Welcome back.
In this video, we will cover a tool called What?
And as I mentioned in the previous lecture, we use what web to determine which technologies does our
website have?
So it's still information gathering, but from a technical aspect and what Web is told that we already
have preinstalled in colonics and we can run it with the help of a terminal.
So let's do it straight away as usual.
Make sure that you're always purtle machine is running and all we need to do to run the what web tool
is to type Blood-Red and then the IP address of the target that we want to scan.
In my case, this is one I to that 168, that one that for which is the IP address of my old Wesp virtual
machine.
If I press enter.
Since this machine is in my local network, it'll take just a few seconds for this command to finish
and we do get some information here.
As we can see, this is the link that what Web tool try to visit it got two hundred OC code, which
means it's successfully loaded the page.
It discovered the Apache version, which is two point two point fourteen.
If we go right here, we got country, we got email addresses, so it does manage to even get some email
addresses out of this page.
The HTP server appears to be running Ubuntu Linux, we get the Apache version once again and we get
the IP address, the Querrey version, the open SSL version, the P version and some other versions
as well.
As we can see, the target machine is running Python two point six point five.
So this allows us to discover technologies behind a certain website.
And what could be our next step is to take perhaps Apache version, Google this version and see whether
it has any known vulnerabilities that exist.
Now, this is just a regular comment.
With what?
With what we can do to discover what else we can do with whatever we can run this command, which is
what web that help.
Once you type it in, it will give you all of the possible things that you can do with this tool.
So we have a bunch of other options that we can use, such as input file your A prefix.
We got the aggression mode.
So the aggression level controls the tradeoff between speed and stealth and reliability.
There are three aggression modes, the stealthy, aggressive and heavy.
Now, you can go through this menu if you'd like, this is just a short help menu of the tool, but
if you want to know even more about the tool, you can use a command called command, which is shorthand
for manual if you type men and then the tool name.
It will open the manual for what it and under the description, we can see what Web identifies websites.
Its goal is to answer the question, what is that website?
What Web recognizes web technologies, including content management systems, blogging platforms, statistical
holistic packages, JavaScript libraries and many other things in the second paragraph.
We also got some explanation on the aggression level or on the aggression option that we saw from the
help menu.
So as it says, what can be stealthy and fast or thorough but slow?
What Web supports and aggression level to control the trade off between speed and reliability when you
visit the website in your browser?
The transaction includes hints on what web technologies are powering that website.
And that's exactly what what web does.
It enumerates those technologies and it outputs them back to us sometimes.
A single Web page visit contains enough information to identify a website, but when it does not, what
Web can interrogate the website further?
And that is where the other aggression levels come.
The default level of aggression called passive, is the fastest and requires only one HTP request our
website.
This is suitable for scanning public websites.
Now this part right here is important.
We can use the default aggression level to scan public websites if we'd like.
But if we want to use more aggressive levels, as it says right here, more aggressive modes were developed
for in penetration tests.
So you should not use the aggressive modes on a website that you do not have permission to scan.
OK, awesome.
So let's take a look at what else can we run with.
So let's go back to the Help menu.
And we do get some examples of use it right here, but what we want to do, as it says the most at the
moment, is let's try to use aggression.
Level three, for example, since we used one before, which was default, let's increase it a little
bit and let's move the aggression level to three.
Then we can also type Dash V, which stands for Verbose, which means it will output even more things.
And at the end, let's add the IP address.
Oops, we misspelled aggression, so let's add another S and let's let it to run.
OK, the output came once again relatively fast because the parties in my local network, so let's see
what else do we have straightaway?
We notice much more output.
Then once we ran the comment previously and we got it ordered by detected plugins so we can see the
detected plugins, we got the Patriot first.
Then comes the description of Apache.
We got the version right here and we got the website of Apache as well.
So we do get some more information about each of the discovered plugins.
Up here, we get pretty much the information that we got from the first scan and down here we can read
more about every plug in that it managed to find, including email addresses, HTML version, Jüri,
Open, SSL and all of that.
And in case there is a plug in that you do not recognize, you can read through the description and
figure out what it is used for.
Besides of using what web on only one IP address, you can also use WhatsApp on multiple IP addresses
if you'd like.
You can type the same comment.
And for example, let's say you have multiple websites in your local network that you want to scan with
one comment.
You can do so by typing your network range, which in my case is this one, and then it will perform
scanning of all of the IP addresses inside of your network.
And you can notice that I'm getting a lot of errors right here.
These are all the IP addresses that are not hosting any website.
As you can see, it tries to visit this IP address over FTP, but it can't find the route to the host.
Therefore, it throws us an error.
Now, just so you don't have to see all of these errors, what you can do is you can run the same command
and add at the end dash, dash, no dash errors.
This will remove all of these errors so it doesn't get printed out to us.
It just simply gives a better output.
And here you will get response for every device on your network that has a website hosted.
In my case, that should only be our wesp virtual machine as well as perhaps my router.
Let me see if we got the IP address of one or to that 168 that wandered for and down here we got my
rotters IP address, which is 190 to the 168.
That one.
Now, of course, with the IP range, let me just go down here, clear the screen.
Your IP range might be a completely different one.
It doesn't have to be the same one that I have.
So make sure that you check that out first and then you can run this command with your IP range.
OK, also, and this is what we use the word for, it helped us discover different plugins that the
website has.
Now, what what can be considered one of the tools that are used for advance website operation, because
it does give us a lot of information back, however, we are slowly getting closer to ending website
enumeration.
There are a couple more tools that we want to discuss.
Of course, you do not have to use all of these tools.
We just showing different options that you can use.
And besides all the tools it will cover, there are also a bunch of other tools that you might find
useful.
So feel free to use any one of them that you like.
Now, in the next video, we're going to check out a tool called Therp.
So thank you for watching and I will see you in the next lecture.