Now you may be wondering how do we go on a remote web server and start browsing
through the directories and at least even trying to figure out what directories
are on there.
We would first need to start by understanding what our web server is.
Is it Apache? Is it IIS? Is it something else?
Well we've been through these before and we're going to do a quick refresher
and then start moving into some tools that are already in Cali for us to be
able to take a look at for directory browsing.
And potential traversal.
First, I've already ran these and I haven't opened already so I don't want to
go through the whole wait time of actually running them.
The first one we have is ZenMap and I ran this against bwap.test on an
intensive scan and that was just for us to be able to touch the website and get
an idea of what it's running.
And this reinforces that we are in fact running IIS version 10 on the actual
web server that's hosting our bwap.test website.
This is just one of many methods that we've learned along the way to help us re
identify.
And based on that reidentification, we now know that we can go to and get our
documentation or our notes and get a general idea of how that directory
structure is put together on our website.
And we're going to be able to do a quick refresher on IIS defaults. Now, is
every website going to be default installed for IIS?
No, of course not.
But it gives us an idea of how the actual website works and what other tools
that we can use to be able to take a look at.
For instance, one of the first ones that we're going to take a look at is
called DIRB.
And that's short for directory busting. Yeah, directory busting. And it's DIRB.
There's two verses that we'll be showing both. First one we're taking a look at
is DIRB and commands in the code box below.
This one's pretty straightforward and simple. It has default settings.
And as you can see, I'm going to zoom in for us here real quick.
You can see that I ran pseudo derm HTTP bwap.test.
And right below that you can see that it says URL underscore base. There's a
words list file.
Yes, that's right. There are words list that we can configure on here.
But we're just doing a basic one right now. We're here in just a second. I'll
show you the differences.
But that's the path to the actual common.text file that he used.
And based on what presets are in that file, you can go through and see as I
zoom out and pop back in that it found a couple of folders for us already.
Primarily it found that bwap.test.
Aspenet_client and bwap.test.test.
Now, is this everything on that server? No, because we've seen in the previous
skill using burp suite that there's a lot more on that website.
But we can go ahead and open up a web browser just out of curiosity and go to b
wap.test/evil for instance.
Now, right there we know that it exists, but we don't have access to it because
we have a 503 forbidden.
Now, the other one was ASP net_client. I'm just going to copy that real quick
and go over to the web browser again.
There we go. And yet again, another 403 forbidden based on permissions. But we
do know that they exist now.
Now, the other tool that we have is DerBuster. And this one doesn't have any
commands with it.
It's actually a GUI program. You can either go through the start menu or you
can go into the terminal and say pseudo-derbuster.
And I've ran this one already, but don't you worry, we're going to go through
it.
These are the results of the reason that I didn't want to wait through the
actual scanning itself is because this takes time based on the actual word list
.
For those familiar with programs like John the Ripper, this follows the same
idea. Use it a word list provided either through the defaults of Kali itself or
something that we put together.
This goes through a test every single line of entry in that file to see if it
actually works.
So be web.test/1 be web.test/2 etc. And when you first open this up, you'll say
file new.
I don't want to close that yet. I'll open up another one for so we can see the
actual results for it.
Or the beginning screen for it so that way we don't close that one out.
Let's see pseudo-derbuster.
And there's the empty one right there.
So I'll go ahead and zoom in for us real quick and we can see what's going on
here.
There we go.
Our target URL is going to be bwap.test and you can put the port on there at
the end of it if you want.
You don't have to because we're already HTTP and it's a default port.
The work method would be either the get or the head call on the actual website
itself which is stuff we saw at Burpsuite.
And this allows the flexibility based on the actual web server of what's
allowed to be able to go in there or not.
Number of threads. This is where we start getting into stealthiness.
This works based on the number of attempts that you're allowed every time it
goes.
And same with derm that this is going to continuously go unless you slow it
down manually.
Now the reason this company becomes important is the same thing like when we
were doing our in-map scans and we showed them one chart that there was a lot
of traffic that generated because of this.
IBS and IPS is out there are going to pick this up and basically block the IP
address or even the subnet that you're doing this from.
So either user proxy or slow down patience.
And then the select scanning type is list based brute force or pure brute force
.
Now the list base requires a word file which is right below that and I'll show
you the directory for in a minute because it's in the comments shared.
And then if you want to do a pure brute force it's going to be very similar to
John DeRipper except in directory format.
And this will take a while.
The small file itself took about 10 minutes to run once I actually got
everything going.
But if you let it go pure brute force and have a long list of directory
possibilities for names it's really going to take a while.
Now I'm going to the rest of the stuff on here you know select running options
brute force directory brute force files be recursive meaning go back and forth.
And dirt to start with is always going to be slash P. Now since we know this
website already has a lot of PHP files.
We use the file extension of dot P and PHP to try to sniff out some of the
other files in there.
You could put HTML XML whatever the case may be to try to sniff out not only
directories but files.
And when you click on browse and you go to the root system on here you want to
go to user share word list.
And then inside of here you'll see that there's a folder called Durb and Durb
Buster.
Inside of there are the actual word list that support Durb and Durb Buster in
doing their brute force attacks and also trying to guess and test the names of
the actual folders that exist on the actual web server.
So Durb Buster.
I'm not trying to rename it.
Double click and you can see here that we have a few already that come default
with Kelly especially the first two Apache.
So this was developed in mind for us to be able to test whether it's an Apache
or IIS or other system out there like.
And we also see that there is a lowercase medium small and that you can always
download or create your own to use on this as well.
But once you do run this and I'm going to close this one because this one's
already been ran.
This is generally what we're going to get in return that you have a scan
information that shows us what all it found in the process of everything.
Now this right.
Like I said it took about 10 minutes for the small file to run and you could
see that it already found pretty much the same thing that Durb did in the
actual terminal without having the extended word list and just basing it off of
the defaults.
We can look at the results and see what it found along with the actual HTML
response code and a lot of these were 302 or 403 specifically the 403 is that
forbidden access tonight based on permissions that we already saw.
Inside the results tree viewer is the one I like because it shows us basically
how it looks inside of a standard folder setup.
So I'm more of a visual person and I like to see it and this is a way for me to
be able to see it right here.
We have the root.
Now this is where it becomes very important to remember that we're not looking
at the actual root of the system whether it be windows or POSIX based that this
is actually based on wherever the services are.
services are installed for that web server.