Original subtitles

In this lesson, we're going to dig in a little more.

We looked at a few different tools

for enumerating a website.

Websites are really important.

You're going to see them, again, internally or external

to a network.

And we're going to utilize some Nmap

scripts to enumerate even more.

And you've been given our IP address.

I always see the same results, as in the past.

But port 80 is open with HTTP, and that's

what we care about most right now.

I'll run a service scan.

HTTP is open, so open Firefox, navigate to the website,

and we get webgoat.net on the default, dot aspx.

And we're running Microsoft HTTPAPI httpd

2.0, which is rather useful.

But we could run some further enumeration.

Let's look at just port 80, and we'll

run a script with http-enum.

The script is going to return not just what service

is running, but also maybe some directories that

are very common, similar to running [INAUDIBLE],,

but with a very select list.

We got our results back, and you see

there is a content directory, a downloads directory,

and a webdav, all marked as potentially interesting

folders.

We could navigate and try to connect

to them through a browser, but there's another script

that we can run.

This one is going to be web, or HTTP, headers.

We'll let that script on, along with the skin.

And this owner turned in more information--

the straightforward HTTP header information,

which is where we find out that it's Microsoft IIS 10.0.

We can also dig in, and it shows that cross-site scripting

protection is off.

X-Powered by ASP.NET.

So it's potentially useful for us.

All of this, we would want to save in our notes

to come back to later.

Another thing that's useful to look at is methods,

and we'll pass arguments--

http-methods.url.

We're going to dig into this web.dev

and see if there's anything we can do in there.

And we find out the supported methods,

options trace, get, get being very common,

it's what we're most used to, or post.

But websites are just APIs, and you've got all these methods.

Some of these could be quite useful,

but we won't dig into why just yet.

We'll save that for an HTTP section.

Right now, we're just enumerating.

So we tested web.dav, came up with these potentially risky

ones.

We would want to write that down in our notes,

maybe check the other directories that we found.

What's really helpful-- we found a webdav.

Well, there's an HTTP webdav scan,

and we'll pass the same URL, and this

will help identify webdav installations utilizing options

and prop find methods.

So just more useful information that we will

want to write down in store for the auditing phase.

Now, that's two Windows servers that we've looked at.

But what's really most common out there in the wild

is Linux servers, so we'll take a look at that next.