OK, so the next Web application scanning tool that we're going to use is called Directory Buster.
So Callicles with the tool is called Derb.
Well, that's directory, but they're pretty much shortened, shortened, and it's going to pretty much
enumerate or gather directories and exist on a Web server.
So Darby is very powerful and it can actually discover, you know, directories and files that weren't
meant to be public and you could potentially exploit them.
So let's go check out how to use DeBrie real quick.
So we're Nikolaidis machine.
We open up the laptop.
So let's go ahead and just try to create Darbie commonness of Derb.
And then we're going to be calling for this for as the IP address of our Métis for the machine for.
And then we're going to do actually we're going to just going to do just to make it not take forever.
We're going to do the specific app that we're, you know, attacking sort of Dan Vulnerable Web app.
So Steve Way.
And then we're going to use you as our source share slash wireless slash derby slash comment.
So this is pretty much a link to a word list that has a bunch of different various names of directories
separated by, you know, lines.
So one on each line.
And when we put this argument here is going to pass in each one of these.
And Darbie is going to use this list to look for those directories and see if they're actually there
to enter and just let it run and it's going to scan.
So as you can see us going through and it's trying to see if it could find some of the stuff there.
So it says right here, hey, it found actually 15 of the directories.
You see, like, if we got like a two hundred response, usually that means, you know, as good as
a good HDTV because it was accepted that I mean, that the page exists.
So it did find some directories out of that list.
And another thing that you can do, like if you know, for example, that it's an Apache server, you
can actually just look at you can run these different lists.
So if you buy else of you use our share dot, share, slash, wireless slash, derb slash, advance
slash and then just enter and you'll see it has a lot of different lists already in here is a Tomcat
Apache's like, you know, as an Apache server, you can run it against the common Apache directories
and look for those.
It's pretty useful.
So and this is definitely a tool that you want to use and then you can start to browse to, you know,
some of these right here and see kind of like what's going on.