In this lesson,
we're going to dive into the tools used
for directory traversal attacks.
Specifically, we'll look at Gobuster, DirBuster, and WPScan.
Each of these tools is designed
to help us find hidden directories
and files on a web server,
which can be important when we're trying
to identify vulnerabilities during a pentest.
Let's start with Gobuster.
Gobuster is a fast and efficient directory
and file brute-forcing tool written in Go.
It's command line-based,
which makes it ideal for integrating into scripts
or using it in automated environments.
One of the strengths of Gobuster is its speed,
because it's written in Go.
And it can handle large word lists
and complex scans without slowing down.
For instance,
just say you're targeting a web server running
on 192.168.1.10.
You might use Gobuster with a command
like gobuster dir -u
http://192.168.1.10 -w,
and then we have the path for the common text file.
Gobuster is especially useful when you need
to quickly enumerate directories and files
that aren't listed in the site structure,
but might be accessible if you know where to look.
Next, we have DirBuster.
DirBuster is a Java-based tool
that performs brute-force attacks
to find hidden directories and files on a web server.
While it has a graphical user interface,
it's also quite powerful under the hood.
DirBuster's key feature is its ability
to recursively brute force directories,
meaning it doesn't just stop at the first level.
It will continue to dig deeper
into the directories that it finds.
This can be particularly effective
on complex websites with deeply nested directories.
For example,
if you're testing a website hosted on www.example.com,
DirBuster could reveal directories like /admin/backup,
which might not be accessible via normal browsing,
but are still a part of the service file structure.
And finally, we have WPScan,
which is a specialized tool used primarily
for scanning WordPress installations.
WordPress is one of the most popular
content management systems in the world,
and as such, it's a common target for attackers.
WPScan is designed to find vulnerabilities
specific to WordPress,
including exposed directories,
outdated plugins,
and weak usernames.
To run a basic directory scan
on a WordPress site at www.vulnerablewp.com,
you might just use a command like the following.
Here in this command,
WPScan will go through the site,
identify potential security issues,
and provide a detailed report
that can help you prioritize your attacks.
Now, let's hop into a short demonstration
with Jason showing us the use of the tool DirBuster.
In this lesson,
we're going to cover DirBuster.
DirBuster is a multi-threaded Java application
that's designed to brute force directories
and file names on web servers and web application servers.
Now what this tool does is it's going to go out
to a web server
and it's going to try to figure out every single file
and folder that's on that web server,
whether or not there's actually a link
to it or not on the homepage.
So unlike a standard web crawler
where it'll just follow all of the links on the homepage
until it finds everything on the site,
with DirBuster,
you can even find hidden things,
because things that aren't linked to
aren't going to show up by default as part of a web crawl.
But with DirBuster, they can.
Now, DirBuster is a great tool.
Let's take a look at how you can use it.
If you type in dirbuster.h at your command prompt,
you're going to see the different options
you have with DirBuster.
You can use this in a headless mode,
which is -H,
which means there's no graphical user interface,
and your report will be auto-saved on exit
so you can run everything from the Linux terminal.
But if you want to use a graphical user interface,
you can simply type in the word dirbuster
and it will pop up on your screen
so you can use the graphical interface,
which is what I'm going to use in this demonstration
just to keep things easy for us.
When I go ahead and minimize the background,
we're just going to see DirBuster on the screen now.
Notice we have to give it a target.
Who do we want to go after?
Well, in my case,
I want to go after my Metasploitable machine
that's on my intranet.
So I'm going to use http://172.16.218.130:80,
which says I want to connect to the server
located at this IP address over Port 80.
Then you're going to choose which work method you want.
You can use auto switch between HEAD and GET requests,
or just use GET requests.
I'm going to go ahead and leave auto switch on,
which is the default.
Next, you'll choose the number of threads,
which is how fast you want to go
and start pulling things off of this web server.
Now, this is always a trade off,
because if you go really fast,
you have the possibility
of either being detected or crashing your server.
When I tried this on my Metasploitable machine before,
and I tried using 500 threads,
I crashed that server in about 60 seconds.
So what we're going to do is we're going to leave it
with the standard 10 threads,
because that way it's a nice slow check,
and you can just walk away
and then come back with the results after,
and it's less likely that you're going to be detected.
When you go to do your scanning type,
you can either do a list-based brute-force attack,
or a pure brute-force attack.
