Hello my phone and welcome back to part twenty eight of my learned ethical hacking course.
In this part I'm going to look at discovering sensitive files within a web site's directory.
So typically when you visit a Web site or this could be actually any Web site.
So let's take my one for example.
So when you visit code on command dot com essentially you're visiting my root directory of my servers
or my Web sites set up.
And when you visit the redirect tree that's got the index to hate demo.
Now that could be dot HP as well.
But essentially that's just the index page.
So that's the home page.
Now that is typically just stored straight into the root directory.
So if I go to the browser and I go to my Web site if I click answer right now I'm going to my root directory
of my web site.
So this will have the index to each demo.
So if I do forward slash indexed or HMO or in this case Patrick because that's what my web sites created
with as you can see it sent you straight to the same page.
So I just close out of that is essentially what we're going to be looking at because when you visit
a Web site you don't know all the directories.
So what I'm going to show you in this is how to search automatically for the directories and files that
you can discover that are typically not meant to be discovered or are trying to be more discreet about
to the owner of the Web site wants to be discreet about the directory as possible Bill.
I'll skip to we'll find all the directories.
So if you think of this as a Web site.
So when you go to your var WW inside your calendar looks machine inside the page to Mel.
This is where we upload payloads.
This is essentially a Web site can visit this by going to your colleague Linux IP address just type
f config in your terminal and visit that in a browser.
But when you visit Web sites.
So essentially what we've just done on my want is visited the indexed page being bought within a web
site that might have different sub directories so they might be about to create a folder.
This is now a sub directory within our Web site and inside this about they might be about Dot Page Pate
and that will be the all about the Web site.
So that's why when you visit the index to each demo you click a link within a heading that says about
us to you click on that and that's where it will send you to the about Dot BHP or hitch demo.
But there might be other sensitive directories within a web site such as admin.
So if you create that that's just a directory and this admin directory might have the admin panel.
So when you visit this page now you wouldn't typically know this because the index to page to mail will
not link you to this but it still exists within the directory and that's what the papers of our scripts
will be to find all the directories.
So when you click on this it might have the within this it might have the admin logging top BHP and
when you click on now or visit it within a browser then it will say please log in with your admin username
or password and it can be quite dangerous then because people could brute force the attack on that specific
web page to gain access to your admin panel.
So essentially that's what we're gonna be looking out for.
If you open up your missus approachable server and what we're going to do is we're gonna go to the directory
of our scripts.
Now it comes print stalled so there's about five different scripts that are pre installed with our meta
splitsville server.
So we type CDE and go to var and then w w w click answer then type less hyphen L.A. click enter that
will list everything inside this directory in any logical order.
And as you can see here there's something called Matilda.
And that is a folder.
So if I just get my mouse back you can exit the screen for me to splurging all on IBM where by pressing
control and alt at the same time as you can see here there's Matilda.
But till the day is a Web site that has vulnerabilities within it.
So we can basically attack a test all knowledge as in it but think of it like a think of it like a test.
So if we go to our Kelly Linux browser and we visit our servers IP address.
Now this IP address is our meat disposables IP address.
So if you type of conflict that will be different to Kelly Linux machine.
So as you can see for this one it's 1 9 2 dot 1 6 8 0 1 10 dot 130.
So let's visit that in the browser to visit our Web site.
Essentially we're connecting to our server Mrs Royce will server click enter and there we go search
it come up like this.
And as you can see there's five different scripts pre installed so there's motility.
So if you click on the now essentially we're in the Matilda root directory here even though it's a soap
directory because as you can see it's a folder it's a separate folder within our reef directory root
directory of our server is this.
This is a sub directory so essentially if you think of it like this this is our reef directory.
But then picture this as like motility so we're visiting this.
That's essentially what's happening.
So when we visit Matilda day this is the soup directory.
It says that a folder itself is essentially the roof folder for the home page.
So with inside this folder within this folder will be the index page pay or hedged email.
And as you can see this is born to be hacked so it's essentially like a hacker's playground.
So you can change the security level.
You can give hints or disable them and you've got to basically just try and hack into this Web site.
But we're not going to be doing that.
We're just going to discover all the directories within this Web site.
So like I said before you will not typically know all the sub directories because you're not going to
be typing.
For example admin after this quick answer and as you can see this does not exist.
So clearly they don't have a sub directory with an admin panel or the sub directory is not called admin
it could be called admin 1.
That could be an admin panel but it's clearly not.
So that is the purpose of a script to find all the sub directories.
This will find sensitive files as well.
So let us go back to all.
Um in fact what we'll do is we'll open up our terminal now so open up your terminal and we'll search
for these files.
So all you need to do you don't need to install it.
