All language subtitles for 4. Enumerating HTTPHTTPS - Part 2

So now we're going to use a tool called Door buster to do a little bit directory busting.

There are other tools out there that are similar or do the same thing.

There are two built in tools.

In fact there's a door buster and there's also a tool called Herb.

And then there is a tool called Go buster.

And you have a lot of options.

My option of choice is door buster but I do recommend that you write these down and just explore them

for yourself and see which one you like the best.

So I'm going to go ahead and run door buster and I'm going to run it like this with the ampersand at

the end and it's going to load up this nice little interface.

And what we're gonna do is we're going to say hey I want to run against this target you are l I'm going

to go ahead just copy this right here and I'll tap back into it.

And syntax is important.

It's going to want the port 80 at the end you see the port 80 here with the slash and we're going to

say go ahead and go faster on these threads and then we're gonna go ahead and pick a list.

So go ahead and go to browse and let's go ahead and go to your base folder here go into your user use

our folder your share which is right here and then if you start typing words list it I'll bring up word

lists right here.

And then you see there Buster has its own folder right here.

So we're going to select door buster and from here we can pick a variety of different lists.

I like to just use the small list if I'm not finding anything at all maybe I'll move up to the medium

and out on the interweb is a large list as well.

Let's just go ahead and start with small for proof of concept.

And so now let's break it down.

We've kind of talked about in the last video but let's just do a quick reminder what we're doing is

we're going out to web directories and we're using these word lists and he's wordless have hundreds

if not thousands of different well known directories.

So it could be something like ad men or like cgi bin etc..

And so to go out and try to navigate these it's also going to look for specific file extensions.

So we know that we're up against an Apache Web site while Apache runs BHP if we're up against something

like a Microsoft Web site which is I guess well those tend to run something called ISP or ISP X..

And so this is why enumeration is important as well because we need to know what's running on the back

end to find or make the most use out of it.

Now what we can do with these file extensions and what I like to do is I like to run against BHP or

whatever the base of the server is but I also do like to run something like a text file something like

a zip file and you can make this is as long as OR YEAH AS MANY AS YOU WANT.

YOU COULD SAY RA PD f dark X but the more of these that you put in there the more times it's going to

search because it's going to search through the word lists and say the word this has admin and it's

going to try and end up PBF or admin Z.

So it's important to limit these to what you need for our sake.

I'm going to go ahead and assume BHP and we're going to just scan with the default results here in just

kind of see what happens.

So go ahead and start that and this will kick off and start scanning and it's already finding right

away it's finding some stuff you could see the list getting big and you can go to this results view

or you can see what it's found and you can also go to this tree view here and see what it's found in

kind of click in you could see it's found some potentially interesting files we can go enumerate these

as well and it's found test that BHP page you can right click on these and open in browser and you can

see that it's found this print test here in page before.

So we can look through some of these pages we're going to go ahead just let that go for now it's going

to take a minute it could take up to a while to scan depending on how big your world this is how many

options you choose and how well your Web site is cooperating with your scan as well.

So from here I'm going to show you a few more things so let's go back to our preferences.

If you still have that open go ahead and go back and let's go ahead and just go to the settings and

we'll go to our manual configuration and let's boot up burp sweet

and this is just another proof of concept that burps wheat is your friend especially when you're looking

at Web sites.

So we're going to utilize it just to take a peek.

I just want to see what's out there.

So we'll go ahead and just hit next and start burps sweet here on this.

And while we wait.

Another thing that I need to point out is if this were a Web site like a real Web site instead of a

test page and a very important thing to do is view the source code so we can right click in here and

we could say view page source and we can view the source code.

Now what we're looking for in source code are any kind of comments potentially any kind of information

disclosures we might be looking for any sort of keys or password or user accounts or anything that might

be disclosed in a source code that should not be disclosed.

A lot of times when you do CTF or you do hack the box or VLAN hubs they hide little comments and source

code but in a pen test your point of view we're looking for more important things like the passwords

or keys etc..

So we've got Bert sweet open and we're just going to go ahead and intercept one request here and we're

going to go ahead and just let this forward.

Actually we'll send this to repeater I'm going to show you a little trick.

Go ahead and send this to repeater.

So you're right click send a repeater and you'll see a repeater tab opens up here.

Now the neat thing about repeater is that repeater will show you your response in real time and you

can modify these so you can say hey I want to send this here or you can say something about like I want

to send a poetry class maybe and let that run and you could see what it says OK method not allowed.

So it doesn't like that but you can send different results modify what you see here and see how that

works for us.

Now this is not taking this.

Exactly.

Let's forward and see maybe if we're missing anything and we're not.

So another thing that we can do is we can actually copy this and what we can do is we go into the target

here and we've got the target showing we could set the scope if we need to.

So we can just we can go to scope here and we can say ad and then paste this in here for HDP and we

can do HDP asked for both Bushes do HDP and we'll say yes.

And what this does for us is this limits only searching for in scope items so we're going to just limit

now and then we're going to go ahead and look at the response that came back and you see there's no

response here.

But there is a three or four not modified.

And the interesting thing is look at the server header the server header is disclosing information to

us as well.

And we saw this in the nick doe scan.

It's all coming back around.

Right.

We saw the Nick doe scan say a patchy one point three point to zero and it pulled down this server header.

