How to hack a site at the stage of collecting information?

[DronVR]

People make trivial mistakes and hackers will take advantage of this.

I want to talk about how you can search for interesting data, accesses and other information in an open form. It often happens that you don’t have to crack anything, but everything that’s ready is already on the surface. The admin did not close the directory, left the backup sites in the public domain, and there is also the opportunity to download documents with sensitive information. How to do it and what can be found - read on.

Introduction
It often happens that users come up with complex passwords, put a bunch of add-ons for protection, are paranoid about every action, but forget commonplace things. This is the essence of man. For example, leave a file with important information or access data in the root of the site. Therefore, before you begin to carry out fairly complex operations, you can start by searching for information. So I prepared interesting files that could contain useful information for us.

List of extensions for backup files:

bak, bac, old, 000, ~, 01, _bak, 001, inc, Xxx

List of interesting files to search :

jpg, png, bmp, doc, xls, rar, zip, pdf, bak, inc

We will need them further when we move on to the next stage - working with utilities.

Dirbuster
This is a great utility that helps to collect directories and hidden files on the site. The program is available in the base Kali Llinux build. There are also dictionaries that allow you to quickly scan for interesting directories. Now I will show how you can use it in practice. If you have never used dictionaries, then you need to unpack them. In Kali Linux, they are located at / usr / share / wordlists / dirbuster / . I usually use the latter.

Dirbuster dictionaries

Dirbuster interface
At the output we get the necessary folders, files with the specified extensions and many other useful data. At the output, you can get a convenient report using the "Export" button.

Scan results

Scan results
The trick is that like this, just by scanning the data, you can find logins and passwords for access, as well as files with data about employees, customers, etc. Sometimes entire directories are open on sites. And these are not invented examples, but obtained from the practice of scanning real and working sites.

Google Advanced Operators
Very cool tool. If you find a non-standard vulnerability and adapt it to google dork, then the exhaust will be very high. If you look like this, even now, without inventing a bicycle, you can find a lot of useful information. It is enough to understand the specifics of the work, and then with experience, make up your own private dorks. Let's look at a few examples.

allintext: passowrd site: site.com // shows pages where there is a keyword entry;

filetype: txt site: site.com // search for files of a certain format, which files can be read at the beginning of the article.

intitle: index.of "parent directory" // search by content title

Issuance Results

One of the results
intitle: index.of.admin inurl: admin // search the contents of the title and the presence of the word admin in the URL.

Issuance Results

One of the results
"Apache / 2.0.46 server at" intitle: index.of // you can play around with versions and get open directories. It is especially convenient when there is a certain vulnerability for a particular version

Issuance Results

One of the results
intitle: index.of index.php.bak // find files backup files

filetype: xls username password email // and last but not least, in which there are logins and passwords

In the last file, accesses to about 20 sites on WordPress. All of them have a certain trust, publications, and some of them have visitors and advertising. In total, the search took no more than 30 minutes. You have a similar opportunity to open and search for interesting and useful files. The most interesting thing is that the passwords seem to be complex, but they are still in the public domain. This happens very often.

Operators for Advanced Use of Duckduckgo
This search engine also has its own operators. You can check the requests, as well as compare them with the results of other search engines.

allintext: passowrd site: site.com // shows pages where there is a keyword entry;

intitle: index.of parent directory

filetype: xls username password email

ip: 104.27.185.0 // search by IP

In addition, it can be carried out in search engines Yahoo and Bing. Some operators for advanced use are similar, some do not work. To show the difference, you can see the screenshot:

Conclusion
In a simple way, you can find and access sites. To do this, it’s enough to be able to use the search and look a little at vulnerabilities. I think that’s all.

Source