All language subtitles for 3. HTTP Apache

[LOGO AUDIO]

We looked at Windows servers
for hosting websites for HTTP.

Now we're going to look
at a Ubuntu, a Linux Unix

distribution and see
it running Apache.

How is that different?

What does is look like?

You're going to find
it's very much the same.

Just once we get to
the operating system,

we're going to interact
a little differently when

we have a shell, when
we're interacting

with the actual machine.

But most of it's going
to look very similar

up until that point.

We have just a terminal.

So let's get our IP address.

So it's saying my IP
address with a .3.

So we'll use that.

And it comes back port 80 open.

Once you could adjust
port 80 per services scan.

And it comes back with
Apache HTTPD 2.4.1.8.

That's useful information.

Now we'll take that
and run Script Header.

Sorry, Script Banner.

And it should return
banner information for us.

The banner being the information
that your machine receives

the first time it connects
remotely to another machine.

In this situation, it says
the server is an Apache

2.4.18 running on Ubuntu.

Let's jump into MSF Console,
something we haven't done yet

with this protocol.

The Metasploit framework
comes with some very useful

auxiliary modules,
scanners, that

will enumerate all sorts
of useful stuff for you.

Yeah, so are our hosts
to our IP address.

And you can look at
the options real fast.

It's going to
connect to port 80.

It's not encrypted
with SSL, so we don't

need to negotiate SSL or TLS.

If it was on port 443,
it might be different,

should be different,
would be different.

Let's run this.

That was fast.

It came back with Apache
2.4.18, which is nothing new.

It's what we kind of expected.

Another thing we
could do is Curl Page.

And I'm going to pipe it
to More just because I

know it's going to give
us a lot of information.

More gives you one
page at a time.

So DOC type is HTML.

And here's that
header information,

which shows that
it's about to 2.

Can be quite useful.

And another tool is
going to be WGET.

WGET will retrieve web files.

So if we ask it for
the index file, which

is usually the Home page for a
website, it will download it.

And we see we've
got index there.

So we could CAT index
and pipe that to More.

And it's the same file.

Another tool we can
look at is Browsh.

And we give it a Startup URL.

And it needs it as--
no, that's fine--

as night viewers.

It's going to render in
the command line what

our website looks like.

It looks like it's an Apache
2, Ubuntu default web page.

This is all useful
information that we

would want to write down in
our notes for enumeration.

Get out of here.

Control-W.

Another great tool is Lynx.

And you pass this one
as the URL with an HTTP.

And it's very similar
to what we just

saw, less gooey, more just
reading and parsing out

the text for you in something
that's a little easier

on the eyes than the default.

HTML.

Sure you want to quit?

Yes.

We can use DIRB, but we're going
to jump back into MSF Console

since we've already done DIRB.

And again, we use an
auxiliary scanner for HTTP.

This one is going
to be Brute Dirs.

Showing quite a few options.

We'll set Rhosts to our IP.

Mostly all the
yeses were filled.

We will delete, or exploit
rather than typing Run.

And what this will
do is, it's going

to use a word list,
one that comes

with Metasploit framework.

Let's see if it can't find
some directories for us.

So it found DIR,
it found Source.

And since it's the Ubuntu Apache
default website, not expecting

to find many directories.

If we did find more directories,
that might be telling.

We'll look at the
non-Metasploit version of that.

So DIRB.

Instead of an IP
address you would URL.

And let's give it
the same word list

that we just used,
the Metasploit

framework for Directory.txt.

Data word lists.

That one went a lot faster.

Came back with
Data and DIR, same

as we found with Metasploit.

The last thing we want to
look at is the Robots.txt.

So Robots.txt is what a web
browser, what a search engine,

utilizes in order to understand
which pages, which files,

are within bounds
to spider and read,

and include in search
results, and what

files it doesn't want read.

Or maybe what browsers
it doesn't want

to be reading these things.

So that Robots.txt file can
usually be very helpful.

It could tell us all of the
subdirectories and directories

because it's got to tell the
search engine to read or not

read them.

Sometimes you get
all that information,

other times you don't.

But let's give it a try.

In this case, we will
hop back into Metasploit.

It's very useful if you start
doing things in Metasploit

to just keep it up.

If you only have one tab,
you only have command line,

then sometimes
that's not an option.

We're going to use this
HTTP Robots.txt scanner.

Set our Rhosts hosts.

It's always best to check
your options with Metasploit.

Make sure that
everything that says

"Yes" in the required
column, actually

has a current setting
that makes sense to us.

.3 on 80.

More on that.

That went pretty fast.

So any user agents allowed,
so any sort of browser works.

Then we have these
Disallows, CGI bin, and Junk.

Maybe if it was the Gibson,
it would say garbage.

And we use the user
agent of Badbot.

What was disallowed
was No Badbot Dir.

That could be useful if we did
a Curl of the website looking

at CGI bin.

Pipe that to More, just in case.

We got a 404.

Knowing that CGI bin
exists might be helpful.

This case, got a 403 forbidden.

So that can be potentially
useful later for exploitation

or for auditing.

And with that, we've
looked at now a Windows

server running HTTP and a
Linux server running HTTP.

There's a lot more that you
can get into with a website

and with HTTP, specifically.

And we will cover that
in its own section.