Learn Website Hacking Penetration Testing From Scratch

Lab Overview & Needed Software Preview 05:54

In this course, we will be using a number of operating systems, Kali for hacking and 2 others as target machines, in this section you will learn how to install all of these machines as virtual machines inside your current operating system, this allows us to use all of the machines at the same time, it also completely isolates these machines from your main machine therefore your main machine will not be affected if anything goes wrong.

Everything shown here will work on Windows, Linux and OS X.

Initial Preparation Preview 08:55

This lecture will introduce you to the hacking operating system that we will be using throughout the course; Kali Linux. You will learn what it is, how to download it, and how to enable virtualisation on your system to run it as a virtual machine.

Installing Kali Linux as a VM on Windows Preview 08:55

This lecture will teach you how to install Kali Linux as a virtual machine in VMware Workstation Player on Windows.
VMware is the software that we will use to install different operating systems inside our current operating system as virtual machines. This will be very useful as you can use it to test and practice what you learn in this course.

Installing Kali Linux as a VM on Apple Mac OS Preview 09:38

This lecture will teach you how to install Kali Linux as a virtual machine in VMware Fusion on Mac OS.
VMware is the software that we will use to install different operating systems inside our current operating system as virtual machines. This will be very useful as you can use it to test and practice what you learn in this course.

Installing Kali Linux as a VM on Apple M1 Computers Preview 09:08

This lecture will teach you how to install Kali Linux as a virtual machine using Parallels Desktop on Apple computers that use the M1 chip. Parallels Desktop is the software that we will use to install different operating systems inside our current operating system as virtual machines. This will be very useful as you can use it to test and practice what you learn in this course.

Installing Kali Linux as a VM on Linux Preview 10:46

This lecture will teach you how to install Kali Linux as a virtual machine in VMware Workstation Player on Linux.
VMware is the software that we will use to install different operating systems inside our current operating system as virtual machines. This will be very useful as you can use it to test and practice what you learn in this course.

Installing Metasploitable As a Virtual Machine Preview 04:33

In this lecture you will learn how to install a vulnerable operating system (Metasploitable) as a virtual machine so we can use it to practice penetration testing in future lectures.

Basic Overview Of Kali Linux Preview 05:10

In this lecture we will have a basic look on Kali linux just to get you comfortable with using it.

You will learn how to use its main applications, browse files, connect to the internet ....etc.

The Linux Terminal & Basic Linux Commands Preview 13:06

In this lecture you will learn how to interact with the linux terminal and run linux commands.

Configuring Metasploitable & Lab Network Settings Preview 03:45

In this lecture you will learn how to configure the network settings for the lab machines and how to access the websites that we will try to hack from the Kali machine.

What is a Website? Preview 04:13

Before diving into website hacking you need to now some basics about websites, this lecture will explain to you what is a website, what it contains, technologies used in it and how all of these components interact with each other.

How To Hack a Website ? Preview 05:31

In this lecture you will learn the various methods and approaches that can be used to hack into a website.

Gathering Information Using Whois Lookup Preview 04:41

In this lecture you will learn how to gather information about the website/ domain name owner, server IP address, hosting company and more.

Discovering Technologies Used On The Website Preview 06:04

In this lecture we will use Netcraft to discover the technologies used on the target website, such as the web server used, installed web applications and more!

Gathering Comprehensive DNS Information Preview 10:23

This lecture will teach you how to gather detailed DNS information about the target website such as it DNS records, resources it shares with other websites and more!

Discovering Websites On The Same Server Preview 03:43

This lecture will show you how to discover websites on the same server as your target website, this is very useful as these websites can be used to gain access to your target website.

Discovering Subdomains Preview 04:08

In this lecture we will use a tool called knock to discover subdomains on the target website, this is useful as these subdomains could contain beta web applications, private web applications or login pages.

Discovering Sensitive Files Preview 07:25

In this lecture you will learn how to use a tool called dirb to discover files on the target website, this can be helpful as it might reveal files that contain sensitive data.

Analysing Discovered Files Preview 04:17

In this lecture we will analyse the files we discovered in the previous lecture and see the information they contain.

