What is Digital Marketing
What is Digital Marketing
YASIR ALI RAJPUT
What is Digital Marketing
What is Networking
in this video we will study about web
server
and application server and this video
will hopefully clear some of your doubts
regarding web server and application
server
so let's begin what is a web server
web server is a computer system
that hosts websites so what do you mean
by websites
it's a collection of web pages
so for example when you open amazon.com
it's a website and it does not have a
single web page but it has multiple web
pages
so when you open it you see the home web
page
but when you click on a product you will
be uh
taken towards a different web page that
will be the product web page
and there you will see multiple things
the image of the product info
and even recommendations so that means
website and then any computer system can
be a web server
what is the difference between a normal
computer system
and a web server so the difference is
that
this computer system is running a web
server software
for example apache http
web server this is the most popular one
today as of now
then we have microsoft iis and some
others
so is this the only difference that
computer system
and a computer system running web server
software
no there is one more difference and the
second is that
this computer system should be connected
to internet
in order to act as a web server
otherwise
uh clients web clients cannot contact it
through http
so it may not be able to it will not be
able to serve those
so it will not be acting as a web server
so it should be connected to internet
and it should be running a web server
software
so uh typically web servers host
multiple websites
some only host a few while others may
host several hundreds
but there are some dedicated servers
also
so based on that we will categorize a
web server
into two parts one is that web servers
that host websites for multiple users
these are called shared hosts
and there are some dedicated uh web
servers that will be hosting uh
websites for single person or company
and these will be called
dedicated hosts
so which servers are shared and which
are dedicated
so when let's say there is some personal
website
or some small websites which
does not have huge amount of traffic
then those who
would be uh generally hosted on shared
hosts
but uh if there is a huge website and it
has
a high traffic then that requires
a dedicated server for that and also if
the sites require custom server
modification then it will go for
dedicated hosts now uh let's understand
how this web server works
so if we have a web server let's
say this is the web server then there
must be a client
client whom the server is serving so we
will call it
web client so this client
sends an http request to the web server
and it will request for some page or it
will require for some other resources
so there are two possibilities one
possibility is that the
requested url the page that is requested
or the file that is requested
is present with the web server then it
will immediately send
a http response with the file
but it may be possible that that is not
present on the web server
so it can look into a static
database so these are files that is
present to this
then there may be also static database
which the web server can contact and
fetch the file
and return to the send http response but
there may be scenario that
this is not present in the staticdb but
it needs some processing
then what this web server will do is
that it will
send a servlet request to the
application server so you can now see
application server coming into
picture it will send a
servlet request
to application server so just a quick
info what is a servlet if you may be
wondering a servlet is a small java
program that runs with a web server
servlets receive and respond to requests
from web clients usually across
http so these will be some java programs
so it will require some processing so it
will send this servlet request
to this application server it will
contact the
application data store
in order to process run this servlet and
fetch some
details from here and do further
processing
and then it will send a servlet response
to the web server and now this web
server has the
response built in so response ready so
it can
send http response back to the
web client so this is how web server
works
and this application server may not be
always required but it may be required
when some intense processing is required
which web server cannot handle so this
is a
rough idea and you should understand
this flow
now let's see some of the examples of
web servers so one
most popular web server is apache http
server
and its most popular as of now it's
developed by
apache software foundation
and just a rough estimate roughly 60
percent
of the web servers run apache web server
and it can be installed on
all operating systems including linux
unix windows
freebsd mac ox osx and more
and it's a open source software so all
of these
are related to its popularity that's why
it's so popular
then we have internet information
services or in sort iis
it's developed by microsoft
and it runs on windows nt 2000 and 2003
platforms
and it is tightly integrated with the
operating system
so it is easy to administer it then we
have some other web servers like lite pd
sun java system web server and jigsaw
server
there are a few more but those are not
