Instructor: So far, we learned
how to find any subdomains
that exists within our target website
and that have not been listed.
In today's lecture, we're gonna see
how we can find files and directories
that are stored on our target computer
or our target website.
Again, this could be useful
because these files could contain passwords.
They could contain config information,
or they could contain information
about these actual server,
which will help us further exploit our target.
Let me just first show you what I mean
by files and directories, just to show you the structure
of directories on a web server.
So here I have my Metasploitable machine.
And as we know, usually the web server stuff
is stored in var/www.
And if I do an ls, you'll see, or I'll do an ls -la
just so that it's nicer.
You'll see that we have a number of files and directories.
And we can see that we have a directory
there called called mutillidae.
Mutillidae is a web application
that is designed to be hacked,
just like metasploitable,
it is designed so that it has a number of exploits,
so that we can learn how to hack based on it.
So we can see that that's installed
in a directory called mutillidae.
Now, if I go here to my IP address
now, this is the IP address of the metasploitable machine.
So if I do an ifconfig here,
you'll see that it's 10.20.14.204.
So I'm in there, and you can see that
they have an easy access for me for mutillidae,
if I click it, look at the URL here, so it's /mutillidae.
That means I'm inside the mutillidae directory,
so every time you see a forward slash,
that usually means you're inside a directory.
So let's go back here, do an ls,
and if I do cd mutillidae, and I'm gonna do an ls.
And you'll see that I have a large number of files,
a large number of files here.
So let's say for example,
I wanted to open one of these files, and we have index.php.
If I do index.php,
then this is our current file, it's called index.php.
So what we learn from this is,
mutillidae is just a directory inside my web route.
So at the moment in the metasploitable device,
I'm in, let me just write it here for you,
so I'm in var/www mutillidae.
and then the file that I'm accessing is index.php.
Okay, so I hope this is clear now,
so I'm in this directory, in this directory
an I'm accessing a file called index.php.
So if I just do a pwd here,
you'll see that I'm in var/www/mutillidae.
The IP address kinda hides where your WWW route is,
so it hides the var/www,
and then everything after that will be displayed here
after the IP address.
So what we're looking to find today is
all the directories and the files that we cannot see.
So throughout these links, we will be able to access
different types and different pages,
this is the same with any other website.
But there is always files and directories hidden
that you just never see.
So we'll see how we can get URLs for these files,
and access them, and read the information in it.
To do that, we're going to use a tool called dirb,
and to see how to use that tool, we're gonna do, man dirb,
to see all the options associated with that tool.
So you can you see that to use the tool,
you just type in dirb, the URL of your target,
and then you put a word list.
So the way this works is,
it works based on a brute force attack.
And it just uses a word list of names,
and it sends requests with these names,
and anytime it actually finds something,
it tells us that, "Oh, I found a file with this name."
So it will only be able to find names and directories
based on the word list that you provide.
Now, you can create a word list using crunch,
or you can use word lists that come in within dirb.
The options here allow you to configure
how the tool is going to work,
so you can change things around the way you want it.
For example, you can disable the recursiveness of the tool,
so it just runs on one directory
instead of trying a number of directories.
You can get it to ask you
if you wanted to access a directory or not,
instead of it automatically accessing directories,
and trying to find files within these directories
because this could be exhaustive
if your target is a big website,
there might be a lot of directories
and then the tool will be trying to access all of them,
and find files within all of them,
so you can see how big the tree could go.
You can also set it to use a username and a password
if the target websites uses some sort of authentication.
And we can use v for verbose output,
and you can also use o to output the results to a file.
So let me show you a very simple example of it.
I'm just gonna run dirb on our target,
which is 10.20.14.204, and that should be http.
'Cause remember, we're targeting a website,
not an IP address.
Then I'm gonna put the directory
that I wanna find files and directories within.
I don't want it to be accessing anything within other
because we can see here
there is a number of scripts installed on this web server,
so we have this script and we also have phpMyAdmin,
and we have TikiWiki.
So we don't want you to be accessing all of them,
we only want it to be working on mutillidae on this example.
So that's why I'm only using this URL,
and then it's gonna start finding URLs
and files within this particular web application.
So I'm gonna hit Enter, and we're gonna let it to work.
So this is going to use a wordlist file.
And it's using a default small wordlist file
that is stored in here.
So it's a user/share/dirb/wordlists/common.txt,
you can have a look at this directory
and see if there is any other wordlists
that you'd like to use,
and you can use them only by placing the full path
to the wordlist after the command.
So instead of the way I wrote the command,
you'd write it like this, and then you'd state
where your wordlist is, for example,
let's say if it's root,
you'd stated as root/wordlist.txt, or whatever.
But at the moment, it's using the default one,
which is stored in this directory
in user/share/dirb/wordlist, and it's using
the one that's called common.txt.