How I was able to find PII of more than 15,000 People using the Directory Enumeration Tool…

Directory enumeration, a critical step in penetration testing, involves systematically listing and gathering information about directories and files on a target system or web server. In this blog post, I will delve into the details of using the “dirsearch” tool and share my experience of discovering sensitive information on a subdomain.

Directory enumeration is a process wherein penetration testers seek to unveil hidden or misconfigured directories and files, potentially exposing valuable information like sensitive data, configuration files, or vulnerabilities. This can be accomplished manually or through automated tools such as dirsearch, DirBuster, gobuster, and dirb, among others.

To begin using dirsearch, ensure you have Python3 and pip3 installed. The following steps outline the installation process, primarily designed for Linux distros:

Clone the dirsearch repository from GitHub:git clone https://github.com/maurosoria/dirsearch.git
cd dirsearch

2. Install required dependencies:

pip3 install -r requirements.txt

3. Verify the installation:

python3 dirsearch.py - version

Dirsearch employs a brute force method to enumerate potential files and directories from a wordlist. The default wordlist can be used or replaced with custom wordlists from SecLists, or wordlists generated by crawling URLs.
For crawling URLs and generating custom wordlists, tools like Crunch, Cewl, etc can be used.
(For more details about these tools you can check the following : https://security.packt.com/4This experience highlights the importance of robust directory enumeration practices and the power of tools like “dirsearch” in uncovering potential security risks. Penetration testers should employ such tools responsibly and ethically to identify and address vulnerabilities, ultimately enhancing the overall security posture of web applications and systems.-tools-to-create-your-own-custom-wordlist/ )

python3 dirsearch.py -u https://www.example.compython3 dirsearch.py -u https://www.example.com -w /path/to/wordlistpython3 dirsearch.py -l /path/to/list.txt“dirsearch” is performed on a URL, and not domain.Results are stored automatically in the “reports” sub-directory inside dirsearch.Extend usage to subdomains, as they may have neglected or misconfigured security on the subdomain compared to the main domain.

In a recent penetration testing scenario, I applied directory enumeration on partners.redacted.com. Within the /web/ directory, I uncovered several subdirectories, leading to the discovery of personally identifiable information (PII) belonging to over 15,000 users.

Using dirsearch on partners.redacted.comAccessing directories on partners.redacted.com

This experience highlights the importance of robust directory enumeration practices and the power of tools like “dirsearch” in uncovering potential security risks. Penetration testers should employ such tools responsibly and ethically to identify and address vulnerabilities, ultimately enhancing the overall security posture of web applications and systems.