have familiarity with the operating system, we have familiarity with the actual
web server,
and we have familiarity with our proxy setup. So let's combine all of it and
see if we can
wreak some havoc in our first attempt and at one of our examples on the fake
website
that to actually use it. So let's hop on over to the lab real quick and you can
see that I have
the CaliBox open along with Burbsweet already opened up for us as well too. We
're going to be
using this as a proxy to be able to see our traffic go back and forth to be
able to get an
understanding and also inject a payload inside of a packet to be able to see if
we can traverse
some directories inside of a website. Now first and foremost we need to go to
our proxy tab and
go ahead and turn the intercept on and then we're going to go to open browser.
Now we need to do
this inside of the Burbsweet browser or make sure that you do set up the proxy
inside of whatever
browser that you want to use. In this particular case we're going to go to blap
.test. There we go.
Now remember we do have to go back here and forward the request to the actual
sites and I'm
just going to hit forward all and just let it go because if we go over to our
target we can see
here that we're also getting a little bit of directory understanding for the
website itself
along with DERB and DERB buster. So we can see here that bwap.test if we expand
it we got the
route for the actual web server not the operating system and the bwap folder.
Now if you remember
we did not see bwap come up as a directory for the actual site itself. We saw
Aspenet.
underscore client and also the evil folder because those words were actually in
the word list
and as a side challenge not for this skill but a side challenge add bwap to
that one of those
word lists run it in DERB or DERB buster and see if it comes up in your
directory listing.
Now here we are going to go back over to proxy and go back to our website. We
're going to go ahead
and log in with b and bug and once we're logged in we can see that we're here
at bugs. Now you
can either select down here or up at the top. I'm going to go down here and
just type in DERB
and we can see that we have directory traversal directories. Now as soon as I
hit hit HAG it's
going to come over here to our BIRP suite and we're going to forward just
individual request at this
point for that one individual request but right here and I'm going to zoom in
for you real quick
we have a PHP call that came in as well. Now this PHP file has a question mark
directory
equal documents so it's telling the web server to bring me the folder of
directories and this is
the packet that we're going to intercept. So we're going to right click on this
packet and go to
send to intruder. Let me see if I can zoom in for you real quick. Right there
or you can just
take control I so send to intruder we'll go to our intruder tab right here and
you can see
I'm going to highlight it and zoom in for you where the actual question mark is
.
Right here question mark directory equal documents. Now we're going to
highlight
let me zoom out for you sorry about that we're going to highlight just the
actual call to the
actual documents so double click documents and then hit where it's at right
above it where it says
add subsection we're going to add that subsection. Now you can leave this at
sniper attack as by default
but what we're going to do inside of our payloads is go inside the add section
and we're going to
add a dot dot slash windows. Now I'm going to zoom in for you and show you
where this is at because
just like we went through the traversal familiarization these dot dot slash dot
slash dot dot
are actually telling the PHP to go further back into the directory browser
itself.
So can we get to the windows directory inside of that actual web page we're
going to start the attack
click okay and you'll notice right here there's a status code of 200 which
means that's a
successful web page I'm going to zoom in for us real quick right there. Now we
went back one,
two, three, four, five, six, seven all the way to the root and then went into
windows.
So we went through iNet pub or c-drop iNet pub, www root bwap and then inside
those sub
directories inside the bwap folder in within iis for windows. Now yes I am kind
of cutting to the
chase here because I know how many to go back you can try and test with many
different ones and
we'll show you a couple examples here in a second. We're going to right click
on this
and go down to show response in browser. I'm going to copy that link and go
back to my browser here
open up another tab, hit put it in and go to enter and would you look at that I
see all the
directories there from c drive windows. Oh that seems to be a bit of a mess
right and I still haven't
allowed the packet that we intercepted to forward yet because we're still
messing with it.
But now I can go through here and just basically look for stuff like system 32.
Now that one I am
going to have to go back into burp suite and go back into my proxy and you can
see there right there
and I'm going to zoom in for us. That packet call was bwap.test/windows/slash/
system32.
Let us forward all of those packets now and see what we get. If I go back in
here we are not
allowed inside of that directory but we were able to list it. So let's poke
around a little bit more.
So going back into our burp suite or excuse me we need to go here first and
reselect the actual
bug itself for directories and we're going to hit hack and you can see that we
're going to for the
first one and this is the one that we were looking for. We're at question mark
directories
equal documents we're going to right click send that one to the intruder go
back to our intruder
double click on documents through to add a section.
Now we're going to dot dot add, um slash dot dot slash dot slash dot slash dot
slash dot slash
dot slash dot slash one more for good measure because the six all the way. I
net hub slash
www root slash b-wap to ease and a slash on the end of it and I believe if
memory serves
they should be the right one. Now we're going to send this attack click okay
and right there
we have a status code of 200 again we're going to right click and send this uh
show response in
browser copy that I'm going to close that tab and use this one and right there
we have all of our
full folders and files that are within the actual b-wap itself. Now this is
where we need to go in
and see if we can actually see some files. We're going to right click on config
ink dot php and see
if we can load it up. May not be able to do the permissions but we're already
starting to get a
directory browsing we're going to right click uh select that one packet right
click on it and go
forward. I think we're going to get a 404 because a directory file or directory
not found but that's
just the beginning of us being able to go in and examine the actual file
structure and uh
directory structure of the target system using injection of packets with
directory traversal.