Welcome back.
And in this video, I want to talk about another thing that we already covered, and that is a numeration
and information gathering.
So this is a step that you also shouldn't skip once attacking websites.
We already covered information gathering.
So this video is more like something as a refresher, just so you know which tools you can use to enumerate
and to scan different websites.
So for this section, we're going to be using metastable.
Most of the time we're going to attack some different targets.
But for the start, we're attacking Métis, so make sure that this is up and running.
I also, Randi, I have a comment and it gave me the IP address of 192, that 168 at one that eight.
So the first thing that we can do is try to visit the Web page of that IP address just to see what we
have.
And to do that, we can open our Firefox.
And remember that once we attacked metastable, we said that we are going to attack Port 80 later in
the course now it came that time, we are going to attack Port 80.
And once again, we're attacking Port 80 because it hosts a page.
If I visit this IP address of my Anticipatable, it will open this page right here.
It tells us the warning, the contact and the login to get started.
But down here we get a couple of links.
If we go to any one of them, it will lead us to a different directory of this Web page.
Currently, we are in this dev directory.
If I go to the parent directory, it will go back to the one to that 168 quantitate, which is the main
or the parent directory, if I go and visit Divi W.A., it will lead me to this directory right here,
which is a log in.
And this file hosts I login form, so we got username and password to input.
If we take a look at this web page a little more clearly, we can see down here that it tells us default
username is admin with password password.
So for now, we're not going to brute force this.
We're just going to log in so we can see what we have behind this login form.
And here it is.
We got divi w eight or as we can see right here, it has this name.
We get a warning, a disclaimer, and here we get a bunch of different attacks that we can perform.
Remember, we talked about access, we talked about Ezekial injection.
We also mentioned brute force and command injection.
And these pages are pages where we can practice these type of the attacks.
All of them are stored in a separate directory now we can go about discovering all the directories on
a website like this, or we can use different tools to automate this process.
So to enumerate and to gather as much information as you can about the website, you can use the tools
that we already cover, such as the Harvester Together, emails such as what web to discover, the website
technologies and all of them we already covered.
We're not going to do that once again.
But there is another cool tool that you can use to discover directories and that tool is called Therp.
There is already installed in Callinan's by default.
So I don't think we need to do is to type there and we will get the help menu for this specific tool.
We get a bunch of options, as we can see right here, but also down here we get the examples of usage
of this tool.
So the most simple test, as it says in the brackets, would be just specifying Derp and then the link
to the Web page that we want to scan.
If I go up here, we can also see that we can specify different wordlist, but I believe Derb has a
default wordlist that it uses.
So we're just going to go with that one instead.
So if I type derp and then one night to the 168.
That one.
That eight.
Invalides URL, so we must specify there and then htp to dot slash slash 192, that 168, that one,
that eight.
So this is how we must specify a link.
If I press enter, it will go and search for different subdirectories inside of that web page.
If I scroll a little bit up, we can also see it managed to find some of them.
It found the index index p p info in that regard, test wiki.
And if I go all the way down, we should be able to find even more subdirectories on that Web page.
And right here we might be able to find something interesting.
For example, we can go and visit any one of them.
Let's visit robots that if I copy the link, go up here, paste the link.
Hmm, we get something right here.
User agent, this allow we already know what user agent is.
It is a field inside of the HDP requests.
Let's also see what else we managed to discover.
We got test teams with me, my admin.
That could be useful.
Let's check out what this is.
You never know anything that you find particularly useful or interesting you might want to check out
by visiting that page.
And this seems to be some file with the code.
So let's go and check out something else.
And it seems that there is a directory called Pass W.D..
Let's see what this is.
If I copy that as well, go and paste it.
Missing fields filled with marker required, please go back in your browser and try again.
Topic webcams.
So it seems that this page is missing some fields right now, we don't really know what this is all
about, but by visiting this for discover more and more pages that we might not be able to find once
browsing through the page on our own.
Now, right here, we can also notice some other information that we get on the side besides these links,
and that is the code.
And if you remember, this code is simply just the status code, which tells us whether it managed to
load the page.
Right now, if we get the code 200 for most of these pages, sometimes we will get code like three or
four, which means that the page gets redirected to a different page.
And at the right, we also get the size of that specific page, which is not something that we are currently
interested in.
But you also get that information if you want to see it.
We can see other links as well, and you would go about visiting any link right here that you find interesting.
So let's go down and it seems that it found 56 links, but that is only with this specific wordlist.
It also downloads I believe it downloads the contents, but I'm not really sure about that.
However, what you can do is if you're not satisfied with the results from this third directory, you
can specify your own wordlist if you want.
Nonetheless, this is not that important tool for us.
However, you can use it if you'd like, and you can combine it with different tools that we covered
for the information gathering to gather as much information about the specific website now since we
discovered information gathering.
I'm not going to go into those different tools.
You can also try finding new tools from the GitHub or somewhere else, and you can experiment with those
tools as well.
But right now, what we are going to do in the next video is we're going to configure are really important
tool that is called Burset.
And as soon as we do that, we're ready to perform our first attack.