‫HTP is a stateless application layer protocol generally uses TCP Port 80 and exchanges data over the
‫World Wide Web.
‫You can fingerprint the FTP service and gain a whole lot of information about the target system.
‫To accomplish this, MSF has some HDB module's.
‫I was hired to MSF modules enumerating the FTP service information, they will also help you looking
‫at backup files on the Web server, listing directories, checking the validity of SSL certificates,
‫presenting on the Web server.
‫But mainly reconnaissance related auxiliary modules will be listed under the auxiliary scanner HTTP.
‫And one more thing about the ports is that HTP uses 80.
‫And when it comes as https, it uses port four for three, but both ports are not mandatory.
‫Why is that, you ask?
‫Well, administrators can easily change the port that the Web application is served on, so be careful.
‫You may see a Web app serving on board 6500.
‫That's nothing new for Appen Testor.
‫So let's jump into a practice session.
‫So I think you probably have many HDTV services running on your target.
‫So let's view them using the services command.
‫And you see there are a lot of HDTV services and let's have a look at the numbers in the real world,
‫it is the same.
‫But here there are only HTP services, right, so I can also look for HDB with SSL like the.
‫There, another report number comes up.
‫And just like I did before, I will search for HTP related auxiliaries.
‫Whoa.
‫OK, so there are too many modules, some of them are for applications that use HTTP or https, so it's
‫kind of hard to find some of the core modules for HTP itself.
‫So why don't we make a short list?
‫That's going to be a handy shortcut for you to start with, enumerating HTP.
‫So let's go back to services.
‫Hmm, OK, so now I want to show you something, look what you have here.
‫A Web dev service, now, this might look kind of old school to you, but you can see in the local networks.
‫This is Métis Voidable three Web dev service is also available on Métis deployable to.
‫So you can use all these modules in the lab to improve your skills, but I'll intentionally choose HTP
‫put module.
‫Show me the options.
‫Right, so this module will use http put as the method to test if the Web server allows for uploading
‫a junk file.
‫But the module one's a path variable, so I can try every possible path on the server.
‫Let's try to find a reasonable path.
‫So at this point, I'll use another module.
‫Crawler.
‫And then this module will crawl pages and lists the pads on the server.
‫Show me the options.
‫And I'll quickly set the variables.
‫Our port to 85, 85.
‫All right, so let's check.
‫And run the majo.
‫So as it finishes up, you have discovered a few paths.
‫And here, the uploads path probably is what you were looking for.
‫So what I'm going to do is I'll use this path.
‫And I'll turn back to the HDP put modu.
‫So the options again.
‫Just going to set our hosts as my variable.
‫Set path to upload.
‫Everything looks good.
‫So let's run the module.
‫And it happens very quickly.
‫There it is, your successful.
‫So now you can upload a malicious file to the Web server and call this file to get a session on the
‫server.
‫So if you follow the link, you will get this page.
‫And this proves that one can easily upload something to the server, that is what a vulnerability is.