You don't need to install anything.
All you need to do is type D.
I'll be then the address for your server which is just the IP address of the meter splitter machine.
So if you just type each TTP then the IP address.
So 1 9 0 1 6 8.
Now this would be different for you.
No one turned up 130.
Then you need to visit the actual directory of Mattel today.
So you need to type m You see I l i d a.
Ay.
Make sure you add Mattel a date to the end of this because if you just search every sub directory of
this then you will find all this of directories of every single script because they revisit the root
directory as you can see it's got multiple ones.
If we removed all of this on the server and just hadn't until the day as our sub main root directory
then you could just take the IP address for now because it's a sub directory we'll just leave it here.
Hopefully that makes sense.
I suggest until I make them go and have a look at like Web sites how they're made and how they're set
up because that will help you understand what's going on here.
Well it's fairly basic to understand anyway.
So once you type this you can just click enter.
Now you can add a trailing backslash if you want to just click enter and maybe go so it starts scanning
and the way it works is it uses a a basically a wait list to find common directories.
So a common directory would be for Slash admin for the admin page or the admin panel as you can see
this is a typical or common index or hedged email or page in this case then this if you noticed here
there's a directory called installation which we wouldn't have known if we didn't use the script.
Let's have a look what else there is.
So let's just make this a little bit larger.
So there's also header home footer.
There's an icon there's diet classes.
If we scroll down a little bit there's also files.
Now it doesn't show.
It shows both.
So it doesn't just show folders which are sub directories it also shows just plain files which in this
case Page Pate in photo op BHP so we can visit this if we go back to our Web sites and just type BHP
info off BHP click enter as you can see now we've located the p HP in photo BHP so we can see what type
of page page using BHP 5 and there's a configuration file.
So we've basically found the configuration file has some useful information here but we go back to our
terminal there's also register.
Now that was probably a common directory because there will be a link to it on the index page because
when you register a Web site there has to link you to the register page.
Ignore these ones here that say use w hyphen w motor scanning but essentially this is how we can discover
all lists of directories within them.
As you can see here there's motility passwords as well.
So these are sub directories of motility.
So as you can see includes as a folder and within includes this index index top HP an installation within
the sub directory javascript there's the log in notes and Page are found and then within the sub directory
passwords there's all of this information.
So let's visit something else so robot stuff text.
So let's visit robots that text the cancer and there we go.
So they're basically robots as used in Web sites to prevent Google from crawling the specific directories
that gets into more detail which is quite along to explain Bill in a nutshell it basically when you
have a robot taxed up blocks and directories from being indexed by Google.
So when you search for Facebook on Google indexes all the Facebook links and that's why they appear
on Google's search engine the index site of index my Web site.
And I'll have a robot a robot stock text to prevent Google from indexing my admin panel for example.
So when you say to my Web site and Google the admin panel will not show up but that's essentially what
this robot's text does.
So these are passwords directory as you can see here.
So let's just visit the sillier day on and passwords and now we're inside the passwords directory.
So like I said we wouldn't have got this far if we didn't use this script.
So I always look here for the sub directory and then the files that were are in the sub directory will
up here here.
Do not get confused like I said before with Matilda because Matilda is also a soup directory of our
server.
But picture this is like the root directory Matilda a picture is the root directory even though it's
the sub directory of our main server a Web site will only have the Web site files on it anyway so that
will always be the root.
But in this case because we have multiple scripts it's a sub directory.
But this is technically passwords here and JavaScript includes and images are all sub directories of
a sub directory because Matilda is technically a server directory but you get the idea.
Anyway we're inside the passwords sub directory and as you can see there's accounts dot text.
So if we click on accounts the text we've got some accounts so Matilda passwords account stock text
and there's admin admin pass monkey Adrian some pass from zombie films rock the boat.
This doesn't really mean anything to us at the moment because we don't know what we can log in with
this sort of thing we don't know if it's genuine but you get the idea because now we're discovering
sensitive files so you can always just discover these files or type in the sub directory to get more
files appear so if we type in let's type javascript
they'd be ghosts and I would in this javascript sub directory am I've got more j ust files if you notice
these don't appear here.
So these are all files within the root directory of Matilda and these are sub directories.
So that's important to remember
um let's just open a jazz file.
Let's just click on page five secrets windows session storage that sets item authentication token so
we've got some tokens here.
This will all be relevance in the future videos but I think I'll leave it there for now because I have
talked quite a lot.
So this was just a video on how to discover secret or discovering sensitive sub directories and files
within a web site's directory.
So hopefully this helped.
Please leave a comment if you stick with anything I'll be happy to help.
Subscribe for future content and I will see you all in the next video.