Welcome back to the official Start Cop series.
This is the Web Application Exploitation module.
In this module, we're going to talk about Metasploit.
We're going to look at web app exploitation, we're going to look at cross-site scripting.
We're going to look at SQL injection.
Many different types of arm abilities.
Ah, this is our chapter outline.
We're going to go into an introduction of Metasploit and the Metasploit framework will look at some
different Metasploit modules.
How to generate payloads using MSF console MSF venom.
We'll get into SQL injection as well as cross-site scripting and directory listing.
So where do we get Metasploit?
Well, there's a lot of different places you can get it.
It does come preinstalled with Kelly Linux.
So if we log in to our call box and we go to the start menu and we go down to exploitation tools, notice
we have the Metasploit framework, we have it Metasploit, payload creator, social engineering toolkit,
SQL Map, all kinds of stuff.
So we can click on the Metasploit framework and it actually gives you the commands for running Metasploit.
It first has to start up a database that runs off of a PostgreSQL database.
And it sets up the a database named MSF.
Now.
Sometimes you do get compiler errors, so don't get panic.
If you see something like this, just go ahead and run it again from the command line.
You always want to make sure that you're on the latest and greatest updates.
So we want to go ahead and do a quick apt get update to.
Make sure we have the latest.
Data from the Kelly Lennox repository while that's updating will go ahead and take a look at.
Where to actually get the Metasploit framework from.
So you can go to Metasploit dot com slash download and you can go here to Metasploit and pick the version
you want.
There is a pro version which is commercially supported.
The open source version from rapid7.
This is more of the.
The easier version of running mate is flight or the.
If you want to run on windows they have a.
Desktop supported version.
So they have an MSI install.
But just be aware, when you go to install Metasploit on Windows, it will flag your antivirus.
So just be aware that of course there's you can get it on Linux.
And they provide a script to do just that.
So you have really two options for Metasploit, the Google version or the command line version, which
comes in with Kali.
And the main difference between the gooey version and the command line version is really ease of use.
If you're not real comfortable with command line, you may prefer to start out with the gooey version
initially.
Just to make it a little bit easier to run exploits.
So this is the nightly installers available from GitHub.
Of course, if you get the latest and greatest version, just keep in mind there may be bugs.
These are all things that just it does happen.
It's an exploit framework and it's constantly updated.
So for the latest and greatest version, always check back here.
This is the command you would enter to curl the Metasploit framework and then you run the Metasploit
installer with MSF install and then you have to change the permissions to.
So we can.
This is another way to get Metasploit from any Linux distro, not just call it Linux.
So let's go ahead and clear.
Make sure we don't have any extra packages lying around.
That's fine.
The best way, of course, is to copy and paste this from the site, but I'm just going to type it out.
We'll just run this part of it.
And there we go.
There's the download.
Go and clear the screen just to keep it a little bit cleaner.
You.
All right, now that we have Metasploit running, notice that it gives us a running tally.
We can see the version number right here, 5.0.93 dash developer.
We have over 2000 exploits, some of them auxiliary, which will get into them 562 payloads.
And you can actually open an interactive terminal with this as well.
We can see this is version five because it has an MSRP five.
Next to it.
So let's look at some of the different Metasploit components.
We have, the payloads portion, we have exploits, we have different types of attacks like SQL injection,
cross-site scripting and directory listing.
So the Metasploit framework is a gathering of different projects and different payloads exploits to
that can be then utilized to exploit targets.
So it's the most widely used exploitation slash penetration testing framework.
And it's a collaboration between open source and rapid7.
They not only verify vulnerabilities, they also try to improve security awareness.
So it helps not only the attackers, but also the defenders to be able to stay up to date on the latest
and greatest exploits that are out there.
So this is the MSF console, which you just saw.
It's the preferred way to be able to access it, but it's not the only supported way to access the Metasploit
framework, as we said.
You can run the gooey version, which we will look at in a little bit.
It's an all in one centralized console and allows you to efficiently access essentially all the options
in the Metasploit framework.
It can seem very daunting at first, but once you get the syntax, you'll be able to run commands much
more efficiently and most of the features.
And it's essentially the most stable Metasploit framework interface.
So these are some of the different commands.
So let's go ahead and go back.
If we type the the word banner in here, we can actually change our banner.
You can get different.
Pictures.
So things you.
This is really more of just a preference thing.
It's not really anything to do with functionality or making it better, but it is one of the options.
Now we can type the help.
Command and help will give you a basic tutorial, gives you a lot of information about the different
commands that are there.
You can change the current working directory.
If you want to exit the console, you type exit, you can actually grep the output of other commands.
You can load different plug ins.
