WEBVTT

0:00:03.720000 --> 0:00:06.720000
 Hello everyone and welcome.

0:00:06.720000 --> 0:00:11.700000
 In this section of the course we're
 going to be taking a look at modern

0:00:11.700000 --> 0:00:18.200000
 web application architecture and then
 server side attacks or you know

0:00:18.200000 --> 0:00:21.660000
 the server side infrastructure so what
 we're going to be targeting as

0:00:21.660000 --> 0:00:24.320000
 well as you know the attacks.

0:00:24.320000 --> 0:00:29.160000
 And so we're going to kick off with
 getting an understanding of you know

0:00:29.160000 --> 0:00:33.900000
 modern web application architecture
 and you may be wondering to yourself

0:00:33.900000 --> 0:00:35.640000
 why is this important?

0:00:35.640000 --> 0:00:39.960000
 Well it's important for a couple of
 reasons and it'll become you know

0:00:39.960000 --> 0:00:45.920000
 it'll become apparent very soon but
 the basic idea is that as a whole

0:00:45.920000 --> 0:00:51.560000
 not just you know related specifically
 to this course you need to understand

0:00:51.560000 --> 0:00:56.800000
 the architecture used to build modern
 web applications or what you're

0:00:56.800000 --> 0:01:03.360000
 likely to encounter and you know the
 key point of the key takeaway is

0:01:03.360000 --> 0:01:07.100000
 going to be the fact that there's you know
 different types of web application

0:01:07.100000 --> 0:01:12.740000
 architecture and they're used for various
 reasons but more importantly

0:01:12.740000 --> 0:01:18.140000
 you need to understand how you know
 these architectures are structured

0:01:18.140000 --> 0:01:24.800000
 the layers that they essentially contain
 from an organizational perspective

0:01:24.800000 --> 0:01:30.180000
 and what that means for you or what
 that means from the perspective of

0:01:30.180000 --> 0:01:32.220000
 you know server side attacks.

0:01:32.220000 --> 0:01:38.660000
 So I know I've just said a lot you know
 outright without explaining anything

0:01:38.660000 --> 0:01:41.940000
 but let's go through this and by the end
 of this video you should understand

0:01:41.940000 --> 0:01:44.180000
 why this is important.

0:01:44.180000 --> 0:01:49.320000
 So to start off when interacting with
 a web application through a browser

0:01:49.320000 --> 0:01:52.540000
 so just think of any side that you use.

0:01:52.540000 --> 0:01:57.800000
 Now I'm going to assume I'm not going
 to assume that you know you guys

0:01:57.800000 --> 0:02:02.600000
 actually think of it this way but most
 people you know to most people

0:02:02.600000 --> 0:02:08.880000
 it may seem like a very simple one-dimensional
 system where a single entity

0:02:08.880000 --> 0:02:13.760000
 or a server is serving your requests
 or is handling your requests.

0:02:13.760000 --> 0:02:20.500000
 However as you know or you may know
 the reality is far more complex and

0:02:20.500000 --> 0:02:25.080000
 the reality you know that I'm speaking
 of is the fact that modern web

0:02:25.080000 --> 0:02:30.000000
 applications are built on sophisticated architectures
 with multiple interconnected

0:02:30.000000 --> 0:02:35.780000
 components. The keyword there is multiple
 followed by interconnected but

0:02:35.780000 --> 0:02:40.700000
 multiple is very important and these
 multiple interconnected components

0:02:40.700000 --> 0:02:45.700000
 work together to deliver a seamless
 experience to the user.

0:02:45.700000 --> 0:02:50.540000
 As a result understanding modern web
 application architecture is essential

0:02:50.540000 --> 0:02:55.280000
 for you as a web application penetration
 tester because it provides you

0:02:55.280000 --> 0:03:00.480000
 with a clear view of how various components
 such as web servers application

0:03:00.480000 --> 0:03:06.660000
 servers, APIs and database interact
 and function together you know to

0:03:06.660000 --> 0:03:12.480000
 bring you that single collective experience
 that you actually get to experience

0:03:12.480000 --> 0:03:15.100000
 or get to use via your web browser.