that much popular
now we have a good understanding of web
server we also know
the most popular web servers how web
server functions
now let's quickly look at application
server
so application server is a server that
is specifically designed to
run applications and here also we had
seen that
this was coming into picture when this
web server did not had the request ready
and it needed to run some
java program to build the response
so it's a server designed for running
applications
and it includes both hardware and
software that
provide an environment for programs to
run
so what are some of the uses of
application server
it's used for running web applications
hosting a hypervisor that manages
virtual machines so what are hypervisors
these are software programs that manage
one or more virtual machines and these
can be used to create
start stop and reset virtual machines
then application server can be used for
distributing and monitoring software
updates and also processing data sent
from
another server now next question is why
we use application server we already
have some idea why we use application
server
so a web server if you see is designed
and often optimized
to serve web pages and not more than
that
therefore it may not have the resources
to run demanding web applications
so an application server provides the
processing power
and the memory to run these applications
in real time
it also provides the environment to run
specific applications
for example let's say a cloud service
may need to process a data
on a windows machine
and a linux based server may provide the
web interface for the cloud service
but it cannot run the windows
application it can just provide an
interface therefore it may send the
input data
to a windows based application server so
this web server
is running on linux and it has some
interface with which the the client can
interact but it cannot process
uh something some application which can
only run on a windows so it has to
contact
the application server which will be
running on windows
and then it will run that application
therefore may it may send input data to
a windows based server and the
application
server can process the data and then
return the result
to the web server once processing is
done
and which can be output
as the form of result on a web browser
so it can be sent to the client
so you see that here it's necessary
it cannot do it cannot be done on the
web server
so this is some intuition why we need
application server
just one of the reasons is that it
provides the environment
to run a specific application web server
may not have that environment
and it's more powerful it provides
processing power
memory as well as environment
so i hope i was able to clear your some
of your doubts regarding web server and
application server
thank you
hello everyone it's zade from zed
security
and in this video i want to answer a
very common question that i get
which is what is the best hacking
operating system
is it kai linux is it pirate os do real
hackers
use these operating systems and what
about windows and osx
before we get into all of this please
make sure you like this video if you
enjoy my content
this makes the youtube algorithm push my
video more
it also tells me that you're enjoying my
content which will make me make more
videos
so more likes equals more videos
so first of all let's simplify the
situation forget about windows and os x
don't get me wrong they're good
operating systems for daily use
and for other uses but when it comes to
hacking they're just not that good
because a lot of the hacking tools are
simply not designed to work on windows
you can get them to work if you really
try to but they'll still be buggy
and in many cases it'll just be really
difficult to get them to work in windows
now i know what you're gonna say but
zade you use os x
and that's correct but i only use os x
for my daily use
i'm a big believer in separating your
domains
so i use osx for my daily use but i use
a hacking
operating system when i want to hack and
i also use several other different
operating systems
for different uses so i'd use tails or
cubes if i'm accessing the dark web
and i'd use other different operating
systems for different
uses you can do this by having different
computers
or you can actually install these
operating systems
as virtual machines and that's actually
what i do and you see me do it in my
courses
so i have a hacking operating system and
several other operating systems
all installed as virtual machines inside
os
x which is the computer that i use for
my daily use you can have them installed
inside your windows machine the one that
you use for your daily use that's not a
problem and then
use each one of them for a different
purpose for the purpose that they're
made for
so now that we have windows and os x out
of the way
we are left with linux so the question
now is
what is the best linux hacking distro
now if you know anything about linux you
know that there are
so many different flavors and different
linux distros
there are ones that are made for general
use there are ones for everyday
use there are ones for design and there
are linux destroys for hacking
and the most popular as you know kali
linux
and parrot os now to answer the question
which is best
it's very important to understand how
these linux distros are built
so we have a number of base
