recon_05 (wfuzz)

View the exercise here: PentesterLab: Recon 05

OBJECTIVE

For this challenge, your goal is to find a directory that is not directly accessible.

FUZZING DIRECTORIES

When accessing a new webserver, it often pays off to brute force directories. To do this, you can use many tools like patator, FFUF, or WFuzz (amongst many others).

SOLUTION

You can use wfuzz, ffuf, or patator.

For wfuzz: https://wfuzz.readthedocs.io/en/latest/

In Kali machine:

We'll change the directory to /usr/bin and then check wfuzz.

cd /usr/bin
./wfuzz

To discover wordlists to use for fuzzing:

ls /usr/share/wfuzz/wordlist/general

We'll use common.txt and enter it in wfuzz.

wfuzz -c -z file,wordlist/general/common.txt --sc 200 http://hackycorp.com/FUZZ/

-c to colorize the output

-z to define the payload type for fuzzing

--sc (show codes) In this case, it will only show responses with 200 OK status

--hc (hide codes) hides responses that match the specified HTTP status codes

Notes:

• -- take note of the double dash, this is often the cause of errors

• add slash / at the end of the URL to get exactly 200 rather than 301 responses

  

From the wfuzz results, we use curl to the directories we've found to get the flag.

curl http://hackycorp.com/admin/
curl http://hackycorp.com/images/
curl http://hackycorp.com/startpage/

We'll see the flag in http://hackycorp.com/startpage/