Hack Like a Pro: How to Hack Web Apps, Part 2 (Website Spidering with WebScarab) « Null Byte :: WonderHowTo

Welcome back, my tenderfoot hackers!Now that we have begun this trip downweb app hacking lane, we need to first address target reconnaissance. Like any hack,reconnaissanceis critical. (Are you tired of me saying that yet?)There is no better telltale sign of a script-kiddie than a hacker who runs willy-nilly into trying to hack/exploit without doing proper recon. They say they don't "have time" to do proper recon, then when they are invariably unsuccessful, they scratch their head and ask, "Why didn't this hack work?"For a professional hacker, reconnaissance is often 70% or more of the time we spend on a hack. Since each hack/exploit is specific to a vulnerability, and the vulnerability is specific to the OS, the ports, the apps, the technologies used, and even the language, hacking without recon is simply an exercise in futility.Web App ReconnaissanceI think it's important to note here that web app reconnaissance is a process and not a tool. Before attacking a web app, you need to gather as much information as possible. In some cases, you will get conflicting information, and when that happens, you may need to run another reconnaissance tool or technique.Here are some of the tools and tutorials that I have already covered that you can use for reconnaissance.Operating System- The underlying operating system of the target can often be determined by usingNmap,Xprobe2,P0f, orNetcraft.Web Server- The underlying web server can often be determined byNetcraft, banner grabbing withNetcat,Httprint, orShodan.Web Technologies- The underlying technologies can be determined withNetcraft.DNS- You may need toperform DNS reconto find hidden servers.Wikto- This is an excellent tool for finding so much information on the website including finding hidden directories and Google hacking.DirBuster- OWASP's tool maps nearly every directory in a website and often finds hidden or unknown directories in a website.Maltego- This tool is great for many of the above tasks, as well as social networking relationships.Httrack- This tool enables us to make a copy of the website for online reconnaissance and analysis before exploitation.Website SpideringBefore a website attack or penetration test, we need to spider the site. Many of the tools we use to attack a site need a map of the website in order to do their work. We could manually spider the site by simply navigating to each page and saving it, but fortunately, we have tools that can save us time and automate this process. The tool we will use here is calledWebScarabbyOWASP. It's built into Kali, so no need to download or install anything.Step 1: Fire Up Kali & Open WebScarabLet's begin by firing upKaliand then navigate to Applications -> Kali Linix -> Web Applications -> Web Crawlers -> webscarab.Step 2: WebScarabWhen we click on the webscarab option, it opens with a GUI interface like that below. As you can see, WebScarab has many web reconnaissance features, but here we will focusing on its ability to spider a website. In later tutorials, we will explore some of its other capabilities.Step 3: Configure Your BrowserBefore we begin spidering a website, we need make certain that your browser is configured properly. By default, WebScarab uses a proxy on 127.0.0.1 on 8008. You can change it by clicking on the "Proxy" tab, but for now, let's keep the default setting and make certain that our browser is using the same setting.For more information on configuring the proxy setting in IceWeasel, seemy tutorial on THC-Hydra and Burp Suite.Step 4: Point WebScarab at a WebsiteNow, to see how WebScarab can spider a site, let's point it at our favorite website,WonderHowTo. In the "Allowed Domains" window, simply type inwww.wonderhowto.com.Next, go to your browser, in this case IceWeasel, and navigate towww.wonderhowto.com. When we do so, WebScarab will begin to populate the main window with every web address linked on that page. Note that the webpages are arranged in alphabetical order.Let's navigate down a bit to the Ns and findhttps://null-byte.wonderhowto.com/. We can click on it and expand all the links withinNull Byte, our favorite hacker training site.In this way, we can now see every webpage and link on the target website. In a future tutorial, when we begin the attack phase, we will see how we can actually use this information.Keep coming back, my tenderfoot hackers, as we exploreweb app hacking!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image viaShutterstock,OWASPRelatedHack Like a Pro:How to Hack Web Apps, Part 1 (Getting Started)Hack Like a Pro:How to Hack Web Apps, Part 5 (Finding Vulnerable WordPress Websites)Hack Like a Pro:How to Hack Web Apps, Part 6 (Using OWASP ZAP to Find Vulnerabilities)News:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:How to Find Website Vulnerabilities Using WiktoHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)How To:Launch Apps, Tasks, & Websites Directly from Your iPhone's Notification CenterHow To:The Safest Way to Disable ALL Bloatware on Your Galaxy S10Hack Like a Pro:How to Hack Web Apps, Part 7 (Finding Hidden Objects with DIRB)How To:A Security Bug Just Made It Risky to Open Links on Your iPhone—Here's How to Protect YourselfBest Android Antivirus:Avast vs. AVG vs. Kaspersky vs. McAfeeHack Like a Pro:How to Hack Like the NSA (Using Quantum Insert)Hack Like a Pro:How to Hack Web Apps, Part 4 (Hacking Form Authentication with Burp Suite)Firefox Mobile 101:How to Turn Websites into Apps on Your Home Screen with the New Quantum BrowserHow To:Expand Your Coding Skill Set with This 10-Course Training BundleNews:8th Wall Spins Up New 'Spider-Man: Into the Spider-Verse' Augmented Reality Experience for Blu-Ray, DVD ReleaseHack Like a Pro:How to Hack Facebook (Same-Origin Policy)Hack Like a Pro:How to Fingerprint Web Servers Using HttprintHow To:Save Custom Shooting Presets in Filmic Pro So You Don't Have to Adjust Settings Later for Similar ShotsHow To:This Android App Lets You Cast Unsupported Web Videos to ChromecastHow To:No Data, No Problem—Use SMS to Connect to Your Favorite Web Services on AndroidHow To:If You're Seeing Lock Screen 'DU' Malware When Charging, Uninstall These Apps Right NowHow To:Get LED Color Effects for Music Playing on Your AndroidHow To:Generate Viral Memes Like a Pro with These Apps for Your iPhoneNews:8th Wall Adds Another Brick to Its Web AR Platform with AR Camera for Easy PrototypingHow To:Control Your iPhone Using Your EyesHow To:Get Nokia's Exclusive Camera App with Pro Mode on Any AndroidHow To:Get the Chrome Experience on Android Without Google Tracking YouHow To:Hack websites using cross-site scripting (XSS)How To:Hack web browsers with BeEFHow To:Sneak Past Web Filters and Proxy Blockers with Google TranslateNews:An Introduction to Macro Photography (Plus Some Insane Shots)How To:Use JavaScript Injections to Locally Manipulate the Websites You VisitHow To:Hack Anyone's Facebook, Twitter or YouTube Account with Your Android DeviceHow To:The Official Google+ Insider's Guide IndexHow To:Spider Web Pages with Nmap for SQLi VulnerabilitiesNull Byte:Never Let Us DieNews:Indie Game Mashup! DTIPBIJAYS + LSQOM = Scorpion Psychiatrists of SaturnCommunity Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 3 - Real Hacking Simulations