[MUSIC PLAYING]
Welcome to this, our first lab in this course.
We're going to be researching and investigating
the web and HTTP protocol.
And with that, we'll jump into our VM environment.
We've got our VM.
Here it's a Kali box.
And what we're going to do is first check our IP address.
And we have this one 192.36.17.2.
Yours might be different.
That's why we check.
And I wanted to open Firefox.
I'm going to copy out that IP address,
drop it here and put a 3 at the end instead of the 2,
and that pulls up our vulnerable app.
Now, what we're going to investigate here
is some methods.
In the first introduction, we played a little bit around
with the web.
And we can see here that this page
shows HTML, but down here at the bottom
should have a POST request.
Or rather, if we go to the login page, and there we go.
Take a look at this one.
Let's see the page source.
That's a little easier.
I've got the body, and this is CSS.
There you go.
There's our form.
So it's going to take a password, a username,
and it's going to send it as a POST request.
Currently, we got a get request to get us here,
and it's going to send it to login.php, so you're here.
This form is going to gather all this,
create a POST request to login.php,
and you can see that that's what we've got here.
So a get request to get there.
And that's all good and dandy.
Let's try it with John and password, which they gave us.
Don't worry about saving.
And it says, welcome, John.
And that's kind of cool.
We can go-- silly workspaces and scroll wheels.
There we go.
We can see here, there's a little bit of information.
If we dive in, we can see that there is a blog.
And really, so far, we've seen login.php and post.php.
Let's see what all the possibilities are.
So we're just going to run dirb, and this
is a very simple to use directory buster.
And we got to give it the right stuff.
We've got to give it a website, http:// like it says up there,
and it is going to do some directory busting for us.
We talked about these are just files
on someone else's computer.
These are held in directories.
Let's see what directories and files exist.
That's what dirb does.
It utilizes this word list in /usr/shared/dirb
/wordlists/common.txt.
And this site is purposefully vulnerable and easy to find.
We've got the CSS images.
There's a .git.
That can be interesting.
Got the license, PHP info, server status.
They gave us a 403.
There's uploads and vendors.
We could play with uploads.
In a little bit, we will.
Looks like there's mail, there's JavaScript images.
So let's see what those actually do.
Let's start with sending a get request.
And we're going to utilize curl.
I showed curl a little bit before with Wireshark and what
it looks like in this situation.
Sorry, 36.17.3.
We're just going to send a get request.
That's what the forward slash X with curl does.
You select what kind of request you're going to send,
and in this case, a get request.
Do that, and it sent the page back.
That's all good.
And Danny, that's kind of cool.
Let's do the same thing, but let's just ask for a head.
These are different methods that we can use.
And it came back not wanting head.
Of course, it's because--
Fred, you just do tag L. My mistake.
And let's try with a couple there.
There we go.
There's the head.
OK, so it's then an HTTP head request.
That's tag capital I. I got a 200 back,
and it says not a whole lot.
There's a PHP session and a path.
Not a ton of extra information other than hey,
you should get back text in HTML.
Well, let's see what all of our options actually are.
So tag X, and then options.
And it didn't do anything, wow.
So silly.
We need a tag B at the end, and that's going to do verbose.
And in there, that's where we can see what is allowed.
It tried.
It connected.
It got options with HTTP accepted as the route.
We got our 200 OK.
And in there, it says that we could do get, head,
and options, which is what we just did,
and why we got information back.
Well, let's try it with a put.
Let's see what we get.
And we're going to keep that tag V at the end.
Well, let's not.
Let's get rid of the tag V. And we're
going to get back 405, method not allowed.
It wasn't an allowed method.
So it was right here, allowed, get, head, options.
Not allowed, a put.
This is not a place where it will accept us putting files
on the server, if that's a nice way for you to think about it.
There was a login.php.
Let's look at our options at login.php.
And of course, if we do options, we need a tag V at the end.
Set options to login.php.
and we get back at 200 OK.
And we can get post, get head, or options.
