I know what you're thinking. That was pretty easy. So easy that we shouldn't
even go through the
solution. We're going to go through the solution together. Don't you worry,
because there's a couple
of different ways to bounce this basketball inside of our side screen. Oh,
there it is.
Wait a minute. Where's my lab? Oh, there we go. These are the results that I
got. Now,
I'm also showing you that you can even search these results and do a received
space equal space
one to be able to get the actual number of received responses. Anything that
receives
equals one means that it's going to be active. And you could sift through this
information here
to figure out more details about which system it was that was actually active.
Inside of our
bad folder, I'm going to open it up for us real quick. There is something there
for you. And I
also have it in notepad form opened up for you as well. Not that one. My bad.
Where is my
BIM? Oh, I think I close it by accident. My bad. Come on, open up.
There we go. For some reason, I opened up inside of notepad plus plus whatever.
I'm going to zoom in
for us real quick and we'll see what this is. It is a command line script
written in command line
code. So 4L percent one meaning the variable of or excuse me percent I the
variable of I
in one of one of 60 do ping with one response only needed dead or alive in this
particular case
with a millisecond delay of 100. And we're going to do it on the subnet of 192
168 dot 0 dot
variable of I being one to 60. So this is basically going through and doing a
single ping on
one through 60 inside of that class C subnet to see what's active and what's
not. Why? Well,
first and foremost that this is simulating us to attacking a web server and
theoretically that
web server should be inside of an internal network or a DMZ depending on if it
's a forward facing or
back, you know, internal. And we may not be able to ping everything on the
inside of that network
from the outside as pen testers. We may be on a scope of IP addresses where the
rules of engagement
don't allow us to go in directly like that. But being able to go through and
into traversal
and inclusion methods, we can now start doing some reconnaissance. Remember how
I'm told you
again, of course, that pen testing lifecycle is in just a circle. It goes back
and forth and
bounces around. But we can go through on the internal of this network and
perform another round
of reconnaissance to get more information about the systems that we can't
necessarily see from the
outside world. And very simply, you're just going to copy everything that's in
line one right here.
Go over to your web browser where bad PHP is. And inside the address bar, you
're just going to
from command equals, paste it in there. And when you run it, it's going to take
a second to be able
to come back with the results, because it has to run through all the pings
first before it gives
the actual data for us on the screen. So if we do a DIR, it's going to think a
second, get all the
data, transmit it back to us. And that's when we get everything. So the longer
the directory,
the longer it takes to get that visual back to us. And in this particular case,
the longer the time
it takes to be able to ping and the number of systems that we're going for, the
longer it takes
to get that data presented back to us. I'm actually doing one through 60 for a
couple of reasons.
One, I know that all the IPs are within 60. And if I go to 254, it's going to
take so long that
it's going to time out that something like this has to be done in chunks. But
that timeout isn't
from the actual network itself. It's from the actual web browser and web server
response timeout.
See, it took so long over that amount of time that it disconnected the socket
connection between us
and them and we have to reset. Now, do keep in mind a couple things. One, this
is HTTP. And this is
going to be sent plain text back over to us. So I DS and IPS will be able to
get it. As we continue
through, we'll talk about encryption and obfuscation, maybe even with hashing,
because sometimes it
just confuses the IPS or IDS or even endpoint security systems. Along with that
, we have the
IPs of the internal systems. What if we want system names? Because a lot of
people like to name the
systems based on what they do. You know, DC one, DC two, xj exch one SQL one.
Well, if you could
run it in command line, you could run it inside of here because you have direct
access to that
command line through that PHP file inclusion exploit. And that is a tongue tw
ister. But that's a lot
of information to take in, which is why we're taking this one step at a time as
we make our way
through different things like command injection and being able to take stuff
like file inclusion,
tie it in with command injection, go in and run things like netcap behind the
scenes to where we
can actually have that socket connection open directly to the command line and
not have to go
through the browser, get a little bit more mischievous and start exploit
different users and everything
like that. Anyway, I hope this has been informative for you and I'd like to
thank you for viewing.