Welcome back, everyone.
This is a speech and this session is about sensitive data leakage.
Remember, we are still in the information gathering stage and we are still trying to get more and more
information about our target.
OK, so we have we have covered an idea about how to get the information from the target application
about the boats and boats vulnerabilities, open borders services version of the software.
We even got to know how to run one of the scanners like Nessa's and map open vasts as well.
And even we got the idea about how to analyze the HTP as well.
Now, this is about getting the idea about the any sensitive data which might have been left by the
developer of the of the of the Web application.
Not not intentionally, but maybe those are those are some of the hidden files.
And so we we have to look for those files if those are possibly available.
This this can be used by hackers to, you know, get get the idea about the U.S. ambassadors of the
website itself.
I'm not saying this.
Those always be available, but most of the time, you know.
Right.
Humans make mistakes.
So developers may leave some of the files as hard as those.
Could be many kind of file, but would be focusing on some very sensitive file which are related to
getting the credentials or maybe user database or maybe in back of file and all that stuff.
Right.
So let's understand a bit more about it.
So first thing is we will be looking for back a file on the website.
Right.
So I understand this.
When when you when the Web application is built, it is nothing more than just just a comprehensive
storage of files.
That's right.
What do you see on a Web application?
Just an images, text, videos and other stuff.
Right.
So this is all made up of files.
You get multiple directories or folders.
You just have one index page and multiple folders, multiple folders one might be getting one might
be getting information about the front page, another that would be getting information about customer
information.
Another would be getting information about the product catalog.
Another might gatti's the information about, you know, product, product keywords, the customer rating
database and all the survey.
So what we are looking for is the back of five will be looking for some sensitive file, which is can
be backoffice, but end up with the extension A, not all of the stuff.
This could be certain.
Barometer's will be looking for some credentials from the directories itself.
Right.
And BHP files that can be used for for understanding what all if we can gather some link.
OK, and I'll show you how that would really be helpful.
Directory structure.
Of course, we get the idea about how the directory structure really looks like which file is stored
under which which which is pretty much can be observed and can be gathered through a Web browser as
well.
But but there are some widely used tools which make this job even more better.
OK, so the most popular tool for making use of it will be using it as well as the buster, the desires
and former director Buster.
So again, this is another project developed by OAC again, you know.
Right.
That the non-profit organization, that's the one they are the one who developed this tool.
But we can we are not just limited to that.
We can make use of my desk point as well.
And it has got multiple auxiliary modules.
OK, so we have seen the payloads, we have seen the exploit modules as well.
Those auxiliary modules, which is majorly for generating activity related to information gathering,
related to gathering information, passive scan, all the stuff.
Right.
So this is what we can make use of it and I'll show you how that flows.
And now when it comes to the door buster, this is how the dashboard or the tool really looks like it
is already in the galley.
And remember the.
This is the weird air buster walks is basically it guess the possible directors basically against the
possibility trees and if it is a valid one, then to win.
Right.
So you can't simply go and get the all the directorate's normally is blocked by the developer to to
to block the crawling of the pizza, but with these to the elbows to make use of brute force and wearing
it, keep trying all the possible director mean and until it get the right one and they the hidden files
and directories as well.
And of course support both as GPS you are eligible for a soup.
You can just mention Cole in Aden for CBS.
You can just specify for 40 pre-bid one list.
There are a whole list for small list medium.
This is what you can make use of spoilers for static pages five to six pages four for web application,
which might be a WordPress related or any other.
You have to make use of medium woodenness, usually the smallest present and the user directly and users
share then be at burster if I'm not wrong and then end up that you will find a wordlist wherein you
will find the text file.
I'll show you how that works in the next session.
Will get you there.
Thank you.