[Music]
hello everyone
welcome to the http enumeration
section where we're going to be covering
how to perform http enumeration with
nmap as more specifically
using the nmap scripting engine and the
various scripts that come pre-packaged
with nmap
now we're going to have multiple videos
that will cover http enumeration that's
because of the
extreme you know variability that you
have in terms of the nmap scripts
that are specific to http that are
available
so for example if i list out all the
nmap scripts available within the user
share and map scripts directory
that are targeted towards http right so
i'll just pipe this and i will say grip
and we'll use the expression http and
we'll just display them so
right off the bat you can see we have
plenty of nmap scripts uh that you know
are targeted towards http
and the the the immediate thing you'll
be able to tell here is they all perform
something different and that's primarily
why we're going to have multiple videos
now we're not going to be covering how
to use all of the scripts we're going to
be covering how to use the most
important scripts in regards to how much
information
you can actually get out or off your
target using this script so
again we're primarily going to be
focused on the enumeration section right
or the enumeration aspect where we're
trying to
enumerate information from the target
we're really not trying to exploit it or
do anything
like brute forcing and stuff like that
and of course you can experiment with
these scripts
but again if you just browse through the
directory and list all the http scripts
here you can see
they're primarily nuanced or they're
going to be nuanced based
on the target you're dealing with and
the web technology that you're dealing
with so
for example we have a script here that
is targeted towards adobe cool fusion
right
which is again is only going to work on
on systems that have
the cold fusion um that have called
fusion running
you then have an http apache negotiation
script
again which will actually uh will
perform a scan and will actually perform
the
the negotiation with apache uh you then
have
let's see we have cold fusion again um
we have then we have drupal we have all
the various cms
scripts so we have drupal i believe we
also have some joomla scripts we have um
http icloud find my phone scripts um
let's see what else do we have here a
few more important ones
we have a tp-link directory traversal
script very helpful uh for all the
routers all the tp-link routers
that were actually susceptible to this
particular vulnerability that still
haven't been patched
allow you to actually navigate the the
actual directory
i believe it runs apache or some
modified version of apache
you then have all your various
vulnerability scanning scripts that
are sorted out based on their cves which
is very helpful so if you are
dealing with a target that is
potentially vulnerable and you're aware
of the cve
uh code that is you know related to that
particular vulnerability you can perform
the scan to test
and see if the target is vulnerable to
that particular vulnerability or is
vulnerable to that particular to that
particular exploit
um you then as i said you have important
scripts like http wif detect which
detects a firewall
http fingerprint which detects what web
application firewall is running
et cetera et cetera now this video where
we're going to be starting off with the
essentials right so
let's get started with understanding
what http methods
are currently uh operational or are
running on the server or are activated
on the server
now you might be thinking yourself well
i just saw all of these really cool
scripts why are we taking a look at
the http the http method script
now http methods uh if you're not
familiar with http
already uh http methods essentially deal
or are used to again denote certain bits
of functionality on the surface for
example
we have the put http header we have the
delete http other we had
post which allows us you know to to send
data so on and so forth get
actually gets a request so on and so
forth you should be already familiar
with this
but the important thing is to understand
which one of these
methods are running on the web server
and then given the results of that
um and or given the response we're able
to then understand
uh for example if we have the put http
method enabled that means you know we
can modify files if we have the delete
http method then you know again we can
we can essentially modify files delete
files
access files potentially uh access uh
you know certain directories that have
directory listing enabled
so on and so forth so we're going to
perform a simple scan here
and we're going to say nmap and we'll
say we don't want to perform a ping
sorry that is pn
we'll perform some service version
detection we're targeting port 80
we'll use t4 the timing template t4
and we'll say script http methods
right and we want to pass on some script
arguments so we say script args
and that is going to be http methods
dot test all and this is going to ensure
we test all the potential methods that
are currently available and we'll say
nmap
nmap.scanme.org right we're going to use
that same target
and i'm going to hit enter now
and we're just going to let that scan
complete
all right so the scan is complete and
you can see first of all
we get these uh we we actually get the
banner here but you know we're running
apache which we should already
know um and immediately for the http
methods
we can see we have get head post and
options and options of course is the the
is the method that allows us to actually
enumerate uh info
all the other information like what
other methods are running so
on this particular web server you can
see we pretty much have a standard
setup where you know we can we can we
can we can perform requests or we can
requests we we can actually request all
the various web pages on on
on on the server and then of course we
have the ability to send data
but in terms of directory listing you
can see we don't have put or
um we don't have the put method or the
delete method which means we
we pretty much don't have anything
interesting regarding uh
functionality and whether or not we can
actually start modifying files
on the web server so that is how to use
the http methods script now of course
we're going to be taking a look at a few
uh
more interesting scripts that will again
shed light on
various types of vulnerabilities and
again will allow you to gather a whole
lot more information
from your target based on what it's
running exactly and we'll take a look at
a few targets so that's going to be it
for this video
and i'll be seeing you in the next video
[Music]
you