You can check the version.
And it has some different commands for working with the database itself.
So you wanted to see what credentials you had.
They would show up here if you want to see the version.
This is the current version.
Where on.
Lots of different commands.
So.
If you want to get into scripting mode, you can type I RB.
I notice we get into an hour b shell.
So you can pick what functions you want to look at if you.
Type exit.
You can get back out to the Metasploit framework, change the banner again.
So.
If you want to launch the Web, go from here, you can type in go underscore pro and if it's installed,
it will launch the web.
Again, this these things do change from time to time.
So the web query is normally.
Installed separately.
So let's go ahead and.
So we have Metasploit installed on our Windows Workstation, which will open up here in a moment.
Now let's talk a little bit about vulnerabilities of our ability is essentially any flaw in code or
some type of weakness in software.
It could be hardware related, but.
It's a way that attackers can compromise different systems, attack vectors, vulnerabilities come out
all the time.
Vulnerabilities, or actually there's a list of vulnerabilities called the National Vulnerability Database.
If we go back to our open up our Web browser here.
Now we go to Nvidia dot nest dot gov.
This is the National Vulnerability Database.
If you're in the U.S., this is kind of one of the standardized places where new vulnerabilities come
out and they have essentially a ID number that is.
It always starts with the three letters CV and you add in the year and then the four digit number at
the end.
So and then over on the right hand side, you can see the severity or these cvss score, the common
vulnerability scoring system.
So these are individual vulnerabilities.
If you click on one, it will give you some more information about the vulnerability and even links
to the vendor website where the vulnerability is posted.
Now there may be Metasploit modules that actually show up down here, potentially.
Now, not always, but there are lots of different vulnerabilities.
We can go over to the search menu.
We can actually search for all different types we want.
We can search by number.
We can search by vendor.
Let's say we want all the Microsoft vulnerabilities.
We can actually click on that and just hit search and or turn us any vulnerability.
That it finds based on Microsoft.
Notice.
We've got
lots of different vulnerabilities here.
So you can search, you can filter.
But those are those are the vulnerabilities, the weaknesses that create attack vectors.
And where we run into problems is when there's a vulnerability and there's no fix or there's no patch,
there's no.
So attackers may use malware or payloads, as we'll get to talk about later, that use or exploit multiple
vulnerabilities.
The vulnerabilities, allow attackers to take advantage of systems, elevate privileges and potentially
take over certain systems.
So what our exploits well, exploits are what we have in Metasploit.
These are essentially.
Payloads that take advantage of some vulnerability.
But an attacker can use to take over a system.
So if we go to show exploits on Metasploit, we're going to get a whole bunch of information returned.
Usually if you just type the show command and there's too many results, it it'll ask you, are you
sure you want to show all this?
Because there's too many.
Values to return.
So it takes a little bit of time, but eventually you'll get something similar.
To this screen here.
And so the vulnerabilities will have a name, the date they were found, and they will have a description.
So keep in mind that not all of our abilities work for all systems.
These are some of the different modules.
With respect to Metasploit, you have the MSF console which is in the center here and then you have
exploits, you have payloads.
So in exploits you have different systems like Windows, Android, Unix, and then you have these auxiliary
modules which deal with.
Things like skater systems, databases, and then the payloads could be designed for particular systems
like Android.
They could be happy.
It could be a lot of different things.
So payloads are an important component to understand as well as the different Metasploit framework modules.
So you can think about payloads as the dangerous part of Metasploit.
So what is an auxiliary module?
And that's the modules used for gathering information.
So Metasploit framework has hundreds of auxiliary modules that perform scanning, fuzzing, sniffing,
and many, many more different functions.
So these models will not give you a shell, but they're extremely valuable when conducting a penetration
test, things like SQL databases and also doing men in the middle attacks.
Then you have exploit modules.
Exploit models are commonly used to convey code.
They are the actual exploit.
And these are constantly updated and developed.
So.
You can look at what these are, the things that actually make Metasploit unique versus other platforms.
This actually gives Metasploit its exploit capability.
So things like exploit modules will handle the payload, the encoding, the no operate instruction generation
and many other things.
So because there's so many exploits already in Metasploit, there's a good chance that there's already
a module you can just edit for your own purposes.
And there are lots of different samples.
That you can modify yourself within Metasploit.
So this is an example of running an exploit under.
Metasploit So if we go back over to our our system here.
Too many, too many windows open now.
Too many command windows.
Let's close one of these here.
Okay.
So.
We got our list of exploits that came back.
Is it's a very long list because we didn't specify anything in particular.
So let's go ahead and say we're going to use exploit.
Windows will say SMB.
