REAL World Website Hacking and Penetration (101% Practical)

Install xampp on your system, choose custom components (apache, mysql, php), download from the official site, configure firewall prompts, and learn to start services and troubleshoot apache.

Troubleshoot Apache failure by freeing port 443, often used by Skype, and change listen ports in ssl and non-ssl config files to 8443 and 8080.

Install and configure dvwa on a local server, set up database, enable php include, adjust memory limit and maximum input time, then restart services and log in to explore vulnerabilities.

Install the essential penetration testing tools on Windows using a native tool box, including Metasploit, Nmap, and Burp Suite, with Mac VM alternatives.

Configure Burp Suite as a Firefox proxy to intercept and forward browser traffic between the browser and websites, then install Burp's root certificate to enable SSL through the proxy.

Learn how to set the DVWA security level and compare four options, low, medium, high, and impossible, while understanding how protections evolve and vulnerabilities interact.

Explore the four-step flow of a web request—from the user over the internet to web, file, and database servers. Identify vulnerabilities at any stage to support practical penetration testing.

Explore passive information gathering by examining publicly available data about a target without interaction, using open source data from a site's tech stack, DNS records, and whois records.

Learn how active information gathering differs from passive methods, using tools like nmap to scan, enumerate ports and services, and test a web site with payloads to uncover xss.

Contrast source code review with fuzzing, within black box, white box, and gray box penetration testing, and demonstrate how fuzzing uncovers vulnerabilities like insecure password changes.

Understand why never trust user input, and how missing validation and sanitization lead to reflected cross site scripting (XSS) and potential code injection.

Demonstrate stored cross site scripting (xss) vulnerability by testing name and message fields, observing database storage and page rendering, and evaluating defenses across low to high security levels.

Learn how to detect and bypass filters in reflected cross-site scripting (xss) across low, medium, and high security levels, including payloads like script tags, onload events, and cookie theft.

Explore cross site request forgery (CSRF) and how forgery of requests bypasses user intent, enabling password changes, account takeovers, and other unauthorized actions.

Learn how cross-site request forgery enables unauthorized password changes by crafting requests, and how anti-CSRF tokens and referer checks mitigate this threat.

Learn how sql injection enables login bypass by manipulating input with ' or 1=1, and why input sanitization and validation are critical in real-world web apps.

Learn to automate sql injection with sqlmap, intercept requests via a proxy, identify vulnerable parameters, enumerate databases, tables, and columns, and dump data including cracked password hashes.

Explore how common injection and command execution occur in a web application that blindly trusts user input, leading to executing system commands like ping on Windows or Linux.

The lecture demonstrates command execution vulnerability through input handling, showing how colon, ampersand, and pipe enable multi-command injection, and contrasts brittle blacklists with a secure IP address validation.

Explore vulnerable file uploads in web apps, showing how unchecked extensions and content on the same server can enable full system takeover, with DVWA in focus.

Explore real-world file upload vulnerabilities, demonstrating low to medium security scenarios, bypassing extension checks and headers to upload shell files, analyze requests with a proxy, and assess server risk.

Explore popular web shells such as C99 and AR57, and learn how they enable testing through server command execution, with demonstrations of their features and sizable codebases.

Explore how brute force attacks work by attempting usernames and passwords with automated tools, and learn how protections like a 15-second delay after three failed logins mitigate these attacks.

Demonstrate a brute force attack on a login form using Burp Suite intruder to automate password guesses against a local host, highlighting the risk of missing login attempt validation.

Discover how to automate web security testing with Vega scanner, configure the base url, scope, and modules, run scans, view executive summaries, and grasp remediation and reporting.

Learn how a source code disclosure vulnerability can expose credentials and database access by leaking php files and configuration, and apply prevention strategies to secure web applications.

Automate web vulnerability scanning with the Arachni scanner, building profiles, scheduling scans, and navigating high, medium, and low risks with false positives and fixes.