So we went through the directories and we saw that we can actually use
bwap. It's misconfiguration. In JEX-N-Packets using programs like
Burpsweet and see the actual directory structure. Can we see what's in the
files?
I'm glad you asked because that's exactly what we're doing up here. Kind of the
same
method except this time we're going to go back to our bwap site. If you'll
remember
here this was the file directory listing that we traversed and was able to
exploit
using Burpsweet. But we want to kind of look at config.inc.php. But we can't
just
click on it. I'm going to afford the request as if it never happened. You see
it's it's not there according to the web browser. But let's close these two
tabs
real quick and go back to our actual bwap site and now select DIR and go down
to
directory traversal for files. And I'm going to hit hack and inside of our
Burpsweet here you can see that we have the first packet ready to go for going
to the page. And the second one is what I'm looking at. The reason I'm looking
particularly at this one is because this one actually is requesting a file of
some type on the actual server itself message.text. So I'm going to right
click on this one and go to send to intruder. Go back to our intruder again
and now I'm going to select the file that was trying to be requested message.
text
and I'm going to add a subsection and I've already preloaded these so that way
we don't have to spend time going through and trying to wait for me typing
it. Basically the folder traversing all the way back to root and then going
into
iNet Pub and the configuration folder for IIS and where this website is
pointing
directly to config.ink.php. Now I'm going to start my attack click okay and
you'll notice right here I'm going to highlight and then zoom in that that has
a status code of 200 which means that something worked. So let's see if we can
see inside of it a little bit more. We're going to show response in browser
copy it go back to our browser real quick open up a new tab and paste it in
there and go and would you look at this we have something. Well what is
something
you say? Well if I scroll down you can see right here the contents of config.
ink.php
let me zoom in for you and right there because it's in plaintext we now have
the username password and database information for this actual website. Now
these are beginning level practices for us to be able to go through and try our
hand and directory traversal and file manipulation. We will get to the
manipulation here shortly but as you can see now we have a lot of information
for this particular website as a web server and we can start mucking about
inside of some of the web appliances as we continue throughout the course.