Instructor: Welcome back.
And in this video I want to talk
about another thing that we already covered.
And that is enumeration and information gathering.
So this is a step that you also shouldn't skip
once attacking websites.
We already covered information gathering,
so this video is more like something as a refresher
just so you know which tools you can use to enumerate
and to scan different websites.
So for this section,
we're going to be using metasploitable most of the time.
We're going to attack some different targets,
but for the start we are attacking metasploitable.
So make sure that metasploitable is up and running.
I also ran the "ifconfig" command
and it gave me the IP address of "192.168.1.8".
So the first thing that we can do is try to
visit the webpage of that IP address,
just to see what we have.
And to do that we can open our Firefox.
And remember that once we attack metasploitable,
we said that we are going to attack
port 80 later in the course.
Now it came that time.
We are going to attack port 80
and once again, we are attacking port 80
because it holds a web page.
If I visit this IP address of my metasploitable,
it will open this page right here.
It tells us the warning, the contact
and the login to get started.
But down here we get a couple of links.
If we go to any one of them,
it will lead us to a different directory of this webpage.
Currently, we are in the "/dav" directory.
If I go to the parent directory
it will go back to the 192.168.1.8,
which is the main or the parent directory.
If I go and visit "DVWA",
it will lead me to this directory right here
which is "/DVWA/login.php".
And this file hosts a login form.
So we got "Username" and "Password" to input.
If we take a look at this webpage a little more literally,
we can see down here that it tells us,
"default username is 'admin' with password 'password'."
So for now, we're not going to brute force this.
We're just going to log in,
so we can see what we have behind this login form.
And here it is, we got "DVWA"
or as we can see right here, it has this name.
We get a warning, a disclaimer,
and here we get a bunch of different attacks
that we can perform.
Remember we talked about "XSS",
we talked about "SQL injection".
We also mentioned "Brute force" and "Command" injection.
And these pages are pages,
where we can practice these type of the attacks.
All of them are stored in a separate directory.
Now we can go about discovering
all the directories on a website like this,
or we can use different tools to automate this process.
So to enumerate and together as much information
that you can about the website,
you can use the tools that we already cover
such as the harvester to gather emails
such as what web to discover the website technologies
and all of them we already covered.
We're not going to do that once again.
But there is another cool tool that you can use to
discover directories and that tool is called dirb.
Dirb is already installed in Kali Linux by default.
So one thing we need to do is to type dirb
and we will get the help menu for this specific tool.
We get bunch of options as we can see right here,
but also down here we get the examples
of usage of this tool.
So the most simple test
as it says in the brackets,
would be just specifying dirb
and then the link to the web page that we want to scan.
If I go up here,
we can also see that we can specify different "wordlist",
but I believe dirb has a default wordlist that it uses.
So we are just going to go with that one instead.
So if I type "dirb"
and then "192.168.1.8".
Whoops, "Invalid URL."
So we must specify "dirb",
and then "http://192.168.1.8".
So this is how we must specify a link.
If I press enter, it will go
and search for different sub directories
inside of that webpage.
If I scroll a little bit up,
we can also see it managed to find
some of them it found:
"/index",
"/index.php",
"/phpinfo",
"/phpinfo.php".
We got: "/test",
"/twiki".
And if I go all the way down, we should be able to
find even more sub directories on that webpage.
And right here we might be able
to find something interesting.
For example, we can go and visit any one of them.
Let's visit "robots.txt".
If I copy the link, go up here, paste the link.
Hmm, we get something right here,
"User-agent,"
"Disallow," we already know what user agent is.
It is a field inside of the http requests.
Let's also see what else we managed to discover.
We got: "/test", "/themes", "readme", "phpmyadmin".
That could be useful.
Let us check out what this is.
You never know.
Anything that you find particularly useful,
or interesting you might want to check out
by visiting that page.
And this seems to be some file with the PHP code.
So let's go and check out something else.
And it seems that there is a directory called "passwd".
Let's see what this is.
If I copy that as well, go and paste it.
"Missing Fields," "Fields with a ** mark are required,"
"Please go back in your browser and try again,"
"Topic WebHome."
So it seems that this page is missing some fields.
Right now we don't really know what this is all about,
but by visiting this we discover more
and more pages that
we might not be able to find once browsing
through that page on our own.
Now right here,
we can also notice some other information that we get
on the side besides these links.
And that is the code.
And if you remember, this code is simply just a status code
which tells us whether it managed to load the page.
Right now we get "CODE:200" for most of these pages.
Sometimes we will get code like 304,
which means that
the page gets redirected to a different page.
And at the right we also get the size of that specific page,
which is not something that we are currently interested in.
But, you also get that information if you want to see it.
We can see other links as well.
And you would go about visiting any link right here,
that you find interesting.
So let us go down.
And it seems that it found 56 links,
but that is only with this specific wordlist.
It also downloads, I believe it downloads the contents,
but I'm not really sure about that.
However, what you can do is if you're not satisfied
with the results from this dirb directory,
you can specify your own wordlist if you want.
Nonetheless, this is not that of an important tool for us.
However, you can use it if you'd like
and you can combine it with different tools that we covered
for the information gathering to gather as much information
about the specific website.
Now, since we already covered information gathering,
I'm not going to go into those different tools.
You can also try finding new tools
from the GitHub or somewhere else
and you can experiment with those tools as well.
But right now what we are going to do
in the next video is we are going to configure
a really important tool that is called Burp Suite.
And as soon as we do that,
we are ready to perform our first attack.