Maltego - Discovering Servers, Domains & Files Preview 07:42

Maltego is a great information gathering tool that can be used to gather information just about anything (people, websites, computers, servers ...etc).

In this lecture we will have an overview on the tool and some basic use, you will learn how to discover domains, websites, servers and emails associated with your target.

Maltego - Discovering Websites, Hosting Provider & Emails Preview 04:49

In this lecture we will dive deeper into Maltego, you will learn how to discover more info about the target such as admin's email, hosting company, servers and lay out this information nicely.

How To Discover & Exploit Basic File Upload Vulnerabilities to Hack Websites Preview 06:43

File upload vulnerabilities allow attackers to upload files on the web server.

This lecture will introduce you to these vulnerabilities and teach you how to discover and exploit them to gain full control over the target server.

GET & POST Requests Preview 05:20

In this lecture you will learn more about how websites work, how the browser communicate with web server, http request types, and how to use this method of communication to discover and exploit advanced vulnerabilities.

Intercepting Requests Preview 08:02

In this lecture you will learn how to use Burp Suit to intercept GET & POST requests and modify them.

This can be useful in so many cases, to discover vulnerabilities, bypass filters.....etc

Exploiting Advanced File Upload Vulnerabilities To Hack Websites Preview 05:09

Now that we know how to intercept HTTP requests, in this lecture you will learn how to exploit a more secure file upload vulnerability and gain full control over the target web server.

Exploiting More Advanced File Upload Vulnerabilities Preview 06:33

In this lecture we will have a look on an even more secure upload page, you'll learn how to use Burp Suite to intercept the upload request and exploit the upload functionality to gain full control over the target web server.

[Security] Fixing File Upload Vulnerabilities Preview 06:21

In this lecture we shall have a look on the code causing the above vulnerabilities, you will learn why the above vulnerabilities are exploitable and how to fix these pages to prevent file upload vulnerabilities.

How To Discover & Exploit Basic Code Execution Vulnerabilities To Hack Websites Preview 07:25

Code execution vulnerabilities allow attackers to run system commands on the web server.

This lecture will introduce you to these vulnerabilities and teach you how to discover and exploit them to get a reverse shell and hack websites.

Exploiting Advanced Code Execution Vulnerabilities Preview 06:06

This lecture will teach you how to exploit more secure code execution vulnerabilities to get a reverse shell and gain full control over the target server.

[Security] - Fixing Code Execution Vulnerabilities Preview 05:47

In this lecture we shall have a look on the code causing the above vulnerabilities, you will learn why the above vulnerabilities are exploitable and how to fix these pages to prevent code execution vulnerabilities.

What are they? And How To Discover & Exploit Them Preview 05:49

Local File Inclusion vulnerabilities or (LFI) allow hackers to read local files on the server that they are not supposed to read.

This lecture will introduce you to these vulnerabilities and teach you how to discover and exploit them to read any file on the target server.

Gaining Shell Access From LFI Vulnerabilities - Method 1 Preview 06:46

In this lecture you will learn how to exploit local file inclusion to get reverse shell and gain full control over the target web server.

Gaining Shell Access From LFI Vulnerabilities - Method 2 Preview 10:37

Here you will learn another method to use a local file inclusion vulnerability to get a reverse shell and gain full control over the target web server.

Remote File Inclusion Vulnerabilities - Configuring PHP Settings Preview 03:46

This lecture will teach you how to configure php setting to allow remote file inclusion, so we can practice a remote file inclusion vulnerability in the next lecture.

Remote File Inclusion Vulnerabilities - Discovery & Exploitation Preview 05:44

Remote File Inclusion vulnerabilities (RFI) allow hackers to include remote files.

This lecture will introduce you to these vulnerabilities and teach you how to discover and exploit them to get a reverse shell and gain full control over the target server.

Exploiting Advanced Remote File Inclusion Vulnerabilities To Hack Websites Preview 02:49

This lecture will teach you how to exploit more secure remote file inclusion vulnerabilities to get a reverse shell and gain full control over the target server.

