by Zaid Sabih | Publisher: Packt Publishing | Release Date: April 2018 | ISBN: 9781789346145

Learn website hacking and penetration testing from scratchAbout This VideoLearn how to gather information about your target website and discover, exploit and fix a large number of vulnerabilities.Learn what can you do with the access you gained from exploiting these vulnerabilities and much more.In DetailWelcome to this comprehensive course on website and web application hacking! In this course, you will start as a beginner with no previous knowledge about penetration testing or hacking. This course is focused on the practical side of penetration testing without neglecting the theory behind each attack. Before jumping into penetration testing, you will first learn how to set up a lab and install the required software to practice penetration testing on your own machine. Then you will learn about websites, how they work, what they rely on, what is meant by a web server, a database, and how all of these components work together to give us functioning websites. Once you understand how websites work we will start talking about how can we exploit these components and this method of communication to carry out a number of powerful attacks. This course will take you from a beginner to a more advanced level. By the time you finish, you will be able to launch attacks and test the security of websites and web applications in exactly the same way that black hat hackers would do, fix these vulnerabilities, and secure websites from them. All the attacks in this course are practical attacks that work against any real websites. For each vulnerability you will learn the basic exploitation, then you will learn advanced methods that will give you more privileges or allow you to bypass security measurements.

1. Chapter 1 : Course Introduction
   • Course Introduction 00:02:13
2. Chapter 2 : Preparation - Creating a Penetration Testing Lab
   • Lab Overview & Needed Software 00:03:26
   • Installing Kali 2018 as a Virtual Machine Using a Ready Image 00:08:31
   • Installing Metasploitable as a Virtual Machine 00:04:11
   • Installing Windows As a Virtual Machine 00:03:22
3. Chapter 3 : Preparation - Linux Basics
   • Basic Overview of Kali Linux 00:04:37
   • The Linux Terminal & Basic Linux Commands 00:09:07
   • Configuring Metasploitable & Lab Network Settings 00:05:38
4. Chapter 4 : Website Basics
   • What is a Website? 00:04:14
   • How to Hack a Website? 00:05:31
5. Chapter 5 : Information Gathering
   • Gathering Information Using Whois Lookup 00:04:41
   • Discovering Technologies Used On the Website 00:06:04
   • Gathering Comprehensive DNS Information 00:05:58
   • Discovering Websites on the Same Server 00:03:43
   • Discovering Subdomains 00:05:06
   • Discovering Sensitive Files 00:07:26
   • Analysing Discovered Files 00:04:18
   • Maltego - Discovering Servers, Domains & Files 00:07:43
   • Maltego - Discovering Websites, Hosting Provider & Emails 00:04:49
6. Chapter 6 : File Upload Vulnerabilities
   • What are they? And How to Discover & Exploit Basic File Upload Vulnerabilities 00:06:44
   • HTTP Requests - GET & POST 00:04:13
   • Intercepting HTTP Requests 00:06:45
   • Exploiting Advanced File Upload Vulnerabilities 00:04:37
   • Exploiting More Advanced File Upload Vulnerabilities 00:04:22
   • [Security] Fixing File Upload Vulnerabilities 00:06:22
7. Chapter 7 : Code Execution Vulnerabilities
   • What are they? & How to Discover & Exploit Basic Code Execution Vulnerabilities 00:07:26
   • Exploiting Advanced Code Execution Vulnerabilities 00:06:06
   • [Security] - Fixing Code Execution Vulnerabilities 00:05:48
8. Chapter 8 : Local File Inclusion Vulnerabilities (LFI)
   • What are they? And How to Discover & Exploit Them 00:05:49
   • Gaining Shell Access from LFI Vulnerabilities - Method 1 00:07:11
   • Gaining Shell Access from LFI Vulnerabilities - Method 2 00:10:38
9. Chapter 9 : Remote File Inclusion Vulnerabilities (RFI)
   • Remote File Inclusion Vulnerabilities - Configuring PHP Settings 00:03:46
   • Remote File Inclusion Vulnerabilities - Discovery & Exploitation 00:05:44
   • Exploiting Advanced Remote File Inclusion Vulnerabilities 00:02:50
