Cyber Security / Ethical Hacking
  • Prologue
  • CTF/OSCP Prep
    • Fundamentals
      • Linux
        • Basics
        • Bash Scripting
      • Windows
        • Basics
        • PowerShell
          • Scripting
        • CMD
      • Kali Survivor Skills
    • Information Gathering
      • Passive Recon
      • Active Recon
    • Enumeration
      • Common Ports
      • Vulnerability Analysis
    • Exploitation
      • Shells
  • Binary Exploitation / Exploit Development
    • Useful tools and techniques for Binary Exploitation
    • Shellcoders Handbook
      • Chapter 2 - Stack Overflows
        • Linux Buffer Overflow With Command Injection
        • Linux Buffer Overflow Without Shellcode
      • Chapter 3 - Shellcode
  • TryHackMe
    • Linux Fundamentals
      • Linux Challenges
      • RP: tmux
      • Common Linux Privesc
    • Advent of Cyber
      • Inventory Management
      • Arctic Forum
      • Evil Elf
      • Training
      • Ho-Ho-Hosint
      • Data Elf-iltration
      • Skilling Up
      • SUID Shenanigans
      • Requests
      • Metasploit-a-ho-ho-ho
      • Elf Applications
      • Elfcryption
      • Accumulate
      • Unknown Storage
    • Web Application Security
      • Web Fundamentals
      • Juice Shop
      • WebAppSec 101
    • Linux Privesc Playground
    • Intro to x86-64
    • Ninja Skills
    • CC: Radare2
    • Reversing ELF
    • Intro to Python
    • ToolsRus
  • Programming
    • Python
      • Simple TCP Port Scanner/ Banner Grabber
      • Botnet
      • Keylogger
      • Nmap Scanner
    • Golang
      • Execute Commands
      • MAC changer
      • TCP Port Scanner
      • TCP Port Scanner (improved with goroutines)
      • GoNmap Scanner
  • Protostar
    • Stack 0
    • Stack 1
    • Stack 2
  • Web App Pentesting
    • Recon
    • Authentication (Portswigger Academy)
      • Vulnerabilities in password-based login
        • Username Enumeration via different responses
        • Username enumeration via subtly different responses
        • Username enumeration via response timing
        • Broken brute-force protection, IP block
        • Username enumeration via account lock
        • Broken brute-force protection, multiple credentials per request
      • Vulnerabilities in multi-factor authentication
        • 2FA simple bypass
        • 2FA Broken Logic
        • 2FA bypass using a brute-force attack
      • Vulnerabilities in other authentication mechanisms
    • Broken Acess Controls
      • Insecure direct object references (IDOR)
        • Insecure direct object references lab
  • HackTheBox
    • Active
      • Untitled
      • Blunder
Powered by GitBook
On this page

Was this helpful?

  1. TryHackMe
  2. Advent of Cyber

Arctic Forum

Brute Forcing Directories

PreviousInventory ManagementNextEvil Elf

Last updated 5 years ago

Was this helpful?

Many off the shelf applications like Apache web server, Django framework and Express are not secure by default; many use default credentials and even leave sensitive pages open to the public including:

  • Admin panels

  • Server status checks

  • Debug pages

These pages contain information and functionality like paths to sensitive files on the server and version information, that can allow an attacker to learn more about the system.

Attackers can enumerate directories by brute-forcing. This evolves sending requests to different pages on the server and using the server's response to verify the existence of a pages (and even access the page).

Depending on the application used, an attacker can easily find sensitive information when accessing the application. Examples include:

  • Comments and API keys in the source code

  • Password (Hashes) in requests and responses:

    • For responses, having sensitive information as part of GET requests is insecure as these requests are usually logged for debugging. This would mean anyone with access to the logs has information about it

    • For responses, sensitive information is usually put in headers, cookies or source code

After checking the aforementioned locations, an attacker can mostly use this extra information to enumerate the application. Examples of enumeration include:

  • Cracking password hashes in the response to access user's accounts

  • Using API keys to access functions and API calls without authorization

  • Find hidden URLs and System information that they can use to find public exploits

Checking the source code of the sysadmin directory

The GitHub page has the admin credentials

Login with admin credentials