Get, make this pretty straightforward.
And post, we showed if we do a post, it logs us in.
Well, let's try that.
Let's use curl with post.
And we get back information for logging in.
Remember all this from before?
We looked at it over here.
It's the same form, and we got it back as a 200.
OK.
Well, let's actually pass some information.
We'll do the same thing here, except we're
going to pass a tag D, and it asks
for username, and the username, and then
password and the password.
So we will follow their same options right in here.
And this will be a little easier to read if I do this.
There we go.
Looking for name equals and username's a placeholder,
password, and password.
So in that situation, name equals,
and we'll still use John like it was passed to us.
We need an and to split up these key variable pairs,
and it's also password.
And we'll make sure that that's verbose, so we get back info.
What I really wanted, we got 302.
The 302, we have a session, PHP session ID that's good.
But we've got a 302 index.php.
302 is a redirect.
Well, what happens at index.php?
Well, we could check that out.
We did that on Wireshark in the last video.
But it eventually takes us back to the page that we're used to.
It takes us back to this page--
well, this one, except we're logged in.
And if we wanted to see what that looks like.
Storage and our cookies.
And we have name equals John.
That got stored, because we logged in,
which is why it knows we're John.
Well, there was also a post way up there.
I'm not going to scroll all the way up.
Let's check out post.php, and let's look at the options.
I think there's going to be a post option.
I sure hope so.
Yeah, there's get, a post, head, and options.
Well, let's go check it out over here.
Post.php, and it was the blog, remember?
What are we going to post in here?
It shows that post is an option.
Let's look at the page source.
And we'll cheat, Control+F, find post in here.
Post content.
Oh, looks like we can upload.
Hmm, not seeing anything too terribly crazy.
Well, let's explore.
We got the command line.
Looks like it'll take a post.
It doesn't really tell us how it's going to take a post.
What happens if we try it?
I didn't really get anything back that crazy.
It'll take it post.
It gave us a 200 OK.
But nothing terribly new.
Well, let's move on.
Let's try something else.
We saw there was an uploads.php with our dirb.
So let's explore uploads.php.
And of course, we're going to check for options and a tag V
for options.
We've got a 404, not found.
Why did I-- did I spell that right?
Let's just do uploads.
It's a directory.
Uploads.
There we go.
It's a directory.
What does it let us do?
We got a 301, move permanently.
And it's been moved to--
that one?
That looks the exact same.
Well.
Well, let's try it with this bit.
There we go.
Treat it like a directory, and it gives you what you want.
So there's options, get, head, post.
You could delete.
There's trace, prop find, prop patch, whoa.
I didn't even think those were going to be options.
Lock and unlock, so many options are available here.
That is insane.
Let's try putting a file on there.
Let's do Hello world, because that's cliche.
Put it in hello.txt.
We can see it's right there.
Still exists.
Now let's put it into options.
And to actually upload the file, we don't do the tag X put.
We're going to do upload file, hello.txt,
and it looks like it took.
Well, let's check.
Hey, there it is.
It exists.
Hey, we were able to upload it using curl.
Very neat.
Well, let's try deleting.
there is nothing fancy for deleting.
So what we will do is just tag X and delete.
And what do we want to delete?
We want to delete uploads/hello.txt.
Whoa, it says it worked, and it's gone.
The browser itself doesn't really
allow us to use many of these options
unless you click on the right thing or have a button.
Usually, a post has a form.
And in the form, you hit submit or whatnot,
and then it does a post request for you.
There's no adding or deleting anything on here.
They can make the page have those options,
but they don't, currently.
While it allows the methods, it doesn't have any GUI option
for doing it, but we're able to through the command line,
tools like curl.
Well, let's try a few things with burp.
Turn on our proxy, open up burp.
And this will just allow us to investigate and play out
a little more with other tools.
Go to proxy, intercept on.
And let's go to the main page.
Boom, it caught it.
And we will do Actions and Send to Repeater.
Over here, we can try different things.
