56 Scanning and Enumeration: Dirbuster

If your target is hosting a website, you will want to review its file structure.  This knowledge could significantly enhance your understanding of the target and improve your “Google Dorking” efforts. In this chapter, we will explore how to use the Dirbuster tool.

Learning Objectives

• Learn the basics of Dirbuster

Prerequisites

• Chapter 45 – Eagle Net
• Chapter 46 – Nmap

Deliverables

• 4 Screenshots are needed to receive credit for this exercise:
  • Nmap scan identifying the web server on the target network
  • Dirbuster GUI wordlist selection
  • Wireshark results for normal scan (tail end)
  • Wireshark results for your attempt at a ‘quiet’ scan (tail end)

Resources

• How to Use the Command ‘dirbuster’ (with Examples)
• DirBuster: The Ultimate Tool for Brute Forcing Web Directories

Contributors and Testers

• TBD

1. Start the baseline environment
2. Run an Nmap scan on the target network
   1. Determine possible target IP addresses
   2. Determine the operating systems on each IP address
3. A target hosting a website will have many of these services running
   1. Web server software: Apache, NGINX, IIS, etc.
   2. Database management system (DBMS): WordPress, MySQL, PostgreSQL, MariaDB, etc.
   3. Domain Name Service (DNS)
   4. File Transfer Protocol (FTP)
   5. Email services: SMTP, IMAP, POP3, etc.
4. Continue your nmap scans until you find a target that has these attributes. You may have to perform a detailed scan to see these services
   

   

5. Alternatively, you can open Firefox in Kali and type the target IP addresses one at a time and see if you get something that looks like a webpage
   

   

1. Open Dirbuster from the Kali app menu
   

   

2. Here, you will open the GUI version of Dirbuster, and you will need to fill in the appropriate fields
   

   

   1. Target URL – this is where you type in the target you identified earlier (in this example, we use http://200.200.200.19)
   2. File with lists of directories and files:
      1. Click on “List Info” to read about the different lists. Settle on one that might seem to work for you; you can always change it later
      2. Click on “Browse” and navigate to /usr/share/dirbuster/wordlists/
      3. Click on the list that you decided on earlier
      4. Click on “Select List”
3. Select “Start” and let it run. You can press stop after a while if needed.
   

   

• Results – List View: A simple list of found directories and files. You can click on each category at the top to sort the lists in different ways
  

  

• Results – Tree View: this is a hierarchical view and is easy to navigate the results
  

  

• Create a report by clicking on the “Report” button (scan needs to be stopped)
  • Select the report type: you can select more than one
    • Full text (text file)
    • Simple text (text file)
    • XML (Visual Studio)
    • CSV (Excel)
  • Click on “Generate Report
    

    

• Understanding the HTTP status codes
  • 200 – Generally means the URL path is valid; false positives are usually indicated by many responses being the exact same size
  • 3XX – Generally means the URL exists, but additional action is needed
    • 301 moved permanently
    • 302 found via alternative URL
    • 303 may require a GET request
  • 4XX client errors
    • 401 unauthorized (ooooo, we like these!)
    • 402 Payment required
    • 403 forbidden, might need to create a dummy login
    • 404 not found
  • 5XX or greater, the servers are unstable – probably because of your dirbuster scan!

1. Stop the Dirbuster scan if it is still running
2. Return to GNS3 environment and open a Wireshark scan on the wire from the Kali box
   1. Right-click on the cable and select “start scan”
   2. Alternatively, you can start Wireshark inside of Kali, by selecting from the app menu
3. Observe the results on the normal scan
   

   

4. You can adjust the “noise” level with a few setting changes
   1. Select GET requests only to reduce the number of packets generated
   2. Adjust the number of threads used. I don’t recommend more than 200, or you may generate many false positives
      NOTE: more threads = more noise
   3. Target your directory
      1. / is the home directory
      2. /admin will have limited, but possibly relevant information, without sending a lot of packets
   4. Use different file extensions. If you are looking for documents, limit to PDF, doc, or docx
   5. URL Fuzz will send nonsense data to see what comes back

End of Lab