0:03:15.100000 --> 0:03:18.940000
 And so the point I'm making here is when
 you're interacting with the website

0:03:18.940000 --> 0:03:24.340000
 your your visibility is limited to just
 what you can do or what you can

0:03:24.340000 --> 0:03:25.760000
 see via your browser.

0:03:25.760000 --> 0:03:30.560000
 Now I know that you know a lot of you
 experience pen testers you know

0:03:30.560000 --> 0:03:34.740000
 specifically when it comes down to web
 app pen testing know that the the

0:03:34.740000 --> 0:03:37.200000
 actual truth is far more complex.

0:03:37.200000 --> 0:03:41.680000
 There's a lot of components that actually
 end up as a whole giving you

0:03:41.680000 --> 0:03:46.780000
 that singular or one-dimensional
 experience.

0:03:46.780000 --> 0:03:48.860000
 So I just wanted to clarify that.

0:03:48.860000 --> 0:03:53.420000
 Now to build on what I just said at the
 end of the previous slide understanding

0:03:53.420000 --> 0:03:57.460000
 modern web application architecture
 will enable you to better understand

0:03:57.460000 --> 0:04:00.480000
 and map out the functionality
 of the web application.

0:04:00.480000 --> 0:04:07.520000
 So you understand you know what the extent
 or the scope of its functionality.

0:04:07.520000 --> 0:04:11.640000
 Secondly identify the various components
 that make up its architecture

0:04:11.640000 --> 0:04:16.900000
 and I should say more importantly the
 technology stack that is being used

0:04:16.900000 --> 0:04:19.840000
 by the web application as a whole.

0:04:19.840000 --> 0:04:25.080000
 So for example it's not enough to say
 that oh there must be a relational

0:04:25.080000 --> 0:04:30.420000
 database it's probably a good idea to
 understand what relational database

0:04:30.420000 --> 0:04:36.780000
 it is. So does the web app use
 a MySQL, PostgreSQL etc.

0:04:36.780000 --> 0:04:40.880000
 Furthermore this knowledge is also useful
 in understanding the layer specific

0:04:40.880000 --> 0:04:46.060000
 vulnerabilities how they can propagate
 across layers and of course the

0:04:46.060000 --> 0:04:52.400000
 potential impact of exploiting said vulnerabilities
 or weaknesses or vulnerabilities.

0:04:52.400000 --> 0:04:57.000000
 Now in the context of this course namely
 server-side attacks understanding

0:04:57.000000 --> 0:05:02.580000
 web application architecture more specifically
 you know server-side infrastructure

0:05:02.580000 --> 0:05:05.560000
 is particularly important.

0:05:05.560000 --> 0:05:09.940000
 This is because vulnerabilities like
 you know server-side request forgery

0:05:09.940000 --> 0:05:16.260000
 and insecure deserialization which are
 the core of this course often exploit

0:05:16.260000 --> 0:05:21.260000
 the architecture's internal trust relationships
 data flows and of course

0:05:21.260000 --> 0:05:25.840000
 the interactions between
 all of these components.

0:05:25.840000 --> 0:05:30.360000
 So the key point here is that by understanding
 a web applications architecture

0:05:30.360000 --> 0:05:35.320000
 you can approach these attacks with
 precision, uncover hidden flaws that

0:05:35.320000 --> 0:05:39.540000
 you may have previously not been able
 to find or uncover and recommend

0:05:39.540000 --> 0:05:44.000000
 targeted mitigations if you are you
 know performing a web app and test

0:05:44.000000 --> 0:05:48.200000
 but it's also probably a good idea to
 include that in you know your bug

0:05:48.200000 --> 0:05:54.860000
 bounty reports. So that begs the question
 what exactly is web application

0:05:54.860000 --> 0:05:58.680000
 architecture. You know I've thrown that
 word around quite a bit it's in

0:05:58.680000 --> 0:06:02.980000
 the title of this video and it's probably
 wise to understand what this

0:06:02.980000 --> 0:06:06.720000
 is and again if you have no experience
 in software development this will

0:06:06.720000 --> 0:06:09.200000
 sort of seem like a new term.

0:06:09.200000 --> 0:06:15.120000
 In reality the broader term is software
 architecture right but specifically

0:06:15.120000 --> 0:06:24.420000
 in the case of web applications the
 adapted name becomes web application

0:06:24.420000 --> 0:06:28.260000
 architecture. So again what is
 web application architecture?