Say if we send that, we get our response, request, response.
And we're going to play in here.
It's way easy to see exactly what the request says
and what the response is.
And as you see, we sent a get request
and we get back the 200 OK, and then the HTML document.
And that's all here in the response.
You can dig in and see what it looks like.
Burp is kind of neat in that way.
Well, what if we-- we can change this.
That's the great joy of repeater.
You can change things and then send that,
and hey, we get back just that information.
Neat.
If we send options, we get back options.
Get, head, and options.
Well, let's try sending a post.
It's not allowed, so what do you think is going to happen?
Bam, 405, method not allowed.
These codes, this 405, the 200, those
are standard internet codes that allow
the machines to know if their message was received or not.
They've been using them for decades.
We get used to seeing certain ones because of our interaction
with the web, but APIs have the same similar codes,
and many other protocols also use the same codes just
to ensure that, hey, 200 is OK, a 404 is not found,
a 405 is method not allowed--
pretty straightforward.
Well, let's switch this up.
Instead of to the root, let's go to login.php.
Sending get request, and we get back a 302.
A 302 that sends us to index.php.
Well, what if we do a post?
And again, a 302.
What if we tell it to follow 302?
I'm going to cheat just a second,
turn intercept off, log out, go to the login page,
turn intercept back on.
When I click this button, what do you
think is going to happen?
It's going to send a--
I need something.
I'll send it here, John and password.
It's going to send a post.
Let's send that over to repeater.
Jump to repeater, our post with the name of John and password.
And if I actually send it, I'm going to get back a 302.
And hey, we've got a cookie set for John that expires.
So John must be a good login.
Well, let's play with something else.
How about we get rid of this guy?
Let's put Hello world down here.
And we're going to do a put to uploads, hello.txt.
We know uploads will take a put.
We played with that before.
And we're going to send Hello world,
and it's going to get stored in uploads as hello.txt.
What do you think?
Think it'll work?
We also need content length, and that is--
should be 11.
Hello space world, yep, that's 11.
See if it works.
201, created.
So it now exists there.
Well, if I turn intercept off, I go to uploads, hey, it's there.
If I click on it, it says hello world.
Crazy.
Made that one work.
And if we wanted to go back to here, turn intercept on--
I could have seen it in here, I guess, if I really wanted to.
Send a repeater, send the get request.
And we would have seen that hello.txt is in here.
This is-- OK, rather hard to actually read this little bit.
There it is, hello.txt.
And if we went to the get request to hello.txt,
that's the one.
That'll be a lot easier.
There it is.
Pretty, huh?
And we could even delete it from here, if we wanted to.
So let's try that.
We will send a delete.
And if I send it, boom, get a 204, no content.
It's closed.
We'll wait.
Let's do another get request.
404, not found.
Whoa, epic.
We were able to delete it utilizing repeater.
Pretty crazy, huh?
And that is playing with methods.
We were able to upload some files
and download some files and--
well, I guess we didn't download.
I mean, we could have just done that.
Let's do that real fast for--
why not?
We'll upload this one, and then we'll
just do a straight up curl.
Boom, there it is.
Neat, huh?
And that's playing with methods in HTTP.
Now, start thinking about what you
could do if it was misconfigured and you
were able to use put or delete or any
of these methods in a malicious way.
We will dive into that in some coming labs.
Again, when you find things like this,
you need to identify them to your customer, your client
through your report and talk about
what is your actual impact on the business, what
is the impact to the CIA triad?
Could they lose information that they want to keep secure?
Could they lose access?
Might you be able to change the integrity of files
by uploading new files and possibly overwriting
what already exists?
Perhaps you might be able to put an executable file that
runs on its own.
You could do remote code execution in that way,
if it's allowed, if you can figure it out.
So these are all important to understand
what methods should be and what might
your customer want in their web app on their web pages.
And I'll leave you with that, and we
will go into some more directory busting with more tools.
That way, you get a handle on different methods
and you can pick which one you really like.
We'll do that in the next lab.