Beginner Web Application Hacking

Explore a hacking lab built with virtualization, creating virtual machines like Kali, Metasploitable, and Windows to safely learn hacking, testing, and debugging without risking your host.

Install VirtualBox to set up a sandbox environment for beginner web application hacking, enabling hands-on practice of security testing techniques.

Learn metasploitable installation to support beginner web application hacking in this course, focusing on practical setup and foundational skills.

Master configuring virtual machine network settings to practice beginner web application hacking in a practical, hands-on learning environment.

Learn the Linux basics with Kali Linux for hacking, exploring a terminal-driven workflow, essential commands (pwd, cd, ls, nano, cp, rm, mv) and preinstalled tools like nmap and Metasploit.

Master networking basics in Linux by viewing connections with ifconfig and ip. Change ip address, netmask, and broadcast; change mac address; and request a new ip with the dhcp client.

Explore Linux file permissions and root access, using sudo su, ls -l, and chmod to demonstrate read, write, and execute rights, including 777.

Learn how to manage software in Kali Linux: search with apt-cache, install via apt-get, update and upgrade the system, and clone tools from GitHub with git clone.

Learn what a website is, how it runs on an operating system, how web applications use languages like PHP, HTML, Python, and JavaScript, and how DNS resolves names to IPs.

Explore the basic flow of http requests—from client to server to response—then learn how a Burp proxy intercepts and modifies traffic for ethical hacking through a man-in-the-middle approach.

Explore open source information gathering for web apps. Identify IP and domain lookup, DNS, WHOIS, server technologies, subdomains, and directory discovery with NOC, Robtex, and DirBuster.

Discover how to gather information on a local network using netdiscover and nmap, identify devices, open ports, banners, and vulnerable services on Metasploitable2 and its web applications.

Explore information gathering techniques in web application hacking by practicing directory brute-forcing with word lists, using tools like Go-buster and Dirbuster, and uncovering hidden files, robots.txt, and default credentials.

Begin vulnerability assessment by identifying exposure points, using nmap, nikto, and legion to scan ports, enumerate directories, and reveal vulnerabilities.

Explore vulnerability assessment and exploitation concepts using scanners and a Metasploit console to identify exploitable services, simulate backdoor access, and discuss ethical bug bounty practices.

Explore the file upload vulnerability as an entry point for attacks and how unvalidated uploads can execute code. Learn to validate file name, type, and extension and prohibit executables.

Analyze a file upload vulnerability in a low-security web app and demonstrate how a backdoor and reverse connection can be established through a malicious upload.

Learn how a code execution vulnerability on a web server enables attacker-controlled command execution. Explore how this can yield a reverse shell and full system control.

Demonstrates exploiting a code execution vulnerability in a DVWA lab, showing command execution, shell access, and data leakage via chained commands and netcat sessions.

Local file inclusion lets a web app read or expose server files. Attackers can access sensitive files on the same server, such as etc/passwd.

Explore local file inclusion vulnerabilities, demonstrate reading sensitive files like etc password, and leverage Burp Suite proxy to craft a reverse shell using netcat.

Learn about remote file inclusion, a vulnerability that lets attackers reference external scripts and read files from any server. Apply defenses like input filtering and whitelisting to mitigate RFI risks.

Explore remote file inclusion and local file inclusion on a metasploitable web server by enabling php.ini settings, restarting services, and delivering a reverse shell payload for remote access.

Explore the hardest vulnerability to mitigate: sql injection that manipulates the database to bypass authentication and access data. It can modify records and upload files, keeping mitigations challenging.

Explore sql injection techniques to bypass login on a DVWA-based web app. See how crafted inputs alter queries to grant access and relate to the OWASP top ten.

Master blind sql injection techniques that expose data without visible errors, using boolean logic, quoted inputs, and payloads like 1=1 and hash to reveal user details and admin credentials.