Hey everybody and welcome to the next video.
So we talked about Nick toe and scanning web applications in the previous video or in the few previous
videos.
Now what we're going to talk about is we're gonna take this one step further when you found a web application
you may want to look at the web application so actually going visiting the site which will go over in
the browsing video.
However when you're looking at a non
browser based reconnaissance we're not actually using a browser and visiting the site.
So we've ran Nick toe and found maybe a few common directories or we might have found a vulnerable version
for web service or the p p version WordPress version.
Whatever the case might be.
Maybe now we want to know if there's any hidden directories that might have some useful things.
So for example there might be a custom Web application that still has a slash admin directory.
Now we can easily check that ourselves.
But what if it's called.
But what if it's admin or one or anything like that.
I'm not gonna want to go through thousands and thousands of combinations all at a time.
So what we can do with this is used as a tool called Darby right there.
So what this does is this allows you to actually go and check the directories based on a word.
So it goes to listen for each word it goes at it when it goes ahead and makes and makes a connection
and depending on the response of the web server it will either show it or not show it or throw Error.
So what we can do is we can use this to actually go and check.
Let's say I'm going to use a local service or a local web service to go ahead and check this.
So to use this It's Derby.
And then just the url.
So in this case I'll do one and two and six eight to port eight thousand.
That's when I happen to have the web servers running on and a slash.
Now whatever you put after this if you don't want anything just put a slash if you want to search let's
say a director your base directory everything returns to you know the home.
Right.
So like if it redirects to home by default there's nothing you don't believe there's anything in the
original directory structure then you can start with home and it'll put everything all of its test after
slash home.
Just important thing to know now again the port change you just put a semicolon here you go.
Now you need a word list.
So Carly comes with a large amount of worthless which locate in user share.
Word list word list.
Now if we go ahead and look here we can see there's quite a few options here.
Now Rock you is a gigantic word list under Metis but there's even more DNS map is normally for the DNS
map tool but you can use it for other things.
The Wi-Fi sequel map and map.
Then there's dir buster in Derby.
So in this case we're going to use Darby's wordless.
So in here we've got quite a few we've got common indexes small other mutated common Spanish stress
loans is a different photo.
So if you go in her bones we can see that there's even more so specifically what we're looking for like
Apache we can look for specific things but we're getting into the small word.
Let's just for sake of simplicity.
So if we go ahead and run this we can see.
OK so we found three things so far.
It's found a admin with capital a lowercase a.
Some cases this makes a difference if if the web app is custom there might be some security by obscurity
type things going on here where lowercase a is what will actually get you to the admin panel but a uppercase
a won't do anything.
And then we see we have a log in director here which might be something of importance.
So it gives you an idea of what you can do to generate directories that might be interesting to you
to look at as an attacker or red team or in this particular case what I want to do is again you can
use this on your router local at home or on a domain that you own and go ahead and give it a try.
Maybe you'll find directories that you weren't aware that were even present if you're using an older
router you might find some very interesting things.
So go ahead and play around with this use different wordless and even open up some of these wordless
and see what kind of data is actually in them and what it's actually checking because this goes by way
too quickly just as an example I'll run it again like it goes by way too quickly for you to kind of
get an idea of everything that's happening.
So play around with it and if you have any questions go ahead and throw things over the Facebook group.