general use linux distros examples would
be debian
red hat and arch these are usually very
stable linux distros
that existed for a long period of time
and therefore
they're usually used as a base in order
to build
other distros for example we have a very
common linux distro called ubuntu
that is designed to be user friendly and
easy to use
ubuntu is built on debian but it comes
with a nicer graphical interface
with its own software manager and a
number of really useful programs
that make the operating system easier to
use
and more user-friendly another example
is mint
mint is built on ubuntu that is built on
debian
so you want to try to make debian more
user-friendly
but with the extra added features ubuntu
became resource hungry
therefore we have debian which combines
best of both worlds
so it uses its own graphical user
interface that is less resource hungry
but still maintains all of the user
friendliness
and the nice features that ubuntu offers
to help make debian
more user-friendly and easy to use so
these other hacking distros are no
different than all of the other linux
distros
they pick a base and they install a
number
of hacking tools on them so cali
pirate and backbox all are popular
hacking distros
and they're all built on debian we also
have
arch strike and black arch and they're
both built on arch
so if you think of it these hacking
operating systems
are simply normal linux distros that can
actually be used for any use you want
but someone came in and pre-installed a
number of hacking tools on them
so you're probably thinking now that i'm
full of and if this was the case
then why do people actually use these
operating systems if they don't offer
anything new
if they're simply linux operating
systems with tools well the answer is
very simple
it's convenience see back in the day
before we even had kali
before we even had backtrack which is
the old version of kali
we actually used to build our own
hacking distros if you want to call them
hacking distros
so you would go ahead and pick a linux
distro
that you like and you're comfortable
with and then you'd install
all of the hacking tools and the other
tools that you like yourself
and then you would make a backup of this
on a storage device or on
a cd and then you can install that on an
on a real computer or you can live boot
from it
and use it for hacking and for other
uses
to do this you had to first of all be
very comfortable with using linux
you have to know the tools that you want
to use for hacking you'll have to learn
how to properly install these tools and
configure them
and solve conflicts which is very very
annoying
and you might have to recompile the
kernel of your installing drivers and
doing some other
annoying tasks so as you can see there
is a bit of a learning curve to this
and even if you know all of this even if
you learned it and you streamlined the
process
it's still going to be time consuming
when there is updates when there's new
things to be made
it's still time consuming therefore a
bunch of really smart people at
offensive security
got the idea of making a team and making
a hacking distro
this team will work on this hacking
distro and publish it to the world
the world can also contribute to it and
this way
we will have an operating system that is
made for hacking
so we can install it it comes in with
all of the tools that we need to use
pre-configured and pre-installed so we
won't waste time
installing and configuring these tools
and that is the only reason people use
kali and such operating systems in order
to save time
so like i said kali started with
backtrack which was based on slacks
and then kali linux came in which is
based on debian
and right now we have the latest
versions of kali and parrot
and both of them are really really cool
operating systems in my opinion
there are other good up hacking
operating systems but i think
kali and pirate really take the
spotlight
these days but as these operating
systems grew
they tried to tailor for different
hacking fields and for different uses
so both of these operating systems now
come with thousands of tools
and you probably don't even know how to
use a lot of them
therefore you're installing these huge
operating systems with a huge amount of
tools
and you probably don't even need to use
a lot of these tools
these extra tools are using your
resources they are taking up space and
they're slowing down your computer
for no reason therefore in my opinion
now that these operating systems have
grew so much
and are trying to become a hacking
operating system
with the idea of one size fit all i feel
like we kind of need to go back
to where we started with you creating
your own hacking
operating system obviously once you know
that hacking is your thing and you want
to continue with this
then it is a very good idea to actually
build your own hacking operating system
because that way you'll only have the
tools that you want to use yourself
you'll also learn how to properly
install them and configure them so if
something breaks you'll be able to fix
it quickly
and it's not a problem that you have a
limited amount of tools
because let's say you learned a new
topic and you wanted to install new
tools
you can just go ahead and install these
tools and have them part
of your own hacking operating system
instead of downloading kali or
parrot with a thousand tools and you're
only using 10.
