you guys can see I've

listed out eight cyber attacks

that have plagued us since

the beginning of the internet.

Let's go through them briefly.

So first on the list,

we have General
malware's malware is

an all-encompassing term
for a variety of cyber threats

including Trojans viruses

and worms malware
is simply defined as code

with malicious intent

that typically steals

data or destroy.

On the computer
next on the list.

We have fishing often

posing as a request for data

from a trusted third

party phishing attacks are sent

via email and ask users

to click on a link

and enter the personal

data phishing emails have gotten

much more sophisticated in

recent years making it difficult

for some people to discern

a legitimate request

for information from a false

one phishing emails often fall

into the same category as

spam but are more harmful

than just a simple ad

next on the list.

We have password attacks.

It's a password attack is

exactly what it sounds

like a third party trying

to gain access to your system.

My tracking a user's password.

Next up is DDOS

which stands for

distributed denial-of-service

DDOS attack focuses

on disrupting the service

of a network a darker send

High volumes of data

or traffic through the network

that is making a lot

of connection requests

until the network

becomes overloaded

and can no longer

function next up.

We have man-in-the-middle
attacks by impersonating

the endpoint in
an online information.

That is the connection

from your smartphone

to a website the MIT.

Emma docs can obtain information

from the end users and entity he

or she is communicating
with for example,

if your Banking online

the man in the middle

would communicate with you

by impersonating your bank

and communicate with the bank

by impersonating you the man

in the middle would then receive

all the information transferred

between both parties

which could include

sensitive data such as

bank accounts and personal

information next up.

We have drive-by downloads

through malware on a Ledge.

Emmett website a program

is downloaded to a user system

just by visiting the site.

It doesn't require
any type of action
by the user to download
it actually next up.

We have mail advertising

which is a way to
compromise your computer

with malicious code

that is downloaded
to your system

when you click

on an effective ad lastly,

we have Rogue softwares,

which are basically malware's

that are masquerading as

legitimate and necessary

security software

that will keep your system safe.

So as you guys can see

now the internet sure

isn't the safe place.

As you might think

it is this not only applies

for us as individuals.

But also large organizations.

They're having multiple

cyber breaches in the past

that has compromised the privacy

and confidentiality of a data.

If we head over to the site

called information is beautiful.

We can see all

the major cyber breaches

that have been committed.

So as you guys can see even

big companies like eBay,

AOL Evernote Adobe

have actually gone
through major cyber breaches,

even though they have a lot

of security measures taken

to protect the data

that they contain

so it's not only

that small individuals

are targeted by hackers

and other people

but even bigger organizations

are constantly being targeted

by these guys.

So after looking at all sorts

of cyberattacks possible
the breaches of the past

and the sheer amount

of data available.

We must be thinking

that there must be some sort

of mechanism and protocol

to actually protect us from all

these sorts of cyberattacks

and indeed there is a way

and this is called

cyber security in

a Computing context security

comprises of cybersecurity

and physical security.

Both are used by

Enterprises to protect

against unauthorized access

to data centers

and other computerized

systems information security,

which is designed to maintain

the confidentiality integrity
and availability of data is

a subset of cybersecurity
the use of cyber.

Cybersecurity can help prevent

against cyberattacks data

breaches identity theft

and can Aid in Risk Management.

So when an organization
has a strong sense

of network security

and an effective
incident response plan,

it is better able to prevent

and mitigate these

attacks for example

and user protection defense

information and guards

against loss of theft

while also scanning computers

for malicious code.

Now when talking

about cybersecurity,

there are three main activities

that we are trying to protect

ourselves against and they

are Unauthorized modification

unauthorised deletion

and unauthorized access.

These freedoms are

very synonymous to the very

commonly known CIA Triad

which stands for confidentiality

integrity and availability.

The CIA Triad is also

commonly referred to as
a three pillars of security
and more security policies
of bigger organizations.

And even smaller companies are

based on these three principles.

So let's go through
them one by one.

So first on the list we have

confidentiality confidentiality
is roughly equivalent

to privacy measures
undertaken to ensure

confidentiality are designed

to prevent sensitive information

from reaching the wrong people

while making sure

that the right people

can in fact get it access

must be restricted.

To those authorized to view

the data in question

in as common as well for data

to be categorized

according to the amount

and type of damage

that could be done.

Should it fall into

unintended hands more

or less stringent measures

can then be implemented across

to those categories?

Sometimes safeguarding
data confidentiality meanwhile

special training for those privy

to such documents

such training would typically

include security risks

that could threaten

this information training

can help familiarize ourselves.

Her eyes people

with risk factors

and how to guard against them

further aspects of training

can include strong password

and password related

best practices

and information about social

engineering methods to prevent

them from bending

data handling rules

with good intention

and potentially
disastrous results.

Next on list.

We have integrity Integrity

involves maintaining

the consistency accuracy

and trustworthiness of data

over its entire lifecycle data

must not be changed in transit

and steps must be taken

to ensure that data.

Cannot be altered by

unauthorized people for example

in a breach of confidentiality.

These measures include

file permissions and user

access controls Version Control

may be used to prevent

are honest changes

or accidental deletion

by authorized users
becoming a problem.
In addition.

Some means must be in place

to detect any changes in data

that might occur as a result

of non-human caused events

such as electromagnetic pulses

or server crash

some data might include

checksums even cryptography.

Graphic checksums for

verification of Integrity backup

or redundancies must
be available to restore

the affected data

to its correct State last

but not least is availability

availability is best ensured

by rigorous maintaining

of all Hardware performing

Hardware repairs immediately

when needed and maintaining

a correctly functional
operating system environment

that is free
of software conflicts.

It's also important to keep

current with all necessary

system upgrades providing

adequate communication bandwidth

and preventing the occurrences

of Bottlenecks are equally

important redundancy failover

and even higher availability

clusters can mitigate

serious consequences

when hardware issues

do occur fast in
as adaptive Disaster
Recovery is essential

for the worst-case scenarios

that capacity is reliant

on the existence

of a comprehensive Disaster
Recovery plan safeguards

against data loss

or interruption in connection

must include unpredictable

events such as natural disasters

and file to prevent data loss

from such occurrences

a backup copy.

He must be stored
in a geographically

isolated location,

perhaps even in a fireproof

water safe place

extra security equipments

or software such as firewalls

and proxy servers

and goddess against down times

and unreachable data you

to malicious actions such as

denial-of-service attacks

and network intrusions.

So now that we have seen what we

are actually trying to implement

when trying to protect

ourselves on the internet.

We should also know the ways

that we actually
protect ourselves

when we are attacked

by cyber organizations.
So the Step to actually mitigate
any type of Cyber attack is

to identify the malware

or the Cyber threat

that is being currently going on

in your organization.

Next.

We have to actually analyze

and evaluate all

the affected parties

and the file systems

that have been compromised

and in the end we have

to patch the hole treatment

so that our organization

can come back

to its original running State

without any cyber breaches.

So how is it exactly done?

This is mostly done by actually

calculating three factors.

The first factor is vulnerable.

Leti the second factor is threat

and the third is risk.

So let me tell you about

the three of them a little bit.

So first on the list

of actual calculation is
we have vulnerability.

So a vulnerability refers
to a known weakness of an asset

that can be exploited by

one or more attackers.

In other words.

It is a known issue

that allows an attack

to be successful.
For example,

when a team member resigns

and you forget to disable

their access to external

accounts change logins

or remove their names

from the company credit

cards this leaves.

Your business open

to both unintentional
and intentional threats.

However, most vulnerabilities

are exploited by automated tacos

and not a human typing

on the other side

of the network.

Next testing for vulnerabilities

is critical to ensuring
the continued security

of your systems
by identifying weak points

and developing a strategy

to respond quickly.

Here are some questions

that you ask when determining

your security vulnerabilities.

So you have questions

like is your data backed up

and stored in a secure off-site

location is your data stored

in the cloud if yes,

how exactly is
it being protected

from cloud vulnerabilities?

What kind of security

do you have to determine
who can access modify

or delete information from

within your organization next

like you could ask questions

like what kind of antivirus

protection is in use?

What is the license currents are

the license current?

And is it running
as often as needed?

Also, do you have

a data recovery plan

in the event of
vulnerability being exploited?

These are the normal questions

that one asks when actually

checking their vulnerability.

Next up is thread a thread

refers to a new or newly

discovered incident with

potential to do harm to a system

or your overall organization.

There are three main types

of thread National
threats like floods

or tornadoes unintentional
threats such as employee

mistakingly accessing
the wrong information

and intentional threats.

There are many examples

of intentional threats including

spyware malware advert companies

or the Actions of disgruntled

employees in addition worms

and viruses are categorized

as threats because they

could potentially cause harm

to your organization through

exposure to an automated attack

as opposed to one
perpetrated by human beings.

Although these threats

are generally outside

of one's control and difficult

to identify in advance.

It is essential to take
appropriate measures to assess

threats regularly here are

some ways to do so and sure

that your team members

are staying informed

of current trends

in cyber security so they

can The identify new threats,

they should subscribe to blogs

like wired and podcast

like the Tech janek's Extreme it

that covers these issues

as well as join
professional associations,

so they can benefit

from breaking news feeds

conferences and webinars.

You should also perform

regular threat assessment

to determine the best approaches

to protecting a system

against the specific threat

along with assessing

different types of thread

in addition penetration,

testing involves modeling

real-world threats in order

to discover vulnerabilities
next on the List,

we have risk.

So risk refers to the potential

for loss or damage

when a threat exploits

a vulnerability examples

of risks include
Financial losses as a result

of business disruption loss

of privacy reputational
damage legal implications

and can even include loss

of life risk can also

be defined as follows,

which is basically threat

X the vulnerability you

can reduce the potential

for Risk by creating

and implementing a
risk management plan.

And here are the key aspects

to consider When developing

your Management strategy firstly

we need to assess risk

and determine needs

when it comes to designing

and implementing a
risk assessment framework.

It is critical to prioritize
the most important breaches

that need to be addressed all

the frequency May differ

in each organization.

This level of assessment

must be done

on a regular recurring basis.

Next.
We also have to include

a total stakeholder
perspective stakeholders include

the business owners as

well as employees customers

and even vendors all

of these players

have the potential

to negatively impact.

Actor organization,

but at the same time

they can be Assets

in helping to mitigate risk.

So as we see risk management

is the key to cybersecurity.

So now let's go

through a scenario
to actually understand

how cybersecurity actually

defend an organization against

very manipulative cybercrime.

So cyber crime

as we all know is
a global problem

that's been dominating

the new cycle.

It poses a threat
to individual security

and an even bigger threat

to large International companies

Banks and government

today's organized cybercrime.

Part of Shadows
loan hackers of Fast

and Now large organized crime

Rings function like startups

and often employ

highly trained developers

were constantly innovating

new online adapt

most companies have

preventative security software

to stop these types of attacks,

but no matter how secure we are

cyber crime is going to happen.

So meet Bob,

he's a chief security

officer for a company

that makes a mobile app

to help customers track

and manage their finances.

So security is a top priority.

So Bob's company has

an activity response.

Platform in place that automates

the entire cybersecurity process

the ARP software

integrates all the security

and ID software needed

to keep a large company

like Bob's secured

into a single dashboard

and acts as a hub

for the people processes

and Technology needed to respond

to and contain cyber doll.

Let's see how this platform

works in the case

of a security breach

while Bob is out

on a business trip
irregular activity occurs

on his account as
a user Behavior analytic engine
that monitors account activity.

Recognize a suspicious Behavior

involving late-night logins

and unusual amounts

of data being downloaded.

This piece of software

is the first signal

that something is wrong

and alert is sent to the next

piece of software in the chain,

which is the
security information

and event management system.

Now the ARP can orchestrate

a chain of events

that ultimately prevents

the company from encountering

a serious security disaster

the ARP connects

to a user directory software

that Bob's company uses.

Which immediately Cognizes

the user accounts belong

to an executive

who is out on a business trip

and then proceeds

to lock his account.

The ARP sends the incident

IP address to threat
intelligence software

which identifies the dress

as a suspected malware
civil as each piece

of security software runs.

The findings are recorded

in the ARP s incident,
which is already busy
creating a set of instructions

called A playbook

for a security analyst

to follow The analyst

and locks Bob's a bounce and

changes his passwords this time.

The software has determined

the attempted attack came

from a well-known
cyber crime organization

using stolen credentials.

Bob's credentials were stolen

when the hacker found

a vulnerability in his company's

firewall software and use it to

upload a malware infected file.

Now that we know

how the attack happened

the analyst uses

the ARP and identifies

and patches all the things

the ARP uses information

from endpoint tool to determine

Which machines need

to be patched recommends

how to pass them and then allows

the analyst to push the batches

to all the computers

and mobile devices instantly.

Meanwhile Bob has to allow

the legal Departments

of the breach

and the ARP instantly

notifies the correct version

of the situation
and the status of the incident
after the attack is contained

and Bob's account

is secured the analyst

and communicates which data may

have been stolen or compromised

during the incident.

He identifies which
geography is jurisdiction.

And Regulatory Agencies cover

the users and informations

affected by the adapter.

Then the ARB creates

a series of tasks.

So the organization can notify

the affected parties and follow

all relevant compliances

and liability procedures

in the past a security breach.

This large would have

required Bob's company

to involve several agencies

and third parties to solve

the problem a process

that could have taken

months or longer.

But in a matter of hours

the incident response platform

organized all of
the people processes.

Has and Technology to identify

and contain the problem find

the source of the attack

fix the vulnerability

and notify all affected parties

and in the future Bob and

his team will be able to turn

to cognitive security tools.

These tools will read
and learn from tens of thousands

of trusted publication blogs and

other sources of information.

This knowledge will uncover

new insights and patterns

and dissipate an isolate

and minimize attacks

as they happen and

immediately recommend actions

for Security Professionals

to take Keeping data safe

and companies like pops

out of the headlines.

Cryptography is essentially
important because it allows

you to securely protect data

that you don't want anyone else

to have access to it is used

to protect corporate Secrets

secure classified information

and to protect
personal information

to guard against things

like identity theft

and today's video

is basically going to be

about cryptography now

before we actually jump

into the session.

Let me give you guys

a brief on the topics

that we're going to cover today.

So first of all,

we're going to cover

what is cryptography

through the help

of a very simplistic scenario,
then we are going to go through
the classifications of Rafi and

how the different classification

algorithm works in the end.

I'm going to show you

guys a Nifty demo on

how a popular algorithm

called RSA actually works.

So let's get started.

Now.

I'm going to take the help

of an example or a scenario

to actually explain.

What is cryptography.

All right.

So let's say we have

a person and let's call him Andy

now suppose Andy sends a message

to his friend Sam who's

on the other side

of the world now,

obviously he wants
this message to be private

and nobody else should Have

access to the message now.

He uses a public forum.

For example the internet

for sending this message.

The goal is to actually

secure this communication.

And of course we have to be

secured against someone now,

let's say there is

a smart guy called Eve

who is secretly got access

to your Communication channel

since this guy has access

to your communication.

He can do much more

than just eavesdrop.

For example, you can try

to change the message in itself.

Now this is just

a small example.

What if Eve actually gets access

to your private information.

Well that could actually result

in a big catastrophe.

So, how can an D be sure

that nobody in the middle could

access the message center sound.

The goal here is to make

communication secure and that's

where cryptography comes in.

So what exactly is cryptography?

Well cryptography
is the practice

and the study of techniques

for securing communication

and data in the

presence of adversaries.

So, let me take

a moment to explain

how that actually happens.

Well, first of all,

we have a message.

This message is firstly

converted into a Eric form

and then this numeric form

is applied with a key

called an encryption key

and this encryption key is used

in encryption algorithm.

So once the numeric message

and the encryption key
has been applied

in an encryption algorithm.

What we get is called

a cipher text.

Now this Cipher text

is sent over the network

to the other side of the world

where the other person

whose message is intended

for will actually use

a decryption key and use

the ciphertext as a parameter

of a decryption algorithm.

And then he'll get

what we actually send

as a message and

if some error had actually

occurred he'd get an arrow.

So let's see

how cryptography can help secure

the connection between Andy

and sound so
the protect his message

and the first converts

his readable message

to an unreadable form here.

He converts a message
to some random numbers

and after that he uses

a key to encrypt his message

after applying this key

to the numerical form

of his message.

He gets a new
value in cryptography.

We call this ciphertext.

So now if Andy
sends the ciphertext

or encrypted message
over Communication channel,

he won't have to worry

about somebody in the middle of

discovering the private message.

Even if somebody manages

to discover the message,

he won't be able
to decrypt the message

without having a proper key

to unlock this message.

So suppose Eve here

discovers the message

and he somehow manages

to tamper with the message

and message finally reaches

some Sam would need a key

to decrypt the message to

recover the original plaintext.

So using the key he

would convert a cipher.

X2 numerical value corresponding

to the plain text now after

using the key for decryption,

what will come out is

the original plain text message

or an adult now this error

is very important.

It is the way Sam knows

that message sent by Andy is

not the same as a message

that you receive.

So the error in a sense tells us

that Eve has tampered

with the message.

Now, the important thing

to note here is

that in modern
cryptography the security

of the system purely relies

on keeping the encryption

and decryption key secret

based on the type

of keys and encryption.

Algorithms cryptography

is classified under
the following categories.

Now cryptography is
broadly classified

under two categories namely

symmetric key cryptography

and a symmetric key cryptography

popularly also known as

public key cryptography.

Now symmetric key cryptography

is further classified
as classical cryptography

and modern cryptography

further drilling down classical

cryptography is divided into two

which is transposition cipher

and substitution Cipher on the

other hand modern cryptography.

He is divided into stream Cipher

and block Cipher

in the upcoming slides

are broadly explain all

these types of cryptography.

So let's start with symmetric

key cryptography first.

So symmetric key algorithms

are algorithms for cryptography

that use the same cryptographic

keys for broad encryption

of plaintext and decryption

of ciphertext the keys

may be identical

or there may be some simple

transformation to go

between the two keys the keys

in practice represent
a shared secret

between two or more parties

that can be used to maintain

a private information
link this requirement

that both parties have access

to the secret key is

not the main drawbacks

of symmetric key
encryption in comparison

to public key encryption also

known as a symmetric
key encryption now

symmetric key cryptography

is sometimes also called

secret key cryptography

and the most popular

symmetric key system is

the data encryption standards,

which also stands

for D EAS next up.

We're going to discuss

transposition Cipher.

So in cryptography

a transposition cipher
is a method of encryption

by which the positions held

by units of plain text,
which are commonly
characters are groups

of characters are shifted

according to a regular system

so that the ciphertext

constitutes a permutation

of the plain text.

That is the order

of units is changed.

The plaintext is reordered now,

mathematically speaking
a bijective function is used

on the characters position

to encrypt and an inverse

function to decrypt.

So as you can see

that there is an example

All on the slide.

So on the plain text side,

we have a message,

which says meet me

after the party.

Now.

This has been carefully arranged

in the encryption Matrix,

which has been divided

into six rows and the columns.

So next we have a key

which is basically
for to 165 and then

we rearranged by looking
at the plain text Matrix

and then we get the cipher text

which basically is
some unreadable gibberish

at this moment.

So that's how this

whole algorithm works

on the other hand

when the ciphertext Being

converted into the plain text

The plaintext Matrix

is going to be referred

and it can be done

very easily moving on.

We are going to discuss

substitution Cipher.

So substitution of single letter

separately simple substitution

can be demonstrated

by writing out the alphabets

in some order to represent

the substitution.

This is termed a substitution

alphabet the cipher

the alphabet may be shifted

or reversed creating the Caesar

and upstage Cipher

respectively or scrambled

in a more complex fashion.

In which case it is called

a mixed Alpha bit

or deranged alphabet

traditionally mixed alphabets

may be created by first writing

out keyword removing

repeated letters in it.

Then writing all the remaining

letters in the alphabet

in the usual order now

consider this example shown

on the slide using the system.

We just discussed
the keyword zebras gives
us the following alphabets
from the plain text alphabet,

which is a to z.

So the ciphertext alphabet

is basically zebras Then

followed by all the alphabets.

We have missed out

in the zebra word.

So as you guys,

Can see it's zebras followed

by s c d e f g h

and so on now suppose

we were to actually

encrypt a message
using this code.

So as you guys can see

on the screen,
I've shown you an example,

which is a message flee at once.

We are discovered
is being actually

encrypted using this code.

So if you guys can see

out here the F letter

actually corresponds to S.

And then the L letter

actually corresponds

to I out here then we actually

get the cipher text which is Si

a a is that you using the code

and the process that I just

discussed now traditionally,

the cipher text

is written out in blocks

of fixed length omitting

punctuations and spaces.
This is done to help avoid
transmission errors to disguise

the word boundaries

from the plain text.

Now these blocks

are called groups

and sometimes a group count.

That is the number of groups

is given as an additional

check now five-letter

groups are traditional

as you guys can see

that we have also divided

our ciphertext into groups

of five and this dates back.

Back to when messages

were actually used

to be transmitted by Telegraph.

Now if the length

of the message happens

not to be divisible by 5.

It may be padded
at the end with nulls

and these can be any characters

that can be decrypted

to obvious nonsense.

So the receiver
can easily spot them

and discard them next on

our list is stream Cipher.

So a stream Cipher is a method

of encrypting text
to produce Cipher text

in which a cryptographic key

and algorithm are applied

to each binary digit

in a data stream
one bit at a time.

This method is not much used

in modern cryptography.

The main alternative method

is block Cipher in which a key

and algorithm are applied

to block of data rather than

individual bits in a stream.

Okay.

So now that we've spoken

about block Cipher let's go

and actually explain what block

Cipher does a block Cipher

is an encryption method that

A deterministic algorithm

for the symmetric key

to encrypt a block

of text rather than encrypting

one bit at a time as

in stream ciphers.

For example, a common block

Cipher AES encryption

128-bit blocks with a key

of predetermined length.

That is either 128 192

or 256 bits in length.

Now block ciphers

are pseudo-random
permutation families

that operate on the fixed size

of block of bits.

These prps our function

that cannot be
differentiated from completely

random permutation

and thus are A reliable

and been proven to be unreliable
by some Source.

Okay.

So now it's time

that we discussed
some asymmetric cryptography.

So asymmetric cryptography also

known as public key cryptography

is any cryptography system

that uses pair of keys,

which is a public key

which may be disseminated widely

and private Keys

which are known

only to the owner.

This accomplishes
two functions authentication

where the public key verify is

that a holder of the paired

private key send the message

and encryption where only

the paired private key holder.

Decrypt the message encrypted

with the public key and

a public key encryption system.

Any person can encrypt a message

using the receivers public key

that encrypted message

can only be decrypted

with the receivers private key.

So to be practical

the generation of public

and private key pair

must be computationally
economical the strength

of a public key
cryptography system relies
on computational efforts
required to find the private key

from its paid public key.

So effective security

only requires keeping

the private key private

and the public key

can be a openly distributed

without compromising security.

Okay.

So now that I've

actually shown you guys

how cryptography actually

works and how

the different classifications

are actually applied.

Let's go and do
something interesting.

So you guys are actually

watching this video

on YouTube right now.

So if you guys actually go

and click on the secure part

besides the URL you

can actually go and view

the digital certificates

that are actually used out here.

So click on certificates

and you'll see the details

in the details.

Up.

Now as you guys can see

the signature algorithm

that is used

for actually securing YouTube

is being shot 256 with RSA
and RC is a very very
common encryption algorithm

that is used

throughout the internet then

the signature hash algorithm

that is being used is sha-256.

And the issue is

Googling internet Authority

and you can get

a lot of information

about sites and all

their Authority Key identifiers

or certificate policies
the key usage and a lot of thing

about security just from

this small little button audio.

Also, let me show you

a little how public key

encryption actually works.

So on the side,

which is basically
cobwebs dot CSV or UGA dot edu.

You can actually demo out

public key encryption.

So suppose we had to send

a message first we would need

to generate keys.

So as you can see,

I just click generate keys

and it got me two keys,

which is one is the public key,

which I will distribute

for the network and one.

Private key which I will

actually keep secret to myself.

Now.
I want to send a message
saying hi there.

When is the exam tomorrow?

So now we are going to encrypt

it using the public key

because that's exactly

what's distributed.

So now as you can see we

have got our ciphertext saw

this huge thing right

out here is ciphertext

and absolutely makes no sense

whatsoever now suppose we were

to actually then

decrypt the message we

would Would use the private key

that goes along with our account

and we would decode the message

and as you guys can see

voila we have hi there

when the exam tomorrow.

So we are actually
sent a message

on the internet in a very

secure fashion above that.

There's also our essay

that needs some explaining

because I had promised

that to now RSA is a very

very commonly used algorithm

that is used
throughout the internet

and you just saw it

being used by YouTube.

So it has to be common.

So RSA has a very unique way

of applying this algorithm.

There are many actual parameters

that you actually
need to study.

Okay.

So now we're actually

going to discuss Odyssey,

which is a very popular

algorithm that is used

for of the internet.

And you also saw

that it's being used

by YouTube right now.

So this cryptosystem is one

of the initial system.

It remains most employed

cryptosystem even today

and the system was invented

by three Scholars,

which is Ron rivest ADI

Shamir and Len adleman

hence the name RSA and we

will see the two aspects

of the RSA cryptosystem.

Firstly generation of key pair

and secondly encryption

decryption algorithms.

So each person or a party

who desires to participate

in communication using
encryption needs to generate

a pair of keys namely

public key and private key.

So the process followed

in the generation of keys is

as follows first,

we have to actually calculate

n now n is actually given

by multiplying p and Q

as you guys can see out here.

So p and Q are supposed to be

very large prime numbers so

out here P will be 35,

but Are some very

strong encryption we

are going to choose very

large prime numbers.

Then we actually have

to calculate Phi L Phi is you

can see the formula

goes is p minus 1

into Q minus 1 and this

helps us determine

for the encryption algorithm.

Now, then we have to actually

calculate e now he
must be greater than 1

and less than Phi

which is p minus 1

into Q minus 1 and there must be

no common factors for e +

5 except for one.

So in other words,

they must be co-prime

to each other.

Now to form the public key

the pair of numbers

n and E from the RSA

public Key System.

This is actually made public

and is distributed

throughout the network

interestingly though,

N is a part of the public key

and the difficulty
in factorizing a large
prime number ensures

that the attacker

cannot find in finite time.

The two primes that is p and Q

that is used to obtain n this

actually ensures the strength

of RSA now in the generation

of the private key.

The private key D is It from p q

and E for given n and E.

There is a unique number D. Now.

The number D is the inverse

of B modulo 5.

This means that D is a number

less than five such that

when multiplied by E.

It gives one.

So let's go and actually

fill up these numbers.

So n should be 35 out Hill

and if we generate them

we get the value of V,

which is 24,

which is basically 4 into 6,

and then we should also get It's

now he should be co-prime.

So we are going to give it 11

as 11 is co-prime to both.

So now for the actual encryption

part we have to put in p

and N out here

so he out here for us is 11

and N is 35 and then we

are going to pick a letter

to actually Cipher
which is a and then we're going
to encode it as a number.

So as you guys can see

we've encoded as

one and out here now.

After we've given the message

it's numerical form.

We click on encryption

and we get it now to actually

decrypt the message.

We are going to need d

and n now D for us was 5

and N was 35 so 5 and 35

and then we're going

to take encrypted message

from above and we're going

to decrypt this message.

So after you decrypt it,

we have the numerical form

of the plaintext

and then decode the messages

click here decode messages.

And as you guys can see we have

decoded the message using RSA.

So guys that's
how I receive Oaks.

I explained all the factors

that we actually use

in our essay from n25 to e to D.

And I hope you understood

a part of it

if y'all are still

more interested y'all can

actually research a lot

on our say it's a very

in-depth cryptography system p

and N now D for us was 5

and N was 35 so 5 and 35.

And then we're going

to take encrypted message

from above and we're going

to decrypt this message.

So after you decrypted we

have the numerical form

of the plaintext

and then decode the messages

click here decode message.

And as you guys can see we have

decoded the message using RSA.

So guys, that's
how I receive books.

I explained all the factors

that we actually use

in our essay from n25 to e to D.

And I hope you understood

a part of it.

If y'all are still

more interested y'all can

actually research a lot

on our say it's a very in-depth

cryptography system just

as pollution was a side effect

of the Industrial Revolution.

So are the many

security vulnerabilities

that come with the

increase internet connectivity

cyber attacks are exploitations

of those vulnerabilities
for the most part individuals

and businesses have found ways

to counter cyber attacks using

a variety of security measures.

And just Good Old Common Sense.

We are going to examine eight

of the most common

cyber security threats

that your business could face

and the ways to avoid them.

So before we actually
jump into the session,

let me give you how the session

will actually work.

We are going to discuss

the most 8 common cyber threats.

We're going to discuss

in particular what they are

how the threat works

and how to protect yourself.

Okay.

So now let's jump

in now cyber attacks

are taking place all the time.

Even as we speak the security of

some organization big or small.

All is being compromised.

For example,

if you visit this site out here

that is threat Cloud.

You can actually view

all the cyber attacks

that are actually

happening right now.

Let me just give you

a quick demonstration of

how that looks like.

Okay, so as you
guys can see out here,

these are all the places that

are being compromised right now.

The red Parts actually

show us the part
that is being compromised
and the yellow places

actually show us from where

it's being compromised from.

Okay, as you guys can see now

that someone from Madeline's

is actually attacking this place

and someone from USA

was attacking Mexico.

It's a pretty interesting site

and actually gives you a scale

of how many cyber attacks

are actually happening

all the time in the world.

Okay now getting back I think

looking at all these types

of cyber attacks.

It's only necessary

that we educate ourselves

about all the types

of cyber threats that we have.

So these are
the eight cyber threats

that we're going to be

discussing today firstly.

We're going to start

off with malware.

So malware is
an all-encompassing term.

Or a variety of cyber attacks

including Trojans viruses

and worms malware

is simply defined as code

with malicious intent

that typically steals data

or destroy something
on the computer.
The way malware goes about doing
its damage can be helpful

in categorizing what kind

of malware you're dealing with.

So let's discuss it.

So first of all viruses like

the biological namesakes viruses

attach themselves to clean files

and infect other clean files

and they can spread

uncontrollably damaging
a systems core functionality.

I'm deleting or
corrupting files.

They usually appear

as executable files

that you might have downloaded

from the internet.

Then there are also Trojans.

Now this kind

of malware disguises
itself as legitimate software

or is included in legitimate
software that can be tampered

with it tends to act discreetly

and creates back doors

in your security to let

other malware sin.

Then we have worms worms.

In fact entire networks

of devices either local

or across the Internet by using

the Network's interfaces.

It uses each consecutive

infected machine.

To infect more and then

we have botnets and such
where botnets are networks
of infected computers

that are made to work together

under the controller

of an attacker.

So basically you
can encounter malware

if you have some OS

vulnerabilities or

if you download some legitimate

software from somewhere

or you have some

other email attachment

that was compromised with

Okay.

So how exactly
do you remove malware

or how exactly do you

fight against it?

Well, each form of malware

has its own way of infecting

and damaging computers

and data and so each one

requires a different
malware removal method.

The best way to prevent malware

is to avoid clicking on links

or downloading attachments
from unknown senders.

And this is sometimes done

by deploying a robust
and updated firewall

which prevents the transfer

of large data files

over the network in a hope

to be doubt attachments

that may contain malware.

It's also important
oughtn't to make sure

your computer's operating system

whether it be Windows Mac

OS Linux uses the most

up-to-date security updates

and software programmers

update programs frequently

to address any holes

or weak points,

and it's important to install

all these updates as

well as to decrease
your own system weaknesses.

So next up on our list of

cyber threats we have fishing.

So what exactly is fishing

well often posing as

a request for data

from a trusted third

party phishing attacks

are sent via email

and ask Those to click on a link

and enter their personal

data phishing emails have gotten

much more sophisticated

in recent years

and making it difficult

for some people to discern

a legitimate request

for an information

from a false one now

phishing emails often fall

into the same category as

spam but are way more harmful

than just a simple ad

so how exactly
does fishing work.

Well most people associate

fishing with email message

that spoof or mimic Bank

credit card companies

or other Genesis
like Amazon eBay

and Facebook these messages look

at entik and attempt

to get victims to reveal

their personal information.

But email messages are

only one small piece

of a phishing scam

from beginning to end

the process involves five steps.

The first step is

planning the Fisher

must decide which business

to Target and determine

how to get email addresses

for the customers

of that business.

Then they must go

through the setup phase.

Once they know which business

to spoof and who their victims

are fissures create methods

for Living the messages

and collecting the data then

they have to execute the attack.

And this is the step.

Most people are familiar

with that is the fishes

and the phony message

that appears to be
from a reputable Source

after that the Fisher records

the information the victims
enter into the web page

or pop-up windows
and in the last step,

which is basically identity

theft and fraud the Fisher's use

the information they've gathered

to make illegal purchases

or otherwise commit fraud

and as many as 1/4 of

the victims never fully recover.

So how exactly can Can you

be actually preventing yourself

from getting fished?

Well, the only thing

that you can do is being aware

of how phishing
emails actually work.

So first of all,

a phishing email has

some very specific properties.

So firstly you
will have something

like a very generalized way

of addressing someone liked

your client then your message

will not be actually from a very

reputable source so out here

as you can see it's written

as Amazon on the label,

but if you actually inspect

the email address that Came

from its from management

at Maison Canada dot C A

which is not exactly

a legitimate Amazon address.

Third.
You can actually hover
over the redirect links and see

where they actually redirect you

to now this redirects me

to www.facebook.com zone.com

as you can see out here.

So basically, you know,

this is actually a phishing

email and you should actually

report this email

to your administrators

or anybody else

that you think is supposed

to be concerned with this also.

Let me give you guys

a quick demonstration.

Chinon how fishing actually

works from the perspective

of an attacker.

So first of all,

I have actually created

a phishing website for

harvesting Facebook credentials.

I simply just took

the source code

of the Facebook login page

and paste it and then made

a back-end code in PHP

which makes a log file

of all the Facebook passwords

that get actually entered

onto the fishing page now.

I've also sent myself an email.

As to make sure
this looks legitimate,

but this is only

for spreading awareness.
So please don't use
this method for actually

harvesting credentials.

That's actually a very

legal thing to do.

So, let's get started.

First of all,

you will go
to your email and see

that you'll get some emails

saying your Facebook credentials

have been compromised.

So when you open it,

it looks pretty legit.

Well, I haven't made

it look all that legit.

It should look legit.

But the point out here is

to actually make you aware

of how this works.

So as you guys can see

it says Dear client we have

strong reasons to believe

that your credentials

may have been compromised

and might have been used

by someone else.

We have locked
your Facebook account.

Please click here

to unlock sincerely

Facebook associate Dean.

So if we actually click here,

we are actually redirected

to a nice-looking Facebook page,

which is exactly
how Facebook looks like when
you're logging in now suppose.

I were to actually log

into my Facebook account,

which I won't I'll just

use some brand my

Like this is an email addres

gmail.com and let's put

password as admin 1 2 3

and we click login now

since my Facebook is actually

already logged in it will just

redirect to facebook.com

and you might just see me logged

in but on a normal computer

is just redirect you

to www.facebook.com,

which should just

show this site again.

Okay.

So once I click
login out here all

that the backend code

that I've written in PHP.

PHP out here will do is

that it's going to take

all the parameters

that have entered

into this website.

That is my email address

and the password and just

generate a log file about it.

So let's just hit

login and see what happens.

So as you guys can see

I've been redirected

to the original Facebook page

that is not meant for fishing
and on my system audio.

I have a log file

and this log file

will show exactly

as you can see are fished

out the email address.

This is an email addres

gmail.com and it's also

showed the password.

That is admin one two three.

So this is how exactly fishing

works you enter an email address

and you're entering

the email address

on a phishing website.

And then it just redirects you

to the original site.

But by this time you've already

compromised your credentials.

So always be careful
when dealing with such emails.

So now jumping back

to our session the next type

of cyber attacks.

We're going to discuss

is password adducts.

So an attempt to obtain

or decrypt a user's password

for illegal use is exactly

what a password attack is

Hackers can use cracking

programs dictionary attacks

and passwords Nippers

and password attacks

password cracking refers
to various measures used
to discover computer passwords.

This is usually accomplished

by recovering passwords

from data stored

in or transported

from a computer system password

cracking is done by

either repeatedly guessing

the password usually

through a computer algorithm

in which the computer

tries numerous combinations.

Nations under the password

is successfully discovered now

password attacks can be done

for several reasons,

but the most malicious reason is

in order to gain
unauthorized access

to a computer

with the computers owners

awareness not being in place.

Now this results

in cyber crime such as stealing

passwords for the purpose

of accessing Bank information.

Now today, there are

three common methods

used to break into

a password-protected system.

The first is a Brute

Force attack a hacker

uses a computer program

or script to try
to login with possible.

Odd combinations usually

starting with the easiest
to guess password.

So just think if a hacker

has a company list he or she

can easily guess usernames.

If even one of the users

has a password one, two,

three, he will quickly

be able to get in the next

our dictionary attacks.

Now a hacker uses a program

or script to try

to login bicycling
through the combinations

of common words in contrast

with Brute Force attacks

where a large proportion key

space is searched systematically

a dictionary attack tries

only those possibilities

which are most

likely to succeed.

Typically derived
from a list of words,

for example a dictionary

generally dictionary attacks

succeed because most people have

a tendency to choose passwords

which are short

or such as single words found

in the dictionaries

or simple easy predicted

variations on words

such as a pending a digit or so.

Now the last kind

of password attacks are used

by keylogger tax hacker uses
a program to track all
of the users keystrokes.

So at the end of the day

everything the user has typed

including the login IDs and

passwords have been recorded.

Added a keylogger attack

is different than a brute force

or dictionary attack
in many ways not the least

of which the key logging program

used as a malware

that must first make it

onto the user's device

and the keylogger attacks

are also different

because stronger passwords

don't provide much

protection against them,

which is one reason

that multi-factor authentication

is becoming a must-have

for all businesses

and organizations.

Now, the only way to stop

yourself from getting killed

in the whole password

attack conundrum is

by actually practicing
the Best practices

that are being discussed in the

whole industry about passwords.

So basically you
should update your password.

Regularly.

You should use alphanumerics

in your password and you

should never use words
that are actually
in the dictionary.

It's always advisable

to use garbage words

that makes no sense

for passwords as a just

increase your security.

So moving on we're going

to discuss DDOS attacks.

So what exactly is a DDOS

or a Dos attack?

Well, first of all,

it stands for distributed denial

of service and a Dos attack

focuses on disrupting
the service to a network

as the name suggests attackers

and high volume of data

of traffic through the network

until the network

becomes overloaded

and can no longer function.

So there are a few

different ways attackers

can achieve dos attack,

but the most common

is the distributed
denial-of-service attack.

This involves the attacker

using multiple computers

to send the traffic or data

that will overload the system

in many instances a person

may not even realize

that his or her computer

has been hijacked

and is contributing
to the Dos attack
now disrupting Services

can have serious consequences

relating to security

and online access many instances

of large-scale Dos attacks

have been implemented as

a single sign of protest

towards governments

or individuals and have led

to severe punishment
including major jail time.

So, how can you Prevent

dos attacks against yourself.

Well, firstly unless

your company is huge.

It's rare that you would be even

targeted by an outside group

or attackers for
a Dos attack your site

or network could still

fall victim to one.

However, if another organization

on your network is targeted now

the best way to prevent

an additional breach

is to keep your system as

secure as possible with

regular software updates

online security monitoring

and monitoring of your data flow

to identify any unusual

or threatening spikes in traffic

before they become a problem.

Dos attacks can also

be perpetrated by

simply cutting a table

or dislodging a plug
that connects your website
server to the Internet

so due diligence
in physically monitoring.

Your connections is
recommended as well.

Okay.

So next up on our list

is man-in-the-middle attacks.

So by impersonating

the endpoints in an online

information exchange the man

in the middle attack can obtain

information from the end user

and the entity he

or she is communicating
with for example So

if you are Banking online

the man in the middle

would communicate with you

by impersonating your bank

and communicate with the bank

by impersonating you the man

in the middle would then

receive all of the information

transferred between both parties

which could include sensitive

data such as bank accounts

and personal information.

So how does it exactly

work normally an MI t--

M gains access

through an unencrypted
wireless access point

which is basically one

that doesn't use WEP WPA or any

of the other security measures.

Then they would have

to access all the information

being transferred

between both parties by actually

spoofing something called

address resolution protocol.

That is the protocol

that is used when you

are actually connecting

to your gateway
from your computer.

So how can you exactly prevent

MIT am attacks from happening

against you firstly you have

to use an encrypted W AP

that is an encrypted
wireless access point next.

You should always

check the security

of your connection because

when somebody is actually trying

to To compromise your security.

He will try to actually

strip down the HTTP or hsts

that is being injected

in the website,

which is basically
the security protocols.

So if something

like this HTTP is not appearing

in your website,

you're on an insecure website

where your credentials

or your information
can be compromised

and the last and final measure

that you can actually
use is by investing

in a virtual private Network

which spoofs your entire IP

and you can just

browse the internet

with perfect comfort.

Next up on our list

is drive-by downloads.

So Gone are the days

where you had to click

to accept a download

or install the software update

in order to become infected

now just opening

a compromise webpage

could allow dangerous code

to install on your device.

You just need to visit or drive

by a web page without stopping

or to click accept any software

at the malicious
code can download

in the background to your device

a drive-by download refers

to the unintentional download

of a virus or malicious.

Software onto your computer

or mobile device
a drive-by download

will usually take advantage

or exploit a browser or app

or operating system

that is out of date

and has security flaws.

This initial code

that is downloaded is
often very small and

since its job is often simply

to contact another computer

where it can pull down

the rest of the code

onto your smartphone tablet

or other computers often

a web page will contain

several different types

of malicious code in hopes

that one of them will match

a weakness on your computer.

So What is this exactly what

But first you visit the site

and during the three-way

handshake connection

of the TCP IP protocol a back

in script is triggered.

As soon as a connection is made

by Al the last ack packet

is sent a download
is also triggered

and the malware is basically

injected into your system.

Now the best advice I

can share about overriding

drive-by downloads is
to avoid visiting websites

that could be considered

dangerous or malicious.

This includes adult content

file sharing websites,

or Anything that offers you

a free trip to the Bahamas

Now some other tips

to stay protected include

keep your internet browser

and operating system up-to-date

use a saved search protocol

that once you went to navigate

to a malicious site and use

comprehensive security software

on all your devices

like McAfee all access

and keeping it up to date.

Okay, so that was it

about drive-by downloads.

Next up is Mal advertising

or malvert izing.

So malvit sizing is the name

we in the security industry

give to criminally
Android advertisements

which intentionally,

in fact people and businesses.

These can be any ad

on any site often ones

which you use as a part

of your everyday internet usage

and it is a growing problem

as is evident
by a recent US Senate report

and the establishment of bodies

like trust and ads now whilst

the technology being used

in the background is
very Advanced the way presents

to the person beings infected

is simple to all intents

and purposes the advertisement

looks the same.

Same as any other

but has been placed by criminal

like you can see

the mint at out here.
It's really out of place.

So you could say it's been made

by a criminal now

without your knowledge

a tiny piece of code hidden deep

in the advertisement
is making your computer go

to the criminal servers

these and catalog details

about your computer

and its location

before choosing which piece

of malware to send you

and this doesn't need

a new browser window

and you won't know about it.

So basically you're redirected

to some criminal server.

Neither injections takes place

and voila you're infected.

It's a pretty dangerous

thing to be in.

So how exactly can you

stop ma advertising.

Well, first of all,

you need to use

an ad blocker,

which is a very must

in this day and age you

can have ad blocker extensions

installed on your browser

whether it be Chrome Safari

or Mozilla also regular

software updates of your browser

and other softwares

that work very fertile

to your browser always helps
and next is some common sense.

And yeah, Advertisement

that is about a lottery

that's offering you free money

is probably going to scam you

and inject malware to

so now we click on those ads.

So the last kind

of cyber attacks.

We are going to discover

today and discuss

about is Rogue software.

So Rogue security software is

a form of malicious software

and internet fraud that misleads

users into believing

that there is a virus

on their computer

and manipulates them

into paying money

for a fake malware removal tool.

It is a form of scare
where that money.

Lets users through fear

and a form of ransomware rock

security software has been

a serious security thread

in desktop Computing since 2008.

So now how does a rogue

security software work

these cams manipulating users

in to download the program

through a variety of techniques.

Some of these methods

include ads offering

free or trial versions

of Security Programs
often pricey upgrades

or encouraging the purchase

of deluxe versions,

then also pops warning

that your computer

is infected with the virus

which encourages you to clean.

It by clicking on the program

and then manipulated

SEO rankings that put

infected website as the top hits

when you search these links then

redirect you to a landing page

that seems your

machine is infected

and encourages you a free trial

of the Rogue security program.

Now once the scareware

is installed it can steal

all your information slow

your computer corrupt

your files disable updates

for Less timet

antivirus softwares

or even prevent you

from visiting legitimate

security software vendor sites.

Well talking about prevention.

The best defense

is a good offense.

And in this case

and updated firewall makes sure

that you have a working

one in your office

that protects you

and your employees

from these type of attacks.
It is also a good idea
to install a trusted antivirus

or anti-spyware software program

that can detect

threats like these

and also a general level

of distrust on the internet

and not actually believing

anything right off.

The bat is the way

to go teen is infected

and encourages you a free trial

of the Rogue security.

Program now once the scareware

is installed it can steal all

your information slow

your computer corrupt

your files to siebel updates

for Less timet antivirus

softwares or even prevent you

from visiting legitimate

security software vendor sites.

Well talking about prevention.

The best defense

is a good offense.

And in this case

and updated firewall makes sure

that you have a working one

in your office that protects you

and your employees

from these type of attacks.

It is also a good idea

to install a trusted antivirus

or These fiber software program

that can detect

threats like these

and also a general level

of distrust on the internet
and not actually believing
anything right off.

The bat is the way

to go the key word

of this video is
ethical hacking course,

but in reality,

it's just an expansive video

on the fundamentals

of ethical hacking.

There is no such thing

as an ethical hacking
course to be honest

because snow course

can teach you a discipline like

ethical hacking all the best

that you can do

and creating content

for ethical hacking is

that you can tell people

about the fundamentals

are followed in this discipline.

Okay.

Now before we start

let me just give you

a general idea of the topics

that I intend to cover

throughout this video.

Okay now to be honest,

we're going to cover a pretty

broad range of material.

We are first we're going

to be going over

footprinting and recognitions

where you get an idea.

What's involved in
the ethical hacking engagement

that you're working

on and information

about the Target that

you're engaged with?

