Original subtitles

Web application penetration testing before we can start talking about that we need to understand what

is a website and just like I said before a website is just an application installed on a computer the

computer probably just has better specs than your computer.

But it fundamentally works.

Exactly.

Just like another computer so it has an operating system and it also has a number of applications to

allow it to act as a web server.

So the main two applications that it probably has is a web server and a database a web server is like

Apache and the database is like my.

And these are the web server basically understands and executes the web application.

So your web application will be written in BHB or Python and you program language really the only thing

is that the web server needs to be able to understand and execute this application.

The database contains the data used by the web application.

So all of this is stored on a computer called the server.

The computer is connected to the Internet and it has a real IP address.

So anybody can access that computer and can get.

So the Web the web application is executed by the web server which is installed by what is installed

on your server on your target.

Therefore any time you request the page or you run the web application it's actually executed on the

web server and it's not executed at the client's computer.

It gets executed on the web server and that it sends a hash DMO page which is ready to read for the

target person or for for the client so let's have a look on an example and let's say you're on the phone

or on your computer and you want it to go to Facebook dot com So you type in Facebook dot com into your

your app.

This will be translated using a DNS server to an IP address.

So there is a server that translates every name dot com dot you or any web site with a name with a domain

name.

So this is the domain name to its relevant IP address.

So your request Facebook dot com their quest goes to a DNS server.

It translates Facebook to the IP where Facebook is stored.

And then you go to go to Facebook to the IP address of Facebook it will execute the page that you wanted.

Using all of the applications that we spoke about and then just give you radiation out.

So what you get back is just a markup routine in hastier mail which is a markup language all of the

result of executing the program so the program gets executed on the server and then you just only get

the result.

This is very important because in the future if we wanted to get anything executed on the web server

if we wanted to get a shell or a virtual or a virus execute on the target computer then we need to send

it into a language that the web server understands.

So for example we.

And once you executed there it will be executed on that computer not on your computer.

So regardless of the person the artist is the page the this the web show that you're going to send if

it's written in ph be in a language that the server understands it's going to be executed on the server

and not on your computer therefore it will give you access to the server and not access to the person

who accessed that server

javascript.

On the other hand there is some websites use javascript and Javascript is a client side language.

So if you managed to find a web site that allow you to run javascript code then the code will be executed

by the clients.

So even though the code might be injected into the web server it will be executed on the client side

and it'll give you it'll allow you to do things to the client computer and not to the server.

So it's very important to separate it between a client side and server side language.