‫In this section, we're going to learn about the app as much as we can.
‫While discovering the app, we analyzed the configurations of the mechanisms used, we collect everything
‫we find and try to use them to hack the app.
‫The first step of information gathering is to surf the app as long as we can visit each page, try to
‫click on all the links you see all that.
‫We can gather a lot of information about the app and the server while analyzing http headers of the
‫requests and responses engaged between the server and the browser.
‫In addition, we can find some clues, especially for the data manipulation section, while analyzing
‫responses which are sent for our targeted requests.
‫Also, we should look for the open ports of the server.
‫For example, there might be a content management system hosted by another port of the server where
‫we can get the management of the entire app after serving the whole app and learning its purpose and
‫mechanisms.
‫First, we should intercept the connection between the browser and the server and analyze the headers
‫of the requests and responses.
‫We can find some information about the server, the technology used, etc..
‫In addition, we can find some clues for the flaws of the app, for example, the cookie in the slide.
‫Contains an attribute value pair, which is security equals high.
‫What if I just replace high with low or none?
‫Look at the header.
‫If there is any header specific to this app, if there is no debt header, because that's the one you're
‫going to tamper with.
‫So far, we've gathered as much information as we can.
‫Now is the time to look for the known vulnerabilities of the server or the technologies that are used
‫frameworks, plugins, software, languages, et cetera.
‫You can use the vulnerability databases and exploit databases to find the known vulnerabilities.
‫One of the most famous databases is exploit database.
‫The URL address to visit exploit databases.
‫HTTPS Collins Exactly.
‫WW dot exploit.
‫Dash.
‫DB ICOM Exploit Dash DB is the exploit database archive of offensive security who are the producers
‫of Kali Linux distribution.
‫So suppose that we realize the server is Apache2 2.0 4.3, visit a vulnerability database and search
‫if there are known weaknesses of that version of server.
‫Crawling or spidering is traveling through the website and collecting data about it.
‫We can pull data from the application like email addresses, sensitive data backup or forgotten pages,
‫etc. Now, because we have to send a lot of HTTP request, automated tools and scripts that are called
‫crawlers or spiders are used to crawl a website.
‫All the automated tools have their own crawlers Burp Suite that we use as its own spider, too.
‫You may encounter interesting situations during crawling.
‫For example, software developers create a copy of the file in the same directory for backup, or they
‫may have a test version of the file, which contains a valid credential in it.
‫In some cases, they just turn the line, which contains credential values into a comment line.
‫But those comment lines are visible at the client side.
‫That means when you look at the page source in the browser, you see the comment line, which contains
‫a valid credential.
‫You can find an administrative interface that does not have a link through the website.
‫And having no link to the interface does not mean that it's unreachable.
‫So here's a demo.
‫Let's see the spider tool of Burp Suite in action.
‫Run Burp Suite, turn the intercept off, we just want to have some links under the FTP History tab.
‫Go to the browser, configure the proxy settings to use Burp Proxy.
‫Visit the website you want to crawl.
‫And this example?
‫Use NHS Dot UK now go to HTTP History tab under proxy tab.
‫Select the Route request.
‫Right Click and select Spider from here.
‫You can answer yes if you're faced with a question.
‫And when you select the option, the font color of the Spider tab turns orange.
‫That means there are changes in the tab since your last visit.
‫Go to the Spider tab since you see some statistical information, request made, request queued, forms
‫queued, etc. When you go to Site Map tab under the Target tab, you will see the current results,
‫files and folders of the application.