Now in our challenge, we were tasked with using a combination of go buster and
W get to be able to do a crawl.
Being assisted by a directory listing that we got from go buster.
So I encourage you to do that against the be WAP.test site in our adept lab
that you see here, but I will be doing this against cbt nuggets.com.
I have permission.
So inside of our lab environment, the first thing we want to do is run go b
uster and we'll be using the same style and command as listed above.
It's actually the first one where we're going to be identifying a directory
crawl for the FQDN of cbt nuggets.com at the top level and using our word list
for that that comes default inside of Cali.
In addition, we're looking for specific file types to see if we can get some
other information out of that as well.
Now, when we run this, it's going to ask us for our pseudo password.
And you can see here that we have a reveal of the server returns a status code
that matches the provided options for non existing URLs.
Did I spell this correctly?
I did.
But as you can see here, we get a code of 301.
Now, what was our code of 301?
That was moved permanently.
Well, why is this?
If we ping cbt nuggets.com.
We do get a response.
Oh, we don't get a response.
Very interesting.
Can we ping the www dot cbt nuggets.com?
Mm, we can't.
Can we ping a depth dot at?
Ping the depth.
E P T dot.
OK.
Mm, can't do that.
Wonder why that is.
Can we ping Google?
We can't ping Google.
Well, this would actually tell us that there's a firewall in place that's not
allowing crawling type structures on this.
And this is actually good information to know because we do get the IP address
that's well listed here.
And we could go a little bit further.
But that's for a different skill.
We'll actually do this against the BWAP.test.
I'm leaving this in to show you that there are things like this that do pop up.
And then later throughout the course, we will explore why this happens and
potential ways to get around it.
So we'll go back up in our command here and go to pseudo go buster and we'll
change it to BWAP.test.
So that way we can all play along on the same sheet of music.
And oh, that's because there's no HTTPS to be WAP.test.
There's only HTTP.
And there we go.
We start to get our crawl.
It's looking at the different file extensions based on the common word list to
see if it finds it.
And we got a very limited response from what we used before.
But that's OK, though.
We understand that we now have index dot PHP that did return a code of 302.
But there's one right above it called cross domain dot XML that returned to
status code of green green.
And one thing I want to note here, too, is that web.config.test is an available
file.
And that may be something you want to look into as you're starting to do your
exploits well.
Again, more on the it allows us to dig into potential vulnerabilities and mis
configurations later on.
But going back to our other terminal here, I'm going to modify this for BWAP.
We're doing the web crawl now for W get against the BWAP.test and sending it to
a predefined directory on our desktop.
Now, when we do this and while it's running, you'll see that it's starting to
pick up a decent bit of files.
And it creates a folder for the actual domain itself.
And when we go in here, that first folder, by the way, if we go into crawl
again, this is for the top level FQDN.
And inside of there are the sub directories that it finds.
Based on what we get back in our go buster, we can actually go in a little bit
more in depth and see if there are any other potential directories that pop up
against less secure sites.
Or if there's others out there that do allow visibility of those sites.
One of the tips that you may get for misconfiguration is if you get all the
directories listed because in IIS, we know for a fact that there's an ability
to stop
directory browsing for everyday users with no elevated permissions.
But this is just a simplistic way for us to be able to go through and see what
it is that we can get for offline examination later on as we're starting to do
our web server and web application vulnerabilities.
And in the next skill, we're going to be using this exact same lab and starting
to do a little bit more vulnerability assessment against the WAP.test.
I hope this has been informative for you, and I'd like to thank you for viewing
.
[BLANK_AUDIO]