In this section we are going to learn directory bursting and host enumeration.
That is very important concept in website pentesting and bug bounty.
Rectory busting refers to finding directories and pages of a website, whereas in Vhost enumeration
we are looking to find subdomains of a website.
We are going to see two tools in this tutorial.
Go-buster and Alpha.
Go-buster is an open source directory and files Bruteforcing tool written in go programming language.
It is used for discovering hidden files directories on a web server by generating a list of possible
directories and file names and then trying to access them.
Purpose is another tool that is becoming popular due to its fast speed and flexibility that it provides.
Another important concept is word lists.
Word lists are lists of words or phrases that are used in directory and vhost brute forcing to generate
possible directory and host names.
These word lists typically contain common words and phrases that are used in file and directory naming
conventions, as well as common vhost names and subdomains.
We will be using psychedelics for our lecture, which can be installed by using the following command
on Kali Linux or parrot OS.
First of all, let's see.
Directory bursting.
The commands for directory bursting are very simple for both Go-buster and F5.
In go-buster use their flag, specify the URL and the dictionary file.
And if you need to provide the first word.
At the end of where you are going to find the Rectories.
Before finding the files, we can specify the extensions for searching files for that extension in the
specific directory.
In Go-buster.
You can specify the extensions by X flag and list down the extensions with comma in between.
Efforts can also be used to brute force the files.
Extensions are specified with dash e flag.
Now let's see some host enumeration commands.
Rehost rumination is the process of identifying virtual hosts on a web server.
A virtual host is a method of hosting multiple domain names on a single web server.
Each domain name is associated with a unique IP address or port number, and the web server uses this
information to route incoming requests to the appropriate website via host.
Enumeration is often used as part of the recursive phase of a web application pentesting or Vulnerability
assessment.
Attackers can use host enumeration to identify all the virtual hosts hosted on a web server and then
focus their efforts on those hosts that may be vulnerable to attacks.
For Vhost enumeration.
Just use the flag.
Vhost.
Go-buster.
Specify the URL the wordlist and use dash.
Dash.
Append dash.
Domain flag.
For if you need to specify the dash head that specifies the header and specify the host.
So let's see the demonstration.
So I am using web enumeration room from tryhackme.
For demonstration purposes.
Scroll down to Go-buster tasks.
The room first explains different modes that Go-buster uses, which we have already seen.
The dark mode and the host enumeration mode.
Now go to Task six and start the machine.
Here we are provided a website address.
First of all, we need to add this to our host file.
I'm already connected to my Tryhackme VPN, so open a terminal.
And open your host file.
Add the IP address and the domain name.
And save the file.
Do.
You can install go-buster with sudo app install go-buster command.
It's already installed on my Kali machine.
The first question is run a directory scan on the host and find other directories except CS images and
JS directory.
Let's first visit the website.
And we have a static page without any other information.
Dollars.
Just try to bust in with Go-buster.
With the command Go-buster dash you.
The double flag gave the name.
Use the directory list.
2.3 medium word list from cyclist.
Here, you can see that Go-buster has already found some directories.
So we have changes, video and public directory.
Just answer the first question.
No.
In second question, we need to find what file extension exists in the changes directory.
So use the command as shown on the screen.
Specify the extension with dash x flag.
I'm using dash to increase the threads to 32 and using the same dictionary file.
So it has found a few files that changes dconf and bootstrap dot js.
So answer the question on Try hack me with the found extensions.
So the next question is, there is a flag out there that can be found by directory scanning.
Find it.
So we may just check the directories one by one and find the flag file.
Just open the browser and visit the directories one by one.
So we do have a flag file in videos directory.
Let's go up with the flag and paste it on Tryhackme.
No, let's just move to host enumeration.
The next question is there are some virtual hosts running on the server.
What are they?
Open the new terminal with the Go-buster with host flag.
Abusing the worldly subdomains to 1 million from cyclist.
And start the scan.
The go-buster found two subdomains learning and products.
To answer the question, we'll try hack me.
With the subdomains name.
Once you find any subdomains in solving any challenge, just remember to add them to your Etsy host
file.
Now try to visit them.
And you can see that both websites are working now.
So we need to brute force the flag file in both subdomains.
Just use the Go-buster command.
Specify the sub domain and the text extension.
We'll use the same command for learning as well as the product subdomain.
And we have found the flag file if products of domain.
Please visit the website.
Copy the flag and paste it onto a hair clip.
So we have completed the challenges.
Now let's just do the same task with F.
So the first task was to brute force the directories.
Use the command f dash URL and use the same word list of directory list 2.3 medium.
Then you can see that it has found the directories.
Similarly for finding extensions specify the extensions with E flag.
And it has found our extensions.
Similarly, we can use F for enumeration.
Specify the header with dash h flag.
And use the sub domains to a 1 million dictionary file from checklist.
Let's start the scan.
If you get a lot of false positive, stop the scan.
And you can filter the results.
The word size.
By using the flag.
It specifies the word size, which is 205.
In this case.
Well it is found are both subdomains.
Now to find the flag, specify the first keyword after the sub domain and specify the extension.
And it has found the flag dot txt file.
So in this manner we can use F and Go-buster to do directory bursting and vhost enumeration on web applications.
I hope you like this lecture and see you in the next lecture.