0:06:28.260000 --> 0:06:32.300000
 Well web application architecture refers
 to the framework and structure

0:06:32.300000 --> 0:06:37.780000
 that defines how the components of a
 web application interact with each

0:06:37.780000 --> 0:06:42.360000
 other and function together to deliver
 the application to the users.

0:06:42.360000 --> 0:06:45.800000
 Now you may be asking yourself the
 question well what if I just have a

0:06:45.800000 --> 0:06:49.180000
 simple you know landing
 page HTML website.

0:06:49.180000 --> 0:06:52.880000
 Well even in that case there is an
 underlying architecture regardless

0:06:52.880000 --> 0:06:56.740000
 of whether or not you have actually
 thought about how it all works or

0:06:56.740000 --> 0:06:58.600000
 it all comes together.

0:06:58.600000 --> 0:07:02.400000
 You know if you think about it even
 the most simplistic there's always

0:07:02.400000 --> 0:07:06.000000
 going to be a web server
 that is being used.

0:07:06.000000 --> 0:07:09.900000
 Now that you know is a very basic example
 but the bottom line is that

0:07:09.900000 --> 0:07:14.340000
 the more functionality that a web application
 has it's you know quite

0:07:14.340000 --> 0:07:19.320000
 likely that you're going to have additional
 components or the larger or

0:07:19.320000 --> 0:07:24.420000
 the broader user base a web application
 has the more you're going to start

0:07:24.420000 --> 0:07:30.840000
 to see you know the inclusion of let's
 say intermediary systems like proxies,

0:07:30.840000 --> 0:07:32.440000
 load balances etc.

0:07:32.440000 --> 0:07:37.980000
 All of these have to fit into sort of
 a cohesive structured architecture

0:07:37.980000 --> 0:07:40.640000
 in order for it to work well.

0:07:40.640000 --> 0:07:45.740000
 So web application architecture encompasses
 the design of the applications

0:07:45.740000 --> 0:07:51.280000
 front end, back end data storage and
 the communication between them and

0:07:51.280000 --> 0:07:57.080000
 the communication aspect is very important
 right and all of this is you

0:07:57.080000 --> 0:08:02.580000
 know to ensure that they all that all
 of these components work cohesively

0:08:02.580000 --> 0:08:06.500000
 to provide a seamless user experience.

0:08:06.500000 --> 0:08:11.360000
 So in essence or to summarize what I've
 just said web application architecture

0:08:11.360000 --> 0:08:16.540000
 is the foundation that determines the application's
 functionality, performance

0:08:16.540000 --> 0:08:21.240000
 and adaptability making it a critical
 element in the development process

0:08:21.240000 --> 0:08:26.620000
 and that you know it goes without saying
 that without a solid or you know

0:08:26.620000 --> 0:08:34.360000
 well-defined fail to meet the user
 expectations or business goals.

0:08:34.360000 --> 0:08:40.580000
 So again I'll use the example I spoke
 of a couple of seconds ago scalability

0:08:40.580000 --> 0:08:46.420000
 is one of these important factors at
 least nowadays it is that actually

0:08:46.420000 --> 0:08:50.320000
 makes companies or developers think
 about the actual architecture and

0:08:50.320000 --> 0:08:53.400000
 all of these components are going to
 work together how they're going to

0:08:53.400000 --> 0:08:57.800000
 serve you know the entire world and
 how to handle you know increasing

0:08:57.800000 --> 0:09:02.780000
 amounts of traffic or high amounts
 of traffic so on and so forth.