[Security] Fixing File Inclusion Vulnerabilities Preview 05:54

In this lecture we shall have a look on the code causing the above vulnerabilities (Both local and remote file inclusion), you will learn why the above vulnerabilities are exploitable, how to fix them and secure pages from them.

What is SQL? Preview 05:48

This lecture will explain what is SQL and what is it used for, this is important to understand before we dive into sql injection vulnerabilities.

Dangers of SQL Injections Preview 02:53

This lecture highlights why SQL injections are considered one of the most dangerous vulnerabilities.

Discovering SQL Injections In POST Preview 07:56

This video will teach you how to discover SQL injections in text boxes.

Bypassing Logins Using SQL Injection Vulnerability Preview 04:49

This lecture will teach you how to bypass login forms if the inputs are injectable, this will allow us to login as any user without a password.

Bypassing More Secure Logins Using SQL Injections Preview 06:24

In this lecture you will learn how to bypass security measurements in login forms, you will learn how to bypass client side filtering and login as admin without a password.

[Security] Preventing SQL Injections In Login Pages Preview 07:43

In this lecture we shall have a look on the code causing the above vulnerabilities, you will learn why the above vulnerabilities are exploitable, and how to quickly mitigate them .

Discovering SQL Injections in GET Preview 07:01

In this lecture we will learn how to discover SQL injections in GET requests, ie: in URL parameters.

Reading Database Information Preview 05:26

This video will teach you how to build a basic SELECT statement to exploit the SQL injection vulnerability we discovered in the previous lecture to find the database user, database name and version.

Finding Database Tables Preview 03:34

In this lecture we will use our SELECT statement to further exploit this SQL injection vulnerability and discover the tables on the current database.

Extracting Sensitive Data Such As Passwords Preview 04:29

Now we will use all the discovered information we got so far to further exploit this SQL injection vulnerability and find the usernames and passwords of all the users on the website.

Discovering & Exploiting Blind SQL Injections Preview 05:53

Blind SQL injections are ones that do not show errors, this lecture will introduce you to these vulnerabilities and teach you how to discover and exploit them to hack websites and do all of the SQL injection techniques we learned so far.

Discovering Complex SQL Injection Vulnerabilities Preview 07:21

In this lecture we will have a look on a more secure page, you will learn how to adopt your sql queries to discover and exploit more advanced SQL injections.

Exploiting an advanced SQL Injection Vulnerability to Extract Passwords Preview 04:47

In this lecture you will learn how to bypass more security measurements and extract all usernames and passwords stored in the database.

Bypassing Filters Preview 04:48

In this lecture we will discuss some tricks on bypassing client-side and server-side filters to discover and exploit SQL injections on more secure websites.

Bypassing Security & Accessing All Records Preview 08:36

In some cases the target web page might be vulnerable to an SQL injection, but it would only display one result at a time limiting our ability to exploit it, in this lecture you will learn how to bypass that by iterating over all the records.

[Security] Quick Fix To Prevent SQL Injections Preview 06:43

This lecture will show you a quick method to mitigate SQL injection vulnerabilities.

Reading & Writing Files On The Server Using SQL Injections Preview 05:58

This lecture will teach you how to use SQLi to read or write files to the server, this is very useful as it can be used to read sensitive files, or upload files with evil code that would allow us to gain full control over the target web server.

Getting A Shell & Controlling The Target Server Using an SQL Injection Preview 08:26

In this lecture you will learn how to exploit an SQL injection vulnerability to get a reverse shell access and gain full control over the target server.

Discovering SQL Injections & Extracting Data Using SQLmap Preview 06:47

In this video we will have a look on a tool called SQLmap and learn how to use it to do all of the attacks that we did before and much more!

Getting a Direct SQL Shell using SQLmap Preview 02:57

In this lecture you will learn how to use SQLmap to get a system shell, or an SQL shell where you can directly interact with the datavase and run SQL queries. 

[Security] - The Right Way To Prevent SQL Injection Vulnerabilites Preview 04:58

In this lecture we shall have a look on the code causing the above vulnerabilities, you will learn why the above vulnerabilities are exploitable, and how to properly write web applications that are not vulnerable to SQL injections.