Then we're going to talk

about networking fundamentals

and here we're going to get

our hands dirty with buckets

and the understanding

of dcpip at a deeper level

and also understanding

how the different protocols work

and why they work that way now.

We are also going

to be talking about cryptography

where we talk about different

cryptography key ciphers.

We're going to deal

with web encryption to SSL

and And TLS we are also going

to talk about certificates

and the creation of certificates

and how they actually

operate we will also talk

about public key cryptography

and we are also scanning

an enumeration so nmap

and dealing with Windows servers

and using SNMP and ldap

and all that sort of stuff.

Then we're going to be

talking about penetration

where we deal
with different ways

of getting into systems and also

go over using Metasploit,
which is an exploit framework,

and we're going to talk

about how to Use Metasploit

and you actually

get in the systems

and make use of the exploits

that they have then we're going

to talk about malware's viruses

and worms and rootkits and all

of that sort of stuff.

We're going to take a look

at the different pieces

of malware and how you

would pull that apart

in order to understand

what is doing and potentially

make use of that malware during

an ethical hacking engagement.

Then we're going to talk

about different types of denial

of service attacks
or dos attacks

and the difference

between a denial-of-service

attack and Distributed

denial-of-service attack,

and there is a difference there.

So we're going to go
over this docks now.

We're also going to go

over web application hacking

and the types of tools

that you would use during

web application hacking and

the different vulnerabilities

that web applications have

and how to make use

of these exploits

and those vulnerabilities.

We're going to talk

about Wireless networking

how to probe wireless networks

what wireless networks are doing

and how to secure

wireless networks.

We're also going to talk

about a little bit

about detection vation.

And to be honest with you,

the direction of Asian kind

of comes up in a lot

of different areas
through the many of the topics

that were also

going to talk about

programming programming tax

and how to protect oneself

against programming attacks.

Okay.

So that was the number of topics

that we are actually going

to cover through this video.

Now the approach

that I'm going to be taking

in the series of videos

is whenever possible.

We're going to be going

to use a Hands-On approach.

So we're going to show you

the actual All tools I'm going

to make use of and the tools

to do some sort of demonstration

and how they actually work.

I am a big believer

in getting your hands dirty as

the best way to learn anything.

So as we go through
the series of videos,

I strongly encourage you

to get access to the tools

that I'm going to

be demonstrating wherever

possible and dig in and get

your hands dirty along with me

and there are places

where we're going to be going

over some theoretical material

and I'm not a big fan

of PowerPoint slides,

but That are necessary evil

and order to convey

certain types of information.

So wherever possible I'm going

to minimize their use,

but you will run across places

where they're just a necessity

and we're going to have to go

through some slides

where in order to get

some particular points

across they are primarily

of a theoretical nature.

So that's the process

that we will be taking

through this video

and I hope you have fun

as you go along the way.

Okay.

So let's begin now

the first topic
that we're going to tackle is
what What is hacking?

Okay, so let us take a trip

to the early days

of hacking the start

with now the internet

engineering task force

is responsible for maintaining

documentation about protocols

and very specification

and processes and procedures

regarding anything
on the internet.

They have a series of documents

called the request for comments

or the rfc's and according

to RFC one three eight nine.

It says a hacker is a person

who Delights in having

and Intimate understanding

of the internal workings

of a system computers

and computer networks

in particular while
the expression hackers

may go back a long time

and have many different

connotations are definitions.

As far as computers.

Go.

Some of the earliest

hackers were members

of the tech Model Railroad Club

at the Massachusetts
Institute of Technology

and what those people did

and the various things
that they did and were involved
in a detailed and Steven Levy's

book called hackers

for Our purposes now

for our purposes

would be talking

about other types of hackers.

Although the spirit of

what we do goes back

to those early days.

Now, the definition of hacking

or hackers has changed

particularly in the 1980s

and in part as a result

of a couple of people

namely Robert T Morris

who was a Cornell graduate

who Unleashed a
piece of software

that was called a worm on

what was an early version

of the internet Forum went

on to cause a lot of damage

and create a lot of downtime

on Systems across the country

and across the world.

Now the Morris worm did end up

resulting in something good.

However, that is
computer Emergency Response Team

at Carnegie Mellon
was created primarily

in response to the mall swarm.

Now, there's also Kevin mitnick

was another well-known hacker

who was responsible

for various acts
of computer crime
over a couple of decades.

He was the first

convicted in 1988.

So the definition of hacker

or hacking move from something

benign to something
far more sinister.

In popular culture now,

we see hacking or hackers

in all sorts of popular culture.

We've seen them in hacker movies

called War Games also

the movie hackers.

Of course.

You also see in The Matrix

movies where you can see

if you look really closely

that they are using

a tool called nmap,

which we will get into the use

of in great detail later on

as we go on now.

It's the movie sneakers

and the movie SWAT fish

and on television

in other Into other places

you can see the agents

at NCIS regularly doing

things like cracking

complex cryptography in just

a matter of seconds or minutes.

So what is hacking really

well hacking is about

a deep understanding

of something particularly

with relation to
computers and Computing.

It's also about exploring and

the joy of learning new things

and understanding
them very clearly

and being able to manipulate

those things in ways

that maybe other people

haven't before it's all

about digging into problems.

To find out Solutions

in creative and interesting ways

and sometimes finding problems

where there weren't

problems previously

and that's a little bit

about what is hacking.

Okay.

So now that we have talked

about what exactly is hacking

and how the meaning

and conditions of that word

has changed over time

how it came into existence

how it was coined.

Let's go over the reasons

that people normally hack.

Now you may want

to hack just for fun

as discussed previously
hacking is a tradition.

It goes back several decades

at MIT even preceding

the computer too late definition

of hacking now MIT has a long

and storied history of hacking

and sometimes have

a computer to lated nature
which in this case
happens to be true

and sometimes a fan

on computer-related
nature instance.

Now here you can see

that MIT is home page

has been hacked

or you might even say

the faced indicate

that Disney is buying a mighty.

This was an April Fool's

Day prank and 1998.

Eight.

And again, this is just

the kind of hacking

that it would do for fun.

Rather.

Now.

Sometimes you might want

to hack just to prove

a political point or any point

for that matter in this case.

Again, Bill Gates had donated

some money to the MIT

which allowed them

to have a new building

and he was coming

to MIT to visit

and give a talk

about Microsoft Windows

and its systems.

And as you can see the the

Windows systems are installed

in the entryway at the

Or hacked to be running Linux

instead and you can see here.

That ducks.

The penguin is saying welcome

to the William Edge

Gates Building again that

some students who decided

that they wanted to make a point

about Linux and Microsoft

and windows to Bill Gates

and they thought hacking was

the best way to go about it.

Sometimes you have just

for the challenge.

Here's an example again at MIT

where some students turned

the facade of a building

into a Tetris game board.

Now, this was

a reasonably difficult hack

and the students went

after it just for the challenge

of completing it and it just

so they could have

some pride of ownership

and to be able to say

that they were able

to pull this off,

you know, the things

that teenagers do to show off

to other teenagers.

It just increases with increase

in scale now in spite

of its difficulties

and its challenges and all

the obstacles and planning

that have to go into it.

They were able to pull it off

and now they have

those bragging rights.

So that was one Them and one

of the instances

where somebody would hack just

for the challenge and

for the fun of it.

Now, sometimes you want

to hack to prevent theft

and this is where we get

more specifically in
the computer-related hackings.

You see a lot of Articles

and stories in the news

over the last few

years about cybercrime

and here is an example

of data theft compromised

and a few than

one-and-a-half million cards

for Global claimants.

So there are some attackers

who got into this

company global payment

and they were able to pull

out about a million and a half

credit card numbers

during the intrusion there.

So what you may want to do

is you may want to learn

how to hack in order

to find these holes

in your systems or applications

or employer systems

so that you can fix these holes

and prevent these compromises
from happening because of
the reputation of hit

that your company takes

where were things

like these happen.

You have the risk of completely

running out of business.

So just to protect
our job to protect Company

and protect your own

desire of business.

You may just want

to learn to hack

and that's a very good reason.

Now, you may also want

to find all the problems

that exist in your system

for putting them out

and deploying them

so that you can keep

these attackers from getting in

and stealing critical

or sensitive information.

Sometimes you may want to hack

to get there before the bad guys

and the same sort

of idea is the last one

where we're just going to talk

about and it exactly is

ethical hacking now.

We were just talking Talking

about how sometimes

you may want to hack

into your own system

before publishing it
out to the public.

Let's take Internet Explorer.

For example.

Now Internet Explorer was

actually published the public

with some critical

error in the code.

And these flaws were heavily

exploited by people

who actually found them.

Now a number of people

in the world go out looking

for these flaws

and they call themselves

security researchers

and they get in touch

with the vendors

after they found a flaw

or a bug and work.

The vendors to get it fixed

what they end up with is

a bit of reputation.

They get a name for themselves

and that name recognition

may end up getting them a job

or some speaking engagements

or book deal

or any number of ways

that you could cash in

on some name recognition

from finding the sort of bugs

and getting them fixed.

If you want to get there

before the bad guys.

You may think you're

helping out a vendor.

You may want to just

make a name for yourself.

If you want to find

these sort of bugs
before the bad guys do

because think about the bad guys

finding then is they

don't announce them

and they don't get them fixed

and that makes everybody

a little less secure.

Finally may want

to protect yourself

from hacked computer companies

and fight cyber criminals,

and this is new headline

from June 18 2012,

and we're starting

to see these sort

of news headlines show up

as companies are starting

to retaliate against attackers

in order to retaliate
against attackers.

Now in order to
retaliate against Dockers,

you need to be able

to The same sort

of skills and techniques

and knowledge and experience

that those attackers have

and where your company

may want you to learn to hack

or the company may want

to bring in people

who are skilled

at these sort of activities

so that they can

attack the Dockers

and hopefully you end up

with more Steely exterior
and you get a reputation
for not being a company

that people wanted to go

after those are several reasons.

And there you go.

I gave you around a bunch

of reasons as to why
you may want to hack.

Back for fun prove a point take

yourself to protect the company

to not run out of business

and along with another

bunch of reasons.

Okay.

So now that we have talked about

why you would want to hack.

Let's move on to the types

of hackers that exist.

Now we're going to be talking

about the different types

of hacking and the first

step of Hawking

that I want to discuss

is ethical hacking

and ethical hackers,

which is really

what we're going to be talking

about for the rest

of these lessons now

an ethical hacker is Buddy

who thinks like

a black hat hacker

or things like somebody

who is intent on breaking

into your systems

but follows a moral compass

that's more in line

with probably the majority

of the population.

So their intent isn't to do

bad things their intent

is look for bad things

and get them fixed.

So that bad things don't happen

ethical hackers aren't out

to destroy anything
and they're not out

the break anything

unless it's deemed

to be acceptable as a part

of the engagement
and also necessary.

And in order to demonstrate

a particular vulnerability

to the organization that

they're working with so

that's an ethical hacker

and there's a certification

that's available
from the ec-council.

It's a certified ethical

hacker and you know,

if you find
certifications valuable

and this sort of thing is

what do you want to do?

We're seeing a set

of certified ethical hacker

may be something you

might want to look into now.

Let's talk about

black hat hacker.

There's a plenty of cases

of black hat hackers

through yours and

let's talk about a guy.

In particular called
Kevin mitnick.

This guy right here

is a particularly

good example probably

because he was a black hat

hacker for a lot of us years.

His goal was to cause

mischief to steal

where necessary and just

to be engaged in the lifestyle

of being a hacker

and doing whatever was necessary

to continue doing
whatever it craw doing

whatever he was doing it

cross moral boundaries

or ethical boundaries.

And so Kevin mitnick here was

involved for well over a decade

and computer crime

and was finally

picked up by the FBI

and he was charged

and prosecuted and he

was eventually convicted

of some of the activities

that he was involved with now

you may be able to argue

that Kevin is a gray hat hacker

and as well and a gray

hat hacker is somebody

who kind of skirts

the line between black

and white hat Hawking

and white had Hawking

is really what

an ethical hacker is so instead

of saying ethical hacker.

You could say white hat hacker.

It's the same idea

of white hat hacker is somebody

who acts for good

if you Think of it like that

if you want to think

of it as a good versus evil

and what they're really

doing is they're in it

for the technical challenge.

They're looking to make

things better make things

more efficient improve them

in some way on the other hand.

The black hat hacker is out

for the money for the thrill.

It's really criminal activity

and a gray hat hacker is

somebody who may employ

the tactics and technique

of a black hat hacker,

but have sort of a white hat

focus in other words

they're going to do Do things

that may be malicious

and destructive in nature,

but the reason they're doing

it is to improve

the security posture

of an organization

that they're working

with so you can see

there's actually a book

called gray hat hacking.
It's a pretty good book
and it details a lot

of the tactics and strategies

and techniques will be going

over in subsequent lessons

in this video.

Now one other type of hacking

that I want to talk about is

a thing called hacktivism

and you'll find hacktivism

all over the place

and Example in the last year

or so and certainly in recent

memory is called loves security.

Yeah, you heard that right?

It's called loves security

and you can argue

that lulls is actually

a response to another type

of activism and
organization called Anonymous

started hacking companies

like Sony to protest

their involvement in a lawsuit

regarding a PlayStation
3 hacker now allow security

was supposedly testing

the treatment of anonymous

or was hacking in support

of this group Anonymous,

so they hacked number.

Of companies and the things like

pulled information usernames

and passwords from the databases

at these companies and they said

that the reason was to shine

a light on the security
of these companies

and also theoretically

embarrassed the companies

with their weak

or poor security postures

and the problem with that

that they were doing this

through were posting information

that they had found online

and that information

often included details

about customers for

these particular corporations.

And for an ethical hacker

a white hat hacker

that would cross the boundary.

Of causing harm.

So there's no reason

for me as an ethical hacker

to post information

in a public forum about somebody

because I could be doing

damage to them.

But in this case law security

and Anonymous specifically lot

of security were engaged

in the form of hacktivism

and what they were doing

was not only damaging

to the corporation

that certainly was detrimental

to those people so
different types of hackers

and different types

of hacking we've got

ethical or white hat hacking.

You've got black hat gray hat
and then we finally got Mmm,

it's really the goal

and the means that vary

from one to the other.

Okay.

So now that we've discussed

the types of hackers.

Let's also discuss the skills

necessary to become one.

So what we're going to discuss

in this part are

the different skills

that are required

or will be learned as
a part of this video.

So initially just

for basic Computing you

need a basic understanding

of operating systems
and how to work them.

There are going to be several

fundamental types of tasks

that I won't be going

into any detail at all

or and you need to know

how to run programs.

And do things like open

up a command prompt

without me walking you

through and how to do that.

So I am going to assume

that you have some basic

understanding of how to do

these sorts of tasks.

Also, you need an understanding

of the basic system software
and you'll need a basic
understanding of how to use

command line utilities.

There are a number

of tools and programs

that we're going to be going

through this video

and many of them use

the command line now

whether it's on Windows

or Linux still need

to be familiar with typing

and being able to run programs

from the command line

and the various command

line switches and parameters

that those programs are types

of programs are going to use now

from a networking perspective.

You need a basic understanding

of some simple
networking Concepts.

You need to know

what cables are and switches

and hubs and how systems

are networked together.

You don't really need

a deep level of understanding.

I'll be going
through some protocols

as reasonably deep level

because I think
it's important as

an ethical hacker to understand

what's going on
at the protocol level

so that you can know

better what you are.

Going and how to achieve

the goals and tasks

that you have before you so

we're going to be going

over some protocols.

So just understanding
what protocols are

and how they go together.

They all sort

of things are necessary

from a networking perspective.

Now, we're going to also be

learning a bunch of life skills.

Yes, there are some life skills

that it's important to have.

I think the most important one

is the ability to accept failure

and persevere and by that.

I mean you're going to be just

running across several things

that just don't work

the first time around

and it's going to take

a little bit of time

and stick-to-itiveness to plug

away and keep going

until you get something to work.

And the way that you get

things to work is having

an ability to problem solve

and sometimes solving

problems requires being

a little creative.

Sometimes you need

thing out of the box

and come out a problem

from a different perspective
in order to find a solution

throughout the course

of this video.

You're going to run

across a lot of sticky problems

through the course of learning

about being an ethical hacker

and just doing the work.

Because it's not a simple.

So here's a little recipe for

how to do this now go follow

this recipe every time and

you're going to be successful.

Every situation is different.

Every system is different.

You're going to run across

some pretty sticky problems

and you're going to have to just

wait and get your hands dirty

and keep failing and failing

and failing and failing

until you find a way to succeed.

So I think those skills are

very necessary to learn

how to be an ethical hacker

digging through some

of the material
that will be going over in this.

Yo, as far as what you

are going to be learning

you're going to be learning

about how to use a lot of tools.

You're going to learn

networking and by that.

I mean we're going to be talking

about different Protocols
are evolved involved
in networking systems together,

you're going to learn

about security and security

postures security is the heart

and soul of ethical hacking.

It's why we do ethical hacking

in order to make systems

and networks more secure

than they were previously.

That's the goal

from a networking perspective.

We're going to be talking

about how to read packets

from Network captures.

You're going to be going

into TCP IP related protocols

and fairly significant amount

of detail and they're

going to understand

how protocols interact

with one another.

So we're going to do all

that and the reading packets

is going to be really important

and we're going to do

a fair amount of that

in addition to just
fundamental approach to learning

how to read packets

in several lessons.

We're going to read packets

as a way of understanding

the different tools

that were using

and how they're going to learn

tactics and methodologies
and you get to learn Learn
to use the information

you've gathered in order

to get more information

and information is really

what is this all about?

You can't do much anything

without information

and sometimes it takes

a fair bit of digging in order

to find that information

and what you're going

to learn is the entry points

and the Stepping Stones

to get the information

that you need.

And then once you

have that information,

you're going to be learning

about ways to exploit it

in order to get deeper

into the dark.

You're going to learn

security awareness.

We're going to talk about risk

and understanding risks

and vulnerabilities primarily

recognize the difference

between a vulnerability

and an exploit and there's

a significant difference.

There is so security awareness

and understanding what a risk is

and how that impacts your Target

and it's going to be key

to a lot of things
that we talked about.

So it sounds like a lot

we're going to cover a fair bit

of ground not all

of it at a deep level.

Sometimes we are going

to skim the surface

but there's an an awful lot

of material to be cover.

So let's get started

into talking about the different

skills are required

or will be learned as a part

of the series of video.

So initially just
for basic Computing you

need a basic understanding

of operating systems.

So it sounds like a lot weird

that we're going to cover

and fair bit of a is going to be

at a very deep level

and sometimes we're just

going to skip the surface

but there's an awful lot

of material to cover

so let's get started.

Okay, so that was all

about the skills

that we are going to develop.

Throughout this video

and that might be necessary

for you to become

an ethical hackl.

Now.

Let's talk about

the types of attacks

that you might be dealing

with ethical hacker yourself.
So now we're going to be talking
about the types of attacks.

Now one type of attack

that you'll find common

particularly in cases

of hacktivism, for example,

or cases where people are trying

to make a particular point

or just be a general pain is

this idea of defacing defacing

goes back for quite a while.

It's the idea.

In of sort of digital graffiti

where you've left your mark

or your imprint behind

so that everybody knows you were

there primarily a website thing

and it's really just making

alterations to something

that used to be pretty common

a long time ago.

Now it's very particular

for businesses or people

or just organizations
in general to have

their homepage has been replaced

by this other thing

that was along the lines

of hey, I was here

and I took over your web page.

We also have a pretty common one

for certainly has been common

over the years.

And it's a pretty good part

towards quality exploits

in high-profile vulnerabilities.

And that's buffer overflow.

Now a buffer overflow is
a result of the way programs

are stored in memory

when programs are running

they make use of a chunk

of memory called a star

and it's just like

a stack of plates

when you put a bunch

of plates down when you pull

a plate off you're going

to pull the top plate

you're going to pull the old

displayed you're going to pull

the one that was on top.

So the same thing

with the stack here,

we're accessing memory

and This has to do with the way

functions are called in memory

when you call the function

a chunk of memory gets thrown

on top of the stack and

that's the chunk of memory

that gets accessed

and you've got a piece

of data in memory,

but in that stack and

that's called a buffer

and when too much data

is sent and try to put

into the buffer it

can overflow now the bounds

of the configured area

for that particular buffer.

It can overflow the bounds

of the configured area

for that particular buffer.

Now the way stack Are put

together we end up

with the part of the stock

where the return address

from the function is stored.

So when you overflow

the buffer you have

the ability to potentially

override that return

at which point you

can control the flow

of execution of programs.

And if you can control the flow

of execution of the program,

you can insert code

into that memory that could

be executed and that's

where we get buffer overflow

that turns into exploits

that creates the ability to get

like a command shell

or some other useful thing

from the system

where the The buffer

overflow is running.

So that's a buffer
overflow in short.

Sometimes.

We also have
format string attacks.

And sometimes these

can be precursors

to buffer overflow formats.

Now format strings come about

because the C programming

language makes use
of these format strings

that determines how data

is going to be input or output.

So you have a string

of characters that define

whether the subsequent input

or output is going
to be an integer or

whether it's going

to be a character

or whether it's going

to be a string

or a floating-point
that sort of thing.

So you have a format string

that defines the input

or the output now

for programmer leaves

of the format string

and just gets lazy

and provides only the variable

that's going to be output.

For example, you have

the ability to provide

that format string.

If you provide
that format string

what then happens is

the program starts picking

the next piece of data

of the stack displays them

because that way we

can start looking at data

that's on the stack

of the running program just

by providing a format string

if I can look at the data I

may be able to Find information

like return address

or some other use

of piece of information.

There is also a possibility

of being able to inject

data into the stock.

I may be able to
find some information

like a return address

or some other useful

piece of information.

There is also a possibility

of being able to inject data

into the stack.

I may be able to
find some information

like a return address

or some other useful

piece of information.

There is also a possibility

of being able to inject data

into the stock using

this particular type.

Now moving on to our next type

of attack is a denial

of service a denial of service.

This is a pretty common one

and you'll hear

about this a lot.

This is not to be confused with

the one that I'll be talking

about after this and that is

a distributed denial of service.

So this one that you see is

that this is a denial

of service attack
and a denial of service
is any attack or action

that prevents a service

from being available

to its legitimate
or authorized users.

So you hear about a ping flood

or a syn flood?

That is basically a syn packet

being sent to your machine

constantly or a Smurf attack

and Smurf attack

has to do something

with icmp Echo requests

and responses using

broadcast addresses.

That one's been pretty

well shot down

over the last several years.

You can also get a denial

of service simply

from a malformed packet

or piece of data

where a piece
of data is malformed

and sent into a program.

Now if the program

doesn't handle it correctly

if it crashes suddenly
you're not able to use

that program anymore.

So therefore you are denied.

The service of the program

and thus the denial of service.

Now, as I said a denial

of service is not to be confused

with a distributed
denial of service.

And I know it's

pretty trendy particularly

in the media to call it

any denial-of-service DDOS

or any denial-of-service DDOS.

Now it's important to note

that any denial of service

is not a DDOS a DDOS or

as you might know

a distributed denial

of service is a very specific

thing distributed denial

of the service is a coordinated

denial-of-service making use

of several hosts
in several locations.

So if you think about a botnet

as an example a botnet

could be used to trigger

a distributed denial of service,

but I've got a lot of bots

that I'm controlling

from a remote location

and I'm using all

these boards to do something

like sending a lot of data

to particular server

when I've got a lot of system

sending even small amounts

of data all of that data

can overwhelm the server

that I'm sending it to

so the Behind a distributed

denial-of-service attack is

too overwhelmed resources

on a particular server
in order to cause that server
not to be able to respond.

Now the first known

DDOS attack use the tool

called stock Old Rod,

which is German for barbed wire

the stock Old Rod came

out of some work that a guy

by the name of mr.

Was doing in 1999.

He wrote a proof
of concept piece

of code called tfn,

which was the

tribe flood Network.

Let me just show that for you.

So you can see

on the Wikipedia page

the try flat Network

or tfn is a set
of computer programs

that is used to conduct various

DDOS attacks such as icmp

flood syn floods UDP flowers

and small for tax.

Now.

I know many people

don't really consider

Wikipedia really good source

of any sort of knowledge,

but it's a good place

to start off.

So if you want to read

about all these types

of attacks like icmp floods

and what exactly is

a syn flood you can always do
that from It's
not that bad place.

Of course, you should use

Wikipedia as your final

Rosetta Stone moving on.

So this program called Old Rod,

which was it was used to attack

servers like eBay and Yahoo!

Back in February of 2000

so that tack in February

of 2000 was really

the first known distributed

denial-of-service attack,

which is not to say

that there weren't denial

of service attacks previously So

to that there were

certainly plenty of them,

but they were

not distributed now

this means If there

weren't a lot of systems

used to coordinate

and create a denial-of-service

condition and therefore

we get distributed
denial-of-service attack.

So that's a handful
of type of tax

and some pretty common attacks

that you're going to see

as an ethical hacker

when you become

an ethical hacker

or if you're trying
to become an ethical hacker,

you should always know

about these types of attacks.
Okay.

So in this lesson,

we're going to be talking

about penetration testing

and some of the details

around how it works

and Logistics and specifically

things like scope so,

Exactly is penetration testing.

So well, not surprisingly.

It's testing to see

if you can penetrate something

which means you're going

to check to see

whether you can break

into a particular thing.

Whether it's a server or

in applications depending

on the type of Engagement.

You've got you may have

the ability to try to break

in physically to a location

but primarily but you're

going to be doing

with penetration testing

is you're going to be trying

to break into systems

and networks and applications.

And that's the kind

of what It's all about

and this may actually involve

social engineering attacks.

So it may require you

to make a phone call

to somebody and get them

to give you their username
and password or some other type
of social engineering attack

where maybe you send a URL

via a crafted email.

Sometimes it's just strictly

a technical approach.

We're running scans

and you're running Metasploit

and you're gaining

access that way or maybe

some other type of Technology.

Application sort of connection,

sometimes it's physical access

that you need.

So in order to get access

to a particular system,

if you can get physical access

then maybe you can get in

so that was all about

that's what exactly

penetration testing is.

It's checking whether you

can get into a system

whether it be physically
or on a network.

So what are the goals

of penetration testing the goals

would be to assess weakness

in an organization
security postures.

We want to figure out

what they're vulnerable

so that they can go and fix

It's these problems you want

to help them understand

their risk positions better

and what they can

or may be able to do
to mitigate those risks

and ultimately you want

to be able to access systems

in a particular way
to find weaknesses.

So those are really

sort of the goals

of penetration testing now

from a result standpoint

when you're done you're testing

what you are going to do.

Well, you're probably going to

generate a report and by that,

I don't mean you're going

to run some automated tool

and you're going

to get it to generate.

The report for you,

you're actually going to give

that to the client.

You're actually going to give

you a report to the client

and then they're going to write

you a really large check.

So that's not really

how it works.

You're going to write a report

detailing the findings

in a detailed way

so that it includes
what did you do to find out

what you actually found out

and how you can actually

mitigate that particular risk.

So you should really include

remediation activities in order

to fix this vulnerabilities

that you find and it's

pretty easy to walk

around saying hey,

that's a problem
and that's problematic.

And that's a problem.

That's really not a lot of value

in that where there's

a value is that hey,

that's a problem.

And here's how you

can go about fixing it.

So let's talk about the scope

of penetration testing.

So firstly you want

to actually realize

how big is the breadbox

and how specifically what is it

that the you two of the two

of you have agreed

that being you

the ethical hacker

and the other guy being

the authorized person to give

you permission to ethically

hack specifically agree

that you can do

penetration testing.

And you can Target them as

an organization or decline

and what you have agreed

to our any exclusions

or any sort of areas

that they say you're not allowed

to touch so anything so

like if they've got

a database server,

maybe there's a lot

of really sensitive data on it
and there's a little hesitant

and they may put don't touch

this thing clause in the school.

So there are a lot

of different reasons

why they may exclude

areas from the scope

and if they exclude them

then trust their reason

and listen to them

what They have to say

in terms of this is

what we want you to accomplish.

So along those lines you

really need to get sign off

from the target organization.

Now, we've talked

about this before

and this is certainly all

about the ethics then trust

and it's also about legality

because if you do something

that you don't have

permissions to do you

could be prosecuted for that.

So definitely get the scope

very clear in writing

and with signatures attached

to it as to what you can

and what you can't do

and always get approval

from the right people

and make sure you get Buddy

who has the right level

of permissions and is
the right level of management
so that they can sign off
on its understanding

and accept the risk

that is associated
with a penetration test.

So let me talk a little bit

about security assessments

and how they differ

from penetration tests.

The security assessment

is a hand

in hand approach with clients.

So you would walk in doing

a collaborative thing

where you're a trusted partner

and you are live with them

and your goal

isn't to penetrate them

and point out all the things.

That are really bad,

but it's to get a full

assessment of the risk

that the organization is exposed

to and you would probably

provide more details about fixes

that maybe you would

in a penetration test.

Now what we're going to do

is we're going to walk in

and make sure

that the policies

and procedures they have

in place are really

what they need

for the organization

and the risk appetite

that they've got
and we're going to make sure

that the policies

and procedures have controlled

that can tell us

whether they are being

actually adhere to or not.

Procedures and policies

are being followed

a security assessment is
probably a little bit

more comprehensive

than a penetration test

and you would look

at more factors to assess

the security postures

of the organization

in their overall risk

and you would tailor the output

based on the risk appetite

and what they're most interested

in and that's not to say

that I'm going to tell them

what they want to hear.

But if there's something

that they know and I know

that they're just

not going to do

I'm not going to be making

a big deal out of it

because they're already

Eddie aware of it

and I'll make a note

of it in the report just

for a complete the sick,

but I'm not going to go out

in a lot of details.

So it's really kind of

a hand hand collaborative
approach where again,

you're not just saying

that they want us to say we're

providing some real security

and risk guidance

towards her activities

and other things

so it may provide
an unrealistic view.

So you've got a week.

Let's say to do
this penetration test

against your target.

Now, you're going to have

to go in you're going

to have to get setup.

You're also going to have

to start doing a bunch

of scans and make sure

that Gathering information

and screenshots and data

for your reports

you're going to have to do

all sorts of activities.

Also during the course

of that week.

You're going to be engaged

in probably beginning

to write your report

and getting a sense of

what is going to say

and what's going to be in it.

If you don't actually

get any major penetration

during the course of that week

the organization may feel

like their code and code secure.

That's one of the reasons

why penetration testing

while really sexy

and show is nice and all

but if an organization walks

out of it it believing

that in a week,

you didn't manage to get

no get the Keys of the Kingdom.

They might must be secure

that's really misguided view

because I'm dedicated skilled

and motivated attacker

isn't going to just take a week

or some portion of that fee.

They're after something

they're going to dedicate

themselves to do it
and really go after it.

So just because you didn't find

a penetration in some subset

of week doesn't mean

that they're secure and Illman

and in vulnerable to attacks.

It just means
that during the course

of that particular week

and The circumstances

that were in place you

can get a penetration

that was really

significant or major.

That's all it means.

It doesn't mean anything

beyond that and

if an organization
walks away feeling

like the secure they're going

to end up not fixing

the real vulnerabilities

that may be in place

that could expose them

to significant risks.

So that's penetration
testing its corpse its goals

and how it differs

to security assessments now,

it's time to go
over foot reading.

So what is footprinting well

for printing is getting an idea.

Via of the entire scope

of your target.

That means not just the scope

that you were given

which may be an address block

or it may be a domain name

that even maybe a set

of a truss blocks.

Now, what you want to do

is you want to figure

out all the information

that's associated with that

in great detail

as you can possibly get so you

want the list of domain names

as you're going
to go through this

you probably want some sort

of database or Excel
spreadsheet or something.

Track of all the information

because you're going to have

a lot of it at the end.

You want to be able

to find information quickly.

So having some sort

of in a notepad going

with your notes or

as I said spreadsheet
or a database.

So if you can get organized

in that way you want to keep

all those sorts of things down.

So in this case,

I want to do
some search on suppose.

Let's say Eddie

record dot go now.

I need Network block.

So so far we found out

that just made up IP addresses

because I'm just

putting information down,

but I need never be Block,

so you may have one IP address

that you can find externally

or you're going to want to hold

range of internal clocks and you

can do a little bit of digging.

If you aren't provided those you

want specific IP addresses

for critical systems web

servers email servers databases.

If you can find any

of these things

of those sorts and you

want system architectures

and what kind of stuff are they

running are they running Intel
are they running windows?

Are they running

some Unix systems?

What are they running?

What kind of Access

Control lists they have.

These are going to be To get

but you may be able to guess

them and you can guess

these by doing Port

can so what sort of responses

you get back from the port scans

with the filters and are

what you don't get back.

We'll tell you about

if there's an IDs

around or some you want

to do a system numeration,

or you can get access

to a system somehow you want

to know usernames group name.

So on so the basic idea

of footprinting is
gathering information now

if you can get access to system

somehow you want to no use

Names group names so you want

system banners routing tables

SNMP information if you

can get it DNS host names

if you can get those now,

this is for both internal

and external on the side.

If you're doing
an internal penetration test

or ethical hacking engagement.

You want to know the networking

protocols that are out there.
Are they using TCP IP,

or are they using some UDP

or are they on ipx

or SPX the using decnet

or appletalk or are they

using some sort of split DNS?

In other words?

Do they have internal DNS?

So was that give different foam

for the external and will it

give different information?

If you want to check for

remote access possibilities now

in the foot printing process

you want to be very exhaustive

you might want to try

and take out email addresses

server domain name Services.

I mean IP addresses
or even contact numbers

and you want to be very

exhausted with your approach.

You don't want to miss

anything out because

if you do that,

you can continue

and also provide some some

launching points for additional.

Tax or test that you

may be able to do but this

is definitely a starting point

of the types of information

that you need to have

as you go about
footprinting your target.

Now next thing

that we are going to see
is very interesting.

This is one
of the many common tools

that are out there

on the internet and

that is the Wayback machine

or also known as archive.org now

while it might not give you all

the information that you need

but it gives certainly

gives you a starting point

and what we're talking about

here is the Wayback machine

or archive.org so Just
give you a quick look

at what archive.org looks like.

Okay.

I already have it open out here.

So audio what you can see is

how a website look

like around some time ago.

So for example,

if you want to look at

with Google look like

so you just have to search

for Google out here and wait

for results to come back.

Okay.

So we see that Google goes

way back to 1998.

So that was the last capture

or the first capture other.

It was the first capture

by the Way back machine

and we can see

that it has a screenshot
of November 11th

and how Google looked so,

let's see what Google look

like in November 11th of 1988.

So this is what Google look

like it was there was

actually nothing to it.

It just said welcome to Google

Google search engine prototypes

and it hasn't link.

So yeah, this is what the Google

search engine look like.

It had a Stanford surge.

It had a Linux urge

and you could do

all sorts of stuff.

You could just put

the results now.

I'm trying to tell y'all is

you can see the evolution

of the website should time

to the Wayback machine

and this gives you rather

in informated look

into how website

has actually evolved.

Okay.

Now that we know what

for printing is

and how it falls into

the hole recognition process.

So let's go over a couple

of websites to do a little bit

of historical thinking
about companies and the types

of infrastructure
that they may be using

and this information

of course is useful

so that we can narrow

down our Focus.

Us in terms of what we want

to Target against them

for attacks now over time

we've improved our awareness

about what sorts

of information we may want

to divulge so several years ago

you may have gone to a company's

website and discover

that you could get

email addresses and names

of people in positions

that you may find relevant

and there were all sorts

of bits of information

that could be used

against the company

and over time we have discovered

that those are pieces

of information probably
don't belong in a website

where they can be used

against the company

and so they've been pulled

off now The used to be also

that Google had the ability

to pull up information

that it had cash so far.

For example,

if a website is
no longer available or

if it was temporarily
down and offline.

There was a little cash button

that you can click

when you did

and the Google search

and you could pull up

that cast information.

So even though the website

wasn't available you can still

get information from Google's

servers now Google's remove

that so we don't have

that ability any longer.

However, there is
an internet archive

that we can Use so this thing

is called the Wayback machine

and I have it open out here.

So it's archive.org / web.

So archive.org is a website

that gives us information

about other websites

and how they look

like in years ago

and by so I'm going to go

to the Wayback machine

which you can see is

at the archive.org

and I'm going to go and try and

search for Eddie record dot go.

So now we're going

to take a historical look

at Eddie record dot goes website

and you can see we've got

some years and they've got

information going back up

to Thousand thirteen,
so let's look at what
this website looked

like when it was just 2013.

Okay, there doesn't seem

to be any snapshots out here.

I wonder what's going on.

Okay.

So let's go 2014 and

the first snapshot seems to be

on the September 12th of 2014.

Actually.

It's on May 17 to so
let's see what

that looks like.

Okay.

So this is what Eddie

regular look like back in 2013

or other 2014 September

12 2014 to be actually exact

now you can see

that the we have

some live classes

and all this pictures there

and they've got this weird

picture of the sky

and here I don't know why

that was a thing back in 2014.

Now we can browse more

advanced screen shots

or rather the screen shots

that were taken later on and see

how this company has evolved

with this infrastructure

and the way it actually

lays out its content.

Okay, so it still hasn't evolved

but I can go a couple
of years ahead and see

what this has actually

evolved into so

if I would go to December 2016,

so this is what it looked

like in 2016 and we can see

that they've added

this weird box out here

about brides and courses

they have other search bar

that kind of looks weird,

but it's mostly

because my Internet is slow

and it's not loading

all the elements.

They've also changed

how they've actually laid

out the courses we can also.

Oh see a change
in the prices, I guess.

So, yeah, this tells us

about how it evolves

as complete website.

Now this other website I want to

talk about is called net crap.

Now next craft does

internet research including

the types of web servers

that companies run and they

have a web server service.

You can see here as we scroll

the Apache server service has

sixty four point three percent

of the internet Market,

of course,

and that's followed by Microsoft

with 13% interesting information
may be useful information,

but even more useful

than that is looking.

But different companies

Run for the websites

and you can see here.

Okay.

So let's try and search

for Eddie Rekha dot code here.

So let's just put

in the website URL

and that net craft

generate the site report.

So as you can see

that some stuff

is not available.

You know that the net

block owner is

by Amazon Technologies name

server is this thing right here?

DNS admin is
AWS DNS host Master.

We also have the IP address

we can go for a wire look up.

Up the IP on virustotal
you can do that.

There is no IPv6 present.

So that's some information

that we can see so we

can obviously opt-out not

Target IPv6 ranges.

Then there's also reverse DNS

then we also have a bunch

of Hosting history.

So this is a history
of it and we know
that it's hosted on a Linux
system with an Apache web server

and it was last seen

and this was when it

was last updated.

So this is some very

useful information.

You can also get information

on If like Netflix,

so if you just type, okay

I said I just
spelled that wrong.

So let me just change

from the URL out here.

So if you go and die for

netflix.com and you'll see

that it will show you

all sorts of information.

So as you see that it's

on an e WS server.

It's Amazon data services,

Ireland and this is

all the hosting history

that it goes along

with it has some send the

policy Frameworks domain-based

message authentication

and Reporting confirmations.

And there's all sorts

of information that you

can get about websites

and web servers from net craft.

So the Wayback machine

long with net craft make up

for some interesting tools

that are available

on the internet from which
you can do a little bit
of your reconnaissance recess.

Okay.

Now that we have gone

over net craft

and the Wayback machine now,

it's time to actually

get to know how to use

the little information

that the side actually provides.

So what the next topic

that we are going to go

over is using DNS to get

more information now we're going

to be Going over to land.

This is called
who is and the utility

that is used to query

the various Regional internet

registries the store information

about domain names

and IP addresses and let

me just show it to you

about all the internet

registries are there.

So I have Aaron dotnet open

out here and these are

the internet registries

that provides the isps

and looks over the Internet

control as a whole.

So here we have afrinic we

have up next we have Aaron

we have lacnic
and we have ripe NCC

so These are all the regions

and all the different types
of stuff that they support
all the different countries.

You can look at the map

that it is pouring out

here by just hovering

over the providers.

So as you can see all

these Brown region

out here is Africa

after Nick then we have up next

which is black or grayish thing,

which is India and Australia

and quite a lot of issue

then we have iron

which is a lot of North America

in the United States me.

Then this lacnic

which is mostly the Latino side,

which is a South American part.

Then we have the rest of Europe

which is ripe NCC

and this is the part

that ripe NCC is providing

internet to okay.

So that was all

about the internet registries.

Now, let's get back to the topic

and that is using DNS

to get more information.

Now for this we are going to

be using a Linux based system.

So I have a bunch of running

on my virtual machine

out here and let me

just log into it.

So firstly we are going

to be using this Square.
I recalled who is that looks up

these internet registries

that I just showed you.

Let me just quickly remove this.

Okay.

So for acquiring information

from the regional internet

registries that I just talked

about you can use

who is to get information

about who owns

a particular IP address.

So for example,

I could do who is and

let's see I could do

who is Google or rather

netflix.com and we can get

all sorts of information

about Netflix so we can see

that we Of the visit markmonitor

then let's see.

Let's go up and look

for all sorts of information

that has been given to

us by this who is query.

So as you guys can see I just

went a little bit too much.

Okay.

So registry domain ID,

we have the domain ID

where it is registered as

a registered URL is markmonitor.

Okay.

So this is for marking actually

now the creation date is 1997.
So you haven't realized Netflix
been around for a long time

and it's been updated on 2015.

And registry expiry date

as we see is 2019 that's going

to actually go off this here.

Then this is all

useful information

so we can see all sorts

of domain status

the name server URL the DNS SEC

that it says unsigned.

This is very useful information

that is being provided

by very simple query.

Now, if you want to know who

owns a particular IP address,

so let's see if we get back

the IP address out there.

We should have got

back the IP address,

but it's kind of lost on me.

So To get back the IP address

also for a domain name service.

So, you know,

so you could use

this command called dick.

So your dick netflix.com.

Now as you guys can see

that it has returned a bunch

of multiple IP addresses

at these are all

the IP addresses

that Netflix's so I
could do something like

if I was trying to check out

who all the certain

IP address and for example,

I have got one

of these IP addresses,

but let's just assume

I don't know

that actually belongs to Netflix

so I can go who is
50 4.77 dot hundred and eight to

and it'll give

me some information

so As you guys can see

it is giving us a bunch

of information as to who this is

and how it is happening.

So we see that it is

from Aaron dotnet and so

we can very smartly assume

that it's from the North

American part know

we can also see

that it's in Seattle.

So our guess was

completely right.

So it also gives us a range.

So this is
something very useful.

So if you see we now have

the rain age of the IPS

that might be being

used by this guy.

So we indeed have 54 and it

says it goes up to the 54.

There's also 34 lat now.

Let's check that out and see

what information we get set

who is and let's check it out.

What was the IP

that we were just seeing
is 34.2 49.1 25.1 67.

So 34.2 49.1 65 I don't know.

Let's see.

You can also put in

a random IP address.

It don't really matter

and they'll give

you the information.

So let's see is this

and some IP address even

this seems to be an error

and IP address
and it's also based in Seattle

and we got
a bunch of information.

So that's how you can use the

who is query

and the query do actually

get all sorts of information

about the domain name service

and get information

from a DNS basically.

So now let's go
over some theoretical part

that Is for DNS.

So using DNS to get

information so firstly

what is the domain name service?

And why do we need?

So a domain name service is

a name given to an IP address

so that it's easy to remember.

Of course you it's easy

to remember names

and demonics rather than a bunch

of random weird numbers.

Now, this was mainly

so that we can map names

to IP addresses and we can get

the a bunch of information

from the host name resolution.

So that's the purpose

of IP addresses now

we Also be looking at
how to find network ranges.

Okay.

Now before we get

onto actually moving on

to how to find out

the network ranges,

let me just show you

how you can also use

who is so who is suppose

you want to know the domains

with the word feu in it.

So you could go

who is fool and this

will give you a whole bunch

of things but hafu exist

and all the sorts of foods

that there is on the internet.

So that was
one interesting flag,

and if you want to know

how to use more about Who is

you could just go - - hell?

Yes.

Yeah.

So this is all
the types of stuff

that we can do with who is

so you can set the host
we can set the board

that we want to search for then

we can set with the elf laughing

and find one level

less specific match

and we can do an exact

match to an inverse

look up for
specified attributes.

Then we can also set the source

we can set verbose type

and we can choose

for request template

with this bunch of stuff.

Can do so you could suppose say

who is verbose and suppose

any record dot coal

and I'll give you

a verbose version

of the right database

query service objects

aren't RPS out format

the right database objectives.

So, okay.

Let's try something else

like who is netflix.com?

Okay, I'm sorry.

I was supposed to be were both

and I kept doing Edge silly me.

So you do V and that will give

you a much more like this

is the right database again.

And I think
I'm doing something wrong.

Okay, just for that thing.

OK V and tight okay,

or let's just see
that's let me just show you

how to use video primary

keys are returned.

Only primary Keys.

Okay.

Let's see.

Let's try that out.

Okay, so it seems to be

that this is a ripe

database query service

and objects are

in our PSL format.

So it won't really
work for that thing.

And it also says

that no entries found

because this error

so this is for
some layer lessons.

So for now,

I hope I gave you a good idea

of how to use Hue is

like you could Just go ho is

then some IP address 192.168.1.1

or some Gabriel just like that

or you could just go

for a domain name service

like Facebook and get all sorts

of information about Facebook

when the query actually

returns you something.

Okay.

So let's move on

to network range is now now

in this part of the video.
We are going to be going
over the utility called who is

which is used for getting

information from the DNS.

Now, let me just show

you a website.

Get out here.

So this is the regional

internet registries.

So the internet registries

are used to store information

about domain names

and IP addresses and there are

five Regional internet

registries first is iron,

which is responsible
for North America.

So that would be the US and

Canada then we have laugh make

which is responsible
for Latin America

and portions of the Caribbean

then there's ripe

that's responsible for Europe

and Middle East

and Central Asia.

There's afrinic which is

responsible for Africa.

And finally we have up next

which is responsible
for Asia Pacific Rim.

So, that's the Regional internet

registries and as I said

who is responsible
for acquiring information

from the various

Regional internet registries
as you can use who is to get
information about who owns

a particular IP address,

for example, let me just open

up my Ubuntu system.

Let me clear this out first.

So as I was just saying,

for example, you could go

who is facebook.com.

Okay.

So as you guys can see

we could find out

pretty quickly about who owns

a particular IP address.

So for example,

I could do who is
in just go facebook.com

and tells me about who it

belongs to a also gives you

who owns a particular IP address

and who's responsible

for them from the information.

You can get email addresses.

I belong to
a particular company.

