Original subtitles

[LOGO AUDIO]

One of the most common protocols we're going to see is HTTP.

HTTP is for hosting websites.

We would see this on an external scan.

We could see it on an internal scan.

Websites are a big part of the internet.

So anything connecting to the internet, networks, websites

are going to be a big part of it.

There are so many programs, so many ways

that you can build a site, so many languages

that, there's just a plethora of possible vulnerabilities.

As an attacker, if we see that there's a website being hosted,

it's like knowing that there's an unguarded back door,

that there's going to be some way of getting in there.

So let's dive in and see what that actually looks like.

We've been given an IP address.

So we're on a civil Nmap scan against it.

And we see port 80 is open.

We also see 135, 139, and 445.

Let's run a couple extras on this machine.

But port 80 is open, port 80 for HTTP.

When I see that, I want to open up a web browser.

And a lot of people will say, there's

a lot you can do before you get to a web browser.

But I think there's a lot you can learn just

from going there.

WebGoat.net.

So WebGoat is a purposefully vulnerable application website,

built by OWASP.

See it over here?

And it's great for teaching.

It's great for training.

It's great for learning.

Let's see what we learned from our scan.

Running Microsoft IIS HTTP D 10.0.

We've got Microsoft running.

There's a MySQL.

That's interesting.

We'll come back to that later.

Fingerprint scan came back no exact matches.

We had Windows.

Going with Windows, it's IIS on port 80.

That's a dead giveaway.

So it's neat.

It's helpful.

What else can we learn from this?

There's a couple extra scans that we can do.

Search on a What Web.

And that's going to reach out and find some information

about our server.

Again, Microsoft IIS 10.0.

No real change there.

Looks like there's no cross-site scripting protection.

When you run a program like What Web,

it's running a bunch of scripts.

And some of them are going to be to test and see

if there's vulnerabilities.

It's kind of nice.

Another tool that we've got is HTTP or HTT pi.

They can manage as HTTP.

And it'll reach out.

You can see here, it just sends an HTTP request.

You got a 302 found.

And this is where we find out what our server.

That it's a Microsoft IIS 10.0.

This is all the header information that came back.

And then it just says that, the object was moved to--

and then an anchor with an href of default.aspx.

That's another dead giveaway.

Microsoft IIS utilizes the aspx file type.

So it's just good confirmation of what we are working against.

Another tool, DIRB, will enumerate for us quite a bit.

You got to give it an URL, not just an IP address.

So it's going to run against this default word

list, the DIRB word list with common.txt.

And what it's looking for is directories.

So we saw the default.aspx is where we were getting sent to.

And we connect to just the IP address.

And in here, there is content.

That's one it tried.

We are forbidden.

Try Downloads.

We'll see some of these things that DIRB is popping out.

We'll wait until it finishes the scan, truthfully,

because it's going to go through 4,600 words.

But what it's doing is, it's sending a GET request

to the full URL to see if it gets back anything.

Since it found these top-level folders,

now it's looking for subdirectories.

We'll probably continue to get 403s.

But a 403 means it might actually be there.

So this is basic enumeration.

One other tool that we have is Browsh.

And it will do website and enumeration based

on an URL in your command line.

So it looks a lot like what you would see in the browser.

And it can be quite useful if you have Browsh on the machine

if you don't have anything more than command line

because you could see, its best guess at rendering the website.

Oh, that made it worse.

And you see DIRB will run for quite a while.

But we would let it run.

We would mark down all of the directories

and see if we have access to anything.

And that is our basic enumeration.

Again, this is a website running on a Microsoft server

because it's running Microsoft IIS server.

You can feel free to let your scan continue, see

what directory, subdirectories you find.

But we're going to move on to the next lesson.