Introduction - What is XSS or Cross Site Scripting? Preview 03:09

Cross Site Scripting or XSS vulnerabilities allow hackers to include javascript in the loaded pages.

This lecture will introduce you to these vulnerabilities.

Discovering Basic Reflected XSS Preview 03:46

This lecture will teach you what is reflected XSS vulnerabilities and how to discover them.

Discovering Advanced Reflected XSS Preview 04:34

In this lecture we will have a look on a more advanced reflected XSS vulnerability, you will learn how to discover it and exploit it.

Discovering An Even More Advanced Reflected XSS Preview 07:04

In this lecture you will learn more about discovering XSS vulnerability, you will be able to discover even more advanced XSS vulnerabilities.

Discovering Stored XSS Preview 02:56

This lecture will teach you what is stored XSS vulnerabilities and how to discover them.

Discovering Advanced Stored XSS Preview 03:36

This lecture will show you how to discover and exploit more advanced stored XSS vulnerabilities.

Installing Windows As a Virtual Machine Preview 06:09

In this lecture you will learn how to set up a windows virtual machine so that we can try and hack into it to practice penetration testing.

Hooking Victims To BeEF Using Reflected XSS Preview 05:41

BeEF is a browser exploitation framework that allows us to run a large number of commands on hooked browsers.

In this lecture you will learn how to use reflected XSS vulnerabilities to hook targets to BeEF, once they are hooked, you can run all the attacks BeEF allows you to (explained later in the course), such as injecting a keylogger or gaining full control over the target machine.

Hooking Victims To BeEF Using Stored XSS Preview 04:09

In this lecture you will learn how to use stored XSS vulnerabilities to hook targets to BeEF, once they are hooked, you can run all the attacks BeEF allows you to (explained later in the course), such as injecting a keylogger or gaining full control over the target machine.

Interacting With Hooked Targets Preview 03:56

BeEF is a browser exploitation framework that allows us to run a large number of commands on hooked browsers.

In this lecture we will have an overview of the interface, how to navigate it and use it execute commands on hooked browsers.

Running Basic Commands On Victims Preview 04:24

In this lecture you learn how to run basic commands on the target machine using BeEF, you'll learn how to run any Javascript code, get a screenshot of the page they're browsing and redirect them to any page you want.

Stealing Credentials/Passwords Using A Fake Login Prompt Preview 02:17

In this video you will learn how to use beef to display a fake login dialog to the target user and steal the password they enter, dialogs can be made for Facebook, Youtube, Microsoft or you can even create your own using the custom option.

Bonus - Installing Veil Framework Preview 03:56

In this lecture you will learn how to download and install Veil Framework.

Bonus - Veil Overview & Payloads Basics Preview 07:20

This lecture will give you an overview on Veil Framework and its basic commands.

You will also learn what is a payload and the different types of payloads that can be generated with Veil. 

Bonus - Generating An Undetectable Backdoor Using Veil 3 Preview 10:19

In this lecture you will learn how to create a backdoor that is not detectable by antivirus programs, this is very important in client side attacks as we will be using this backdoor in future videos to try and gain control over the target system.

Bonus - Listening For Incoming Connections Preview 07:18

In this lecture you will learn how to listen for connections coming from the backdoor we generated in the previous lecture.

Bonus - Using A Basic Delivery Method To Test The Backdoor & Hack Windows 10 Preview 07:12

Finally we will test the backdoor that we generated on a Windows machine and make sure that it works as expected.

Gaining Full Control Over Windows Target Preview 03:39

In this video we will se BeEF to create a fake notification bar telling the user that there is a new update, the update is actually a backdoor, so once they install that update we will gain full control over the target machine.

[Security] Fixing XSS Vulnerabilities Preview 07:17

In this lecture we shall have a look on the code causing the above vulnerabilities, you will learn why the above vulnerabilities are exploitable, how to fix these vulnerabilities and secure pages from file them.

You will also learn how to protect yourself as a user from XSS vulnerabilities.

Logging In As Admin Without a Password By Manipulating Cookies Preview 06:05

In this lecture you will learn how to exploit insecure session management to login to any account on the target website without the account password.

