- [Instructor] In the mapping phase,
we can take a few different approaches.
We can do a manual crawl.
We can also do an automated crawl,
which, most time, is called spidering,
and we can take a hybrid approach,
doing a manual and automated.
We'll talk more about that in a minute.
Remember, the idea of the mapping phase
is to uncover all of the corners
of the application we want to attack.
Sometimes the approach is determined
by the actual application.
For instance, if the application is using a technology
that is not understood or compatible
with an automated scanner or crawler,
then you would need to move to a manual approach.
I would normally start out first
by using an automated scanner, commercial or open-source.
This tool will follow each link in the application
to determine its full scope.
Manual scanning is literally the process
of clicking each link throughout the application
to map it out.
You can also take that hybrid approach.
What this means is that you click
through some of the application
to give the automated scanner an idea of where to look.
From there, the scanner will dig deeper
and report back what it finds.
So in the mapping process, we need to have a starting point.
This is with manual or automated approaches.
So, for instance, our starting point would normally be
the root of any site, so the fist page or the index page.
Here, you can see were starting with Hackazon.net.
The index page will typically have links on it
that will lead us to the next level of pages,
so, in a manual process, we would essentially start clicking
on these different links, like FAQ, Contact Us,
Wish List, the registration page,
and while we're mapping, we're gonna be building out
our map of all the pages,
so, under Contact Us, there may be phone or email.
Each of these individual pages also have some sort of link
to lead us to the next level,
so this is a way a normal web scanner might work.
We would also follow the same method for manual mapping.
Another approach we can take is
to just brute force the files and folders.
This method takes a dictionary list
of commonly found pages and folders
that you would find in websites on the internet,
and what it does is it sends a request for each of them.
As it gets back responses,
the tool will report pages that were found.
These are typically indicated by a 200 response.
This method is good for finding hidden pages
that a spider might miss,
and we would normally not find manually.
The mapping process is walking through the application
to map out all the menus and links
that are included in the scope.
A good way to do this is to proxy your browser
through an application like Burp Suite.
This way, you can capture all of the application traffic
while browsing through Burp Suite.
From there, you can utilize those results in your attacks.
Let's take a look at how we do this.
First, we'll open up Burp Suite.
We need to turn off the interception feature of Burp Suite
so that we collect all of our data
instead of stopping and having
to forward the request each and every time.
Next, we need to make sure our browser
is configured to use the proxy.
We can see here in Burp Suite, in HTTP History,
right now, we don't have anything to look at,
so let's start browsing our application.
Again, the application that we're gonna be using
in most of these demos is Hackazon.net.
Now, what we wanna do is just start browsing
through the different sections of the website.
Maybe put some test data into the forms and submit.
Doesn't have to be correct.
We're just collecting data at this point.
Click on a few of the items, maybe add one to a cart.
That should be enough.
Now let's go back over to Burp Suite.
Here, we can see in HTTP History
all of the web requests and responses that we've sent,
and if we go over to the target tab,
we can actually see how the Burp Suite application
built out a map of the website for us.
This is exactly what we're trying to do
in the mapping phase.
So, from here, we can move on
to our vulnerability discovering phase.