This one has an email address

for Tech contact

of Ip reg address it

so you can get all sorts

of email addresses

attack contacts and all sorts

of stuff out there

the Database contains

only.com and dotnet

and all sorts of information.

Now.
I want to query
a different IP address

and different information

belongs in the different

Regional internet registries,

of course,

so if I want to go
to a particular database,

I will have to use

the minus H flag

so I could do who is Aaron net

and remember the IP address

and I'm going

to query that again.

And of course I get

the same information back

because I went there

so you could just go

who is Edge and then follow it

with an IP address.

So something like 30 4.25

the 176 the 98 so that's

just some random IP address.

I just made up and it says

that who is option?

Okay.

So it's a it's a capital H.

Okay.

So let's see

that and we get all sorts

of information back from that.

So area a Darren and all sorts

of stuff now I
can get information

about domains as well.

So if I can query
something like netflix.com

and I can find out that this is

that actually Netflix

and there's an
administrative contact

and the technical content that I

need to see the difference.

Main server so service

that foot have

authority of information

about the DNS entries

for that particular domain.

You can also see

other information like

when the record was created

and whole bunch

of different phone numbers

that you contact an

additional storing information

about IP addresses
and domain name.

Sometimes it will
store information

about particular host names

and there may be other reasons

why you would store a hostname

or particular information

about hosting on
the system where the one

of the rare rirs now

if I want to wanted to look

up something specifically So

once I have found

that I could know do a look up

on who is supposed say

something like who is full.
So let's say who is fool.

Now if you already don't have

who is installed you

can easily install it

by just going up to install

who is on your Unix system

and that should do the trick

and then you can start use

this really Nifty tool.

Okay, so that was all

about using who is now let's get

on to actually using

how to Network ranges

for a domain.

Okay.

So now let's talk about how we

are going to be going over

and fighting next ranges.

So suppose you bought it

at engagement and you only

know the domain name

and you don't know much

beyond that and you're

expected to figure out

where everything is
and what everything is.

So how do you go
about doing that?

Well use some of the tools that

we either have been talking

about or will soon be talking

about in more detail.

And the first thing

I'm going to do is I'm going

to use a domain name

that you record.com

and I'm going to look up at you

like a DOT go and see

if I get get an IP address back.

So let's just head over there

and go poo is Eddie record

or not cool,

or we could use
the host keyword.

So as you see we get

an IP address back

and that is 34 the to dander

to 30 the 35 and that is

the IP address and you see

that I've got back

an IP address.

So here's just an IP address

and I don't know what

that IP address belongs to

and I also don't know

how big the network range

or network block is

that's associated
with so what I'm

Do is a who is and I'm going

to look up with Aaron

who owns it IP address

so you can basically go

who is 34.2 10.2 3935.

So as you guys can see

that gives us a bunch

of information and

who is now this doesn't seem to

have a very big Network range,

but unlike something

like Netflix.

So suppose we were

to do something like host

netflix.com and see See now.
We have a bunch of IP addresses.

So suppose we will do
who is let's see

who is 52.99 the $40 147

now I'm expecting Netflix

to be a much larger company

and have a better.

Yeah now see we get net range.

So this is the network range

that we're talking about.

So we had a random IP address

and now we have found

the network range.

So that's how
Find network ranges

and this can be very useful.

So this gives me evidence

that netflix.com has a presence

on different addresses.

The one I have also

located by looking up
that particular host name.

So I've got one address

here that I can look at.

Let's take a look at the website

because let me
different address.

Now if I didn't have

that I could also go

and do something
like an MX flag.

So let's see I could go dig

and this will give us

all the male's so dig MX.

And let's see.

Let's see what MX
does actually you go help

so we could do dig -
Edge for a list of options.

So these are all the options

that we have and the one

that we're going to use

is something like this.

Do you think MX and we say

something like netflix.com.

So these are all

mailings and mx's

that we have gotten from Netflix

and this is information

regarding it's still

producing information.

That's a big thing to produce.

Okay.

So as I was just
saying you can use

the MX flag I could get back all

the mail handlers in this case

and their mail is being handled

by Google and let's see wait,

let's go until then

it's going to tell me

that Google is not particularly

surprising and other things

that you can do is check

for different host names

since I'm assuming DNS

probably doesn't allow

Zone transfers since most DNA.

Has servers don't anymore,

although they used to you

may have to start guessing

so I could do something like

Web Mail said we find out here.
So it's showed us a dump of all
the ascending memory stuff.

Okay, so that was all

about finding Network

ranges now moving on

to our next topic is using

Google for recognizance.

Now some people also call

this Google hacking now,

if you know how to use Google

to exactly Target and find

what you are looking for.

Google is an excellent tool

for recognitions purposes.

And today.

I'm going to show you

how you could use Google exactly

for your searches.

So first of all,

let's go Open a tab

of Google so open up here.

So let's go to google.com.

Ok.

So now we're going to be talking

about how we can use Google to

actually gain some information

or some targeted information.

So this is in general called

Google hacked now

when I say Google hacking

I'm not meaning

by breaking into Google

to steal information.

I'm talking about making use

of specific keywords

that Google uses to get

the most out of the queries
that you submit.

So for example,

a pretty basic one is the use

of quotations you go things

in order to use Civic phrases.

Otherwise Google will find pages

that have instances

of all those words rather than

the word specifically together

in particular order.

So I'm going to pull this query

up and this shows a list

of let me just show it to you.

So you go index off now.

This is showing us an index

of all the films now.

This is basically all

those index of size

that you want.

So as you guys can see the show

this index of all sorts of films

that are there now you

can Use index of and you see

that we have also

an index of downloads
or something like that.

-.com such download

and it is an index
of all sorts of stuff.

Now you can go into some folder

and check them out G Jones.

You weren't EG Perico.

I don't know what these are

but some sort of self.

And this is how you

can use Google Now.

Let me just show you

some more tricks.

So you can use this

suppose you're using Google

to find for something

like a presentation

so you could use something

like file type.

DP DX and it'll search

for every type of file there.

That is Peabody.

Okay.

Let's try some other

side PVD so config.

Okay.

So this brings up all

the types of files

that have some configs in them.

So some gaming configuration

as we see this initial

configuration of Liverpool.

Now, you could also use

something like the sing and URL

and you can use

some other route.

And this will give

you all the things

that route in their URL.

So King rude and Digital Trends

and how to root Android

so fasten the root

and suppose you want

to say something like all

in file type or suppose.

You want some extension

so so dot P BTW the pptx.
Does that work?

Let's search for

JavaScript files.

Okay.

I think it's JS.

Okay, that doesn't seem

to work either.

This shows us all the things

that she estimate.

No, it's just external JS.

I'm doing this wrong.

So you could use file type.

So let's see file type

and we go see doc.

So these are all the documents

that you could find

at the file type thing.

And you could also

do GS, I guess.

Yeah.

This is give you all

the JavaScript files are there.

So this is how you can use

Google to actually narrow

down your searches

to suppose you want

a particular set of keywords,

and we want to make sure we get

the password file from Google.

Okay.

So now let's go

into more details

about the various things.

You can find

using Google hacking.
Now while Google hacking
techniques are really useful

for just general

searching in Google.

They're also useful

for penetration testers

or ethical hackers.

You can narrow down information

that you get from Google you

get a specific list of systems

that may be vulnerable

so we can do things
like look for are pages

that do in the title error.

So I'm going to get

a whole bunch of information.

So suppose like we go in title

and we say error So

as that we get
all sorts of stuff

and we can do
the mines Google part.

So if you don't mind is

Google not show you the stuff

that's from Google.

So we get a variance
documentation pages

about different vendors

and the errors

that they support.

So here's one doc

about Oracle about Java error,

but you know something more

specific we may be able to get

errors about all sorts

of other stuff.

So this is how you could use

the Google hacking technique
to your own advantage
of your penetration tester.

Now, let's also show

You something called

the Google hacking database now.

This is very useful

for an ethical hacker.

Now on the Google hacking

database was created

several years ago by

a guy called Johnny Long

who put this Google hacking

database together to begin

to compile a list of searches

that would bring

up interesting information.

Now Johnny has written a couple

of books on Google hacking.

So we're at the Google

hacking database website here

and you can see them talk

about Google Docs

and all sorts of stuff.

Now you can see

that we can do all sorts

of search like and you

are Elsa BC B SP this brings up

some portal Pages now out here.

You can bring up some password

APS password and URL.

Now this will give

you all sorts of stuff

on Google suppose you go and URL

like a PS password.

Now, you can get all sorts

of stuff like which have

passwords in their URL.
So maybe you can just guess
a password from there to now

that was Google hacking

so Google hacking
entries and they also,

Number of categories

and that you can look through

to find some specific things.

So you may be interested

in of course

and you will search

specific information that you

may be looking for with regards

to specific product.

For example, let me

just show you XY database.

These are all

the certain types of stuff.

You can go through out here.

And as you see we have all sorts

of sound like is
an SQL injection thing.

This is something
regarding Pier archived ours.

So these let you get a foothold

in the some password cracking.

Alms and you can do

some Brute Force checking

and you can see here

if it talks about the type

of searches and what it reveals.

You can just click here

on Google search engine

will actually bring up

Google fit a list of responses

that Google generates.

So let's look at this one here.

This type is a log.

So this is something
about cross-site scripting logs

and we can also

see some party logs

if I was not wrong

so some denial-of-service POC

and we can see a bunch of stuff

and if you continue

to scroll down there,

Our interesting information

in here so somehow
somebody's got a party log

that has a lot of information.

They've got it up
on a website and basically

bunch of information

that you can see you can also

get some surveillance video

sometimes and you can look

into them and this basically

how you could use Google.

So it's basically a list of

queries that you can go through

and this is a very useful site

if you are a penetration tester

and looking for some help

with your Google

hacking terminologies,

so that's it for

Or Google hacking now.

Let's move on.

Okay.

So now it's time

for some networking fundamentals

and what better place

to begin with dcpip.

Now we're going to be talking

about the history of dcpip

and the network

that eventually morphed

into the thing

that we now call the internet.

So this thing began

in 1969 and it spun

out of this government

organization called arpa

which Advanced research

projects agency and they

had an idea to create

a computer network

that was resilient

to a certain type

of military attacks

and the idea was

to have This network

that could survive certain types

of war and warlike conditions.

So our percent out this request

for proposals to BBN,

which is Bolt beranek and Newman

and they were previously

and acoustical consulting

company and they won

the contract to build

what was called the arpanet.

The first connection

was in 1969.

So that's where we get the idea

that the internet began

in 1969 and the internet

as we call it now Then

Shall We Begin but arpanet it
and often it has a long history

that goes goes through NSF net

in 1980s and after arpanet

was sort of decommissioned

and a lot of other networks

were folded into this

this thing called nsfnet

that then turned into

what we now call the internet

and once a lot of other

networks were connected

into its first protocol

on the arpanet

initially there were

18 to 22 protocols,

which is very first protocol

defining communication

on arpanet and it
was called 1822 protocol

because BBN report

1822 which describes

how it works shortly

and after that.

It was just think all

the network control program

and the network

control program consisted

of arpanet host-to-host protocol

and an initial control protocol.

Now, they're certainly

not a direct correlation

or an analogy here.

But if you want to think

about it in particular
where you can say

that the arpanet host-to-host

protocol is kind of like UDP

and initial connection

protocol or ICP.

It's kind of like TCP.

So the host-to-host
protocol provided

a unidirectional flow control

steam stream between hosts.

Which sounded a little bit

like UDP and ICP

provided a bi-directional pair

of streams between Two Hosts.

And again, these

aren't perfect knowledge.

He's but the host-to-host

protocol is a little I bit

like UDP and ICP is a little bit

like TCP now now

the first router was called

an interface message processor

and that was developed by BBN.

It was actually
a ruggedized Honeywell computer

that had special

interfaces and software.

So the first router wasn't

Roundup built piece of Hardware,

but it was actually

an existing piece of hardware.

Especially published
for this particular application.

So Honeywell had this computer

that they made out and BBN took

that and made some specific

hardware and faces

and build some special software

that allowed it to turn

into this interface

message processor,

which passed messages

over arpanet from one location

to another so

where did I become

hint here in 1973?

So I became in here
as well in 1973

as I just said and a guy

but name of Vint Cerf

and another guy by the name

of Robert Kahn took.

The ideas of NCP and

what the arpanet was doing

and they tried to come up

with some Concepts

that would work for the needs

that the arpanet had

and so by 1974.

They had published a paper

that was published by the IEEE

and they propose

some new protocols.

They originally proposed

the central protocol called TCP

later on TCP was broken into TCP

and IP to get away

from the monolithic concept

that TCP was originally

so they broke it

into more modular protocols

and thus you get TCP and IP.

So how do we get to our version?

Or which is ipv4

since that's the kind

of Internet that we're using

right now version 6 is coming

and has been coming

for many many years now,
but you're still
kind of version for

so how did we get here

between 1977 and 79

and we went through version 0

to 3 By 1979 and 1980.

We started using version 4 and

that's eventually became

the de facto protocol

on the internet in 1983

when NCP was finally shut down

because of all the hosts

on the arpanet,

but we're using TCP IP.

By that point in 1992 work began

on an IP Next Generation
and for a long time,

although the specifications

in the rfc's talked

about P&G eventually

and I PNG became known as IPv6.

You may be wondering

where ipv5 went.

Well, it was
especially purpose protocol

that had to do something

with streaming and certainly

not a widespread thing.

One of the differences

between ipv4.

And IPv6 is

that IPv6 has a 128-bit address

which gives us the ability

to have some Recklessly

large numbers of devices

that have their own unique

IP address IP V4 by comparison
has only 32-bit addresses.

And as you probably

heard we're well

on our way to exhausting

the number of IP addresses

that are available

and we've done a lot

of things over the years

to conserve address space

and reuse address space

so we can continue to extending

to the point till

where we completely
run a 5p V4 addresses.

Another thing about IPv6

is it attempts to fix

on the inherent issues and IP

and some of those has to do

with security concerns

and there are certainly

a number of flaws and ipv4.

I'm going to start working

on IP Next Generation or IPv6.

They try to address some

of those concerns in some

of those issues and they

may not have done it perfectly

but it was certainly an attempt

and IPv6 attempt to fix

some of the issues

that were inherently in IP.

And so that's the history of

TCP IP still very reach today.

Okay.

So now that we've discussed

a brief history on TCP IP

and how it came about

to the TCP IP version

4 Cisco's the model itself.

Now we're going to be

discussing two models.

And those are the OSI model

and the TCP IP model.

Now as I said will be talking

about the OSI and TCP models

for Network protocols

and the network Stacks OSI.

First of all is the one

that you see out here is the one

on the left hand side

of the screen and OSI stands for

open systems interconnection.

And in the late 1970s,

they start working on a model

for how a network stack

and network protocols would look

originally the intent was

to develop the model

and then developed protocols

that went with it.

But what ended up happening was

after they develop the models

TCP IP started really taking off

and the TCP IP model was

what went along with it

and much better

what was going on with TCP IP,

which became the predominant

protocol and as a result

The OSI protocols

never actually got developed.

However, we still
use the OSI model

for teaching tool as

well as way of describing

what's going on
with the network stack

and the Applications

you'll often hear people talking

about different layers.

Like that's a little too problem

or render layer
3 space now continuing

through these lessons.

I'll refer occasionally

to the different layers.

And when I do that,

I'm referring to the OSI model.

So let's take a look

at the OSI model starting

from the bottom.

We have the physical layer,

which is where all the physical

stuff lives the wires and cables

and network interfaces

and hubs repeaters switches

and all that sort of stuff.

So all that's all physical stuff

is sitting Sitting

in the physical layer now

sitting Above This is

the data link layer.

And that's where

the ethernet protocol

ATM protocol frame relay.

Those are things live.

Now.

I mentioned the switch

below the physical

the switch lives at layer 1,
but it operates at layer 2.

And the reason it

operates at layer 2 is

because it looks
at the data link address

and the layer

to our physical address

and that's not to be confused

with in the physical layer.

It does get a little

mixed up sometimes

and we refer to the MAC address

now the MAC address is

not the physical address.

I'm talking about it

is the message
authentication code dress

on the system as
so the MAC address

on system as a physical address

because it lives
on the physical interface

and bound physically.

However that Mac address

or media Access Control

address lives at layer

2 at the data link layer

the network layer,

which is right above at layer 3.

That's why the IP lives

as well as icmp ipx

and from ipx SPX

to the protocols from novel

routers operate at layer 3.

Three and at layer 4 above that

is the transport layer.
That's the TCP UDP and SPX again
from the ipx SPX suit

of protocols number
of that is the session layer

and that's layer 5 and

that's a plot of SSH as well

as several other protocols.

Then there's a
presentation layer

which is a layer 6 and

you'll often see people refer

to something like jpeg

or MPEG as examples of protocols

that live on that layer then

there's a presentation layer,

which is the final layer

which is layer 6 and you'll

often see people refer

to something like Jpeg,

or MPEG as example the protocol

that live at that layer

and then the live at that layer

which is the presentation layer.

Finally.

We have Leo 7,

which is the application layer

and that's actually TP FTP SMTP

and similar application

protocols whose responsibility

is to deliver and use

the functionality.

So that's basically
the OSI model and

that's the seven layers

of the OSI model

and there's some important

thing to note here.

That is when we
are putting packets

onto the wire the packets

get built from Top.

Top of the Stack Down

by from the top of the stack

to the bottom of the stack

which is why it's called

a stack each layer sits

on top of the other

and the application layer

is responsible for beginning

the process and then

that follows through

the presentation session

and transport layer and down

through the network data link

until we finally drop it on

the wire at the physical layer

when it's received

from the network.

It goes from the bottom up

and we receive it
on the physical

and gets handled

by the data link

and then the network

and till the application layer.

So basically when a packet

Coming in it comes in

from the application goes

out from the physical

and then we're going out also,

it goes from the physical

through the data link,

then the network

transport session presentation

and application and finally

to the Target system.
Now what we're dealing with is
an encapsulation process.

So at every layer on the way

down the different layers

add bits of information

to the datagram all the packet.

So that's when it gets

to the other side

each layer knows

where it's demarcation pointers.

Well, it may seem

obvious each layer.

Talk to the same layer.

On the other side.

So when we drop a packet out

onto the wire the physical layer

talks to the physical layer

and in other words

the electrical bits

that get transmitted by

the network interface

on the first system are received

on the second system

on the second system.

The layer two headers

have report by the first

system get removed

and handled as necessary.

Same thing at the network layer.

It's a network layer

the puts the IP header

and the network layer

that removes the IP header

and determines what to do

from there and so

on and so on again
while it may seem obvious

It's an important
distinction to recognize

that each layer talk

to each layer

while it may seem obvious.

It's an important
distinction to recognize

that each layer talk

to each layer.

And when you're building

a packet you go down

through the stack

and when you're receiving

you come up to the stack.

And again, it's called a stack

because you keep pushing things

on top of the packet

and they get popped

off the other side.

So that was detailed

and brief working on

how the OSI model is set up

and how the OSI model works now,

let's move on to the VIP model,

which is on the right hand side

and you'll notice

that there's a really

big difference here that being

that there are only four layers

in the TCP IP model

as compared to the seven layers

of the OSI model.

Now, we have
the network access layer

the internet layer the transport

layer and the application layer
in the functionality.

Now, we have the access layer

the internet layer

the transport layer

and the application

layer the functionality

that the stack provides is

the same and in other words,

you're not going

to get less functionality

out of the TCP IP model.

It's just that they've changed

where And functionality decides

and where the demarcation point

between the different layers are

so there are only four layers

in the TCP IP model,

which means that a couple

of layers that have taken

in functions from some

of the OSI models

and we can get into that right

here the difference

between the models

at the network access layer

in the TCP IP model

that consists of the physical

and the data link layer

from The OSI model.

So on the right here,

you see the network access layer

that takes into the account

the physical and the data link

layers from The OSI model

and the Left hand side similarly

the application layer

from the TCP IP model

and compresses all

the session presentation

and the application layer

of the OSI model

on the right the very

top box the application layer

and Compass has

the session presentation

and application layer

and on the left hand side

that of course leaves

the transport layer to be

the same and the OSI model.

They call it the network layer

and then dcpip model.

It's called the internet layer

same sort of thing.

That's where the IP lives

and even though it's called

the internet layer as

compared to the network layer.

It's Same sort of functionality.

So those are the really

big differences between OSI

and dcpip model anytime.

I refer to layers
through the course of this video

that I'm going to be referring

to the OSI model and in part

because it makes
it easier to differentiate

the different functionality.

If I were to say live

on function in the TCP IP model,

you would necessarily know

if I was talking
about a physical thing
or a data link thing

since there's more granularity

in the OSI model.

It's better to talk about

the functionality in terms.

Terms of the layers

in the OSI model

and that's the predominant

model The OSI model

and the TCP IP model

for Network Stacks Network

protocols and applications.

Okay.

So now that we've discussed

the TCP IP model.

Let's go over some

another important protocol

and that is UDP.

So what do you see out here

on your screen right

now is Wireshark

and we'll be going

over the users of our shark

and what it's useful for

in the sock upcoming lessons.

But for now, let me

just show you a UDP packet.

Okay.

So before we get

into the analysis of the packet

while it's still filtering,

let me just tell you

a little bit about you to be

so UDP is a protocol and

the TCP IP suit of protocols.

It's in the network layer.

That's a network layer
in the OSI.

So similar reference model

the IP network layer carries

the IP address

and that has information

about how to get back is

to his destination

the transport layer sits

on top of the network layer

and that carries information

about how to differentiate

Network layer applications

and that information about

how those Network application

gets differentiated is
in the form of ports.

So the transport layer has ports

and the network layer has

in this case an IP address.

And UDP is a transport layer

protocol and UDP stands

for user datagram protocol

and often call connectionless

or sometimes unreliable.

Now unreliable doesn't mean

that you can't really rely

on it unreliable means

that you can't just

that what you sent

is reaching the other side.

So 1 means actually
that there's nothing

in the protocol that says

it's going to guarantee

that the data Will Graham

that you send or the fact
that you send is going to get
where you wanted send it.

So the Tikal has no sort

of safety feature like that.

So you shouldn't use

this protocol that is used to be

if you want some sort

of safety net.

And if you needed that type

of safety net you

would have to write it

into your own application.

So basically UDP is
a fast protocol and that's one

of the reason why it's good.

It's also on the reason

why it's unreliable

because in order to get

that speed you don't have

all of the error

checking and validation

that messages are getting there.

So because it's fast it's good

for things like games

and for real-time voice

and video anything

where speed is important.

And you would use UDP.

So right here.

I have a packet capture.

So I'm using Wireshark capture

some buckets and let's check out

UDP packet so out here you see

that there are some freedoms

that says 167 bites on bio

167 bites have been captured

but we're not really interested

in the frame part.

You're interested in
the user datagram protocol.

But so here you can see

that the source board is

one eight five three

and the destination

Port is Phi 2 0 8 1

now it has a length

and it has a checksum and Tough.

So as you guys see

out here, well,

we don't really see

a bunch of information

what you only see

is a source port

and the destination port land

and there is also a checksum

so you to be doesn't come

with an awful lot of headers

because it doesn't need any

of the things that you see

in the other packet headers.

The only thing it

needs is to tell you

how to get the application

on the receiving host.

And that's where

the destination Port comes in

and wants the message gets

to the destination.

The destination needs to know

how to communicate back

to the originator

and that would be

Through the source port

or a return message.

So a return message
would convert The Source port

to a destination port

and send back to that board

in order to communicate
with the originator.

So we have a source port

and destination port

and the length is

a minimal amount of checking

and to make sure that

if the packet that you received

as a different from the length

that specify in the UDP header,

then there may have

been something wrong

so you won't may want

to discard the message to check

for more messages.

So the checksum also make sure

that nothing in the middle

was tampered with although it's

if there's some sort

of man in the middle.

Attack or something like

that a checksum is
pretty easy to manufacture

after you've altered the packet

so you can see here

in the message

that there's a number

of UDP packets some of them

just UDP the one look

and happens to be
from some Skype application,

I guess so talking
to Skype servers
and we've already got
the DNS now DNS also

needs some Fast Response times

because you don't want

to send a lot of time looking

up information about service

that you're going to before

because just to go to them.

So DNS server through all

throughout their queries

on to the Using UDP hoping

to get fast sponsors.

They don't want to spend a lot

of time setting up connections

and during all the negotiating

that comes at the

protocol like TCP.

For example.

So here you see

that the DNS is using UDP and

what we've got here is another

UDP packet for Destination

and all sorts of stuff

so you can see it out here

so you can see the checksum.

It's unverified checksum status

so you can check out all sorts

of stuff using Wireshark.

So that was about UDP

or The user datagram protocol.

Okay.

So now that we're done

with the user datagram protocol.

Let's talk about

addressing mode.

So addressing modes is
how you address a packet
to your different destination.

So there are three kinds

of addressing mode.

The first kind of addressing

mode is unicast.

This is pretty simple

one to understand.

So there is one destination

and one source

and the source sends

the packet to the destination

and it's it depends

on the protocol

that you're using

to actually address.

So if it's something

like TCP IP your Using

a bi-directional stream.

So the blue computer can talk

to the red computer

and the red computer can talk

back to the blue computer,

but you can also use

a UDP stream which is

like One Direction stream.

So it's not sure

if I'm using the correct word.

So it's a stream that

in One Direction.

I guess I'm driving

home the point here.

So if it's UDP only

blue is talking

and when blue stops

talking then read can talk,

but if it's dcpip blue and red

him talk simultaneously

at the same time now moving

on there's also so

broadcast now broadcast means

that you are sending

your bracket to everybody

on the network.

So broadcast messages
are very common

from mobile network providers

so many get those

advertisements saying something

like you have

a new postpaid plan

from Vodafone or as hell

or something like that.

Those are broadcast messages.

So it's one server

that is sending out

one single message to all

the other systems now,

there's also multicast now.

The cast is like broadcast

but selective now

multicast is used

for actually casting yours

your screen to multiple people.

So something like screen share

and you're doing it with

multiple people is multicast

because you have the option

to not show particular computer

what you are actually sharing.

So those are three modes

of addressing unicast
broadcast and multicast.

Okay now moving

on let's look into the tool
that we just used once and UDP.

That is why sure.

So what exactly is wash off?

So this utility called

Wireshark is a packet capture.

Usually meaning that

it grabs data.

That's either going out

or coming in of a specific
Network and there are a number

of reasons why
this may be useful

or important on the reason

why it's really important is

what's going on in the network

is always accurate.

In other words.

You can't mess

around with things

once they're on the network

or you can't lie about something

that's actually on the network

as compared with applications

in their logs,

which can be
misleading or inaccurate.

Or if an attacker gets
into an application they

may be able to alter the logging

now several other behaviors

that make it difficult to see

what's really going on

and the network

you can really see

what's going on.

Once it hits the wire.

It's on the wire and you

can't change that fact now

once it hits the wire

so we're going to do here

is a quick packet capture.

So let me just open up

our shop for you guys.

So as you guys can see

I have already washed

Shock open for us.

Let me just remove

the CDP filter that was there.

So why shock is Cheering.

So let's go over the stuff

that you can see

on the screen some important

features of our sharks

so that we can use it later.

So what I'm doing here

is a quick packet capture

and I'm going to show some

of the important
features of Wireshark

so that we can use

it later on now

when we're starting to do

some more significant work.

I select the interface

that I'm using primarily,

which is my Wi-Fi,

and I'm going to be go over here

and we'll bring up a Google page

so that we can see

what's happening on the network.

So let me just quickly open

up a Google page

as you guys can see

It's capturing a bunch of data
that's going on here.

Let me just open

up a Google base

and that's going

to send up some data.

Let's go back.

So it's dropping a whole bunch

of stuff of the network.

I'm just going to stop

that going to go back

and go back and take a look

at some of the messages here.

So some of the features

of a shock as you can see

on the top part of the screen.

It doesn't window

that says number time Source

destination protocol length

and info and those are

all of the packets

that have been captured

in the numbering starting from 1

and the time I'm has to do

with being relative to the point

that we've started capturing

and you'll see the source

and destination addresses

and the protocol

the length of the packet

and bytes and some information

about the packet

the bottom of the screen.

You'll see detailed information

about the packet

that has been selected.

So suppose I'm sales selecting

this TCP packet out

here so we can go

through the frames frame also

has an interface ID
is encapsulation type

and all sorts of information.

Is there about the frame

then we can look

at the source Port

destination Port see Stumble

the flag said the check sums,

you can basically check

everything about a packet

because this is
a packet analyzer

and a packet sniffer.

Now, you'll see

some detail information

about the back of that.

I'll be selected.

So I'm going to select so

the selected this TCP IP packet.

We see that in the middle frame

and says frame 290.

It means that it has

a 298 lat packet and the packet

that was capture 66 bites and we

grabbed 66 Bisons 528 bit later.

So you what do you see

out here was source

and the destination In

Mac address of the layer

to layer address

and then you can see

the IP address

of both source and destination

and says it's

a TCP packet gives us
a source Port destination port

and we can start drilling down

into different bits

of the packet and you can see

when I select a particular

section of the packet down

at the very bottom you can see

what's actually a hex dump

of the packet and on the right

hand side is the a sky.

So this is the hex hex dump

and is the a sky that

you're looking at.

What's really cool

about varsha gate is

it really pulls the packet

into it's different layers

that we have.

Spoken about the different

layers of the OSI

and the TCP IP model

and the packets are put

into different layers

and there's a couple

of different models

that we can talk about with that

but were shocked

does really nicely.

Is it demonstrate
those layers for us

as we can see here.

It is actually four layers

and in this particular packet

here we can also do something.

So I've got
a Google web request.
So what I want to do here is
I want to filter based on HTTP,

so I find a filter.

So let's see
if we can do an http.

And what I see here

is says text input

and it's going to get an image.

That's a PNG image.

And this is a request

to get the icon

that's going to be displayed

in the address bar.

So you also see something

called our pouch here,

which I'll be talking

about very soon.

So let's just filtering

be done now in the web browser.

It's a favicon dot Ico

that can do here.

I can select analyze

and follow TCP streams.

You can see all

the requests related

to this particular request

and it breaks them

down very nicely.

You can see we've sent

some requests to Spotify

because I've been using

spotify you actually listen

to some music then you

can see all sorts of stuff.

Like this was something

to some not found place.

So let's just take

the Spotify one and you can see
that we get a bunch

of information from
the Spotify thing.

At least you can see

the destination The Source,

it's an Intel core machine.

So the first part

of the MAC address the first

few digits is lets you tell

if it's what what is vendor ID

so Intel has its own member ID.

So F 496 probably tells us

that it's that's an Intel Core.

So why shock does this

really neat little thing

that it also tells us

from the MAC address what type

of machine you're
sending your packets

to from the back address itself.

So it's coming
from Sophos foresee

and going to an Intel Core

in the type is ipv4.

So that was all about Bioshock.

You can use it extraneously

for packet sniffing

and pack analysis.

Packet analysis come very handy

when you're trying

to actually figure out

how to do some stuff

like IDs evasion

where you want to craft

your own packets

and you want to analyze packets

that are going into the IDS
system to see which packets

are actually getting detected

its as some intrusion

so you can craft your bucket

and a relative manner

so that it doesn't get actually

detected by the idea system.

So this is a very Nifty little

tool will be talking about

how you can craft your own

packets just a little while,

but for now, Now,

let's move ahead.

Okay.

So now that we're done with

our small little introduction

and a brief views

on history of our shop.

Now, let's move on

to our next topic for the video.

That is DHCP.

Okay.

So DHCP is a protocol

and it stands for dynamic

host configuration protocol.

So DHCP is a network
management protocol used

to dynamically assign
an Internet Protocol address

to any device on the network

so they can communicate

using IP now DHCP.

Means and centrally

manages these configurations

rather than requiring

some network administrator to

manually assigned IP addresses
to all the network devices.

So DHCP can be implemented

on small or small local networks

as well as large Enterprises.

Now DHCP will assign new

IP addresses in each location

when devices are moved

from place to place

which means Network

administrators do not have

to manually initially
configure each device

with a valid IP address.

So if device This is
a new IP address is moved

to a new location
of the network.

It doesn't need any sort

of reconfiguration.

So versions of DHCP
are available for use

in Internet Protocol version

4 and Internet Protocol

version 6 now

as you see on your screen

is a very simplistic diagram

on how DHCP works.

So let me just run

you down DHCP runs

at the application layer

of the TCP IP protocol

stack to dynamically assign

IP addresses to DHCP clients

and to allocate
TCP IP configuration information

to It's TB clients.
This includes subnet mask
information default gateways

IP addresses domain name

systems and addresses.

So DHCP is a client-server
protocol in which

servers managed full

of unique IP addresses

as well as information about

line configuration parameters

and assign addresses

out of those address pools now

DHCP enabled clients send

a request the DHCP server,

whenever they connect

to a network the clients

configure with DHCP broadcasts

a request the DHCP server

and the request Network.

In information for local network

to which they are attached

a client typically
broadcasts a query

for this information immediately

after booting up
the DHCP server response

to the client requests

by providing IP configuration
information previously specified

by a network administrator.

Now this includes

a specific IP address as well as

for the time period also

called Lee's for which

the allocation is valid

when refreshing an assignment

a DHCP client request

the same parameters

the DHCP server May assign

the new IP address based

on the You said by

the administrator now

a DHCP server manages a record

of all the IP addresses it

allocates to networks nodes.

If a node is we are located

in the network the server

identifies it using its media

Access Control address now

which prevents accidental

configuring multiple devices

with the same IP address now

the sap is not routable protocol

nor is it a secure one DHCP

is limited to a specific
local area network,

which means a
single DHCP server.

A pearl an is adequate now

larger networks may have a wide

area network containing multiple

individual locations depending

on the connections
between these points

and the number of clients

in each location.

Multiple.

DHCP servers can

be set up to handle

the distribution of addresses.

Now if Network administrators

want a DHCP server to provide

addressing to multiple subnets

on and given Network.

They must configure

DHCP relay Services located

on interconnecting routers

that DHCP request

to have to cross

these agents relay messages.

Between DHCP client

and servers dscp also lacks

any built-in mechanism

that would allow clients

and servers to authenticate

each other both are vulnerable

to deception and to attack

where row clients can exhaust

a DHCP servers pool.

Okay.

So let's move on
to our next topic

and that is why use DHCP.

So I just told you

that DHCP don't really have

any sort of authentication

so it can be
folded really easily.

So what are the advantages

of using DHCP

so The sap offers quite

a lot of advantages

firstly is IP address management

a primary advantage

of dscp is easier management

of IP addresses in a network

with the DHCP.

You must manually

assign IP address,

you must be careful

to assign unique IP addresses

to each client
and the configure
each client individually

the client moves

to a different network.

You must make model

modifications for that client.

Now when DHCP is enabled

the DHCP server manages

the assigning of IP addresses

without the administrators

intervention clients.

And move to other

subnets without panel

country configuration

because they obtained

from a DHCP server

new client information

appropriate for the new network

now apart from that you can say

that the hcp also

provides a centralized
Network client configuration.

It has support
for boot TP clients.

It supports of local clients

and remote clients.

It supports Network booting

and also it has a support

for a large Network

and not only for sure

like small-scale networks,

but for larger Works as well.

So that way you see DHCP has

a wide array of advantages even

though it doesn't really

have some authentication.

So because of these advantages

DHCP finds widespread use

in a lot of organizations.

Okay, so that winds

up DHCP for us.

So let us go into the history

of cryptography now.

So let me give you

a brief history

of cryptography now cryptography

actually goes back several

thousand years before shortly

after people began to find ways

to communicate there are some

of Who were finding ways

to make the understanding

of that communication difficult

so that other people

couldn't understand

what was going on.

And this led to the development

of Caesar Cipher

that was developed

by Julius Caesar

and it's a simple

rotation Cipher and by that,

I mean that you rotate a portion

of the key in order

to generate the algorithm.

So here's an example.

We've got two rows

of letters and

that are alphabetical in order

and means we basically wrecking

the alphabets down

and the second row

is shifted by three.

Letters so Abby is a z actually

because if you move that way B
is a z from the first row

gets shifted back the second row

and then the letter

D becomes letter C

the there's that's an example

of how encryption works.

So if you try to encrypt

a word like hello,

it would look completely

gibberish after it came

out of the algorithm.

So if you count the Letters

Out you can see that letter H

can be translated
to little a letter L.

So that's a Caesar Cipher.

Now you must Little things

like rot13 which means

that you rotate the 13 letters

instead of three letters.

That's what we
can do here again,

and this is just

a simple rotation Cipher

ourseives the cipher that's

what of course the rod stands

for its rotate or rotation.

Now coming forward

couple thousand years.

We have the Enigma Cipher now,

it's important to note

that the Enigma is not the word

given to this particular Cipher

by the people who developed it.

It's actually the word

given to it by the people
who were trying to crack
it the Enigma Cipher

is a German Cipher,

they develop this

Cipher and machine

that was capable of encrypting

and decrypting messages.

So they could messages

to and from different

battlefields and waterfronts,

which is similar
to the Caesar Cipher

sees a use it to communicate

with his Butterfield generals

and the same thing.

We're with the Germans.

You've got to get messages

from headquarter down

to where the people

are actually fighting

and you don't want

it to get intercepted

in between by the enemy.

So therefore you use encryption

and lots of energy

was spent by the allies

and in particular the British

trying to decrypt the messages.

One of the first instances

that we are aware of

where machine was used

to do the actual encryption

and we're going to come ahead

a few decades now into the 1970s

where it was felt

that there was a need for

a digital encryption standard.
Now the National
Institute of Standards

and technology is responsible

for that sort of thing.

So they put out a proposal for

this digital encryption standard

and an encryption algorithm.

What ended up happening

was IBM came up

with this encryption algorithm

that was based

on the Lucifer Cipher

that it was one of their people

had been working on on a couple

of years previously in 1974

and they put

this proposal together

based on the Lucifer Cipher

and in 1977 that proposal

for an encryption
algorithm was the one

that was chosen to be

the digital encryption standard.

And so that came

to be known as Des over time

and it became apparent

that there was a problem

with this and that was it

only had a 56 bit key size

and while in the 1970s

that was considered

adequate to defend

against brute forcing

and breaking of course.

By 1990s.

It was no longer considered

adequate and there was a need

for something more and it

took time to develop something

that would last long

for some long period of time

and so in the meantime

a stopgap has developed

and this stopgap is

what we call the triple Des.

The reason it's called

triple Des is

you apply the Des algorithm

three times in different ways

and you use three different keys

in order to do that.

So here's how triple Des Works

your first 56 bit key is used

to encrypt the plain text just

like you would do

with the standard

digital encryption standard

algorithm but changes

and you take that Cipher text

that's returned from

the first round of encryption

and you apply the decryption

algorithm to the cipher text.

However, the key

thing to note is

that you don't use the key

that you use to encrypt you.

Don't use the first

key to decrypt

because otherwise you'll get

the plain text back.

So what you do is
you use a second key

with the decryption algorithm

against the cipher text
from the first round.

So now you've got

some Cipher text

that has been encrypted

with one key and decrypt it

with Second key and we take

the cipher text from that

and we apply a turkey using

the encryption portion

of the algorithm to
that Cipher encryption portion

of the algorithm
to that ciphertext to receive

a whole new set of ciphertext

obviously to do the decryption.

You do the third key

and decrypt it with

the second key you encrypt it.

And then with the first

key you decrypt it.

And so you do reverse order

and the reverse algorithm at

each step to apply triple Des.

So we get an effective key size

of about one sixty eight bits,

but it's still only

X bits at a time.

Now I said triple Des

was only a stopgap.

What we were really looking

for was Advanced encryption

standard once again

and niste requested proposals

so that they could replace

the digital encryption standard

in 2001 after several thousands

of looking for algorithms
and looking them
over getting them evaluated

and getting them looked

into this selected an algorithm

and it was put together by

a couple of mathematicians.

The algorithm was called

rijndael and that became the

advanced encryption standard.

Or AES, it's one

of the most advantages

of AES is it supports
multiple key lens currently

what you'll typically see is

as we are using 128-bit keys.

However, AES supports

up to 256 bit key.

So if we get the point

where 128-bit isn't enough

we can move all the way up

to 256 bits of keying material.

So cryptography has
a really long history.

Currently.

We are in a state where we

have a reasonably stable

encryption standard and AES,

but the history

of cryptography shows

that with Every set

of encryption eventually
people find a way to crack it.

Okay.

So that was a brief

history of cryptography.

Now.
What I want to do
is let's go over

and talk about a yes

triple des and Des in themselves

because they are

some really key cryptography

key moments in history

because there's some really

key historic moments

in the history of cryptography.

Now, we're going to talk

about the different types

of cryptography key ciphers

and primarily we're going

to be talking about
this triple des and AES now.

This is the digital

encryption standard.

It was developed by
IBM in the 1970s.

And originally it
was cryptography Cipher

named Lucifer

and after some modifications

IBM proposed it as

digital encryption standard

and it was selected by

the digital encryption standard

ever since then

it's been known as dis.

Now one thing

that cost a little bit

of controversy was

during the process of selection

and it's a requested

some changes and it hasn't been
particularly clear but changes
were requested by the NSA.

There has been

some speculation that wondered

if the NSA was requesting

a back door into this

digital encryption standard

which would allow them to look

at encrypted messages
in the clear.

So basically it would
always give the NSA

the ability to decrypt

DS encrypted messages.

It remained the encryption

standard for the next couple

of decades or so.

So what is this and

how does it work?

Basically?

It uses 56-bit Keys rather

than the stream Cipher.

It's a block Cipher and it uses

a 64-bit blocks and a 1998 -

was effectively broken

when a desk

If the message was cracked

and three days a year

later a network

of ten thousand systems

around the world crack

the best encrypted message

in less than a day

and it's just gotten worse

since then with modern

computing power being what it is

since this was actually created

we already have come
to the realization

that we needed something else.

So Along Came triple Des

now triple DES isn't

three times the strength

of desk necessarily it applies.

There's just three times

and what I mean by that is is

what we do is we take a plain

text message then let's call

that P and we are going to use

a key called K 1 and we're going

to use that key to encrypt

a message and use a key

that will be will call K1

and we're going to use

that to encrypt the message

and that's going to result

in the ciphertext

and we will call the c 1 so c 1

the output of the first

round of encryption.

We're going to apply

a second key and we'll call

that K2 with that second key

and we're going to go

through a decryption process

on see one

since it's the wrong key.

We're not going to get

plain text out on the

And what we're going to get

is another round of ciphertext

and we will call this c 2

what we do with c 2.
We are going to apply a third
key and we will call this K 3

and we're going

to encrypt ciphertext c 2

and that's going to result

in another round the ciphertext

and we will call that c 3.

So we have 3 different Keys

applied in two different ways.

So with Chi 1 and Chi 3 we

do a round of encryption

and with key to we do

a round of decryption.

So it's an encrypted Crypt

and crypt process

with separate keys while

that doesn't really healed.

A full 168 bit key size

the three rounds of encryption

yields an effective key size of

a hundred and sixty eight bits

because you have

to find 356 bit keys.

So speaking of that technical

detail for triple Des.

We're still using the test block

Cipher with 56-bit keys.

But since we've got

three different Keys,

we get an effective length

of around 160 8.

Bits triple Des was really

just a stopgap measure.

We knew that if test

could be broken triple desk

surely we broke in
with just some more time again.

And so the nest was trying

to request a standard
that was in 1999.

And in 2001 this

published an algorithm

that was called a s

so this algorithm

that was originally

called rijndael was

published by nist as

advanced encryption standard

some technical specifications

about a s is

that the original drained

all album specified

variable block sizes

and key lengths

and as long as those lock sizes

and key lengths were

multiples of 32 bits.

So 32 64 96,

and so On you could use

those block sizes and key lens

when a s was published

a specified a fixed
128-bit block size

and key length

of 128 192 and 256 a yes

with three different key lengths

but one block size and

that's a little bit of detail

about desk triple des and AES.

So when a s was published

a specified fixed
128-bit block size

and a key length

of 128 192 and 256 bits.

So we've got with a S3

different key lens,
but one block size.

And that was a little bit

of detail about this triple des

and AES will use some of these

and doing some Hands-On work

and the subsequent part

of this video.

Okay.

So now that I've given

you a brief history

of how we have reached

to the encryption standards

that we're following today.

That is the advanced

encryption standard.

Let's go ahead

and talk a little bit more

about this triple des and AES.

So this is a digital
encryption standard.

It was developed by IBM

in the 1970s and originally it

it was a cryptographer
xi4 named Lucifer

and after some modifications

IBM proposed it as

the digital encryption standard.

It was selected to be
the digital encryption standard

and ever since then

it's been known as Tes

or deaths one thing

that caused a little bit

of controversy was

during the process of selection

the NSA requested some changes
and it hasn't been
particularly clear

what changes were

requested by the NSA.

There has been some sort

of speculation that wondered

if the NSA was requesting

a back door into this.

It'll encryption standard

which would allow them to look

at encrypted messages

in the clear.

So basically it would
always give the NSA

the ability to decrypt

this encrypted messages.

It Remains the encryption

standard for the next couple

of decades or so.

And what is this and

how does it work now

tests Remain the digital

standard for encryption

for the next couple of decades.

So what does it do
and how does it work?

So basically it uses

a 56 bit key rather

than a stream Cipher.

It's a block Cipher and it

uses 64-bit blocks and in 1998,

if you know there's

was effectively broken

when a des encrypted message

was cracked in three days

and then a year later

a network of 10,000 systems

around the world crack

the Des encrypted message

unless and a day

and it's just gotten worse

since then with modern Computing

being what it is today.

Now since this was created

and broken we knew

we needed something

and what came in between

Advanced encryption standards

and this is triple

Des now triple

Des is Three times the strength

of this necessarily it's really

there's applied three times

and what I mean by that is

we take a plain text message,

then let's call

that P and we are going

to use a key called K

1 and we're going to use

that key to encrypt the message

and that's going to result

in the ciphertext one.

So we'll call that C1

now c 1 is the output

of the first round of encryption

and we're going to apply

a second key called key

to and with that second piggy.

We are going to go through

a decryption process on C1 now

since it's the wrong key we are.

Not going to get the plain text

out of the decryption process

on the other end.

We are going to get
another round of ciphertext

and we're going to call

that c 2 now with c 2.

We are going to apply

a third key and we are going

to call that K 3 and we're going

to encrypt ciphertext c 2

and that's going to result

in ciphertext C 3

so we have 3 different Keys

applied in two different ways.

So what Chi 1 Chi 3 we do around

of encryption with key to we do

around a decryption.

