In this lab, we're going to take over
from where we left off before.
We're going to do some directory enumeration with Gobuster
this time.
So let's jump in the lab and see what it looks like.
We have our Kali Linux environment.
Gobuster is a command line tool, much like DIRB.
Let's take a look at our IP address.
And we'll just change that to 2 to 3,
and we'll run Gobuster against it.
Let me make that larger, so we can see
what Gobuster suggests doing.
Gobuster is very much like DIRB, except it is written in Golang,
and it's a much faster non-keypal language.
So we can pick what commands we want.
So we're just going to go with a very straightforward one.
We'll talk Gobuster, then we're going to do directory look up.
And we can just--
I haven't start with that.
Well, first we need to specify--
well, let's see what we need to specify for DIRB.
We'll do-- that'll help.
And you can see it's a little different
when you get into the directory brute-forcing.
We have certain flags.
So there's a tag u for the URL.
And we want a specific word list.
So we will set that with a tag w, pick our word list.
So there's a tag u and http deck up.
And then for our word list, we'll do
/usr/share/wordlists/dirb and then should be common.
I used the Tab in there a bunch of autocomplete,
and it works really nice.
I will run it, and it goes really, really fast.
We got a dot get.
We have a bunch of these 301s.
We have some 403s.
We're going to clean this up a little bit because some of this
isn't really telling us that much that's useful.
So I don't want a 403, and I don't want a 404.
So we'll use dot b and the 403s and the 404s.
We'll get silenced.
OK, that's a little more helpful.
And I'm going to expand this out,
so it's again, a little easier to read.
OK, some of that is useful.
Passwords seems interesting.
Data seems interesting.
Well, we have some 301s in there.
A 301 we saw before is a redirect--
I'm sorry, 302 is a redirect.
Let's look for something specific.
Let's see if there are any file types that are dot php or dot
xml or dot txt.
And then let's follow redirection
dot r, see what that brings us.
OK, a little more--
phpinfo, login.php, index.php.
And we see everything in here is 200 and this one 500--
a couple of 500s.
This could be way more useful to look at.
And if we're going to actually get into the text--
let's dive deeper into one of these directories.
We got this data directory.
So we'll take what we've already got.
And I'm going to go back to this dot 3 forward slash data.
And we'll now look in the subdirectory there.
And this scan goes usually really, really fast.
There's an accounts.xml.
OK, that seems interesting.
Let's check it out.
We'll throw the IP address in there--
dot 3-- Mutillidae.
Awesome.
Well, we had data.
And then in data, we've got accounts.xml.
And whoa, we've got this document
that's got usernames and passwords, signatures
and types.
Not exactly sure what this is, but this
could be really useful.
Perhaps, admin, adminpass.
Well, let's see what that does.
Let's go back to the home page.
It's a way to log in.
There is log in here.
Let's go with admin and adminpass.
Hey, and I logged in.
I'll pretend like I didn't know it was going to log in.
So we saw that Gobuster goes really quickly
for directory busting.
It uses a word list and you can specify what you
want to do with your outputs.
And that can be really useful.
So with that, that is the end of this lab,
and we'll see you in the next one.