Welcome back, my friends, this is Rosnes, and this issue is about demonstrating the ambassador,
trust me, this is gonna be fun for sure.
Let's get something.
All right.
So now let me open my candy machine hacking machine.
OK, so the first.
Once you are in the machine, how to launch the idea, just idea of it at the moment you die.
This is how the two really.
What are you need?
You need to specify the target you are in and you need the wordlist.
OK, let's start with the simple one here.
Yeah, I started the the OS B.W. itself and currently the BWV is on an IP address so you can access
it.
So once you install your OS everywhere you can access the IP address.
Luckily I have made it online.
You could see very.
This is what.
The system really works if all Granges are rude and always BWB, OK, and this is the IP address of
the system, I can access to the IP address.
Now, there are many applications of this project that has basically consolidated all the application
in one single platform.
You get to see that code, you get to see the lead, Lee-Anne.
So I'm not sure how to pronounce it perfectly.
And then you have the map as well.
Just again, pretty popular.
Then there are a couple of mortgages which are outdated, but I'll be focusing more on this mutely ad
and then we have that code, which is pretty new one, and then we'll be focusing on oil.
And this is pretty, pretty old.
And I mean, this is in the market from like last six or seven years, maybe even more than that.
So people will be using it because this is this is very generic.
Every other day, people do all the stuff.
The new one is B, that and that gold and this one even this is all we didn't try to do it.
OK, you keep making use of each one of them for our application testing.
There will be more as well.
If you have seen the nation's video where I have shown you the list of tools that will be making use
of it.
These are the laptops.
There are some which are publicly available or mutual which will be using it in the next edition and
on this.
But you are not that as you can type, if you will, in the name of it.
You can
go to the fire site.
You can see this a demo.
Despierta, this project, this is the demo site.
Remember, this looks like exactly like a syndic or financial services site or banking site.
It's being developed by IBM, IBM.
Now, it's a part of the product.
It is basically made to test the IBM product security of IBM, which is now which is now a part of an
I of sale after after it has been purchased by its purchased by you.
All right.
Let's go to the system will be targeting this site.
OK, so this is where cyber units and so let's say I go into it.
So this is how the entire application really looks like.
This is a dump site.
So you get to see all the best that you can perform.
You could perform injections and injection and all those stuff, which would be it would be doing it
for the edition.
And we are not recording.
So we we don't you don't even have to do this because this is a target site.
We have to scan it from over the left hand side.
This is the poster.
And what you see on your right, this is our target site.
Okay, so on the left, we have our.
Attacking Blackphone on the right, we have our target.
OK, so let's specify the URL so we can be then and you to launch one.
Well, you can make it easy if you want, but it's not OK.
It's done.
You can keep both of it.
What you can be.
You can either keep it get of the or you can keep order, which I suggest you do keep order which then
it require you to browse if you don't browse and select the world.
It won't be wordlist.
The word list is usually present in the user, then share and then search for vier.
Oh yeah, here it is.
And then the wordlist lovely.
Now you see there are many decks.
These are on the list of OK list of X files.
It's kind of big study database.
So they must make use of all those X marks basically to guess the possible directories.
So that's why it is a brute force.
OK, so there I recommend you Google the medium, but if the application is pretty smaller, Sandeep's
or something, you can go for a small.
If it is, you feel it's heavy website WordPress or maybe any e-commerce platform as well.
You can go for a medium as well.
Let's start with medium then.
Now, if you would like to scan the entire application, then you can just go inside.
If you have some folders to scan, some directly to scan as well so you can select them.
In our case, we have multiple applications that are part of multiple directory subjects.
So you could see if I can go to any application, let's have a.
These are all part of different directions.
You see this if they go to be back.
OK, this is again about this.
This is nothing but folders similar to this.
This is another XO, because my target is this.
I mentioned this to the.
Sprey.
You mean that, right?
OK.
I hope I'm right.
Lovely and kind.
OK, let's start with was lovely.
You can see it has it started.
You can see the number of requests being sent to one seven, all of the staff.
Right.
These are all the possible requests.
Insane than average speed.
You see pass size, total request.
Everything OK?
These are the possible directories that you can find.
These are all you could see.
This is the home page, which is available images.
These are all in this speech.
These are directories, basically, OK, and the size of the directory is one.
And you see the response code is 200.
If you have if you're following me correctly, to convert is OK.
That means this site seems to be valid when you see 500.
That means it is so rare, but it might not be available as well.
So what are you seeing doing?
That means it's actually available and the DRM buster is going to jump right on that part of you.
There are many other as well.
And you can see because we have selected the medium.
So this might take a whole lot of time to scan all possible directories and any possible fights as well.
And once you see all of them, you can see you can get there is and there is a path you can get to see
how many files has been scanned and how many of them have tested.
And if there is any error, you see the errors over here.
OK, so you already know what files to look for.
You already know if there's any directories with the backup or dot dot files or files and all that stuff.
This is something which is pretty much important for you and this is something which you can try looking
for.
This is also being very useful to gather the hidden files as well.
Right.
So in spite of you never know.
Right.
You can you can't really just go to the very place on a file.
Right.
So if you already know that this is the possibility that files, you can simply go to the retrieval
directly to the directory there so you can straightaway go to the directly by specifying the name of
it.
Let's say in this situation, the images is available point two hundred so I can search for images directly.
Lovely.
So this means I could actually get all these images otherwise just by looking at looking at the looking
at the site, you never know how many folders or how many how many directories might be there.
Right.
But because of the buster, you can't possibly get the idea about what are the possible directories
for of Melbourne based on images.
I can get those images.
I can download this similarly.
Let's try one more.
These are all hidden files in the images sections.
You can also look for this one.
This is, again, part of images.
This is also said followed right here.
Let's see what we get for this set up database, BHP.
Lovely.
OK, so we see some error with this, and this might be useful for many of the problems, but you can
get the idea of what all the information you have, right?
This is all the Kuwaitis and you can make use of it.
And even this can be used for the Eskil Egyptians as well, if it is possible, possibly information.
Right.
So this is all it is giving you as a part of information.
So let's say this is for Web services.
Right.
So we get to see different services that are available.
We can look for this so we can look for best for everything, right.
That's output on the Starbright and we can see if it is really useful or not.
This is usually usually as a part of best practices developer.
It's able to directly browsing.
You can't really call the directories.
So this can be useful on the situation.
So I hope this was useful.
We can make use of a couple of more systems in following situations to then keep learning.
Thank you.