Review technology and architecture information, as we talked about previously, the technology stack
behind an application can vary widely.
So that means is in the real world, it's very common to see complex applications everywhere you turn,
different technologies, different vendors, different versions and so on and so forth.
So naturally, these technologies can have vulnerabilities were configuration, well, shall we say
shortcomings.
So in order to discover these vulnerabilities, extracting that technology information is a one priority.
It's absolutely critical for your career as a pen tester.
So that's why we need to detect the type in the version of the server software and the application framework
or application platform.
This information will help you to shape the payloads that you're going to use and deploy, and it will
also bring you the awareness that you need to have about known vulnerabilities if the framework has
any as well, because that's part of your research.
So I think that you detected Jake query library or an old server version, which has some insecure functions
or vulnerabilities.
Yes, what a coincidence, because it just happens to be perfect in order to compromise the application
we're about to do.
So first, open up your terminal in Carly.
And we are going to use what web to get some information, so see the options for the tool and then
before using the tool, I want to just tell you a few more things so it's not hard to detect the server
and the framework information.
You can get this information from the HTTP headers are cookies, error messages, whatever.
So the first place to look is the HTTP response headers.
So type what web.
That's A3 http colon's one nine two dot one six eight two zero four zero one three zero be web slash.
So perimeter aid determines the aggression level of the tool.
And then the target, your URL comes up and what Web will analyze some http headers for you?
It has a very colorful output.
And the tool also follows the redirections, so that's a very good feature.
And here you can see the server header for the server software information.
And the application framework and platform information from the X powered by header.
Now, there may be some other HTP headers specific to some particular technology.
So you always need to look out for the headers.
OK, so now we're going to just minimize it terminal.
Now, you can also view headers manually in berp, so open up your browser and burp.
And enable Foxy proxy to send traffic to.
Now request a login page of B Web.
I'm going to forward the request.
And here are the headers server and it's powered by headers.
So easy is very easy.
However, these headers are configurable.
That means the administrator can easily change these entries from the configuration of the server and
application or even some security products can do this.
That's why you need to dig into the application and the environment to gain more clues about the server
framework and the platform.
So let's say, for example, a different Web server software can have different http header orders.
And then these servers can behave in a different way if you send some malformed requests.
Also, you can look at HTTP headers, cookies, e-mail sources, file types and extensions, and the
error messages are a great way to detect things as well.