Still inside of our lab, we're taking a look at IIS as far as our internet
information services
manager inside of VWAP.test system or a wind 10 system inside of our lab. And I
just kind of
wanted to point out some common errors that are executed in the course of
setting up new software
and also understanding that these common errors will allow us as pen testers to
get into the side
inside of systems faster. Now, IIS has a default installation path that we've
already seen in the
previous portion of the skill, but there are also default settings that we
should be accustomed
with. And that's why I linked documentation in the previous skill for us to get
familiar with.
Now, are we going to know every single in and out of IIS if we're more used to
working with
things like Apache? Of course not. But that documentation allows us to be able
to go in and
understand where default paths are. So as an example, here we are in IIS. And
one thing that I want
to point out is first and foremost, as I zoom in for us, is that we only have
one binding
for this actual web server. And that is port 80. And that is HTTP. No SSL or
TLS required. So
everything that we see or capture over the wire to and from our test website is
going to be in
plaintext, unless the individual files themselves aren't encrypted. But the
traffic overall is going
to be very accessible to us. And we can see HTTP commands across the wire like
get push and all
that other great stuff open to us. And this opens up this website for command
injection,
which is also one of the things that we're going to be covering. And we can
also go over and inside
of our default website home, we could go in and I'm going to zoom out so I can
do this here real quick.
Go down to things like the IIS portion and see directory browsing. Sometimes
when people install
this or people install IIS or have a custom website, directory browsing will be
enabled. Now,
there are websites out there that are legitimate that have browsing directory
browsing enabled.
One such is VMware. So whenever you go to install patches and you don't have
the right one or you
want to get an older version, they have it to where you can browse the
directory of patches
through the actual web browser. And that means that directory browser is
enabled up to a certain
point, maybe for the entire site, who knows. But if directory browsing is
enabled at the root of
the actual web server itself, then we are able to use commands like W get to be
able to crawl
and get every single thing that we can get from that actual website itself to
include subdirectories.
Now, we also know that subdirectories do exist and because when we go to the
actual website itself,
we can use techniques like masking in the web address bar to hide what the full
path of everything
is. That'll allow users to and potential hackers to not see what commands are
being
executed inside of the actual web browser. But if it's on HTTP, like we have in
this right here,
doesn't matter, they can just use things like wire shark to see what's going on
behind the scenes.
Just a couple of things to keep in mind when we start using default
installations and not going
through and making our configurations more secure. Now you may be wondering
what I'm doing here.
And inside of our Ubuntu desktop, I'm installing Apache to I'm just doing a
very basic install.
I skipped through all the steps because we should be very familiar with this by
now.
So what's happening is is that I'm going to go through now and go to the
Firefox
and go into our default path of 127.001. The reason I'm doing this is I wanted.
If I can clear it, there we go. I wanted to show you here that this is the
basic install
webpage that we get whenever we don't make any changes to Apache after the
basic install.
And you can see here that it even gives us a directory listing of different
places that we need
to look at for Apache. This is the web server that POSIX-based systems
generally use and
because this exists, this tells us that even if a website has a start page and
all this other
great stuff that if this pops up, then basic security features haven't been
enabled or configured
on the system. So this cuts down our workload tremendously when we're wanting
to pin test a website
and potentially have a backdoor to be able to access different things because,
you know,
it's already there for us. Why not do it?