Hello everybody and welcome back.
And now before we continue with the suit I just want to show you some of the tools that you can check
out by yourself that already come pre installed in clinics and are used for discovering basically more
information about a certain website.
So let's just open our terminal will go then briefly.
There's only two tools and then we'll continue after that to use burp suit in order to a heck of a page
but first of these tools is called What web.
If you just type here what web you will be prompted with your options for this comment and what this
comment basically does is it e identifies different web technologies running on a certain website where
it can for example detect your script libraries use for designing the website it can discover some different
systems technologies that are running on the website.
Now we will only cover one of the options right here which is just the repos which is minus we will
just use that in order to show you that what this tool does.
So let me just check out the I.P. address of my was machine.
So I'll just start here.
I have config and we can see that it is not one that's nine.
So if I type here what web minus V 1 I do that 168 dot com that one that 9
we should see some of the things that are running on the Web site which can be useful if you're planning
further attack.
So we can see we got a bunch of these options bunch of the output which says basically diversions and
the things that are running on the Web site.
So we go from the top as it says the page is found which it gives us the status quo two hundred.
This is the title the IP address the country summary EDTA in the summary basically you can see all of
the things that it is running and below that you will see in more details what version are they running.
So for example you can see J query h the email five Open SSL Python HDP server Apache and so on and
so on.
But if you scroll right down you can see Apache version two point two point fourteen.
We can see different modules module proxy.
Underscore HDMI all website.
Now this is just the website of the Apache.
Let me just go down emails.
So it extracted some of the emails I believe.
Not really sure.
That's that it could be that these are just some of the emails that are located on the website.
Yeah because of this one I believe always but BWI it basically just found some email on the website
HDMI all five a CTP server Jake Query Open SSL BHP we can see the Virgin passenger Perl Python script
and so on.
So these are just some of the useful information you can find out about a certain website.
For example if you find out that it uses javascript you can possibly try to plan out and the cross site
scripting attack or something like that.
Now that's just the first tool that I want to show you.
We won't be covering it in detail so let's just go on to the next one right away and the next two would
be derp.
So just type in your terminal there and you will get the available options for this too.
So basically what these two does is it scans for directories that aren't found in the page it.
It basically recursively tries to find web pages with different extensions if it finds out that that
page exists or if it doesn't exist.
It basically finds it out by the status code of the page itself.
So for example we all know that if you visit the page it doesn't exist.
You get that weird four or four error page not found.
And if he does it did exist you get the status code of 200.
So basically how this program works is it brute forces the Web site with directories.
And if you get the status code of 200 to a print does that page exists and if it gets the status code
for all four it will say that the page doesn't exist now it's a simple concept.
So let's just run this program on the same webs which is our US political machine.
So let me just see what the syntax is.
As we can see there a Euro base word lists.
So let me just look it's out the word list now some of the word lists you can find its users share the
word lists.
And then just type here l s and let me see which one we will use.
Let me go to Matt Price point since there are a bunch of other board lists as you can see right here.
Let me see if there is any one list that could be useful for us for these specifically for this specific
attack which is basically brute force in the directories in order to find some of the directories that
aren't on the Web site.
So let me just see it right here.
I can't seem to find any directory.
Let me just tell us Greg there.
Maybe it will find something like that No.
Well let me just go.
Oh there it is.
There is literally a blurb so we can use something from here I believe extensions common.
But I just kept that so we can see if that is what we need.
No I don't think that is what we need.
This is the.
Yeah.
The file extension so let me just see what is under common.
It could be something useful so we can try that one not really sure if it is made for this.
Probably not.
But let us give it a try.
Why not.
So we will use the common the 60.
Let me just.
Yeah common that 60 word list.
So it is it should be in the same pad three as well.
So slash user slash share slash word and then slash Europe.
And you should see these common dot text file.
So let's just run there once again.
And if we type here there one ninety two that 168 that one that's nine hopes that nine and we type here
the users share or at least I could have specified comment at the 60 since we are already in the
in the folder and then the options that is received.
We want to add any options or do we want to basically just run this look and see if it will work like
this
use HDP OK.
So we need to specify a CTP
and as we can see right now it is running the director a brute force and we can see right here.
I just want we can see the code.
Two hundred means that the page exists.
No need to scan that we just see code 500 code 200 200.
All of these 200 pages do exist.
So we can prove that.
Let us just use any page that was code 200 for example.
This one we can copy the URL and let us go open our Firefox.
Now the reason why I'm showing you this attack is because some of the Web sites can configure to have
available Web pages with basically usernames and passwords and so
you can basically find something you shouldn't be able to find.
Just by trying out random directories for that page.
Now before I go and paste the link I need to turn off my proxy which is the suit.
So if you have it or as a set as proxy and not running it currently.
Just go here and for this time you go on no proxy.
So I don't have to turn on the bird suit for this video and we will paste and go and as you can see
it there.
It found a page.
So this page exists.
And if we check out another page that gave us the status code of 200 for example to see we can take
any page we want.
So code 200 index that page the email this some icon file so but it doesn't matter.
Let's just see if it works and it does work.
We got the picture.
So all of these 200 codes exist on the Web site as a directory so basically that's about it for this
tool.
Now we will be coding our own directory brute force or in the event section it is really easy to code
and you will see how it works behind the scenes.
So but for now on I just want to show you these two tools.
And in the next lecture we will continue with these bird suit and some of the attacks on our o US virtual
machine.
So I hope I see you there and take our.