Discovering Cross Site Request Forgery Vulnerabilities (CSRF) Preview 06:46

Cross Site Request Forgery vulnerabilities or CSRF allow attackers to force users to send requests that they don't want, this can be very dangerous as it can be exploited to force users to change their password, submit forms.....etc

This lecture you will introduce you to these vulnerabilities and teach you how to discover them.

Exploiting CSRF To Change Admin Password Using a HTML File Preview 07:00

In this lecture you will learn how to exploit CSRF vulnerabilities, you will learn how to create a HTML file that will change the password of the person who opens it to any password you want.

Exploiting CSRF Vulnerabilities To Change Admin Password Using Link Preview 05:40

In this lecture you will learn a more advanced method to exploit CSRF vulnerabilities, you will learn how to generate a URL that would change the password of anybody who clicks on it to any password you want..

[Security] The Right Way To Prevent CSRF Vulnerabilities Preview 09:19

In this lecture we will analyse the weaknesses that allow attackers to forge requests and teach you the right way to prevent CSRF vulnerabilities.

Introduction to Brute Force & Dictionary Attacks? Preview 03:44

Most people mix up dictionary and wordlist attacks, this lecture will explain the differences to you and discuss how these attacks can be very useful.

Creating a Wordlist Preview 06:35

A wordlist or a dictionary is a file that contains a large number of possible passwords.

In this lecture you will learn how to create a wordlist or a dictionary so that you can use it in dictionary attacks.

Guessing Login Password Using a Wordlist Attack With Hydra Preview 13:32

Hydra is a tool that can be launch brute force attacks against most services (ssh, ftp, http ...etc).

In this lecture you will learn how to use it to launch a dictionary attack against a login page and guess the password for the admin.

Scanning Target Website For Vulnerabilities Preview 04:19

In this lecture you will learn how to use a tool called owasp zap to automatically discover all of the vulnerabilities we learned so far and much more.

Analysing Scan Results Preview 04:11

In this lecture we will analyse the scan results obtained from the previous lecture.

Post Exploitation Introduction Preview 03:58

In this lecture we will talk about what you will learn in this section and show you where we will start from.

Executing System Commands On Hacked Web Servers Preview 06:59

In this lecture you will learn how to interact with the reverse shell access you obtained from exploiting the vulnerabilities we learned so far.

Escalating Reverse Shell Access To Weevely Shell Preview 07:52

This lecture will teach you how to upload files to the target server using the shell access you have.

As an example, you will learn how to upload a weevely shell and connect to it.

Weevely Basics - Accessing Other Websites, Running Shell Commands ...etc Preview 06:31

In this lecture you will learn how to use Weevely to run basic commands, get system information and navigate between websites on the same server.

Bypassing Limited Privileges & Executing Shell Commands Preview 04:53

This lecture will teach you how to bypass limited privileges and execute system commands on the target web server using Weevely.

Downloading Files From Target Webserver Preview 04:39

This lecture will teach you how to download files from the target webserver to you machine.

Uploading Files To Target Webserver Preview 07:52

This lecture you teach you how to upload files from your computer to the target webserver, this can be very useful as it can be used to upload scripts, exploits ....etc.

Getting a Reverse Connection From Weevely Preview 07:46

This lecture will show you how to get a reverse shell access from a weevely shell.

Accessing The Database Preview 08:53

This lecture will show you how to access the database of the webserver we hacked.

You will learn how to find database information (username, password ..etc), and how to use this information to either connect to the database and run SQL commands, or download the whole database to your local machine.

Conclusion Preview 05:20

In this lecture we'll formalise everything we done so far and go over the general server-side attacks methodology.

Writing a Pentest Report Preview 13:48

At the end of a pentest you have to write a report to detail you findings, such reports are known as pentest reports.
This video will introduce you to pentest reports, you'll learn what to include in a report, what they look like and how to write your own pentest report to detail your findings.

4 Ways to Secure Websites & Apps Preview 09:23

This video explains the best four methods to secure websites or applications in general. It will also breakdown the benefits and disadvantages of each approach and the difference between penetration testing (pentesting) and bug bounty programs.

Bonus Lecture - Discounts Preview 02:16