I know that you know, that we all know, that they know, that websites are the most forward-facing
thing out there on the internet. Most places, organizations, businesses, private folks,
and even people like me on the side that just want to have a website just to have one,
have most of their stuff conducted through a web server. And those web servers being
forward-facing are subject to what's known as a public IP address. Because if it was in a
private network, we wouldn't be able to get to it as easily as everybody else. So why am I bringing
all this up? Well, web exploits are basically the front door for everything that is networking now,
just about. There are organizations that don't have websites out there, and that's okay. They
have their own internal network, and we will deal with those accordingly. But for nearly everybody
else out there in the rest of the world, their organization has some sort of forward-facing
service. Now, just because they have a forward-facing service like a web server doesn't
necessarily mean that it's tied in to their internal network for us to be able to go through
and pen test with ease. Or does it? See, there are some web servers out there that even though
they're in the forward-facing side of the internet with that public IP address, they may
have some sort of server in the middle or way in the middle for them to be able to communicate
back with the internal organization. Now, why would I think that? Well, let's take
into consideration here for a second authentication. And there are services out there such as Microsoft.
I'm going to pick on them because a lot of the Microsoft websites out there require you to log
in with your Microsoft or live account. And when you do so, that authentication, those credentials
aren't stored on the actual web server. Because if they were, then they would be subject to people
like us, or even worse, malicious actors out there trying to always do attacks against those web
servers to crack those credentials. No, no. Those credentials are stored on the internal side of the
organization's network and servers. So it has to go from the public-facing side somehow traversing
through to the internal side. Now, I'm sure you can already guess that we're talking about DMZs and
ACLs on networking devices and things like that. But even though those are put into place, that
traffic is still going back and forth. And it's an opportunity for folks like us later on in this
course to be able to use things like man-in-the-middle-pass-the-hash and all sorts of
other great stuff, depending on the type of authentication it is. And it also depends on the
type of travel method that that authentication or that traffic from the public side to the private
side is taken. Is it SSL TLS? Is it just open plain text? I mean, there's so much stuff out there.
And so this is just some of the things that we take into consideration when we come into this
skill talking about web exploits and, unfortunately, how to address fixing them. I guess we'll do some
defense. Now, in some previous skills, definitely check them out if you haven't yet. We've gone over
things like directory traversal, file inclusion, and all sorts of neat little things that we can
do against unprotected web servers. Now, I bring up those two specific skills for a reason, and that
is that in those particular skills, we were doing these attacks against a web server that had PHP 7
running on it. And one of the things that we're going to really get into when we talk about web
exploits is the idea that if we put so much security on something that we're preventing
every single attack or attack attempt, I should say. And if that's the case, if we prevent every
single attack attempt, no matter how big, no matter how small, we've effectively lost ourselves.
Because nothing is going to be 100% secure, no matter what we do to it. And if it is 100%
secure, that means it's locked up in a safe where no one can access it, therefore giving us a denial
of service. Because in order for us to be able to get to it, we'd have to open the safe up and go
through a whole lot of trouble to be able to get there. Now, that being said, that we have to find
that perfect balance between what's acceptable on the security side of things to what's acceptable
to access on the actual web server itself. Because access to the web server opens up the possibility
that somebody may try to actually get into our internal network. They could plant something on
the web server that could attack other users that access that website itself. They could plant
something on that web server that actually tries to go in and scope out the rest of the organization's
network. Now, I know there's probably a lingering thought in some of y'all's minds out there because
I mentioned DMZ already. And you're like, Eric, there's a DMZ everywhere, even in the routers that
you buy from your local insert name store here for all the home use. And yes, there is a DMZ
implemented in that in order to be able to go and do things like that and pat. But you'd be surprised
at how many organizations there are that don't utilize a DMZ, not because it's too troublesome
or that it requires all this fancy equipment. They don't know how. And that's where pentesters like us
come into play because while we do come in and find those vulnerabilities like in a web environment
and along with in any other environment that's within the scope of our rules of engagement,
we're there to teach and advise and assist. As much as it is fun to go through and wreck house,
there's no point behind what we do unless we're actually teaching people along the way
how to actually make it better because a pentester that doesn't teach from what they've learned or
from what they're seeing on the organization that they're testing when they report back
is just nothing more than a hacker. Let all cards on the table. That's it. Because if you go to an
organization, you pentest and you don't report anything back, you're wrong. And that's why we
have the executive summary and reports findings and all this other great stuff that's in the
pentesting life cycle overall.