So it's basically an unencrypted

decrypt encrypted process

with three separate keys,

but It does really is

it doesn't really healed

a 168 bit key size

because ineffectiveness it's

basically 256-bit keys

that are being used to race it

whether it be
three different keys.

So ineffectiveness,

you could say

that it's the 168 bit key,

but it is not the same strength

because people realize

that triple Des

can be easily broken

because if this is broken,

you can do the same thing

with three different ways

whether whatever key

that you use
so it just takes longer time.

To decrypt if you
don't know the tree

and if you are just using

a Brute Force attack,

you know that triple

Des can be broken

if this can be broken.

So triple Des was literally

a stop gap between Des and AES

because people knew

that we needed something

more than triple des and for

this the NISD

or the National
Institute of Standards

and technology in 2001.

They chose a s as the algorithm

that is now called

Advanced encryption algorithm.

So it was originally called

the rijndael algorithm.

And the main thing

about the rijndael algorithm

and advanced encryption

standard algorithm.

Is that the rijndael

algorithm specifically
States in its papers

that it has available block size

and available key size

as long as they are

in multiples of 32.

So 32 6496 like that.

But what AES does differently is

that it gives you one block size

that is 128 bits and gives

you three different key sizes

that is 128 192 and 256.

So with AES three

different key lens,

but one block size.

Okay, so that was a little bit

more information on a yes this

and triple des

and we are going

to be using this information

in some subsequent lessons

Okay now moving on.

Okay.

So now that we've discussed

the different history of

cryptography and more important

cryptography algorithms.

Let's discuss the different

types of cryptography.

Now, the first type of

cryptography I'm going to talk

about is symmetric cryptography

and by symmetric cryptography,

I mean Key is the same

for encrypting or decrypting.

So I use the same key

whether I am encrypting the data

or decrypting data.

Well things about symmetric

key cryptography is

that the use a shorter

key length then

for asymmetric cryptography,

which I'll get into

a couple of minutes.
It's also faster
than a symmetric

and you can use algorithms

like d EAS or a s

as those are both symmetric

key cryptography algorithms

and you can use a utility

like a a script.

Let me just demonstrate

how a symmetric key

cryptography works.

So for this we can use

a tool called a a script.

So in a a script is
actually available for Linux

and Windows and Mac

all the systems.

So I'm using it

on the Windows one and I'm using

the console version.

So first of all,

I have a text file

called text or txt.

So let me just show that to you.

So we as you guys can see

I have this thing called text

up txt now to do text or txt.

All I let me just show

what x dot txt contains.

So as you guys can see

it has a sentence.

The quick brown fox jumped

over the lazy dog.

So that's the sentence

that has all the alphabets

in the English language rather.

So now we are going

to try and encrypt it
so we can use
something like a SIDS

because both of them

are symmetric key ciphers

symmetric key algorithms rather.

So we are using AES

in this case.

So what we're going

to do is say s script

I'm going to encrypt it

and we're going to give

you the password

of let's say Pokemon.

We're going to call it

Pokémon and regarding

do Do text Dot txt.

We're gonna encrypt that file.

So now we have
encrypted that file.

Let's go see we must

be having a new file.

So this is called text

or txt that a yes.

So that is our encrypted file.

And this is what we would

generally send over the network

if we are sending it to anybody.

So let's assume
the person who's received.

It also knows
our encryption algorithm.

I mean encryption
algorithm and the key

that goes along with it.

So let's try to decrypt it

now now before I decrypted,
let me just show you What
an encrypted message looks

like so this is

what the ciphertext look

like a snow text Dot txt.

The AES.

So yeah,

as you guys can see

the windows control control

you she'd everything

but if I were to go here I

will just go into the file

and just ever notepad

plus plus you'll see

that it's a bunch of crap.

You really can't make out

anything what is being made?

Here we come.

Really decipher much.

So that's the point

of using encryption.

Now if you were to decrypted,

all you have to do is

a script we turned the crib.

We're trying to give

the password is going to be

what was the password

Pokémon I'll K

so and we're going to try

and create text txt.

The AES.

Let's dir that again.

Okay, so that just the crypts

are message for us.

So this is

how you would use a script

for encryption and decryption.

So that just
description and that's

how you would use symmetric key

encryption to encrypt a file

for this example symmetric key

uses the either a stream

Cipher or a block Cipher

and the differences

between stream or block ciphers.

Is that block takes a block

of bits at a time

and it's a fixed length.

For example 64 bits

if I were to use
a block Cipher with 64 bits,

I would need to take him 64 bits

before I could
start encrypting now

if I didn't have 64 bits

to encrypt I would have

to fill it with padding

in order to get
up to 64 bits a stream Cipher

on the Other hand

it will encrypt a bit at a time.

So it doesn't matter
how many bits you've got.

You don't need

to have some multiple

of the block length in order

to encrypt without padding.

And another type of cryptography

is a symmetric now asymmetric

as you would expect users

to different keys.

And that's where we have

public key and private key

a symmetric key cryptography

uses a longer Keelan

and also has more computation

and the encryption

process is slower

with a symmetric key encryption

and the encryption process

is slower than with

a symmetric key encryption

while the For symmetric key is

for signing documents

or emails for example,

but I would have

the private key sign something

and the public key would be used

to verify a signature

and another reason

for using a symmetric key

encryption is to ensure

that you got it from

who actually sent it

since you've got two keys.

You always knew who

the other end of the equation is

where it's symmetric

key senses just one key.

If you can intercept

the key you can decrypt

and also encrypt messages.

And so if somebody can figure

out the key you can break

into a communication
stream using symmetric.

Turkey and scription

so asymmetric gives you

the advantage of ensuring

that the other end is who
the other end says and they are

since they're the only ones

who should have the private key

and in this particular

instance in practice.

However, however hybrid

encryption models tend

to be used and that's

where you would use

a symmetric encryption to
encrypt asymmetric session keys.

So basically you
encrypt the message

that you are sending using

symmetric key encryption

and then you

when Changing the key

with somebody else you use

a symmetric key encryption.

So this is going to be
a slower process.

You probably won't want

to use it for a smaller files

in order to do that.

Fortunately the file example

that I have is a smaller one.

So I'm going to try

and generate a key right now.

So for this we have to head over

to our Ubuntu system.

So let's see.

Let me show you how public

key encryption actually works

and we are going

to first create a key.

So let me just clear

this out for you.

First of all.

Let's create a file and

let's call that text Dot txt.

Now.

If you see we are going to edit

text or txt to have some file.

So have some text in it.

So there seems to be
a warning with the GDK.

I'll just use Echo instead.

So now let's see

if that is in our file.

Okay.

So let me just show you

how a symmetric key encryption

or public key
cryptography works.

So first of all,
we need a text file.

So let me see do we
have a text file?

So there seems to be
a text Dot txt.

So let's see what

this text Dot txt says

so it says that this is

a random text file.

Now, what we want to do is

we want to create
a public key first,

so I'm going to use

openssl for doing this.

This so we go openssl

and we are going to use it

with our say so we're trying

to generate a key.
So generous e and we're going
to use this tree to use this

and we're going to Output it

into file called private key.

So we are also going

to be using a 4 0 9 6 bit.

So this is going
to be our private key.

So this will create a private

key using RSA algorithm.

So let it work its way out.

So first of all,

it's asking me
for the past three days now,

so since You can protect

your keys with the passphrase.

So I'm just going

to use my name.

Okay.

So now we see

if we LS and we have
a private key, I guess.

Yep.

So we have this private key.

Now.

We're using this private key.

We are going to generate

a public key.

So for this I'm again

going to be using open SSL

and open SSL is unix-based.

So you will need a Unix system.

So you go are say utl.

That's RC utility.

And what we want

to do is encrypt

and we want the public key

in and key and we want

to use the public key

that we just generated.

I'm sorry guys.

So we are going
to be using Odyssey.

So first of all,

we need to generate
a public key.

So for that we use

the private key.

So we will give the private

key as an argument

after the in flag.

So private key and we are trying

to get out a public key.

So pop out and we're going

to call public dot key.

Okay, so there seems to be Okay.

I messed it up a little I
forgot to give the output

so you go out and then

you use public key.

So it's asking me
for a passphrase

and now it's writing

the are sticky and

since the password was correct.

We have a public key to so

if you see now we have

a public key and a private key.

So we are going to encrypt

our file using the public key.

So we go openssl
and we go RS a utl.
And we go and crypt
and we can do pump in.

So we are going
to use the public key

and we want to put

the text at the XT

as the file to be encrypted.

So text Dot txt.

And what we want to Output

is an encrypted file.

So encrypted Dot txt.

Okay, I call it open SL L

need to go and edit that out.

Yeah, so that makes

it a correct command

and now we have

an encrypted file.

So let's see Alice and yep

encrypted dot txt.

So if you just cut that out,

so we see it's
a bunch of garbage

and we really can't read it

unless we decrypt it so
or decrypting the key.

All we have to do
is again use openssl.

Let's clear this out

first so openssl.

And we are going to be using

the RC utility again.

So RSA utl.

We're going to
decrypt this time.

So we go with the decrypt flag

and then we are going

to be giving the inky
and that is going
to be the private key

and what we want to decrypt

is encrypted the txt.

And what we want output it is

as let's say plain text txt.

So it's going to ask me

for my past rays,

which is mine.

Name and I've entered

the passphrase and now

we have a plain text Dot txt.

Now.

If we are to go and LS we see

that we have a plain

text txt out here just

with light info dot txt.

Let me just cut that out.

So plain text D XD.

So this is a random text file.

And if you go up we see

that it was a bunch

of garbage and before that.

It was a random text file.

Now, you can also run

this command called

if plain text Dot Txt text txt.

So this give you a difference

in the text rings.

So it's zero so it gives you

that's the difference.

So both files are the same

and that's how public

key cryptography works

and how symmetric

key cryptography works.

Okay.

Now moving ahead

of cryptography.

Let's talk about certificates.

Okay.

So now that we're done

with cryptography.

Let's talk about

digital certificates.

So what is
a digital certificate?

Well, a digital certificate

is an electronic password

that allows a person

or can ization to exchange

data securely over the internet

using public key infrastructure.

So digital certificate

is also known as
a public key certificate

or an identity certificate now

digital certificates are a means

by which consumers

and businesses can utilize

the Security application

of public key
infrastructure public

key infrastructure comprises

of the technology to enable

and secure e-commerce and

internet based communication.

So what kind of security does

a certificate provide so firstly

it provides identification

and Authentication Asian

the person or entities
with whom we are communicating
I really who they say they are

so that is
proved by certificates.

So then we have confidentiality

of information within a message

or transaction is
kept confidential.

It may only be read

and understood by
the intended sender.

Then there's Integrity

there's non-repudiation

the center cannot deny

sending the message

or transaction the receiver

really get to non-repudiation

and I'll explain

how non-repudiation comes

into digital certificates.

So digital certificates
are actually issued

by By authorities
who are business

who make it their business to

actually certify certify people

and their organization

with digital certificates.

Now, you can see these

on Google Chrome now,

let me just open

Chrome for you guys

and you can see it out here.

You can see certificates

and you can go into the issue

of statements and you can go

and all sorts of stuff

so you can see it's issued

by encrypt Authority X3.

So that's an issuing authority

for digital certificates.

Now that was all about

the theory of certificates.

Let's go and see

how you can create one.

Go to create
a digital certificate.

We are going to be using

the openssl tool again.

So first of all,

let me show you

how to create a certificate.

So we are going to be using

the openssl tool for that.

So first of all,
let me clear the screen out.

So in this case, I'm going

to generate a certificate

Authority certificate.

So I'm doing an artistic

key here to use

inside the certificate.

So first of all,

I need to generate
a private key.

So to do that as I had just

showed you guys we can use

the openssl tool ego openssl

and Jen are say and we're going

to use test three then

Ouches and let's call it c

a DOT key and we're

going to use 4 0

9 6 this so I'm doing

an RSA key here to use
inside the certificate
some generating private key and

the private key is used as

a part of the certificate

and there's a public key

associated with the certificate.

So you've got public and private

key and data gets encrypted

with the public key

and then gets decrypted

with the private key.

So they are mathematically

linked that the public

and private key

because you need one for the end

of the communication the

and the other for the the other

end of the communication

and they have to be linked

so that the data

that gets encrypted

with one key catch

to be decrypted with other key.

So this is asking
for a passphrase

and so I'm going to be giving

my name as a passphrase so that

has generated the key for us.

So now I'm going to generate

the certificate itself.

So I'm going to be using

the openssl utility.

So first of all,
you say openssl nice a request,

so it will be a new request

and it's going to be

An x.509 request it's going

to be valid for 365 days.

And let's see the key
is going to be see a DOT key

and we're going

to Output it into CA

or let's call it at Eureka dot

c r t so this is certificate
that I'm producing in the name

of the company that

I'm working for.

So that is at Eureka.

So it says it's unable

to load the private key.

Let me just see

as the private key existing.

I had a previous.

Private key.

So let me just remove

that doesn't have

a see a DOT key seems

like I put the name differently.

So let me just try

that again openssl

and we do request

so we are requesting

new certificate and

it's going to be x509

and it's going to be there

for 365 days and key is He

apparently that's
where it's cold out here.

So and it's going to be out

into Eddie record CRT.

That's another so
let's enter the past three.

So it's my name.

So now it's going to ask

me a bunch of information

that's going to be
inside the certificate.

So let's say it's asking

the country name

against let's put in the state.

Okay.

So iin State Province

named some states.

So Bangalore look ality.

Let's say white Field

organization name is Eddie.

Rekha unit name brain

Force common name.

Let's leave that

out email address.

Let's leave that out too,

and we have a certificate.

So if you go and list

all your files,

you'll see that there is

a certificate called any record

or CRT out here,

which is highlighted.

Okay.

So now if you want

to view this file,

you could always use the openssl

you can always use the openssl.

Utility, so you say you want to

read an extra five nine request

and you wanted to text

and what you want

to see is at Eureka CRT.

Okay, so that
is the certificate.

So you see
that it has all the signature
it has signature algorithm.

It has all the information

about the certificate

and it says signature issuer is

cin and state Bangalore

and location right field.

I wreck up reinforce velocity.

It has all sorts of information.

Nation so that was all

about digital certificates how

who issues digital certificates?

Where are they useful?

So this is
basically non-repudiation.

So nobody can say

with this certificate that

if this certificate is included

in some sort of website

and that website tends

to be samples malicious

and there's a complaint

now the website can go

to a court of law and say

they didn't know about this

because the certificate

that was included had

their private key and

private key was only supposed

to be known to the company

so that Non-repudiation
you just don't deny

that you didn't do it.

Okay, so that was all

about certificate not moving on.

Okay.
So moving on we're
going to be talking

about cryptography caching.

And while the word

cryptography is in

the term cryptography caching

and it does lead to believe

that there is encryption Vault.

There is no encryption involved

in a cryptographic hash.

There is a significant
difference between hashing

and any sort of encryption

and that is primarily

that encryption is
a two-way process

when I encrypt a piece of data

or a file or anything else.

So what I'm doing

is putting it into a state

where I expect it to be able

to get it back out again,

in other words

when I interrupt a file

expect it to be able

to decrypt the file and get

the original contents hashing

is a one-way function
on the other hand.

Once I've hashed piece of data

or file there is no expectation

and ability to get

the original piece

of data back hashing

generates a fixed length value

and different types

of hashing will generate

different length values.
For example, md5 will generate
a different length value

than sha-1 And they're

both hashing algorithms,

but they generate

different length values

and the resulting value

from a hash function

should be no relation at all

to the original piece of data.

As a matter of fact,

if two inputs generate

the same hash value

it's called the collision and

if you can generate collisions,

you may be able to get a point

where you can generate

a piece of data

that are going to generate

the same hash values

and that leads you to

the potential ability to break

the particular hashing algorithm

that you're using.

So what we can use hash is

for well one thing we can use

hashes for file in text.

T we can run a hash

on a file and get

a value back and later.

We can check

that the value make sure

if it's the same

if it's the same I can be sure

that the same file was hashed

in both instances.
So let me just show you
an example of what I just said

that if we Hash
a file we will get

the same hash every time so

remember the certificate

that we just created.

Let me just log in again.

So we are going

to Hash this certificate and it

will create a certain hash

and we are going to see

that every time

we hash it we are.

Being the same hash

so we can use this command

called md5sum and we can do

Eddie record or CRT.

So this is the harsh produced

after you've hatched

at your record or CRT.

So if I do an md5 again,

so md5 is a hashing algorithm

that you should move so

at your record or CRT

and it will produce

very similar has let's see

a sha-1 works like this.

So sha-1 and you record or CRT?

Okay, Xiao Chuan

is sha the shuffle

in the shower you tools back?

Courage.

Okay, so I proved
my point that but md5
if it is cryptography
hashing algorithm.

We are getting
the same hash back.

So if you are able

to produce the same hash

that means you have broken

the algorithm in itself.

So if you run md5 on the knocks,

you can get a version

of md5 and md5 summation program

on Windows and Mac OS

where with the utility

md5 is does the same thing.

So I just showed you

the file and I hashed it

and another reason we use

hashing is we are storing

passwords so password.

Stored after hashing,

we hashed passwords.

And the reason

for hashing password is

so you're not storing

the password in clear text

which would be easily seen in

if you got it protected

with low emissions

if I hashed password
every time I hash the password,

I'm going to get the same value

back from the same algorithm.

So what I do is store
the hash and some sort

of password database
since it's a one-way function.

You can't get the password

back directly from the hash.
Now what you can do
with most password

cracking programs do
some variation of this

and you just generate hashes

against list of words.

If you look at a hash value

that matches the one

in the password

once you get the hash

that matches the one

in the password, you know,

what password is there

and here and we come back

to the idea of collisions

if I can take
two different strings

of characters and get

the same values back

and it's easier

to crack the password

because I mean not necessarily

get the password with the hash

that I get back from particular

string of data is the same

as that I get from

the original password,

then it doesn't matter

whether I know the password

because the string of data

that I put in is going

to generate the same hash value

that you're going to compare

when Login and this hash value

will just give you

that as valid and you

will be able to login.

So suppose the password

that you chose

while making your account is dog

and the dog word

produces this hash value

and if I were to like hash cat

with the same algorithm

and if the other

than was prone to collisions,

it might produce
the same hash value as dog.

So with the password cat I

could open up your password.

I mean I could open

up your account.

So that was all

about hashing and hashing.

Rhythms, let's move on.

Okay.

So in this part of the video,

we are going to go
over SSL and TLS

or SSL and TLS are ways

of doing encryption

and they were developed

in order to do encryption

between websites web servers

and clients or browsers.

SSL was originally developed by

a company called Netscape and

if you don't remember

Netscape eventually spun

off their source code

and became Mozilla project

where we get Firefox

from so back in 1995 Netscape

released version 2 of SSL,

and there was a version one,

but nothing was Done with it.

So we got the version 2 of SSL

and that was used for encryption

of web transmission
between the server

and the browser

to do a whole number

of flaws between the server

and the browser now

SSL version 2 had a whole number

of flaws and SSL to has

the type of flowers

that can lead to decryption

of messages without actually

having the correct keys

and not being

the right endpoints

and so Netscape released

SSL version 3 in 1996.

And so we get SSL

3.0 which is better

than 2.0 but it still hurts.

Some issues and so

in 1999 we ended up

with TLS now SSL is secure

socket layer and TLS is

transport layer security.

They both accomplished

the same sort of thing

and they're designed

for primarily doing encryption

between web server

and web browsers

because we want to be able

to encrypt the type of traffic.

So let me show you what kind

of traffic looks like.

So first of all,
let me open bar shop
and out here.

I already have a TLS scan

ready for you guys

that you can see we have

all sorts of TLS data

so you can see

that here's my source

and it's 32 and destination

is sound 6 1 2.

4050 9.46 doing

a client key exchange

and the chain Cipher suspect

and Krypton handshake message

and then we start

getting application data.

So there are some other

steps involved here

and you're not seeing all of it

with this particular

Wireshark capture

because again, you know,

we get fragmented packets

and at some point it

starts getting encrypted

and you can see it anyways

because wash out

without having the key

can decrypt those messages

but one ends up happening

is the client sends a hello

and the silver is

Ponce with a Hello

and they end up exchanging

information as part

of that now including

version numbers supported

and you get random number

and the clients going to send

out a number of surface suits

that may want support and order

and it can support the server

and it's going to pick

from those sweet of ciphers.

Now, then we start doing

the key exchange and then

do the change Cipher spect

and from the client and server

and eventually the server

just sends a finished message

and at the point

we've got this encrypted

communication going on,

but there's this handshake

that Zone between the two

systems and there's a number

of different types
of handshakes depending

on the type of end points

that you've got.

But that's the type

of communication that goes on

between servers and the client

one important thing

about using SSL and TLS is

as I mentioned some
of the earlier versions had

vulnerabilities in them
and you want to make sure

that the server's

aren't actually running those.

So you want to run some scans

to figure out the type
of calls and ciphers
that different systems you

so for this we can use

something called SSL scan.

So this is available for Unix.

Not really sure.

If there is something

that is similar
for Windows or Mac,

but on Unix based system that is

Linux we can use SSL scan.

So let me just show

you how to use

that clear as far out.

So what we can do is run

SSL scan again suppose

www dot Ed u-- record dotco.

So we're doing Isis can hear

against the website

and you can see it's going out

and probing all

the different types of ciphers

after you know on this system

start with SSL V3

and are going to TLS

version 1 and we could force

as a substantive try

to do an SSL V2.

If I scroll back up here

I get the surface I

Firs which is SSL version

3 it's using RSA

and it's using RSA

for the asymmetric.

Now in order to do
the key exchange and

once we get the session key

up we're going to do use AES

256 and then we're going

to use the secure hash algorithm

to do the message authentication

or the Mac.

It's something calls the hmac

for the hashed message

authentication code and

what it does is simply

hashes the MAC address

that you would check one side

against the other to make sure

that the message

hasn't been fitted

with in transmission.

You can see here all

the different types

of Cipher suits that are

available peers TLS running rc4

at 40 bits using md5.

So that would be
a pretty vulnerable type

of communication to use
and between the server

and the client 40-bit

Cipher using rc4 is

a low strength Cipher and we

would definitely Recommend

that clients remove those

from the support of ciphers

that they have on their server.

All that configuration

would be done

at the web server as well as

when you generated your key

and your certificates normally

certificates would be handled

by a certificate Authority.

Now, you can also

self-signed certificates

and have those installed

in your web server

in order to Communications
with your clients

that the challenge with that is

browsers today warned when they

see a certificate against

the certificate Authority

that is entrusted of it and it

doesn't have any certificate.

Aditi tall so
you'll get a warning

in your browser indicating.

There may be a problem

with your certificate

if your clients
are Savvy enough and

if the users are Savvy

enough you may be able

to make use of these self

fine self-signed certificates

and save yourself some money,

but generally it's

not recommended simply

because clients are starting

to get these bad certificates

and when they run across one

that's really a problem

a real Rogue certificate.

They're going to ignore

the certificate message

in the browser
and just go to the sites

that could have malicious

purposes in mind and may end up
compromising the clients
or customers or users.

That's SSL and TLS

and how they work and negotiate

between servers and end points.

Okay.

So now that we've talked

about TLS and SSL.

Let's talk about

disk encryption.

Now this encryption

is actually something

that was not really difficult to

do but sort of out of the reach

of normal desktop computers

for a really long time.

Although there have long been

ways to encryption of files

and to a lesser degree

maybe entire disks

as we get faster processor

certainly encrypting

the entire disks

and being able to encrypt

and decrypt on the fly

without affecting.

Performance is something

that certainly comes

with Within Reach

and it's a feature

that shows up in most modern

operating systems to one degree

or another now these days

we are going to look

at a couple of ways here

of doing disk encryption.

I want to tell you

about one of them first
and it's not the one I

can show I can't really show

the other one either.

So with Microsoft

their Windows system have

this program called BitLocker

and BitLocker requires

either Windows Ultimate

or Windows and price.

I don't happen to have

either version so I
can't really show it.

You but I can tell you

that BitLocker has ability

to entire disk encryption

and they use a s

for the encryption Cipher

and the thing about BitLocker is

that they use a feature

that comes with most modern

systems particularly laptops.

Lll strip in them

that's called The Trusted

platform module or TPM.

The TPM chip is part

what it does is
it stores the keys

that allows operating system

to be able to access the disk

through this encryption

and decryption process and they

use a pretty strong encryption

Cipher which is a yes,

but you have to have

one of the cup Well
of different versions
of Windows in order

to be able to use BitLocker

and it's one of those things

you would normally run

in an Enterprise.

And so that's why they included

in on its Enterprise version.

Now on the Mac OS side

they have this thing called

file Vault and you see

in the system preferences

on the security and privacy.

If you go to filevault you

can turn on filevault now I

if you have the little button

that they're says

Stone on file wall,

then you can turn

on the file wall

and it would ask you

about setting up keys

and it works similar

to Those BitLocker now

pgp happens to have the ability

to do disk encryption

and you can see

that in the case of this

you burned the system.

They've got a package called

gde Crypt which is a GUI

that allows you to map and mount

a created encrypted volume

so I could run G decrypt and put

help me set up the process

of encrypting the volumes

have got on my system.

Now this conscription

is a really good idea

because when you are working

with clients the data is

normally very sensitive.

So as I mentioned

And you can always use things

like BitLocker and windows fault

or other search software's

for disk encryption.

So what I mentioned before

is now not only possible.

It's very much a reality

with current operating systems.

Now, let's talk

about scanning now

scanning is refers to the use

of computer networks
to gather information

regarding computer systems

and networks canning

is mainly used to security

assessment system maintenance

and also for performing

attacks by hackers.

The purpose of network

scanning is as follows,

it allows you
to Nice available UDP

and TCP Network Services running

on a targeted host.

It allows you to recognize

filtering systems

between the users

and the targeted host.

It allows you to determine

the operating systems

and used by assessing

the IP responses.
Then it also allows you

to evaluate the target

host TCP sequence numbers

and predictability to determine

the sequence prediction attacks

and the TCP spoofing now

Network scanning consists

of Network Port scanning as

well as vulnerability scanning

Network Port scanning refers

to the method of sending

data packets via the network.

Through computer system

specified Service Port

this is to identify
the available Network Services

on that particular system.

This procedure is effective for

troubleshooting systems issues

or for tightening the system

security vulnerability scanning

is a method used to discover

known vulnerabilities

of computing systems
available on network.

It helps to detect
a specific weak spot

in an application software
or the operating system,

which could be used

to crash the system

or compromise it
for undesired purposes.

Now Network Port scanning as

well as vulnerability scanning

is an information.

Rings technique,
but when carried out
by Anonymous individuals

are viewed as a pollutant

attack Network scanning process

is like Port scans

and pink stripes

and return details

about which IP address map

to active life hose

and the type

of service they provide

another Network scanning method

known as inverse mapping gathers

details about IP addresses

that do not map to Live host

which helps an attacker to focus

on feasible addresses
Network scanning is one

of the three important methods

used by an attacker

to gather information
during the footprint stage

and the attacker makes a File

of the target organization

this includes data

such as organization's
domain name systems

and email servers in additions

to its IP address range

and during the scanning stays

the attacker discovers details

about the specified IP addresses

that could be accessed online

their system architecture

their operating systems

and services running

on every computer now
during the enumeration stays

at a collects data including

routing tables Network user

and group names simple

Network management protocol data

and so on.

So now let's talk About

intrusion detection evasion.

So before we get
into IDs Salvation,

let's talk about

what exactly is an IDs now

an intrusion detection system

or IDs is a system

that honor does Network traffic

for suspicious activity

and issues alerts

when such activities discovered

while anomaly detection and

Reporting is primary function

some intrusion detection systems

are capable of taking actions

when malicious activity

or anomalous traffic is detected

including blocking traffic sent

from suspicious IP addresses,

although intrusion detection

systems monitor Network

for Ali malicious activity they

are also prone to false alarms

or false positives

consequently organizations need

to fine-tune their IDs product

when they first install them

that means properly configuring

their intrusion detection

system to recognize
what normal traffic
on the network looks

like compared to potentially

malicious activity

and intrusion prevention

system also monitors

Network packets for potentially

damaging Network traffic,

but we're an intrusion

detection system responds

to potentially malicious traffic

by logging the traffic

and issuing warning

notification intrusion
prevention systems response

to such By rejecting the

potentially malicious packets.

So there are different types

of intrusion detection system.

So intrusion detection system

come in different flavors

and detect suspicious activities

using different methods.

So kind of intrusion detection

is a network intrusion
detection systems

that is nids is it deployed

at a strategic point

or points within the network

where it can monitor

inbound and outbound traffic

to and from all the devices

on the network.

Then there is host

intrusion detection system

that is at IDs

which runs on all computers

or devices in the network.
With direct access
to both the internet

and the Enterprise internal

Network SIDS have an advantage

over any ideas in

that they have may be able to

detect anomalous Network packets

that originated from

inside the organization's

or malicious traffic

that nids has failed

to detect hid s may also be able

to identify malicious traffic

that originates from

the host itself as

when the host has been

infected with malware

and is attempting spread

to other systems signature

based intrusion detection system

monitors all packaged

traversing the network

and compare them

against database of
signatures or attributes.

I've known malicious threats

much like antivirus softwares.

So now let's talk

about into IDs evasion.

Okay.

So now let's talk

about IDs evasion.

Now IDs is
an intrusion detection system

as we just spoke about

and instead it detect exactly

the types of activities that

we are engaged in sometimes
and sometimes you may be in
called in to work on a Target

where activities are known

and should be known

by The Operators

or the operations people

involved in monitoring

and managing the network

and the idea being not only

do they want to assess

the technical controls

that are in place,

but they also want

to assess the operational

procedures and ensure

that the systems and processes

are working the way

that they are supposed

to be working.

Now when you are engaged

with the Target

that you are in full cooperation

with you don't need to do

these types of vision tactics.

All these techniques

may be actually avoided

but if you are asked

to perform an assessment

or a penetration on a Target

where they are not supposed

to see your activities,

then you need to know

some different techniques

to evade detection from an IDs.

So we're going to talk about

a couple of different things.

That you can do.

So one thing that you can do
is manipulate packaged to look

a particular way.

Now for this there is

a tool called packets.

So packet is a really good way

to actually manipulate traffic

and by actually manipulating

the contents of a packet

like you can specify

the destination and source.

So it's a really useful tool

to set up a package
look a particular way.

One thing it can do is allow

you to spoof IP addresses

so I could set
the source IP address here.

That was something completely

different from mine now

from Using TCP or UDP?

I'm not going to see

the response back.

And in this case TCP.

I'm not even going to get

the three weeks connection me

because responses are going

to go back to the source IP.

But what you can do

is an additional two spoofing

you can set a particular ways

that a packet may look

like changing the type

of service or by changing

the fragmentation of set or by

different flags settings

at me allow you through an IDs

without maybe getting flagged

and it may also allow

you to a firewall now

it's a slim possibility

but it's a possibility.

Now.

Another thing you

can do is use packets

to generate a A lot
of really bogus data

and what you might do is hide

in the noise generated by packet

so you can could create

some really bogus packets

that are sure to set

of ideas alarms

and then you can run

some legitimate scans underneath

and hopefully be able to get

some responses different

from mine now

from using TCP or UDP.

I'm not going to see

the response back.

And in this case DCP,

I'm not even going to get

the three weeks connection me

because responses are going

to go back to the source IP.

But what you can do

is an additional two spoofing

you can set up a particular ways

that a packet may look

like changing the type

of service or by changing

the augmentation offset or by

different flag settings

at me allow you through an IDs

without maybe getting flagged

and it may also allow

you to a firewall now

it's a slim possibility

but it's a possibility.

Now.

Another thing you can do is

use packet to generate a lot

of really bogus data

and what you might do is hide

in the noise generated by packet

so you can could create

some really bogus packets

that are sure to set

of ideas alarms

and then you can run

some legitimate scans underneath

and hopefully be able

to get some responses.

Kali Linux is the industry's

leading Linux distribution

and penetration testing

and ethical hacking

it offers tons

and tons of hacking

and penetration tools

and different kind

of software's by default.

It is widely recognized
in all parts of the world even

among window users

who may not even know

what Linux has well

to be precise Kali Linux

was developed by offensive

security as the rewrite

of backtrack backtrack just

like Kali Linux was a lie.
Linux distribution

that focused on security it

was used for digital forensics

and penetration testing purpose.

But the question here is why

should you choose Kali Linux

when you have other choices like

parrot security operating system

back box black art

and many more out there.

Let me list are few reasons as

to why Kali Linux is

the best choice first

and foremost it offers more than

600 penetration testing tools

from different kind

of security fields

and four and six secondly.

Kali Linux is customizable.

So if you're not comfortable

with current Kali Linux tools

or features or
graphical user interface,

you can customize

Kali Linux the way you want.

It is built
on a secure platform.

The Kali Linux team

is actually made up

of small group of individuals.

Those are the only ones

who can commit packages

and interact with repositories.

All of which is done using

multiple secure protocols.

So color Linux is definitely

a secure platform,
although penetration
tools tend to be

In an English colony includes

multilingual support this way

more users can operate

in the native language

and locate the tools

that they need for the job

that they are doing

on Kali Linux

and lastly Kali Linux just

like back truck is

completely free of charge on top

of all this benefits

Kali Linux offers different

installation options one way

of installing Kali Linux is

by making a collie
bootable USB drive.

This is the fastest way

of installing Kali Linux

and the most favorable as Well,

we will discuss why in a while.

You can also install

Kali Linux using

hard-disk installing Kali Linux

on your computer using the hard

disk is a very easy process,

but you should make sure

that your computer has

compatible Hardware.

You can also install Kali Linux

alongside your operating system.

It could be Windows or Mac,

but you should exercise caution

during setup process
because it might mess up

with your default

bios settings lastly.

You can use different kind

of virtualization software.

Just VMware or watch

a box to install Kali Linux on

your preferred operating system.

Well apart from all this you

can also set up Cal Linux

on Advanced risc machines

or a RM like Raspberry Pi
trim slice cube truck

and many more.

So there you go guys.

Now if you know what

color Linux is and why it

is a leading Linux distro

for ethical hacking

and penetration testing

in today's session.

We will explore different ways

to install Kali Linux.

Let's get started

then all Your I said

that the fastest method

for setting up Kali Linux is

to run it live from a USB drive.

But why first of all,

it's non-destructive,

it makes no changes
to the host systems hard drive

or the operating system

that it is installed on.

So once you remove USB your

operating system will return

to its original state.

Secondly.

It's portable.

You can carry color index

in your pocket

and can run it whenever you

want just in few minutes.

It's customizable.

You can create your own.

Kali Linux ISO image and put it

into USB drive using

a simple procedure

which we will discuss

later and lastly.

It's potentially persistent.

You can configure

your Kali Linux live USB drive

to have persistent storage

so that the data you

can collect is saved

and you can use it

across different reboots.

Now.

Let's see how to create

a bootable USB drive

on Windows guys.

Actually the process

is very simple.

It's just a three step process.

First of all,
you need to plug your USB.

USB drive into an available

USB port on your Windows PC

next you need to note down

the destination drive.

It uses one set mounts.

For example, it could be

F drive after that.

You will have to download

and launch a software

called win32 disk imager

on the software.

You'll have to choose

color Linux ISO file

that needs to be
matched and verify

that the USB drive

to be overwritten is
the correct one lastly.

Once the Imaging is complete.

You need to safely

eject the USB drive

from Windows machine.

So, like I said,

it's very simple, right?

Well, I'm not going to show

you a demo on this one

because like I said,

it's very easy, and I'm sure

you guys can pull it off.

If you have any doubts.

You can post them

in the comment session.

We'll get back to you.

And as for the demo part will

be doing for installations here.

First of all,

we'll see how to install

Kali Linux using VMware

on Windows operating system.

Then we'll see

how to install Kali Linux on Mac

using virtualbox moving on.
We'll see how to install

Kali Linux tools on

different Linux distributions.

I'll A showing
how to install it on Ubuntu.

Well, the procedure is same for

every other Linux distribution.

So you can go ahead and use

the same procedure

for the Linux distribution

that you're using

and lastly we will see

how to install Kali Linux

on Windows 10 using
Windows subsystem for Linux.

So, I hope it's clear

that what we'll be learning

in the session.

Let's get started with

the first demo in this demo.

We'll see how to launch

Kali Linux using VMware.

So guys you can install

Kali Linux using

any virtualization software.

It could be VMware
or virtualbox in this demo.

I'll show you

how to install it using VMware.

So first of all,

obviously we'll have

to install VMware light.

So just type of VMware

and it's the first link

that you find you can go

ahead and download

VMware Workstation Pro

you have it in the downloads.

Here you can download

workstation player as well

or you can download

VMware Workstation Pro now.

Once that is downloaded.

You will have to download

a curl Linux ISO image

so that you will have to go

for official Kali Linux website

just type for Kali Linux

and it's the first link you

can see downloads option

here click on download

and yeah,

you can see different

download options here you

have color Linux light

for 64-bit as well as 32 bit.

And then there is

Kali Linux 64-bit and 32-bit

and you have Great images

for VMware and Wachtel boxes.

Well suppose you want to skip

the entire lengthy procedure

of installing it and you

want to just use the image,

then you can go ahead and use

this color Linux

64-bit for VMware

or virtual box same goes

for the 32-bit as well.

But since we are focusing

on installing right now,

let's just go ahead

and download ISO file

and install it from

the beginning until last step.
I have already downloaded it.

So I have an ISO file

downloaded on my computer.

So all you have to do is

just click on the torrent link.

It will be downloaded.

Let's open VMware then so

as you can see,

I have the embed workstation

Pro installed here.

So I already have two about to

Virtual Machine installed

on my VMware Workstation.

As you can see on the home page

three different options.

It says create
a new virtual machine

or open a virtual machine

and connect to remote server.

So if you want to
create a color index

or any other washing machine

from step one,

you can use this create

a new virtual machine option.

Well, if you have an image of

and watch the machine already,

and if you want to just

use it and avoid

installation procedure.

Then you can go

ahead and use this open

a virtual machine option

while just click on this

create a new virtual machine

and click on next

as you can see here.
You have an option which says
installer disc image file.

ISO file.

You'll have to attach

your so click on browse.

Let's see where I've stored

my color Linux as you can see.

I already have it here

and there's one file here.

Let me click on that and open

so I don't bother
about this at all.

It usually shows that

and then click on next year.

So it's asking

which operating system

will Be installed

on this virtual machine.

I wanted to be Line-X.

So make sure you select

Linux 64-bit and click

on next you have an option

to name your virtual machine.

Let's say Kali Linux.

And where do I want to store it

in my documents under watching

machines color next sure

and click on next.

It says it already exists.

Let me try this one.

Then let's take our Linux one

and next Yeah,

so basically Your Kali Linux

will need about a 20 GB.

Let's assign some 40 GB are

that's the maximum this size
that you can a lot

while you can a lot more

than that as well.

But minimum it needs about 20 GB

and you have an option

with Stay Store virtual disk as

a single file or multiple files.

Let's just select store

virtual disk as a single file

toward complications
and click on next here.

So as you can see,

you can review your virtual

machine settings here.

You have an option to make

changes to the settings.

You can make changes right now,

or you can do it later.

It as well.

Let's just go ahead

and make changes now.

Click on the customize

Hardware option here.

Well as for the memory

for this virtual machine,

it totally depends

on what you're using

virtual machine for

if you're not using

it for heavy works.

Then you can assign

least amount of memory.

Let's say I want

to assign about 2GB.

There we go.

And as for the processors number

of processors 1 and the number

of core processors,
you can choose as
many as you want.

Let's say to this

will increase the performance

of your virtual machine,

so and again,

Totally depends on whatever

you want to choose and yeah,

we have already attached

the image network adapter you

can set for not USB controller

and sound card.

You can retain

the default settings.

And as for the display click

on accelerated 3D Graphics sense

what color Linux has

a graphical user interface

and it says 768mb is

the recommended amount of memory

that you can use for graphics.

So let's go ahead and select

that and click on close.

Well, you can actually

make all the settings

after installing color index.

As well no problem there.

Once you've done

that click on finish here,

as you can see,

my color Linux image is ready.

For installation.

You have two options to power up

as you can see you have

this option here.

You can click on that to power

on this virtual machine,
or you can go ahead
and click on this.

Let me click on this.

So once you click on that,

you should be greeted

with this Kali boot screen

as you can see,

there are a lot of options here.

We did discuss live

option earlier, right?

So if you don't want

any trace of Kali Linux

on your operating system,

you can go ahead and use

live option here.

You have live

USB persistence mode and live

USB encrypted persistence

as well suppose.

You want to store some data

and save it for later

the boots you can use

live persistent option here

and most of the time

people get confused

with this installing

graphical install.

Just don't go ahead

and click on it.

Style option do it only

if you are well versed

with command line interface.

So basically that install option

is for command line interface.

So you will be greeted with Kali

Linux command line interface

since if you're doing it

if you're using Kali Linux
for the first time go ahead

with graphical installed select

the graphical install

and click enter.

So as you can see,

it will start
mounting storage devices

whole installation process

might take about 10 minutes.

So it's prompting you

to select a language so select

your preferred language,

then you control location.

Let's say English

and click on enter

and it's asking you

for the country location

just give United States

and enter and I want

the keyboard to be configured

with American English.

You can choose

any native language.

Like I said earlier it supports

multilingual or it
supports Get the languages.

So go ahead and choose it,

but it might complicate the way

you use Khalil mix later.

So you can always go ahead

and stick out with English only.

Well, it doesn't matter.

So as you can see

it's configuring the network.

So it will detect the ISO file

and load installation component

and then prompt you to enter

the hostname for your system

while in this installation.

Let's just enter Kali

and click on and off.

You can give the name you want

and next it's asking you

for the domain name suppose.

You have set

up virtual machines.

Jeans, and if you want to give

all of them a domain name,

you can assign

a domain name as well,

but it's optional.

Let's not give any domain name

here and click on enter.

The next thing it does is it

will prompt you for the password

that you'll have to enter every

time you launch your Kali Linux.

So just give some password

of your choice.

And click on continue.

The best thing about callanetics

is you can set up date

and time as well.

You can make it

later as well,

but you can choose it here.

So just click on Eastern

of whichever choice you like

and click on enter.

So the installer will now prob

your disk and offer you

four different choices,
as you can see,

it says guided use entire disk

guided use entire disk

and setup lvm,

which is logical volume

manager same thing,

which is encrypted and manual.

So if you are an expert,

if you already use

this color index

before you can go ahead

and select any of this three

options from the bottom.

That's he'll be a more manual

or encrypted lvm.

Otherwise, you can always

go ahead and choose guided

use entire disk option here

if you are a beginner

and click on enter so This

is the disk partition.

Where'd all the data will be

stored and click on continue.

It's asking if you want

to stores all files

in one partition,

or if you want
to make partitions.

So depending on your needs,

you can go ahead and choose

to keep all your files

in single partition,

which is default or you

have separate partition

for one or more

of the top-level directories.
Let's just choose
the first option

and click on enter.

So once you've done

that you'll have

one last chance to review

our disk configuration.

Once you're sure

that you've given correct

details click on enter here.

It's asking if the changes

that you make to Kali Linux

should be written
to the disk or not.

So say yes.

So we did start partition

and install the washing machine.

It took a while but

as you can see installation

is almost done.

It's asking me to configure

the package manager.

Well, if you select

no in the session,

you will not be able

to install packages

from Cali repositories later

and click on continue.

So suppose if you want

to install other repositories

or updates later on you

can always go and click on yes.

Otherwise, it's always otherwise

you can go for know as well.

Now it's going to configure

the package manager

will install package manager

and configure it then it
will install GRUB boot loader.

And it's asking

if you want to install GRUB boot

loader to master boot record.

Definitely.

Yes so select.

Yes and click on continue.

So it's asking to select

the device manually.

You can click

the select the device.

So yeah, guys we're done here.

So you can finally click

on continue option to reboot

your new color installation.

So as you can see

the entire process took

about 10 to 11 minutes.

So yeah, let's go ahead

and click on continue here.

It's gonna finish

the installation.

So guys as you can see

the installation process

from the step where we

select the language

till the last step is same.

It's just the medium on which

you are installing is different

for example, right now.

We use VMware later on.

I'll show you

how to use virtualbox.

But once you color Linux image

is ready to boot the rest
of the installation process
is similar to this.

So it's finished installing.

It's loading the image.

So if you have done

everything right during

the installation process

and according to
your needs your land up

in this page use a name.

So we've given
at this Scully right kli

and password as you can see

it showing an error.

It says the didn't work.

Please try again.

This is mostly
because if first time

when you log in you

should use word root as

your default username.

But later on

once you have already logged

in you can change the username

according to your need so root

and password you can use

the same password

which you set

during installation.

In process so as you
can see login is successful

and here I go my Kali

Linux is up and running

so I can start using cullinan X

according to my needs.

So once you've done

that you can go ahead
and install VMware tools

so that you can maximize it

full screen and all that stuff.

You can also go ahead

and change the date

and time settings.

As you can see here can go

for the settings option here

and do the settings

and you can start using

Color Linux for hacking and

penetration testing purposes.

So it's as easy as that guys.

So please Please go
ahead and try installing it.

Well, if you find any errors

during installation process,

let us know
in the comment session.

We'll get back to you

as soon as possible.

Now.

Let's move on
to our second demo.

Now.

We'll see how to launch Cullen X

on Mac operating system using

virtualbox in the previous demo.

We use VMware and now

we'll be using virtualbox.

But actually I'm not using

any Mac system here

operating system,

but I'll show you

how to install using virtualbox.

The procedure is very similar.

So all you have to do is
on your Mac operating system.

Go ahead and click a

for Should box download.

So this is the
virtualbox official page.

You can go ahead and click

on downloads here.

As you can see you have

different options here.

It says windows

for Windows operating system

OS X host line X and solar host

since if you're using

Windows then go ahead

and select Windows host.

But as for Mark,

you'll have to select this.

It's mostly a DOT exe file.

Once you've done

that you can install virtualbox.

It's just click

on next next next

and it will walk out

and provide settings

according to your need.

I already have
installed virtualbox.

It's the next thing

you do is similar as

what you've done with VMware.

Go ahead and download

official Kali Linux image.

Make sure you don't download

any duplicate versions

of ISO file from other websites.

Make sure you download it

from original website.

If you want to do it
from the beginning

go ahead and install

ISO file your torrent

or you can just go ahead

and download just the image

for Wii virtual box here

for 64 bit and you have option

for 32-bit as well.

I've already done that.

So let me open my Virtual box.

Yeah artists the procedure

for VMware and watch

the box is almost seen

just slight difference.

Let me maximize
the screen for you guys

as you can see I already have

and watching machine

launched up here.

