So far, we learned how to find any subdomains that exists within our Target website site and that have
not been listed in today's lecture.
We're going to see how we can find files and directories that are stored on our target computer or our
target website.
Again, these could be useful because these files could contain passwords, they could contain config
information, or they could contain information about these actual server, which will help us further
exploit our target.
Let me just first show you what I mean by files and directories, just to show you the structure of
directories on a Web server.
So here I have my floatable machine.
And as we know, usually the Web server stuff is stored in the.
And if I do this, you'll see or I'll do I less of a you just so that it's nicer.
You'll see that we have a number of files and directories and we can see that we have a directory there
called Matilda, Matilda is a web is a Web application that is designed to be just like Matteis floatable.
It is designed so that it has a number of exploits so that we can learn how to hack based on it, so
we can see that that's installed in a directory called Mythili Day.
Now, if I go here to my IP address now, this is the IP address of the floatable machine.
So if I do.
And if configure.
You'll see that it's 10, 20, 14 to 04, so I'm in there.
And you can see that they have an easy access for me, for myself, if I click it, look at the URL
here.
So it's forward slash misleader, that means inside the metal at the rectory.
So every time you see a forward stash, that usually means your inside a directory.
So let's go back here to analyze.
And if I do see.
Matilde.
And I'm going to do another and you'll see that I have a large number of files, a large number of files
here.
So let's say, for example, I wanted to open one of these files and we have indexed at BHP.
If I do index that for you.
Then this is our current file, it's called Indexed So.
What we learn from this is Matilda is just a directory inside my webroot, so at the moment in demitasse
floatable device I'm in.
Let me just write this here for you, Sam, inva w w w.
Matilde de.
And then the file that I'm accessing is index.
OK, so I hope this is clear now, so in this directory and this directory and I'm accessing a file
called Index Dot.
So if I just do a WD here, you'll see that I'm inva w w w mattilda.
The IP address kind of hides where your w w w root is, so it hides the word w w w and then everything
after that will be displayed here after the IP address.
So what we're looking to find today is all the directories and the files that we cannot see.
So throughout these links, we will be able to access different types and different pages.
This is the same with any other website, but there is always files and directories hidden that you
just never see.
So we'll see how we can get your house for these files and access them and read the information in it.
To do that, we're going to use a tool called there and to see how to use that.
We're going to do man there to see all the options associated with that tool.
So you can see that to use the tool, you just type in derb the URL of your target and then you put
a wordlist.
So the way this works is it works based on a brute force attack and it just uses a word list of names
and it sends requests with these names.
And any time it actually finds something, it tells us that, oh, I finally I found a file with this
name so it'll only be able to find names and directories based on the word list that you provide.
Now you can create a word list using Krunch or you can use Wordlist that come in within the.
The options here allow you to configure how the tool is going to work so you can change things around
the way you want it.
For example, you can disable the recursive ness of the tool.
So it just runs on one directory instead of trying a number of directories.
You can get it to ask you if if you wanted to access a directory or not, instead of it automatically
accessing directories and trying to find files within these directories, because this could be exhaustive
of your target is a big website.
There might be a lot of directories and then the two will be trying to access all of them and find files
within all of them.
So you can see how how big the tree could go.
You can also set it to use the username and password if the Target website uses some sort of authentication.
And you can use Vevey for verbose output.
And you can also use O to output the results to a file.
So let me show you a very simple example of it.
I'm just going to run Derb.
On our target, which is 10.
Twenty fourteen to four, and that should be top.
Because remember, we're targeting a website, not an IP address.
Then I'm going to put the directory that I want to be, that I want to find files and directories within.
I don't want it to be accessing anything within other because you can see here there is a number of
scripts installed on this Web server.
So we have this script and we also have my admin and we have to squeaky.
So we don't want it to be accessing all of them.
We only want it to be working on Mattilda on this example.
So that's why I'm only using this URL.
And then it's going to start finding your URLs and files within this particular Web application.
So I'm going to hit enter and we're going to let it work, so this is going to use a wordlist file and
it's using a default small wordlist file that is stored in here.
So it's in user shared their word lists comment that you can have a look at this directory and see if
there is any other word that you'd like to use.
And you can use them only by placing the full path to the list after the command.
So instead of the way I wrote the command, you'd write it like this and then you'd state where your
word list is.
For example, let's say if it's in root, you stated as root wordlist.
But.
Or whatever, but at the moment, it's used the default one, which is stored in this directory in user,
shared their word lists and using the one that's called common the text.