so bottom line is both kali and parrot
os
are great hacking operating systems
which one you want to use is a matter of
preference
but in my opinion the best thing to do
is to actually have your own hacking
operating systems
with the tools that you like yourself at
the end of the day
like i've been saying throughout the
whole video the operating system that
you use
does not matter it is the tools that are
important if you know how to use the
tools you can use them in any operating
system
and i know what you're thinking right
now why do i use kali linux in my
hacking courses
if i recommend creating your own hacking
distro the answer for this is very
simple
first of all convenience like i said it
saves
so much time of having to go and
download a bear linux and install
all the tools that you need to install
on it so it's a really good way to get
my students
starting and learning really quickly
it's also a great way for me to
introduce them to kali
and such operating systems and as we
said before
the operating system doesn't matter at
all it's the tools
that you use on this operating system so
once they learn hacking in my courses
and how to use the tools
in kali they can use these tools on any
operating system it doesn't really
matter
as long as they manage to install the
tools on that operating system
anyway that's just my personal opinion
let me know in the comments which
hacking distro you like the most
or do you use your own hacking distro
also don't forget to like the video if
you enjoy this content
and subscribe to the channel to stay
updated with the latest in cyber
how to hack so today we will be going
through the kali
linux explain alright so before i do
that i have a wonderful news
okay so the first thing is we actually
have the following new changes
all right that can actually help us do
more tutorial for you so i can go ahead
and go into command prompt and i can
actually show you the new upgrade that
we got
so that we can actually put in more
systems more
service more applications so that we can
demonstrate
how an enterprise network is actually
looking like and then
how we can do ethical hacking and
penetration testing
on those tests labs environment in which
you have like your proxy servers your
directory service
your application systems and so on and
so forth so we can actually build up
a very very nice lab environment in
which we can test
all these different kind of exploits
vulnerabilities
and how enterprises could be trying to
protect your systems
so we got the amd 3900xt
all right so this is a 12 core all right
we have 12
core running to actually help us do all
this processing
as we begin to virtualize even more
systems
all right so that's the good news to
start off today's tutorial
okay so going back to call linux right
so the first question is
what is call of linux all right so call
linux
is an operating system all right very
similar to how for example you would use
your macintosh your windows 10 computer
your ubuntu all right and the list goes
on so this is a linux distribution
and it is of course created and
maintained by offensive security
and it was previously known as backtrack
so i was using backtrack
more than a decade ago more than 10
years ago and it already had all this
wonderful
tools software for us to actually do
adequate hacking and penetration testing
on whether you are
doing it as a penetration tester or
whether you're doing it and learning
about how
certain software could be run how we
could test certain networks and systems
and applications
so this is call linux an ethical hacking
penetration testing platform
okay so of course you can go into the
official
site which is kali.org okay so over here
we have the advanced penetration testing
distribution okay and of course it has
all the
tutorials the new updates of all the
software and so on
so one of those wonderful places that
you go to is to go to the top tab
click under download and click under
download call of linux
okay so over here the wonderful thing is
that we have a lot of different images
that you can use
to run color linux okay and you have
64-bit you can torrent them
okay or you can also download them if
you're for example running different
kind of virtualization technology like
vmware
virtualbox you can just download it
straight and all you got to do is double
click on it
and once you have for example oracle
virtualbox or vmware running
you can immediately get kala linux up
and running
in just a few minutes okay so this is a
wonderful way for us to actually start
using and learning colonics to get more
understanding about radical hacking
okay so moving back into call links so
let me log in
okay so this is the login page let me
log in into call linux
and of course in call linux i am
actually using it
all right as a platform
all right where i can also where i'm
also teaching
a lot of it professionals in the area of
cyber security
all right i've trained hundreds of it
professionals across the world
in terms of using kala linux and of
course you can see
all of the different kind of information
or different kind of payloads that have
created as part of all this training
and one of the important places that we
look at is actually on the top
left corner so this is the manual of
call linux
and they have actually broken down all
this different software for us
so you have your favorites recently used
and so and so forth
but the more important one here is zero
one zero two zero three zero four
all the way to number one three okay so
this
are how they have actually categorized
some of this software
and before i actually dive deeper into
what
each of this category does i also want
to share with you a little more about
for example some of you may be familiar
with the cyber attack framework
which was developed by lockheed martin
and of course there's also the michael
attack framework okay so this is a
knowledge base about foundation
