Websites are sometimes set up in ways that let attackers see hidden folders
that are not meant to be seen. These folders might have private information
like passwords or files that can be used to attack the server. Hackers can use
a tool called Websploit to easily scan websites for these hidden folders.
Websploit is a free tool for testing websites and networks. It's made in
Python
and has different parts for doing things like scanning folders, intercepting
data, and attacking wireless networks. In this guide, we'll focus on the
folder scanning part and use it to find important folders on a website.
Install Websploit
To get started, we first need to download and install the latest version of
Websploit. Fortunately, it's available in the Kali repositories, so we can
install it just like any other package using the following command in the
terminal:
apt-get install websploit
Now, we should be able to run the tool. Simply type `websploit` in the
terminal to launch the framework. Websploit is similar to Metasploit in that
it uses modules, the commands are alike, and it even has a welcome banner. If
you're familiar with Metasploit, you should find it easy to use Websploit.
Once it's loaded, you should see the "wsf >" prompt.
websploit
To display the help menu, type `help` at the interactive prompt. This will
provide you with a list of core commands that you can use.
help
One useful feature of this tool is the capability to execute operating system
commands within the framework, eliminating the need to open a separate
terminal. To do this, type `os` followed by the command you wish to run. For
example, `whoami` displays the username of the current login session, while
`ip address` shows the system's IP address information.
os whoami
The core functionality of Websploit comes from its modules. To display a list
of modules and their descriptions, type `show modules`.
show modules
Websploit has four main categories of modules: web, network, exploit, and
wireless/Bluetooth. Today, we'll focus on the directory scanner, which is part
of the web modules. Before we start using it, though, we need to configure a
few things.
Tweak the Script
The default directory scanner script is helpful because it includes a vast
list of possible directory names. However, when running the script, any
directory names that are not found (those that don't return a 200 HTTP
response code) are displayed on the screen. Given the large number of
possible directories involved, it's challenging to sift through all those
results.
To address this, we can modify the script to only display directories that
are found, making it much easier to manage. Navigate to
`/usr/share/websploit/modules` and open the file named
`directory_scanner.py` with your preferred text editor. Scroll to the
bottom and locate the block of code that looks like this:
One way to improve the script is by commenting out the print statement and
adding a continue statement under the else clause. This change ensures that
the script ignores responses that are not status code 200 and continues
running. This means that only directories that match will be displayed in
the terminal.
Another improvement is to add a forward slash in front of the directory
names in the list. This change is necessary for the script to work
correctly, as the directories are not valid without the slash. To do this
efficiently, we can modify the GET request in the try statement to include
the forward slash:
conn.request("GET", "/" + path)After making these changes, the script should look like this:
Scan for Directories
In the Websploit framework, we can load the directory scanner module using
the `use` command:
use web/dir_scanner
Next, we need to configure the settings for this module. To do this, type
`show options` at the "wsf:Dir_Scanner" prompt to display the current
options.
show options
To scan our specific target (not Google), we need to specify the appropriate
IP address using the `set` command:
set target 172.16.1.102
After setting the target, we're ready to launch the scanner. Type `run` at
the prompt to start the scan.
run
Since the script includes a large list of potential directories, the
scanning process can take a considerable amount of time. You can shorten the
list or add your own custom directory names to speed up the process.
After running the scan, Websploit will display any discovered directories.
The "phpinfo" directory could be particularly valuable, as it might contain
important information about the site's PHP configuration and settings.
Conclusion
Websites can be a goldmine of information for hackers when not configured
correctly, providing them with more resources for a successful attack. In this
tutorial, we've learned how to tweak a script in the Websploit framework to
scan a target for hidden directories. It's often worthwhile to be patient and
thorough in these scans, as you never know what valuable information might be
waiting to be discovered.