All language subtitles for 2. HTTP IIS Nmap Scripts

In this lesson, we're going
to dig in a little more.

We looked at a few
different tools

for enumerating a website.

Websites are really important.

You're going to see them,
again, internally or external

to a network.

And we're going to
utilize some Nmap

scripts to enumerate even more.

And you've been
given our IP address.

I always see the same
results, as in the past.

But port 80 is open
with HTTP, and that's

what we care about
most right now.

I'll run a service scan.

HTTP is open, so open Firefox,
navigate to the website,

and we get webgoat.net
on the default, dot aspx.

And we're running
Microsoft HTTPAPI httpd

2.0, which is rather useful.

But we could run some
further enumeration.

Let's look at just
port 80, and we'll

run a script with http-enum.

The script is going to
return not just what service

is running, but also maybe
some directories that

are very common, similar
to running [INAUDIBLE],,

but with a very select list.

We got our results
back, and you see

there is a content directory,
a downloads directory,

and a webdav, all marked
as potentially interesting

folders.

We could navigate
and try to connect

to them through a browser,
but there's another script

that we can run.

This one is going to be
web, or HTTP, headers.

We'll let that script
on, along with the skin.

And this owner turned
in more information--

the straightforward
HTTP header information,

which is where we find out
that it's Microsoft IIS 10.0.

We can also dig in, and it
shows that cross-site scripting

protection is off.

X-Powered by ASP.NET.

So it's potentially
useful for us.

All of this, we would
want to save in our notes

to come back to later.

Another thing that's useful
to look at is methods,

and we'll pass arguments--

http-methods.url.

We're going to dig
into this web.dev

and see if there's anything
we can do in there.

And we find out the
supported methods,

options trace, get,
get being very common,

it's what we're most
used to, or post.

But websites are just APIs, and
you've got all these methods.

Some of these could
be quite useful,

but we won't dig
into why just yet.

We'll save that for
an HTTP section.

Right now, we're
just enumerating.

So we tested web.dav, came up
with these potentially risky

ones.

We would want to write
that down in our notes,

maybe check the other
directories that we found.

What's really helpful--
we found a webdav.

Well, there's an
HTTP webdav scan,

and we'll pass the
same URL, and this

will help identify webdav
installations utilizing options

and prop find methods.

So just more useful
information that we will

want to write down in store
for the auditing phase.

Now, that's two Windows
servers that we've looked at.

But what's really most
common out there in the wild

is Linux servers, so we'll
take a look at that next.