I haven't powered it up yet.

Anyway, I'll show you

how to install new one.

Just click on new' option here.

This is your
virtualbox homepage guys.

So click on New Year

and just give a name.

We've already given

color Linux all you're right

for the virtual machine.

So let's give it
some of the name.

Let's say capital K L line.

Unix and choose the type

of operating system
that's line X and here 64-bit -

64-bit according to
your operating system needs you

can go ahead and choose it 32

but as well click

on next and again,

like I said earlier

depending on what you're doing

on color Linux operating system

or virtual machine you go ahead

and design the memory

since I'm just showing you

how to install I'm not assigning

much memory you have.

So let's just retain

the default ones it to 4mb.

That's 1 GB and click on next

and it's asking you have

a three options here.

Of not to add virtual artists

create virtual orders now

and you can go ahead and add

a virtual hard disk,

you use an external

virtual hard disk.

Go ahead and select

the second option click

on create and use

virtualbox image.

Like I said earlier

we downloaded ISO image,

right and it's an ISO file

with extension dot

is oh, so basically it's nothing

but image so click on next

and I want to the storage

on physical hard disk

to be assigned dynamically

and click on next.

So this is the name

of the virtual machine

which we just gave all your

it's asking you to choose

the path wherever you want

to store your virtual machine.

Let's say documents

and watching machines click

on open and save

so that's the part of setup.

And as for the memory call

you always needs you

to assign at least 20 GB.

So let's go ahead

and give 20 GB you

can always assign more than that

and click on create.

So this is the one we

just created right?

It's ready.

Just click on settings

before you power up.

You'll have to make

certain settings.

So if you want to change name

or type and version

you can always go ahead

and do that here.

We don't have anything

in advance is just the folder

where your virtual machine

with this Toad go for systems.

We won't be using
any floppy disk are so right.
So on ticket or uncheck it and

yeah, this is memory

if you want to go ahead

and change or assign more memory

because the performance

of your virtual machine

is not that great.

It you can go ahead and do

that for the process

of make sure you enable

this extended features.

So basically if you want

to increase the performance

of your virtual
machine the number

of processors you assign

should increase Well for now

since I'm to show you

how to install and just going

to assign one you have option

to increase to say to like that.

And as for the display,

you can enable 3D acceleration

display storage settings.

This is the most

important one right now.

We don't have any image attached

to your so click on this empty

and click on the CD image

that you see here

and choose watch.

And attach the image or die.

So Fire torrent file,

which you just downloaded

click on open and audio

no settings default
Network by default.
You can always set it for Nat

since we're using only one

watching machine ha but

if you want to use a cuddle in X

with any other motion machine

like Metasploit able to you can

go ahead and use this host-only

adapter option here

because when you use Nat

and when you have

two virtual machines,

both of them will be assigned

with same IP address,

which will definitely a problem.

L'm because both

of these virtual machines

need to interact right?

So, yeah.

Well, I'm just saying all

this video information

so you can go ahead

and click on host-only adapter

if you using 2 virtual machines

and you want them

to interact as for now,

I'm just retaining

it Nat and rest

you can you don't have to make

any changes and click on OK

once you've made all

the settings click

on this or you can go ahead

and click on start option.

Are you can light click

on it and start Again,

like I said,

the installation process from

Step One is very similar to that

whether using VMware.

So again, you'll be greeted

with Kali boot screen and you

have multiple options again.

I'm not repeating

the entire thing here.

So go ahead and click

on graphical install.

And if you're a pro

and using command line,

you can always go

for install option.

And if you want to just use it

for one time purpose,

you can always go

for live option here.

That's all guys.

I'm sure you can catch

it from here, right?

Because it's almost similar

to the ones we did using VMware

if you have Here are just go

back and take a look at it.

Yeah, well, like I said,

I showed you on how to use

virtualbox to install Kali Linux

on Windows operating system.

Well, let's aim

for the Mac as well.

You just have to download your

stuff there instead of Windows.

You have another option

with this operating system.

You can dual boot

your color Linux

with Windows or Mac.

It's not as easy as
these installation process

because it will involve

you setting the BIOS to changes

that you get to see

when you power up

your computer initially.

Make sure you refer to color

Linux official documentation

and make sure you've done

the installation properly

so that you won't mess

up your default settings.

So guys we are done

with two ways

of installing Kali Linux one

on Windows and one on Mac.

We saw how to install it using

VMware as well as virtual box

in the third part will see

how to install Kali tools

on any Linux distribution.

It could be Ubuntu Fedora

peppermint operating system

or any other version

or distribution of Linux.

The procedure is

actually similar in
every Linux distribution.

So if you follow up
on one Linux distribution,

you can go ahead and do it

on the Linux distribution

of your choice or the one

that you use One thing

you should remember is

that Kali Linux is not for

the Dai Li line X purposes.
Well, it's only
for ethical hacking

or web application penetration

testing for these purposes.

So guys will be using

a tool called Catalan.

Let me spell it for you guys.

It's Ka T WL iron.

So let's just search for that.

There we go.

It's a script that helps you

to install Kali Linux tools

on your Linux distribution

of your choice.

So it's usually
the GitHub script.

So click on the first link

that you find.

So for those of you

who like to use penetration

testing tools provided by

Kali Linux development team.

You can effectively do

that on your preferred Linux

distribution using this tool

which is Catalan
or Ka t oo a lion.

So as you can see once you've

installed Catalan properly

on your operating system,

you should be greeted

with this page.

I'll show you how to do that.

What about it?

So the purpose of asking you

to see this page is to take

a look at prerequisite hours.

So first thing you need

to have a python of version

2.7 or above installed

in your operating system

and you need a line

exists efficient system.

It could be Ubuntu
or it could be Fedora

or peppermint any other

planets distribution.

I have a bun to here.

I'll be using
VMware Workstation Pro.

It's already open but let

me just go back.

All you have to do is

search for one, too.

And click on the first link.

So as you can see there are

a lot of options yet

for to install a bin

to just click on this

and you'll be able

to download a file ISO image.

I've already done that.

I'm not doing it again.

Let's go back
to VMware Workstation

as you can see.

I already have my Ubuntu

operating system installed

installing a window is
it's very straightforward.

So just take a look

at the instructions

that you need to know when

you're installing Ubuntu once
you've done the installation,

which should look

something like this.

So let me power up.

I've been to operating system.

So as you can see,

once you install your land up

on this page and it's asking

for the password you

set up this username

and password during

the installation process.

So don't worry about it.

Click on enter.

So let's say you are

a Unix lover you

like using your next platform.

But right now you want to use

certain tools for performing

application penetration,

testing and ethical hacking.

You just don't need

all the tools.

You need few Tools

in that case instead of

installing color index

on your operating system

installing only certain

color Linux tools will be

The best option right for that.

Like I said earlier

will be using cut Olin.

I have a set
of four five commands

that you need to use

to install Catalan Festival.
You need to have get
on your operating system.

Let me check
if I have it or not.

Anyway, I have these five

or four set of commands

which will be using

I'm going to attach them

in the description below.

So if you want you can use them

as you can see install

get First Command.

It says unable to use it

because have to login

as a root user.

So let me just it's asking

for the password.

Yeah now I'm a root user.

So let me try the command again.

That's apt-get install Kit.

Yeah installing get it's just

going to take few minutes.

But while this is happening,

let's go ahead
and explore cartoon

to let me go for Firefox here.

Let's search for Carter:

so it's the first link guys

like I said earlier,

so let me scroll down

as we saw the should be

the home page

and we did take a look

at the requirements.

So let's just go back and see

if it's done.
It's still happening.

So one thing is make

sure you have a python

or version 2.7 or above.

Otherwise the entire thing

won't work at all.

Yeah guys it's done.

Now.

We are done with the first step.

We need to install a we need

to clone the cartel in right?

So what you do?

Like I said,

I have a command right

here just copy this

and place it over

there control C.

Let's go back to terminal and it

makes your skin for you guys.

Yeah.

And based so basically

I'm cloning it here

and the next command is

I'm copying the python file

to this directory and click on

until it's done.

It's just quick process now,

we'll have to change permissions

so that we have access

to use Catalan for that.

Basically.

We are giving
execute permission.

So chmod plus X. Make sure

you take a look at that +
x + enter we are audio
is now our cut line

is installed say a lion,

so as you can see It's

already the first thing

that you should do is

before you upgrade

your system essays.

Please remove all the color

like repositories to avoid

any kind of problems.

So as you can see it shows

you like five options here.

First one is
Azad Kali repositories

and update next view categories.

Like I said,

Kali Linux is 600

plus tools, right?

So you have different

tools categorized

under different headings.

Then you have

classic menu indicator.

It's nothing here

as you can see.

I have a small icon here.

If you click on that,

it'll just show

you different menus.

That's all and if you

want to install color menu

for easy access you

can do that as well.

So let me just click one

under one that says add

color Linux repositories update

remove and view all kundan's.

So let's try removing them.

Let's drive with

adding repositories.

It is there are certain

duplicate signatures removed

and all that.

So let's just try to remove

like they suggested earlier

have been deleted now one.

So if you guys want to go ahead

and update the repositories

already existing ones,

you can go ahead and do that.

I'm not doing it now

because it's going

to take a while.

So if you want to go
back just click back.

It's as easy as that.

Now, let's say I want

to view categories

and install one to love it

as you can see.

There are like number

of fusion number

of categories here.

So I have web application

penetration tools your

have password attacks.

I have exploitation tools.

Well, if you are interested,

there's an introduction video

of what is Kali Linux

by director in the south.

Security playlist.

So go ahead and take

a look at that.

We have explained

like about five to six popular

tools in Kali Linux.

Anyway getting back

to today's session.

Let me just say for

as you can see it lists all

the web application tools.

So if I want to install
all those there's an option

that's zero, but let's

just say I want an install

a tool called SQL map.

I'm sure you might

have heard SQL map.

If not, it's okay.

It's a tool which you

use for checking out

vulnerabilities at a present
an application database system.

So anyway, it asks
inside the number of the tool

that you want to install.

Let's say 27.

So as you can
see it's installing.

So it's as if you said guys so

once you just done installing,

I'll get back to you.

Any tool I just

showed you how to use

how to install SQL map

which is there
in web application tools.
You can go ahead and do

that for other different types

of tools as well suppose.

You want to install

all the tools.

You can go forward 0 as

in click on zero option.

So there you go guys.

I just showed you

how to install one tool

so you can go ahead and do

that for any kind of stool

under any category.

So if you just want

to go back click pack

and go for other types of tools,

let's say eight there you can

see so whatever different time

of exploration tools you

want you can go ahead

and install them.

Let me just click back

and the back sometimes when you

try to install all the tools,

you might get an error saying

that's the file doesn't exist

or depository doesn't exist.

All you have to do is go

for one First Option here.

As you can see here

you have option two

which is update.

So update your repositories.

Make sure the Kali Linux mirror

which is present for

the updation as the right one.
Once I've done
that you won't get any errors.

All the tools will

be installed properly.

So suppose you want to get

back from these cattle

and easy just press control C.

And yeah as you can see

it says goodbye.

So that's as easy as it is to
use colonics tools on any kind

of Linux distribution

while I've showed you on a bun

to the procedure is same

on any other Linux

distribution guys.

So there we go guys.

I've done with

three things first.

We did on Windows
using VMware then

on Mac using virtualbox

and third I showed you

how to install Kali

Linux tools on any kind

of Linux distribution.

And finally, there's

one last demo here.

We'll see how to

install Kali Linux

or Windows operating system

using Windows subsystem

for Linux feature.

So, let me get back

to my operating system.

We won't be needing
VMware Workstation anymore.
So guys will be using
a feature called

windows subsystem for Linux,

which is By default present

in all the current versions

of Windows 10.

This is actually for those

who prefer using Color Linux

command line interface.

So make sure to listen

to me properly.

Oh use this option only

if you are a pro in using

command line interface

or if you have any experience

using command line interface.

Otherwise just go ahead and use

VMware watch the box

and install Kali Linux graphical

user interface option.

So yeah, this windows subsystem

for line X allows you to run

Linux distributions as subsystem

on your Windows
operating system this

Her is really a new feature.

It exists only in Windows 10.

So you need to use

latest version of Windows

10 to perform this demo

or use this option.

And in addition to that.

We also have
other prerequisites,

especially we need
to have git installed

or you can go ahead

and zip the file

which is Windows subsystem

for Linux files normally

but having it is
also a nice day.

Secondly, you need

to have python

of version 3 or above make sure

you've installed Python and set

up the path to check

if your python is installed

properly or not just sake.

Go via command prompt

and just type a python version.

It should show

you wasn't properly only

then you can be sure

that your python

is properly installed.

As you can see for made showing

three point six point seven,

which is definitely above three,

and it's properly installed

in the path is set.

The first thing you

need to do is enable WSL

or Windows subsystem for Linux.

Just go for the control panel

and there click on programs

and turn Windows features

on or off make sure

not to touch any other features.

It might mess up
your operating system.

So scroll down.

It's usually at the bottom.

Bye.
For let's never nibbled a few

using it for the first time you

need to enable it.

So first thing you

do is enable it

as you can see here.

It says windows
subsystem for Linux.

Make sure you enable it check

mark it and click on OK.

Once you have done

that run your command prompt

or terminal as an administrator.

All you have to do is

right-click on it and click

on run as administrator.

And yes now will be

enabling based distribution.

That is like I said windows

subsystem for Linux allows

you to run a line X

distribution as subsystem.

Right, but for that

we need to enable

this base distribution for that.

You need to install

the base distribution

or any kind of Linux

distribution that you need.

So just use LX run and install.

So once you type

that this is the output

which you get it says,

it's the Legacy Windows system

for Linux distribution.

So you can go ahead and install

other Linux distribution
which are available
in Microsoft store.

But unfortunately Kali Linux

is not available,

but it doesn't matter right.

We're anyway installing

it using the procedure.

Just click on why

here saying yes,

I've already installed.

So it's showing
Legacy Windows system

for Linux distribution

is already installed

on my system for you.

It might take a while

after installing.

The most important

thing is it lasts

for you to set up a password

and username don't skip

that step wait for a while

and make sure you set

up the password and use

an improperly only then

entire thing will work out

once you've done

that we are done here.

You can close

the command prompt.

The next thing you need

to do is install git

I already have it installed.

It's very easy install

dot exe file and click

on installation process.

It's very straightforward

and open git bash.

Yeah before that.

Let me go ahead and create

a folder called text here.

And as you can see it stored

on my desktop right now,

it's empty.

Anyway, let me go back

to get here and CD desktop

TST all your Venable

windows subsystem for Linux.

But now we have to download

the script right for that.

Search for Windows subsystem

for Linux Witcher.

And the first link is

the GitHub link click on that.

There you go guys.

It says windows subsystem

for Linux distributions,

which are it is the purpose

is to let you easily download

and install Linux distribution

as subsystem on your
Windows operating system.

So as you can see you have

different options here

for the base operating systems.

So yeah copy this link

here control see see

and go back to git git clone

and paste the link which you

just download it paste it.

It shouldn't take very long.

It's done guys.

So now if your check

your test folder
Windows subsystem for Linux
will be downloaded properly.

Let's just go back and check

that here is our test folder

as you can see windows subsystem

for Linux is already there

now open your command prompt.

CD let's go for the text file.

And if you search

for the directories under

that you can see WSL here.

Now, let's go for that as well.

You can just press stop

directories under that

so as you can see the two things

the most important things is

this get pre-built dot p y

and install py

this KET pre-build py will fetch

Kali Linux Docker files

and installed our py

will install Kali Linux for you.

I already have it installed.

But I'll just show you

how to do it.

So go back to the browser

and type talk a file.

Click on the second link.

I just wanted few

to copy the command easily

so that you won't make mistakes.

This is the one

which you'll have

to copy to fetch

the color index dog of files.

So you can just copy this part
and go for command prompt.

Let me maximize this for

you here you can say so

if you remember I said

python is masked.

So make sure you install

it properly and set

up the path White.

And get pre-built.

Let me just people dot

pi and copy it.

As you can see it's installing.

It's going to take

probably like 2 minutes.

So it says it's done

at says it's safe to this file

in the text folder.

Let's go back and check

if that's happened.

Here's a test folder

under WSL you have python

as you can see you

have python folder.

Is it folder
of Kali Linux installed

or fetched you'll have

to install it now,

right?

So let me now just type python.

This is the command

that you want to use

that's installed on pie

and stalled out pie

and copy this or just type

and enter tab lutefisk stabbed

and click enter.

So as you can see
it took a while

but it did install right now.

All you have to do is

it's installed so you

can close the CMD and open

your command prompt and run it

as an administrator click.

Yes.

Let me maximize the screen

you'll have to set

the root password are

the default user as brute so

set default the command

that you need to use

hit default user as root.

As you can see it's now set

to root and click Bash.

Done guys, right now.

We are running

on Callie operating system

on command line interface

if want to make sure

if you're actually running

on Curry just type

Cat ATC and issue.

It shows that
Kali Linux rolling.

So as you can see we

have successfully installed Kali

Linux command line interface

or how to use command line

interface on Windows using

Windows subsystem for Linux

and I'm telling it to you again

just use it if you know

how to use command line
interface very properly.

Otherwise Might be

a little overwhelming
subpoenas the fault.

It's the command that you need

to use hit default user as

root as you can see.

It's now set to root

and click Bash.

Done guys, right now.

We are running

on Callie operating system

on command line interface

if want to make sure

if you're actually running

on Curry just type Cat ATC

and issue its shows

that Kali Linux rolling.

So as you can see we

have successfully installed Kali

Linux command line interface

or how to use command line

interface on Windows using

Windows subsystem for Linux

and I'm telling it to you again

just use it if you know

how to use command line

interface very properly.

Otherwise It might be a little

overwhelming for beginners.

So now it's time

that we go through
the command line basics

of any Linux terminal.

Now, the Linux terminal

is a very powerful tool.
It allows you to move around
the whole operating system

through the files and folders.

It allows you to create files.

She's their permissions change

how they behave

and a bunch of other things you

can do filtering you can grab

stuff the specific stuff

from a specific file

and there's a bunch

of interesting thing

that you can do

and as an ethical hacker

you will be working

with Knox distribution

most of the time

whether it may be Kali Linux

or some other thing

like Peridot s

but you will be working

on enough most of the time

because it's a powerful tool

for networking analysis

and scanning and

all sorts of stuff

that you want to do

as an ethical hacker.

So the First Essential step

is to actually know

how to use the tool

that is available to you

and that is out here,

which is the terminal now

as I'm running this

on a virtual machine,
you might find it

that my execution times

a much slower and that is

because I I have
a very very slow laptop

because my virtual machine

is actually eating up a lot

of my Ram and I have a bunch

of other processes

that are also rendering

I do this on my free time.

So let's go ahead and go

through the commands

that we are going

to actually go through now.

Let me actually make

a list of commands

that I want to teach you guys.

So let me see

if leafpad is available
firstly leafpad is

basically a text editor.

So the first come on

that we're going

to start off with is CD.

CD stands for change directory

now at this moment.

We are in the root directory

as you guys can see we can print

the current working directory

with the single PWD and that is

a current working directory

as you see it's called route

and suppose we want to change

directory to the home directory.

So all you have to do

is CD which stands
for change directory

as I just said
and specify the part.

No CD / home.

Okay.

So once we're in home,

I want to make
a list of commands

that are used on the CLI

that I want to teach you guys.

Guys, so what would I do

I would firstly see

if any files are available

that I can edit.

Okay, so these files

are available, but let's create

a new file for ourselves.

So firstly let's do
Nano list dot txt.

Now.

What Nano does is

now we'll open up

a small command line text editor

now come online text editors

are very much used

by ethical hackers

because they save

a bunch of time

if there's always switching

between GUI and command-line

because you'll be doing a bunch

of stuff on the command line

and Will you want to write

something you're always

switching to gooey?

It's a waste of time

and you want to see

if I'm as an ethical hacker.

So you can use this thing

called a command line editor

and it can basically do most of

the stuff a GUI editor would do.

Now you say Nano

and the name of this file.

So now basically
has created this file now

and it has opened up

this new fresh window,

which overrides the command line

that we were in The Bash

and this is a place

where you can actually edit

what goes in the file

now, let's see.

See the list of commands

that I'm going to teach you.

I'm going to teach you LS LS

will be the list of files.

We did CD.

We saw a PWD.

So that was a print working

directory will be looking at

how you can copy stuff

at the CP command.

Then we will be looking at MV

which is basically move then

we will be looking at cap.

And that's an interesting one

and also less which is

another interesting thing

and we'll be looking at grep

which is actually
used for graphing
or grabbing things from files

that You might want

to see you'll see

what I mean and a short

while we will see echo which

probably does what you think.

If you have any experience

with the Linux,

then we'll be doing touch

and we'll be doing make

their which is make directory

and then we'll do

in ch own chmod

then all the most

dangerous commands has RM

and then you can do man.

Let's help.

Okay.

So these are
the list of commands

that we are going to go through

in this As part of the video so

suppose I was making this video

and I want to
save the somewhere.

So you see down here.

There are a bunch of options

that are sure to you.

Now this cat it sign

might be not really thinking

that the shift 6

1 it's not shift 6:00.

It's actually a controlled

so cat it is controlled

and then G of course means G.

So if you go Control G,
it will actually get help.

Now.

What we want to do
is save the file

and that is control.

Oh and that is right out.

So what we want
to Who is a control?

Oh, and now it's going to say

if we want to name
the file list at the XD

and we want to name

the file and it says

that we have written

down 15 lines.

So that's how you save a file.

Now.

All you want to do

is exit out of you.

Okay.

So first let's go LS and let's

go through whatever there is.

So LS showed us the list

of files that are there

in that directory.

Now Alice can also

show you the list

of files in a directory.

Curry with the paths

that you specify

likewise ALS VAR.

It'll show me everything

that is involved.

Okay, there are a lot

of interesting things like bar.

So let's head over twice CD /

bar and you hit enter

and now we are

in the folder bar.

So now to actually demonstrate

how powerful analysis we have

a few Flags now to see the flags

of any command you

can just do - -

help universally throughout

the Unix one line so out here

you see some information

that is Stuff to read

but if you go on top

and scroll out here,

you'll see all the flags

that you can use

with the command.

That is LS and
how you can use them

so you can see

what you use and you can read

a little bit about it.

So if you use all it ignores

entries starting with DOT,

so suppose we were to do LS

in why let's see so

it shows us like this now

if you do LSL,

it'll show a long list

with more information.

So these are the permissions

Options that you see out here

we will be seeing

how we can change

the permissions of a file

soon enough and this is
who owns the file the user

and the user group

is the file number.

I guess.

I'm not sure which is

when the created the name

of the file is the time

when the file was

created, I guess.

Okay.

So that's how you get

very detailed information

about all the files now.

That's another thing you

might want to use with ALS

and that is the 8X

so you can go LS

a and it will show you all.

Of the hidden files also.

So now you see some two files

that were not shown out here.

Our file is begins from backup.

But when we do LS, / I mean -

La we see two more files

at this Dot and Dot so let's see

if we can move into that CD dot

so we can't even move into that.

So that's interesting.

So these are hidden files.

So these are not seen

two random users

and we can actually

do stuff with them.

We will see how we

can use hidden.

Hours later on.

So if you want to show
hidden files through LSU,

all you have to do is LS and -

La so that was all about LS.

So let's move back to /home

where our list of commands

that I want to show you

always so silly home.

Let's Alas and see

what was it called,

its called list and suppose.

I want to see the condensed

of list or txt.

All I have to do
is say list dot txt.

Now.

It shows us whatever
this file is containing.

It will read it out for you.

Done CD we've done LS

and its various forms

we've done PWD now it's time

to do CP CP is basically used

for copying files from one place

to another so suppose.

I want to copy this address file

that is there into

some other directory.

Let's save our so all I would

have to do is CP name Dot txt.

And then you specify

which location you want

to actually copy it
to so CD / VAR.

So this is where I want to copy

my file to and you hit enter

and it's Copied but

that was a very small file now.

We can actually check

if it was copied

before I move on and pour

some more knowledge into you.

So let's go into VAR.

So CD / VAR hit enter

and you're involved again

and you CLS and now

you see a name dot txt.

So let's remove
name dot exe from here

because I want to copy

it again and show y'all

a difference between a flag

that I'm going to use right now.

So the -

and letters that you

use are called flag.

Technically in the
Linux terminal RG.

So let's go back to home now

instead of the name of the file

and moving back home.

Just like I did you can type

out the complete name

of the file out here.

So you could have gone

CD slash home slash name

Dot txt and copy to slash bar.

But this time

what we're going to do is

we're going to use a hyphen V,

which is basically used

for a verbose output

of whatever you're doing.

So most of the commands

that we're going
to using will have a -

V with them.

So, let's see how this

actually affects the output.

So what we're going to do

is we want to copy so sleepy

and verbose and we want

to copy the file name Dot txt.

And we want to copy it

to the folder called VAR, right?

So now you'll see

that it will give us

what is being moved rather

that is named Dot txt.

And where it is being moved

to so this is a very good way

of knowing what is
actually happening because

if you do it without the verbose

And suppose name not the XD was

just 20 GB file
and you just don't know

if it has finished or not.

So if it's a 20 GB file

that is continuously update you

on where what is being copied.

So basically all you

have to do is type -

V if you want to know

where your files being copied

and the exact part.

Okay, so that was about

how you can copy files

from here and there now,

what was the next command

that we want to see so cat.
So, let me just go and see
the next command

that is there so list at the XT

so after God I want

to show less Okay.

So we've done CP we
also have to do MV.

Now as you guys can see

that CP is basically
a copy copy is

as you would expect it leaves

a copy of the file that

in the original directory

while also maintaining

a copy in the directory

that you specified.

But if you want to move

the file completely,

all you would have to do

is use the command MV.

So MV is for moving
the file now,

let's see what all goes with MV

so you can type help

and as I said you get

the verbose option

And you get suffixes

you can force things

to happen to suppose.

You don't have the permission do

not problem before overwriting.

So it'll give you a prompt

and you can completely

overlooked the problem

with the F thing.

Let me just show you

how that looks like.
We'll be doing a verbose

and we will be coughing the

address dot txt file and okay.

So every time I've

been actually typing

so you can do address

or txt by just pressing Tab

and it will auto complete

so address or txt to / -

bar now, it will show you

that it is actually renamed

addressed at the XD

to VAR dress dot txt.

Now.

If you go and do LS
out here you will see

that address dot txt is

not actually he go

but if we were
to move to VAR,

so CD / far, okay.

I've also been

typing out commands

that have been previously using

and you can simply toggle

through all the commands

that you've used by

the up and down keys.

So LS MV MV V help I did CD home

and I have to go through all

this just to prove a point.

It's a seedy bar.

We want to change that now.

We're in the variable folder.

And we also want to see

what we have out here.
So address should be
out here and Alas and

as you guys can see addressed

at the XT is the first file

that has come up and it

is basically the same file

and it can prove that to you

by just getting the file

and as address txt.

And you see

that is some random address

for some random person.

Okay now, Let's quickly clear

out a file or window.

You can do that

with the control l

or you can just type or clear.

Now.

What we want to do
is move back to home.

So yeah

City home.

Okay.

So now that we're

back at home again.

Let's get out our next file.

So let's start the XT

and after move I wanted to go

through cap now cat

as you guys can see is printing

out the contents of a file

and there's also less

which does something

very similar to cat.

So, let's see what it does.

So if you go less

and you list.txt you actually

see the contents of the file

in a completely new window,

which overlays on
the previous window

and this is a very neat way

to actually see the contents

of a file which is true less.

If you want to keep

your main command line interface

not so cluttered which cat

clatters it completely.

So if you want to get out

of this place this less place

and all you have

to do is press q

and Q gets you back and

as you see nothing was printed

out on our main interface.

So this is a very
cool way to actually keep

your command line interface neat

and tidy when you're doing work.

Okay, so crap,

so grab is used for actually

filtering out stuff from file.

So suppose we want to see

whether a command has

some verbose option

to it or not.

So now I know

that MV has a purpose command

but suppose I didn't know

that so MV - - helped then

you use the pipe sign.

So what the pipes Means

is you have to take
this command the First Command

and then you five nine and two

the second come on

and you want to see graph -

V if that exists.

Okay, so let's see

grab for both.

Yep.

So a verbose exists
and that is -

be and that's - -

verbose so explaining
what is being done.

So what happened out

here is basically

we took this first command

and then we filter it

and filtering is done

through the piping.

So basically think
about you taking some Ian

and pipelining it
through something else

which funnels it
out of this command

which is grip

so you can use MV /

help in conjunction with a bunch

of other commands just

on correct and I'll leave

the creativity up to you.

So grab is basically
used for getting

what you want from a file

and graph is used very very much

throughout the source

of this video through

this Kali Linux tutorial

that you're going

to be watching.

So that is a very
easy way to see

if you have a particular option

or let me do Against also

so CD / VAR now,

we're in the bar folder.

And let's LS.

We actually have name dot txt.

Now.

Let's also go into backups

OCD be and tapped and

that brings us back up folder

and we're now in the backup

folder Let's do an LS out here.

Okay, so we have
a bunch of files.

Okay.

We have some password dot back.

No see if you have cat

and you go password got back.

You can see the entire thing.

Now what?

What if you didn't want

this entirety of it or

if you want something

in particular you
want to be very neat

so you can do that same command.

You can pipeline it

and you can see grab and you

want everything with no login

so we can see

that there's a bunch of things

that say no login

and we only want those

and these are all the things

that say no login in them and

it's a much less a list

and it gives us a very

particular list that

you are looking for.

So that is how you use crap.

So now let's head back.

To home.

Okay, I've done wrong.

And again, let's see

what the next Monday's so

now let's start the XD.

So we've done crap.

We now have to do Echo Echo

and then touch OK let's go

back a few we press q

and we get out of there.

So what did I have

to teach again?

I'm such a dummy

we have do Echo.

Okay.

So what does it Echo used

for so suppose you will say Echo

and open code hello world.

It would basically do
what the man says that is.

Echo whatever you say now,

it'll say Echo hello world
and that will basically

Echo whatever you typed out

in the conditions.

That is Hello World

spelled very wrong.

Okay now suppose you want

to actually put this into a file

so you could do
Echo hello world.

Let's spell it properly

this time and you want

to answer in the file.

We had a phone number I guess

for number dot exe.

Yep, and we can Echo

it at that thing.

Now that was done now.

Let's see.

What is it phone
number DOT txt phone.

Dot txt and it says hello world

so you can basically input

text it to a certain file

with the echo command and

that's how you do it.

Okay.

Now let's also see

how you can make directories and

that is with the make directory.

Come on.

So, okay.

We also have to do
touch before that.

I forgot now Dodge is used for

quickly creating files so touch

for you could save touch

and then the file name

so we can create
a name file again

name dot exe or or

that will create a name dot txt.

Let me just show it

to you and I sell

and we have a name dot txt.

We can also create

multiple files with touch

and you could say file1 file2

and file 3 so like this

you can create multiple

files and let me just LS

that out and show it

to you and let cell

and we have five on file

to open files three now.

We can also create a directory.

So make dir and the name

of the directory.

So suppose you wanted to say All

your movies in One Directory,

they make directory movie

and now you have

directory called movies

and you can also

move into movies.

So CD movie.

Okay, so that's
how you create directories

and you can move into them with

the change directory folder.

Now, let's see what

the next command was.

So CD and dot dot so

fit CD dot dot you can move back
to the previous folder
if I'm already know told you

that and since we're in movies

we can just go back to home

with CD dot dot after now.

Let's see what else is there,

so Cat list Dot txt.

And okay now CH own

chmod now CH own will be

a little tough to show

because we don't have any sort

of a user or here.

The root user is the only user

that we have on this virtual

box and set up but

if you want to change

the ownership of a file,

so let's see

so you can see the ownership

of a file through the LSL.

Come on and you see

that root and root.

So this is owner name.

And this is the owner group and

they're mostly the same thing.

So our next command app

you're going to actually

see is called CH own.

So let's see how CH own

is actually used CSU own

is used for changing

the ownership of a file.

So a actually don't remember

how to use CH own.

So if you actually don't

remember or you're getting stuck

somewhere just use

the help function.
So if a command
line argument symbolic,

so let me just go
through this one.

So this is how you use it owner

and then call them group.

Okay, and then the file name

so you go CH own

and then you want to say

the name of the owner

and the group you wanted

to belong to that is root

and rude and then you

specify the name of the file.

So suppose I
won't change file one

that already belongs

to root and root

so it doesn't really matter

because I don't have

any other username to actually

change the ownership to

so this is how you

would normally change ownership.

So let me just show you

where you can see the ownership

and that is LS -

L and I'll share the root

and root you see on file

one is basically
this is the owner.

This is the owner group.

They're normally the same thing

and the same name,

but if you had

some different owner

like a guest you could change it

by actually using the CH

own method the command methods

are different things.

I always get confused

because of the programming.

Okay.

Now the next command

that is left is called

chmod to actually show you

how chmod works.

Let me show you

an interesting file.

So suppose.

Let me just do this once okay

now Echo what you want to Echo?

Oh is let's Echo.

Hello world and let's put

that in quotation.

And we want to put

this in test now

once we've done that lets

Alas and we see

that we have
a test file out here

and we want to move test to test

our sh so tested sh
is the executable file

that is used in bash scripting.

So we move test to test

out sh the way you

actually execute batch files

on your command line is with .

+ / she say dot slash

and if I press T,

and I press tab.

You see that there is no options
that's coming up.

That is because they're start

sh is not an executable file

to test out sh is don't have

the executable permission.

So let me just show

that to you LS and you see test

or sh it doesn't
have the executable.

Now you see movie

it is executable.

I don't know why

it is a directory.

So it is an executable
you can move into it.

So it's blue and color.

So the way you I actually

can make this an executable is

by changing his permission.

So the way you do

that is chmod and basically

you change it to an executable.

So plus X that is
making an executable.

If you do plus RL
make it readable.

And if you do plus W

will make it writable also,

so if you do plus X
and do tests or SSH

and now you go and do LSL,

you'll see that SSH

has become green

because it is an executable file

now and now if you do dot slash

and you press T,

you get that Sh,

if I press tab,

so now it is
an executable file.

And if I executed it

presses out hello world

under the my screen.

So that's how you

can use the chmod

or which is basically the change

of emissions of files

and we'll be changing

permissions of files

throughout the course of

this video will be very useful

for us and you'll see

as we go along with this video.

Okay.

So the next thing

that I want to show

you only to our left

and I remember those now

and it is RM + RM is used
for actually removing.

A files so you
should be very careful

while using RM or any sort

of removing command
on a Linux system

because once you

remove something it is

very difficult to get it back

in as almost The Impossible.

It's not like Windows

where it's basically

just disappeared in
front of your eyes,
but it's still there in
the memory cluttering it all up.

That's why Linux

always Trump's Windows.

That's one of the reasons

and make a video

on that later on.

But for now,

let's focus on our M.

Now.

We can remove file one.

So, let's see so file one

is going to be removed.

So if he LS no,

you see 506 this but let

me show you our M.

And if I do movie

it'll say cannot remove

movie is a directory.

But if you go into the help menu

I bet there will be an option

that you can just

forcefully should move it.

So our M force will just

remove so our n /r

and you can do movie

and it will recursively remove

everything and if you go Hill

and do The LSL you'll see

that there is no movie.

He directory anymore.

And that is how you

can remove movies.

Now that problem

that you see out there is

actually a safety measure
because once you
remove a directory

and it's not retrievable,

that's a very sad scenario

and you don't want to get

yourself in such a scenario

in whatsoever possibility.

Okay moving on so on so forth

that was all about the RM folder

now you can do RM

and address of anything.

So RM, I know we moved

in address that the x

t so in The VAR folder

we can go our M VAR

and dress Dot txt.

And that will remove address

out the XD from the folder

of our let me just

show you that work.

So CD bar and LS and you see

that there is no address

or txt out here.

Okay, another way to get

help for any command

that you want is man

and suppose you want

to see what RM will show

everything about our M

that is there to show

to you show you

how to use use it'll give you

a description schnapps has named

remove files and directories.

It's a very useful way so out

here you see is the manual page.
So that is where means man

and you can press

line one nature.

You can press Q to quit.

So that's very much helpful.

OK guys.

So that was all

about the command line interface

and how we can use it to go

about the operating system

and change file permissions

copy fires move files

and a bunch of other stuff now

it's time to get on

with the interesting stuff

and that Is firstly we're going

to be learning how you

can actually see Anonymous

with proxy James OK guys.

So now that we are done

with the command line Basics.

It's time that we move

forward with proxy James.

So before we move forward

with proxy chains,

let us head back to PowerPoint

presentation and see what

exactly proxy chains are.

Okay.

So proxy chains now

as the name suggests

proxy chains are basically

a chain of proxies now,

where is the proxy used

a proxy is used whenever

you want to anonymize?
Has yourself on the wire
or the network?

You do not want to know or you

do not want to others know

what the source IP address was

for your client system

and to do this.

All you have to do is send

your package through a bunch

of intermediaries systems

and these intermediaries systems

carry the bucket out

and they transmit it

to the Target system.

And this is much

slower and let's see

how we can use this

in Kali Linux.

No in combination with tour

to in order to anonymize.

Pick not only

on web browsing traffic,

but rather instead on

all networks related traffic

generated by pretty
much older applications,

but you can also change

this in the settings.

Now, what we're going

to do is we're going

to open up the proxy

chain configuration file

and we're going to

understand all its options

that are available.

So to do that.

All you have to do is say no

you go into the ETC folder
and then you go
for the proxy chain

that conf and what

do you see out here?

Is in a new editor

and we had spoken

about Nano editor

when we were discussing

the CLI part.

I hope you haven't skip that now

what do you see

out here is a bunch

of instructions and options.

So let me just zoom in

into the Squall line interface

and now you can read

everything much well,

so what proxy jeans is well,

it gives you the ability

rather to draw out your traffic

through a series
of proxy servers

and stay Anonymous

in such a fashion by hiding

behind them or by having

them forward your request.

So it looks like
On the other side

that your requests are coming

from them as opposed

to you now surprisingly enough.

There are large amount

of these proxy servers out there

that you can use but they're

not very stable, you know,

they go up and down

and they're not very fast so

far specific targets,
they can be useful
but not for brute forcing

and not for any sort

of computing attack.

So suppose you're doing

something to certain Target

for trying to log in

or you're already logged

in you can definitely do it

through proxy chains,

and it will be reasonably fast

and reasonably stable.

As well, but

if you're doing some sort

of mass scanning

or your brute forcing a password

or something of a kind
of a proxy chain with a list

of proxies selected
from the internet,

especially the free proxies.

It's not going to work.

I mean it's going to work out

eventually in a technical sense,

but it will consume more time

than you can spare and by that.

I mean it can be
very very long time.

It can take about months

or two to do a simple scan.

So that's not an option and

there are other ways of doing

that but for the time being

I just want you to know

how you can use proxy jeans

and How you can configure

it and actually
because it's really useful

and I use it fairly

often a lot of people do

and it's a fantastic

piece of software.

So first off we have

the types of proxies.

So you see yes EDP socks

for and socks5 now,

they are fundamental differences

between these protocols

and you always want to find

yourself a socks5 proxy

as that's the best possible one

and that has the ability

to anonymize all sorts

of traffic scdp.

Well as a name it says

it's for HTTP traffic

and socks for Or is very similar

to Socks by but it
does not support IPv6 protocol

and it does not

support UDP protocol.

So this can be sucks for

and can be rather problematic

and you always want to make sure

that you're using socks5

wherever and however any way

down below you have

these other options,

which we will go over.

So basically how you

enable these options is

that you don't need to type

some complex lines of code

or anything of any kind

basically you all you have to do
is just leave the hash out here.

I'll show you so suppose we want

Do actually activate
Dynamic jeans option.

So all we have to do
is delete the hash.

But let's put

in the harsh right now.

So after you delete the harsh,

all you have to do is save

the file and the option

is enabled this hash presents

a commented out line meaning

that the system reading

this will ignore

if there is Harsh and

if there isn't hash it

will take it into consideration

and interpret it according you.

Anyway what we have

here are statements

which allow us to specify

how we want our traffic

to be routed the First

off we have Dynamic

chain Dynamic chain is a some

and is an option

which you will find

people using the most it

is most commonly used option

and a preferable want

to at that and honestly,

I think it's the best one

out there primarily

because it's the most stable one

and here's why now suppose

you have a b c d proxies.

So those are some servers

with IP addresses

with open ports.

And if you have

a strict chain policy,

which is enabled
on this computer right now

as you see if you have

a strict chain policy,

we can only be able

to access any site

on Internet in general
by going through ABCD.

So you have to go
through all of them

and you have to go through them

in that specific order.

That is ABCD and that's

not always a good thing.

I mean if you're paying

for 5 proxies,

that's not a problem

because they will

always be operational

and they will always be up

and why not that's

not a bad idea or an option

but there are however people

who use proxies for free and

they don't tend to pay for them.

Why would you pay for like

five proxies for simple scan

or something of that kind?

They're not free

and the a cost money and they're

rather expensive also,

but still, I mean the act
of paying itself identifies you

and kind of diminishes

the amount of anonymity you have

on the internet.

So some complex payment methods

can still be used

to actually anonymize yourself,

but it's fairly simple

to just use a dynamic chain.

So firstly we're going

to go ahead and uncomment

the dynamic chain option

and we're going to comment

out the strict chain option.

So strict chain will

no longer be used and I

will be using Dynamic chains.

And one more thing to note here.

Is that if you want

to use Rocky chains

in combination with door

if you want to Route

all your traffic

through the Tor Network

not just web traffic.

You must be
enabling Dynamic chains.

I mean, there's a chance

that it will work

with strict genes.

But give the instant

instability of door nodes.

It is highly unlikely.

You will need Dynamic jeans

and that is why I'm using them.

Anyway, if you're using

Dynamic changes just

give you the ability to go

from ABCD to your desired

destination by not having

to adhere to any order.

So let's say C is down

and you would go a b d

and it Woodworking
with no problems,

even if P was down

you would go to a d

and you would go and still

reach the destination.

So as long as one single proxy

is functional it's going to work

and you don't require

any specific order to do

it down below now down

below you have some other

options to so first is

random chains now random chains

in effect are basically

the same thing as

resetting your service.

I mean if you're
resetting your door,

you will be now assigned

new IP address in Taurus

is your new IP address

every 10 minutes or so.

Anyway with the random.

You can specify a list

of ips and then you

can tell your computer.

Okay, I want you to try

and I want you to connect

to this point and
every time you connect every
time you transmit the packet,

I want you to use

a different proxy

and we can do that as well.

And that's one of the options

definitely and you can see okay.

Use this is phone five times

and then change to another one

or some kind of like that.

There are a lot of options

to specify their family

the chain length

any way down below.

There's quite mode.

You don't really need

that then that's proxy.

DNS requests.

No leak from DNA.

Stata, this is very important.

You cannot have any DNA sleek

and let me explain to you what

DNS leaks are and even

though somebody cannot get

your particular IP address.

They can get the IP address

of the DNS server

that you are using and

that DNS servers do is resolved

main domain to the IP address

and vice versa.

So for example,

if you type in youtube.com,

the DNS server of your local

ISP provider will resolve
that into some sort
of IP address that YouTube has

and it will make a request.

No problem and you

do not want that happening

because Is your local DNS server

will be discovered

and that is information

that can be used

in order to figure out

your personal IP address.

And when that is done

your physical location

is pretty much compromised.

And that's an oval

and you definitely

need proxy DNS here.

It might slow you down a bit,

but without that you're

practically not Anonymous

and it's just a matter of time

before somebody finds you now,

if you go down below we have

some other options here,

but we're not really interested

in them at the moment.

What we here are for the formats

for entering proxies and I'm

going to leave it at that.

So what do you see out here

is first the type of the proxy

that is sucks 5 then the IP

address then the port number

and then two words

that Islam has secret

and then juice to Hidden.

Okay.
So now what you see out here
as I just said is

how you would actually write

down your proxy chains.

And now as I had already

also said you always want

to be using socks5 and you

don't want to be using HTTP

because they're not really

that safe and socks5

doesn't support a lot of Anyway,

and this is the IP address

of the proxy server

that we will enter a few

of them manually later on

and this here is the port number

that you see on which

the proxy server is listening

and that port is open

over here these two words.

Now what some proxy server

especially paid ones will always

have a username and password

so you can just type

them here in plain text

and fortunately it is assumed

that only you and you alone

have access to this computer

besides this file

and besides this file

is you not know.

Everybody can read

this file anyway,

so if you can just type

in the username here

and password here,

you will gain access

to a certain proxy

that you have chosen

or that you have paid for.

Anyway, these are

just some examples

and we won't actually

be using these proxies

or anything of the kind.

We need to go down
below here here you see

and at the end of the file.

So if I just press
enter a couple of times,

there we go.

So here is only one proxy active

at the moment and says socks

for and all traffic is routed

here through Tor by default.

So That to tour now and tardy

for listens on the sport.

So this 9:05 is report is white

or listens on now,

what we want to do is we want

to add socks5 proxy address.

So what you want to do

is just type in socks5

and the same IP address socks5

and you want to be keeping the

spacing correct just use tab.

So 127 dot 0 dot 0 dot one

and then you want to specify

the port number the

also so now 0 5 0 so

what you see out

here the 127. 0.021.

This is the loopback address

of your computer.

So this is for any

device communication and

if you're paying
this address and

if you're paying yourself

basically and usually

people think this address

in order to make sure

that the IP protocol

is set up correctly,

even though they don't have

internet connectivity.

So let's just type

in 1.27 dot 0 dot 0 dot one and

the same port number and 9:05.

So now we have to press Ctrl o

to save our You can save

on the same name

and we're o 65 lines of course

down and that's written

and now you have to press Ctrl X

and you exit out.

So let's press Ctrl L

and clear our screen now,

we just edited
our proxy change configuration

in a very neat environment.

So to go ahead and type

in our service door status.

So we want to check
status of our daughter.

So service tour still this so

torturous could not be found.

Sound so do we have
the torturers installed?

Okay sewed.

Our service is not installed.

Just give me a little moment

quickly install it.
Okay.

So now that we have set

up our broccoli
jeans configuration file

and we have put in a sock

5 proxy chain giving

it the torch service.

Now, what we need to do first

is start up our tour service

now to actually check

if the car is running or not or

if the door service

is running or not.

Let me just clear that out.

We need to go service
to our star.

And you see it

says it's inactive.

So what do you have to do

is say service to our star

and that will start

the tour service.

It might take some time

depending on the system

that you're using and what are

their it has started it for me.

