Everybody worked the next video.
So we're going to be taking a look at a web application scanner called Nick.
Now what I normally do when I'm running an engagement that doesn't necessarily require stealth is when
I come across any web app whether it's something that's custom whether it's on a different weird port.
It doesn't matter what I normally do as I run.
Now Nick tow provides a good base of information for what a Web site has available and normally is able
to check what page P version you're using Wordpress version you're using or what the servers Web site
or web service version is.
In some cases and it will then take a look at the web app see what HDP methods are there is there a
put method which allows you erm sorry not to put a method a yes a put method so which allows you to
upload arbitrary data or files to a Web site which allows you to run p p RSP whatever the Web site is
using and it can also go into searching for example if it searches a web WordPress site it can start
looking for vulnerable WordPress installs and if it finds one it will give you a link to the exploit
for it.
So it's a very powerful tool and it allows you to do a lot of interesting things.
So on Cally it's already been installed.
So if we do Nick know dash dash help we see we've got a few options here.
It's not a giant list by any stretch.
However the first thing we're not really want to do is do the dash host or the desk H and then give
it a Web site.
So we'll do slates like dot com so before we do that.
So if you need to you can change the port as well.
So if this needed to be a specific port you could do dash P for three or four four four four depending
on what though if it's a custom Web service so it's quite clear that we'll go ahead and run this so
we can get an idea of what the outcome is OK so it went ahead and stalled a little bit.
So I went and killed it.
But this is the majority of what you're going to find so we can see here that it is.
It is soon as it's an Apache server and it's powered by HP 5.5 which is which is fine.
And talk to a..
Click jacking headers not presence that gives us the possibility of what we can do.
No cross-eyed scripting protection.
It uses uses SSL and the strict transport security issue here is not the file OK that might be useful.
The root page redirects to this particular page.
That's completely fine.
The banner change from Apache to Apache such to which may indicate a web application firewall load balancer
a proxy which makes sense in this particular case.
It does have a load balancer in front of it so that we've got leaked notes for e tags with files of
slash row about stuff.
So if we went to sites like dash dot com slash robots that is probably have one or two entries in there
which is pretty common robots tends robots that is for web application to not be not have a website
have a search engine crawl in particular you are all inside the Web site.
Uncommon link header found with the contents of WordPress dash or WP dash Jason which gives us an idea
that it's a wordpress site servers using a wildcard cert which that if if if you were able to get the
private key of that that would be a very big problem.
Now the content header is set to deflate which may allow a breach it may be vulnerable to breach.
This is the case for most web sites are going to have this deflate option set now allowed methods is
an interesting one so I said like I said if you if you see a put method here it's always good to double
check and actually if Nick Toh finds a put method it'll go ahead and push up a file to test just to
see if it works and then it'll let you know if it worked or not.
So that's always important thing to know because it will just leave a file that says anecdote test on
the server so it knows where it came from and Webber's web server responds with junk HDP methods which
may cause false positives so you might not be able to trust this specifically.
You might have to test each one that might be relevant.
So again if this was if I wanted to search more what you could do is you could do it see I've noticed
that this is a wordpress site for example WP scan is a wordpress scanner so we could run a wordpress
scan on that if we really wanted to and that would give us a better idea of maybe how we can attack
the site.
Maybe there's a current exploit available maybe the version of WordPress has not been updated and there
is a known issue for remote code execution.
There's a lot of possibilities that you could run into and this again this gives you that just that
little bit more of information because the important part about reconnaissance enumeration information
gathering whatever phase you want to call it is the fact that you want to gather as much information
as possible because that makes looking for an attack vector much much easier when you have more information
rather than when you have less.
So what I want you to do is you can do this on the router that you have at home so don't run this on
a external Web site that you don't own.
I happen to own that domain.
So I went ahead and ran it against my domain.
However feel free to run this on your local machine or your local router if you have a web server and
just see what the results are the results might surprise you on your own router or if you own your own
Web site.
Feel free to do it there as long as you have permission of the owner which you would be in that particular
case.
So again go ahead play around with it check a few of the options and maybe if you see if you have a
wordpress site go ahead and try WP scan on it as well just to kind of get a better idea of what you
can and can't do when you start going down the rabbit hole of enumeration.