Skip to content

Commit 15a29a1

Browse files
h00dieh00die
committed
finished up comments
1 parent c13e024 commit 15a29a1

File tree

5 files changed

+90
-54
lines changed

5 files changed

+90
-54
lines changed

‎documentation/modules/auxiliary/scanner/http/cert.md

Lines changed: 48 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,6 @@ Just set target RHOSTS and THREADS values and let it do its thing.
1313

1414
## Scenarios
1515

16-
**Running the scanner**
17-
1816
```
1917
msf > use auxiliary/scanner/http/cert
2018
msf auxiliary(cert) > set RHOSTS 192.168.1.0/24
@@ -30,4 +28,51 @@ msf auxiliary(cert) > run
3028
[*] Scanned 256 of 256 hosts (100% complete)
3129
[*] Auxiliary module execution completed
3230
msf auxiliary(cert) >
33-
```
31+
```
32+
33+
## Confirming
34+
35+
The following are other industry tools which can also be used.
36+
37+
### [nmap](https://nmap.org/nsedoc/scripts/ssl-cert.html)
38+
39+
```
40+
# nmap -p 443 192.168.2.137 -sV --script=ssl-cert
41+
42+
Starting Nmap 7.60 ( https://nmap.org ) at 2018-02-24 13:20 EST
43+
Nmap scan report for ubuntu (192.168.2.137)
44+
Host is up (0.0029s latency).
45+
46+
PORT STATE SERVICE VERSION
47+
443/tcp open ssl/http Apache httpd 2.4.18 ((Ubuntu))
48+
|_http-server-header: Apache/2.4.18 (Ubuntu)
49+
| ssl-cert: Subject: commonName=ubuntu
50+
| Issuer: commonName=ubuntu
51+
| Public Key type: rsa
52+
| Public Key bits: 2048
53+
| Signature Algorithm: sha256WithRSAEncryption
54+
| Not valid before: 2018-01-26T21:38:21
55+
| Not valid after: 2028-01-24T21:38:21
56+
| MD5: d2a7 364d 636a 6eee c3e1 7af9 05f7 8c5b
57+
|_SHA-1: a5bf f783 2514 90ee 365a 3ee4 9b6c 23f6 24af dbfa
58+
MAC Address: 00:0C:29:5B:CF:75 (VMware)
59+
```
60+
61+
### [sslscan](https://github.com/rbsec/sslscan)
62+
```
63+
# sslscan 192.168.2.137
64+
Version: 1.11.11-static
65+
OpenSSL 1.0.2-chacha (1.0.2g-dev)
66+
67+
Connected to 192.168.2.137
68+
69+
Testing SSL server 192.168.2.137 on port 443 using SNI name 192.168.2.137
70+
```
71+
...snip...
72+
```
73+
Subject: ubuntu
74+
Issuer: ubuntu
75+
76+
Not valid before: Jan 26 21:38:21 2018 GMT
77+
Not valid after: Jan 24 21:38:21 2028 GMT
78+
```

‎documentation/modules/auxiliary/scanner/http/dir_scanner.md

Lines changed: 34 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -8,29 +8,10 @@ This module scans one or more web servers for interesting directories that can b
88
2. Do: ```set RHOSTS [IP]```
99
3. Do: ```run```
1010

11-
Let the default dictionary included in Metasploit set, set our target, and let the scanner run.
12-
1311
## Scenarios
1412

15-
**Running the scanner**
16-
1713
```
1814
> use auxiliary/scanner/http/dir_scanner
19-
msf auxiliary(dir_scanner) > show options
20-
21-
Module options (auxiliary/scanner/http/dir_scanner):
22-
23-
Name Current Setting Required Description
24-
---- --------------- -------- -----------
25-
DICTIONARY /usr/share/metasploit-framework/data/wmap/wmap_dirs.txt no Path of word dictionary to use
26-
PATH / yes The path to identify files
27-
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
28-
RHOSTS yes The target address range or CIDR identifier
29-
RPORT 80 yes The target port (TCP)
30-
SSL false no Negotiate SSL/TLS for outgoing connections
31-
THREADS 1 yes The number of concurrent threads
32-
VHOST no HTTP server virtual host
33-
3415
msf auxiliary(dir_scanner) > set RHOSTS 192.168.1.201
3516
RHOSTS => 192.168.1.201
3617
msf auxiliary(dir_scanner) > run
@@ -51,4 +32,37 @@ msf auxiliary(dir_scanner) > run
5132
msf auxiliary(dir_scanner) >
5233
```
5334

54-
A quick scan has turned up a number of directories on the target server that could be certainly investigated further.
35+
## Confirming
36+
37+
The following are other industry tools which can also be used.
38+
39+
### [dirb](http://dirb.sourceforge.net/)
40+
41+
```
42+
# dirb http://192.168.2.137 /usr/share/metasploit-framework/data/wmap/wmap_dirs.txt
43+
44+
-----------------
45+
DIRB v2.22
46+
By The Dark Raver
47+
-----------------
48+
49+
START_TIME: Sat Feb 24 12:56:40 2018
50+
URL_BASE: http://192.168.2.137/
51+
WORDLIST_FILES: /usr/share/metasploit-framework/data/wmap/wmap_dirs.txt
52+
53+
-----------------
54+
55+
GENERATED WORDS: 2351
56+
57+
---- Scanning URL: http://192.168.2.137/ ----
58+
==> DIRECTORY: http://192.168.2.137/.../
59+
==> DIRECTORY: http://192.168.2.137/Joomla/
60+
==> DIRECTORY: http://192.168.2.137/cgi-bin/
61+
==> DIRECTORY: http://192.168.2.137/error/
62+
==> DIRECTORY: http://192.168.2.137/icons/
63+
==> DIRECTORY: http://192.168.2.137/oscommerce/
64+
==> DIRECTORY: http://192.168.2.137/phpmyadmin/
65+
==> DIRECTORY: http://192.168.2.137/security/
66+
==> DIRECTORY: http://192.168.2.137/webalizer/
67+
==> DIRECTORY: http://192.168.2.137/webdav/
68+
```

‎documentation/modules/auxiliary/scanner/http/dir_webdav_unicode_bypass.md

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,6 @@
11
## Description
22

3-
The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list folders or read, create, or modify files, via a %c0%af (Unicode / character) at an arbitrary position in the URI, as demonstrated by inserting %c0%af into a "/protected/" initial pathname component to bypass the password protection on the protected\ folder, aka "IIS 5.1 and 6.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1122. More info about this vulnerability can be found [here](http://cve.mitre.org/cgi-bin/cvename.cgi?name=2009-1535).
4-
5-
CVE: CVE-2009-1535
3+
The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list folders or read, create, or modify files, via a %c0%af (Unicode / character) at an arbitrary position in the URI, as demonstrated by inserting %c0%af into a `/protected/` initial pathname component to bypass the password protection on the protected\ folder, aka "IIS 5.1 and 6.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1122. More info about this vulnerability can be found in [cve-2009-1535](http://cve.mitre.org/cgi-bin/cvename.cgi?name=2009-1535).
64

75
## Verification Steps
86

@@ -11,12 +9,8 @@ CVE: CVE-2009-1535
119
3. Do: ```set THREADS [number of threads]```
1210
4. Do: ```run```
1311

14-
You can keep the default DICTIONARY and HTTP404S dictionary settings, set our RHOSTS and THREADS values and let the module run.
15-
1612
## Scenarios
1713

18-
**Running the scanner**
19-
2014
```
2115
msf > use auxiliary/scanner/http/dir_webdav_unicode_bypass
2216
msf auxiliary(dir_webdav_unicode_bypass) > show options
@@ -62,5 +56,3 @@ msf auxiliary(dir_webdav_unicode_bypass) > run
6256
[*] Auxiliary module execution completed
6357
msf auxiliary(dir_webdav_unicode_bypass) >
6458
```
65-
66-
The scan can find vulnerable servers. This vulnerability can potentially allow attacker to list, download, or even upload files to password protected folders.

‎documentation/modules/auxiliary/scanner/smb/smb2.md

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@ The SMB2 scanner module simply scans the remote hosts and determines if they sup
1111

1212
## Scenarios
1313

14-
**Running the scanner**
1514
```
1615
msf > use auxiliary/scanner/smb/smb2
1716
msf auxiliary(smb2) > set RHOSTS 192.168.1.150-165
@@ -27,4 +26,4 @@ msf auxiliary(smb2) > run
2726
[*] Scanned 16 of 16 hosts (100% complete)
2827
[*] Auxiliary module execution completed
2928
msf auxiliary(smb2) >
30-
```
29+
```