Now what you have to do

to actually use proxy chains

before you go to any website.

So all I have to do
is say proxy chains,

then you specify the browser

that you're using.

So we're going
to be using Firefox

and you could say something

like www dot Duck duck duck
on so now here you will see

how your ping is

being transmitted to.

Dr. Go.com when I say thing,

I mean your packets

and your requests,

I'm sorry for my vocabulary.

So now your packets

are going to be directed

through a bunch of IP addresses,

but we haven't actually

put a bunch of you just

have put the loop back

for the Tor Network.

So we will let our do the rest

of the things for us.

Okay, so depending

on your system this

might take a little bit.

Of time to actually open up.

Okay.

So let's go ahead and see

what's actually happening

on the terminal

while this thing is loading up.

Okay, as you can see

it's going through a bunch

of proxies out of here

and some are denying it

and some are saying it's okay.

So as you guys can see most of

the time you might give tonight

and it will be a less

number of occasions

and that is exactly

what we're looking for
because primarily we have gone
a great extent for the anonymity

and what do you want

to do is stay like that.

So this is basically
how you Use proxy chains.

Now if this computer

just decides to open

up talk go.com on Mozilla.

I could actually show you

some interesting stuff

but it seems my computer

has kind of given up

on actually opening duck Taco

it still waiting for dr.

Goes actually confirmation,

but that's about it.

So this is how you can actually

configure proxy chains.

I'm really sorry

that my computer
isn't working right now,

so well and nothing

is actually opening on Mozilla.

It's mostly because

my Ram is over.

Loaded.

I think I should go
ahead and get myself a new Ram.

But for now,

let me just also say

that we can put

some custom proxy lists

and instead of just

saying let me just go ahead

and open up that file again

as you guys and see out here.

I'm going to end this right now

because my computer can't really

take all this pressure.

See it's like so hard.

Okay.

Let me just quit out of that and

let me just open up a new one.

Now as I had said

that you can put up

some custom proxy lists,

not really gonna do that.

But let me just show you.

You can do that you go.

No and you go cetera and proxy

so you basically have to go

into the proxy chain.

Okay, so I think I
should put this can yeah

now if you just go in

and edit out here,

all you have to do is

setup Dynamic jeans

and you can go online and search

for free proxy list and

that will give you everything

that the port number

to the IP address.

Let me just show it to

you free proxy server.

Our list.

So all you have to do is search

for free proxy server list

and you can see out here

the proxy Davis scbs

and you basically want to find

a soft fire proxy to find

self a proxy just add

that into your keyword.

And once you find

those proxy addresses,

all you have to do is take

down this IP address

and followed by the port number

and you go ahead

and just put it down

in this configuration file

and then you hit control.

Oh and you just save it

and And you just go back.

So that was all

about proxy chains and

how you can set up Roxy change

to set make yourself.

Very Anonymous.

I'm sorry hold muscle, uh,

pardon work that's still

sad state of my computer

but moving on let's go ahead

and study about Max changes.

OK guys.

So that was all

about proxy chains.

Let's move ahead

to match changer.

Okay.

Now before we go into the tool

called Mac changer,

let's just see

what a Mac addresses now

Mac address actually stands

for media Access Control

address of the device
and is a unique identifier
assigned to a network interface.

Stroller for communication

purposes now a Mac addresses

are used as a network address

for most IEEE a certain

ethnic Technologies,

including ethernet Wi-Fi

and Bluetooth.

Now in this context

Mac addresses are used

in the medium Access

Control protocol sub layer

and as typically represented

as Mac addresses are

not recognizable as six groups

of two hexadecimal digits each.

Now, these are separated

by a colon and the first

three hexadecimals are

actually the organizationally

unique identifier.

So they actually
represent your vendor

and the next three Hexadecimal

is actually represent
your network card unique.

Okay, so when you are

actually on a network you

are recognized on something

called an ARP table.

Let me just show

you the ARP table

how you can see it.

Let's go in.

So the password is root

still an ARP table is
basically an address
resolution protocol table.

And well, this is

a virtual machine

and it doesn't really

know many machines

on the local network.

But if I were to go

on my Windows system and show

you my ARP table, let's see.

Okay, so if I show
you the ARP table

of my Windows machine
and on any machine

that has a TCP IP protocol

suit installed you

will have this command

as working called are

and you gave the -

A and now you see

that your IP address

or somebody else's

IP address is actually map

to physical address.

Now.

The MAC address

is very commonly used

in the our protocol and this is

how you are actually

identified on a network.

Now sometimes what you want

to do is be unknown
on this network.

There are various reasons

why you want to do that.

Let me just give you an example

of a very malicious.
Reason that was done
in my college.

So we asked students would

actually change the MAC address

of our own computer

to the professor's computer.

So we would somehow look up

the professor's IP address

and then come to know

about his Mac address

and then we would spoof

our Mac to be his Mac address

and then we would do

some tripe sort

of malicious activity
on the college internet

and then internet administrators

of our college
would come to know

that that Mac address

is doing some sort

of malicious activity and

that Mac address

would get permanently banned

for that session on the call.

Dish Network so basically

our professor would not be able

to use a wireless projectors

that he would use to actually

show us as presentations

and we end up
getting a free class.

Now.

I am not actually
promoting any sort

of bad activity like this.

I have just experienced this

in my own college life.
So that was something
but there are many other reasons

that you might want to spoof

your Mac now Mac changer

is an amazing tool
for actually spoofing your back.

So first of all,

how do you come to know

your Mac address?

So let's see you go ifconfig.

This will give us

our Mac address.

Now this dress

that you see out here is

the MAC address of this machine.

So you can also check

out the MAC address

by going Mark changer,

then let's type

in the help options.

And this will show us

how to get the MAC address.

So if you see
there's a show flag

so we can go Mac changer

and you can put the S and then

you put the interface now

the interface is
where it's working.

So at 0 is where we are.

Actually getting we
don't want the loopback one.

So at 0 and this will give

us the MAC address.

So I can't Mac address is

zero eight zero zero two seven.

Let's see if that was

the same one shown.

Where is that matter?

It's okay.

So if a 0 a 0 0 to 7,
so, I'm sorry.

This was the MAC address.

I selected the wrong thing.

What I was showing you is

the IPv6 address and you can see

that's very very long.

So, this is our Mac address.

Now what you might want to do

to change your Mac address.

Well, let's see with V

we can get the version

with s you can show

we can do the E.

And as I said,

if you remember that the first

three bits is about the vendors

so you can also get

the vendor list by going - L.

So you go -

L and this will give you

a list of Mac addresses

and which rendered

the belong to so sometimes

if you don't know the vendors

that are actually

being used on the network

of your college, for example,

and you want to

just stay Anonymous

and not raise any Flags.

Lakhs of Suspicion
so you could hide yourself
as a Cisco router.

So suppose your college

was using all sorts

of Cisco routers
and you decided that today.

I'm going to put myself

as a Cisco router

and I'm going to screw

around with the network.

So it would not raise any Flags

before you actually decide

to do some malicious activity

in some deeper inspection

of your Mac address people

would actually realize

that you are actually

spoofing the dress

and after some investigation

they put Andy take some time

to actually reach to you

and how you spoofed it,

but the And of Ginger Mac

is not raising any flags

and that is exactly

what you should try to do.

So Mac changer is also

very useful for getting the list

of all the Mac addresses

and the vendor IDs.

Now, let me just clear

the screen out quickly.

So we go clear and let's

bring back the help.

So we go matching
injure and - help.

Now, what we want to do is give

ourself a random Mac address

now Mac changer,

so that is Done
with the our flag

and we want to do it on F 0.

So once you run

that you will be given

a new Mac address.

So our new Mac

address is f6c 649

now you can verify

that by running ifconfig.

Now we could just do ifconfig

and you see our new

maxi dress is an ether

so we could also do something

like this ifconfig

and you could grab eater.

So that's just telling

you the MAC address

and this is completely new also.

You can show it to

the Mac changer tool itself.

Okay, so we need
to give it the e0.

I've got that now.

You see that this is

our current MAC address

and this is a permanent

Mac address and their two

are completely different.

Sometimes you also might want

to actually change your Mac

when your laptop is

or your system is booting up

because you might want

to stay Anonymous all the time.

Who knows and sometimes

you might think
I'll actually change it
when I want change it,

but let's face it we

We are forgetful as human beings

and we tend to forget things

that we are supposed to do.

So what else is better

than to actually automate

the whole process yourself

and forget about remembering all

these stupid nitty-gritty stuff.

So you can tell Linux

or cardigan enough
to actually change.

Your Mac address on boot-up

is use this tool called crontab

now crontab is actually used

for scheduling tasks on Linux.

So let me show you

how to do that firstly.

Let's clear our screen

and go crontab

and go Health now.

You see it's

a pretty small and menu.

So first we start
with it you flag that user

this file is going to work

for then we got the E flag,

which is for editing crontab

users the users crontab list

and you can see the list

of users crontab and let's see.

So do we have
any crunch all this?

So there is no crontab
at this moment so we can set
up one for ourselves
by going to the E.

Then there's the r

which is delete users crontab

and I want to tell you all be

very careful when treating

anything of that sort

because once you delete

something from The Knocks

that I've already said

that it It is very

very difficult to actually

retrieve it back.

You might get fragmented pieces

of what you had actually deleted

and that will only leave you

with sadness and Devastation.

Now, what you want to do is go

through crontab and press e

and this will bring us to select

an Editor to change later

on select editor.

So we'll do it Nano.

So what do you have out

here is the readme file

of crontab and if you read

this entire thing you will get

how to use crontab completely.

But if you have any sort

of doubts even after reading

it you can leave them down.

The comment section below now.

What do you want to do

is actually set up a crontab

so that you can change

your Mac address whenever

you reboot your computer.
So all you have to do
is say at reboot

what you want to

done is Mac changer,

and if you remember we want

to run the MAC address

and we want it on eat zero.

So that's done.

Now.

All you have to do

is save this thing.

So you go control.

Oh and that will write

it out you crontab

and you press enter

and you have ridden on one line.

Now you go control X

you have X is it out?

So now let us clear the screen

by pressing Ctrl L

and enter and let's go

ahead and get our Mac address.

So if we go ahead and run

that are Mac address

is set to f6c 649.

So just remember the first few

letters have 66 and 49 now.

Let me just reboot my computer

and you will see

after I reboot and run ifconfig

again with gravity table.

We will see a different

Mac address now rebooting

my take some time

because I'm actually

using Of washing machine
but still now it's given
problems with the Firefox.

But let's hope this

won't take much time.

Okay.

So now that our computer

has booted up

and we have actually opened

up a terminal let's go

in and type ifconfig and

let's get in our ether

that is the MAC address.

So if you remember
the MAC address now,

you see that it has

completely changed and that's

how you can spoof

your Mac address

on our local network.

And this will basically help you

in staying Anonymous
on our protocols and anything

that actually laughs your IP

address to the MAC address.

Okay.

So that was all

about math Changers meet you

in the next section.

So in this section,
we will be talking

about wireless encryption

protocol cracking.

So that is basically
Wi-Fi cracking now Wi-Fi

in today's day and age uses pins

or passwords to normally
encrypt the data usage.
Basically, if you want to access
the wireless access point,

you need a password

or a PIN to actually
gain authorization now

this authorization Chicken

is done using a for a handshake

which we will try to capture

using a tool called aircrack-ng

and then we will try

to crack into the password

using a wordless
generator called crunch.

Now, you can use aircrack-ng

to crack WPA and WPA2.

There's also another protocol

called WEP or WEP

and that is not normally

used these days.

If you find anybody using

that you should always advise

them to actually upgrade to WPA

or WPA2 because Wei.

EP is actually very
easily cracking these days

and people are generally

punished for using WEP

by hackers all around the world.

Okay.

So now you can actually go ahead

and go into a terminal

and type ifconfig to actually

look at your network card name

as you guys can see out here.

It's called wlo one.

So the first step

that we need to do to actually

go into the process

of Wi-Fi cracking is set

up our network access card

or our access point.

Monitor mode so

as you guys can see out here

after typing ifconfig.

It shows me

that my Wi-Fi access

God is wl1 interface.

Now our process of cracking

passwords is pretty simple.

What we want to do
is actually monitor

for all sorts of access points

that are nearby to us.

Once we have chosen

the access point that we

want to actually penetrate

into and find the password.

What you want to do is run

a narrow dumps can on it

and then we will try

and D authenticate any device

that is connected
to the access point now

one assumption out here

is that the password

is saved in that device

and it will automatically

try to re-authenticate

itself with the access point

and we want to catch and log

this re-authentication process

which will actually have

a four-way handshake

between your device

and the access point.
So this is basically

the procedure we are going

to follow now another thing

that you need to know

before actually using

this process to gain

any access to any Is

that you need to know a little

bit about what the password is?

Maybe it could be length

or it could be something

like a specific character

at a specific place.

Maybe you know

a series of characters.

So you just can't really guess

the password out of thin air.

That is not how cracking Works

unless you have

some unlimited potential

of processing power
in that case.

You can very well brute force it

and just find the password,

but if you are not somebody who

Has unlimited processing power

and you're trying

to use aircrack-ng.

You need to know a little bit

about the password.

Also before we proceed

with this wireless

encryption protocol cracking.

What I want to say is

if you want to get

into somebody's Wi-Fi network,

or you want to actually

test for vulnerabilities.
It's better that you test
for router vulnerabilities.

Then actually cracking

a Wi-Fi password

because you're more likely

than not to find

more router vulnerabilities

than actually successfully

Like a Wi-Fi password

if you don't know

anything about it,

if you don't know anything

about the password

just go ahead and run

some vulnerability tests

on the router itself and more

often than not you will just

find something you can abuse.

Okay.

Now let's talk

about the two tools

that I'm going to be using.

Now these two tools.

One of them is already

installed on Kali Linux,

but if you are not using

this on Carly,

you can also use this

on any Linux based system.

So what you have

to do is download

and All aircrack-ng,

which is easily installed

with the command

apt-get install aircrack-ng

and you also have to install

this word list generator
called crunch now crunch
is easily downloadable

by just Googling the name

and the first link

will be a sourceforge link

and all you have to do

is go inside that

and install it and

once you've figured out

how to install crunch

you can make sure

that its installed.

Now once you have installed both

the software's you can check out

if the manual pages

are opening up.

Let me just open the manual page

of aircrack-ng and show you

that it has been

properly installed.

Now as you guys can

see the manual page

of aircrack-ng opened up

and the manual page

of crunch is also opening up.

So that means both

of our software's

have been successfully

installed on our system.

Now before we go ahead.

Let me just show you

how crunch actually works

so crunch is basically
a wordless generator.

What you would do is you try

and generate a word list

with given characters.
So what you can see out here
is I've typed in crunch 3/5,

so Means the minimum length is 3

and the maximum length is 5

and I've given it

a series of numbers.

So it will use these numbers

and generate all the words

that are possible

from length 3 to length 5.

So the way we are going

to use crunch in conjunction

with aircrack is

that we are going to use crunch

to generate the word list.

And then we are going

to pipe the word list

through aircrack-ng

when we are actually

trying to capture and crack

what we will capture

in a certain log file now.

What you want to do

first is actually put

your network interface card

on a monitor mode.

Now you can do

that by typing in ifconfig

and then the interface name

which happens to be wl1 and

first you have to put it down.

So I've config wl1 down now

to put your interface card

into monitor mode.

You have to type in IW config

and you go the name

of the interface

and then you go mode monitor.

Okay, it seems
I've spelled it wrong.

So let me just do it once again.

So that has put

our network interface card

into monitor mode

and what we need to do

after that is we need to start

up our network interface.

So all we have to do is type

in ifconfig wl1 up now.

Once it is up and running you

can check by typing in ifconfig

that indeed your network

interface card is up

and running don't worry

is running in monitor mode

if it's up and running

what we want to do next

is pretty important

to the whole process.

So what we want to do now.

Now is check for some services

that might still be running

in the background

that might hamper

with our whole scanning process.

So we do this by actually typing

in the command Area 1 and G

check and then the name

of the interface.

So as you guys can see nothing

is exactly running right now.

But if there were any process

running you would only add

a command airmon-ng check

and instead of writing
the interface name.

All you have to do is say kill.

It will kill any processes now

if you see Any process named

the network administrator

you want to kill

that process first separately

and then kill

any other child processes.

You may need to actually

run this command few times

before all the processes

are killed and then

you're good to go.

Okay.

So now that we have finished

killing all the subprocesses.

What we want to do is run

and error dumps can on

the network card.

So that is WL 1.

So for this we go Aero dump -

Angie and then we put in

the name of the interface.

And this will start the scan

that will look

something like this.

So after you run

the aerodrome scan

on your interface,

what do you see out here is

a result of all the access point

that is found out

to the monitoring mode.

Now if you see we have a bunch

of columns out your first
of all we have the bssid column.

Now, the bssid column is

basically the MAC address

of all the routers

that are found.

No, every router obviously

has a MAC address.

So those are the MAC address

that is tied
to the router names,

which is shown by the SSID then

we How the pwr column we have

the beacons column we have

the data packets column.

Another important column

is a channel column.

It's important know

which channel your router

is working on.

Then we can see the cipher

column the authentication

so out here we can see

the encryption that is used.

So most of it is using WPA2.

So what we will be cracking is

basically WPA2 so from this is

what you need to recognize

is basically the Wi-Fi router

that you want to crack into now,

I'm performing this particular

test at my office.

Is and I don't really have

the permission to actually

go in and test them

for these vulnerabilities.

I'm not a security

analyst off here.
So I don't really

have the permissions

to penetrate into them.

So what I have done is I

have run a similar test

at home using my own Wi-Fi

and I will show you

the results for that.

But for this working example,

you will see the scans

that I'm running in this office.

So as we intend to stay ethical

what we are going to do out

here is we are going to capture

whatever we find in our office.

For on the educational purposes,

but when we are doing

the actual cracking step

that is the last step

of this whole procedure.

I'll be running it on a file

that I had generated at home

as I just said

because I have four missions

to do whatever I want

with my own Wi-Fi and passwords.

Okay.

So for this example,

I'm going to pick this wi-fi

that is called attract of Wi-Fi

and it's running

on channel number 6.

So what do you want to pick

from here is the bssid

and the channel number

we need to remember
these two things first the bssid

and Channel number now.

What do you want to do after

that is open up a new window

on your terminal
and login as root.

Now what we want to do here is

run a separate Arrow dumps can

on this specific bssid

and check for all the devices

that are actually connected

to this access point.

Now we do this by running

the command airodump-ng

and while we're doing this,

we also want to capture

all the scan outputs

that we actually get

into a certain file.

So we will be actually storing

it in a file called capture

and then we just have

to pass in the bssid

and the interface We also

have to specify the channel.

So let's see what the channel is

1 so the channel is Channel 6.

So that's what we want to do

and we specify the Channel

with the - see Flags.

So after you have identified

the MAC address,

all you need to do is copy

it down and place it

with after the bssid flag.

Okay, so we're going

to run our Command out here

and we just want to say

our file is going to be

well test out capture.

Now that our scan is

up and running.

All you want to do is wait

till someone is actually

connected to this access point.

So I forgot to mention this

for this process

to actually work properly.

Somebody needs to be connected

to that access point

because what we are going to try

and do is disconnect.

That certain device

and let them reconnect

and capture that log file.

Okay, so it seems

like nobody is actually

connecting to it.

So at this time I'm going to do

is go back to our Aerodrome scan

that we had run

on a network interface and look

at some other Mac address

or other access point

to actually penetrate

into and let's see

if something has actually

connected to that.

Okay, so

oh la la now
what do you see out here is

that somebody has actually

connected to this access point

and his Mac address can be seen

under the station stab.
Now.

What we want to do is run

the authentication broadcast

message on that station

and the authenticate that guy.

No to actually run
the the authentication process.

All you have to do is go ahead

and open up a new terminal

window again and let

this can be running

in the background.

Don't use any

scanner this moment.

Okay.

So the information

that they need to

remember is the bssid

or rather the Mac ID

of the station now,

you also want your monitoring to

be running on the same channel

so that your the authentication

message is being already

broadcast on the same channel

so we can do that easily

by going airmon-ng

and saying WL One

and you can say start

on specify channel.

So what we want to be doing

is running this on Channel 6,

then we want to go and use

the third suit of tools

that is are replay now are

replay is used for broadcasting
the authentication messages
and all sorts of stuff.

Now you can see all this

in The Help menu also

and you can do

that by typing in - -

help if you go down you see

that you can send

the authentication message

using the - 0 Flag

and that's exactly

what you're going to do.

Then we stay zero again

because we wanted
constantly send a broadcast

of the authentication.

So it's looping
basically and until

and unless we stop the scan.

Nobody will actually

be able to access the Wi-Fi.

So it's basically
like a small toss attack

and then we want

to specify the bssid.

Okay, so it seems
like I forgot the whole a tag

before the bssid and

that should get it working.

Okay, so it seems

like I have copied

some wrong bssid I guess.

So, let me just go ahead

and copy that once properly.

Okay.

So now that we have

the proper bssid
as you guys can see

we are running the

authentication broadcast message

on that particular
network access card,

and now you want to run this

for around a couple of minutes

so that you become sure

that all the devices

have disconnected.

Now while this is happening

what you're doing is basically

sending a Dos attack

to that small little Wi-Fi and

you want to catch the handshake

that occurs between devices

and the router

that it is connected to
while reconnecting themselves

Okay.

So now that we've let's can run

for a couple of minutes.

Let us just stop it.

Let's stop this

others can too now.

If I go and list out

the files on my desktop,

you should see

that there's something

called the test capture.

Now, the test capsule is given

to us in various formats.

We have the capture format,

which is just capture - 0 1.

Cap and then we

have test capture CSV.

We have a Kismet CSV.

So it gives you a bunch

of formats to actually
run your cracking on now

if you remember I
had told you all

that I have already

generated a similar.

At home, basically

when I was trying to crack

into my own home password,

so I will be running
the tests on that file

or the cracking procedure

on that file.

And that is the last step

of this whole procedure.

So, let me just go ahead

and move into that folder.

So I go see these can now

as you guys can see out here

if I list down the files

if you can see a Capture

One Dot Capture One Dot CSV.

This is Kismet CSV

and this and that XML.

So I was not lying when I said

that I have already

done this at home.

So we are going to run out.

Cracking process on
capture with 0 1.

Cap now.

Let me just tell you guys

the password for my home.

Wi-Fi is sweet ship

346 so you can say

that I know the entire password,

but I'm going
to act like somebody

who only has a general idea

of what my password look like.

So let's say I know

that my password
contains tweet ship

but I don't really know the last

three numbers or letters

or whatever they may be.

Okay, so we are going

to use crunch once again

to generate a list of words

that might include Egypt

346 and let me just open

the crunch manual for once now

if you go down
in the crunch manual

what you'll see is the -

t so as you guys can see

there is a pattern

that is pit specified

like after it at the red God

and Then followed by

four other ad rates

and all the ad rates

will be replaced by
a lowercase character.

Now you can remove

other eight and use a comma

and be replaced
with an uppercase character

or you can use percentages

which in case it
would be numbers.

Or you could use the caret sign

in which case it
will insert symbol.

So when you know the length

of the password

and also a certain degree

of few letters,

you can use the hyphen T flag.

So that is exactly

what we are going to use

with crunch out here

for this example.

So, let me just remind

you guys that the password

for my home Wi-Fi

is we chipped 346.

Now what we can do

is we can ask crunch

to actually generate something

that looks like sweet ship 346.

So what I could do is say crunch

So the minimum length is 12.

I already know

that and the maximum

length is also 12 now.

Let me just input

in the pattern.

So we put in the pattern

after - tea.

So now I'm going to show you

how long it can take.

So we are just
going to say sweet

and then put in some ad rates

and then also get a try

and guess in the numbers.

So after you've put

in the pattern you want

to also input which letters
and numbers it could be

and I'm just going to input

my entire keyboard out here.

Now, what you want to do is pipe

this command through aircrack-ng

is cracking procedure.

Okay.

So now what we want to do is

type this command to aircrack-ng

and we want to write

from a rather read

from the capture file.

So what we go is -
W and then -

and then the capture file name.

So capture 0 1.

Cap and then we also

have to specify the essid

which is given to the E flag

and the essid for my home.

Wi-Fi is Nest away

underscore cc105.

So that's actly
what I'm going to type in

and this will start

the cracking process on my Wi-Fi

from the captured file.

So as you guys can see

this is going to take

a long long long long time

and I'm not really actually

going to complete it.

So in this time,

I'm actually just going to try

and explain why this is

not very feasible

on a virtual Network.
So basically this
is not feasible

because at this moment

why computer is using

all four of its course

and all the memory

that is possible.

So what this means is

on a virtual box.

This is not really possible

your virtualbox don't really

have that much power.

If you are using a 4 core

processor computer only two

of its maximum course

can be actually allotted

to your virtual box

machine above that.

You can't really give

it the entire memory

because that will make

your computer crash.

So if you want to do
something like this,

it's better that you install

Kali Linux as a dual boot or as

your own daily driver

and then you can do this.

So this is why I have not done

this on a virtual machine

and instead downest

on deep in Linux,

which is my daily
driver operating system.

Now as you guys can see

this constantly trying

to actually guess the password

by actually going
through all the permutations

and combinations.

That is basically it's taking

in all the words generated

from crunch piping it

into the current command.

That is the aircrack-ng command

and is comparing everything.

So what I'm going to do is

I'm actually going to end this

because this will take

a very very very long time.

And what we're going to do is

we're going to actually try

and shorten the command

of the or the amount of guessing

that you're trying to do.

So, let me just try and do that.

So as you guys can see out here,

I have reduced
the number of alphabets

that might be actually tested.

But even in this case,

this will take

a humongous amount

of time and let me

just show that to you.

So as you guys can see

the test is running running

running and running

and and there's not really

much you can do you can just

let this run go out

for a cup of coffee

and then come back

and you might still

see that drawing.
It really depends
on what the password is

and how much time

it takes to crack it

and how much processing power

you have directly affects

how much time this will take

so let me just show you guys

that this is taking

a bunch of time.

Okay.

So now that I have

fast-forwarded a lot

into the scan you can see

that I have tried

almost two one two,

seven six zero eight keys.

So that's more
than a million Keys.

That's 2 million keys

that have tried so and it

still hasn't reached at 3:46.

So what we're going

to do is just to show you

for demonstration purposes that

this procedure actually works.

Let me just shorten

guessing even more.

So what we want to do
is this time we want

to just guess the numbers

so We'll modify
our Command accordingly.

So we just put in

sweet chip and let the algorithm

just guess at 3:46 part.

So we're going to
remove the alphabets

from the guessing scope also

and as you guys can see

the password is almost

immediately guessed

because only 456

keys were tested.

And as you guys can see it shows

that the key was found

and it's sweet ship 346 now

let me also show you

that it works with the guessing

of letters just

because I don't think of did

that letters are also guest

and not just numbers.

So let me make it just gets

the P part that is sweet.

She and then it should

guess B and then 346.

So let me just show you that and

as you guys can see it guesses

it almost immediately

after just going

through 15,000 Keys.

Okay, so that brings

us to the end

of this wi-fi cracking tutorial

and also to the end

of this video

which was regarding ethical

hacking using Kali Linux.

I hope you guys had

a bunch of fun learning

about Mac changes proxy chain.

And a bunch of stuff that we did

like Wi-Fi password cracking.
I hope you practice these
procedures and methodologies

that have thought you only for

your own educational purposes

and not use it to harm anybody

or do anything harmful with it

because let me just tell

you very seriously

that you can be prosecuted

by the law.

So let's end this video

on a good note by saying

please practice this

for only educational purposes.

Let me just show you that and

as you guys can see it guesses

it almost immediately

after just going

through 18,000 Keys.

Okay, so that brings

us to the end

of this wi-fi cracking tutorial

and also to the end

of this video

which was regarding ethical

hacking using Kali Linux.

I hope you guys had

a bunch of fun learning

about Mac changes proxy chains

and a bunch of stuff

that we did like

Wi-Fi password cracking.

I hope you practice these

procedures and methodologies

that have taught you only for

your own educational purposes

and not use it to harm anybody

or do anything harmful with it

because let me just tell you

when he sees this.

You that you can be

prosecuted by the law.

So let's end this video

on a good note by saying

please practice this

for only educational purposes.

If you are a hacker

pentester security researcher

or just another person

who picks Google in front

of friends to look cool,

then it's likely

that you must have already known

about some Linux distros,

which are particularly

made for them.

Today.

We're going to explore

one such Linux distro parrot.

Security OS one of
the leading Linux distribution

and penetration testing

and ethical hacking.

So let's quickly go
through today's agenda first.

We will Begin by discussing

how Linux distributions are

suitable for ethical hacking

and different type

of Linux distros

that are available

for ethical hacking

and penetration testing.

Then we will begin

with our today's topic

which is parrot security OS

we will discuss
its features its history.

If or not parrot security OS

is suitable for you.

Moving on we will see

how particular day

OS is different from Kali Linux

and then I'll show you

how to install parrot security

OS using VMware software

and finally we'll end

the session by taking

a look at few popular

parrot security OS tools.

So I hope agenda
was cleared you guys.

Let's get started

then a security

focused operating system is

a hacker's best friend

as it helps a hacker
to detect the weaknesses

in computer systems
or computer networks.

whether you want to pursue

a career in information security

or you are already working

as a security professional

or if you are just interested

in this specific field

for fun or decent Linux distro,

that suits your purpose

is always a must now

if you're wondering

what a line X destroys

it is a Linux distribution

that has been curated to perform

security related tasks on most
of the time a lonex distro will
have a line X base of the Ubuntu

or Debian flavor and the usually

Some custom tools pre-installed

in it as well.

As you guys know

line X is the best choice

for Security Professionals

for obvious reasons.

And hence.

Most of the Destroyers

are usually built on it

a line X distro can help you

in performing analysis

ethical hacking then iteration

testing digital forensic task

and various other

auditing purpose,

but guys apart

from these destroys.

There are other open

source tools as well that you

can bundle and use as

per customer requirements,

but using these destroys

have lot of advantages.

Like first default,

they save a lot of time and

effort that you need to spend

when you are dealing

with customer requirements.

Secondly the help

beginners to easily start

with security testing

without having to get

into the nitty gritties

of operating system.
And lastly the most

popular reason is you have

great pool of distros

that you can choose from most

of the time Kali Linux is

the obvious first choice

of operating system
for every new hacker.

If you ask me why

the obvious answer would be

because Kali Linux is lot

of cool things it comes bundled.

With the curated collection

of tools moreover.

These tools are organized

into easy-to-navigate menu

and a Lifeboat option.

That's very new be user-friendly

as an it's very friendly

to new ethical hacker,

but guys cullinane X is

in the only distribution

which is targeted at pentesters.

There are many exciting

Alternatives that may better

fit your use case.

Anyway, let's begin

our discussion with Kali Linux.

It was developed by
a fancy security as a rewrite

of backtrack Kali Linux distro.

Those tops the list

of best operating system

for ethical hacking purposes.

And then there is

parrot security OS

which is our today's discussion.

It is a mixture
of Frozen box operating system

and Kali Linux.

It's the second most popular

operating system vertical acting

and penetration testing is well,

and then you have

back box Linux.

It's a win to based operating

system with its focus mainly

on security assessment
and penetration testing.

Then you have been

to and excellent

hacking operating system

with wide variety of tools

that you can choose from Apart

from this you have deaf clinics

blackout lining cyborg backtrack

and many others.

But as for today's session,

we will be discussing
about parrot operating system

that it OS is the second most

popular Linux distro vertical

hacking after Kali Linux.

It is a comprehensive
portable security lab

that you can use for cloud

penetration testing computer

for insects reverse engineering

hacking cryptography

and many other

security purposes.

Now a little bit about

his history the first release

of parrot OS appeared
in April 10 2013.

Originally it was developed

as part of Frozen box.

Now it has grown

to include a community

of Open Source developers

Professional Security Experts

Advocates of digital rights

and Linux enthusiasts

from all over the world.

Well compared to others

para sacar TOS promises

a lightweight operating system

and it's highly efficient along

with its plethora

of Recognize tools you also

get the opportunity to work

and surf anonymously

which is like a granted wish

to an ethical hacker

or any penetration tester

will learn about other features

in the later part

of the session.

So moving on since its release

in 2013 parrot has grown rapidly

and currently offers

many different flavors targeted

towards different use cases.

For example,

like I said,
we have para security.

It's the original parrot OS

and is designed
with penetration testing.

Forensics hacking development

and privacy in mind then

you also have parrot home

which is targeted
towards desktop users.

It strips out
the penetration testing packages

and presents are nicely

configured Debian environment.

Then you have parrot

are it's focused

on wireless penetration
testing borrowed Studio.

It's designed with

multimedia Creation in mind.

Then you have parrot

Cloud the most popular

it Target server applications

giving the user access

to full suit of penetration

testing tools included

in part security.

But it doesn't have

a graphical front end

like we do in Paris
security moving on.

We also have parrot iot.

It's designed for low

resources devices such as

orange Pi Raspberry Pi

and you have pine

64 and many others.

So it's true

that pallet security was

doesn't have large community

of users behind it
as Kali Linux dust,

but the distribution

has been gaining a lot

of momentum recent years.

So things could be
very different just a year

or two from now.

So let me convince you more.

Let's just discuss A features

of parasitic rtos.

Let's start with

the system requirement.

It's based on Debian 9.

It runs on a custom

hardened line X 4.5 kernel

uses a mate desktop

and light DM display manager.

It requires a minimum
of 256 MB RAM

and works with both 32

and 64-bit systems as well as

a are incompatible version apart

on this parrot OS can also

be installed on cloud

and updated to perform

cloud-based security.

So basically it
runs on Debian 9.

It is compatible with 32
as well as 64-bit systems

and a RM systems as well

and it requires a minimum

of 256 MB RAM.

So those are the system

requirements moving on it

also supports anonymity.

It offers a tool called and non

surf including anonymization

of entire operating system.

It comes with custom-built

anti-foreign sick tools
interfaces for gpg and crisp

that up originally it also

supports Bose encryption tools

such as Elle UK has truecrypt

and veracrypt and many others

moving on it also supports

forensic boot option

to shut put Ottomans

plus many more it braces

Falcon programming language

multiple compilers debuggers

and Beyond it also

provides full support

for developing Frameworks

for embedding systems

and many other amazing features.

So Guys, these are

few features of para todos.

So basically parrot
operating system supports

and Amity it offers different

kind of cryptography tools.

It also supports forensic mode

and it also provides opportunity

to develop Frameworks
for embedded systems

and many other amazing

features moving on

before you go ahead and use

parrot OS there are

some important considerations

that you need to take

a look at first

of all parrot towards provides

general purpose features,

like any other normal

operating system,
but guys before you go ahead
and use para Todo es there are

some important considerations

that you need to take

a look at first.

Of all it provides
general purpose features,

like any other normal

operating system does

but at its core it

is still tuned for security

and foreign six.

Now, let's see

how different parrot OS is

from other distributions.

Bharat is different from

a general-purpose distribution

because it does not try

to hide its features.

For example, there is a tool

called parrot update reminder.

It's simple yet powerful program

using this program.

You can check for system

upgrades once a week,

but instead of hiding

the upgrade process behind it.

This part like any

other operating system.

It shows the user

the full update process

from the APT output.

So you can see the upgrade

process going on.

Secondly parrot was designed

to be a very comfortable
environment for Security Experts
and researchers.

It includes many basic

programs for daily use

which other penetration

testing distributions usually

exclude part security includes

its own sandbox system.

I mean, it provides a secure

distribution user applications

and parrot are protected

to Emmett the damages in case

if the system
is compromised anytime.

So this way no harm is caused.

So like we discussed earlier

it also supports Digital

four and six digital forensics

experts need an environment

that does not

compromise their proof.

So pirate comes
with Autumn and functions

which are disabled by default

to all of four and six

Acquisitions to perform

in a very safe way.

So before you go ahead

and choose any

of these operating system,

make sure you check

out their features.

The services they offer

and make sure that

if they are suitable

for the task,

which you want to perform

but as for Peridot s

these are its features

we discussed earlier

and these are the certain points

that you should take

into consideration

before you go ahead and use it.

Now if you're wondering who

the parrot security

is made for well,

it's made for Security

Experts digital forensics

experts engineering
and IIT students researchers,

you have journalists and

activists as well in the list

and you have the new be

hackers police officers

and special security.

Institutions.

So basically if you ask me

it's suitable for a student

or the entry level

Security Experts as well.

So first, I'll show you

how to install para

sacar TOS on VMware.

So basically when it
comes to installation,

you have two options,

you can install

parrot security OS

alongside your operating system

using dual boot option

or you can install it using any

of these virtualization software

like virtual box or VMware.

Ask for today's session.

I'll show you
how to install it using VMware.

So let's get started

with our installation.

So, where is this search

for the pirate security West

and it most probably the first

link that you find on the net.

This is particle
TOS official website

as you can see,

there's a little bit

about its history.

Its features.

It says it's based on Debian.

It's designed for security

development and privacy in mind.

It also includes
a laboratory for security

and digital forensics experts

along with that it also focuses

if you want to develop

your own software

and all that and it's

project goals mostly a security

privacy and development.

This is the Which you should

consider important development

unlike other operating

systems its features.

It secure lightweight

when compared to Kali Linux

or any other operating systems

and it's a free source.

So go ahead and explore it.

So as for the download options,

you can go for

security addition here

and the download menu here you

can see other options as well.

It says home edition security

and other bills we discussed few

of the flavors of pirate.

Orsolya.

We discussed pirate home

part are part student

when you lose any weight

If you're concerned
with parrot security four point

five point one is a current

version that's running.

So you have two options

here to download.

First of all take

a look at the size.

It's 3.7 GB and 5.9 GB.

So make sure whichever

you want you downloading it

depending on your operating

system requirements.

And as you can see,

this is a lifeblood installer.

I so this is
a virtual Appliance.

You can choose any of these

if download is taking
a little longer

than you expected.

Maybe you can go

for mirrors or a torrent.

So I've already installed it.

I'm not doing it I have What is

a file as well as the Soviet

format installed as well?
Next thing we need
to do is install VMware.

So VMware VMware
Workstation Pro.

So you have
a download option here.

You can go ahead

and download it you have

for the free option yard

also have VMware Player.

I guess fate here.

I go the Ling sorry

about that here in the downloads

so you can go
for a workstation Pro

or you can also go

for workstation play

or hear any of this

with civil suits you have

he downloaded it.

It's going to take for a while.

And then all you have

to do is install click

on next and finish

the installation process.

So before you start

your virtual machine,

make sure you have

your parrot OS image ISO file

or Ruby a format
which ever is of your choice.

And then here we go

VMware Workstation homepage.

Yeah, as you can see

I already have a pirate

OS operating system installed

your or washing machine install

your this is I have install
it using ISO file.

It's very easy.

I'll show you how to do it.

But if you have ovf format,

all you have to do is click

on this file menu.

Open and as you can see,

I have a particle T over here

and click and import it.

That's all click select it

and click on open.

So I'm not going to show you

how to do that.

So it's very
straightforward process.

That's it.

This is my ISO file.

Let me show it to you again

how to install it.

Anyway current file

or you can just go for create

a new virtual machine.

Yah, click on next

and attached ISO file browse.

I have it in my
local this T here.

I have a pair of security

and open next it selinux it did.

Bian latest version

which is 64 bit and click

on next give any suitable name

for your virtual machine.

Let's say parrot

secured t Okay,

Wes and click on next.

Let's assign about

40 GB it again.

Depends on what you want to do.

If you're doing heavy tasks.

Maybe you can assign more disk.

So as it a store-bought
shall discuss a single file

or split into multiple files.

I'm going to choose single file

click on next and you

And always go ahead

and make this customize Hardware

settings earlier or later,

but you can do it now as well.

Customize Hardware.

I have not connection as

for network adapter

memory 5 to well,

let's just say 2 GB and not

yeah, we set processors.

I'm just designing one

for now cool and clues.

You can see the changes

which are made

are displayed here.

Once you're satisfied

with your settings with that

you made click on finish.

You're good to go your cigars.

System is been displaying

your so like I said,

you can always make

settings later on.

You have the set it question

machine setting options here.

Just click on this.

Let me maximize
the screen for you guys.

So as you can see the parrot

security ISO is very flexible.

There are quite a few options

you have live mode.

You have terminal mode

you have Ram mode.

So basically live mode is just

a standard live USB boot option

just like you can see

while you're installing

Kali Linux suppose.

If you don't know

how to install Kali Linux,

there's a video on how to

install it as well by durocher.

You can refer to that

in the the clacking playlist.

Okay, so coming back.

Sorry about that you

have Have a persistence

more encrypted persistence

foreign six mode

and all that terminal mode.

As you can see is

out of the live boot option.

But without graphical user

interface the most popular one

among new hackers,

or if you're the first time

user is install option

with a graphical user interface.

So it's almost familiar

with Kali Linux users.

If you want to get a feel

of parrot security
if analyst features,

maybe you can give

for live mode,

but if you want to get just

started then you can always

go for install mode.

I'm going to click on that

and click on standard install.

So it's mounting all

the installation tools

and all that.

So once the machine is booted

up you'll be asked to select

your preferred language

the broad menu select

the graphical installer options

and click on let's say English

and United States

American English.

So then the loader

will automatically install

some additional components

and configure your network

related settings.

It might take a while.

So basically then
the installer should prompt

you for a host name

and the root password.

Let's give some root

password give the password

of your choice reenter

the password for verification.

And now it's gonna ask you

to set up a user apart

from the root user.

So let's just say

test user continue.

I'm going to keep it

as tests continue

and choose a password

for the new user

which is different

from the root user password

that you'll have to remember.

What so just give this new user

a passport continue
re-enter the password?

Okay.

Let me just go back

and my mistake.

Let me try it again.

Select your time zone.

So basically after
you've set your password,

it's asking you

for the time zone.

Let's say central eastern.

So now the installer

will provide you four choices

about the partition of the disk.

The easiest option

for you is to use guided use

entire disk option

which the first option here

experienced users can always go

for manual partitioning method

for more granular

configuration options.

So yeah Gaiden partitioning

I'm going to select

that guide use entire disk.

This is the disc

we're going to store

so it's asking

if you want to store all files

in one partition or different.

Let's just say all files in one.

Mission and hit on continue.

So now we will have

to confirm all the changes

to be made to the disk

on the host machine be aware

that continuing will erase

the data on the disk.

So after that you can just click

on finish partitioning

and writing disk thing.

It's asking if you want

to write the changes

to the disk, obviously.

Yes.

So click.

Yes.

So once aren't confirming

the partition changes

the installer will run

through the process

of installing the files let it

install the system automatically

this may take a while.

So I'm we'll meet you guys

once installation is done.

So once installation
is done It'll ask you

if you want to install

the GRUB boot loader

on your hardest just say yes

and click on enter device

manually or sorry
just click the device,

which is already there go back.

The installation process

is now almost complete.

So guys the
installation is done.

Once the installation is done.

You can see the machine boots

you intimated desktop

environment as an if you

have chosen to install

option will be presented

with a light DM login screen.

So basically you'll have

to enter the password

and the which is set up

for the test use earlier.

Not the root password.

Please do remember that.

I'm sure you remember

setting up a password

for the user right

that password and login.

So here we go.

So guys here we are

as you can see

the machine boots you into

the mate desktop environment.

Let me pronounce it
M80 you can call it

whatever you want mate

or mate desktop environment.

So as you can see,

it's very good looking apart

from that parrot Security

will automatically detect

when updates are available

and prompt you to update

the system as soon as you

install it here.

It's not showing it to me

because I've already updated it,

but Otherwise, all you can do

is just go to the terminal here.

You can see terminal option

here right go to terminal there

and just say sudo apt-get update

last me for the password.

How'd it go?

Might be a matter of updated

in another virtual machine.

Anyway, I installed
the other one as well.

Maybe it's in that anyway,

I'll update for you.

So let me just minimize this

while it's updating.

Let's go ahead
and do other things.

So it's almost done I guess.

Yeah, as you can see

it's almost updated

and it says 116 packages

more can be upgraded and if I

want to have to run update list,

if you want to see

which of those packets

are have to just list out

those using app command.

Yo, I'm not showing

you two guys.

So anyway when you're making

you First make sure you system
always stays updated.

Okay, let's go back

to exploring parrot towards so

as you can see

system is laid out

in a very straightforward manner

with a collection of tools that

you might be familiar with.

If you're using Kali Linux

before the menu system is

almost similar to Kali Linux

and it's very easy to navigate

the real differences

that parrot security is meant

to be used as a daily driver as

in your regular operating system

through the other things

as well to prove

that you can see you have sound

and video options here a lot

of Grabbing languages options

as well you have system tools

and you have Graphics included

you have office applications

of software's you have base.

You have math writer

and planner just like any other

normal operating system.

So while you can use color index

as a desktop workstation,

it is really is a penetration
testing distribution first.

I'm talking about Kali Linux.

So with curly you need

to build the system

towards being a daily use system

as in you start using
Kali Linux you need to modify

or you need to customize it in.

Your way that you make

it more plausible or easy

for you to use

for the daily purposes,

but that's not the case with

parrot security OS its interface

and everything is so good.

It almost appears
like a normal operating system

and it is like a very

normal operating system.

So you have
your penetrating distance

which are there and along

with that you have

your day-to-day applications are

also there in this now talking

about the system requirements

the default palette

Security install uses

about 300 13 MB of ram.

So as you can see here you

can see The squad little bar.

It's like a task manager,

which you can find it in

your windows can click on that.

It will show you all

the progress that's going on.

First of all,

it says the pirate gnu

Linux system in the release

and the colonel

all the information

about your ISO file
and you have made
desktop environment here

in the hardware,

which is this and the presser

it's based on available space

and all that when you

click on the processes,

it shows all the processor

which are currently

running sleeping just

like your task manager.

And your Windows

operating system.

So yeah, like I said,

it requires about 200 13 MB

of ram approximately around that

but of course,

this is only system

related process running

when compared to Kali Linux.

It's very lightweight

callanetics install requires

about 600 4 MB of RAM

and that too only with system

related process running.

So, like I said,

it's a very lightweight system.

So yeah, the bar is

a task manager it
lists all the processes

that are running and all that

you obviously have a terminal

which I showed earlier

the Cool thing with terminal is

that it goes
with their interface.

Other than that.

It's pretty much
like any other normal dominant.

And then there is a pure ends

of the interface.

I mean my first reaction

when I saw it was wow, amazing,

right when compared

to the plain Kali Linux.

So yeah, you get

to use cool collection

of wallpapers as well.

You have change

desktop background here you

have fonts interface and see

you have quite a lot

of collection of wallpapers

and you can go ahead and add

your Customs as well.

