Now we're going to start tying things together from previous skills and
combining new things
to learn as we begin to continue moving forward throughout this course.
To do that, we're going to go into our lab here that I have not only in this
particular
skill but also now as a playground lab because this lab in particular will be
referred to
quite a bit.
Now I do want to point out again my background in this lab for a depth is
different because
I'm using remote desktop and I have not published the changes to this lab yet
so in case you're
wondering that's why.
What I have here is the CaliBox that's opened up and I've already opened up Zen
Map.
No need to go through doing all this again so I just want to show you some of
the results.
One of the first things that I did was run a sweep of the actual Class C sub-
depth that
we're attached to inside of this virtual setup.
Upon running the Class C sweep at just a quick scan, we identified that there
are four systems
in active use on this actual sub-depth.
Of those four systems, three of them are popping up, web application and web
server functions.
Now once those three were identified, I went ahead and did an individual intent
scan on
them to which I have the results as well.
Before I show you those, I'm going to explain real quick why I identified three
overall.
You can see here I have the report for the quick scan and we're taking a look
at 192.168.0.1
and we see that not only is port 53 and all that other great stuff open but you
can see
that we have 3389 MSWBT server.
So there is some sort of function on there.
Now that's on .1.
Now it is a server, it does have things open on it and it does have remnants of
IIS on it.
But that's not the really important one.
What we're taking a look at is 13 right below and you can see that port 80 and
445 are open
and HTTP and port 80 is open which is HTTP.
Now this right here sets off alarms that there is a web server of some type
there because
it's given back to ZenMap the actual HTTP header response to correlate with the
actual
identification of web server.
And the same thing if I zoom out and go down just a little bit more, you can
see right
here that there is another server in our MIPS 192.168.0.52 with port 80 open as
well.
And it's responding back with a packet header of HTTP of some kind.
Now this identifies that two for sure out of our four systems that came up as
responding
had HTTP of some variety that can be confirmed.
And 0.1 does have remnants of it but not for sure you'd have to do another
intensive scan
on that later.
But the intensive scan is exactly what I did on 13 and 52.
And I already have those results ready for us so we don't have to wait on the
scan.
I'm going to scroll down here and show you, I have to pop out and pop back in
to zoom in
for you.
port 80 is open HTTP and already has a version of Microsoft IIS 10.0.
And right below that you can see that the HTTP title and the actual server
headers and
everything else responded back to ZenMap/InMap with all this great information
to allow us
to be able to determine what version of web server is actually running on 0.13.
And the same thing happened on 0.52 but you'll notice that when we go to 52's
results and
scroll down and then zoom in for us that we get a different web server.
It's Apache 2.4.58.
Now this information is real critical for us because that's where we start
going up and
above and looking at that documentation and also comparing it to the OWASP and
top 10
to see if there are any vulnerabilities that we can identify or later on pen
testing purposes.
Right now we're just doing the reconnaissance and research on this to identify
to leverage
those vulnerabilities.
Now once we have identified this we're actually going to pick one of these to
start doing a
little bit of digging on it and we're going to introduce the tool GoBuster.
Now I'm going to zoom out and go over to my terminal window here and this
command that
I have in the terminal right now is actually right below this video for you to
be able
to take a look at as I go ahead and run it and explain it at the same time.
GoBuster is basically a directory and file crawler to give us names and
addresses of
where these files are on the actual web server itself.
Now I'm using GoBuster against the actual FQDN of the website and the reason
that I
know this is because if I go back to my ZenMap real quick and select the
results for 0.13
I can scroll down and we can see right here right here that that's part of it.
I'm going to zoom in for us real quick.
BeWAP/Login.php so we already know there's one directory there.
We don't know if it's root one or not but we can also do an NSLookUp and FQ
domain name
lookup on that actual IP address to see if there's a domain name listed
associated with
it.
Just assume that I did that and didn't know it ahead of time and forgot to
actually
point that out here.
So we go back to our terminal window and as we run this command and I'm looking
at it
inside the actual ADEP course right now, the command is GoBuster.
It comes default inside of Cali Linux and we're doing a directory dig on this
using
the -u flag to identify the FQDN and of what it is that we're actually testing
against
and the -w is our word list.
Now the word list is also default inside of Cali.
You can expand on this if you want or find others and this allows us to be able
to go
through and identify basic words that we're looking for such as admin like what
came up
in here already, index, images, basic names of directories and files that would
commonly
occur inside of different types of web servers themselves.
Along with that, the -x on the end of it is helping us look for particular file
extensions.
So in this particular search, if you will, if you look inside the code box on
the ADEP,
I was looking for PHP, HTML, TXT, HTML and I think in this command I typed in
PDF as
well.
I did.
So those are the particular files I was looking for and I did -c in here.
I might have messed that up and I might have to rerun it with -x.
I apologize.
But that's the idea of what's actually going on here.
Yeah, you can see that the files are starting to come up now, my bad, but it is
correct
inside of ADEP.
Now this is just a listing of all the files that we are available to us along
with their
status codes.
Now you may be thinking status codes.
Well I'm glad you asked about that.
As I zoom in and show us here real quick, you can see that for instance the /
admin folder
has a status of 301 and then a couple of lines down, backdoor.php and /bugs.txt
has a status
of 200.
Now we should all be familiar with status of 200.
That means it's green to green, good to go and it's available on webpage.
I'm going to put up here a list of common statuses that we have inside of the
web server
world so that way we can get familiar with these because if we go back to the
actual page
itself, you can see here that we have a couple of common occurrences.
We have 1, 200, 302, 500, etc.
And going using that list, and I'll put the picture below in ADEPT as well too
of basic
status codes, you can kind of get an idea of if that page is available to the
public
or if it's restricted in some manner or it just doesn't exist.
Now if it doesn't exist, why is it coming up in here?
Well that's because it's part of the word list and it checked it out to see if
it was
a common occurrence and it wasn't.
So like connect.php was something that came up in the word list but status 500,
unavailable.
That's also why it has a size 0 to it.
And in the right side, we also get to where it actually goes to.
You see that some of these actually go to a different directory or they forward
to a different
page itself.
Now for instance, let's look at the kapture.php line here.
And I'm going to zoom out for us again and log in, or not log in.
I'm going to highlight that so we know particularly what we're looking at here
and then zoom in.
The kapture.php has a status of 302, size 0, but it points to the log in.php.
Meaning that if you try to go to that PHP page itself, it's going to redirect
you to the
log in.php.
So kind of the pointer, if you will, of where it's going.
Now again, this is just a directory enumeration and doesn't exactly give us all
the files
themselves.
That's where an additional portion of this skill, we're going to refresh on how
to actually
crawl since now we know some of the directories that are listed in here.
So we'll be right back.