Re: Website "Scanner"

[Javier Fernandez-Sanguino <jfernandez () germinus com>]

sullo () cirt net wrote:

> Quoting backed.up.by.2048.bit.encryption () hushmail com:
>  
>
> > Is there anything out there like a port scanner but for websites, where it
> > dictionary attacks the files. For example you plug in the domain:
> >    
>
> Not that I know of. The closest I can think of are two functions I have in
> Nikto, which can do two similar things currently:
> 1) guess Apache user names in a similar manner 
> For example
>   ~a
>   ~aa
>   etc
>  
Well, the user enumeration plugin could be trivially be modified to do a 
brute force attack of filenames too. The problem being, however, that 
the number of requests you are going to make are quite high (and 
increase exponentially). Maybe it would be better to try to first index 
the site (spider like), and then attempt to retrieve "mutated" 
filenames. For example, if you see index.html try: index.html.old, 
index.html.bak...

Regards

Javi