Top 31 Metasploit Auxiliary Scanner Tutorials - Kali Linux

 

CASE 1:

This module queries the FrontPage Server Extensions and determines whether anonymous access is allowed.
use auxiliary/scanner/http/frontpage_login
set rhosts IP_Address
set rport 80
run
[*] http://IP_Address/ may not support FrontPage Server Extensions
[*] Scanned 1 of 1 hosts (100% complete)

CASE 2:

This module identifies the existence of possible copies of a specific file in a given path
use auxiliary/scanner/http/backup_file
set rhosts IP_Address
run

CASE 3:

use auxiliary/scanner/http/http_version
set rhosts IP_Address
run
[*] IP_Address:80 Microsoft-IIS/8.0 ( Powered by ASP.NET )
[*] Scanned 1 of 1 hosts (100% complete)

CASE 4:

Discover active pcAnywhere services through TCP
use auxiliary/scanner/pcanywhere/pcanywhere_udp
set rhosts IP_Address
run

CASE 5:

This module is based on et’s HTTP Directory Scanner module,
with one exception.Where authentication is required, it
attempts to bypass authentication using the WebDAV IIS6
Unicode vulnerability discovered by Kingcope.
use auxiliary/scanner/http/dir_webdav_unicode_bypass
set rhosts IP_Address
run
[*] Using code ’404′ as not found.
[*] Found protected folder http://IP_Address:80/Rpc/ 401 (IP_Address)
[*]     Testing for unicode bypass in IIS6 with WebDAV enabled using PROPFIND request.

CASE 6:

This module identifies the existence of files in a given
directory path named as the same name of the directory.
use auxiliary/scanner/http/file_same_name_dir
set rhosts IP_Address
run
[-] Blank or default PATH set.

CASE 7:

This module attempts to authenticate to an HTTP service.
use auxiliary/scanner/http/http_login
set rhosts IP_Address
run
[-] http://IP_Address:80 No URI found that asks for HTTP authentication

CASE 8:

Collect any leaked internal IPs by requesting commonly redirected locs from IIS.
use auxiliary/scanner/http/iis_internal_ip
set rhosts IP_Address
run

CASE 9:

Simplified version of MS09-020 IIS6 WebDAV Unicode Auth
Bypass scanner. It attempts to bypass authentication using
the WebDAV IIS6 Unicode vulnerability discovered by Kingcope.
use auxiliary/scanner/http/ms09_020_webdav_unicode_bypass
set rhosts IP_Address
run

CASE 10:

Checks if an HTTP proxy is open. False positive are avoided
verifing the HTTP return code and matching a pattern.
use auxiliary/scanner/http/open_proxy
set rhosts IP_Address
run

CASE 11:

Display available HTTP options for each system
use auxiliary/scanner/http/options
set rhosts IP_Address
run
[*] IP_Address allows OPTIONS, TRACE, GET, HEAD, POST methods
[*] IP_Address:80 – TRACE method allowed.
[*] Scanned 1 of 1 hosts (100% complete)

CASE 12:

This module identifies files in the first parent directory
with same name as the given directory path.
Example: Test /backup/files/ will look for the following files /backup/files.ext .
use auxiliary/scanner/http/prev_dir_same_name_file
set rhosts IP_Address
run
[-] Blank or default PATH set.
[*] Scanned 1 of 1 hosts (100% complete)

CASE 13:

This module identifies the existence of additional files by
modifying the extension of an existing file.
use auxiliary/scanner/http/replace_ext
set rhosts IP_Address
run
[*] Using code ’404′ as not found for .bak files.
[*] Using code ’404′ as not found for .txt files.
[*] Using code ’404′ as not found for .tmp files.
[*] Using code ’404′ as not found for .old files.
[*] Using code ’404′ as not found for .htm files.
[*] Using code ’404′ as not found for .ini files.
[*] Using code ’404′ as not found for .cfg files.
[*] Using code ’404′ as not found for .html files.
[*] Using code ’404′ as not found for .php files.
[*] Using code ’404′ as not found for .temp files.
[*] Using code ’404′ as not found for .tmp files.
[*] Using code ’404′ as not found for .java files.
[*] Using code ’404′ as not found for .doc files.
[*] Using code ’404′ as not found for .log files.
[*] Using code ’404′ as not found for .xml files.
[*] Scanned 1 of 1 hosts (100% complete)

CASE 14:

Scrap defined data from a specific web page based on a
regular expresion.
use auxiliary/scanner/http/scraper
set rhosts IP_Address
run
[*] [IP Address] / [Microsoft Internet Information Services 8]
[*] Scanned 1 of 1 hosts (100% complete)

CASE 15:

This module launch a sqlmap session. sqlmap is an automatic SQL
injection tool developed in Python. Its goal is to detect and
take advantage of SQL injection vulnerabilities on web applications.
Once it detects one or more SQL injections on the target host,
the user can choose among a variety of options to perform an
extensive back-end database management system fingerprint,
retrieve DBMS session user and database, enumerate users,
password hashes, privileges, databases, dump entire or
user specific DBMS tables/columns, run his own SQL SELECT
statement, read specific files on the file system and much more.
use auxiliary/scanner/http/sqlmap
set rhosts IP_Address
run

