Original subtitles

1

Welcome back.

2

Let's discuss bug bounty a little bit, we mentioned it in the previous video, but what exactly is

3

it?

4

There is one thing that we know it has nothing to do with the real bugs bug bounty or hunting for bugs

5

is mostly referred to as discovering vulnerabilities in a Web page.

6

Now you can hunt for bugs in applications and other type of programs.

7

But usually when someone says bug hunting or bug bounty, it's referred to as a website bug or unknowability.

8

Now, these women abilities can be anything from past verbal abilities, maybe they are not encrypted

9

well and the attacker can easily break them, or perhaps there is a database of vulnerability and the

10

attacker can extract all of the information from the database, including usernames, passwords, emails

11

and other personal information that shouldn't be public.

12

Some vulnerabilities can also target not only websites, but client devices as well.

13

By this, I mean that they're going to build things that could also be dangerous for the client that

14

visits a vulnerable Web page.

15

But don't worry, all of this is something that people talk about in the course and we will explain

16

how all of these attacks work.

17

For now, it's important that we mention what do we need before we even start hacking?

18

So the first thing that we want to do is to create a virtual environment, and this is something that

19

we mentioned in the previous video, we want to create a virtual machine that we will use for hacking.

20

This will be our own personal machine that we're strictly going to use to run different tools and perform

21

different attacks.

22

But we will also be installing vulnerable virtual machines that are running a Web page that we can attack

23

and that we can practice on.

24

Why you might be asking?

25

Well, we can't just target any website without permission.

26

That is why we are going to create our own machine with a website that we can attack as much as we want.

27

Second thing that we must get used to is Kelly Linux.

28

Now, Kelly, Linux is an operating system the penetration testers use.

29

You probably already know it, but we are going to use it inside of this course.

30

It is a Linux based operating system that comes with a bunch of useful tools that hackers need.

31

Out of all of that, the most important thing for us to learn is to introduce ourselves with basic command

32

line usage inside of Linux.

33

Don't worry, it will be nothing to advance.

34

We just want to cover the basics.

35

And the last but not least, we need some basic website structure, knowledge, we need to understand

36

the basics of website development just so we can understand the attacks better.

37

For this, we need to know what different programming languages in web development are used for, and

38

we need to recognize them.

39

So we will briefly cover HTML JavaScript and ask you out.

40

Why do we need to cover this?

41

Well, most of these attacks are based on injecting code from these programming languages, but let's

42

not confuse ourselves right now.

43

We'll talk about that when the time comes.

44

Right now, I want to show you a quick little bug that is easy to perform, yet it's still considered

45

a small vulnerability.

46

Just so I can give you an insight on how easy can it be to sometimes discover a bug?

47

So here I am on a Web page that I'm running inside of my local network and we can see that this Web

48

page right here performs a simple task.

49

It asks us to enter the background color that we would like to see.

50

Whatever color we enter, the background will change color.

51

So, for example, if I type red and said background color, nothing will change because it tells us

52

to enter the color in this format and it even gives us an example.

53

Now, this is not important for us, so let's just copy the example for the red color and let's paste

54

it right here.

55

If we set background color while it changes to red.

56

But is this the only thing that this Web page can perform?

57

What if we, for example, try to inject HTML code inside this input right here?

58

Well, let's give it the try.

59

The most simple HTML code we can enter is each one which stands for header size one and then test and

60

then we close the tags for the header.

61

Don't worry, if you don't notice, we will cover this as well, and if we set background color, it

62

tells me the current background color is best.

63

Just by looking at this, I can already tell that this is a bug in this webpage.

64

You might not be able to tell it right now, but by the end of the course, recognizing these bugs will

65

become second nature for you.

66

So what did they notice here?

67

Well, we typed some text in the size of a header one, and it seems that this website or web page executed

68

it.

69

It read it as an HTML code and it printed our text in size of header one.

70

Even if we tried to, for example, underline by using you inside of the HTML tags and using header

71

one and then typing test again, then we close header one and close underline text, we click said background

72

color.

73

Well, now we got our text written in size header one and also underlined, and this is called HTML

74

injection, this is a bug for the Web page, allows you to input HTML code in some user input field,

75

which in this case is this background color field.

76

And the Web page will process it as HTML code so we can conclude that this user input is not filtered.

77

Well, if this is too overwhelming for now, don't worry.

78

We will explain all of this in details later in the course.

79

I just want to show you a cool little bug that is so easy to find, yet it is discoverable in so many

80

websites that are currently online.

81

Now, enough of talking now that you explained bug bounty a little bit.

82

Let's get straight into setting up our virtual environment, see in the next video.