Today, we're going to learn how to get information about the technologies used by the targeted website.
So we're going to use a website called Nut Craft, and I'm going to put my target here and as you can
see, I already put it there I security dot org.
So I'm just going to hit enter.
And again, first of all, you'll see some basic information, such as the website title, the description,
the keywords and when the website was created.
Scrolling down, you'll see the website itself, the domain name, the IP address, just like we've
seen in the previous video, the domain registrar.
So the company who registered the domain for us for security and you also see information about the
organization.
And here you can see it for this example, because security is using privacy protection, but usually
you'll be able to see it and see more information.
We can also see that it's hosted in Netherlands.
We can see the name server, which is dimness dot net.
And again, if you just go to dimness dot net, you'll discover that this is a website for Web hosting.
So we know this is a Web hosting company and worst case scenarios, we can use this or try to hack into
dimness itself to gain access to a security.
Scroll down, you'll see history of the hosting companies that I security used, and we can see that
the latest one is this one and it's running on Linux with Apache, same server that we've seen in the
previous video, two point three point three one with Unix Mod, SSL and all the other items ons.
Again, this is very important to find vulnerabilities and exploits on our target computer.
In the security section, you'll see if the website has any spam and you can see that it doesn't really
have any spam.
Scrolling down on the Web trackers, it will show you the third party resources or applications used
on our target so we can see that our target uses Google Analytics, Google sedan and other Google services.
So this could also help us to find or gain access to the target computer.
The technology is one of the most important tabs or sections in here, because it shows us the technologies
used on the target's website so we can see it's using Apache Web server.
We already know that.
On the server side, we can see that the website uses BHP, so this means the website can run, can
understand and run code.
This is very important because in the future, if we manage to run any kind of code on our target,
then we know this code should be sent as code.
So for creating payloads and meet, exploit or even relevation, we should create them in HP format
and the Target website will be able to run them because it can support BHP.
On the client side, we can see that the website supports JavaScript, so if you run JavaScript or if
you manage to run JavaScript code on the website, it's not going to be executed on the website.
It will be executed onto users who see the website because JavaScript is a client like Clydeside language
and.
BHB is a server site, so if we if we manage to run code, it will be executed on the server itself.
If you manage to run JavaScript, it's going to be executed on the users or the people who visit the
website.
Same here with Jaquie, this is just a framework for JavaScript.
Scroll down, we can see that the website uses WordPress.
This is very important, so that craft will also show you any.
Web applications being used on the website, so WordPress is just a Web application, so you could see
other examples in your case and its open source Web application that a lot of other Web sites might
have.
The good thing about this is you can go and find exploits or vulnerabilities within this Web application.
If you are lucky enough to find an existing one, then you can go ahead and exploit it on the target
website.
So, for example, we have WordPress in our example and I'm going to go to exploit database.
And if we go on the search here.
So I'm just going to type in word press here and say I'm not a robot.
Then we're going to search.
And as you can see, we've we managed to find a lot of exploits related to WordPress.
Now these are related to different versions of WordPress.
So you need to make sure that you have the same version on your target.
And we'll have examples to see how to use exploits like these.
But it just shows you how powerful information gathering is.
Again, going down, you can see that the website users see panel, this is another Web application,
it's a hosting control panel.
Again, you can go on exploit database and see if you can find any vulnerabilities or exploits related
to it.
And you can also find other information such as that the website uses HTML five user access and all
that kind of stuff, so that craft is really useful from it.
We managed to know that the website runs runs JavaScript and uses WordPress so we can use WordPress
to hack into the website and see panel.
And we can also, if we go up, we also manage to know the Web hosting or even we found that in the
previous video that dimness is the Web hosting company of this website.
So in worst case scenarios, we can try to hack into that Web hosting and gain access to our Target
website.