So we can see from the result it was able to find a number of files some of them we already know of
now the fav icons just an icon Foodtown have there.
These are probably on the style files index is the index that we see usually.
So it's our right log in we can see that we discovered a page that allows people to log in.
Now in many scenarios I was able to find username and password.
Our target exploiting a really complex exploit and then ended up not being able to log in because I
couldn't find where to log in.
So tools like this could be very useful.
And here we can see that we have a log in page that we can use to log in page in our phone number is
very useful.
You can see the ph we have on file now this file is usually very very useful because it displays a lot
of information about the BHP interpreter running on the web server.
And as you can see this file contains a lot of information a lot of them are useful now you can see
you get to know some of the directories you know that it's running ph 3:5 the configuration is stored
in this file and any files is usually the config files for BHB so you can see all the places where they're
stored.
And going down you'll see all the permissions they installed.
You can see here it's it has my askew I also use in my squirrel and agency Doura directories where different
types of configurations are stored.
You can also see all the modules and extensions are being used with PAGG.
So this file is usually very very useful.
You can see we've managed to find where the PH my admin log in is and that's basically the logging that's
used to log into the database.
Another very useful file is the robots that the XTi.
And that is the file that tells search engines such as Google how to deal with the website so it usually
contains files that we don't want the web site or Google to see or read.
So if we can read that file then we'll be able to see what what the web admin is trying to hide.
So go in and hear we can see that Dubai admin doesn't want Google to see a directory called password
OK.
And it also doesn't want to see a file called config Inc.
And it also doesn't want it to see these other files.
So let's have a look on the passwords and the conflict.
And as examples.
So I'm just going to open a new tab and we're going to put our address like so so is the current directory
and then would just put passwords after and that we can see that there's a file called accounts to the
XTi I'm going here we can see that we've got some user names and passwords so we can see there is admin
admin POS we can see that we have a password as Adrianna's a password.
So we managed to find usernames and passwords.
Now we're still not sure what these usernames and passwords for but we're sure that we were able to
find very useful stuff.
Another useful file is the config got ink.
So let's see what's in that and from here we can see that we have information that allows us to connect
to the database because these are saying D-B Helo's the user they will pass a name so we can see that
the user name is root and the password is blank.
So we can go ahead and try to connect to the database based on these commands and then we should be
able to get access to that database.
Also using these passwords we're still not sure what we can use them for but we can add them to our
list.
Try to log into the admin or just store them in a list so that we can use it if we're going to do any
brute force attack.
So then again this is another video that just shows how important and powerful information gathering
can be.