All right, on the last lecture, we got HTP X working, and it is an excellent way of probing cumins
and subdomains to see which ones are valid.
And now we're going to go with go witness to also written in Go Go is just a very fast language.
And if you scroll down, you'll notice that it doesn't really give you a lot of help when it comes to
installing this like it go here, the documentation.
That's actually what we're going to do.
So we can go to the wiki here where we can go to the top and quick wiki scroll down, quick installation.
And it says if you have to go in binary in your path, which we do, we can just run this.
So let's do that.
Give it a shot.
All right, so now we should have go witness and we do very, very cool.
So again, I'm going to create Dupain top is going to contain the instructions and the bottom we will
build out our command.
So first we're going to run, you know, go witness and we want to take the euro sourced from a file.
We'll say, well, let's go here.
Biotech age, and then we get more options with the file we need to tack F and then we can put the file
containing the Urals, right.
And then we can also use a number of threads to use and a few other things that we can do, and you
can see here using this user agent string right here.
So what we could do is we could do tech f people.
And let me show you what I'm doing with the file.
So I'm going to go back to HTP X.
I ran another HDB X scan in this one.
We used a combined file, and this time I'm using the silent flag so that we're only getting the domain's
OK.
And I bumped up the thread count the 200 and leaving it in a file called Powder HDB.
So you just get a lot cleaner output.
That's perfect for the input into your witness.
OK, so now that we've got that file,
which you can see is about eight thousand bytes, which is pretty cool.
Let's go back here.
Got that going.
And where's it going to put these screenshots?
Store path for screenshots.
Use that use that for present working directory, we can keep it the way it is and I'll just put it
in a folder called Screenshots.
Let's give it a go.
What happened here?
Go witness command not found.
Let's get rid of the CEO.
You know, sometimes when it's it just you just got to know how to play with it.
All right.
So you can see we're getting some 200 status codes.
You can see.
Here are some of the stuff we saw in HTP X, but now we're actually able to look at it live and if we
create another pain, let's move this guy up.
Let's see if we can look in this folder, screenshots folder.
Now, we've got some screenshots inherent
in all we can do.
You don't have a screenshot reader.
I mean, obviously, we can't look at the screenshots here, right.
So we're going to need to EKPE We can just sepi all these pages down to our host box and then open them
up and like, you know, photos and, you know, take a look at what's behind each of these pages that
that'll help us to determine, you know, where are we going to go next with our tax rate.
So we'll let this run and we'll come back once it completes.
All right.
So everything is done and didn't take too long.
Let's see if we can look at the folders that we have here.
If got the screenshots or one three screenshot you can see.
All of the screenshots we have, so we don't have everything, it's only returning the Urals that actually
had some content on it or that it was able to take a screenshot from.
So this is good.
It narrows down our search dramatically when we look for bugs.
So what are we going to do here?
Well, we need to grab all of the pages in this folder before the right here.
So we're going to do is we're going to set this stuff down.
I'm going to exit.
And we can run step on our host machine, right, so we can say,
all right, S.P.I for our, you know, our private key.
Loubani at sixty five to thirty eight.
All right, let's put that directory in here and we'll put it in our current directory.
Oh, that's right, because we need to grab all the star start up beings.
There we go.
We're just downloading all the images we captured from our digital ocean droplet to our physical host,
and now we shall be able to open these up, see what they look like.
And I just changed the view to extra large a double quick this.
I can see the view here, so I've got a login form here that's interesting and I can just hit the right
and left arrows right and left our keys to just, you know, page through all these pages.
And some of the stuff looks interesting, right?
What is this?
And this domain is registered, but there's nothing here, you know, maybe there's a subdomain takeover,
that this might be something you want to pass over to nuclei because nuclei has the most subdomain take
over modules and we're going to get into that in subsequent lessons.
You can see there's some pages here that.
Some weird base64 string here.
You know, I mean, there's just lots of lots of good stuff in here, I mean, OK, like, what the
heck is that forbidden, right?
Maybe you want to divorce browsing against this page to find out more.
And if you want to know where the page is, just look at the file name and it tells you this is that
colon whack whack API, that financing, that PayPal dot com, you know, in the file or or no input
invalid argument.
Right.
So there's a lot of juicy stuff in here.
And if you take your time and your patient, you're going to find some bugs that you can report.
You know, I could already see a lot of really good ones in here that I want to dig into, but in the
next election, I'm going to show you guys how to use D in Maskin so that you can now start scanning
these domains for ports, running ports, games against them, because by default, Maskin takes IPPs.
It doesn't take domains, but restacking actually wrapped the mass and binary in a custom Basche script,
which will convert the domains.
You feed it into IPS and then scan those and then you can, you know, run that into EMAP diversion
scanning and then pass it down your automation sequence to get even more results, more information
that you need to produce.
A great book, Boundy Report to submit a hacker one or Warcraft.
Right.
So I'll see you guys in the next picture when we get into Dán Mascotte.
See it a little bit by.