Browsing Site Using UserNames

Hi,

Today I am going to show a trick to browse the website using the username. How? Please go through the document to understand how.

Note: This method does not works always but most of the times.

Suppose you find a symlink using your favourite search engine like google. Dont laugh, yes beleive me you can!!!

example:-

http://site.com/sym/home/somename/

Now open http://www.yougetsignal.com and do the ReverseIP. So some websites get listed.

Now try to browse like http://site.com/sym/home/<website>/

If you find the somename matches with the listed websites and you can view the files of that website than this tutorial is not for you, stop reading and leave please. If above is not the case with you, please read on.

Now we are sure that  "somename" is the username and we got to find a way to find the usernames on the server. Well there are different ways to find it, I am going to discuss to how to find usernames using symnlink that you found using google or your favourite search engine.

So go here using your symlink:- http://site.com/sym/etc/group

Wow! you can see the groups, these are infact the usernames. Dont believe me, go search for creating users and groups on linux on google. Now why /etc/group file, because it is viewable and have no rectricted permissions set. 

So you now found the usernames :) cool 'eh!?

Now you can browse the different sites like http://site.com/<username>/public_html.  Remember to add "public_html" or you will get Forbidden message.

The moment you browse the URL, you can view the files of that user mapped to a website. Files of different types, index, configure, db, connection and ofcourse because you found this site in google having a symlink, there  is a possibility that you find shells. Trust me yes there are some "Smart Hackers" who left their shell  as it is to be found by the guys like you:). 

So be careful when you upload the shell, after finishing your dirty work, remove it or chmod it.

Anyway, lets come to the point now. So now you have usernames and now you can browse the different directories of different websites of that users. But how do you relate the usernames with the websites? May be the matching usernames with the matching websites you found earlier using ReverseIP.

But this is not the case for all the users and most of the times not all websites gets listed. So how you going to found the name of the website of that username. Yea I know some of you would say, " we can browse to index.php or some configuration file to find the site name" Yes sometimes you can but am sure not always.So then whats next?

Some of you would say :-

"Shit! man, I can not do a simple task, can't even browse a site!!!!. I know there is a shell, but fuck I don't know the site name. Fuck hacking, am leaving it!!! :("   You see any resemblance? NO? read on :)

Ok here is the trick:-

1. Get the IP of the server, lets say 127.0.0.1

2. Now take any username and tyoe http://127.0.0.1/~username/

Volla! I can see the website now, wow, I am able to browse the site. I got shell, I am in, I r00ted, backd00red!!

                                             G A M E   O V E R

One more thing, sometimes shell is placed here:  http://site.com/<username>/public_html/shell.php.But when you try to browse it using http://site.com/shell.php, you wont find it. That is strange! Try with my trick like this :- http://127.0.0.1/~username/shell.php Voilla!, you got shell!!! :)

                                               

By:-

Mike Waals

Mail: MikeWaals@Gmail.com