[MUSIC PLAYING]
This is our second lab on directory enumeration.
This one is going to be with Burp Suite.
So far, we've done DIRB, which is quick and easy, fairly
straightforward with some customization, Gobuster,
which is very fast.
And you can use for some directory busting
or for fuzzing, utilizing whatever you want for the word
list and filtering out your results to what's most useful.
We're going to use Burp Suite in this one.
And it's great because when you start working with Burp Suite,
you can just stay in that environment.
If you're going to be doing web app penetration testing--
and the top names in our industry
tend to use Burp Suite.
And Data Poll asked around on social media and Hackers Point,
and Ben, and a lot of the top influencers, at least
in our space, use Burp Suite when
they're doing web app penetration testing and bug
bounties.
And if they start in Burp Suite, then they
don't have to change a whole lot.
They set it up for their engagement.
They go do whatever they're going to do.
And they just stay in there the whole time.
Usually, if they're professionals
who are using Burp Suite Pro, we're
going to start out with Burp Suite Community Edition.
And it's got a few drawbacks, especially
for what we're going to do.
But we're just going to show how it works.
If you get into a professional setting,
you will be prepared to use it.
If you're doing capture flags, if you're getting your hands
warm, use Burp.
If you want to use Burp, use Gobuster or any of the other,
maybe the REST tools, to go even faster.
But let's dive into this lab.
We have a Kali environment.
We need our IP address.
We can shut this out by doing the .3,
and that's our same target that we've been using.
Let's open up Burp Suite.
We'll leave it blank.
Start Burp and start going, and it's up and running.
Intercept is on.
We can turn on the proxy.
We're using the FoxyProxy over here.
And then, if we refresh, we get this.
What we're going to do is we're going
to send this over to Intruder, so Sent to Intruder
[INAUDIBLE].
Now, we've got our target.
That's what we've been attacking.
Cool.
Positions, and here, we need to clear all of our positions,
where I can change the cookies or anything like that.
Right here, we want to add $name.
And we're going to look for directories in there.
So this funky Burp Suite symbol, whatever's
in between those two, that's going to be our variable.
So we'll send it to Sniper, and we'll see.
Sniper is going to shoot one at a time.
Battering ram will hit a whole bunch.
Pitchfork and Cluster bomb are also different ways
of going about fuzzing.
But this one is going to go directly.
And we'll utilize our get requests in order
to do this and our directory that we
look at as part of the attack.
So we want to use a simple word list.
We'll keep it at simple list and payload count.
We're going to add in a couple of things here off the bat
because it will--
Burp Suite Community Edition throttles some of your speed.
[INAUDIBLE] it in here.
It will when we run it.
So we're just going to add in a few things that
might be helpful.
And then, we're going to load on top of that a word list.
User, Share, Wordlists.
I will use dirb and common because it works,
and it added all of those in there.
It's a great word list.
It's a chance it's going to go really, really slow.
[INAUDIBLE]
We're going to get rid of this empty space.
And that should be good.
Now, we just start attack.
It's up here in the top right.
Yep, and it tells you it's a throttled version.
Sweet.
We can see it's going through.
We got our different statuses.
We can sort by status.
And we will just let it run.
Knowing that we got 301, this over here,
we can see what does that mean.
We can look at our response is permanently moved.
OK, it was moved to data.
So there is a data directory.
See that?
Hey, there's passwords, and passwords move to passwords.
That can be really useful.
There's going to be a lot of 404s in here.
But this is generally how you go about doing directory
busting with Burp Suite.
There's other things that we can do with Burp Suite,
and we will get into those.
We'll get into those in following labs.
We'll do some spidering, some built-in stuff.
It can be quite powerful.
This is just one way of utilizing Burp in order
to do directory enumeration.
If you thought it was useful, awesome.
It's a powerful tool, and being able to use it well
can help you go a long way.
So with that, we'll get into the next steps.