0:09:02.780000 --> 0:09:06.960000
 You know this can get quite complex but
 this is not the focus of the course

0:09:06.960000 --> 0:09:12.480000
 I just want to sort of give you an introduction
 to it especially modern

0:09:12.480000 --> 0:09:16.580000
 web application architecture because
 it's very important and trust me

0:09:16.580000 --> 0:09:20.660000
 the more I started to understand you
 know the different architectures

0:09:20.660000 --> 0:09:27.500000
 out there and what that means for a pen
 tester I really improved you know

0:09:27.500000 --> 0:09:32.880000
 my I really improved my methodology
 and as a result I have I was and I

0:09:32.880000 --> 0:09:36.640000
 have been able to find you way more vulnerabilities
 than I did previously

0:09:36.640000 --> 0:09:42.140000
 this was especially the case when I
 was doing clock bounties so this is

0:09:42.140000 --> 0:09:48.200000
 very important. So what that means
 is that at their core and of course

0:09:48.200000 --> 0:09:53.880000
 I'm generalizing here but generally
 speaking web applications nowadays

0:09:53.880000 --> 0:09:59.860000
 consist of application servers not always
 but generally application servers

0:09:59.860000 --> 0:10:04.080000
 process business logic and we'll talk
 about what that means and handle

0:10:04.080000 --> 0:10:07.500000
 dynamic requests from users and then
 we have you know the web servers

0:10:07.500000 --> 0:10:11.560000
 which are not explained here but the
 database servers right so these are

0:10:11.560000 --> 0:10:15.240000
 dedicated servers that are useful storing
 and retrieving application data

0:10:15.240000 --> 0:10:20.540000
 typically secured behind firewalls and
 isolated from direct external access

0:10:20.540000 --> 0:10:24.800000
 that's the ideal as you know and as
 I know that's not always the case

0:10:24.800000 --> 0:10:30.580000
 but that's typically what you're going
 to be trying to do and then of

0:10:30.580000 --> 0:10:33.840000
 course you have your performance optimization
 mechanisms which would be

0:10:33.840000 --> 0:10:39.900000
 considered your middleware not really
 middleware the intermediary systems

0:10:39.900000 --> 0:10:44.760000
 so these are services like content delivery
 networks or CDNs that cache

0:10:44.760000 --> 0:10:49.260000
 static assets so you know for the presentation
 layers so this can be images

0:10:49.260000 --> 0:10:55.900000
 JavaScript libraries CSS etc and you know
 they do this closer to essentially

0:10:55.900000 --> 0:11:00.780000
 reduce the latency and server load
 so using a CDN essentially ensures

0:11:00.780000 --> 0:11:05.640000
 that all of these critical assets that
 the presentation layer the web

0:11:05.640000 --> 0:11:10.360000
 application uses that need to be accessed
 or that are required to render

0:11:10.360000 --> 0:11:15.780000
 the web application correctly in a
 user's browser you know need to be

0:11:15.780000 --> 0:11:21.660000
 or CDNs essentially ensure that they're
 available you know globally you

0:11:21.660000 --> 0:11:27.240000
 know to essentially ensuring that then
 most geographic locations and that

0:11:27.240000 --> 0:11:31.720000
 reduces latency which increases the
 responsiveness or you know reduces

0:11:31.720000 --> 0:11:35.020000
 the amount of time it takes to load
 up the web application but really

0:11:35.020000 --> 0:11:43.660000
 it's it's it's important for responsiveness
 so again I think I I sort

0:11:43.660000 --> 0:11:48.640000
 of explained this but why is this important
 well the this architectural

0:11:48.640000 --> 0:11:54.200000
 organization allows for scalability
 security and high availability as

0:11:54.200000 --> 0:11:59.840000
 I just extolled a few seconds ago now
 let's take an example you know in

0:11:59.840000 --> 0:12:03.320000
 such configurations like the one I just
 showed you in the previous slide

0:12:03.320000 --> 0:12:07.600000
 the IP address associated with the
 applications domain name typically

0:12:07.600000 --> 0:12:11.780000
 or often points to an intermediary
 service like you know load balances

0:12:11.780000 --> 0:12:16.540000
 or CDNs which you know I've just mentioned
 their primary function but

0:12:16.540000 --> 0:12:21.780000
 from a security perspective they obscure
 the actual IP addresses of the

0:12:21.780000 --> 0:12:26.260000
 you know application servers or the
 server itself from direct exposure

0:12:26.260000 --> 0:12:31.480000
 to users while the client side experience
 appears straightforward the

0:12:31.480000 --> 0:12:36.180000
 underlying architecture is complex is
 a complex layered system that ensures

0:12:36.180000 --> 0:12:41.400000
 performance resilience and reliability
 each component is meticulously

0:12:41.400000 --> 0:12:47.320000
 designed to handle specific roles making
 modern web applications robust