Discovering hidden files and directories on web servers is not only essential but can also be a thrilling
part of a penetration testers job in the realm of digital espionage.
Uncovering valuable information can be the difference between success and failure.
Luckily, there is a powerful tool.
At our disposal Nmap with its robust database and versatile capabilities.
Nmap shines as a web scanner, enabling us to unearth integrating files, directories and even vulnerable
web applications.
So let's embark on a journey to explore the depths of web server and unravel their secrets.
Imagine you are tasked with assessing the security posture of a target web server.
The first step is to initiate a scan using Nmap web scanning features.
By employing the Http enum script so you with this script, you unlock a treasure trove of possibilities.
The script leverages the Nmap extensive database, which encompasses a wide range of interesting files,
directories and application vulnerabilities.
Among the games you might stumble upon a Readme file database dumps, forgotten configuration backups,
common administration panels and even attack payloads designed to exploit directory traversals in vulnerable
web applications.
The Http script is not just a simple file and directory enumerator.
It's also supports advanced pattern matching, enabling it to identify specific versions of web applications.
So to embark on the exciting web scanning adventure, open your terminal or command prompt and with
Nmap at your fingertips execute this command here Nmap script http enum here and after that you will
enter the SRV and then your target.
In this case, our example target will be telecom.
This is my website that I that uses on WordPress.
It's a regular website, nothing special about nothing I made specially vulnerable.
It's just a regular website that I just created and here you can use arrow keys to see the present of
works and here.
As the scan commences, Nmap will diligently explore the target web server, applying the Http script
and performing version detection with SV here to gather as much information as possible.
91 present.
It's almost done.
That's it.
It's done.
9.99%.
It should be done right now.
No, it's scanning again and say timing is 97.78%.
Now it will show us the results and that will of our scanning.
99.78%.
I was stopped with you right here.
It might take longer.
The firewall of our code.
Silicom has blocked our request since the is not completing now.
Here waited almost.
Almost ten minutes here, but now we are now executing a new scan with without the SRV here.
Now, quickly, we will in three minutes we will get our results.
And here, once the scan complete its mission, a comprehensive report will materialize before your
eyes.
So showcasing the secrets uncovered here.
So let's delve into the an example to illustrate bond results.
So this tantalizing output here reveals that an assortment of discoveries among them there are admin
block, a directory, a test.
Here we also have we have the potentially interesting folder.
It also have the the this descriptions for one of these folders.
Each of these folders here we have possible admin folder here, possible admin folder.
We have a patch tonk tomcat which is unauthorized to us.
We have the key file upload so we can if we go to this here, we can upload files and so on.
We also have open cart editor file upload.
So here understanding the inner workings of the Http enum script, The deepens our appreciation for
its trueness.
So here the Nmap script http enum option acts as a catalyst signaling Nmap to activate the Http script
whenever it detects a web server originally contributed by Ron, both this script primarily focused
on directory discovery.
Over time, the script has evolved as the community expanded its collection of fingerprints to include
various files like version files, read and forgotten database backups.
Notably, the script has enhanced to integrate a database further enriching its detection capabilities.
And it's worth venturing into the intricacies of the fingerprint database used by the Http script.
So the fingerprints reside in the Http fingerprints Rusa file securely stored in the NS lib data directory.
So here we will scan in C lib.
So we don't we can't actually reach it, but we will look at and look at it in the next lectures.
So here this represented a law tables.
Each entry contains a valuable information, including a specific file path patterns to match.
And if you are feeling adventurous, you can contribute to this, to this database by appending your
own entries or even employing an alternative fingerprint file using http dot fingerprint file script
argument.
For instance, you can do this in nmap script http http enum here, and after that you can enter the
script arguments.
Of course, as we always see script arguments and after that we will use the http enum dot fingerprint
file here and here you will enter your fingerprint file and after that you will enter your target,
the IP or domain.
And in this command you replace the default fingerprint file with your own enabling customization and
expanding the scope of your discoveries And the further enhance your reconnaissance, you can modify
the base path of the scan by utilizing the http enum htp enum base path string argument of Sorry of
sorry.
Is my voice going now?
Yes.
So you can do this by enumerating http enum script argument here.
And however, if you are a specific directories here, you can also sorry for this my microphone.
It's actually going and coming here.
Sorry.
Okay.
So.
That's it.
And here you can.
As I said, this Http scripts script begins its exploration from the root directory and however, if
you suspect specific directories holds secrets, you can interact Nmap to focus its efforts efforts
accordingly here.
So here you will enter after script arguments.
We will use http enum enum.
Of course you can use multiple arguments here.
I'm just I was.
I will.
I'm just deleted the previous one because I want to show better here.
So base path and here you can also use the web here and after that you can enter the target here.
So we with this command Nmap will scrutinize the web directory, revealing any intriguing files or directories
lurking within.
But wait, there's more.
So in a remarkable collaboration between Nmap and Nick Tom, an exciting feature was born.
The Http enum script now supports parsing Nick to database files, which opens up a realm of possibilities
by integrating the powerful Nick database, the script dynamically transforms nick entries into Lua
tables and merges them with an existing fingerprint database.
So this collaboration enables you to leverage the strengths of both tools and conduct more truth assessments.
So the harness to harness this power, you can use the nmap here.
Script http enum Nmap or nick here Nick to database path.
This is a script argument.
With this you can provide the a map the path to your database file.
And here after that you will enter with equalities after Equitis and you will enter path to Nicto database
file.
And after that you will enter your target domain or IP address.
And here, as you can see, there's no such path exists because I don't have the database right now.
But you will learn that how to integrate and use that database index lectures.
And here this amalgamation of Nmap and this capabilities offers unparalleled depth and precision in
uncovering hidden vulnerabilities.
So armed with armed with armed with Nmap web scanning pruners, you can venture into the digital wilderness
on unearthing hidden files, directories and potential vulnerabilities.
However, with great power comes with great responsibility.
Always ensure you have a proper authorizations and consent before engaging in any security testing activities.
Remember, penetration testing should be conducted ethically within legal boundaries.
So before concluding our expedition, let's keep a few additional points in mind.
The first is the first is regularly using the Http fingerprints, dot fingerprints, dot lua file with
new fingerprints and patterns strengthens the accuracy and effectiveness of the Http enum script.
So stay informed about the emerging web vulnerabilities and adapt your fingerprint database accordingly
to stay ahead of potential threats.
And here I have two more suggestions to keep in mind.
So the second is file and directory.
Discovery is only one phase of comprehensive web server security assessment to ensure holistic security
evaluation.
Compliment your scans with techniques such as vulnerability scanning, input validation testing and
secure configuration assessment.
And the second and the last suggestion is embrace the thrill of exploration, but always prioritize
responsible disclosure.
If you uncover sensitive information or vulnerabilities during your scans, handle them with care and
report them to the relevant authorities or system owners to ensure proper remediation.
Now, armed with Nmap and its formidable web scanning capabilities, go forth and uncover the hidden
gems within Web servers, empowering organizations to strengthen their security and defend against potential
threats.
Happy scanning.
See you in next lecture.
My name is Typhoon.