That's all about the interface.

And like I said,

it's like any other

normal operating system.

So it comes with a lot

of programming languages

and a bunch of text editors.

You also have IDs as well.

It uses plume as
your default text editor.

So that's it

when talking about the normal

operating system not talk

about the performance

almost all of his know

that color index is a bit laggy

and when you run it

on a low-end system,

sometimes it's like a nightmare

when you have Have
Brute Force attack going on

in the background.

Are you doing something else?

It's gonna be worried say stock

or it's very slow but imperative

it's very lightweight

and doesn't like much

as you can see,

it's smooth now talk

about Hardware requirements.

Pretty much both Kali Linux

and your parrot required

high end Hardware,

but Pat, it needs

low specification Hardware

as compared to Kali.

So if I have to conclude

and one board parrot is

a good-looking distro.

It's very lightweight

its resource friendly

and Want to know

how much resources

consuming and all

that you can always go

at click on the little bar,

which is available there.

Click on the resources.

You can see the CPU is

tree memory Network history

file systems and all that.

So basically it's
a good-looking distro

lightweight resource friendly.

All this features apart tight.

Security Os Os has pretty good

collection of features as well,

which we discussed earlier.

It comes like what hell

lot of tools,

but if you see the sections,

there are a lot of other things

which are not in Kali Linux.

So the most A pointed

tool here is

that in Kali Linux is supposed

want to say private

when you're doing hacking

or any other stuff.

You have to install

a non serve tour

and then enable them

or proxy chain.

You also have the option

of proxy chains to stay yourself

Anonymous on the system

by you doing hacking

or pen testing or anything,

but with parrot OS you already

have an answer of pre-installed.

All you have to do is click

on the start button.

So let me show you

how to stay Anonymous.

So this is one
of the best feature

and Palette security OS

it has proxy change.

As well as an unsafe to make

yourself an anonymous

so you can go for this announcer

of and click on and on

Star talk before that.

You can check your IP

of your system.

So it says 1.65 1.73

doesn't just remember

it don't have to note

it down anywhere.

Well, not 651 76 now now

if I go and enable
this first of all L ask you

for the administration

passport give that Okay.

So basically once you

enter the password,

I'll ask you

if you want an answer

to kill the dangerous process

which that can be D anonymize

you are clear cache files

or modify your IP table rules

and all that.

It'll ask you

if you want to do
that just say yes.

So basically as
soon as you click on S,

as you can see the notifications

here the tool will attempt

to kill dangerous processes

that can be anonymous you

anytime it will clear

your cache files.

It will modify
your iptables modify your

Of config file disable your IPv6

and only allow you

the outbound traffic through top

as you can see it's a store

is running started for you.

Imagine doing all

this stuff by yourself.

If you don't have

an answer fly can call it an X.

This would be quite a bit

of effort manually,

but with the script

already present here,

it's just a click away.

So parrot security
also includes a seminal script

for i2p as well apart from that

once you've enabled

you can also check

like I said your IP address now.

So as you can see it says Global

Anonymous proxy activated dance,

like no one's watching encrypt

like everyone is so

basically it's saying

the surf is started out.

As you can see my IP address

has been changed it

for something of 160 something.

But right now it's 182.

So on and on surf has made

me Anonymous now,

I can do whatever you want

in an anonymous mode.

So that's all I wanted to show

you here now back to Firefox.

It has quite
a documentation part.

Well, it's still

in the creation stage here

is you can see documentation.
It's not all that well prepared
or created yet.

So if you have any minor dot

you can go ahead and refer

to the Documentation party.

Oh, so here you go.

Okay, then let's go

back to the Destro.

One thing that you can point out

about parity with is

that it has a lot

of cryptography tools such as

it has Zulu script Zulu mount

a graphical utility

that will help you mount

your encrypted volumes.

Then there is something

called Crypt Keeper.

It's another graphical utility

that allows you to manage

encrypted folders and much more.

These agilities
makes confidential.

LT easily accessible anyone

with the minimal experience.

I mean if you do not have

any idea about cryptography you

can easily start learning your

that's what I meant.

So it just doesn't stop

with cryptography or a non surf

you have lot of other tools

which you might not find

and color next.

So let me show
you guys that part

as you can see you have lot of

tools you have most used tools,
which is Armitage.

You have Wireshark Zen map

over a span all

that then you have

wireless testing tools.

Give me a second.

Yeah, post exploitation this set

of tools mostly you can't find

them in the Kali Linux.

You have OS back door

towards webpack dough tools.

You have web Covey

bleep and all that

and you have something called

social engineering kit.

If I'm right.

It should be
in the exploitation tools.

Whereas exploitation here

how you can see a social

engineering tool kit just click

on that password.

So it is started up all that.

So if I just click one,

you have a lot of options

the update set configuration you

have Social Links.

Attacks you have different type

of attacks here.

You have power

shell attack vectors.

You have mass mailer attack

you have phishing

attack vectors and all that.

So basically you can click

on that and enable all
that acts not going to show you
in this demo how to do it.

This is just the basic

introductory video

about Peridot s.

So, let me just

close the terminal

while there are common tools

like you have nmap.

I'm sure you know

how to use nmap.

Let me just show you anyway

and then map is one

of the scanning tools.

You can find it

in information guy.

Drink, I'm short and map

is you're here to one

of the basic tools.

Okay, let's just explore and map

and Demetria here.

Let me just show you

how to use nmap first just

click and map you have

all the help or then

map configuration options

are displayed in front of you.

If you don't have to use

just go through them.

It's pretty easy

a simple example.

I'm already using the one

which is already there.

Just say scan me

dot nmap dot orgy.

Okay your aegyo making

spelling mistake again.

Sorry about that.

It's gonna take a little while.

That's all while it's scanning.

Let me just show

you another tool,

which is Dimitri.

It's a deep magic

information gathering tool.

It has ability.

So here it is.

It should be in the information

gathering only you

have your here goes.

So basically, like I said,

it has ability to gather as

much information as possible

about a hose subdomains.

It's email and

formation TCP port scan

who's look up and all that.

Let's just check out.

Then map scanning is done.

Here is the terminal.

Yeah, it's gonna take

a little while.

So once the scanning is done,

it's going to show you

how many seconds it took

what are the pores

which are open

and the close personal

that now about the material

you can enable it

from your dominant,

but you can also do it

from here information gathering

and click on the me.

Try password.

So let's say Huh?

Here we go.

So let me maximize.

All you have to do is

you have lot of options here.

You have W,
which performs a who's look up

you can do it online as

an using Firefox as well.

You have a lot of websites

where you can gather

all the information

once you have your IP address

or and all that

and you have retrieved

and crafts outcome information

on host perform search

for possible subdomains

email address and all that.

So basically you can give

all this options in one go.

Let's say TR y - -

option taste output

your host or text or to

the file specified by -

oh, so I just press click 0,

let me just gives pseudo.

Let me just check

if I've given any file here.

I do have a file
called test dot txt.

Okay.

So like I said
in the iPhone option,

it will save your output to

the dot txt file out of the file

specified by - no option.

So basically just
specify the filename

where you want to store

the all the scan info.

Whoa, and the website

where you want to website

of whose information
you want to scan.

So let's say the blue

dot pinterest.com.

Here you go.

It started scanning.

Let me just scroll up.

The host name and the host

IP addresses showing

once you have IP addresses,

you know can gather almost

all the information.

It's also showing the places

where it's coordinated.

It's created lost modified.

You have sources you

have address here

and then yeah last modified

created sores and all that.

So basically it's showing a lot

of information here.

Similarly.

You can using Dmitry

or a deep magic information

gathering tool you can actually

gather information about any

other website you want to know.
Let's just check out
if in map is done scanning.

So see as you can see it's done.

So I've given a website name

here instead of that.

You can go ahead

and give the IP address

which is this one

and it will show you

the same results as you can see.

There are a lot of ports

usually nmap scan is

about more than thousand votes

as you can see.

It says 992 of the clothes pose

and these are the open ports

and suppose you want to know

more information about each Port

because basically if your hacker

if you try to hack something you

don't need information

about all the ports.

It's basically the One port

which you want to so to know

that you can there are

a lot of options

which are provided by a map.

If you want to know more

about by and Map There's

and video and I'd wake up

playlist all about in map.

It's under network security.

So you make sure

to take a look at that.

So while you are taking a look

at particular device,

make sure you go ahead

and watch a video
on Kali Linux as well.

So you will know

how different Heroes

and color index are

though they are similar

in few parts.

So that's it about system

as in parrot OS so

like I said, it's

On good-looking distro,

which is lightweight
when compared to Kali Linux

and lot of tools lot

of unique tools as well.

When compared to Kali Linux and

it's very smooth away smooth.

Oh apart from all

these good things.

There are a few things

that are problematic

with part ways.

First of all,

like you don't find

our search body.

Oh, that's not a problem.

But that's one demerit

you can say and it's

also a little problematic

when it comes to launching your

application the process LL slow

and like Carla lineage.

So guys, this is your

parrot OS so basically Lee

this was a crisp video

on what parrot devices

it's review its features
and all that and make sure
to watch a video on pero no es

versus Kali Linux.

So Linux has been known

for its various distributions

that cater to various needs one

of the most famous

distributions is Kali Linux

that is a penetration
testing oriented distribution,

which was built to bring

about much-needed Corrections

in its previous.

Duration known as
backtrack OS now

since the release of Kali Linux.

It has gone

under various iterations

in the form of updates

while other penetration testing

and security related

distributions were also

being developed all

around the world.

So in this session,

we will compare Kali

to One Source distribution that

has come under the spotlight

and that is parrot OS

so today in this video.

I will first be giving you

guys a brief introduction

to what exactly is Kali Linux.

And then I will also give

a brief introduction to

what parrot OS is then

we will be comparing Kali

versus parrot according

to various parameters.

So let's move ahead now.

Let me give you guys

a brief introduction

to what Kali Linux is.

So Kali Linux is a penetration

testing and security

focused operating system

as the name suggests Carly has

a Linux kernel at its core above

that the creators

of Carly Marty are Oni

and Devon Kearns.

Added the latest injection

packages to help pentesters.

Save some time Kali Linux has

developed according to the DB

and development standards

and it was developed as

a refined penetration test

during distribution.

That would be served as

a replacement for backtrack OS

currently the development

of Carly is being handled

by offensive security,

which is the organization

that provides prestigious

certifications, like oscp osce

and Os WP over the years.

Carly has developed its own cult

following with people

who swear by the word and by

the power provided by Kali
while I may not be
such a staunch believer

in Kali Linux.

There are plenty of reasons

for want to use curly for one.

It's absolutely free.

Secondly.

It comes pre-installed

with tons and tons

of penetration testing tools

and security related

tools above that.

It can be completely customized

according to your needs

as the code is
an open-source get tree

and The whole code

is basically available

to the public to be tweaked.

Also the kernel

that runs Kali Linux comes with

the latest injection packages.

And it also comes

with gpg signed packages

and repositories above that.

Kali Linux has

some true multi-language support

and it was developed in

an extremely secure environment.

Also Carly supports a wide range

of wireless devices now

at this moment Callie

may seem like a very

useful operating system.

But as you guys might

remember the great quote,

From Spider-Man create

power comes with
heavy resource utilization

according to the official

documentation of Carly

the system requirements

are quite heavy

on the low-end Kali Linux

needs a basic of at
least 128 MB of RAM

and a 2 GB hard disk space

to set up a simple SSH server

that will not even have

the GUI of the desktop

on the higher end.

If you opt to install

the default genome desktop

and the Kali Linux

full meta package.

You should really Aim

for at least round 2 gigs of RAM

and around 20 GB

of free hard disk space

now besides the RAM

and hardest requirement.

Your computer needs to have

CPU supported by at least one

of the following architectures

them being amd64 i386

and Armel and AR M HF

and also arm 64 now,

even though the official

documentation says 2GB

of RAM is enough.

I have personally
faced numerous lag

and stutter issues

when running Carly

on a virtual machine

with 6G EB of allocated Ram

which in my opinion
is a definite bummer.

Now, let's take

a moment to discuss

about parrot OS so parrot much

like Carly is also a deviant

based distribution of Linux.

When I see Debian based,

it means that the

code repositories adhere

to the Debian development

standards para Todo es 2 comes

with its own arsenal

of penetration testing

and security related tools.

Most of these tools are

also available on Carly.

No, but it was first

released in 2013

and was developed by

a team of Security

Experts Linux enthusiasts

open source developers

and Advocates of digital rights.

The team was headed

by Lorenz of Elektra

and part is designed

in a very unique way

while the operating system

has everything that is needed

for a security expert.

It doesn't present itself

to be a daunting learning
experience for beginners

who want to set foot into

the world of ethical hacking

and vulnerability analysis.

But it OS can be very well

used as a daily driver

as it provides all

of the necessary tools

to complete day to day tasks.

So who exactly is peridot

s made for well,

first of all,

it is made for Security Experts

and digital forensic experts.

It can be also used by

engineers and IIT students

who are enthusiastic

about ethical hacking

then parrot OS can be also used

by researchers journalists

and hacktivists and last

but not the least

but it OS is also meant

for these officers and

special security institution.

Okay.

So now let's take a moment

to actually discuss
the system requirements

that one might need

to run parrot OS

so the system requirements

for Bharat is much

more forgiving than Kali Linux

on the CPU side.

You need an x86 architecture

with at least 700 megahertz

of frequency and architecture.

Why is you need i386 amd64

or AMD 486 which is basically

the X86 architecture

or are male and Armature

which are basically iot devices

like Raspberry Pi on the side

of ram you need at least 256 MB

on a nine three eight six

architecture three a 20mb

on an amd64 architecture

and as a general
documentation 512mb

of RAM is generally recommended

by the parrot zik OS people.

On the GPU side parrot

OS is very surprising

as it needs.

No graphic acceleration.

That means you can run this

without a graphic
card on the side

of hard disk space pirate

OS needs at least 16 GB

of free hard disk space

for its full installation.

That is for G 4 gigabytes

Left 4 gigabytes

lesser than Kali Linux and for

booting options both Kali Linux

and parrot OS have

the Legacy BIOS preferred.

Now comparing two operating

systems when it comes

to Parrot OS and Kali Linux

that are both operating systems

meant for similar purposes

that is penetration.
Testing.

In this case.

It becomes really tough.

Most of the factors in such

cases boil down to a matter

of personal taste rather

than an objective comparison.

Now before we move ahead

with the comparison,

let me list out

a few similarities that you

might have noticed between

the two operating systems.

So first of all,

both operating systems

are tuned for Operating

penetration testing

and network related tools

and both operating

systems are based

on Debian development standards

both of the operating system

Support 32 and
64-bit architecture

and both operating systems

also support Cloud VPS

along with iot devices.

And of course,

both of them come pre-installed

with their own arsenal

of hacking tools.

Now, let's get down

with the differences.

The first criteria

of differences that we are going

to discuss is Hardware.
Points now as you guys
can see on the slide.

I have put down the system

requirements of parrot OS

on the left hand side

and I have put down the system

requirements of Kali Linux

on the right hand side.

So as you guys can see parrot OS

and Kali Linux both need

1 gigahertz dual-core CPU

when it comes to Ram parrot

OS needs much lesser arm

than Kali Linux,

but it needs 384 MB of RAM

for its minimal running time

and Kali Linux needs

a 1 gigahertz of RAM.

The other hand in terms of GPU,

but it OS doesn't really

need a graphic card

as it has no need

for graphical acceleration Kali

Linux on the other hand.

If you're trying to run

the genome desktop version,

you will certainly

need a graphic card

on the other hand pirate OS need

16 GB of free hard disk space

for its full installation

and Kali Linux needs

20 GB of free space.

So basically parrot OS is
a much more lightweight version.

So we see that parrot

OS definitely wins
against Kali Linux

when it comes

to Hardware requirements due to

its lightweight nature not only

does it require lesser Ram

to function properly,

but the full installation is

also pretty lightweight thanks

to the use of the mate desktop

environment by the developers.

So basically if you're having

an older Hardware configuration

on your computer pirate

OS should definitely

be your choice.

Now the next parameter

that we are going to compare.

The two OS is in is look

and feel now this section.

Be boils down
to personal choice personally.

I prefer the minimalistic look

that is given by parrot OS

the interface of parrot OS

is built using the Ubuntu

mate desktop environment.

There are two clear

sections on top you

see a pain which contains

applications places systems,

which is much like Kali itself,

but it also gives

some cool information

about CPU temperatures

along with the usage graph

and the bottom pane

contains the menu manager
and the work station manager,

which is a brilliant addition

to the Linux system Kali Linux

on the other hand follows

the genome desktop interface

while it still
has the functionality

that is offered by para Todo es.

It doesn't provide
the same clean and refined

look in my opinion.

If you don't know your way

around a collie interface,

it is pretty easy
to actually get lost.

Now, the next parameter

that we're going to compare

them is hacking tools now

since both these

operating systems are

For penetration testers

and ethical hackers.

I think hacking tools is

the most important criteria

that both the operating systems

are going to be compared in so

when it comes to General tools

and functional features para

Todo es takes the price

when compared to Kali Linux

pirate OS has all the tools

that are available in Kali Linux

and also it adds his own tools.

There are several tools

that you will find on parrot

that is not found on Kali Linux.

Let's take a look

at a few of them.

So the first on that you

see is called Wi-Fi Fisher

now Wi-Fi fish oil is

a rogue access point framework

for conducting
red team engagements

or Wi-Fi security testing using

Wi-Fi Fisher penetration testers

can easily achieve a man

in the middle position

against the wireless clients

by performing targeted
Wi-Fi Association attacks.

Wi-Fi Fisher can be further

used to mount victim

customized web phishing attacks

against the connected clients

in order to capture credentials

or in fact the victim

With some sort of

malware another tool

that is seen on parrot

and is much appreciated

that is not seen

on the Kali sign is called

a non surf now being anonymous

for a hacker is the first step

before hacking a system

and anonymizing a system

in an ideal way is
not an easy task.

No one can perfectly

anonymize a system and there

are many tools available

on the internet that see

that they are no no my system

one such tool is
a non surf now, announce.

So of is pretty good

as it uses the tour iptables

to anonymize the whole system.

Also, if you guys

have not already realizes

tour also also comes

pre-installed on parrot

while it has to be externally

installed on Carly.

Now these things that you see

that Wi-Fi Fisher Tor Browser

and announcer surely

they can be imported

and download it on curly

but they don't really come

pre-installed and that is

what counts right now.

So since pirate OS
also Is designed

with development in mind

it also comes pre-installed

with a bunch of useful compilers

for various languages

and ideas for their

respective development,

which is completely absent

on the Kali Linux side.

So for this part of hacking

tools parrot OS definitely takes

a price now the next thing

that we are going

to compare both y'all both

these operating systems is

release variations now

both operating systems come

with a variety of variations,

but part OS has
much more diversity

in terms of variety.

So let me just explain

what I mean.

So as you guys can see

on the left-hand side,

I have listed down

the release variations

that are available

for parrot OS now aside

from the full editions,

which is both provided

by parrot and Kali.

They also both provide the light

additions on parrot side

and the light Edition

on Carly side.

They are both basically

the same thing.

We're in minimalistic tools

are actually pre-installed

and you can Install and

customize the operating system

according to your own needs.

If you don't choose to customize

the operating system,

you can very well use

it as a very lightweight

and portable operating system.

So Peridot a slight addition

and Carly light additions

are two flavors

of the operating system.

Now, this is

where the difference is

such differences start.
So parrot os are
Edition also exist.

So this is an addition

that is used
for wireless penetration,

testing and wireless

vulnerability testing.

So basically anything
Thing Wireless parrot

OS erudition does it faster

and does it better then?

There's also parrot

OS Studio Edition,

which is used for multimedia

content creation Yes.

You heard that right part

it OS can also make content

for your social media.

So if you're thinking
about using part OS

for marketing as well as

security deposit OSU has

definitely your go-to

operating system Carly

on the other hand aside

from its light version

and full edition offers.

Some desktop interfaces

like the E17 KDE and xfce

the Ubuntu mate and the lxde.

So these are
basically just skins

that run over Cali

and basically make

Ali look a little different

from one another you

can check out all
these different customizations
on the khari documentation.

Other than that Callie

has also support for cloud

and iot devices in the form of

the Armel and arm HF releases.

These releases are

also available in parrot over.

ESO para Todo es

doesn't stand down.

So as you guys see Peridot s

provides you a lot

of diversity in the variety

that it is offering.

So in my opinion parrot
OS also takes the price

in this section.

Now the main question remains

which of these two distributions

is better for beginners Well,

it is to be duly noted
that both these distributions

are not exactly

meant for beginners.

If you want to learn about Linux

as an operating system,

you're better off using

something like Go bond

to or deepen.

This also doesn't mean

that you cannot learn

the basics on parrot

or Kali on the other hand.

If you are already knowing

the basics of Linux

and want to get your hands

on an operating system
to learn ethical hacking.

I would personally recommend

using the parrot SEC OS light

addition this is

because the light version comes

with the bare minimum

of networking tools.

This means as you learn

your ethical hacking concept

slowly you could develop

or install tools one by one.

Instead of being overwhelmed

with a whole bunch of them

from the beginning not only

does this allow yourself

to evolve as an ethical hacker

and penetration tester,

but it also makes sure

your fundamentals are built

in a methodical manner.

Now, I recommend parrot OS /

Carly for one other

reason to that is

because the default user

for Callie is Route.

This makes the environment

a whole lot more aggressive

and mistakes tend to be punished

and a whole lot more difficult

to deal with So this means

that parted OS is generally

the winner in my opinion.

When you get hired as

a penetration tester

or a security analyst one

of the main rules

is vulnerability assessment.

So what exactly is
vulnerability assessment?

Well, I've already possessed

man is the process of defining

identifying classifying

and prioritizing vulnerabilities

in a computer system application

and network infrastructures

and providing organization

doing the assessment

with the necessary

knowledge awareness

and risk background

to understand the threats

to its environment
and react appropriately to them.

So vulnerability is a situation

that can be taken

advantage of by a hacker

or a penetration tester

for their own misuse or actually

for fixing the issue.

So while I'm ready assessment

has three steps.

So the first step is actually

identifying the assets

and the vulnerabilities

of the system.

The second step is actually

quantifying the assessment

and the third is reporting

the results now vulnerability

assessment is only a small part

and Pen testing is

an extended process

of vulnerability assessment
when testing NG
or penetration testing

includes processes like scanning

vulnerability assessment

and itself exploitation research

and Reporting whatever

the results are.

So in the industry
was the most widely

used Frameworks when penetration

testing is Metasploit.

So Metasploit is widely used

in penetration testing

as I just said and also used

for exploitation research.

So some of you might ask

what exactly is
an exploit research well

in this world there

are tons of exploits

and the way to approach each

Of them is ever so different.

So what we have to do
is exploit all the research

that is available to us

and we have to find

the best way to approach them.

So suppose, for example,

you have a secure shell login.

So the best way to actually

approach secure shell login

until my knowledge is

that you have to get

a backdoor access

to this from the port numbers

that you can scan

via nmap or eczema.

Okay.
So without wasting
much time at looking

at prop and presentations,

let's actually get started as

to how we can use Metasploit.

So So Metasploit is a freely
available open source framework

that is widely
used by pentesters

as we just discussed.

So to actually
install Metasploit,

which is easily available

on Linux and windows.

I guess.

Let me just check it out.

So you go on your browser

and you time Metasploit

downloads now you just

visit the first link and

as you guys can see it says

it's the world's most

used penetration testing tool

and then you just download

the Metasploit framework

by clicking the
download button here.

So y'all might also

find Pro version

which is a paid thing.

And this has a little bit

of extra features

like group support

and actually helping a company

work as an organization,

but we don't actually need

that and practicing
our pentesting abilities.

So for that you just go ahead

and download Metasploit

framework and install it

on your system above

that there is another thing I

want to get make you guys aware

of and that is Metasploit table.

So when actually
been testing we need a server

or a website to actually
pen testing zone.

So normally this is

a very illegal thing to do

with our permission.

Ian so Met exploitable

has actually created

a server with a lot

of vulnerabilities on it

and it's called Metasploit

able to somet exploitable

to is easily downloadable
from this link

and it's a virtual box file.

So you guys must have

a virtual machine software

on your system to actually

set this thing up.

I'll also go through

how to actually set

up Metasploit herbal

because it has a lot

of configuration and network

management to go with it.

So we'll get to that later.

But for now,

let's get started

with Metasploit table.

So before that Metasploit herbal

is written in Ruby

and if you all know

Ruby coding and y'all know

how to make exploits

y'all can also always contribute

to the Metasploit community.

So Metasploit is one of the most

widely used pen testing tools

in the industry.

So what exactly is Metasploit?

Well, it's a framework

and what a framework is is it's

actually a collection of tools.

So these tools are majorly used

for penetration testing

and exploitation research

now one might ask

what Exactly is
exploit research.

Well, there are tons

of exploits out there

and there are tons of ways

to actually approach them

and this only comes to us

from thorough research as

to how we can approach each

and every exploit

in their best way.

So talking about Metasploit.

Well, it's open source and free

and it's also written in Ruby.

So if you guys know

Ruby coding and know
how to make exploits
y'all can always contribute

to the Metasploit framework now

talking about the download part.

Well y'all can easily

download Metasploit

from its download page,

which is -

Floyd.com download I'll

be leaving the download link

in the description.

And once you're

on the download page,

you'll see two versions

one is the free version

which is the original

Metasploit framework

and it's the core framework

that everybody works on

and then there's Metasploit Pro

which comes with

a 14 day free trial.

So Metasploit Pro actually

has a few extra features,

which is great
for an organization.

Like it helps
you work as a team,

but if you're a guy

who's just practicing pentesting

like me Metasploit framework,

Work the free version is

the absolute way to go now.

Also when pentesting

you all will also need

Metasploit table now met

exploitable is an intentionally
vulnerable Target machine
for actually practicing
your medicine flight skills

on so we will go

over the installation

of Metasploit table later.

But for now, let's go

over Metasploit table.

So once you guys

have actually downloaded

the link y'all can actually

install it on your systems

and Metasploit actually

has three interfaces.

So we are going to be using

the command line interface.

Or the msf console

in other words,

but you all can also use the GUI

interface which is called

Armitage if I'm not wrong.

So let's get started.

So first of all,

I've already actually

downloaded Metasploit

and install it on my computer

and y'all can just do the same

by pressing the download button

as you guys can see so

just start up Metasploit.

All you have to do

is go on your terminal

and so to start a Metasploit

all you have to do.

Do is go on your
terminal on Linux?

Well, we're starting

upholstery SQL Server
because first of all
the postgresql server

is the basis of all

the Metasploit exploits

that are stored and starting it

will just make it run faster.

So we go service post
gray SQL and start

so that's the start of a service

and indeed it has so next thing

you want to do is go in

and type msf console.

And that's going to take

a little bit of time

because I was very slow computer

and it's going to start

up our Metasploit free.

So as you guys can see you got

a big banner out here.

It says Metasploit cyber mesial

and it's the banner changes

every time don't get worried.

If you have a different banner

and the main thing is

that you should see

this msf thing out here.

So this means we are

in the msf Shell right now,

which is the
Metasploit framework shell.

So let's get started by

actually curing our screen.

So first things first

the first command that you

might want to run on a deployed

is the help command.

So help will tell us everything

that we can do
with this framework.

So as you guys can see

there are a bunch of commands

and the descriptions

to go along with it.

Y'all can give it a quick read

and find the things

that are interesting to you.

So as you guys can see

Banner is display

an awesome Metasploit Banner

y'all can change the banner

as you guys can see there are

a lot of Juicy commands

like there's a banner command,

which I just had used.

So if you go and die panel

will give you a nice cool Banner

about Metasploit and there

are other commands

which work very similar

to Linux like CD.

Changes the current directory

you can change the color

by toggling colors

and then you can connect to

the host and all sorts of stuff.

So Metasploit has
a bunch of exploits.

So before we go further,

I want to make you guys aware

of three important terms

regarding Metasploit.

The first is a vulnerability and

we had already discussed this

that a vulnerability
is a situation
which can be taken advantage
of by a system or a person

who axis so the second

part is an exploit.

So what exactly is
an exploit Yeah,

well an exploit is a module

which is a bunch of code written

in Ruby on Metasploit

that is used to Target

different vulnerabilities.

And the third thing

is a payload.

So a payload is
the action that you do

once you actually have access

to somebody system.

So basically suppose
you have hack somebody

and you've gained access

to their system.

Now the activities you do

after gaining access

is defined as the payload so

we just spoke about exploits

and I told you guys

that Metasploit has

a bunch of Right.

So how do we see all

the exploits that are there?

So you go show exploits.

Well, as you guys

can see we've loaded

up a bunch of exploits

which is basically
all the exploits

that Metasploit has

to offer at this moment.
So let me just increase
the screen a bit and let's cruel

completely to the top.

Yep.

So as you guys can see

show exploits give us

a bunch of exploits

and shows the name a description

a disclosure did and the rank.

So the name and description is

as it says it's the name

of the exploit and it's

a short description about it.

The disclosure date is

when the extract was actually

released by Metasploit

and the rank is

how it has fared

against the vulnerability.

It was released for

since it was actually released.

So as you guys can see

ranks range from Great good

and stuff and we have

a bunch of exploits.

So as you guys can see

there's an Android exploit.

There's a Samsung Galaxy

knocks Android exploit.

There are bunch

of Windows exploit

Adobe Flash exploit FTP exploits

MySQL exploit asp.net exploits

and a bunch of other stuff.

So as you guys can see there are

a bunch of exploits to use

and it can get confusing

and rather Troublesome
to search for the exploit.

You actually want to use so

as A pen tester you can always

go for the search keyword,

which is basically suppose,

you know that you

have a MySQL server

which has a bunch

of vulnerabilities and you

want to test those out.

So you simply go
search my SQL now,

I'll search the database

for all the exploits

that are related to mySQL

and present them to you.

Okay, so we have our results.

So as you guys can see

we have a bunch

of MySQL related module system.

Now at this makes it very easier

if you are a pen tester

and you're looking

for MySQL exploits

now suppose you choose

your exploit and let's see,

let's choose.

Which one do we
want to use today?

We're going to just use

this MySQL hash dump.

So to actually use
this we have to copy

the knee so double click on it

and it'll just select it and New

go Ctrl shift C
in your terminal

so that copies it and so

if you want some more

information about it,

you can always go info

and then just paste

in the name of the exploit.

So this gives us a bunch

of information actually

gives us all the information

you need about the exploits.

So it gives you the name

that it's a MySQL password.

Hash dump its module name

is Ox Terry scanner

and all this stuff.

It's licensed by Metasploit.

Framework in itself
and it has a normal rang

and these are all the options

that you might need to set

when actually using the exploit

and this also gives you

a small description.

So it says this module

extracts the user names

and encrypted password hashes

from a MySQL server

and stores them

for later cracking so seems

like really cool stuff.

You can do with ice cubes server

and its password database.

So if you actually
want to use this

so you have to use

the use keyword.
So we go you Who's
and control shift V?

So as you guys can see

it's denoted in red out here

that we are indeed and exploit

that we want to use.

Now.

The first thing you want to do

when you're using

an exploit is you want

to go and say show options.

Now as you guys can see

these are the options

that we actually need to set

before using the exploit.

Now the options can be necessary

or they can be optional

like so there's
a password field out here,

which is not really necessary,

but will help your exploit

if you actually provide it

but you need to provide

the our hosts

which is the targeting

host machine and the port

and the threads is already

set now suppose you want

to set the our hosts

so you can just go set.

Host and you can set it

to whatever IP address

you want like suppose you want

to address 192.168.1.1 56 some

of that sandwich.

I will set the our hosts.

You can also set the number of
threads now threads are actually

what the threads mean

and parallel processing

that mean how many parallel

threads you're gonna run

so that you have

faster computation.

So this means new need GPU power

if you have multiple threads

running So let's set

threads 234 now

so we've set the threads 30

and then you can go

show options again and see

that you have indeed

actually set your options.

So we've set the threats to 30

and our host has also been set.

So that was all about how you

can get into a module know

get some information

about a module and

how can also use them or you

so once you're done

using the module

or once you're done

setting up the options,

You can go ahead and run

the command run or even exploit

and this will start actually

running exploit on the system

that we want to now of put

in a very arbitrary IP address.

So and that not have

MySQL Port running

so our exploit feel now

once you have desiderio exploit

and you want to go
back to the main msf.

Unix shell just go

ahead and type back.

It's as simple as that so

that brings us back

to the msf command line.

I'm so let's go ahead

and clear our screen now.

Okay, so it's time

to do something interesting.

So to do that.

First of all,

we need to go ahead

and actually download

Metasploit able to so

download Metasploit able to do

you have to go on this link.

I'll leave the link

in the description.

So or rather you can just

go on your browser

and type in Metasploit able

to download so met exploitable

as we had earlier discussed

is a Linux based distribution

and It's mostly meant

for actually practicing

your pen testing skills.

So basically it has a bunch

of ports open on it.

So it's basically
just for your he's

so that you don't go ahead

and test it out

on some valid website

and then get thrown into jail

because that's a very
illegal thing to do.

So go ahead and download

Metasploit able to and then

also download Oracle virtualbox

machine Oracle virtualbox.

So you all can

also easily download

that from www.virtualbox.org.

And this is

because you should never run mad

exploitable to on a system

that is connected to a network.

You should always use it

on a virtual machine

because it's Protected

Their Faith so

that nobody else can access it.

So to actually set
up Metasploit table.

Once you've downloaded

it you go ahead

and open up your virtual box.

So out here you have

to go into Global tools

and you create a host only

network manager now already

created a host only network

manager and then you go ahead

and enable the DHCP server

by pressing this out here

like enable then you go back

and you just go new you give it

a name like whatever

you want to name it.

I have already named

mine Metasploit with to
as you guys can see.

So we're going to call this demo

for just demonstration purposes

choose a type to be Linux

and it someone to 64-bit click

next give it a gig of RAM

and you are going to use

an existing virtual hard disk

so out here you just click

on this button out here

and Browse to the place

where you actually downloaded

and unzipped your Metasploit

will download file.

Then you get this virtual

machine disk file,

which is with vmdk file

and you just go ahead

and load it up.

So I'm not going to do

that again because that's just

going to eat up my Ram

and I've already

installed it up to you.

So that was all

about the installation

and the configuration.

So now let's get started

and let's start playing

around with Metasploit.

So once you're done downloading

and installing Metasploit table

on your computer,

all you have to do is

Is go ahead and start it up

in your virtual box machine

and the login ID

and the password both are msf.

Admin.

So first of all,

we need the IP address

of our Metasploit double server.

So we go ifconfig
and this gives us the address.

So as you can see out here

are addresses 192.168.1.2 6.

101.

So once you've go ahead

and started a Metasploit herbal,

it's time that we go ahead and

exploit all the vulnerabilities

that is presented to us by meds.

Able to so do that.

Let's head back

to our Linux terminal again.

So once we have the IP address

that was 192.168.0 6.11

if I am correct,

so let's go

and quickly get a little bit

of information about that.

So who is 192.168.1.1
6.1 o 1 so this will give us

who is on Metasploit able to

and will give us a bunch

of information as to To
how the server is set up

where is set up?

The ports are open

and various other things.

So as you guys can see

this gave us a complete
who is so to get
some more information

about our Metasploit.

Double Servo.

We're going to be using nmap.

Now.

If you guys don't know about

how to use nmap you can go out

and check my other video

on the playlist of made

a pretty good and map tutorial.

So we go and map -

F - s and V which is
steel version and we give it.

the name or the domain name

server and 2.16 856 R11

So we've got a juicy result

out here and we can see

that there's a bunch

of stuff open.

So as you guys can see

there's the FTP poor open,

which has a version

of vsf tpd 2.3.4.

There's also openssh,

which is for .7 P1 DPN.

There's also tell languages

almost miserable to have talent

running on your computer.

Then there's SMTP.

There's HTTP and there's

a bunch of ports open

as you guys can just

see on your screen.

So it's We actually used

Metasploit like a pen tester

to go ahead and test

out these vulnerabilities.

So let's choose
these FTP things.

So we have this fdp out here.

So from the version number,

which is given to us by
the steel version flag

on and map we know

that it's using vsf tpd 2.3.4.

So we can easily search for

an exploit of the same version.

So as a pen tester you

would go search V SFTP D 2.3.4.

So this should give

us all the exploits

that are available for

this particular vulnerability.

So as you guys can see

after a long search

from the search vsf tpd,

we found a vulnerability

or an exploit that can take

advantage of the binary.

So it's time we
actually use this.

So first of all,

let's get some info

about this so info.

Let's copy down this thing

and then let's get

some info about this.

So as a small module description

says this module exploits

a malicious back door

that was added to be

SFTP D download archive.

This backdoor was introduced.

In the vsf tpd, 2.3.4,

tar.gz archive between June 30th

and voila voila.

So we have the options

of setting in our host.

It has an available targets

provided by these guys,

and it's a pretty good

exploit in my opinion.

So let's go ahead and use it.

So we go use
and love the exploit.

So it's visible to us

that again entered

exploit module which is eunuch /

FTP SFTP D 234 back door.

So what we're going to do is

we are going to actually

gain a backdoor access

to our met exploitable system.

So to actually make
this more believable.

So if you guys go into

your Metasploit herbal system,

so you guys can see

that That you are

in the root directory

so you can gain some root access

by going sudo Su
and going msf admin.

So we're now
root user in the msf.

Admin or rather
the Metasploit will console.

So if we go LS we can see
the various files and

if you go sleepy / home

when the home directory now and
if you do LS out here we can see

that there are a bunch of stuff.

So there's an FTP folder.

There's a hack Folder there's

a times of admin folder

and the service in this user.

So that's five folders

if you guys remember so now

what we're going to do is

we're going to gain

some back door access

into the system

and we're going to create

a bunch of folders

in the home directory.

So let's get on doing that.

So to do that we head back

to our marriage like terminal

and we go show options

as we had already
entered are exploited.

So go show options.

So as we see the options

that we have to provide is

the ER host and port number

now the port number

has already been set

because it's 21.

That's where FTB runs

or other TCP runs and we now

just have to set the host.

So to set the host we have

to just put it in the IP address

of our Metasploit herbal server.

So if I remember
correctly it set our hosts

to 192.168 / 56 Art 101.

So that has said are our hosts

so we can again check

that if we've done it correctly

by going show options.

And we indeed
have set our hosts.

Now.

All we have to do
is run the exploit.

So we go and hit run.

So as you guys can see

we have actually gained

a back door service

has found and handling

and the command shell session

has started now you

might be confused as to why

do I have this blinking line?

Well, this blinking

line actually means

that you are inside

the Metasploit herbal server.

That means we have already

gained the backdoor access

and is taking line denotes

that we are on the terminal

of Metasploit able to now

if you don't guys

don't believe me,

let's do some experimenting.

So as I had said,

I'll create a bunch of folders

in the home directory.

So let's change
the home directory first

or rather first.

You can also do a

who am I and instead you

that you're the root user

next you go and do CD / home

and I'll change

the home directory.

Now, let's make

a bunch of folders

like make directory.

This is a test.

So that should have

made a directory.

So let's go into
that directory CD.

This is a test.

So we're already
into the directory.

This is a test.

Now.

Let's make a file

called targets Dot txt.

So that creates 12.

So just to see

if you have actually

done it properly.

Let's go back
to our Metasploit herbal.

So Now in the home directory

you go and type in LS again.

Okay.

So let's type in LS and see so

as you guys can see

we have created.

This is a test folder

and it's already available
then so let's go

and move into that folder.

So this is a test and we

are already in that folder.

So I'm we are also

created a text file

which was called targets.

So that was LS

and it should give us

a Target start txt.

So as you guys just saw

we gained a backdoor access

into a remote system

through a vulnerability

that was available

to us on the FTP.

Port so we first did

that by scanning
the entire domain name server

of Metasploit table by nmap

and gaining some intelligence as

to what ports are running

and watch boats

are actually open

then we found out

that the FTP port is open.

Then we went on to Metasploit

and we found out exploit

that vulnerability very

successfully we found out

how to use the exploit

some information about

that exploit and in the end,

we actually executed at months

and we are already

in that folder.
So and we are also
created a Text file

which was called targets.

So that was LS

and it should give us

a Target start txt.

So as you guys just saw

we gained a backdoor access

into a remote system

through a vulnerability

that was available

to us on the FTP Port.

So we first did that by scanning

the entire domain name server

of Metasploit table by nmap

and gaining some intelligence as

to what ports are running

and what sports

are actually open.

Then we found out

that the FTP port is open.

Then we went on to Metasploit

and He found out exploit

that vulnerability very

successfully we found out

how to use the exploit

some information about

that exploit and in the end,

we actually executed at months.

Now you guys must be wondering

what exactly is and map

and why should I learn it?

Well and map is

a network scanner

that is widely used by

ethical hackers to scan networks

as the name suggests.

Now, you might wonder why
do I need a network scallop?

Well, Let me give

you an example.

So suppose you have a Wi-Fi

that has been set up

in your new house

and you realize

that your data is being actually

consumed at a faster rate

than you are using it.

Now.

You have suspected

that it's your pesky neighbor

who keeps on connecting

to your Wi-Fi and eating

up all your data.

So to actually confirm
all your doubts.

What you want to do

is a network scan

and nmap is a pretty

wonderful tool to do

that now nmap runs on Linux.

Mac OS and windows

and I'm mostly going

to be running this on Linux

because that's what I do most

of my penetration testing

and network testing on

so let's go ahead and get on

with the installation

of nmap on your computer.

So what you do is go
apt-get install and map now

for this you have

to be logged in as root.

If you're not logged in

as root just add pseudo

before this whole command

and it will install it now.

I already have nmap

installed so Um,

not really going to install

it again and again,

so let's just go ahead and just

do a few scans on our website

that is www.eddecosta.com

and we are going to see

what we get back as results.

So first of all,
let me just show you

how you can scan a certain

domain name servers or DNS.

So at map we are going to use

a flag all the time now,

let me just tell

you what our flag.

So if you just go
to nmap and type - -

help this will give you

all the flags and options

that are available

to Actually use on any map.

So if you are actually stuck

and you can't remember stuff,

let's go in and type and Mom -

help and it will give you all

the stuff now Network scans

generally take a long time.

So I'm going to be using

the fast mode most of the time.

So for fast mode,

all you have to do is type

in any record dot go and sit

and wait for this

can't get over now

when the scan gets

over you will see a bunch of

information and let me just wait

till that information pops up

and then we will talk

about the information together.

Okay.

So as you guys can see

our scan has been completed

it took 13 .71 seconds

to actually do the scan.

Now as you guys can see it shows

us the port's the states

and the services now the porch

is basically the port number

which are service

that is also bind it

to is working on so we can see

that SSH service is working

on port number
22 SMTP on 25 actually

Beyond 80 our PC by 911 and Sgt.

BS on 443 so that is

how you can use nmap

to scan a certain website.

Now if you see and map

has also given us

the public IP of the DNS

because what nmap does

is it looks at the DNS

and then translate it to an IP

that is recognized
to that DNS server.
So nmap.

Also Returns the public IP.

So what we can do
also is and map -

F and 34.2 10.2 30 and Dot.

35.

Okay.

So as you guys can see

that our command also works

when we put in the IP address

and it produces
the same results.

Now we can also scan

for multiple hosts now

suppose you are on a network

and you want to scan

for multiple hosts now.

You don't really want to run

different commands for that.

Now what you can do is just go

in and type and map and a bunch

of IP addresses like 192.168.1.1

and Or 1.2 and 192.168.1.3

and what this will do is it

will draw the net Maps scan

on these three
different IP addresses

and you did this

in just one command.

So that's a way
that you can do this.

Now.

You can also know about

how much of your scan is left

by just pressing the up button

so that will tell you

and give you a constant update
on how your scan is going like -

32.4% Dot and 4.7 now

and also show you kind

of the time remaining.

Okay.

So till this port

scan is going on.

Let me just tell you

about the states now States

can be of two types

open closed and unavailable.

Sometimes you will see that

it is unavailable and that's

because some sort of 5

all or something is running out

there states can also be closed

in that case mostly

and math will not return

you any result

unless you're explicitly finding

something of the closed state.

So that was a little trivia

on States and how they work.

How much are Scott has done

so a scout is dot 81% takes

around another 20 seconds.

It should be done soon.

Now.

This scan could be significantly

made faster with just EF tag,

but I really want to give

you all a good look

into how this works.

97 98 99.

Okay.

So as you guys can see

this is our result.

It gives us a bunch
of ports and services now

as I just said this thing

can be also closed

and also unable Available.

So open and closed

we see both the examples.

Okay, so that was about

how you can scan multiple ports.

So you can also scan multiple

boards with this command

as I will show you.

So what I do not one six eight

dot one dot one to Thirty.

Now what this will do

is basically scan everything

from 192.168.1.1 to 192.168.1.2

up to 30 like that.

So this is a very useful way

of actually scanning.

Tubal IP addresses.

Let me just show you

how that works.

Since we have used the a flag,

this is going to work

considerably faster now

as you guys can see out here.

This had taken around

a hundred nineteen seconds.

So that's round two minutes now.

This will take

a considerably less a time.

So, let's see this was done

in 29.91 seconds,

and we'd it 30 IP addresses.

So we see that -
F surely speed ins
the whole scanning process now,

you can also give nmap

a Target list now,

let me Could Target list

so targets D XD.

We just got it out for you.

So that's starting it now.

All I want to do
is edit this file.

So, let me just edit

that file and put

a 192.168.1.1 192.168.1.2
192.168.1.3 192.168.1.5

for 192.168.1.5 or 15.

Boom Rose.

Sit now, all we have

to do is save it.

So that saves it and control

X to actually access it.

Now, you can go ahead and view

what is a target set txt.

So as you guys can see this is

what isn't Target such cxt.

And now you can just pass it

to end map with the IL flag

and you could say that nmap

is going to actually

scan all the IP addresses

that are in this file.

So let that just run.

So this will take

a little bit of time

because it's five IP addresses

and it's really radical

the fast boat 83%
of our work is done.

Okay.

So as we see our scan

has been completed now,

what do you see out

here is scan results

for whatever we had provided

and targets dot txt list.

So that's how you can also

provide and map input file

and it will give you the results

for all the targets

that were specified in the file.

Now, let's go ahead

and talk about a little bit

on Port scanning.

So nmap is also A brilliant tool

for scouting boards.

And if you have

a server or web site,

you know that there are

65535 ports out there

or every silver and almost 99%

are unused so sometimes kind

of ports is really
at the society.

Now you can scan boards

by just using the pflag

and specifying the port number

and this is how you would do it.