CASE 16:

This module test for authentication bypass using different HTTP verbs.
use auxiliary/scanner/http/verb_auth_bypass
set rhosts IP_Address
run
[*] [IP_Address] Authentication not required. / 200
[*] Scanned 1 of 1 hosts (100% complete)

CASE 17:

Identify valid users through the finger service using a
variety of tricks.
use auxiliary/scanner/finger/finger_users
set rhosts IP_Address
run
[*] IP_Address:79 No users found.
[*] Scanned 1 of 1 hosts (100% complete)

CASE 18:

Detect anonymous (read/write) FTP server access.
use auxiliary/scanner/ftp/anonymous
set rhosts IP_Address
run
[*] IP_Address:21 Anonymous READ (220 Microsoft FTP Service)
[*] Scanned 1 of 1 hosts (100% complete)

CASE 19:

This module will test FTP logins on a range of machines and
report successful logins. If you have loaded a database plugin
and connected to a database this module will record successful
logins and hosts so you can track your access.
use auxiliary/scanner/ftp/ftp_login
set rhosts IP_Address
run
[*] IP_Address:21 – Starting FTP login sweep
[*] Connecting to FTP server IP_Address:21…
[*] Connected to target FTP server.
[*] IP_Address:21 – FTP Banner: ’220 Microsoft FTP Service\x0d\x0a’
[*] IP_Address:21 FTP – Attempting FTP login for ‘anonymous’:’IEUser@’
[+] IP_Address:21 – Successful FTP login for ‘anonymous’:’IEUser@’
[*] IP_Address:21 – User ‘anonymous’ has READ access
[*] Successful authentication with read access on IP_Address will not be reported
[*] Scanned 1 of 1 hosts (100% complete)

CASE 20:

auxiliary/scanner/http/webdav_scanner
set rhosts IP_Address
run
[*] IP_Address (Microsoft-IIS/8.0) WebDAV disabled.
[*] Scanned 1 of 1 hosts (100% complete)

CASE 21:

use auxiliary/scanner/http/webdav_internal_ip
set rhosts IP_Address
run

CASE 22:

use auxiliary/scanner/http/webdav_website_content
set rhosts IP_Address
run

CASE 23:

For more on webdav myexploit recommend
http://carnal0wnage.attackresearch.com/2010/05/more-with-metasploit-and-webdav.html

CASE 24:

use auxiliary/scanner/http/dir_scanner
set rhosts IP_Address
run
[*] Detecting error code
[*] Using code ’404′ as not found for IP_Address
[*] Found http://IP_Address:80/Rpc/ 404 (IP_Address)
[*] Found http://IP_Address:80/aspnet_client/ 404 (IP_Address)
[*] Found http://IP_Address:80/rpc/ 404 (IP_Address)
[*] Scanned 1 of 1 hosts (100% complete)

CASE 25:

use auxiliary/scanner/http/ssl
set rhosts IP_Address
run
[*] IP_Address:443 Subject: /CN=WIN8SERVER
[*] IP_Address:443 Issuer: /CN=WIN8SERVER
[*] IP_Address:443 Signature Alg: sha1WithRSAEncryption
[+] Certificate contains no CA Issuers extension… possible self signed certificate
[+] Certificate Subject and Issuer match… possible self signed certificate
[*] IP_Address:443 has common name WIN8SERVER
[*] Scanned 1 of 1 hosts (100% complete)

CASE 26:

The “mssql_ping” module queries a host or range of hosts on
UDP port 1434 to determine the listening TCP port of any
MSSQL server, if available. MSSQL randomizes the TCP port
that it listens on so this is a very valuable module in
the Framework.
use auxiliary/scanner/mssql/mssql_ping
set rhosts IP_Address
run

CASE 27:

The SMTP Enumeration module will connect to a given mail server and use a wordlist to enumerate users that are present on the remote system.
use auxiliary/scanner/smtp/smtp_enum
set rhosts IP_Address
run

CASE 28:

use auxiliary/scanner/smtp/smtp_version
set rhosts IP_Address
run

CASE 29:

The “snmp_enum” module performs detailed enumeration of a
host or range of hosts via SNMP similar to the
standalone tools snmpenum and snmpcheck.
use auxiliary/scanner/snmp/snmp_enum
set rhosts IP_Address
run

CASE 30:

