Website enumeration, what is it and why do we do it and also why is this something that we should do
before attacking the website?
Well, it's quite simple.
We want to learn as much as we can about our target before we perform any type of the attack.
We want to know what we are dealing with and what is the structure behind the website that might look
simple on first glance.
Does it have forms that we can attack, where is it located, what is the website used for?
Basically any information about the website could be useful for us.
Imagine it like this, we as penetration testers have been given the task to test for vulnerabilities
on some website and usually for us to be able to discover anyone more abilities on the website or any
bugs, we must directly interact with it.
Which simply just means we must open it up and experiment with different things that the website has,
usually first thing that we want to do is discover the IP address of the website or domain.
We can do that by using tools like A. Lookup or host, which we will take a look at later.
But this is very simple to do.
We just throw the domain name inside a tool and it will give us its IP address.
Keep in mind that some bigger websites could have multiple IP addresses due to them being located and
hosted on multiple servers, for example, Facebook being a big website, has ranges of IP addresses
with an IP address.
What we can do is we can, for example, locate the website physical location.
We can throw that IP address in a scanner and discover some technical information about the server hosting
that website, such as, for example, discovering open ports and services running on those open ports.
And after we do that, we can, for example, look at the website structure.
What is it made of?
Does it have JavaScript?
Does it have some third applications that it's running?
That could potentially be vulnerable?
All of that we want to know.
We also want to know if perhaps the website has some login pages.
Does it have a registration form where users sign up?
Maybe we can try and find an administrator login page somewhere which shouldn't be accessible to regular
users like us.
Does it maybe have any other input fields outside of the registration forms?
Why are we looking for user input fields where our website allows us to input something or to type something
in?
That is the place where we want to interact with it and perhaps make it run something that it shouldn't
be running.
An example of user input field would be, let's say, a website that has movies on it, and you have
the search field where you type in a movie name, and that search field is user input field.
And we would definitely be interested in checking it out and to see what we can do something else besides
searching for a movie.
We also want to figure out where is that website hosted on what type of server, what operating system
is that machine running that's hosting the website?
Does the server have some other ports open besides the ports that are used to host the website?
Another possible thing that the website does, especially if it has some registration form or login
form, is that it interacts with the database.
It probably has a database that's storing all the user's information, such as usernames, passwords,
emails, phone numbers and so on, so maybe we can get that database to respond to us with the information
that it shouldn't give us, such as, for example, other users passwords.
You never know all of these things is something that we want to check.
We also want to see if the website has good encryption, maybe it has a weak encryption or no encryption
at all.
And someone with an attack like man in the middle could capture in plain text passwords that are going
through that website.
OK, I just gave you some examples as to why we want to learn as much as we can about our Target website
now to do this, we can use different tools.
Some of the tools that we use are and map NICTA Derb.
We will also be visiting websites regularly over our browser and we will also cover possibly the most
important tool for bug bounty hunters, which is.
Anyway, let's not get lost in too much information straight away and let's start off with our website,
numeration one task at a time.
See you in the next video.