Instructor: So far, we learned 2 2
how to find any subdomains 3 3
that exists within our target website 4 4
and that have not been listed. 5 5
In today's lecture, we're gonna see 6 6
how we can find files and directories 7 7
that are stored on our target computer 8 8
or our target website. 9 9
Again, this could be useful 10 10
because these files could contain passwords. 11 11
They could contain config information, 12 12
or they could contain information 13 13
about these actual server, 14 14
which will help us further exploit our target. 15 15
Let me just first show you what I mean 16 16
by files and directories, just to show you the structure 17 17
of directories on a web server. 18 18
So here I have my Metasploitable machine. 19 19
And as we know, usually the web server stuff 20 20
is stored in var/www. 21 21
And if I do an ls, you'll see, or I'll do an ls -la 22 22
just so that it's nicer. 23 23
You'll see that we have a number of files and directories. 24 24
And we can see that we have a directory 25 25
there called called mutillidae. 26 26
Mutillidae is a web application 27 27
that is designed to be hacked, 28 28
just like metasploitable, 29 29
it is designed so that it has a number of exploits, 30 30
so that we can learn how to hack based on it. 31 31
So we can see that that's installed 32 32
in a directory called mutillidae. 33 33
Now, if I go here to my IP address 34 34
now, this is the IP address of the metasploitable machine. 35 35
So if I do an ifconfig here, 36 36
you'll see that it's 10.20.14.204. 37 37
So I'm in there, and you can see that 38 38
they have an easy access for me for mutillidae, 39 39
if I click it, look at the URL here, so it's /mutillidae. 40 40
That means I'm inside the mutillidae directory, 41 41
so every time you see a forward slash, 42 42
that usually means you're inside a directory. 43 43
So let's go back here, do an ls, 44 44
and if I do cd mutillidae, and I'm gonna do an ls. 45 45
And you'll see that I have a large number of files, 46 46
a large number of files here. 47 47
So let's say for example, 48 48
I wanted to open one of these files, and we have index.php. 49 49
If I do index.php, 50 50
then this is our current file, it's called index.php. 51 51
So what we learn from this is, 52 52
mutillidae is just a directory inside my web route. 53 53
So at the moment in the metasploitable device, 54 54
I'm in, let me just write it here for you, 55 55
so I'm in var/www mutillidae. 56 56
and then the file that I'm accessing is index.php. 57 57
Okay, so I hope this is clear now, 58 58
so I'm in this directory, in this directory 59 59
an I'm accessing a file called index.php. 60 60
So if I just do a pwd here, 61 61
you'll see that I'm in var/www/mutillidae. 62 62
The IP address kinda hides where your WWW route is, 63 63
so it hides the var/www, 64 64
and then everything after that will be displayed here 65 65
after the IP address. 66 66
So what we're looking to find today is 67 67
all the directories and the files that we cannot see. 68 68
So throughout these links, we will be able to access 69 69
different types and different pages, 70 70
this is the same with any other website. 71 71
But there is always files and directories hidden 72 72
that you just never see. 73 73
So we'll see how we can get URLs for these files, 74 74
and access them, and read the information in it. 75 75
To do that, we're going to use a tool called dirb, 76 76
and to see how to use that tool, we're gonna do, man dirb, 77 77
to see all the options associated with that tool. 78 78
So you can you see that to use the tool, 79 79
you just type in dirb, the URL of your target, 80 80
and then you put a word list. 81 81
So the way this works is, 82 82
it works based on a brute force attack. 83 83
And it just uses a word list of names, 84 84
and it sends requests with these names, 85 85
and anytime it actually finds something, 86 86
it tells us that, "Oh, I found a file with this name." 87 87
So it will only be able to find names and directories 88 88
based on the word list that you provide. 89 89
Now, you can create a word list using crunch, 90 90
or you can use word lists that come in within dirb. 91 91
The options here allow you to configure 92 92
how the tool is going to work, 93 93
so you can change things around the way you want it. 94 94
For example, you can disable the recursiveness of the tool, 95 95
so it just runs on one directory 96 96
instead of trying a number of directories. 97 97
You can get it to ask you 98 98
if you wanted to access a directory or not, 99 99
instead of it automatically accessing directories, 100 100
and trying to find files within these directories 101 101
because this could be exhaustive 102 102
if your target is a big website, 103 103
there might be a lot of directories 104 104
and then the tool will be trying to access all of them, 105 105
and find files within all of them, 106 106
so you can see how big the tree could go. 107 107
You can also set it to use a username and a password 108 108
if the target websites uses some sort of authentication. 109 109
And we can use v for verbose output, 110 110
and you can also use o to output the results to a file. 111 111
So let me show you a very simple example of it. 112 112
I'm just gonna run dirb on our target, 113 113
which is 10.20.14.204, and that should be http. 114 114
'Cause remember, we're targeting a website, 115 115
not an IP address. 116 116
Then I'm gonna put the directory 117 117
that I wanna find files and directories within. 118 118
I don't want it to be accessing anything within other 119 119
because we can see here 120 120
there is a number of scripts installed on this web server, 121 121
so we have this script and we also have phpMyAdmin, 122 122
and we have TikiWiki. 123 123
So we don't want you to be accessing all of them, 124 124
we only want it to be working on mutillidae on this example. 125 125
So that's why I'm only using this URL, 126 126
and then it's gonna start finding URLs 127 127
and files within this particular web application. 128 128
So I'm gonna hit Enter, and we're gonna let it to work. 129 129
So this is going to use a wordlist file. 130 130
And it's using a default small wordlist file 131 131
that is stored in here. 132 132
So it's a user/share/dirb/wordlists/common.txt, 133 133
you can have a look at this directory 134 134
and see if there is any other wordlists 135 135
that you'd like to use, 136 136
and you can use them only by placing the full path 137 137
to the wordlist after the command. 138 138
So instead of the way I wrote the command, 139 139
you'd write it like this, and then you'd state 140 140
where your wordlist is, for example, 141 141
let's say if it's root, 142 142
you'd stated as root/wordlist.txt, or whatever. 143 143
But at the moment, it's using the default one, 144 144
which is stored in this directory 145 145
in user/share/dirb/wordlist, and it's using 146 146
the one that's called common.txt.