Hands-On Web Penetration Testing with Metasploit

Enumerating files

Enumerating files and directories is one of the most important steps during a pentest activity. A small misconfiguration on the server's end can lead us to the following files:

• Hidden files
• Backup files
• Config files
• Duplicate files
• Files containing juicy information, such as credentials files, password backup, error logs, access logs, and debug trace

Information contained in such files can help us to plan further attacks on an organization.

The following are a few auxiliaries that are available in the Metasploit framework that can help us to gather information:

• dir_scanner
• brute_dirs
• prev_dir_same_name_file
• dir_listing
• copy_of_file
• Backup_file

Here are some examples of the aforementioned auxiliaries:

1. We can look for ...