All right, you guys, on the last lecture, we explored Broken Authentications and we accomplished
complete account takeover of a victim user account, it was pretty cool.
You haven't seen that one.
Make sure you go back and check it out.
But now we're going to explore sensitive data exposure.
And one of the best ways to hunt for confidential or sensitive files on a web endpoint is to proxy all
traffic through berp while browsing the page.
So what we can do is make sure that berp is connected, in fact, proxy.
And then I'll just refresh this guy to see if I can get it to show up in berp.
And it is.
Let's take off proxy, take out the history.
I'm getting some stuff in here.
That's good.
Let's go to the target and you can see our target here and you can see the tree, right?
So this is actually what we want to see.
You can see all the endpoints in this webapp I can right.
Click, expand branch and just expand everything and take a look here so you can see that there is,
you know, products.
There's this language thing.
There's an admin folder.
There's even application configuration.
Which looks pretty juicy, but what we want to do is look for some sensitive files, so let's just click
through the application and see if we can get brb to passively spider as we click and maybe we'll stumble
across something interesting.
So I'm just going to start at the top, I'm going to click the pancake menu and I'm just going to go
to like customer feedback.
See if there's anything in here, you know, you can press control you to look at the source, do you
like control and certain key access password, things like that control w to close.
Let's go back.
Let's see about us.
All right, corporate history and policy, blah, blah, blah, blah, blah.
Check out our boring terms of use if you are interested in such lame stuff.
All right, so let's click this.
And that's kind of interesting, is prompting us to download a file and let's open that.
We have some legal information.
Now, this isn't confidential or sensitive.
But I wonder where this came from, if you look at the link, you can see it says FTP for legal M.D.
If we go to Berp, we now have the people there.
Right, because Burb passively spidered it as we were clicking through the app.
So now I'm interested.
You know, I want to see what's in this folder, so let's click into the request control our control
shift are to go to repeater control space to send and let's play with this.
Let's take out the legal guarantee and see if we have a directory indexing vulnerability control space,
if we can view the contents of this directory control EFF legal legal guarantee.
So there's a legal term indeed.
But there's some other files.
Wow.
There's a CDB.
Do you guys know that is Hitbox?
Yeah, that is I believe that's actually a a password vault file.
And there's some other stuff here, too, there's a backup file coupon's.
Suspicious errors, I mean, there's a lot I'm sure we've got something in here that's good quarantine,
maybe this malware in there, you know, acquisition that indeed this is why he shouldn't run an FTP
server on your Web server in the first place and you shouldn't have it exposed to the Internet in the
second place.
So let's see if we can access some of these files directly.
Can we get to this power here?
Aquisition?
Copy that pasted in control space and yes, we did land acquisitions.
This document is confidential.
Do not distribute.
So, guys, this is sensitive data exposure we just demonstrated here.
Now, there is another way to find this.
If you use a tool called Go Buster, which may not exist, but if you hit, why you can install it.
And what this thing does is it will try to find a whole bunch of sensitive stuff and you've got to go
bust through the homepage.
You can see it's a directory file, DNS and we host busting tool and go.
And since it's written and go, it is fast.
Very fast.
All right.
And you know, we can brute force yourself directories and files and websites.
It's kind of like Derb or a door buster, but it's the evolution of that, right?
This is the new tool.
It's not really the new tool, but it's the tool that you should be using if you're going to do this
exercise.
So let's see if we have combustor now.
Oh, we do.
Yes, yes, yes.
So pseudocode buster tech age.
Right.
And then control the pain and build out our command.
So what we want is let's say we want to do directory file enumeration.
So I'll skip down to the bottom pane Diar and I'll do the same thing here.
And now we have a new help file for DARPA.
What are we going to do here?
Well let's see.
We can add Slasher's don't need to do that.
Cookie's.
Nope, nope, nope.
Upon finding a file such for backup files, that looks kind of interesting at that, to discover backup.
Expanded principal yourself.
Yep, I want to see that
expanded extension's file extensions to search for so we can actually brute force files.
Right.
So if we do something like indexed that HTML.
We get this page right, if we do index up, we also get this page so we know these are some file extensions
we can look for.
What about aspects?
That's kind of strange.
Wait a second, what's going on here and the Kabani all right.
And I think what's happening is this is a single page application and so it's just returning this home
page regardless of the the endpoint that we put there.
So I don't think we're really going to have a lot of success if we try to look for a specific file.
Right.
It's just going to give us a 200, OK, and we'll have a two hundred, OK?
And we'll have tons of false positives.
Right.
So we'll skip that part of redirects and we let off for now.
What else?
Method's Password's random agents is a random agent.
Stranger can do that and this is good.
So now that, you know, you've got your separate set up.
So, you know, we can use random user agent strings and then you can look at Splunk to see if you can
discover, you know, this particular attack that is code will be overwritten.
OK.
But as you say, positives and negatives, that's codes.
Right?
We'll leave that alone.
For now.
You are out of the target.
So we want obviously HDP juice, that carbon bike, that car, what else?
We can do an output mile and the path toward list and threats.
All right.
So let's do an output file output.
Do you go buster threads defaulters 10 don't want to crash this application, this is in your lap,
so be careful what you said to 15 and then the wordlist path to the worthless.
Which one will we use?
User share worthless.
I'm just completing and actually I want these to be cyclists.
The Queen stole that earlier didn't we all.
We didn't.
OK, Toby, there's this app to install cyclists.
All right, so we'll let this install and then when it finishes, we'll put the part to cyclists and
then we'll jump into this attack.
Let's see the updated locate cyclists.
Yeah, sometimes you just have to do that control busy and you can see that we have it.
So let's go ahead and exit this pain.
And now we should be able to type complete, complete cyclists.
So what do we want?
We want discovery.
What do we want here?
Well, we want web content.
What do we want here?
Yeah, let's do that web content.
We've got a bunch of stuff web lets you control.
Beat the you guys see something interesting in here that might be relevant to what we're doing.
What about directory lists.
Medium lowercase.
That might be good directory lists medium victory list two point three medium text and I think that's
all we needed was fire it off, maybe fired off.
Let's do it.
What the heck.
What did we get here?
It says to continue, please exclude the status code.
What the server returns, the status quo that matches the provided options for nonexisting euros.
Yeah, yeah, we saw that earlier when I put in my VONNE Euro to continue.
Please exclude the status code, the lengthways the wild card option.
Right.
I don't know if we're gonna be able to do this wild card that we're getting to hundreds for all this
stuff.
That's kind of annoying.
So this is good, I mean, this shows you why different tools have different purposes here.
We can see we're not able to use go buster because we're getting two hundred for everything, but we
can still use berp.
To find out sort of the anatomy of a Web application, guys, so I hope you enjoyed this lecture and
the series right here we're going to get into next is the XML external entity.
Vulnerability is awesome.
Sexy is sexy.
OK, all right.
Sometimes it can lead to RC e remote command execution that I am singing.
I am rapping, I am clapping because what you guys are about to see is amazing.
All right, so let's jump into the next lecture when we get down and dirty with Xixi.
I'll see you guys in a little bit piece.