All language subtitles for 6. Discovering Sensitive Files

So far we've learned how to find and use subdomains that exist within our target website and that have

not been listed in today's lecture.

We're going to see how we can find files and directories that are stored on our target computer or our

target website.

Again these could be useful because these files could contain passwords they could contain config information

or they could contain information about the actual server which will help us further exploit our target.

Let me just first show you what I mean by files and directories just to show you the structure of directories

on a web server.

So here I have my little machine.

And as we know usually the web server stuff is stored in var W W W and if I do an ls you'll see or undo

give us a just so that it's nicer.

You'll see that we have a number of files and directories and we can see that we have a directory they're

called Matilda.

Matilda is a Web is a web application that is designed to be hacked just like to exploit a world.

It is designed so that it has a number of exploits so that we can learn how to hack based on it so we

can see that that's installed in a directory called Mithal day.

Now if I go here to my IP address now this is the IP address of the floatable machine.

So if I do any of configure you'll see that it's 10 20 3:46.

So I mean they're And you can see that they have an easy access for me for the day.

If I click it look at the URL here so it's forward slash Mythili day.

That means I'm inside the middle of directory.

So every time you see a forward slash that usually means you're inside a directory.

So let's go back here and do an ls and if I do see the Matilda am I'm going to do of this and you'll

see that I have a large number of files a large number of files here.

So let's say for example I wanted to open one of these files and we have indexed that ph with if I do

end up with then this is our current file it's called index APHC.

So what we learn from this is Metulla there is just a directory inside my Webroot.

So at the moment in the midst locatable device arm in that we just write it here for you some inviter

w w Matile a day

and then the file that I'm accessing is index BHB.

OK so I hope this is clear now.

So on in this directory and this directory and access in a file called index page.

So if I just do a PWT here you'll see that I'm in var w w w until today.

The IP address kind of hides where you are the readably that you wrote is.

So it hides the Vardaman WW and then everything after that will be displayed here after the IP address.

So we're looking to find today is all the directories on the files that we cannot see.

So through out these links we will be able to access different types in different pages.

This is the same with any other web site but there is always files and directories hidden that you just

never see.

So we'll see how we can get you or else for these files and access them and read the information in

it.

Do that we're going to use a tool called there and to see how to use that.

We're going to do man there to see all the options associated with that too.

So you can see that to use the tool you just type in Derb.

You are out of your target and then you put a wordlist.

So the way this works is it works based on a brute force attack.

And it just uses a word list of names and it sends requests with these names.

And anytime we actually find something it tells us that oh I find I found a file with this name so it

will only be able to find names and directories based on the wordlist that you provide.

Now you can create a wordlist using crunch or you can use word lists that come in within their the options

here allow you to configure how the tool is going to work.

So you can change things around the way you it.

For example you can disable the recursive ness of the tool so it just runs on one directory instead

of trying a number of directories.

You can get it to ask you if if you want to access a directory or not.

Instead of automatically accessing directories and trying to find files within these directories because

this could be exhaustive if your target is a big Web site there might be a lot of directories and then

the two will be trying to access all of them and find files with all of them so they can see how big

the tree could go.

You can also set it to use a username and password if the target web sites uses some sort of authentication

and you can use it for verbal output and you can also use OE to output the results to a file.

So let me show you a very simple example of it.

I'm just going to wander on our target which is 10 20 14 to 0 4 and thus should be Hastey because remember

we're targeting a Web site not an IP address.

Then I'm going to put the directory that I want to be that I want to find files and directories within.

I don't want to be accessing anything with any other because you can see here there is a number of scripts

installed on this web server so we have this script and we also have page p.m.-I admin and we have the

weiqi.

So we don't want it to be accessed and all of them we only wanted to be working on Matile a day.

On this example.

So that's why I want to use this year.

And then it's going to start finding your allies and files within this current particular web application.

So I'm going to enter and we're going to work.

So this is going to use a wordless file and it's used in a default small wordless file that is stored

in here so it's in use or share their word lists.

Come on.

You can have a look at this directory and see if there is any other one this that you'd like to use.

And you can use them only by placing the full path to the word list after the command.

So instead of the way I wrote the command you'd write it like this and then you'd state where your running

list is.

For example let's see if it's in route you stated as rude at least

GST or whatever.

But at the moment it's use of the default one which is stored in this directory in users shared their

wordlist and it's used in the one that's called com and the GST.