Directory Enumeration: Unveiling Hidden Paths Through Error Message Misconfiguration¶

Ah, the sweet joy of navigating web applications—kind of like a treasure hunt, but with a lot more frustration and a few potential security issues along the way. Recently, while doing my usual routine of poking around a web app during a penetration test, I encountered an intriguing challenge. The app was so smart that it redirected all unauthorized requests to a login page, effectively locking me out of any useful paths. And as if that wasn’t enough, it had DarkTrace—a fancy, state-of-the-art IDS/IPS—lurking in the background like a digital watchdog.

But hey, I’ve been around long enough to know that even the most sophisticated defense can have its little cracks. This "impenetrable" login redirection? Yeah, it wasn’t nearly enough to keep me from uncovering valuable directory information. Thanks to some subtle misconfigurations in error messages, I was able to do a little detective work and expose the hidden directories. So, let's dive in!

The Strategy: Harnessing POST Requests and Error Codes¶

So, this login redirect wasn’t just annoying—it was a redirection nightmare, throwing 302 status codes at me for every unauthorized request. The trick? You could just throw GET requests all day, and it would be like playing fetch with a brick wall. But guess what? I had other plans. Rather than repeatedly running into that 302 brick wall, I decided to mix things up with POST requests aimed at some known (or at least highly suspected) directory paths.

The real genius here was that these POST requests would bypass the redirect and, instead, trigger lovely, juicy error codes. This way, I could get more info than I ever could with a simple GET.

The HTTP Status Codes That Matter¶

Let’s break it down for the uninitiated. Here are the HTTP status codes that practically begged me to explore further:

200 OK: A valid directory exists. Finally, success! It’s like finding the key to the treasure chest.
302 Redirect: Oops! Directory doesn’t exist, but at least I’m getting redirected back to the login page. How nice of it.
403 Forbidden: Oh, so the directory exists, but I’m not allowed to see it? Classic. Time to dig a little deeper.
500 Internal Server Error: Triggering a 500 error means I’ve either broken something or the server is just being a drama queen. Either way, valuable intel!

With this strategy locked in, I whipped up a Python script to handle all the tedious checking for me.

The Code: A Closer Look¶

Step 1: Setting the Stage: Imports and Functions¶

Here’s how you begin:

import requests
import sys
import re

- requests: Because who doesn't love making HTTP calls and pretending to be a browser? - sys: For handling those lovely command-line arguments we all adore. - re: You know, for when you need to pull out the juicy bits from raw HTML.

Step 2: Retrieving Session ID and CSRF Token¶

To be fair, the first thing you need to do is grab the session ID and CSRF token, because web apps love that stuff for security. Here’s how it goes down:

def get_session_id_and_csrf_token(base_url):
    try:
        response = requests.get(base_url, timeout=5)
        session_id = response.cookies.get('JSESSIONID')

        csrf_token_match = re.search(r'name="_csrf" value="([^"]+)"', response.text)
        csrf_token = csrf_token_match.group(1) if csrf_token_match else None

        if session_id and csrf_token:
            print(f"[INFO] Retrieved session ID: {session_id}")
            print(f"[INFO] Retrieved CSRF token: {csrf_token}")
            return session_id, csrf_token
        else:
            print("[ERROR] Session ID or CSRF token not found.")
            sys.exit(1)
    except requests.exceptions.RequestException as e:
        print(f"[ERROR] Failed to retrieve session ID and CSRF token: {e}")
        sys.exit(1)

This part is like unlocking the front door with a shiny key.

Step 3: Checking Directory Existence¶

Once you have your session cookie and CSRF token (because who doesn’t want to pretend to be authenticated), it’s time to check those directories. I mean, why not?

def check_directory(base_url, directory, session_id, csrf_token):
    url = f"{base_url}/{directory}"
    headers = {
        # Headers mimicking a real browser
    }
    data = f"username=test&password=gahjkldsa&_csrf={csrf_token}"

Here we simulate a login with some fake creds. No big deal. Just testing the waters, you know?

Step 4: Bringing It All Together - The Main Function¶

Finally, you bring it all together with the main function, which does all the dirty work and checks the directories for you:

def main():
    if len(sys.argv) != 2:
        print("Usage: python3 script.py <directory_file>")
        sys.exit(1)
    # Read directories from the specified file and check each one

Don’t worry, it’s flexible. You can just throw a file with directories at it, and voilà, results.

Conclusion: The Power of Misconfigurations¶

In the end, it's clear: even the most "secure" applications have cracks you can slip through. By exploiting some misconfigured error messages and strategically crafting requests, I was able to uncover hidden directories in a web app that thought it had all the bases covered. This isn't just about finding secret paths; it's about understanding how systems fail and how we can exploit those failures—responsibly, of course.

Let this be a reminder to all of us: no matter how fancy your security system is, there's always a little misstep that could open the door to the treasure chest. And let’s be honest, there’s always more treasure to find.