The last tool we're going to take a look at is something pretty simple that's
built into basically
any POSIX-based system, and that is WGIT. We're going to be using this to crawl
the actual website
for specific file types that we did inside of our Google search when we were
specified
a site and a specific file type. This is pretty straightforward and simple, and
I have the command
for this listed below, and I'm going to show you it in practice. What we have
here on the screen is
I'm opening up a folder called files, and I have a terminal that's working
outside of that folder.
You can see that right there, desktop files, and I have WGIT as my command
preference. The dash
R is for recursive downloading. Dash L3 is for the recursive depth, meaning how
far in the domain
structure are we going to go. So I have three folders down into the actual
directory structure
which is actually supposed to be happening here, and then dash A is only
accepting the file
types of, in this instance, text, TXT, and we're going based off the actual
file extension,
so more along the lines of those Microsoft-based file systems. And then we have
ND for no directory
structure, which is putting it all over one folder, and no parent directories,
dash and P,
again, just keeping everything in one central location for us to be able to sit
through in a
little bit. And then lastly, we have our actual domain that we're looking at,
adept.com, and I'm
going to show you why I picked adept here in just a second, but I want to go
ahead and run this first
to show you that it's going to go through and start selecting and downloading
files. Now, I'm going
to zoom in real quick and show you that one of these was rejected, and that's
it was index.html.TMP,
and you can see the line in there where it says removing index.html.TMP, since
it should be rejected,
and that's based on the actual file extension type that we submitted in there.
And when we go back
to the actual folder where files are after this thing has ran, we see that we
only have one text file.
Now, we can very easily run this without the file extension filter on there,
and if you do,
you're going to get a lot of stuff because it's going to start downloading
everything that it has
access to. And I mentioned access for a very important reason. We're going to
stop here,
and then go up and replace adept with Microsoft.com. And we're going to await a
response from the
actual HTTP server itself. But even though we put in Microsoft.com, it's
forcing an SSL connection
over 4443. I know this because if we zoom in, let me highlight it first right
here.
Now zoom in. You can see that it was pointed to colon 443, and it was connected
. Also, HTTP
request was sent. Oops, sorry. And this right here was given a response of 301,
which was moved
permanently, meaning that anytime somebody tries to go to HTTP, Microsoft.com
boards them directly
to HTTPS. That's at 301. And then it forced the connection to that. And when we
were going there,
we got the request set, and we got a 403 forbidden because we don't have access
to be able to
directory traverse. And this is a way for us to be able to also verify
borderline active directory
traversing capabilities on a particular website that can be configured to
things like Apache or IIF.