OK, it's time we start our website enumeration, and the very first thing that we should do is to take
a look at the website through our browser.
So we want to see what pages it has, what does it open when we visit its IP address?
This is very basic stuff that we want to check first.
So to do that, we can go to our Firefox.
And make sure that you have your own SPW, a machine started, and once you have it started, then we
can visit the IP address of Paul Wesp B.W. A.
In my case, that is one to the 168 that wanted for we already showed how we can check out the IP address
of this virtual machine.
So once you do that, typing the IP address in your Firefox and it should visit this page.
So this is the first thing that we take a look at.
We already noticed that we have bunching links right here, so this page has a bunch of other pages
that could be hosting different services, that could be offering different things, and it could potentially
have multiple login forms or something similar.
So, for example, let's pick any one of these.
Let's go to this one under the realistic, intentionally vulnerable applications, if we click on it
and let me just enlarge this a little bit so you can see everything better.
Well, who is it, some type of an application, some type of page that our always has and the first
thing that catches my eye is something like this.
We have a search button and we also have a login button.
What does this mean?
Well, it means that this could potentially lead us to some type of a brute force attack where we would
try to gain access to a certain account on this page.
Perhaps they have weak passwords and we can log in if we brute force the account.
You never really know.
We can also create an account.
So this page is already looking interesting to us.
We also have some type of a file that we can send currently no file is selected, but we can see right
here that we have some input as well, and then we have a button to send files.
All of these things we would want to play around and see what we can do with them.
Let's take a look at another page as well.
So if we go back and let's, for example, go to this one, we straightaway get a log in the form.
So this also tells us that there could be a potential brute force attack or weak credentials attack
here as well, since it does offer us a username and password field.
Let's go back.
Since we don't really know any username and password here, we don't really know what this says.
It could be some administrator page.
It basically could be anything whatsoever.
We can also do something like this, for example, go back and let's say we want to try to find some
secret administrator page, try something like padman, and in this case, we don't really get anything.
It says slash admin is not found, but it was worth to try it out.
Now, let's check this out on a real website.
Since this is specifically made vulnerable, so will we know that we will find vulnerabilities in all
of us.
But let's go.
And for example, search for Tesla dot com.
So this is an official website, it is registered and if we visited.
So we get some prompt right here that asks us to select our region, let's just click X right here.
And what we would usually be looking for is, once again, we would try to find some type of a login
form or some type of a search field or any part of Web application where we can interact with.
So we already see right here something like a Tesla account.
And it does ask us to log in, so we do have some type of a log in.
For now, logging firms are not the only thing that we are looking for.
But for now, it's the first thing that catches our eye.
Now, for real websites, we can also perform some advanced search using Google.
This is also called Google Talking.
It's using Google advanced search techniques to discover information that we might find useful.
For example, let's go to Google.
And let's go with Tesla first, so let's type in site.
And then two dots, Tesla dot com and let's say we want to find all the PDA files from this website
right here.
We would type site to dot Tesla dot com and then file type two dot PDF.
If I press enter.
It will give us all the results of -- that this page has, and we can see that these indeed
are --.
It says right here, as we can see, and perhaps we could find something useful in these --.
You never know.
Maybe there is some -- that has information, disclosure, and perhaps it gives us some information
that we find useful.
We can also try to find some emails from this website.
How do we do that?
Well, we can do something like this.
We could open double quotes at Tesla dot com, and then we could dash site and then to dot Tesla dot
com press enter.
And let's see.
Right now, we do not manage to find something interesting for Tesla.
And here is one email we did manage to find, but that's just one email.
It still could be useful for us, but we're looking for a little bit more so we can instead try to go
with some university websites since they usually have a bunch of e-mails.
Let's go with this one.
I'm going to use a university from my country and it's located at this website.
And we are going to use the same command.
So at and then the addition to the email and then the site, which is the same link or same domain I
would press enter right now.
And here is one email address that could also be useful.
Now we can also visit these links and try to find even more, but let's just see what we can gather
from here.
Here's another email address and here appears to be a start of a phone number.
So we also get that here's another email address right here.
And that would pretty much be it from the first page.
Now we can, as I said, visit these links and then we can find even more email addresses, hopefully.
And here's another one that we missed from the first link.
OK, now we try to go to admin before on our own ASPE.
We end by adding slash admin in front of the link or in front of the IP address.
But for regular websites, there is something even better that we can try using Google.
We can use Google Docs to try and find something like admin pages, but we can do that by searching
admin keyword inside the title of the page or inside the URL.
To do that, we simply type in title.
Two dots admin or in you are two dots as well, admin, and then we specify which site and let's use
this same website, this university Web site.
So this is the command and let's press enter.
Ten, we get some responses right here if you go to any one of them.
Secure connection felt.
And the error that it gives us is SSL error, unsupported version.
This website might not support the one point two protocol, which is the minimum version supported by
Firefox, enabling one ninety one point one might allow this connection to succeed.
So let's give it a try if we enable it and we do manage to succeed.
And you can see that this link has addition to it that has admin keyboard, and that is why we managed
to find it.
We also have a couple of input fields right here.
So here we enter email address and password and here we also enter our email address.
And this is just one of the pages.
Maybe there are multiple pages that have admin keyword inside of it and that could be useful for us.
So for now, this seems to be some type of an admin forum.
And if we do also get some email address right here, I do believe this is an email address.
There is not much info about it.
But nonetheless, we did get here successfully.
These are usually the things that you do.
First, to start off with website numeration, we just gather some information about it.
We perhaps try to find some additional pages, such as this admin page.
The most important thing is that we must start somewhere.
There is not a strict rule that says how you can perform your Web site penetration testing and in which
order you do all of these things.
That's why we are going to check out most common techniques and it will be up to you to apply them as
you like.
As far as this lecture, which was on Google talking and just inspecting website in general, you can
take a look at some additional advanced Google comments that are useful for us hackers so we can find
them by, let's say, pipelined Google Docs.
And let's go with the first link, which is exploit dash DB dot com.
Let's visit that.
And once it opens this page, we will get a saying here that this Google hacking database and down here
we have a bunch of Google Docs or Google commands that we can use to extract some useful information
from a certain website.
For example, it gives us the command right here under the category.
It says, what does it search for?
So in this case, it searches for files containing passwords.
And the author name right here.
And you have a bunch of these commands.
As we can see, these are only first 15 commands out of six thousand.
So you can take a look at here, perhaps find some useful commands that you might apply to your penetration
tests and you might use them later on.
However, you will always have this database right here at this link so you can visit it any time that
you like.
OK, awesome.
So we took a look at Google talking or executing some advanced Google search comments.
We also took a look at our website.
We browsed a few pages here and there just to see what the website has.
Now, in the next video, we're going to check out how we can use multiple ways to discover some more
information about our websites, such as IP addresses, such as domain names such as its physical address,
perhaps some additional emails or phone numbers and all of that.
So thank you for watching and I'll see you in the next video.