It's time for us to start examining the websites that we've been
assessing in the previous skill with a little bit more details,
such as vulnerability assessments and getting an understanding of how
those different websites work and what makes them tick under the hood.
Now, I would like to refer you back to the NASA skill that we did earlier
in this course to really get a full scope of what it is that we're doing here.
Because we're taking the ideas of vulnerability scanning and assessment
against an individual system and applying it to a web server and web appliances
.
Now, Nessus overall will scan for vulnerabilities on a system and give us
back based on what Nessus knows about.
So let's say we have definitions that are installed either statically or
heuristic D that gets an idea of what a system could or potentially
has as a offset idea for a way to penetrate it.
Now, that's not what Nessus is for.
Nessus is sitting there to tell us what's wrong with a system so that we may
patch it and be more secure.
And the same idea goes when we start using different tools like Nikto
and some other stuff on the web vulnerability and assessment side of the house.
So when we first start getting into this, we introduced the website of the
house,
my understanding that we had servers and applications and the differences
between them and how they were set up and we got our playground established.
We're moving forward by applying even earlier skills in this course to sit
there
and analyze this website that's our playground to see if we can find any
vulnerabilities either through the actual server or the applications and
appliances that are running underneath it to see if there's a way for us to
generally are gradually build up to pen testing with things like Metasploit
and other tools inside of our Cali toolkit.
So keep it all that in mind.
I just want to stress again that this course is a continuing build.
You can be able to take these skills and run them individually, but to get the
full scope of the story, if you will, start from the beginning and work your
way
through it.
Now, as we go through this course, I want you to realize that we're still using
the same virtual lab that we had in the previous skill, which is in our
playground for the overall course itself.
We're going to be using the web application assessment lab and not making
any changes to it.
When changes do happen, I'll rename this lab something else and reassign it
to future skills.
But so far, everything that we need is inside of a basic Cali install and is
available for us to test against the fake website that we've made for
vulnerability assessment.
So with all that explanation out of the way and getting that understanding
down for our baseline, let's do it to it.