HTTRACK: WEBSITE COPIER

HTTRACK: WEBSITE COPIER Typically, we begin Step 1 by closely reviewing target’s website. In some cases, it may be helpful to use a tool called HTTRACK to make a page-by-page copy of the website. HTTRACK is a free utility that creates an identical, offline copy of the target website. The copied website will include all the pages, links, pictures, and code from the original website; however, it will reside on your local computer. Utilizing a website-copying tool like HTTrack allows us to explore and thoroughly mine the website “offline” without having to spend additional time traipsing around on the company’s web server.

ADDITIONAL INFORMATION

It is important to understand that the more time you spend navigating and exploring the target website, the more likely it is that your activity can be tracked or traced (even if you are simply browsing the site). Remember anytime you interact directly with a resource owned by the target, there is a chance you will leave a digital fingerprint behind.

Advanced penetration testers can also run automated tools to extract additional or hidden information from a local of a website.

HTTrack can be downloaded directly from the company’s website at http://www.httrack.com/. Installing for windows is as simple as downloading the installer.exe and clicking next. If you want to install HTTrack in kali linux or your linux attack machine, you can connect to the internet. And type

Apt-get install httrack

Please note, there is also a graphical user Interface (GUI) version of HTTrack but for now we will focus on the terminal version. If you prefer to use the GUI you can always install it at a later date.

Once the program is installed, you can run it by opening a terminal and typing

Httrack

Before proceeding, it is important to understand that cloning a website is easy to trace and often considered highly offensive, never run this tool without a prior authorization. After starting HTTrack from the terminal, the program will guide you through a series of basic questions before it beings to copy the target’s website. In most cases you can simply hit the “Enter” key to accept the default answer. At a minimum, you will need to enter a project name and valid URL to copy.

Be sure to take a little time to read each question before answering or blindly accepting the default answer. When you are done answering the questions you will need to enter “Y” to being the cloning process. Depending on the size of the target website,

this can take anywhere from a few seconds to several hours. Remember, because you are creating an exact replica of the website, the amount of available disk space on your local computer needs to be considered. Large website can require extensive hard drive space. Always be sure you have enough room before beginning your copy.

When HTTrack completes the process, you will be presented with a message in the terminal that says “Done. Thanks for using HTTrack!” if you are using Kali and accepted the default options, HTTrack will place the cloned site into the directly /root/website/<project_name> you can now open Firefox and enter the address: /root/website/<project_name> into the URL bar.

Note the <project_name> will need to be substituted for the name you used when setting up your copy. You can interact with the copied website by clicking on the links in the browser. A good place to start is usually the index.html file

Firefox can be found by navigating the application menu/icon on the desktop or by opening a terminal and typing

Firefox

Whether you make a copy of the target website or you simply browse the target in real time, it is important to pay attention to details. You should begin by closely reviewing and recording all the information you find on the target’s website. Oftentimes, with very little digging, you will be able to make some significant findings including physical address and locations, phone numbers e-mail address, hours of operation, business relationships (partnership), employee names, social media connections, and other public tidbits.

When conducting a penetration test, it is important to pay special attention to thing like “News” or “Announcements”. Companies are often proud of their achievements an unintentionally leak useful information through these stories. Company mergers and acquisitions can also yield valuable data; this is especially important for expanding the scope and adding additional targets to our penetration test.

Even the smoothest of acquisitions creates change and disarray in an organization. There is always a transition period when companies merge. This transition period provides us with unique opportunities to take advantage of the change and confusion. Even if the merger is old news or goes off without a hitch, the information still provides value by giving us additional targets.

Merged or sibling companies should be authorized and included in the original target list, as they provide a potential gateway into the organization.

git clone https://github.com/xroche/httrack.git --recurse
cd httrack
./configure && make -j8 && make install DESTDIR=/

The download links I picked up from the HTTrack Official Website

https://www.httrack.com/page/2/