Now, what's the difference?
Well, DirBuster comes with a set of different lists,
and the directory-list-2.3-small is just one of them.
If you click on the list info,
it'll tell you all the details
about the different lists that come with DirBuster.
The one I'm going to be using is directory-list-2.3-small,
which has about 87,000 words in it.
These are directory and file names
that were commonly found
on at least three different hosts in the past,
and so they've added these to this dictionary
for you to be able to do essentially a dictionary attack
against this web directory.
Now, if you wanted to do pure brute force,
it's going to start with A, and then go AA, and then go AAA,
and you get the idea as it tries to find
every single thing that could possibly be out there.
If you do use a brute force,
you can tell it what character set you want
and how long of file names or director names you want.
So to find a directory like wp -content,
which is where most of the files inside
of a WordPress server are hosted,
that's actually 10 characters,
and so it'd take a long time to find that
using a traditional brute-force attack,
and this is why a list-based attack can be more useful.
Now, when you go down here at the bottom,
you'll see all of your different starting points
and starting options.
For our test, I'm going to go ahead
and leave it with the default,
and we're simply going to click Start.
Now it's going to go out and start testing my server.
Remember, I'm only using 10 threads here,
and you can see that with 10 threads,
I'm doing about 70 to 100 requests per second,
which is still pretty fast.
As it gets that information back,
it starts putting that information into the directories
and tells me what it's finding
in terms of directories and files.
You can see right now we're still at 0% as we start testing
for all the directories and files across all the tests,
but we've already found 27 directories and 16 files.
Now, what I'm going to do is go up here to the Results tab
just so you could see what this looks like.
Now, here in the Results tab,
you'll see I found the file of index.php.
That's the homepage.
We would expect to find that.
And then we found a couple of directories,
like cgi-bin, icons, twiki, phpMyAdmin,
mutillidae, dvwa, dav,
and others as we go through this list.
As we look at these,
we can see what files and folders might be there,
and anything that we think might be useful
for us to use as we move forward.
There's also a results tree here if you go to that tab.
On the results tree,
you'll see what the directory structure
actually looks like for that server,
and this is going to continually be updated
as it goes through the scans.
So right now,
I can see under the index directory that we have nothing.
But if I go under the twiki directory,
I have a couple of files here, such as readme, license,
TWikiDocumentation, and TWikiHistory.
Now, as it goes forward and it continues to do these scans,
it'll keep adding more and more information.
Now, I'm not going to let it sit here and run
for an entire day and make you watch this,
because there's really no point in that.
But I did want to show you how to use this tool
in a very basic way so you can get an idea
of what DirBuster is used for.
This is a great tool that's provided by OWASP for free.
It's free and open source.
And it runs on any operating system
because it uses Java to run this application.
When you're using DirBuster,
it is an extremely effective tool
at finding hidden files and directories,
and that is the main purpose of using this tool.
So to see what the final report looks like,
I'm going to go ahead and stop my scan
and then click on Report.
Now, from here,
we're going to be able to see the full report as a TXT file.
Now, when I generate this report,
I'm going to go ahead and save it with the information
I want.
In my case, I'm going to use the full text report,
and I need to put it somewhere,
so I'm going to go ahead and put it on my desktop
to make it easy to find,
and then I'm just going to generate the report.
There we go.
Now we can look at the report
and you can see exactly what was found.
In terms of the directories found during testing,
the ones found with a 200 response,
which means it was a good, satisfactory connection,
are listed here.
As we continue to scroll down,
we will see any directories found with a 403 response,
which is an error,
or directories with a 302 response,
which again is another type of error.
Then we find files during testing.
We found some with 200 response,
which says those were files we could access right now
if we wanted to download them.
And then we had files with a 302 response.
This is the basic report,
and it's the full text that we're going to get.
Now, this report would be a lot longer
if I let it finish the entire scan,
which was going to take about 20 to 24 hours
based on the slow speed
that I was scanning my Metasploitable2 server.
But hopefully this gives you a good idea
of how to use DirBuster and what it looks like.
So remember,
whether you're using Gobuster for speed,
DirBuster for depth,
or WPScan for WordPress-specific assessments,
each tool has its own strengths.
By mastering these tools,
you'll be well-equipped to discover
hidden directories and files that could lead
to significant vulnerabilities during your pentest.