Now the next few videos have to deal with web apps as well.
But instead of looking at subdomains we're going to look at what a Web site is built with.
And that's a good indicator here of built with.
So let's go out to Google and we're going to do a search built with.
And we're going to go right to built with dot com and let's take a look at what this does.
So let's just search Tesla dot com for example.
We'll do a look up and I'm going to make this a little bit bigger so you can read it.
And what this does is this goes out and it looks at what type of tech Tesla is running.
Now it gives all this stuff that it can see Google Analytics Salesforce that's great.
But it also tells us the widgets that are running.
You can see it is part of bug crowd log me in Twitter OK.
It's got these language things here.
But what we're really after is what kind of frameworks you might be running on.
So it says here that it's running on HP it has Adobe enterprise cloud.
That's interesting.
It's got CDMA and the content delivery network.
Interesting utilizes stripe.
OK.
We can scroll through this.
Looks like it might be written in Andrew Paul.
That's an indicator there.
And this is a big Web site.
So it's got a lot.
Look at all the information here.
And it might be a lot to track down.
So with this with a big Web site like this there's a better way.
I think now built with a great great resource but I think there's some other stuff out there that might
help us a little bit better.
So let's go out to Google as well and let's search for a tool called flap a liar just like this and
we're going to use it for Firefox.
So it should pull this up here and we'll click on the first one and go ahead and just select add to
Firefox select ad and now it will appear.
So now we have appetizer.
Let's go back to Tesla and you see this little guy here in the corner.
We're gonna click on this.
We're gonna accept it and now we get a little bit of information as to what's going on.
Not as much information as built with but I actually like apples are a lot more because it kind of just
gives you an indication right away with what's going on.
Now appetizer is more of an active type of reconnaissance.
I only say that and I don't necessarily believe it but it's because we do have to interact with the
Web site.
Now we're not doing any type of scanning we're just going after the Web site like a normal user would.
And to me it's still kind of passive because we're not doing anything that would be out of the norm.
So here we can see the content management system is running on true Paul.
We can see the programming language is running HP.
Those are both identified with built with as well.
Now why is this important to you're telling me.
Well it's important because if we know that's running with PDP or Jew Paul there might be a vulnerability
within those a lot of times when we have this let's see if we go to this Web site you can see HP is
running we get a lot of things and we get Virgin numbers so look at the way apples Web site.
You see that it's running on an operating system.
Bun 2 it's got a programming language.
Page P the web servers engine X with one point one for dad zero version no.
Okay.
I can tell that is running on Amazon Web Services as a platform.
It's got all kinds of information here it's got the payment processing.
It's running Google Analytics so see the type of information that can come through a lot of times you
see things like J.
Query and other type of libraries here.
And the version numbers as well.
Now you take those Virgin numbers and you do enumeration on them and you try to find any type of vulnerabilities
that might happen there.
And the more information that we can gather on a client on a Web site whatever it is the better off
we are.
So when we're gathering information on Tesla OK now we know the content management systems written Interpol
the programming language page.
Is that going to lead to an exploit.
Maybe but you don't know where it's going to come up in the future.
So this type of information gathering is great.
Now one more thing that we can use we've got something built into our machine let's go out to the terminal
and we can take a look at it.
So we've got a tool called what web just like this and hit enter on it.
And if we look at the syntax all we need is to specify a target.
So we enter the URL hostname IP address or in that format.
So we just say what web you are L so let's give it a go.
We'll say what web.
And we'll just say h CPS Tesla dot com
and it is a redirect.
So it might not pull down everything for us here.
So it did pull down an IP address it gave us a redirect.
I don't know if there is a follow redirection up option here but what we'll do is we will just say something
instead we'll say like Tesla dot com instead of four 4 three and see if that does anything different
and it didn't.
So it does give us some information in here.
It's not as pretty of a layout but it is a tool that is built in to Cali Linux for us.
So look we can pull down Drupal 8.
We didn't know what kind of Drupal was running on.
Now he knows Drupal 8.
We see that it's running HP seven point three point seven.
That's ID two that we didn't have previously.
So using more tools to our advantage gives us more information and we can pull down the headers that
it has here and you see they have different types of headers which we're not going to get into this
quite yet.
When we get into the web that portion of this we'll talk more about headers but this is just yet a another
thing that we need to look at and we pull down IP address as well.
So a little bit more information that we can gather here and just keep going from this.
So that is it utilized the resources around you to gather information we could utilize resources that
go out and scan a specific web page like this.
We can go and utilize a resource such as we appetizer that you just visit the Web page and you can see
what's running on there or a Web site like built with dot com where we just don't even navigate to a
Web site.
We just type it in and it does all the work for us and we can pull down all this information which is
by far the most information out of these three tools.
So utilize all the resources available to you and you will have much advantages when it comes to pen
testing and your enumeration skills.
So that's it for this video.
I'll catch you over in the next one.