Original subtitles

[LOGO AUDIO]

We looked at Windows servers for hosting websites for HTTP.

Now we're going to look at a Ubuntu, a Linux Unix

distribution and see it running Apache.

How is that different?

What does is look like?

You're going to find it's very much the same.

Just once we get to the operating system,

we're going to interact a little differently when

we have a shell, when we're interacting

with the actual machine.

But most of it's going to look very similar

up until that point.

We have just a terminal.

So let's get our IP address.

So it's saying my IP address with a .3.

So we'll use that.

And it comes back port 80 open.

Once you could adjust port 80 per services scan.

And it comes back with Apache HTTPD 2.4.1.8.

That's useful information.

Now we'll take that and run Script Header.

Sorry, Script Banner.

And it should return banner information for us.

The banner being the information that your machine receives

the first time it connects remotely to another machine.

In this situation, it says the server is an Apache

2.4.18 running on Ubuntu.

Let's jump into MSF Console, something we haven't done yet

with this protocol.

The Metasploit framework comes with some very useful

auxiliary modules, scanners, that

will enumerate all sorts of useful stuff for you.

Yeah, so are our hosts to our IP address.

And you can look at the options real fast.

It's going to connect to port 80.

It's not encrypted with SSL, so we don't

need to negotiate SSL or TLS.

If it was on port 443, it might be different,

should be different, would be different.

Let's run this.

That was fast.

It came back with Apache 2.4.18, which is nothing new.

It's what we kind of expected.

Another thing we could do is Curl Page.

And I'm going to pipe it to More just because I

know it's going to give us a lot of information.

More gives you one page at a time.

So DOC type is HTML.

And here's that header information,

which shows that it's about to 2.

Can be quite useful.

And another tool is going to be WGET.

WGET will retrieve web files.

So if we ask it for the index file, which

is usually the Home page for a website, it will download it.

And we see we've got index there.

So we could CAT index and pipe that to More.

And it's the same file.

Another tool we can look at is Browsh.

And we give it a Startup URL.

And it needs it as-- no, that's fine--

as night viewers.

It's going to render in the command line what

our website looks like.

It looks like it's an Apache 2, Ubuntu default web page.

This is all useful information that we

would want to write down in our notes for enumeration.

Get out of here.

Control-W.

Another great tool is Lynx.

And you pass this one as the URL with an HTTP.

And it's very similar to what we just

saw, less gooey, more just reading and parsing out

the text for you in something that's a little easier

on the eyes than the default.

HTML.

Sure you want to quit?

Yes.

We can use DIRB, but we're going to jump back into MSF Console

since we've already done DIRB.

And again, we use an auxiliary scanner for HTTP.

This one is going to be Brute Dirs.

Showing quite a few options.

We'll set Rhosts to our IP.

Mostly all the yeses were filled.

We will delete, or exploit rather than typing Run.

And what this will do is, it's going

to use a word list, one that comes

with Metasploit framework.

Let's see if it can't find some directories for us.

So it found DIR, it found Source.

And since it's the Ubuntu Apache default website, not expecting

to find many directories.

If we did find more directories, that might be telling.

We'll look at the non-Metasploit version of that.

So DIRB.

Instead of an IP address you would URL.

And let's give it the same word list

that we just used, the Metasploit

framework for Directory.txt.

Data word lists.

That one went a lot faster.

Came back with Data and DIR, same

as we found with Metasploit.

The last thing we want to look at is the Robots.txt.

So Robots.txt is what a web browser, what a search engine,

utilizes in order to understand which pages, which files,

are within bounds to spider and read,

and include in search results, and what

files it doesn't want read.

Or maybe what browsers it doesn't want

to be reading these things.

So that Robots.txt file can usually be very helpful.

It could tell us all of the subdirectories and directories

because it's got to tell the search engine to read or not

read them.

Sometimes you get all that information,

other times you don't.

But let's give it a try.

In this case, we will hop back into Metasploit.

It's very useful if you start doing things in Metasploit

to just keep it up.

If you only have one tab, you only have command line,

then sometimes that's not an option.

We're going to use this HTTP Robots.txt scanner.

Set our Rhosts hosts.

It's always best to check your options with Metasploit.

Make sure that everything that says

"Yes" in the required column, actually

has a current setting that makes sense to us.

.3 on 80.

More on that.

That went pretty fast.

So any user agents allowed, so any sort of browser works.

Then we have these Disallows, CGI bin, and Junk.

Maybe if it was the Gibson, it would say garbage.

And we use the user agent of Badbot.

What was disallowed was No Badbot Dir.

That could be useful if we did a Curl of the website looking

at CGI bin.

Pipe that to More, just in case.

We got a 404.

Knowing that CGI bin exists might be helpful.

This case, got a 403 forbidden.

So that can be potentially useful later for exploitation

or for auditing.

And with that, we've looked at now a Windows

server running HTTP and a Linux server running HTTP.

There's a lot more that you can get into with a website

and with HTTP, specifically.

And we will cover that in its own section.