So simply by sending requests to every single possible I. P. By increasing the X.
Value in here we will be able to discover all of the
valid clients or all of the life clients on the network.
You can also change the Y. Value to discover the ports running on these clients
and we can do all of this using the intruder
which you've already seen how we can use and once I
do it now you will see how simple it is and
how similar it is to other uses of the intruder.
The only difference is we're using it in
a different example to achieve a different goal.
So I'm going to right click this request and send it to the intruder
and in the intruder. As you know.
First of all we're gonna clear the S signs so we can
tell the intruder what to modify in each request that it sends
and what we want to modify. Is this number right here. So as we said the X.
In here in order to discover all of the computers that are
connected to the same network as the server hosting the vulnerable application.
So to do that we're simply going to highlight the
number one in here and click on add the sign.
And this way we're telling it that we're gonna be
modifying this value with every single request that you send.
We're keeping the 80 80 as is so that we're actually going to
discover the devices in the same network that have ports 80 80 open.
If you want to cover other ports you would
have to highlight this and add the sign again and
then use the cluster bomb attack we covered this
before and you saw that it takes much longer.
Therefore I'm actually just going to keep it to modifying only one value in here.
So we're keeping this sniper and we're just gonna go
to the payloads we're gonna keep the set to set one
because we're using the sniper and the cluster bomb you
would have to set different options for one and two.
But like I said we cover that before so there's no need to cover it now for the payload
type we're actually just gonna select numbers because as
you know the I PS can only consist of numbers
and we're gonna start from one and end at 254.
As I mentioned this is nothing that we are guessing I. P.
Ranges start at one and end at 254.
So we're simply just going with the default and we're gonna set the step
to one so that we basically send a request to every single possible I.
P. Within the same range.
If we don't get a valid response that's fine.
That means we don't have a device that is
connected to the network that is running that part.
If we do get a valid response then we have discovered
that device and we can go ahead and browse it.
So as you can see as a result we're going to
be sent in 250 for requests and you want to make
sure that you're actually you are l encoding this request that
is being sent in here so control you and that's it.
We're basically done. We're gonna click on start attack.
You want to leave this running for a while.
As you can see it sends a request to every single possible I. P.
Because that's what we can figure that to do.
And we can find the valid responses that indicate the existence of
a valid running service by analyzing the status and the length.
So you can see for number one in here that's
the one that we actually use to discover the vulnerability.
You can see if we click on the response.
We have the response in missing parameter and we can
see it right away without even looking at the response.
The status is 400 unlike everything else.
Also the length is different because the response had a different length
so you're gonna have to go through all of the requests that were sent to the target
and see the ones that have a different status
than the normal one and a different length.
Now obviously you can make that easier by simply clicking on the
status in here and it's gonna order it based on the status.
And as you can see request number 167 which was sent to 1921680167
gave us a 404 response.
Now a lot of us are familiar with that response which basically means that
the response is saying page not found but like I said this is still good
that means that there is a service running on the I. P.
That is Is 1921680167 on Port 8080.
Therefore when we sent a request to this specific path we
got a response telling us that this page is not found.
But that means that there is something running in there that sent that response.
So it's very different to what we get everywhere
else where we simply just got a response telling us
that we could not connect to the server or even
if it's giving you a less informative message you can see
that the responses in here are not useful at all
which indicate that there is nothing running on the I.
P. That that is being requested in the request in here. Whereas we have the 167 I. P.
And the one I. P. Even though they're sending us errors.
These errors are valid http errors or valid errors in general
that indicate that there was something running on the I.
P. That was sent in the request on the specified I. P. And on the specified ports.
So all we have to do right now is simply send a request to a device that has this I. P.
Right here and from there see what we can discover.
So I'm gonna right click this and send it to the repeater.
And we're gonna go to my repeater
make it bigger. And we know if we send this now
we're actually get something saying not found as I said we know that this I. P.
Is valid because it is responding to us.
So you could go ahead and use the intruder and manipulate
the value in here and discover other open ports or try
to send requests in here after this and see what you
can discover what paths you can discover or what endpoints.
Now a very easy one that you could test is admin
and if we send it
and render the response you will notice that we managed to gain access to
an admin control panel and we have the users in here Carlos and winner.
And as I said earlier you will be able to use this
admin page and do everything that it allows you to do.
As you can see this is a simple one.
But in a real life scenario, admin pages usually allow you to do so much more.
Again similar to what we've seen earlier,
if you wanted to use the functionality within this
page you're gonna have to right click whatever link
that you want to run copy the link address and then send it as a forged request.
Exactly as shown in the previous lecture because as we mentioned earlier,
what we're doing right now is we are exploiting a
server side request forgery and the target server as human.
It's server one in here will not communicate with you directly.
Therefore, even though we have the admin page loaded in front of us,
we can't click on the links in there.
We have to get the link that we want to run,
create a forced request as shown in the
previous lecture and then get the vulnerable web
application to get the server that is hosting it to send it on behalf of us.
That way we're exploiting the trust that is established between this server and
this server and therefore the request will actually be executed on the target.