Original subtitles

Let's briefly cover our notes so far so we have covered a little bit of this right.

We cover the fact that we have our own map in here and what we saw in court twenty two or 80 etc. and

we had a couple of findings from before we had default web page on Apache and we had this information

disclosure as well.

Now we've done some exploding.

So I've gone ahead and just put in here.

I put the S&P exploit so I put an example of what it looks like when we run it.

And you could see that the.

Who am I and the host names in there and then I've got the IP address.

This is just for my notes.

You can make this as detailed as you want.

By the way you could say Hey I ran this at this specific time and I ran it against this host.

And here is the attack I ran etc. and we'll get more into what your report should look like.

But as long as you know at least for me as long as I know I have a screenshot of proof that I did it

and I have the IP address that I ran it against.

That's pretty much enough.

I can remember the rest and then type out the report.

And same here with the mod SSL attack on port 80 and four for three and I don't have a copy of it right

now but the shadow file we did uncover the shadow file as being a root user.

So this just notes for us perhaps we could use the shadow file information and crack the passwords or

we could go on and try to pass the password or pass the hash round which we'll get to in later videos.

And another thing that add in here to was undetected malicious activity.

So this is something that you're going to see on a report and we talked about in the the brute forcing

video where if we're doing any kind of brute forcing we're doing it not only to see if we get hit with

bad password but to see if the client catch us.

So this example I'm using to say hey they didn't catch us.

Here's an example what we did.

Also scanning in there as well if you're not seeing a scan that's something that we're going to report

back.

So this would be typically a low finding these would also be low findings.

Anytime we get access to a machine this is obviously critical finding.

So we just want to keep know of what kind of things we're finding take good pictures et cetera.

So I'm hoping that you are getting the gist now of what your notes should look like.

Again Make these your own however it feels good to you.

This is just how I kind of do it.

I don't have to put a ton of information in there for me to remember as long as I have my screenshots

which are most important because that's your proof that you were actually there and you did it.

Otherwise it's just he said she said kind of thing.

So that is it for this video.

That is it for this section.

Congratulations again for making it this far.

Now we're going to move into some of the fun stuff where we get to look at a bunch of different attacks

and gradually just get a little bit more complex and learn some new things along the way.

And I like to call it a capstone because we're capping off where all the things we learned so far.

We're going to actually build upon it so you're going to learn a bunch of new little techniques as we

do this little midcourse Capstone.

And then we're gonna get into really fun stuff once we get to act director.

I'm really excited for that.

So I will catch you over in the next section.