Instructor: Today we're going 2 2
to learn how to get information 3 3
about the technologies used by the target website. 4 4
So we're going to use a website called Netcraft 5 5
and I'm gonna put my target here and as you can see, 6 6
I already put it there, isecurity.org. 7 7
So, I'm just gonna hit enter and again, 8 8
first of all you'll see some basic information, 9 9
such as the website title, 10 10
the description, the key words 11 11
and when the website was created. 12 12
Scrolling down, you'll see the website itself, 13 13
the domain name, the IP address, 14 14
just like we've seen in the previous video, 15 15
the domain registerer, 16 16
so the company who registered the domain 17 17
for us, for iSecurity 18 18
and you'll also see information about the organization. 19 19
An here, you can't see it for this example 20 20
because iSecurity is using privacy protection, 21 21
but usually you'll be able to see it 22 22
and see more information. 23 23
We can also see that it's hosted in Netherlands. 24 24
We can see the name server, 25 25
which is dimofinf.net. 26 26
And again, if you just got to dimofinf.net, 27 27
you'll discover that this is a website for web hosting, 28 28
so we know this is a web hosting company. 29 29
In worst case scenarios, 30 30
we can use this or try to hack into Dimofinf itself 31 31
to gain access to iSecurity. 32 32
Scrolling down, you'll see history of the hosting companies 33 33
that iSecurity used 34 34
and we can see that the latest one is this one. 35 35
And it's running on Linux with Apache. 36 36
Same server that we see in the previous video, 2.3.31 37 37
with Unix mod_ssl and all the other items. 38 38
Again, this is very important to find vulnerabilities 39 39
and exploits on our target computer. 40 40
In the Security section, 41 41
you'll see if the website has any spam 42 42
and you can see that it doesn't really have any spam. 43 43
Scrolling down on the Web Trackers, 44 44
it'll show you the third party resources 45 45
or applications used on our target. 46 46
So we can see that our target uses Google Analytics, 47 47
Googlecdn, and other Google services. 48 48
So this could also help us to find or gain access 49 49
to the target computer. 50 50
The technologies is one of the most important tabs, 51 51
or sections, in here 52 52
'cause it shows us the technologies used 53 53
on the target website. 54 54
So we can see it's using Apache web server, 55 55
we already know that. 56 56
On Server-Side, we can see that the website uses PHP, 57 57
so this means the website can run, 58 58
can understand and run PHP code. 59 59
This is very important because in the future, 60 60
if we manage to run any kind of code on our target, 61 61
then we know this code should be sent as PHP code. 62 62
So if we're creating payloads in Metasploit 63 63
or even Veil-Evasion, 64 64
we should create them in PHP format 65 65
and the target website will be able to run them 66 66
because it can support PHP. 67 67
On the Client-Side, 68 68
we can see that the website supports JavaScript 69 69
so if run JavaScript or if you manage 70 70
to run JavaScript code on the website, 71 71
it's not going to be executed on the website. 72 72
It'll be executed on the users who see the website 73 73
because JavaScript is a client-side language 74 74
and PHP is a server-side. 75 75
So if we manage to run PHP code, 76 76
it'll be executed on the server itself. 77 77
If you manage to run JavaScript, 78 78
it's gonna be executed on the users 79 79
or the people who visit the website. 80 80
Same here with jQuery, 81 81
this is just a framework for JavaScript. 82 82
Scrolling down, we can see that the website uses WordPress. 83 83
This is very important. 84 84
So Netcraft will also show you any web applications 85 85
being used on the website. 86 86
So WordPress is just a web application, 87 87
so you can see other examples in your case. 88 88
And it's a open-source web application 89 89
that a lot of other websites might have. 90 90
The good thing about this is you can go and find exploits 91 91
or vulnerabilities within this web application. 92 92
If you are lucky enough to find an existing one, 93 93
then you can go ahead and exploit it on the target website. 94 94
So for example, we have WordPress in our example 95 95
and I'm gonna go to Exploit Database. 96 96
And if we go on the search here, 97 97
so I'm just gonna type in WordPress here. 98 98
And I'm gonna say I'm not a robot. 99 99
Then we're going to search. 100 100
And as you can see, 101 101
we managed to find a lot of exploits related to WordPress. 102 102
Now these are related to different versions of WordPress 103 103
so you need to make sure that you have the same version 104 104
on your target. 105 105
And we'll have examples to see how 106 106
to use exploits like these, 107 107
but it just shows you how powerful information gathering is. 108 108
Again going down, you can see that the website uses cPanel. 109 109
This is another web application. 110 110
It's a hosting control panel. 111 111
Again, you can go on Exploit Database 112 112
and see if you can find any vulnerabilities 113 113
or exploits related to it. 114 114
And you can also find other information 115 115
such as that the website uses HTML5, uses CSS, 116 116
and all that kind of stuff. 117 117
So Netcraft is really useful. 118 118
From it we managed to know that the website runs PHP, 119 119
it runs JavaScript, 120 120
it uses WordPress, 121 121
so we can use WordPress to hack into the website, 122 122
and cPanel. 123 123
And we can also, if we go up, 124 124
we also manage to know the web hosting, 125 125
or even we found out in the previous video, 126 126
that Dimofinf is the web hosting company of this website, 127 127
so in worst case scenarios, 128 128
we can try to hack into that web hosting 129 129
and gain access to our target website.