Table of Contents
Introduction
In most environments, web servers play a big part in the infrastructure, and in the daily processes of many departments. Web servers can sometimes be used strictly internally by employees, but most of the time can be found to be public-facing, which means anyone from the Internet can access them to retrieve information, and files from their hosted web pages.For the most part, the web pages hosted on the web servers are managed through their administrative panels, locked behind a log-in page.
Let us think of an example: You have decided to start your own blog and use WordPress to achieve this. If you are not familiar with WordPress, then you can read more about it from my blog, link is in my description box.
WordPress is essentially a popular web application that allows you to easily manage the content you want to post for the rest of the world to read. Once installed, your WordPress website will have a public-facing side and a private-facing one, the latter being your administrative panel hosted on the wp-admin page. This page is locked behind a log-in screen.
Once you, as an administrator of the WordPress site, log into its' admin panel, you will have access to a myriad of controls, ranging from content uploading mechanisms to theme selection, custom script editing for specific pages, and more. The more you learn about WordPress, the more you will see how this is a vital part of a successful pentest, as some of these mechanisms could be outdated and come with critical flaws that would allow an attacker to gain a foothold and subsequently pivot through the network with ease.
Thus, we conclude that Web enumeration, specifically directory busting, is one of the most essential skills any Penetration Tester must possess. While manually navigating websites and clicking all the available links may reveal some data, most of the links and pages may not be published to the public and, hence, are less secure. Suppose we did not know the wp-admin page is the administrative section of the WordPress site we exemplified above. How else would we have found it out if not for web enumeration and directory busting?
Enumeration
Firstly click on spawn Machine to find out our target IP address.
Immediately after, we can follow up with a preliminary scan of the target. Using Nmap and the appropriate service version detection switch, we scan the IP address for any open ports and services.
- -sV: switch to Probe open ports to determine service/version info.
From the scan result, a single entry is shown and catches our attention. It is an http service running on port 80, signaling that this target might be hosting some explorable web content.
Let me take a look at the contents, we can open a web browser of our choice, and navigate to the target's IP address in the URL bar at the top of the window. This will automatically address the target's port 80 for the client-server communication and load the web page's contents.
At the top of the page, we observe the mention of the Nginx service. After researching basic information about Ngnix, and its purpose, we conclude that our target is a web server. Web servers are hosts on the target network that have the sole purpose of serving web content to internal or external users, such as web pages, images, videos, audio files, and other types. Typically, a web server is accessible from the Internet to allow for the stored content to be explored by the online public for many reasons: shopping, providing and requesting services, banking, reading the news, and more.
What we are looking at on our browser screen is the default post-installation page for the Ngnix service, meaning that there is the possibility that this web application might not be adequately configured yet, or that default credentials are used to facilitate faster configuration up to the point of live deployment. This, however, also means that there are no buttons or links on the web page to assist us with navigation between web directories or other content.
Installing Gobuster
First, you need to make sure you have Go installed on your Linux distribution, which is the programming language used to write the gobuster tool. Once all the dependencies are satisfied for Go, you can proceed to download and install gobuster.
Once that installation is complete, you can proceed with installing the go-buster. If you have a Go environment ready to go, it is as easy as typing in the following command in your terminal:
Using Gobuster
- dir: specify we are using the directory busting mode of the tool
- -w: specify a wordlist, a collection of common directory names that are typically used for sites
- -u: specify the target's IP address
Now you can see “admin.php” existed and was returned to us in the output, signaling that the webpage exists and we can navigate to it manually to check out its contents.
Foothold
Navigating to the newly found link manually through our web browser can be done by inputting the following address in our URL search bar. Once we proceed with this, we are met with an administrative panel for the website. It asks us for a username and password to get past the security check, which could prove problematic in normal circumstances.
Usually, in situations such as this one, we would need to fire up some brute-forcing tools to attempt logging in with multiple credentials sets for an extended period of time until we hit a valid log-in since we do not have any underlying context about usernames and passwords that might have been registered on this web site as valid administrative accounts. But first, we can try our luck with some default credentials since this is a fresh Nginx installation. We are betting that it might have been left unconfigured at the time of our assessment. Let us try logging in with the following credentials:
|
admin:admin |
We seem to be successful! The log-in worked, and we were presented with our flag.
Task Solutions
TASK 1: What is considered to be one of the most essential skills to possess as a Penetration Tester?
Ans. dir bustingTASK 2: What switch do we use for Nmap's scan to specify that we want to perform version detection?
Ans. -sVTASK 3: What service type is identified as running on port 80/tcp in our nmap scan?
Ans. httpTASK 4: What service name and version of service is running on port 80/tcp in our nmap scan?
Ans. nginx 1.14.2
TASK 5: What is a popular directory-busting tool we can use to explore hidden web directories and resources?
Ans. gobuster
TASK 6: What switch do we use to specify to gobuster we want to perform dir busting specifically?
Ans. dir
TASK 7: What page is found during our dir busting activities?
Ans. admin.phpTASK 8: What is the status code reported by gobuster upon finding a successful page?
Ans. 200
