Welcome back, let us code our second project for the Web application penetration testing section.
So in the previous video, we took a look at how we can create the simple brute force that will be able
to brute force both of our TV w a log in pages.
We made the Post's request.
We also made the get request, and we also changed fields accordingly to each one of those pages.
Now, as I already mentioned, that program, you will need to adjust for every page that you brute
force.
However, this program that we are going to create right now, which is the directory brute force,
you won't need to adjust for different pages.
It will work for every page.
And what a directory brute force is, is, as we already mentioned, it will discover some hidden directories
that could possibly be useful to us once performing Web application enumeration.
So this is something similar as a Derb tool that we covered in Web penetration testing section.
So let's get straight into it.
I'm going to open the terminal and I'm going to navigate to our desktop and tools directory here.
We got our Web penetration testing directory.
And right here inside of this, we got our previous project.
Let us now know a program that we can call directories DCPI.
As the previous program, this one is also going to import the requests library, and before we start
cutting it, let's first think how our program is going to look like.
So we're going to ask the user of the program to specify the target URL or the target think.
Then we will open a file that has common directory names.
We will read from the file and for each directory name, we are going to perform a request for that
page.
If we receive a response or if we manage to load that page, that means that directory exists on that
page.
If we get something like a connection there, that means that it doesn't exist.
So this program is really simple.
Let's start coding it.
And first thing, as we said, is going to be the target.
You are.
This is going to be equal to the input value, as usual, and here we can specify something like this.
And then enter Target, you are.
What we also want to ask from the user is the file names to file underscore name is going to be equal
to input.
Enter the name of the file containing directors.
OK, so these are the only two things that we need after we get them, we can open our file like this.
So file equals open and then the first parameter is going to be the file name, which they specify,
and the second parameter is going to be opening file for reading.
And this is something we already covered.
So you should be pretty familiar with how we open files.
As soon as we open file, we can start reading different directory names and requesting those pages.
So for line.
In our file for each and every directory, no file, we are going to first strip that line.
From any additional characters and we are going to store that inside of the directory variable, so
directory will be equal line dot strip.
After that we can create a full RL variable and the fully URL variable will be equal to Target Yooralla
plus and then slash and then plus our directory.
So what we are essentially doing right here is let's say the target input's, our website thing or a
domain name of Google dot com.
Let's say the input that and from our file we read the admin directory.
Essentially what we are doing right here in this line is we're combining this to like this.
So this is how we search a directory on a certain domain.
We simply just add a slash and type the directories name.
Now that we got the full your variable, we can perform the same thing from the previous video response
will be equal to request from full bureau and this request function we don't have it is not requested
Geto requested post.
It is just the request function that we are going to code right now.
So go up here and type the fine request.
This request, of course, takes the parameter of your L and what this function should do is it should
try to connect to that page that we are looking for and if it doesn't manage to connect, we're just
going to pass.
So how can we do this?
Well, we can type try and then we can try to return from this function requests that get.
And the reason why we are returning is because we are going to store the response inside of this response
variable.
So we're essentially returning requests that get and then let's add HTP.
And plus, our you are out, so it is going to essentially try to visit our ORL, we're just adding
the prefix of HTP to dogs.
So like this, everything should work.
If we manage to visit that page, we're going to return the value.
And if we don't manage to visit that page in case of requests, dot exceptions.
DOT connection, error.
We're just going to pass and let's not forget to add to that at the end of the except statement, so
in this case we didn't manage to connect, therefore we're just passing.
And the return value inside this response will be nothing since we're not returning anything.
So how can we then check which one managed to connect and which one didn't manage to connect?
Well, we can just type the gift response statement.
And what this response means is if there is something in response, then do the following statement.
If there is nothing in response, then it won't do anything.
So in this case, if we have something in response, that means the statement worked and we managed
to connect to that page.
So we're just going to print.
Discovered the rectory at this path and we're going to print before you are out.
Simple as that.
And this is our entire program.
Let's go through it once again real fast.
So we import the request library.
We ask the user of this program for the target URL.
We also ask for the file name.
Then we open that file and we read each and every line inside of that file.
We strip it from any additional characters and store it inside of the directory variable.
Then we create a fully URL variable that will be the combination of Target Your and the directory name.
Then we request that for the URL and if we manage to connect to, we will return this value inside of
the response variable.
If we don't manage to connect, this response, variable will stay empty.
And then at the end we're just checking if there is something in response print that we discover the
directory at this path.
If there is nothing inside of the response, it will not print anything.
So let's test our program out.
I will say this and all we need to do is Python three directories that why we enter the target you URL.
So let's just go and see what is the IP address of our anticipatable and in my case one add to that
168 funded to.
And the name of containing the rectories, so we need this fall and luckily inside of our clinics,
if I open a second terminal and I type locate deer or Derb how we want to pronounce it, we go to the
user share and then their directory type, unless we will have this word lists directory right here
if we change to that tree.
So the word lists and type L.
S.
We will have a bunch of these defaults and inside of this common the text file or common names for different
directories.
So what we can do is we can copy this comment, the text file inside of our home.
Mr. Hacker.
Then desktop and then tools and then webapp penetration testing directory once I go to that directory.
And type less, we should have our common the texte inside of the same directory as our directories
dot p file.
So now if I go right here and specify common dot 60 press enter.
This will go and search for every director and we can already see that it is discovering some of them.
We got this large directory, this large dev slash index slash BHP slashed by admen, and those are
all the directories that manages to find in the main directory of the anticipatable machine.
Now, you can also specify Subdirectories if you want.
For example, if I ran the program again and type one idea to the 168 that wanted to data it a.
And I typed the same file name, which is common that the act now, it will search for the directories
inside of this DB and we can see it is finding different directories than it found right here.
And what you would basically do once performing this type of enumeration is you would try to find something
interesting, you would go from each and every subdirectory and try to figure out if there is any interesting
directory onto that page that maybe shouldn't be there.
For example, if I write another program and I type the IP address motel.
I the ABC, which is the name of one of the directorates in government, exploitable, I press enter
and I also use the comment that the default.
It will find a bunch of the directories, but there is a directory that particularly stands out, which
is this password's directory, so we can visit that link, which is one to the 168 that found that two.
And then Motyl, they slash passwords.
And it will lead us to this directory, which has this accounts, the text file if I click on it.
Well, it seems like we found some file that contains usernames and passwords.
We got admin.
The password is probably admin pass.
And this could be something like a security question and the answer to the security question.
So this would be a vulnerability of information disclosure where it gave us some information that we
shouldn't have the access to and we would never know that these passwords directory exists if we didn't
run our directories program, which discovered it and then visited it and found out that their account
usernames and passwords are available for us to read.
OK, great.
So we have finished two projects successfully, Frico that the login brute force and the directory brute
force.
So we are officially done with web penetration testing and in the next section we're ready to touch
on a subject of men in the middle attack.
It is a really interesting attack that we can perform inside of our network.
And in the next section, we are going to see exactly how we can perform it.
See you there.