Inside of our MSF console connected to the B-Web site, now we're doing a more in-depth dive with
directory scanning. Believe it or not, there are websites out there that have directories that are
kind of phantom in the background. They're not tied to any link in particular, but they still
exist for you to be able to get to because directory browsing is enabled for whatever
reason. And believe it or not, there are some web administrators that just don't know that that's
on. As a pen tester, you find these and you report back to that web administrator your findings,
and they can do with what they decide to do based on their policies. CIO, CISO, and all that stuff.
They can turn them off. They can keep them on. But to be able to tie this down and get a more
in-depth analysis than what Curl was giving us as an example, we can actually go in and use
auxiliary scanner, HTTP, because this is an HTTP site. Directory scanning or directory scanner,
you know, codes below on this one. And if you're ever confused, don't be afraid to show options by
typing that out because I keep forgetting the tab thing all the time. And you would just put in
whichever ones fields are required. Host, port, and threads. Threads is already filled in. And
the remote port is going to be a port 80. That's already filled in. We just need to put in an
actual target. So the target host in this particular case would be set our host of HTTP 192.168.0.13.
And you can see right there that everything else is good. But I do want to change the path
because I know this path, the site starts with the actual BWAP.
I think I might have to put a slash on that. Yep. Show options. And now you should be able
to see everything. And there we go. And now you can just say run. What's going to happen now is
that the directory browser is going to go through and use its tools to go through and find whatever
uh folders are on there. Based off of, part of it's a word list that it runs behind the scenes
that's default for some of these basic folders. Rest of it is it tries to query and see if it can
find anything heuristically. And I want to point this out real quick because as you can see,
not that one, this this one right here, you can see that for example it did find
BWAP slash admin 200. A lot of sites have that admin site, but not a lot of them have
some of the other ones. Now some of these are just basic ones like the next one is apps,
but it was 404. So it doesn't have a folder called apps. But if we go to BWAP slash admin,
that page would exist and has existed for our previous skills. This is not necessarily checking
for vulnerabilities other than just to show if there are any directories behind the scenes that
are exposed and accessible through the uh you would get a 200 if they are or a 403 if it is
available but behind some sort of authentication. But if they do exist and the web servers or
administrators don't know about it, that is a vulnerability. It may not be a vulnerability
in the classic sense, but it is a vulnerability nonetheless and it's something that needs to be
brought up to the attention of the actual administrators and also the organization
for pen test results in your summary overall. Now by what I mean by 403 and I'll highlight here and
then hone in for you. We have to know our web codes and I've pointed them out in previous
skills before, but a 403 is an error code that you get whenever you go to a website that you
haven't logged into and you get the forbidden. Which means it does exist, but there's some sort
of authentication that's required for it whether it be local through the web server you know stored
credentials inside the web server itself or something that connects to an internal organization's
active directory or some sort of other authentication service. What this does is it
tells us that this web server is connecting to something internally of some type in order to get
authentication. Now that's the images folder so you know it exists it just you've got to figure
out how to get actually get into it. Now as we've seen in the file inclusion that's through the
actual upload when you actually go through and do your vulnerability checks and recon of the site.
Now right here the admin folder comes back with a 200 so that means that the folder or the folder
does exist to an actual website and it is accessible so if you wanted to check you could
check. But you can see here that it also tried its basic word list and I was a little bit off with the
heuristic thing you can add those in but this is just a basic run. So the slash admin comes off of
the basic list of usual suspects and it did come back as a 200 which means fully accessible. Do you
have to be an admin? I don't know that's for us to be able to go through and check and if you do get
a result like this I would highly recommend that you actually do go through and check those sites
and validate the actual links for your notes. Because it could be that you actually go to the
admin site and it's a forwarder somewhere else or that it goes to a different part of the
organization's website and it's an internal forwarder and it's there as like a false flag
honeypot type thing. And some people do set those up so if you're a pen tester don't think that
you're just going in and going to find everything off the bat. You may be in for the time of your
life if you run across a really good blue team.