Now you're gonna think I'm a bit silly or lazy and that's okay because I like
doing command
ejection practice inside of actual command prompt for Windows.
And I actually have the one pulled up for my local system, not the lab itself.
And that's what you see on the screen up there.
And I will cut and pay some of the commands that I'm using right below this.
And I like practicing with our ampersand logical operators.
The reason for this is because it gives me an idea of what's actually happening
on the system
and how the commands interact with each other.
For example, let's say I decided to ping one 27 does your well, I got to turn
on my
number lock because it always likes messing up.
Being one 27 does zero does zero dot one.
That's me, right?
Well, let's say I decided to put an ampersand a single one and go start.
Start is a command that allows us to be able to open up a program inside of
Windows
from the command prompt in its GUI form, essentially, right?
We're telling it to start said program instead of just evoking it from the
command line itself.
See, when you hit start, run any type, no pad, it'll open up no pad.
But that's not always the case inside of command prompt because it's more DOS
based.
And to be fair, and just between you and me, I miss my DOS.
And that's why I'm making man prompt.
But aside from being weird and lacking DOS, when I run this now and say one
night or ping one 27 0 0 1 and at start, no pad, it's going to complete the
ping first
before it actually opens up the notepad that opened up on a different screen
because I
have multi screen here.
Now, this will open up until the pain completes, which shows the operation of
that ampersand
where I could very simply just go up and say, amper amper.
And understand that it'll ping and open up a.
Oh, there it is.
Open up a notepad at the same time as well.
Sorry, I believe me, they opened up at the same time.
It just I got multi screen and I apologize.
But the reason I'm doing it on my local system is because it's more quick to
get
results and easier to deal with.
And I also use it as my own internal lab as well.
Now there are other ways that you go through and do these different commands.
Like for instance, let's say we go back up to the first ampersand and say one
27 0 0 1 ampersand
start no pad.
No pad opened up right away just like that.
And the reason for that is is because the first command failed and therefore it
automatically ended and went to the next one.
Now at the same time, I also like to do use the old PS.
Sweet for process identification to so where I can go through and keep track of
different Pids that are opening up and see how these two programs may have
interacted with each other or I run net stat or MBT stat and try to keep track
of
the actual network traffic that's going on to see if it's associated with
another
Pid or the exact same one.
So these are different ways that we can actually try to test ourselves to be
able
to track down how to prevent stuff like this from happening in the future.
But as a pen tester, what we're doing is actually training ourselves to be able
to get around different security mechanisms.
And as we continue the strength of security on our systems like be whapped
out test, we'll start to increase because if you remember earlier in the
beginning of this course, we had to kind of tune down the security from
standard
baselines that you and I said because we're already cyber security
professionals.
But really, if you go back and look at some of the skills and especially in
this
course, this skill overall, there's a lot of stuff that we've done that can be
done on everyday mom and pop shops or regular users at their house on ISP
connections because not everybody's in the loop like you and I are.
And they just if something pops up like an error or a virus one or something
like
that nine times out of 10, my experience has been that they're going to get
ignore and move on.
And with as much ignoring as people do, it's it makes for a great playground
for
us to be able to go through and pen test legally.
But hackers are really taking advantage of that command injection is
aside from being my favorite part about pen testing is one of the most
exploitive methods to be able to manipulate a system and deperson themselves.
I hope this has been a forwarder for you and I'd like to thank you for viewing.
[BLANK_AUDIO]