of the development of certain threat
models methodologies
in the private sector in government in
the cyber security product and service
community
or as you can see over here so we have
the i attack miter.org
so we can see all of those information
as you scroll down
okay you have the different kind of
tactics
techniques that the hackers are using so
you have the initial access
execution persistence and so on and so
forth all the way
to the end all right so you can actually
see all of those different kind of
tactics and techniques all right the
techniques are listed over here okay so
for example if you want to look at
abuse elevation control mechanism you
can just go ahead and click
on it and it will give you more
information about sub techniques all
right so for example the subtechnics
here
set uid set gid bypass uac
all right so we have done a couple of
those privilege escalation tutorial and
as part of this
channel all right and then we have super
user do all right caching and so on
so all this gives us a wonderful way of
first understanding about how
disciple attackers do it and two in
terms of the mitigation strategy
and activities that we can put in place
to protect ourselves and our enterprises
against all these type of threats okay
so moving back
into colon linux so you can see some
sort of similarity
or of course in this case more from the
attacker's point of view
so we have for example like information
gathering okay so we have information
gathering it's about
gathering information of a network
a device a suite of devices within a
network or
even about an entity which is coming
from open source intelligence
platforms to help us find out more
details before we launch a attack
all right so you have for example here
dns analysis
you have ssl analysis smtp simple
mail transfer protocol and the list goes
on and you have all this common software
and we have
quite a number of them in terms of
helping us list down
the number of devices in a network all
right so this help us
understand for example how many mobile
devices is in the walls network
how many devices are there in the
network whether they are macintosh now
we're attached storage windows computers
mobile devices we can find all of that
from here
okay and moving on to zero two we have
vulnerability analysis
okay so this is the part where we are
scanning the devices looking up for
certain information where we can try to
break open certain openings
in which we can gain access into the
device so i always go back to the very
straightforward use case that we do
as part of a cyber attack so think of it
again like how a
robber would go breaking into a house
okay so what the robbers will do
is that they will first gather
information about
a particular location about a particular
building or a house or residential area
so they will look at the house look at
the vicinity
is there any nearby police station is
there any
high walls that we need to climb what
kind of fans are they using
and how many doors does this house have
how many
windows do they have on the first floor
so all these are the different
information that they're gathering
about that particular house right just
like how we get our information of a
particular network
all right and then we have to begin
scanning for vulnerabilities
so what do i mean by vulnerabilities
we're looking for
places that can give us access into the
house
okay so maybe this house does not have a
high wall so we can easily jump
through the walls and gain access into
the house
and maybe in the house there are 10
windows on the first floor and
one of the windows is always open in
which the
the robbers can easily just jump through
the window and gain access to the house
after which they will begin all right
finding out where are the cash the
valuables
inside the house so of course in the
cyber world we're looking for critical
data
all right so once we gain access to
critical data or like financial
information
credit card details personal data once
we gain access to them right so that
means the hackers
have access to those systems
applications and those key data
all right and on xero tree we have web
application analysis so we have been
doing a lot
of web application penetration testing
series as well
where we demonstrate how many different
of this sites could be vulnerable to
different kind of hacks
so we went through and using of course
open web application security project
and looking at some of this
electronic homicide as an example of how
hackers could do cross-site scripting
cross-site request forgery trying to do
sql injection to gain access
into other parts of the sites all right
so we have actually went through a lot
of them and as you can see over here
right we have
cms right content management system so
we're trying to identify
what kind of platform technology that
you're running so that
we can conduct specific and create
specific payloads to go
and target against a particular site we
have proxy
web crawlers directory systems so we
even had one tutorial where we could
find out where is the login page for the
administrators right so those
were the kind of different tutorials
that we were doing previously and burp
street i know i got a lot of requests
for burp suite so
i would do a tutorial okay a couple of
tutorials on this
coming soon all right so do do watch out
for those tutorials
and we've gone through all this
different kind of technology and
platforms for us to do
analysis of those sites especially in an
automated way
but burp suite give us the option to be
more manual to actually customize our
payload
and inject them specifically into
different input forms
zero four is database assessment so this
is the part
where the hackers go directly into the
database system to try to extract data
all right so we have done number
tutorial on this and of course
sql map is one of the most used tool
