In order for us to truly understand what it is that we're traversing as far as
the
director's structure is concerned through the actual web interface and all that
other great stuff,
we need to make sure that we understand the actual structure of our operating
systems.
Now the first one we're going to be starting out with here, as you can see, if
I can point
in the right direction, is Cali. This is our generic POSIX-based system and we
can get real
familiar with the drive system overall pretty quick. Remembering that we have
our drive assignment
as slash. So let's go ahead and log into our Cali system here and we're going
to keep it straight
to the point. Now you can do this by going into a file system, which is what I
'm doing here.
Now as you'll notice up in the address bar, let me pop out and zoom in for you
real quick. You
can see that there's only a little bit of icon for the actual disk itself, but
that's going to be
that slash that identifies that we're on the root of the actual hard drive
itself, not to be confused
with the actual root user, just the root of the file system overall. So when we
start doing our
directory traversing on sites that run Apache or from that previous skill where
I mispronounced
NG the web server, that these are POSIX-based systems that have that same
directory structure
and the root the folder reference to for the actual website is within this
actual file system
that you see here. As we see up here inside of this folder, we can also right
click and go to
open terminal here. Now you can't open as root, it'll just ask you for your
root password and you
have root access. Now we also need to remember Linux is unforgiving, you make a
commitment in
here, it's going to happen. So if you start typing in RM, we'll be ready. But
inside of here,
you can type in the command pwd to get a present working directory display for
in case you get lost
and that happens to me a lot. And it looks basically just like this as I zoom
in for you here real
quick, that slash where it root. Now the reason all this is becoming important
is because different
services, different web servers and web appliances have default install paths,
which is why we put a
lot of documentation, when we recover in the basics of IIS and Apache as our
examples previously.
So as we start making our way through here, we also need to understand where
key system files are
based on the actual operating system itself. Now this is a POSIX based system
up here. And
we're generally going to have Etsy password Etsy shadow being that in that ETC
folder is where
most of our primary configuration is. So if we say LS for a listing, and I like
putting dash LA on
there because it gives me a more prettier output slash Etsy slash shadow, that
's going to show us
the file itself, not necessarily anything else. There we go. Because you can
say slash Etsy and
it'll give you the entire contents of the actual folder overall, right? Now
this is all stuff that
we know. But the reason that we are rehashing this is that some of us learners
may be in here for
the very first time discovering this. And it's also really important. And I
stress this in all of
our courses together that we need to have a firm understanding of what it is
that we're breaking
into before we actually try to break into it. I'm a fan of throwing that center
block through the
window, but you at least got to know where the window is. So Etsy shadows there
, we know where it's
at. And I'm just going to do one more, which is LS dash LA slash Etsy password.
And you could see
there. Come on, you could do it. There you go. That we have Etsy password as
well. Now you can
cut these out and see what's in them. But do keep in mind that we are in open
terminal here command
being ran as a regular user. So you might, while you would be able to say cat
slash Etsy slash
password and get everything in there, you wouldn't be able to do that for cat
slash Etsy slash
shadow because it would say permission nine just like it did right there. Now
you may have noticed
with the key nine that when I typed in cat slash Etsy slash that I had a
previous command pop up
and that will pop up because this is the VM that you'll be using.
resolve.com. And you can also have over which I'm doing because I'm extremely
lazy when I'm in
terminal. The reason that this is really important here is because as we zoom
into it,
this is the name resolution file that POSIX based systems generally use to have
DNS configurations.
You see that I have name servers in there. Well, one of them is for this local
network inside
the virtual lab. So you can make it to be WAP.test. Remember the host VM has
DNS.
And the name server 8888 is just a generic for me to be able to move about just
in case the 168.63
default that came with Kali install doesn't work. So why is this important?
Again, it's knowing
where those critical files are inside the operating system that allows us to be
able to go through
and pick where it is that we want to examine or exploit later on. We could
create a new user inside
of the password file. We could start using different things like the commands
and the actual open up
command terminals inside of a web browser remotely. You wouldn't have this
window here. It'd be a
little bit different. But trust me, there's a point behind all this because
familiarity is key.
Now the same thing can be said inside of Windows and we're going to examine our
Windows 10
bewapped workstation. Got it here because it's not a server. And the reason
that I really want
to show this one is because even though we know wherever things at, this is our
navigation is a
little bit different. C drive has a assigned letter to it but is still the root
file system of the
operating system. You can see here that we have our usual suspects of files and
folders. Keep note
of INETPUV and also how many directories that we're diving into through travers
ing just through
the GUI here. So we're at one being the C drive going in INETPUV is two going
into ww root is three
and going into bewap where that actual test site is is four. That's going to be
important later as we
start to go into one of these examples and start taking a look. Now you
remember too, again, not
not on wood, hint, hint, nudge, nudge, wink, wink, that some of the PHP files
in here have
configurations in them that might be good for us to examine. We're going to get
there in this one,
I promise. Now we're going to close this and I want to show you inside the
actual command
terminal here for Windows, not PowerShell, that we whenever we start this off
and we're in the
from command line in the user that we're on, it starts us off with C drive
users learner, C drive
users learner, that's three, okay, hint, hint. But as we do this, we also need
to know basic commands
like cd space dash dash and that's change directory directory dot dot and what
that does is it takes
us up takes us up one directory. We can do it again and it takes us back up to
root, you can't do it
no more after that. So let's say we are in CD slash users slash learners and I
'm tabbing over for
some of these. And we say cd space, cd space dot dot slash dot dot. Well, let's
do that takes us
all the way back to C drive our root directory because again, we're now travers
ing upwards to the
parent of all this by using dot dot once for one directory up slash dot dot up
again. So these are
just simple things that we need to keep in mind. And just I care, I was to can
we use pwd in windows
anymore? No, we used to be able to I promise it was way back in the DOS days of
DOS 6.22.
But here we are understanding that directory structures don't change no matter
how many times
we try. So knowing where everything's installed for the operating system, the
actual web server
and web appliance is going to be key as we move into the next portion of the
skill.