So I've gone ahead and just pulled up these sensitive data exposure portion of the guide and you can
see it's pretty much gaining access to confidential information unwanted information finding a backup
file etc..
And this all boils down to enumeration.
Just like I said before a lot of this is enumeration or discovering you know discovering an item that
should not be exposed.
And that's what it does really what it is.
So everything that I've given you so far in terms of tools and techniques is available to you to actually
attack this and try to find things.
The one thing that I can say is we'll walk through this just one here and if we did a quick door buster
against this Web site we would find a directory on here called F T.P..
And guess what FTB has a bunch of different files in here including backup files a Katie B X which is
like a key storage database right for your passwords quarantine there's different kinds of malware stuff
in here.
So you know there's a lot of interesting things in here and this is just one of the data exposures but
this is what I'm talking about like when I told you in the last video that I found a backup folder of
literally the backup of the Web site.
That happens.
The other thing to point out is coming into here and you just need to dig into every single folder and
read what's going on in the response.
Every response is important.
You have no idea what you're going to find.
And just looking through here like you could search at the bottom something like password or you could
search for key or keys.
I always search for those and try to find anything related to keys and you know it just takes time to
go through these and look through all the different responses and see what they're doing and especially
javascript if you can get javascript to pull down with the response that's always good.
And yeah that's I mean that's really it.
So the one thing that we're missing here that I wish that we had back and so show you is this dashboard
like I showed you with the active scanning.
It also does this passively for us.
So this is what's really nice about bird pro is it's good at finding what I call the low findings without
doing much of anything.
And one of those is something like Response Headers.
Now these Response Headers are important.
And it's also good at finding like you know looking at the cookies as well which we'll talk about that
will get to cross-eyed scripting but the Response Headers are important because we can see what kind
of protections they have here in these different protections are you know how we can defend against
certain things and in the one of the defenses was something called H S T S which stands for H TTP strict
transport security.
Now that is a header that should be set in order to prevent an attack where we take secure data say
h G.P.S. we strip it and it's called a protocol downgrade attack and we make it h TTP and then guess
what.
All of your encrypted data is now unencrypted.
So there is a header out there that is called strict transport security.
Guess what I'm not seeing it on here.
You would say strict transport security because of that.
That means that HST s is not enabled here and we could prevent or we could attack this Web site with
a downgrade attack.
Now that is a man in the middle type attack.
It's not something that's necessarily easy but it's something that could be performed and is reportable
to a client and a good Web site for this.
If you're testing against something that's externally facing which we're not so we can't do this.
But security headers dot Io or dot com works either one you just come in here and you scan a Web site
and for example we can scan Tesla dot com and you can take a look and it gives you a report right away
it's a C OK and it comes through here and says here's all the different headers which remember we looked
at the headers and where we saw all the different weird Tesla headers this isn't really common but you
come through here and it says hey look you're missing this header this header in this header and you
have these headers here.
Look here's district transport security header that we're talking about and you can come through here
and see it like here it is in green they have it.
That's good right.
But they're still missing some headers down here so I always like to take screenshots of what they're
missing so that way they have best practices and what they should be including.
So this is just another way it's not necessarily sensitive data exposure with the secured headers but
it is when we include the HST.
Yes.
So you should be considering and thinking about security headers as well when you're doing these sorts
of searches one other thing to point out is that we should also be looking at the level of encryption
on the Web site.
Now there is a tool that we can use for that.
And it's called and map.
It's a great tool and we can use it to scan a Web site and see what level of encryption they are and
get a rating or report back.
So let's take a look at that.
So what we're gonna do is I'm just going to a new tab here and again since we're not using HDTV s on
this site it's not going to be relevant.
So I'm going to scan this against Tesla but we're going to say something like and map.
And then we can say script equals an SSL entomb cipher so we're looking at the ciphers and how strong
their ciphers are.
And we get to say Port forty three Tesla dot com something along those lines.
OK.
Hit enter and it should just take a second to come back depending.
It's going to go out pull down all the SSL information and then drop down a list of information back
to us then it's going to say hey you know it's gonna give it by grade like A B C D F and so go ahead
and let this scan if it takes a second.
Go ahead and just pause the video and then come back when you're done scanning
OK.
So we're back and you can see the least strength isn't a.
This is fantastic.
This means that Tesla goes in there and they really take care of business.
If we were to see like an F or even a C we would probably report this.
You know like if they have bad ciphers that's reportable again it's a low finding.
But this has to deal with that sensitive data exposure.
If we can attack a cipher and again this is a very complicated attack but if we can downgrade you know
something like SSL or tell us whatever we can overcome you know the encryption and we can then then
we can get the sensitive data exposed to us.
So it's always good to check for this as well.
These are just best practices kind of as we're going and we're mentioning these that we should be checking
for.
So I know this can be a lot and a little bit overwhelming.
So please again take notes.
I'm going to keep harping on this.
Take notes re watch this if you need to re watch the entire web app portion if you need to.
But make sure you're checking for security headers make sure you're checking for the SSL ciphers.
This is two basic common checks that you're going to want especially when you're writing reports up
against a client in a Web site.
So that's it for this.
Next we're gonna get into X email external entities which are incredibly fun and incredibly dangerous.
So I'll get you over in the next video.