okay to actually conduct
sql injection to try to gain access into
the database system and it could
help us quickly map out the structure of
the database
and be able to flag out certain tables
with sensitive data
with passwords and try to even crack
crack them open
and with sql like database browser right
so a lot of
new modern and web mobile applications
actually need somewhere to store
some of the data so a lot of this
different data could be stored inside a
sql lite
file so we can actually browse them
using the sqlite database browser so we
have done
a couple of tutorial on mobile
application penetration testing too
password attacks so password attacks are
mainly segregated
into two forms all right so one is the
offline attack and the other one is
online attack
all right so online attack means that we
do a direct
attack against the server to try to gain
entry into those credentials
and for offline attacks offline attacks
we are actually
targeting all right based on the
data that we have extracted so once we
have extracted those data what we will
do is we will try
to crack those passwords that we found
all right so that's the whole idea of
password attacks
and we can also look at some of the
usage of the software here that's been
created like
john medusa word list that we also have
used very very frequently together with
other platforms
attacks all right so you can get
yourself a couple of wireless adapters
and we can put them into the promiscuous
mode
and we can start sniffing for data in
the network and looking at how
data are being transacted in the
vicinity in the area so that's part of
wallace attacks
and more than 10 years ago i was already
using aircrack ng
all right so this is actually very very
useful in
helping us crack certain wireless
networks
all right and we have reverse
engineering all right so this is the
part where we can look
into the software and look at the
assembly language of how
they actually call certain functions and
be able to map out
how their how their application code
could be running logically
and they're looking at places where it
could possibly inject
into the into the software to gain
access to the system
we have exploitation tools like mata
supply framework that we have done
a lot of tutorials on in which we learn
about how we can
target a specific system and run those
payloads
with a shell all right so that we have a
access into the system
and looking at the different modules as
part of metasploit framework to
run our attack okay and we've also
looked into
social engineering toolkit as a way for
us to also
target users on the psychological end
of the attack right so this is how the
fraudsters
all these scammers is to try to trick
users into giving up their usernames
passwords personal data and so on
all right then we have sniffing and
spoofing all right so this is the part
where you could
possibly set up a fake wireless access
point and as people
gain access to your fake wireless access
point you could see all those data
they're going in and out of the system
or if you manage to join a network you
could actually run
a sniffing right to look at certain data
that's been transacted in the
environment
and be able to view into those payload
we have post exploitation so this is the
part where you gain access in the system
and you may want to correct the password
you may want to gain elevated privileges
so those are the different kind of
modules available
as part of post exploitation so we have
went through on mimikatz
powersploit all right and we'll try to
go through the rest of the other
software
or even writing those software ourselves
we have forensics
okay so this is the part where we have
not gone through at all yet
as part of the channel but definitely
really exciting topic and domain that we
will
look deeply into in future tutorials so
do stay tuned for that
reporting tools okay so if you're a
penetration tester at the end of day
whether you are
doing your internal or external
penetration testing you definitely need
to be able
to generate reports to provide them back
to the stakeholders and let them be in
form of
where you detect the vulnerabilities so
again going back to the earlier analogy
about how robbers go after houses so
what we're trying to do here
is to be the good guys all right so
you're scanning
the house ahead and you're scanning the
doors the windows
assessing the security posture of the
house
and of course in the cyber world
security posture of the enterprise
and once you look into all these
different systems applications devices
network equipments and so on and you
find out and flag out where are the
vulnerabilities
and then you prioritize them because
depending on the criticality of those
vulnerabilities and how easy
and dangerous they are if they are
exploited and then giving a
recommendation
back to the stakeholders about what they
should do in order to contain
all right and or of course in order to
remediate against those vulnerabilities
before the hackers do it
okay and again social engineering tools
okay we have no tago we have social
engineering toolkit
msf payload creator npc so again
very very good ways for us to launch
attacks where we could get usernames and
passwords
so rather than doing all the technical
stuff why not couple it together with
how
the hackers could be doing up a fake
login page to get usernames or passwords
through phishing attacks okay so this
are the different
components or categories inside call
linux as part
of how we can perform adequate hacking
and penetration testing
so once again i hope you've learned
something valuable in today's
tutorial and if you have any questions
feel free to leave a comment below and
i'll try my best to answer any of your
questions
and remember like share and subscribe to
channel so that you can be kept abreast
of the latest
cyber security tutorial thank you so
much once again for watching