1
00:00:08,280 --> 00:00:17,110
All right, so the last picture we got got going and now we're going to start cyclists and all of that

2
00:00:17,340 --> 00:00:23,450
we see here what cyclists it's it's the security testers coming in.

3
00:00:24,390 --> 00:00:30,990
And it really contains a list of usernames, passwords, zero sensitive data, a bunch of different

4
00:00:30,990 --> 00:00:37,380
things that you want to look for if you're forced browsing, trying to delete directories directory

5
00:00:37,380 --> 00:00:41,580
traversal all the time, maybe trying to do forced browsing and trying to break in.

6
00:00:42,240 --> 00:00:45,880
You can see here tons of lists here, right.

7
00:00:46,210 --> 00:00:50,370
For APIs, for your house, for different content management systems.

8
00:00:50,610 --> 00:00:51,480
WordPress is here.

9
00:00:52,020 --> 00:00:52,310
Right.

10
00:00:52,320 --> 00:00:53,400
And you can go through this.

11
00:00:54,350 --> 00:00:56,930
And you can look us in your tools like bourbon intruder.

12
00:00:58,150 --> 00:01:03,760
You know, or was or if and there's different tools you can use and you can basically.

13
00:01:04,800 --> 00:01:06,750
I watch these payloads against their targets.

14
00:01:07,850 --> 00:01:10,830
So what we're going to do is we're going to grab this, this is really the industry standard.

15
00:01:10,850 --> 00:01:13,430
I don't know why it isn't included in college by default.

16
00:01:14,720 --> 00:01:21,710
But we're going to install cyclists and then we're also going to get all that text, so of Jason Haddock's

17
00:01:22,640 --> 00:01:27,350
just super elite, I mean, he's one of the one of the most prominent bug bounty hunters in the industry

18
00:01:27,350 --> 00:01:27,860
right now.

19
00:01:29,000 --> 00:01:31,520
He produced a file called All That Text.

20
00:01:31,910 --> 00:01:37,460
And he basically what he did was it's an amalgamation of all the DNS numeration word lists that have

21
00:01:37,460 --> 00:01:38,130
ever existed.

22
00:01:38,720 --> 00:01:44,960
So, I mean, this pile is humongous and it's really, really good because this word list is based on

23
00:01:45,590 --> 00:01:53,350
valid data and based on common speak, which is a project that basically includes the domains or something

24
00:01:53,380 --> 00:01:55,730
means from the Aleksa top one million sites.

25
00:01:56,270 --> 00:02:00,860
It's based on wordlist from fierce, some old tools and some new tools.

26
00:02:01,160 --> 00:02:05,600
I mean, there's just so much data in this wordlist and it's a really great tool if you want to try

27
00:02:05,600 --> 00:02:08,660
to find, you know, an endpoint or try to find a subdomain.

28
00:02:08,750 --> 00:02:12,140
So we're going to go and grab both of these and then we're going to get started.

29
00:02:12,170 --> 00:02:15,290
So it's going to minimize this must jump right in.

30
00:02:15,860 --> 00:02:19,010
Let's go ahead and install Cycliste.

31
00:02:19,220 --> 00:02:23,090
And again, we can select info cyclists.

32
00:02:23,810 --> 00:02:25,070
You want to learn more about it?

33
00:02:26,390 --> 00:02:30,680
Cyclers is a collection of multiple types and less used during security assessments.

34
00:02:31,430 --> 00:02:31,760
Right.

35
00:02:31,780 --> 00:02:35,090
So it's pretty much everything that we saw in the GitHub page.

36
00:02:35,510 --> 00:02:37,910
So you don't have to install cyclists.

37
00:02:39,780 --> 00:02:43,530
All right, so we already have it so I can do a little update DB.

38
00:02:45,500 --> 00:02:47,600
So I did not know we already had it, so we didn't have it.

39
00:02:49,010 --> 00:02:49,790
Now you do.

40
00:02:50,540 --> 00:02:55,160
So when we do update what that does is it updates the index of all the files in the system so we can

41
00:02:55,160 --> 00:02:57,240
type locate cyclist to find it.

42
00:02:58,100 --> 00:03:00,500
You can see it in this user share cyclers folder.

43
00:03:00,680 --> 00:03:01,040
Right

44
00:03:04,220 --> 00:03:04,430
in.

45
00:03:04,430 --> 00:03:04,790
There we go.

46
00:03:04,790 --> 00:03:05,570
We've got everything there.

47
00:03:06,080 --> 00:03:07,370
We should also install tree.

48
00:03:07,940 --> 00:03:08,870
You'll see what that does.

49
00:03:14,220 --> 00:03:19,620
Now, if I type trade shows everything is a tree, so that's kind of useful, but now that we have Cycliste,

50
00:03:19,620 --> 00:03:20,490
we have our wordlist.

51
00:03:21,460 --> 00:03:29,320
Now, what you need to get the all that text right, so we'll put that in use or share word lists,

52
00:03:29,950 --> 00:03:34,300
word lists is not here right now, but we did get.

53
00:03:35,340 --> 00:03:40,710
And we'll just paste it in, I just right, clicked in the window, I had the path copied to my clipboard.

54
00:03:40,950 --> 00:03:42,950
I press, OK, it's going to pull it down.

55
00:03:42,960 --> 00:03:44,550
You can see it's about 25 megabytes.

56
00:03:46,160 --> 00:03:56,420
If we do a word count like this to work out, you can see that it is, wow, over two million lines

57
00:03:57,860 --> 00:04:02,600
and it is twenty six megabytes in size.

58
00:04:03,470 --> 00:04:06,740
So we can start going.

59
00:04:06,770 --> 00:04:07,910
You could start going through this file.

60
00:04:07,970 --> 00:04:11,960
But this is one big file.

61
00:04:12,140 --> 00:04:12,490
Right.

62
00:04:12,830 --> 00:04:15,160
And you can use this for, you know, first domains.

63
00:04:15,710 --> 00:04:16,100
Right.

64
00:04:17,450 --> 00:04:20,140
Basically it would append this to everything, you know, to everything.

65
00:04:20,150 --> 00:04:26,300
Maybe it's an endpoint if you want to add this to the end of your first browsing or you want to put

66
00:04:26,300 --> 00:04:27,070
it as a subdomain.

67
00:04:27,110 --> 00:04:27,410
Right.

68
00:04:27,420 --> 00:04:29,700
The choice is yours and it's different tools that we can use to do that.

69
00:04:30,080 --> 00:04:33,770
I mentioned some of them earlier, like what's faster, you fool is one of them.

70
00:04:34,310 --> 00:04:40,070
Let me show you that one was Masterfoods is a really good tool and maybe we'll install this one.

71
00:04:42,490 --> 00:04:45,340
And maybe I'll show you how to use it, because this is also a really good tool.

72
00:04:45,550 --> 00:04:52,150
Usually I only use this only recommend we don't actually have a burp because burp gives you a lot of

73
00:04:52,150 --> 00:04:53,080
what this tool can do.

74
00:04:53,390 --> 00:04:58,660
And with the turbo intruder burp extension, you can get really, really fast.

75
00:04:59,410 --> 00:05:04,530
And so I don't think basketball is necessary and some people might disagree with that.

76
00:05:05,260 --> 00:05:06,310
But it is a good option.

77
00:05:06,460 --> 00:05:07,410
It is a good tool for.

78
00:05:08,490 --> 00:05:13,740
But that's what we're going to set up in this lecture in the next month, we will set up a class so

79
00:05:13,740 --> 00:05:15,530
I'll see in the next lecture one set up a.

80
00:05:15,550 --> 00:05:17,370
That's right by.