-: Welcome back.
Let us code our second project for
the web application penetration testing section.
So, in the previous video we took a look at how
we can create a simple brute forcer that will be able to
brute force both of our DVWA login pages.
We made the post request, we also made the get request,
and we also changed fields accordingly
to each one of those pages.
Now, as I already mentioned, that program,
you will need to adjust for every page that you brute force.
However, this program that we're going to create right now,
which is the directory brute forcer,
you won't need to adjust for different pages.
It will work for for every page.
And what a directory brute force is is,
as we already mentioned,
it will discover some hidden directories
that could possibly be useful to us
once performing web application enumeration.
So this is something similar as a dirb tool
that we covered in web app penetration testing section.
So let's get straight into it.
I'm going to open the terminal
and I'm going to navigate to our
desktop and tools directory.
Here we got our web app penetration testing directory,
and right here, inside of this, we got our previous project.
Let us now nano a program that we can call directories.py.
As the previous program,
this one is also going to import the requests library.
And before we start coding it,
let's first think how our program is going to look like.
So we're going to ask the user of the program
to specify the target URL or the target thing.
Then we will open a file that has common directory names.
We will read from that file, and for each directory name,
we are going to perform our request for that page.
If we receive our response
or if we manage to load that page,
that means that directory exists on that page.
If we get something like a connection error,
that means that page doesn't exist.
So this program is really simple.
Let's start coding it.
And first thing, as we said, is going to be the target URL.
This is going to be equal to the input value, as usual.
And here we can specify something like this
and then enter target URL.
What we also want to ask from the user is the file name.
So file_name is going to be equal to
input enter name of the file containing directories.
(typing)
Okay, so these are the only two things that we need.
After we get them, we can open our file like this.
So file equals open, and then the first parameter
is going to be the file, name which they specify.
And the second parameter is going to be
opening file for reading.
And this is something we already covered so,
you should be pretty familiar with how we open files.
As soon as we open file,
we can start reading different directory names
and requesting those pages.
So for line in our file,
for each and every directory in our file,
we're going to first strip that line
from any additional characters
and we are going to store that inside of
the directory variable.
So directory will be equal line.strip.
After that we can create a full URL variable,
and the full URL variable will be equal to target URL
plus and then slash and then plus our directory.
So what we are essentially doing right here is,
let's say the target inputs a website thing
CORA domain name of google.com.
Let's say they input that
and from our file we read the admin directory.
Essentially what we are doing,
right here in this line,
is we are combining these two like this.
So this is how we search a directory on a certain domain.
We simply just add a slash and type the directory name.
Now that we got the full URL variable,
we can perform the same thing from the previous video,
response will be equal to request from full URL.
And this request function we don't have.
It is not request.get or request.post.
It is just a request function
that we are going to code right now.
So, go up here and type define request.
This request of course takes the parameter of URL,
and what this function should do,
is it should try to connect to that page
that we're looking for, and if it doesn't manage to connect,
we're just going to pass.
So how can we do this?
Well, we can type try and then we can try to
return from this function requests.get.
And the reason why we are returning
is because we are going to store the response
inside of this response variable.
So we're essentially returning requests.get.
And then let's add http:// and plus our URL.
So it is going to essentially try to visit our URL.
We're just adding it the prefix of http two dot slash slash.
So like this, everything should work.
If we manage to visit that page,
we're going to return the value.
And if we don't manage to visit that page,
in case of requests.exceptions.ConnectionError,
(typing)
We're just going to pass.
And let's not forget to add two dots
at the end of the except statement.
So in this case, we didn't manage to connect,
therefore we are just passing.
And the return value inside this response will be nothing.
Since we're not returning anything.
So how can we then check which one managed to connect
and which one didn't manage to connect?
Well, we can just type the if response statement.
And what is if response means is,
if there is something in response,
then do the following statement.
If there is nothing in response, then it won't do anything.
So in this case, if we have something in response,
that means the try statement worked
and we manage to connect to that page.
So we are just going to print
discovered directory at this path
and we're going to print the full URL.
Simple as that.
And this is our entire program.
Let's go through it once again real fast.
So we import the request library.
We ask the user of this program for the target URL.
We also ask for the file name.
Then we open that file and we read each and every line
inside of that file.
We strip it from any additional characters
and store it inside of the directory variable.
Then we create a full URL variable that will be
the combination of target URL slash and the directory name.
Then we request that full URL.
And if we manage to connect to,
we will return this value inside of the response variable.
If we don't manage to connect,
this response variable will stay empty.
And then at the end,
we're just checking if there is something in response,
print that we discover the directory at this path.
If there is nothing inside of the response,
it will not print anything.
So let's test our program out.
I will save this and all we need to do is
Python3 directories.py.
We entered the target URL.
So let's just go and see what is the IP address
of our metasploitable,
and in my case 192.168.1.2.
And the name of file containing directories.
So we need this file,
and luckily inside of our Kali Linux,
if I open a second terminal and I type locate dirb or dirb,
however you wanna pronounce it,
we go to the user share and then dirb directory, type ls,
we will have this word lists directory right here.
If we change to data directory, so cd word lists,
and type ls, we will have a bunch of these txt files.
And inside of this common.txt file
are common names for different directories.
So what we can do is we can copy this common.txt file
inside of our home, Mr Hacker, then desktop, and then tools,
and then web app penetration testing directory.
Once I go to that directory,
and type ls, we should have our common.txt
inside of the same directory as our directories.py file.
So now if I go right here and specify common.txt,
press enter,
this will go and search for every directory.
And we can already see that it is discovering some of them.
We got this slash directory, this slash dev,
slash index, slash php, slash php by admin.
And those are all the directories that it manages to find
in the main directory of the metasploitable machine.
Now you can also specify sub directories, if you want.
For example, if I run the program again and type
192.168.1.2/dvwa,
and I type the same file name, which is common.txt,
now it will search for the directories
inside of this slash dvwa.
And we can see it is finding different directories
than it found right here.
And what you would basically do,
once performing this type of enumeration,
is you would try to find something interesting.
You would go from each and every sub directory
and try to figure out if there is any interesting directory
onto that page that maybe shouldn't be there.
For example, if I run our program
and I type the IP address /mutillidae,
which is the name of one of the directories
on our metasploitable,
I press enter and I also use the common.txt file,
it will find bunch of the directories,
but there is a directory that particularly stands out,
which is this passwords directory.
So we can visit that link,
which is 192.168.1.2, and then mutillidae/passwords.
And it'll lead us to this directory,
which has this accounts.txt file.
If I click on it,
well it seems like we found some file
that contains usernames and passwords.
We got admin, the password is probably adminpass.
And this could be something like a security question
and the answer to the security question.
So this would be a vulnerability of information disclosure
where it gave us some information
that we shouldn't have the access to.
And we would never know that this passwords directory exists
if we didn't run our directories program
which discovered it and then visited it
and found out that their accounts usernames
and passwords available for us to read.
Okay, great.
So we have finished two projects successfully.
We coded the login brute forcer
and the directory brute forcer.
So we are officially done with web app penetration testing.
And in the next section,
we are ready to touch on a subject of
man in the middle attack.
It is a really interesting attack
that we can perform inside of a network
and in the next section we are going to see
exactly how we can perform it.
See you there.