Hack Security Pro.pdf - Index of

1.Site Mapping
The first thing a hacker will do during an attack on a Web service will be to summarize the banners
(see chapter I: Information Acquisition) as well as map the site to recover a maximum of indications on
his target. Mapping a website can be done in several ways. Either the hacker will have found a
loophole allowing him to list the contents of all the directories of the server, or he will use appropriate
software which will follow all page links from the index page of the website. This is not the end of the
story, however.
What will be of interest to the hacker will be the files and directories forgotten by the webmaster and
not linked to a public page. Intellitamper is such a software that can recover the list of all files present
on the server and to use brute force on the file or directory names to find their existence. Intellitamper
functions on Windows, so we will also see the example of a PHP script attacking through a dictionary.
Intellitamper
Intellitamper is a software with a very simple interface which will enable us to map the website without
downloading the files (unlike Web aspirators). By default, it functions by following the links present on
each page from the site index. To start the software, all that has to be done is to give it the url of the
site that is to be scanned and to click on the small button in the shape of a magnifying glass. In the
example above, “http://www.thehackademy.net” is our target. By launching options by default,
Intellitamper will not use brute force to find all the directories (or files) not linked to the pages.
The Hackademy DMP -101/209- SYSDREAM