In this lesson, we're going to dig in a little more.
We looked at a few different tools
for enumerating a website.
Websites are really important.
You're going to see them, again, internally or external
to a network.
And we're going to utilize some Nmap
scripts to enumerate even more.
And you've been given our IP address.
I always see the same results, as in the past.
But port 80 is open with HTTP, and that's
what we care about most right now.
I'll run a service scan.
HTTP is open, so open Firefox, navigate to the website,
and we get webgoat.net on the default, dot aspx.
And we're running Microsoft HTTPAPI httpd
2.0, which is rather useful.
But we could run some further enumeration.
Let's look at just port 80, and we'll
run a script with http-enum.
The script is going to return not just what service
is running, but also maybe some directories that
are very common, similar to running [INAUDIBLE],,
but with a very select list.
We got our results back, and you see
there is a content directory, a downloads directory,
and a webdav, all marked as potentially interesting
folders.
We could navigate and try to connect
to them through a browser, but there's another script
that we can run.
This one is going to be web, or HTTP, headers.
We'll let that script on, along with the skin.
And this owner turned in more information--
the straightforward HTTP header information,
which is where we find out that it's Microsoft IIS 10.0.
We can also dig in, and it shows that cross-site scripting
protection is off.
X-Powered by ASP.NET.
So it's potentially useful for us.
All of this, we would want to save in our notes
to come back to later.
Another thing that's useful to look at is methods,
and we'll pass arguments--
http-methods.url.
We're going to dig into this web.dev
and see if there's anything we can do in there.
And we find out the supported methods,
options trace, get, get being very common,
it's what we're most used to, or post.
But websites are just APIs, and you've got all these methods.
Some of these could be quite useful,
but we won't dig into why just yet.
We'll save that for an HTTP section.
Right now, we're just enumerating.
So we tested web.dav, came up with these potentially risky
ones.
We would want to write that down in our notes,
maybe check the other directories that we found.
What's really helpful-- we found a webdav.
Well, there's an HTTP webdav scan,
and we'll pass the same URL, and this
will help identify webdav installations utilizing options
and prop find methods.
So just more useful information that we will
want to write down in store for the auditing phase.
Now, that's two Windows servers that we've looked at.
But what's really most common out there in the wild
is Linux servers, so we'll take a look at that next.