The endpoint_mapper module queries the EndPoint Mapper
service of a remote system to determine what services are
available. In the information gathering stage, this can
provide some very valuable information.
use auxiliary/scanner/dcerpc/endpoint_mapper
set rhosts IP-Address
set THREADS 55
run
[*] Connecting to the endpoint mapper service…
[*] b85afe70-a6d5-4259-822e-2c84da1ddb0d v1.0 TCP (49152) IP-Address
[*] a500d4c6-0dd1-4543-bc0c-d5f93486eaf8 v1.0 LRPC (LRPC-c9b26c881cadc33e19)
[*] 87f226c3-ec14-4325-8a99-6a46348418af v1.0 LRPC (WMsgKRpc01E39F1E2)
[*] 12e65dd8-887f-41ef-91bf-8d816c42c2e7 v1.0 LRPC (WMsgKRpc01E39F1E2) [Secure Desktop LRPC interface]
[*] 541b0ce0-c70b-1067-b317-00dd010662da v1.0 LRPC (LRPC-f46a818864cada72bb)
[*] 541b0ce0-c70b-1067-b317-00dd010662da v1.0 LRPC (LRPC-f46a818864cada72bb)

CASE 31:

The dcerpc/hidden scanner connects to a given range of IP
addresses and try to locate any RPC services  that are not
listed in the Endpoint Mapper and determine if
anonymous access to the service is allowed.
use auxiliary/scanner/dcerpc/hidden
set rhosts IP_Address
run
============================================================

OWASP ASVS 2.0 Cheat Sheet for Application Penetration Testers

The primary aim of the OWASP Application Security Verification Standard (ASVS) is to normalize the range in the coverage and level of rigor available in the market when it comes to performing web application security verification. The ASVS standard provides a basis for verifying application technical security controls, as well as any technical security controls in the environment that are relied on to protect against vulnerabilities such as Cross-Site Scripting (XSS) and SQL injection. This standard can be used to establish a level of confidence in the security of Web applications. It is composed of 13 categories containing 168 check points to validate in your application. Of course not all are applicable but the global method is wide enough to cover most of web applications.

As a member of OWASP and regularly performing Security oriented Code-Review in various languages, the Application Security Verification Standard became the basis on which I rely to deliver security reports to my customers and a proper way to measure the confidence you can put in the application. This article is not about presenting ASVS which I trust you can discover by yourself on the website of OWASP, but it is only to share a worksheet I have been using along with the document written by OWASP.
This spreadsheet takes the shape of a checklist you can browse in order to assess the level of confidence of the application. In this article I will enclose this spreasheet and explain how I am using it. You can directly download the cheatsheet at the end of the post.
Basically the spreadsheet is really simple but I have never seen it elsewhere. You have one tab sheet for each category of the ASVS. For each category the criteria is documented with its ASVS Level and description in full text. Then your job will be to fill in the rest of the field as follow:

• Valid (Valid/ Non valid / Not Applicable)
• Source Code Reference (If the code is not valid, insert the reference to the files/lines which lack of security)
• Comment (Field to comment the vulnerability and keep track of changes with developers)
• Tool used (If the vulnerability was found using a tool , you can include the name of the tool / version and sometimes the output)

Once you’ve done that, do not forget to tag the irrelevant critieria with Non Applicable,  and the report located in the first tab sheet will be automatically generated as well as the radar graph, you can directly enclose in your analysis document or report.
Ideally this assessment should be done before any major release of your software, especially if you work with Agile methodology. It should be part of your recipy before shipping to validate this worksheet. Along the security analysis you can share this document with developers to keep tracks of change and also keep the graph at each release to see the evolution of security of your application through time.
LibreOffice Version ASVS-2-0.ods
Excel Version ASVS-2-0.xls
(I built this spreasheet using LibreOffice, I’m sorry if it looks broken in Excel… You can kickstart to offer me a MSOffice license :P)

How to config VA/PT tool OpenVas in to Kali Linux

On the market exist lot of good scanners and all of them are excellent, but unfortunately
most of available scanners are paid and this relevant fact hinder some students of understanding how to analyze and invade remote machines . Nonetheless, a good free scanner exists and using it allow  you find out any possible flaws : OpenVAS. In fact, OpenVAS is so good like Nessus, Retina or any other famous scanner, and learn it is an easy mission.
Whereas there're some details about OpenVAS configuration,it follows a quick start procedure to configure OpenVAS and use it a.s.a.p. on Kali Linux.


root@hacker:~#openvas-mkcert -f
root@hacker:~#openvas-mkcert-client -n om -i
 
(The next command is going to require you enter a New password)
root@hacker:~#openvasad -c 'add_user'-n admin_linuxmagazine -r Admin
 
(These next two steps could take a long time)
root@hacker:~#openvas-nvt-sync
root@hacker:~#openvassd
 
(Onward)
root@hacker:~#openvasmd
--
rebuild
root@hacker:~#openvasmd -p 9390 -a 127.0.0.1
root@hacker:~#openvasad -a 127.0.0.1 -p 9393
root@hacker:~#gsad --http -only --listen=127.0.0.1 -p 5555
root@hacker:~# /etc/init.d/openvas -administrator restart
 
Restarting OpenVAS Administrator: openvasad.
root@hacker:~#/etc/init.d/openvas-manager restart
 
Restarting OpenVAS Manager: openvasmd.

Now, you must open a browser and go to:

http://localhost:5555

If everything installed you will get TOOL UI and you can use it as your VA/PT tool.

.