In this lesson,
we'll explore the topic of enumerating directories
and its important role in pentesting.
Directory enumeration involves identifying
and mapping out directories and files on web servers
or within a web application.
This process helps uncover hidden resources,
sensitive information,
and potential attack vectors that attacker can exploit.
Directory enumeration provides insights
into the structure and content of a website,
revealing areas that might contain vulnerabilities
or valuable information.
Now, let's break down the go-to methods and tools
used in directory enumeration.
First, we'll discuss the use of web crawlers.
Web crawlers, like "DirBuster" or
"Gobuster," and "Dirsearch"
automate the process of discovering directories
and files on a web server.
These tools use wordlists of common directory
and file names to make HTTP requests to target server.
For example, running "Gobuster"
against "www.diontraining.com"
with a wordlist can reveal directories such as "/admin,"
"/backup," or "/test" that might not
be linked to the main site,
but are still accessible.
Next, let's talk about the importance of custom wordlists.
While default wordlists included with tools are useful,
creating custom wordlists tailored
to the target can give us better results.
These lists are built using information gathered
during the earlier recon phase, such as company names,
project names, or technical terms relevant
to the target organization.
For instance,
if "Dion Training" has a project called "ProjectX,"
adding "ProjectX" to your wordlist
might uncover directories like
"/ProjectX" or "/ProjectX/admin."
Another commonly used method is analyzing robots.txt files.
The robots.txt file is used by websites
to let search engine crawlers know
which directories or files should not be indexed.
While this is not intended to protect sensitive parts
of the website from being listed in search results,
it often highlights exactly where these areas are.
For example,
if we look at the robots.txt file for tryhackme.com
we will see that it has two voucher directories
that it doesn't want web crawlers to index.
Error messages can also be revealing.
When making requests to non-existent directories or files,
the web service error messages can provide clues.
For example, the "403 Forbidden" error indicates
that a directory exists but access is restricted,
while a "404 Not Found" error means the directory
or file does not exist.
Testing variations of common directory names
and analyzing the service response
can help identify protected or hidden areas.
Additionally, directory listing vulnerabilities
can be exploited.
Some web servers are configured
to list the contents of a directory
if no index file is present.
Navigating to "www.diontraining.com/files"
might display a list of files stored in that directory.
This can expose sensitive documents, backup files,
or scripts that were not intended to be publicly accessible.
Next, let's consider the use of URL fuzzing.
This technique involves changing URLs
to discover hidden directories and files.
Tools like "Burp Suite" can automate this process
by injecting different payloads into URL parameters,
searching for responses that indicate
that additional resources are available.
For example, testing "www.diontraining.com
/?page=admin"
or "www.diontraining.com
/?file=config"
might reveal hidden functionalities or files.
Server-side includes or SSI injections
are another advanced technique.
By injecting SSI directives into URL or form fields,
testers can attempt to execute server-side commands
or include files from the server.
This can reveal configuration files, scripts,
and other sensitive data stored on the server.
For example, if a web application allows SSI,
an attacker might inject the following command
into the vulnerable field form.
If executed, this directive would list contents
of the /etc directory,
potentially expose insensitive configuration files
like passwd.
Enumerating network services and shares
is also important when enumerating directories.
Tools like Metasploit, `net view`, `arp-a`,
`net user`, and `ipconfig/displaydns`
help enumerate network shares and services.
PowerShell cmdlets such as `Get-NetDomain`,
`Get-NetLoggedon`,
and `Get-NetGroupMember` can be used
for active directory enumeration.
For Linux systems commands like `finger`, `uname -a`,
and `env` are useful as well.
So remember,
enumerating directories is commonly used in pentesting.
By using web crawlers, custom wordlist,
analyzing robots.txt files, examining error messages,
exploiting directory listing vulnerabilities,
and employing URL fuzzing and SSI injection,
testers can uncover hidden resources
and sensitive information.
This detailed mapping of the target's directory structure
provides important information
that will come handy in later phases,
helping to identify and exploit potential vulnerabilities.