Hello i am back with a new tutorial how to scan website for the bugs and vulnerability using BackTrack's uniscan tool. And as we all know that backtrack is specially designed for the security researchers so there are many tools pre installed in the backtrack like sqlmap, uniscan and all.

 Follow the simple steps to find the vulnerability in any website !
Now make sure you have opened Backtrack operating system and now just open the terminal and write the bellow code in the terminal and hit okay!

cd /pentest/web/uniscan && ./uniscan.pl

Now you can see the bellow snapshot there are few options are given.

Now we have are going to use the bellow command and make sure you have the website link :)

./uniscan.pl -u http://www.website.com/ –bqdw

And your website’s URL should be end with the forward slash  and now just hit enter and then the process will start :)

Now as you can see we got the IP address and the server of the website :) and wait we will get many more information :)

Directory Check: Directory check will check the directories of the website and it will list the directories of the website as shown in the bellow snapshot.
File check : Now as the name says it will check the files which are hosted in the website.

Now crawler is started it will grab all the email address and externals hosts and all the information
 
Emails :

External Host:

Web backdoors:

File upload forums :

Now let me tell you that using this tool we can scan the websites for many more vulnerability like sql-i, XSS, remote code execution and many more and you can make few bucks by participating in the bug bounty program :)

Check out: How i got 100$ from Google bugbounty program

Now you can see in the above snapshot the list of the bugs it will find :)
Check out: The list of the bug bounty program !

Now as shown in the above we the website is vulnerable to the blind sqli. :D Mission accomplished :) we have found the bug. if you have any question about this then make a comment :)

Now if you want to get the list of the sites hosted on the same server then simply add this command, just replace the ip address with the server’s ip address. and the list of the websites will be stored in the same directory with the name “sites.txt”

./uniscan.pl -i "ip:127.0.0.1"

and then if you want to scan the list of the website then simply run this command

./uniscan.pl -f sites.txt –bqwd

Now you have done ! :)  I hope you have enjoyed this tutorial :)

How to DNS Enumeration with Kali Linux Tutorial

When it comes to web server’s penetration-testing, a DNS server is always on the top of the list because DNS server is the core gateway of an internal enterprise to the mighty internet. Information gathering, as we all know is an important part of Penetration, so gathering information about the DNS is just as important as the DNS server. Even if an attacker can enumerate a DNS server it can prove very lethal to the Organization whose information is stored on the server. In this tutorial we will be looking at several tools and their usage by which we can enumerate a DNS server in several ways. For this we will open CMD shell in BT and type cd /pentest/enumeration/dns

Then type ls The list of DNS enumeration tools will appear and we will take a look at the use of all tools.First we will use dnsenum tool.It is very easy to use this tool, just type the command in the format perl dnsenum.plIt will generate results as shown in below picture.It provided us with the list of entire IPs used by the website including the mail servers.Now the trick to extract information that we need for further phases of Pen-testing e.g if you want to test the mail server you can telnet it and exploit it by foot-printing (will be explained in upcoming tutorials). The next tool that we will use is dnswalk.It is also a very good tool for enumerating and provides with filtered information of the target.You can access it by cd dns command in dns folder. Only the difference in the input is In Dnswalk the target ends with a “.”We got the results here, as we have mentioned earlier dnswalk only provides basic information like SOA server and warnings. It is a partial enumeration testing tool.Next tool we will be digging is called dnsrecon, You can find this in the dns folder, It is a tool written python scripting.Now as you can see below that we have performed multiple operations with dnsrecon which will be explained further. You can retrieve SRV records of the target also query SOA etc.For retrieving SRV records you have to type the command ./dnsrecon.py –t srv –d target name.Now here is how the result of the srv records look like:And here’s how we query the SOA, NS and MX of the servers using the command ./dnsrecon.py –t std –d And here how the result will look like:By DNS enumeration you can gather a lot of information about the target and it can prove to be very helpful in a penetration test.