   • [Security] Fixing File Inclusion Vulnerabilities 00:05:55
10. Chapter 10 : SQL Injection Vulnerabilities
    • What is SQL? 00:05:48
    • Dangers of SQL Injections 00:02:54
11. Chapter 11 : SQL Injection Vulnerabilities - SQLi In Login Pages
    • Discovering SQL Injections In POST 00:07:56
    • Bypassing Logins Using SQL Injection Vulnerability 00:04:49
    • Bypassing More Secure Logins Using SQL Injections 00:06:25
    • [Security] Preventing SQL Injections in Login Pages 00:07:44
12. Chapter 12 : SQL injection Vulnerabilities - Extracting Data from the Database
    • Discovering SQL Injections in GET 00:07:02
    • Reading Database Information 00:05:26
    • Finding Database Tables 00:03:34
    • Extracting Sensitive Data Such As Passwords 00:04:29
13. Chapter 13 : SQL injection Vulnerabilities - Advanced Exploitation
    • Discovering & Exploiting Blind SQL Injections 00:05:54
    • Discovering a More Complicated SQL Injection 00:07:22
    • Extracting Data (passwords) By Exploiting a More Difficult SQL Injection 00:04:48
    • Bypassing Security & Accessing All Records 00:04:49
    • Bypassing Filters 00:07:20
    • [Security] Quick Fix to Prevent SQL Injections 00:06:44
    • Reading & Writing Files on The Server Using SQL Injection Vulnerability 00:05:58
    • Getting a Reverse Shell Access & Gaining Full Control Over The Target Web Server 00:08:27
    • Discovering SQL Injections & Extracting Data Using SQLmap 00:06:48
    • Getting a Direct SQL Shell using SQLmap 00:02:58
    • [Security] - The Right Way to Prevent SQL Injection 00:04:58
14. Chapter 14 : XSS Vulnerabilities
    • Introduction - What is XSS or Cross Site Scripting? 00:03:09
    • Discovering Basic Reflected XSS 00:03:47
    • Discovering Advanced Reflected XSS 00:04:35
    • Discovering An Even More Advanced Reflected XSS 00:07:05
    • Discovering Stored XSS 00:02:57
    • Discovering Advanced Stored XSS 00:03:36
    • Discovering Dom Based XSS 00:06:33
15. Chapter 15 : XSS Vulnerabilities – Exploitation
    • Hooking Victims to BeEF Using Reflected XSS 00:05:42
    • Hooking Victims to BeEF Using Stored XSS 00:04:09
    • BeEF - Interacting With Hooked Victims 00:03:56
    • BeEF - Running Basic Commands On Victims 00:04:24
    • BeEF - Stealing Credentials/Passwords Using A Fake Login Prompt 00:02:17
    • Bonus - Installing Veil 3 00:07:50
    • Bonus - Veil Overview & Payloads Basics 00:07:20
    • Bonus - Generating an Undetectable Backdoor Using Veil 3 00:09:44
    • Bonus - Listening For Incoming Connections 00:07:19
    • Bonus - Using a Basic Delivery Method to Test the Backdoor & Hack Windows 10 00:07:12
    • BeEF - Gaining Full Control over Windows Target 00:03:40
    • [Security] Fixing XSS Vulnerabilities 00:07:17
16. Chapter 16 : Insecure Session Management
    • Logging In As Admin without a Password by Manipulating Cookies 00:06:06
    • Discovering Cross Site Request Forgery Vulnerabilities (CSRF) 00:06:46
    • Exploiting CSRF Vulnerabilities to Change Admin Password Using a HTML File 00:07:00
    • Exploiting CSRF Vulnerabilities To Change Admin Password Using Link 00:05:41
    • [Security] The Right Way to Prevent CSRF Vulnerabilities 00:09:20
17. Chapter 17 : Brute Force & Dictionary Attacks
    • What Are Brute Force & Dictionary Attacks? 00:03:45
    • Creating a Wordlist 00:06:35
    • Launching a Wordlist Attack & Guessing Login Password Using Hydra 00:13:32
18. Chapter 18 : Discovering Vulnerabilities Automatically Using Owasp ZAP
    • Scanning Target Website for Vulnerabilities 00:04:19
    • Analysing Scan Results 00:04:11
19. Chapter 19 : Post Exploitation
    • Post Exploitation Introduction 00:03:59
    • Interacting With the Reverse Shell Access Obtained In Previous Lectures 00:06:59
    • Escalating Reverse Shell Access to Weevely Shell 00:07:53
    • Weevely Basics - Accessing Other Websites, Running Shell Commands ...etc 00:06:32
    • Bypassing Limited Privileges & Executing Shell Commands 00:04:54
    • Downloading Files from Target Webserver 00:04:40
    • Uploading Files to Target Webserver 00:07:53
    • Getting a Reverse Connection from Weevely 00:07:46
    • Accessing the Database 00:08:53