This is why it's so useful.

And this in itself a screenshot of this right here is information disclosure as well.

So this client that we're working on has a little bit of information disclosure problems and we can

just say information disclosure here and we'll do something if I can type disclosure here and we'll

say something like server headers disclose version information and we'll take a screenshot of that and

we'll put that in our notes as well.

So we're gonna get really deep into Barb sweet once we get to the web app section.

I'd just like to get you utilizing it and familiar with it.

And just so you're comfortable by the time we get there we're going to use it few more times when we

talk through network items and then once we get to the web app it's going to be a lot of brb suite.

So we get very comfortable with that very quick.

So let's take a another peek at our door buster and see how that's working.

And you could see that it still has twenty three minutes but I really just want to put you through the

concept of it.

The concept of it here is that we are looking for any sort of interesting directories and you could

see response codes here as well.

If you've never seen a response code just know for now that to hundreds to hundreds mean OK for hundreds.

I mean there's some sort of error most typically like a four or four means page not found and a three

hundred is typically a redirect.

And then there's five hundred which are like server errors or other.

So what we're going to come in here and do is just kind of peek at these and we can just kind of open

these and see icons probably nothing interesting dark has nothing in it right now.

The manual is not going to be that interesting to us neither is usage maybe maybe usage is interesting.

Openness in the browser and we can see what's kind of running and if you have your proxy on.

Go ahead and turn your intercept off you see mine court there OK.

And now this is an interesting page here we can see usage statistics.

And this might give us a little bit of information disclosure for able to access it at least here.

Well we can see a couple of things we see web of lies or version 2.0 one so we can copy this and see

if there's anything about this here on this machine that maybe is exploitable so let's add this here

as web lies a version to a one and we'll just put it like on this usage I asked him out.

Now we don't know for sure if this is running out on the web or this is just an HCM Al page that has

been generated by something else.

So not for certain that it's actually running on this.

It could just be something they have in this usage folder but it's always good to notate what kind of

items they might be using and they're utilizing this web lies for sure at least in their network.

Again this is probably a little bit of information disclosure or information leakage here.

So they've got a a consistent problem with that.

So let's go ahead and look more at the results and M.R. T.J. is in here and we can come through here

and just look like what's M.R. Markey and we can open that in the browser says what is it T.J..

This is multi router traffic Rafah.

OK.

And we could scroll through this read the details and we can keep going through here and this could

very well be a rabbit hole.

But this kind of makes sense and there's a web server here.

There's a log file.

Let's view the log file.

Nothing nothing unique there.

Let's view the web server.

Let's see if it's the same page.

And it's a little bit different but not not entirely different.

So it's possible what we're seeing here is that what we talked about in the part one of this video which

is that we're seeing the test page is out there.

And why was it out there right.

Is it poor hygiene it's still poor hygiene even if they're running a web server.

But they are running a web server here on the back end.

Whether this web server is useful to us or not I really don't know.

So the goal through this is to dig and this is my challenge for you is to dig kind of through these

results that you get back.

So wait until your your scans finish here and dig through the results.

Look at all these to me right now.

It doesn't look that interesting but again we haven't fully enumerated the real enumeration would be

to go through each and every one of these and determine if there's anything of value here.

Is there any sort of service information that could be useful etc..

So where we're at on the Web portal at the moment.

Again as a recap we have our scan back.

Right.

And we've seen 80s open and running Apache one point three point to zero.

We see for three He's got the same.

We also know about the mod SSL two point eight point four and open SSL zero point nine point six B.

Doesn't hurt to copy this and put this in our notes too because I think that's pretty useful.

We've got that here.

Let's just go ahead and maybe put something up above.

Just as a note and we ran our Nick doe scan and we save this to our for our notes.

So when we go write a report we have it ready and we've got some information here that we've written

down as well.

So it appears that there are some potential vulnerabilities here but we won't know until we start digging

into Google.

OK.

And that will be very very important.

But we're going to get to that when we start getting into the end of this little series here and then

we get transition into the exploitation part of the series.

We'll work on exploiting these.

So this is just a few tricks on how you can enumerate Web sites.

And when we're coming through and showing you these ports and we go over all these ports that we see

we're going to come across new ports so when we do pin tests and what it comes down to is just having

a methodology you might discover a new port.

And as long as you have a methodology that's all you need.

So we're going to work on building that methodology.

And you might find other tools for searching Web sites that you like you might say hey I hate your methods

or you know these tools just work better for me.

And that's absolutely fine as long as you're developing your own methodology.

So just start thinking about when you see a Web site.

What are the basics that you're looking for when you come across the Web site you're looking for service

version information which we have here you're looking for any sort of maybe back end directories you're

looking for source code you're looking for potential vulnerability scanning with Nick DOE and any sort

of information that you can divulge.

Same thing we can come back here.

We talked about it before with the appetizer.

You click on a supplier and see a lot of the same things that we saw.

It knows the operating system.

It knows the web server extensions and it knows what's running on the back end.

So there's a lot of useful information here.

And this is all we are after at this point.

We just want to scan in enumerate and then we're going to dig deep and exploit.

So that is it for this.

We're going to move on to the next port in this section.

We'll do a little bit more enumeration see what else we can uncover.

So I will catch you over in the next video.