And if you just specify

the IP address after that,

so I'm going to use

w-w-w dot Ed u-- record.

Go and what you can also do is

this will scan only

the port number 20,

but you can also scan

from port number 20 to 25.

You can also put in comas

and tell and lap.

You also want to scan all these

are the port 80 is HTTP

and 443 is HTTP,

so you can surely do that.

So let me just go
ahead and run this.

Okay, so that gives us

an information on the boards

that is there now

something about ports.

Also you suppose, you know.

You want to scan

for some HTTP Port

so you can just say and map

and with the -

be you can just say

that I want to scan

the HTTP board www dot Ed u--

red card dot go so that will

just go ahead and do that.

And as you guys can see

that give us a result

and you can also add

in stuff like MySQL FTP

and stuff like that.

So let me just see show you

how that rods okhttp

is done poor Sgt.

Okay, so as you can You

guys can see these artboards

that are running and it gave us

according to the day.

Now.

If you want to scan

all the ports,

you can use - P -

and the IP address

at www.deeptrekker.com.

Now this generate

takes a lot of time

because you're basically

doing 65,000 scan.

So I'm not really

going to do that.

I'm going to quit this out.

Another thing

that I want to show you all

that generally takes a lot

of time to actually
execute is called something

like an aggressive scam.

So as you guys can See out here.

I have done an aggressive

scan on Ed Eureka.

So do that.

All you have to do

is and map - A

and then you go

Eddie record dot go.

So let us see how much time

did this take to actually

execute this deck 459 seconds

that's long time for scan,

but it gives us a bunch

of other information.

For example, it gives

us the traceroute.

So what is the traceroute first

of all so traceroute

is the route taken by a packet

to to actually reach the clients
and the target cell.

So as you guys can see our back

it had 22 hops first went

to the first stop was

to the Gateway router

that is 192.168.1.1.

Then when to the Airtel lease

line then rent this IP address

that went to the pslv SNL dotnet

and it went to London

New York the Chicago

and the went all the way up to

wherever this thing has hosted

that was some information

and then there is

some other Information

given to us like the TCB open

TCB rap program version

sport type sport States

and all sorts of other

information is given about

in an aggressive scan

another scan that I

have previously also done

and kept for y'all is

because it takes a lot of time

and I have done something

called this service

version so and map -

s and V where V Capital will

give you the service version.

So it tries to actually
guess the word.

Asian of the service

that is running.

So for example on TCP Port it

tells us it is postfix SMTP D
or the Apache.

It's Apache HTTP D.

You can see all sorts

of versions that are here.

Another thing and map

is generally brilliant

is for guessing
the operating system

that is running.

Oh, I have already done

this can previously

because this takes

a humongous amount of time

that I don't really have and

that is three eighty six point

three four seconds

and this can together

basically took me.

In ten minutes,

and I don't really

have that kind of time

for explaining all this stuff.

So as you guys could see

out here the OS get is

kind of os detail is fortunate

for the gate it kind of

tries to guess the OS

upon the time to live

that is in the response

from the packets

that it sends.

So - SVP - oh and -

A are some really

cool stuff stuff

that you might want to know.

Another thing that you
can do is trace route

as I had just told y'all

and y'all can do Trace.

Trout separately.

So you go - -

traceroute and then you say

the name of any sort of website.

So suppose.

I want to know
how I reach netflix.com.

So I go netflix.com and this

will give me a trace route

that shows me how my packet

actually reaches the flicks.com.

Okay.

So this is basically
it was a direct one hop.

Okay, so that was surprising

all the other hand.

If I were to do this
on Eddie record dot

go it would take A bunch

of hops to actually reach

that it is by just
take some time to run.

Okay, so it's 94 percent down.

I'm just waiting

for it to get completed.

Okay.

So this gave us a hop and

as you guys can see we took

twenty two hops to actually

reach a direct cannot go

and it's the same process you go

through a bunch of IP addresses

and then you reach

this thing called you
as West do compute
that Amazon AWS.

Okay, so that was

about traceroute now just

to end this tutorial.

Let me just tell you guys

that you all can also save

a file to add map.

And that is basically save

all whatever you found

from a search into a file

and let me just show you

how to do that.

Now.

Sometimes when you are working

as a security analyst you

will have to perform Network

scans on a wide area network

that is huge.

It's basically huge

these cards take a lot of time

and you don't really have

the space or your command line

to actually store

that and see that in the parade.

That is feasible.

Little for analysis.

So what do you want to do

is actually save it in a file.

So what you can do

is say Ed map.

Oh n and then you

can see the other file we

could say results Dot txt,

and we could save this in file.

So w-w-w dot Ed u--
Rekha dot go.

So whatever search result

is going to be generated
is going to be stored

in this file called

results dot txt.

Now.

This file need not exist.

List from before it will just

be created by and map

and now you see if I do LS.

We have a Target
or a results dot txt.

Now if I just cut out that file,

let me just less it

actually results Dot txt.

And what you see out here

is an nmap scan result

that is stored.

Another thing that I would like

to show you all before I end

this at map tutorial

is a verbose mode.

So for verbose mode is basically

when we were pressing

up arrows to see

how much of our scan is done.

You can basically do

that for postponed.

Take all - F + -

V for verbose and you

could say www dot Ed u--

record Dot and this

will basically give

you a verbose mode of

what is actually going on.
I'll tell you everything
and boom roasted there it's done

and we have finished

our and map tutorial

and now you see if I do LS.

We have a Target
or a results dot txt

if I just cut out that file.

Let me just less it

actually results Dot txt.

And what do you see out

here is an nmap scan result.

That is Stored a lot of thing

that I would like to show

you all before I end this

at map tutorial
is a verbose mode.

So for verbose mode is basically

when we were pressing

up arrows to see

how much of our scan is done.

You can basically do

that for postponed.

So you go - F + -

V for verbose and you

could say www dot Ed u--

record Dot and this

will basically give

you a verbose mode of

what is actually going on.

I'll tell you everything

and boom roasted there it's done

and We have finished

our and map tutorial.

So first of all,

what exactly is
cross-site scripting?
Well cross-site scripting

refers to client-side
code injection attacks

where in an attacker

can execute a malicious script

also commonly referred

to as a malicious payload
into a legitimate website

or web application now xss is

amongst the most rampant

of web application
vulnerabilities and occurs

when of Web application

makes use of something

like a nun validated

or unencoded user input

within the output

that it generates Now

by leveraging xss

and attacker does not Target

a victim directly instead

an attacker would be exploiting

a vulnerability within a website

or something like
a web application

that the victim would visit

and essentially using

the vulnerable website

or the web application

as a vehicle to deliver

a malicious script
to the victims browser.

Now while exercise

can be taken advantage

of within a virtual box script

ActiveX and Flash

unquestionably the most

widely abused is Javascript.
This is mostly

because JavaScript
is the fundamental

to any browsing experience all

the modern sides today have some

JavaScript framework running

in the background
now xss can be used

in a range of ways
to cause serious problems.

Well, the traditional is uses

of exercise is the ability

for an attacker to steal.

Session cookies allowing

an attacker to probably
impersonate a victim and

that Justin's and that

just doesn't stop there.

So exercise has been

used to wreak havoc

on social websites spread

malware website defa commence

and fish for credentials

and even used in conjunction

with some clever social

engineering techniques

to escalate to even
more damaging attacks.

Now cross site scripting

can be classified

into three major categories.

So the first is reflected

cross-site scripting.

The second is stored or

persistent cross-site scripting

and the third is dom-based

cross-site scripting so
out here Dom refers
to the document object model

that is used file

web application building.

So let's take a moment

to discuss the three types

of cross-site scripting.

So the first one we're going

to be discussing is reflected

cross-site scripting Now

by far the most common type

of cross-site scripting

that you'll become.

Because is probably reflected

cross-site scripting here.

The attackers payload

is a script and has

to be part of a request

which is sent to the web server

and reflected back in such a way

that the HTTP response

includes the payload

from the HTTP request Now

using a phishing email

and other social engineering

techniques the attacker layers

in the victim to inadvertently

make a request to the server

which contains the cross

site scripting payload,

and then he ends up

executing the script

that gets reflected and cute it

inside his own browser.

Now since reflected cross-site

scripting isn't really

a persistent kind
of attack the attacker
needs to deliver

this payload to each victim

that he wants to serve.

So a medium like a social

network is very conveniently

used for destination

of these attacks.

So now let's take

a step by step.

Look at how cross-site

scripting actually works.

So firstly the attacker

crafts a URL containing

a malicious string
and sends it to the victim.

Now the poor victim

is tricked by the attacker

into requesting the URL

from the website,

which is running
a I respond script

and then the website

includes the militia string

from the URL in the response.

And then in the end

the victims browser executes,

the malicious script

inside the response sending

the victims cookies to

the attacker silver.

Okay.

So at first reflected xss

might seem very harmless

because it requires a victim

himself to actually send

a request containing
a militia string now
since nobody would be
willingly attacking himself.

So there seems to be

no way of actually
performing the attack but

as it turns out there are

at least two common ways

of causing a victim

to launcher reflected
cross-eyed attack on himself.

So the first way is

if the user or targets

a specific individual

and the attacker can send

the malicious URL to the victim.

For example using email

or for example instant messaging

and then trick him

into visiting the site.

Secondly if the user

targets a large group

of people the attacker

then can publish the link

or the malicious URL

or his own website

or social media,

and then he'll just wait

for visitors to click on it.

So these two methods are similar

and both can be very

successful with the use

of a URL shortening service

like one provided by Google.

So this masks the militia

string from users

who might otherwise identifier.

Okay.
So that was all about
reflected cross-site scripting.

Let's move on to store

cross-site scripting now.

So the most damaging type

of cross-site scripting

that is there today

is persistent or stored

cross-site scripting installed

cross-site scripting attacks.

It attacks.

I'm sorry installed

cross-site scripting attacks.

The attacker is injecting

a script into the database

that is permanently stored

on the target application.

So a classic example

is a malicious script
inserted by an attacker

in the comment field or on

a blog or a forum post.

So when a victim navigates

to the affected webpage

now in a browser

The cross site scripting

payload will be served.

As a part of the web page just

like any legitimate

comment would be now.

This means that the victim

will be inadvertently ended

up ending up executing
the malicious script.

Once the page is viewed

in the browser.

Now, let's also take

a step by step.
Look at how cross-site scripting
in the stored version works.

So the attacker uses one

of the websites form to insert

a malicious string into

the websites database first.

Now the victim unknowingly

request the page

from the website

and then the website Glued

some malicious string

from the database

in the response

and then sends it to the victim.

Now the poor victim

will be actually executing

the malicious script

inside the response

and sending all the cookies

to the attackers server.

So that's basically

how stored or persistent

cross-site scripting works.

Now it's time for the last type

of cross-site scripting

which is document object model

based cross-site scripting.

So dom-based cross-site
scripting is an advanced type

of cross-site scripting attack.

So which is made possible

when the web applications

client-side script writer uses

provided data to
the document object model.

So basically it means

that data is subsequently read

from the document object model
by the web application
and output it to the browser.

So if the data is incorrectly

handled in this place

and attacker can very

well inject a payload,

which will be stored as a part

of the document object model

and then executed

when the data is read

back from the Dome.

No, let's see how

that actually happens.

So first attacker craft

the URL containing

a malicious string
and sends it to the victim.

Now this victim is again

tricked by the attacker

into actually requesting

the URL from the website.

This is like the primary step

in actually performing
cross-site scripting.

Now the third step is

that the website receives

the request but does not include

the militia string

in the response.

Here's the catch of

dom-based cross-site scripting.

So now the victims browser

executes the legitimate script

inside the response.

Causing the malicious script

to be inserted into the page

that is basically
into the inner HTML attributes
and the final step is then
the victims browser then

executes the malicious script

inserted into the page

and then just sends

the victim the cookies

to the attacker silver.

Now if you guys

must have realized

in the previous
examples of persistent

and reflected cross-site

scripting those server inserts,

the malicious script

into the page,

which is then sent as

a response to the victim now

when the victims browser

receives the response it assumes

that the malicious Ripped

is to be a part

of the pages legitimate content

and then automatically

executes it during page load as

with any other script would be

but in a Dom base attack,

there is no malicious script

insert it as a part of the page.

The only scripts

that are being actually

automatically automatically

executed during the page load is

legitimate part of the page.

So that's the scary part.

So the problem is

that this legitimate script

directly makes user input
in order to add
HTML to the page.

So the militia string

is inserted into the page

using Nice chairman,

so it's pastas sgml.

So mostly people
who are actually in servicing

or surveying any server for

cross-site scripting attacks.

They will not be actually

checking the client side.

So it's a very subtle difference

but it's very important.

So in traditional cross site

scripting the militias

JavaScript is actually executed

when the page is loaded as

a part of the HTML server

and in dom-based
cross-site scripting

the militias JavaScript

is executed at some point

after the page has

already been loaded.

Because the page is

legitimate JavaScript treating

user input is using it

in an unsafe way.

So now that we have actually

discussed all the three types

of cross-site scripting

that is varied that is

widely available today.

Now, let's see

what can actually happen

if cross-site scripting will

if you were actually a victim

of cross-site scripting,

I'm sorry.

So, let's see what can happen

if you actually were a victim

of cross-site scripting.

So the consequences of
what an attacker can do

with the ability

to execute JavaScript

on a webpage may not immediately

stand out to you guys,

but especially

since browsers like Java

like Chrome run JavaScript

in a very tightly controlled

environment these days

and JavaScript has

very limited access

to users operating systems

and user files.

But when considering

the JavaScript has the access

to the following

that we're going

to discuss we can only see

how creative JavaScript

attackers can get.

So firstly with malicious

JavaScript has access

to all the same objects

that the rest of the web page

has so this includes a thing

called cookies now

cookies are often used

to store session tokens.

And if an attacker can obtain

a user session cookie,
they can impersonate that user
anywhere on the internet.

Secondly JavaScript can read

and make arbitrary modifications

to the browser's
document object model.

So your page will

just be incorporated

with all sorts of scripts

and viruses without You even

knowing from the server side now

JavaScript can be used

with the XML HTTP request

to send HTTP request

with arbitrary content

to arbitrary destinations.

And the most scary part is

that JavaScript and modern

browsers can leverage HTML5 apis

such as accessing a user's

geolocation webcam microphone

and whatnot and even

specific files from

the users file system.

Now while most of these apis

require the users to opt

in cross-site scripting
with in actions

with some very

clever social engineering

can bring an attacker

of very long way now

the above in combination

with social engineering

as I just said allows

an attacker to pull
off Advanced attacks,
including cookie theft
keylogging fishing

and identity theft to now

critically cross-site scripting

vulnerabilities provide.

The perfect ground

for attackers to escalate

attacks to more serious ones.

So now that we understand what

cross-site scripting attacks are

and how damaging they can be

to your application.

Let's dive To the

best known practices

that are actually followed to

prevent them in the first place.

So the first mechanism

that is used is called escaping.

So escaping data means

that taking data and application

has received and ensuring

that it's secure before actually

rendering it for the end user.

Now by escaping
user input key characters

in the data received by

a web page will be prevented

from being interpreted

in any malicious sort

of way now innocence

your censoring the data

or webpage receives in a way

that will disallow characters

especially those brackets

that begin the HTML attributes

like in HTML and I'm G

so these will be stopped

from being rendered
which would otherwise cause harm
to your application

and users and database,

but if your page doesn't allow

users to add their own code

to the page A good rule of thumb

is We need to escape any

and all HTML URL

and JavaScript entities.

However, if you
are running a forum

and you do allow users

to as Rich text to your content,

you have a few choices.

So firstly you will need

to carefully choose

which HTML entities

you will escape

and which you won't

or buy replacement format

for raw HTML such as markdown

which will in turn allow

you to continue escaping all

the sorts of HTML characters

now the second method

that is normally used

is called validating input

And so validating
input is the process

of ensuring an application
is rendering the correct data

and preventing malicious data

from doing harm to the site

the database and the users.

So while whitelisting and input

validation are more commonly

associated with stuff

like SQL injection,
they can also be used as
an additional method

of prevention for
cross-site scripting attacks.

So input validation
is especially helpful

and good at preventing

cross-site scripting in forms

as it prevents a user
from adding special.

Characters into the fields

instead of refusing

the quest completely.

But in fact valid

input validation is

not the primary method of

prevention for vulnerabilities

such as cross-site scripting

and even SQL injection

for that example,

but instead they help to reduce

the effects should an attacker

actually discover such

a vulnerability in your system.

Now the third way to prevent

cross-site scripting attack

is to sanitize user input.

So sanitizing data
is a strong defense

but should not be used alone

to battle cross-site
scripting attacks.

It's totally possible.

Will that you find the need

to use all three methods

of prevention in working towards

a more secure application.

Now as you guys might notice

that sanitizing user inputs is
especially helpful on sites

that allow HTML markup to ensure

data received Can Do no harm

to users as well
as your database

by scrubbing the data clean

of potentially harmful markup

and changing the

unacceptable user input

into an acceptable format.

OK guys.

So that was all the theory about

cross-site scripting it's time.

Demo right now.

So for the demonstration now,

I'm going to be showing

you guys the three types

of cross-site scripting

that we have discussed

throughout the course

of the session.

So not only will this be

a rather interesting to see

how cross-site scripting works

on a vulnerable web application,

but it will also give

us a better understanding
of cross-site scripting

in itself now to perform

cross-site scripting is

a very big crime.

So we really can Target

any random web platform website

or web application
for that matter.
So keeping that thing in mind I

have chosen the broken

web application project.

So this is brought
To Us by a wasp

which stands for open source web

application security project.

The broken web application

project or Bebop is

a broken web application

that is intentionally vulnerable

and it incorporates
a majority of the known bugs

that are out there

and it is widely used by

security enthusiastic students

and practicing ethical hackers

to mostly practice

and nurture their skills

in the right direction.

Okay, so to get started

first of all,

we need to download a few

files and get things ready.

So first of all,
we will download the broken web.

Ation project

and I'll be leaving

the download link

in the description just in case

you guys want to practice

in your own free time.

Secondly.

We need to download
a virtual box.

Now after we have

both the files ready
and we have it installed

and we have our broken

web application installed

in the virtual machine.

We are good to go.

Now.

I've already done

all that boring job

and actually installed

the broken web application

as you guys can see.

I'm already running

the owasp broken web application

on my virtual.

And this is the Oval

Office virtual machine.

So as you guys can see

it's based off Linux

and if we go ifconfig,

it'll give us the IP address

that it's running on.

So as you guys can see,

it's running on 192.168.1 46.4

so If we just head over there,

yeah, I've already open that up.

We get a portal.

So for this
particular demonstration,

I'm going to be using the broken

web application project

and also webgoat.

So first of all,

let's head over to the broken

web application project.

So we'll be greeted
with a login screen out here
and the credentials
for this is B and Bug

as you guys can see,

so just go and enter login

after you enter the credentials.

Okay, so y'all will be

welcomed with a place

where you can choose your bug

and you can also choose

the amount of security

that you want to practice with.

So since this is
a very simple demonstration,

I'm going to set

the security too low.

And the first thing

that we're going

to test is actually

reflected cross-site scripting.

So reflected cross-site
scripting mostly has things

to do with the get request

when we are actually

coding on the back end.

So, let's see.

First of all we go ahead

and choose reflected cross-site

scripting for the get method

and we go and press hack.

Now will be presented

with a form.

Now form is a very good way

of actually showing
reflected cross-site scripting

because normally when

an attacker will be trying
to attack you he'll be trying
to send you a form or any way.

You can actually input

something into the his

soul so interestingly

if we go and just in put nothing

into these two fields

and just go will see

the URL change out here.

So firstly you guys see

that it's the fields are

very clearly visible

and These are the two fields

and that means

that it's an uncoded input.

So this is a very rich place

to actually practice
your web vulnerability

and penetration testing skills.

So if I were to hackl,

I would try and run

a script out here.

So if I were to go script

and I've already

practiced a few out here

as you guys can see,

so if you go script alert,

this is an example
of reflected xss.

Yeah, and if we go and just

end the script out here.

This is going to actually render

the JavaScript input

as a part of the page

and we are going to get

an output because of this.
So that's how reflected
cross-site script

is actually working.

So as you guys can see

we the what am I saying?

As you guys can see

the web application has actually

rendered our JavaScript

and now we can see

that reflected cross-site

scripting is actually
working out here.

So now you guys

must have realized

that in a practical scenario.

This form must be

sent to the victim

and must be tricked

into filling the form

for the attack to be successful.

Also in more practical scenarios

where sites are

also having forms.

They're going to be putting

filters to the Of

the input parameters such

that you cannot run

JavaScript in them

and you cannot also input

any unencoded inputs into them.

So that was all

about reflective JavaScript.

I mean reflected
cross-site scripting.

So now let's move

on to store cross-site scripting

which is the most dangerous form

of cross-site scripting.

Okay, so as I had discussed

the comment sections are

normally the best place

for actually stored

cross-site scripting.

so as you guys can see out here

if we already have
a few comments

that had added for practicing

now in store cross-site

scripting the attacker

is normally attacking the data

that is stored.

So basically we are going

to inject the script

into the database

into the server.

So if the script has

some malicious intent

and it can do
a multitude of thing

if it has a malicious intent

will not get into that.

So for that reason,

let's first add

a normal comment out here.

So let's say

if this was blog

I'd say good job there.

Like I said
or something like hey,

man, nice work.

If you go and
press submit, okay,

it's showing this is

an example of persistent
cross-site scripting

because I had already

inserted malicious script.

So this is that script out

here the second input but just

for demonstration purposes.

Let's go in and put it again

so we can also input raw data

that is unencoded input

in the form of script.

So let's go alerts.

Unless his print hello world.

So if we go and press submit

so at first ones

that other cross-site script

and then it will say

that this page isn't working.

So this is also a very

good example now we

have two scripts actually

running on this page.

So the first one is

actually this is an example of

cross-site scripting persistent.

So that was the second one

and then comes the hello world.

So that's actually two scripts

running back to back.

So anybody if I were
to actually come back

to this side any other day

and these comments

existed It would just

get automatically executed

from the database

because just because we

are referring to it.
Okay, so time for
dom-based cross-site scripting

and I was using this application

for the first time yesterday

and I realized

that there is actually

no way that we

can actually test dom-based

cross-site scripting you.

So to actually test
on base cross site scripting

we are going to be using

this thing called webgoat.

Now the login credentials

to webgoat is guests
for the username

and guests for the password.

I'd already logged in

so it didn't ask me.

So now if we go out here

and go on the cross

site scripting in xs/s,

you will also see

that there is no options

available for actually donbass

cross-site scripting this is

because it's under

a acts security or Ajax

if you might pronounce

it that way.

So in this is
under a acts security

because if you guys remember

we had just discussed

that don't be cross site

scripting is a client-side

cross-site scripting.

So things like a normal script

would normally be checked

on the server side.

But when we are talking

on client side,

we are talking about languages

like HTML a acts etcetera

so you can put your scripts

in HTML form.

So suppose we were to go
so let's input a script first.

So suppose you have

to go script.

Hello world now.

If we go and submit the solution

nothing actually happens

because we are actually putting

in encoded in puts out there.

It's the Dom that is unencoded.

Now if we were to actually go in

and input in a language

that the client-side actually

understands for example HTML,

so we immediately get a result.

So first of all,

it's going to actually

manipulate the inner

HTML attributes of this site.

So if we go image
and we put a source now,

let's not give the source

anything and on alert

on are urado on an error.

We're going to run

some simple JavaScript so alert

And we can say this is

an example of dom-based xss.

Now as soon as I end

end the image tag,

this is going to get done

because the client side

is always rendering
the client-side page.

So watch this.

Sorry, I think
I miss type somewhere.

Let's go again so image.

Unless you something I've

already used and you can see

that it says hacked and out.

He'll we've not even

press submit solution.

So out here you can see

that as soon as we completed

it is again saying hacked so

that means as soon as you

complete the query or

the client-side HTML language,

so that will completely

trigger the cross-eyed

payload image tag.

This is going to get run

because the client side

is always rendering

the client-side page.

So watch this.

I'm sorry.

I think I miss type somewhere.

Let's go again so image.

Okay, let's use something I've

already used and you can see

that it says hacked

and out here.
We've not even
press submit solution.

So out here you can see

that as soon as we
completed it is again saying

that so that means as soon

as you complete the query or

the client-side HTML language,

so that will completely

trigger the cross-eyed payload

firstly let's go

or what does and DDOS means now

to understand a DDOS attack.

It is essential to understand
the fundamentals of a Dos attack

does simply stands

for denial of service?

The service could be

of any kind for example,

imagine your mother

confiscate your cellphone

when you are preparing

for your exams to help you study

without any sort of distraction

while the intentions of

your model is truly out of care

and concern you are being denied

the service of calling

and any other service offered

by your cell phone now

with respect to a computer

and computer networks.

A denial of service
could be in the form

of hijacking web servers

overloading ports,

which request rendering

them unusable the dying

Wireless authentication

and eyeing any sort of service

that is provided
on the internet attacks

of such intent can be performed

from a single machine

while single machine attacks

are much easier to execute

and monitor their also easy

to detect and mitigate

to solve this issue.

The attack could be executed

from multiple devices spread

across a wide area.

Not only does this make

it difficult to stop the attack

but it also becomes

near impossible to point out.

The main culprit such attacks

are called distributed denial

of service or DDOS attacks.

Now, let us see how they work

the main idea of a U.s.

Attack as explained

is making a certain service

unavailable since everything

that is attacked is
in reality running on a machine.

The service can

be made available.

If the performance of
the machine can be brought down.

This is the fundamental

behind dose and DDOS attacks.

Now some dos attacks

are executed by flooding servers

with connection requests

until the server is overloaded

and is deemed useless others

are executed by sending

unfragmented packets to a server

which they are unable

to handle these methods

when Muted by a botnet

exponentially increase
the amount of damage

that they are doing

and their difficulty

to mitigate increases in Leaps

and Bounds to understand more

about how these attacks work.

Let us look at the different

types of attacks.

Now while there are plenty of

ways to perform a DDOS attack.

I'll be listing down

the more famous ones.

These methodologies have become

famous due to their success rate

and the Damage they

have caused over time.

It is important to note
that with the advancement

and Technology.

The more creative minds

have devised more

devious ways to perform.

Dos attacks.

Now the first

type of methodology

that we are going to discuss

is called ping of death now

according to the TCP IP protocol

the maximum size
of the packet can be
65,535 bytes the Ping

of death attack exploits

this particular fact

in this type of attack.

The attacker sends packets

that are more than

the max packet size

when the packet fragments

are added up computers

generally do not know

what to do with such

packets and end up freezing

or sometimes crashing
entirely then we come

to reflect on the docks

this particular attack.

Iraq is more often than not used

with the help of a botnet.

The attacker sends a host

of innocent computers
a connection request

using a botnet which are

also called reflectors.

Now this connection

that comes from the botnet looks

like it comes from the victim

and this is done

by spoofing The Source part

in the packet header.

This makes the host

of computers send

an acknowledgement to
the victim computer

since there are

multiple such requests

from the different computers

to the same machine this

overloads the computer

and crashes it this type

of attack is also known

as a Smurfette.

Another type of attack is called

mail bomb now mail bomb attacks

generally attack email

servers in this type

of attack instead of packets

oversized emails filled with

random garbage values are sent

to the targeted email server.

This generally crashes

the email server

due to a sudden spike in load

and renders them useless

until fixed last

but not the least we

have the teardrop attack.

So in this type of attack,

the fragmentation offset field

of a packet is abused
one of the fields

in an IP header is a fragment
offset field indicating

the starting position or offset.

Of the data contained

in a fragmented packet

relative to the data

in the original packet

if the sum of the offset

and the size of one fragmented

packet differs from that

of the next fragmented packet

the packet overlap now

when this happens a server

vulnerable to teardrop attacks
is unable to reassemble
the packets resulting

in a denial
of service condition.

Okay.

So that was all the theoretical

portion of this video now,

it's time to actually perform

our very own DDOS attack.

Okay.

So now that we finish

the theoretical part

of how DDOS actually works

and what it actually is

but it's different types.

Let me just give you guys

a quick demonstration on

how you could apply a denial

of service attack

on a wireless network
anywhere around you

like this could be

somewhere like Starbucks

where you're sitting

or this could be a library also

or your college
institution no matter

where you're sitting

this procedure will work.

So the first thing we want to do

is actually open up a terminal

as because we were Be doing

most of our work

on a command line basis.

Now for this

particular demonstration.

We will be actually using

two tools first is aircrack-ng,
which is a suit of tools

which contains aircrack-ng

airmon-ng a replay

and G and airodump-ng.

So these are the four tools

that come along with it.

And the second one

that we'll be using

is called Mac change of okay.

So let me just put

my terminal on maximum.

So you guys can see

what I'm actually writing out.

So first thing we want to do

is Actually log in as root.

So let me just do that quickly

because we need to login as

root because most of the stuff

that we're going to do right now

will need administrator access.

Now.

If the first thing we

want to do is check out

our wireless network cards name

and we can do that easily

by typing ifconfig.

Now, you can see

that my wireless card is called

WL 1 and we get the MAC address

and we also get the IPv6 dress.

So that's my wireless network

card and we'll Actually setting

that up in monitor mode now

before we actually go in
to start up our Network

are in monitor mode.

Let me just show you
how you can install

the two tools that I just spoke

about that is aircrack-ng

at Mac changer.

So do install aircrack-ng.

You can just go app get

install aircrack-ng hit enter

and this should do it for you.

I already have it installed.

So it's not going to do

much to install mac changer.

You could just go

the same command

that is zap get

install mac changer

and you can check

if both the tools

have been installed properly

by opening the manual pages

by typing man aircrack-ng

and this will open up

the manual page for you.

And let's also do

the same format to ensure.

So what we're going

to do first is set up

our network interface card

into monitor mode.

So to do that,

all we have to do
is type ifconfig,

and we need to put

a network interface card down.

So we go.

Wlo one down and with

the command IW Go mode monitor.
Don't forget to specify

the interface that

you're working on.

So IW config WL 1 mode Monitor

and all you have to do

now is put it back up.

So what we are going

to type is ifconfig.

Wl1 up.

You can check the mode

it will see managed

if it's monitoring mode.

So as you guys can see

it says mode managed,

so that's how we're going

to go ahead so you can check

that just for your own purposes

so we can also check for only.

Wlo one by
specifying the interface.

Or you could also check

the mode only by passing it

through a pipe function

and that is using grep mode.

So IW config wl1 crap and mold.

Well mode begin

to the capital M.

So that's how you

would probably return it.

So as you guys can see

that has returned

the mode for us icon

along with the access point

and the frequency.

Okay, so that was

a little fun trivia on
how you could fetch the mode
from a certain command

that like iwconfig

by passing it through a pipe

and Open your list mode crap

basically means grab.

Okay, so now moving on we

will get to the more

important stuff now so

firstly we need to check

for some sub processes

that might still be running and

that right actually interfere

with the scanning process.

So to do that,

what we do is airmon-ng check

and then the name

of the interface now

as you guys can see I have

the network manager

that is running out here

and we need to kill that first

and that can be easily

done by going kill

with the PID after that.

You can run

a general command called.

Old airmon-ng check

and kill so whatever it finds

it will kill it accordingly

and when it produces

no results like this,

that means you're ready to go

as there are
no sub processes running

that might actually

interfere with us
can now what we want to do
is we want to run a dump scan

on the network interface card

and check out all

the possible access points

that are available to us.

So as you guys can see

this produces a bunch

of access points and they come

with their be ssids there.

So have the power

which is the pwr

that is the power of the signal

and let me go down back again.

So yeah, you can see the beacons

you can see the data you can see

the channels available

and what the bssid is.

It's the Mac ID

that is actually tied

in with the essid

which basically represents

the name of the router.

Now, what we want to do

from here is we want

to choose which router

we want to actually dose.

Now, the whole process

of dosing is actually

we will continue Sleety

authenticate all the devices

that are connected to it.

So for now I have chosen

Eddie Rekha Wi-Fi to actually

toss out and once I send it

the authentication broadcast,

it will actually

the authenticate all the devices

that are connected to it.

Now this the authentication

is done with a tool

called are replay

which is a part of
the aircrack-ng suit of tools.

Now.

Let's just see

how we can use are a play

by opening up the help command.

So we go - -

help and this opens up

the help command for us.

Now as you guys

can see it shows us

that we can send a D'Orsay.

Gation message by tapping into -

0 and then we need

to type in the count.

So what we are going

to do is type in -

0 which will send

the DL syndication message

and now we can dive 1 or 0.

So 1 will send only

one the authentication message

while 0 will continuously

Loop it and send a bunch

of the authentication messages.

We are going to say zero

because we want to be sure

that we are the authenticating

everybody and we can also

generally specify the person.

We also want to specifically

the authenticate but for
this demonstration,

I'm just Just going to try

and the authenticate everybody

that is there.

So what we are going to do is

we are going to copy down

the MAC address or the bssid

as you would know it

and then we are going to run

the authentication message.

Now as you guys can see

Rd authentication message

is beginning to hunt
on Channel Nine.

Now as you guys know

and as I already know

that our bssid or Mac address

is working on Channel 6 now,

we can easily change the channel

that are interface.

Working on by just going

IW config WL 1 and then Channel

and then specifying the channel

as you guys can see our chosen

router is working on Channel 6.

So that's exactly
what we're going to do.

Now as you guys can see it

immediately starts sending

the authentication codes

to the specified router

and this will actually

make any device

that is connected
to that router almost unusable.

You might see that you are

still connected to the Wi-Fi,

but try browsing the internet

with them you will never be able
to actually Each any site

as I'm constantly

the authenticating
your service you will need

that for a handshake

all the time.

And even if it completes you are

suddenly the authenticated again

because I'm running

this thing on a loop.

Now, you can let this command

run for a few moments

or how much of a time you want

to DDOS at guy for well,

this is not exactly a DDOS

because you're doing it

from one single machine,

but you can also optimize

this code to actually looks

like it's running

from several different machine.

So let me just show you

how to do that.

We are going to write a script

file to actually optimize.

Is our code lat

so this script file

will actually automate

most of the things

that we just did

and also optimize a little

by changing our Mac address

every single time.

So we become hard
to actually point out.

So the first thing

that we want to do is
we want to put our wireless
network card down and maybe

that's not the first thing

that I want to do.

Just give me a moment

to think about this.

I haven't actually thought

this true I'm doing

this on the Fly.

Okay.

So the first thing

that we're going to do

is we're going to start

a while loop that Is going

to continuously run

until we actually
externally stop it.

So we go while true
and then we're going to say do

and the first thing

that we want to do

is send out the authentication

message and we are going

to send a it around 10
the authentication messages

and we want to run it

on a specific bssid.

So that is the bssid

that had copied.

So let me just put in that

and then we just put

in the interface

is it supposed to work on now?

What we want to do
after that is You want

to change the MAC address

after we have sent

all these 10 packets.
So what we will need to do
is put down our wireless network

and as already
discussed we can do

that with ifconfig wlan0 down.

And now what we want to do

is change our Mac address

so we can do

that with the simple tool

that we had installed

and saying Mac changer -

are so let me just open up

a Quick Tab and show you guys

how much Ginger actually works.

Now you can already check

out my other video called

the ethical hacking course,

which actually covers

a lot of topics

and Mac changer is just one

of them and you can check

how to use it in depth

in that video.

But for now, let me just give

you a brief introduction

how much change it works the Mac

changer will basically give you

a new Mac address

every time let me just open

up the help menu for you guys.

So as you guys can see

these are the options

that are available to us.

We can get a random Mac address.

We can also tell to show

our Mac address and we also
have to specify Interface

when we want to show

us the MAC address now,

let me just generate

new Mac address.

So you see our chair

that interface up

or insufficient permissions
is being shown.

So this means we always have

to put down our interface first.

So let me just do that

quickly ifconfig wlan0 down.

And now what we want to do is

give ourselves a new Mac address

and boom roasted.

We already have
a new Mac address

as you guys can see

from the new Mac part.

Now if you put back are

in network interface card,

and then try and show up

Mac address again weeks.

See that our current

MAC and are from red.

Mack are two completely

different Mac addresses

and of current MAC

and the new Mac I identical.

So this is how you

can actually generate

new Mac addresses to spoof

your own identity on the while

and that is very

useful in this case

because the person

you're attacking will be

so confused as to what to do
because your Mac address
is changing every time

and there's no real solution

to the situation
that you're creating for them.

At least.

I don't know of any solution.

If you do know
how to stop this for yourself.

Please leave it.

Down in the comment

section below and help

the world a little bit.

Now.

We wanted also get to know what

our Mac address is every time.

So let me just type my function

through the whole thing

and let me just try

and grab the new Mac address.

So my changer are wl1

and grab Mark and then we

want to put our Rental Car

in the monitor mode

and then we also want to put

up our network interface card.

Now, what we want to do

out here is optimize it

so we can be
attacking constantly.

So let us Put a sleep timer.

So this will make

our program sleep

for a particular amount of time.

I'm going to make

a sleep for 5 seconds.

So after every 5 seconds,

it's gonna send

that particular bssid.

Then the authentication messages

then just going to bring

down my interface card.

It's gonna change

my Mac address.

It's going to put back

the interface card

in the monitor mode

and sleep for 5 seconds.

And then repeat

the entire process

and to end the script.

Let's just say done.

So that will denote

when Loop is done now.

Let me just save it

Ctrl o control X to exit

and there we go.

Okay.

So first of all to actually run

this need to give it

some more permission.

So as you guys can see

we already have it.

Let me just put it

in a much more readable format.

Okay.

So as you guys can see our doors

does sh doesn't really

have execute ability

so we can do
that with command chmod.
So I'm going to give it
some executable permission.

So chmod One plus X

and then the name of the file.

So this will actually

change our dos dos SSH

into a executable bash script.

Okay.

So it seems that we
have done some error.

So let's just go back

into our bash script

and check for the error

that we have probably done.

So now -
does a jet d'eau start sh.

Okay.

So the thing
that I am missing is

that I forgot -

A that I'm supposed to put

before putting the bssid

and the are replay

Angie part of the code.

So let me just go ahead

and quickly do that.

Okay.

So now that that is done.

Let me just save it

and quickly exit and see

if this thing is working.

Ok.

So now we are trying

to work out our script

now you guys should know

that this Erica Wi-Fi

is my company's Wi-Fi
and I have complete permission
to go ahead and do this to them.

Also.

My company's Wi-Fi
is kind of secure.

So every time it senses

that ADI authentication

message is being sent.

I ain't like that.

It kind of changes the channel

that it is working on.

So these guys are

really smart smarter

than me most of the time

and this time I'm just going

to try and force them

to work on Channel 6.

So let me just go
ahead and run my script once.

Okay, so let me just check that.

They're still working

on Channel 6 Yep.

They're still working

on Channel 6.

Let me just check my script

once if it's correctly done

if I have the perfect Mark ID.

Let me just copy in the Mac ID

just to be sure once again,

so they go.

Copied it.

Let's go into the script

and let's face it out.

Okay.

So now that that is done

and we have mac IDs
and everything set up properly.

Let me just show you

how to run the script so you go

Dot and backward slash

and then you said -

does SH now.

I see that our thing

is working on Channel 8.

So this will definitely

not book and say

that the SSID is not so

what we need to do

as I have showed you guys

earlier we can go aw config wl1

and change the channel 2.

Channel 6.

Oops, I channel
to channel it again.

This will not work.

I'm sorry.

That was my bad.

So now that we have changed

it to channel 6,

you can see that it is sending

everything immediately.

Okay.

So that is actually running

our script very well.

And as you guys can see

the security measures

are taken by my company.

It will not always

work on Channel 6.

It will keep rotating now

until it finds the safe channel.

So it really can't find

a safe Channel.

I was always be dosing

on Channel 6 and It will run.

Sometimes it won't run sometimes

but mostly with unsecured Wi-Fi

that is running at your home.

Mostly this will work

a hundred percent times.

So let me just stop this

because my company
will go mad on me

if I just keep on dancing them.

So this brings us to the end

of a demonstration.

This is how you can

always toss your neighbors

if they're annoying you

but remember if you're caught

you could be prosecuted.

So this was about

how the device works

with DDOS actually is

and the different types

and how you can do one

on your own with your own system

by my company.

It will not always work on

Channel 6 will keep rotating now

until it finds the safe channel.

So it really can't find

a safe Channel.

I was always be dosing

on Channel 6 and it will run

sometimes it won't run sometimes

but mostly with unsecured Wi-Fi

that is running at your home.

Mostly this will work
a hundred percent times.

So let me just stop this

because my company
will go mad on me

if I just keep on dancing them.

So this brings us to the end.

To off a demonstration.

This is how you can

always dose your neighbors

if they're annoying you

but remember if you're caught

you could be prosecuted.

So this was about

how the device Works

would beat us actually is

and the different types and

how you can do one on your own

with your own system.

In early days

of Internet building websites

were straightforward.

There was no JavaScript.

No back-end know CSS

and very few images

but as web gained

popularity the need

for more advanced technology

and dynamic websites group this

led to development of common

Gateway interface or CGI

as we call it and
server-side scripting languages

like ASP JavaScript PHP

and many others websites changed

and started storing user input
and site content.

Databases each and

every data field of a website is

like a gate to database

for example in login form.

The user enters the login data

and search failed

the user enters a search text

and in data saving form the user

enters the data to be saved.

All this indicate

data goes to database.

So instead of correct data,

if any malicious code is entered

then there are possibilities

for some serious damage

to happen to the database

and sometimes to the end.

Fire system and this is what

SQL injection is all about.

I'm sure you've heard

of SQL SQL query language

or SQL is a language
which is designed to man,

you plate and manage

data in a database

SQL injection attack is a type

of cybersecurity attack

that targets these databases

using specifically

crafted SQL statements

to trick the systems

into doing unexpected

and undesired things.

So by leveraging

an SQL injection vulnerability

present in web.
Or the website

given the right circumstances

an attacker can use it

to bypass web applications

authentication details as

in if you have login

and password user can

or attacker can enter

just the user ID.

Skip the password entry

and get into the system

or it can sometimes
retrieve the content

of an entire database.

He can also use SQL injection

vulnerability to add modify

and sometime delete records

in a database
affecting data Integrity

while using this vulnerability.

Attacker can do unimaginable

things this exactly shows

how dangerous and SQL

injection can be now.

Let's check out how a typical

SQL injection is carried out.

Well, let's start with

non-technical explanation guys.

Have a simple analogy here.

So first let's go through this.

Once you understand

this you are easily able

to relate this with what

SQL injection attack is.

So anyway first imagine

that you have

a fully automated bus
that functions based

on the instructions given by

human through a standard web.

Well that for might look

something like this.

For example the for might say

drive through the route

and where should the bus stop

if when should the bus

stop this route and

where should the bus stop

and this condition?

That's when should the bus stop

or the user inputs.

This is where you will have

to enter the input

into the form now after putting

some data into the field.

It looks something
like this drive through Route

77 and stop at the bus stop

if there are people

at the bus stop.

Well, that looks

simple enough, right?

So basically you're the human

or the person is trying

to give 3 instruction

that is per should

stop at Route 77.

It should stop at the bus stop

if there are people

at the bus stop.

Well, that sounds harmless

now imagine a scenario

where someone manages

to send these instructions
which looks something

like this drive through Route 77

and do not stop at the bus stop

and ignore rest of the firm

if there are people

at the bus stop.

And now since the bus

is fully automated.

It does exactly as instructed.

It drives up Route
77 and does not stop

at any bus stop even

when there are people waited

because the instruction says

do not stop at the bus stop

and ignore the rest of the form.

So this part which is

if there are people

at the bus stop is ignored

we were able to do this

because the query structure

and the supplied data

are not separated properly

so that Automated bus

does not differentiate

between the instructions

and the data it simply does

anything that it is fed

with are asked to do well

SQL injection attacks are based

on the same concept attackers

are able to inject

malicious instructions

into good ones all of which

are then sent to database server

through web application

and now the technical
explanation and SQL injection

needs to conditions to exist

which is a relational database

that uses SQL and a user.

And put which is directly

used in an SQL query.

Let's say we have

an SQL statement

a simple SQL statement.

This statement says

select from table users

where username is so-and-so

and password is so

and so basically you

can think of it as a code

for a login form.

It's asking for the username

and the password

this SQL statement

is passed to a function

that sends the entire string

to Connected database

where it will be passed executed

and returns a result at the end

if you have noticed First

the statement contains

some special characters, right?

We have asked her

to return all the columns

for selected database row

and then there is equals

to only riddance values

that match the search string

and then we have

single quote here

and here to tell

the SQL database

where the search string

starts or ends.

So for user you

have starting here and in

here and for password here,

so basically a pair now

consider the following example

in which a website user is able

to change the Use of this user

and password such as

n log in form.

So if the values are put

into user and password,

it looks something
like this select

from users table.

The user name is Dean

and password as Winchester's

and the SQL statement

is simple enough.

It's very direct.

So if there is a user called

Dean with password Winchester's

then all the columns

of table users are

extracted now suppose

if the input is not properly

sanitized by the web application

the attacker Can easily insert

some malicious SQL statement

like this the username

might be Dean

or 1 is equal to 1

and then you have double hyphen

followed by password is equal

to Winchester's so basically
along with the data the user
or the attacker
has tried to enter

a malicious SQL statement

disguising it as a data here.

So guys, you need

to notice two things here.

First one we have or 1 is equal

to 1 it's a condition

that will always

be true therefore.

It is accepted as
a valid input by application.

For example, if Dean

is not a valid user or

if there is no user called Dean

in the database application

would consider the next value

because there is or in

between our next value

is 1 is equal to 1

which always returns true.

So basically our input will be

something like this Dean or true

and if there is no user called

Dean the next input will be true

and it will be taken

as an input value

and values will be displayed.

So the next part

which has double -

I'm sure you know

what double -

represents Droid.

Basically, it's commenting

the next part of the SQL query.

So it instruct the SQL passer

that the rest

of the line is a comment

and should not be executed.

So the part that's

password part will be ignored.

So basically what we're trying

to do is we're trying

to bypass the password

authentication here.

So once the query executes

the SQL injection effectively

removes the password

verification resulting

in an authentication bypass
by using double life,

and we're commenting

rest of the comment.

And before that using

one is equal to one

which is translated to true.

We are trying to enter

the database without even

giving an invalid value.

So the application will most

likely log the attacker in

with the first account

from the query result.

And as you guys know most

of the time the first account

in a database is

that if an administrative user

so basically by doing nothing

or basically by giving
some random data here

the attacker was able

to extract the admin details,

it sounds very dangerous, right?

So that's all an SQL

injection attack is all about