‎documentation/modules/auxiliary/scanner/smb/smb_enumshares.md

Lines changed: 6 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -11,27 +11,10 @@ The smb_enumshares module, as would be expected, enumerates any SMB shares that
1111

1212
## Scenarios
1313

14-
**Running the scanner**
14+
### Uncredentialed
15+
1516
```
1617
msf > use auxiliary/scanner/smb/smb_enumshares
17-
msf auxiliary(smb_enumshares) > show options
18-
19-
Module options (auxiliary/scanner/smb/smb_enumshares):
20-
21-
Name Current Setting Required Description
22-
---- --------------- -------- -----------
23-
LogSpider 3 no 0 = disabled, 1 = CSV, 2 = table (txt), 3 = one liner (txt) (Accepted: 0, 1, 2, 3)
24-
MaxDepth 999 yes Max number of subdirectories to spider
25-
RHOSTS yes The target address range or CIDR identifier
26-
SMBDomain . no The Windows domain to use for authentication
27-
SMBPass no The password for the specified username
28-
SMBUser no The username to authenticate as
29-
ShowFiles false yes Show detailed information when spidering
30-
SpiderProfiles true no Spider only user profiles when share = C$
31-
SpiderShares false no Spider shares recursively
32-
THREADS 1 yes The number of concurrent threads
33-
USE_SRVSVC_ONLY false yes List shares only with SRVSVC
34-
3518
msf auxiliary(smb_enumshares) > set RHOSTS 192.168.1.150-165
3619
RHOSTS => 192.168.1.150-165
3720
msf auxiliary(smb_enumshares) > set THREADS 16
@@ -55,7 +38,10 @@ Error: 192.168.1.150 Rex::Proto::SMB::Exceptions::ErrorCode The server responded
5538
msf auxiliary(smb_enumshares) >
5639
```
5740

58-
As you can see, since this is an "###uncredentialed" scan, access is denied a most of the systems that are probed. Doing a "###credentialed" scan produces much different results.
41+
### Credentialed
42+
43+
As you can see in the previous scan, access is denied a most of the systems that are probed.
44+
Doing a Credentialed scan produces much different results.
5945

6046
```
6147
msf auxiliary(smb_enumshares) > set SMBPass s3cr3t

0 commit comments

Comments
 (0)