Then if you hit tab, it'll actually give you different options about which ones you want to pick.
So let's say I wanted to use the May 17 underscore 010 underscore piece exact.
Vulnerability.
And then I hit enter.
Once I do that, notice the prompt changes here so it becomes red and now I have some different options.
So let's do a show command.
So these are the different options for this particular exploit.
So you can pick out what you want to to do what you want to be the target host or the receiving host
and the receiving port number.
And then you.
Give it a domain that you want to try and use a password.
So right now it's just made some decisions about the local host, which is the system.
I'm currently on the local port.
And right now, there's no exploit target.
So you can do different things.
So if I wanted to set.
Exploit.
I'm sorry I set our host.
And then it's going to if it has a value, it'll give that value.
This one doesn't actually have an R host variable, but that's that's very common.
So let's do the show payloads to see if we have any payloads yet.
So there's it's going to return a lot of payloads because there's a whole bunch.
And then you pick which payload you actually want to utilize.
So again, there's there's a lot of options there.
So let's look at some of the different types of auxiliaries.
So there's different scanners for SMB remote procedure call.
There's port scanners.
There's wireless auxiliary modules.
There's denial of service modules, even.
So a lot of different types of auxiliaries.
So let's talk about what a payload actually is.
A payload is a piece of software that's used to control the remote system.
So the payload is like the device you're going to detonate or, you know, it's the weapon portion of
the exploit.
So they're different depending upon what type of system architecture.
So if it's a 64 bit system versus a 32 bit.
So there's four different types of payload in Metasploit.
There's three main types and there's one that's not really a type itself.
So you have in-line or non staged.
So this is a single payload for a task that has the full exploit and full shell code.
So inline payloads are more stable because they're, they're all all in one, they're self-contained.
So some exploits, however, will not support the resolving size of the payloads.
The payload is too large.
They may not work.
Then you have a stage or a stage works with stage payloads to perform a particular task.
Stager creates a channel between the attacker and the victim and reads the execution on the remote host.
Then you have an interpreter.
Motor operator is short for meter interpreter.
It's the payload generation tool for Metasploit.
So it remains in most memory and leaves no traces on the hard drive.
So it's very hard to locate the interpreter with traditional forensic techniques.
Then lastly, we have the passive x passive axis of the payload which can help circumvent firewalls
that are restrictive.
It essentially builds a hidden Internet Explorer instance using an active X control and is able to communicate
with the attacker via Acdp request because HDP traffic generally will be allowed to pass through the
firewall.
Otherwise, there will be no internet access or no web access.
So how do we generate payloads and metasploit?
We can do this from within the Metasploit console.
So there is generate pry and reload commands.
Again, keep in mind that these tutorials do change periodically.
So what works now?
Always consult the documentation for the latest and greatest options.
You know, back into Arkansas because.
I'll go ahead and close this because this is.
Or at least minimize it because it's distracting.
Serrano use a load.
Slash windows shell find underscore TCP.
So we have the listening port and the receiving house.
So pick what target we want to be.
Well, set it to the system I'm currently hosting this virtual machine on.
And so there's the options.
And then if we want to actually.
Generate the payload, then we're going to use the generate command.
So this is do we want to force encoding?
We can set the payload size.
Any characters we should avoid and what output format we want it to be in.
And if we just type in the word generate, we can just either just use the most common default payload
and there's our actual payload.
Similar to the example here.
So let's say maybe we want to generate.
The same shell code, but as before.
Only this time we're going to tell Metasploit to remove some unwanted bytes.
So you're getting a no bite free payload.
So it tells you if you wanted to set it to verbose mode, you would get a little bit more information.
Notice the size here, 328 bytes.
So if we do this time with a generate dash B and we'll do.
Apostrophe Backslash x00 or the null byte.
Character.
Let's see what happened here.
Oh, it does happen.
I make a mistake.
And there we go.
Notice there was a little bit bigger size this time.
That's generating payloads.
How can we use this to go after web applications so we can integrate some different tools like End Map
and wmp?
And maybe find a website that's vulnerable to sequel injection.
There's also the browser exploitation framework.
Project.
All right.
Now we're going to do a sample exploit.
Or of attack or how you would attack web applications inside of Metasploit.
Keep in mind that you only want to attack applications that you have.
Permission to.
So we open up our Metasploit console.
I go ahead and clear the screen so you can see all these.
We're going to use the auxiliary.
Scanner.
ICP crawler.
And once we do that, we're going to hit enter.
And then as our text went to read, we're going to set the our host value as local host because we're
just going to run it on our local machine.
We're going to set the local port to 9000.
And then we're going to type in run to run the crawler.
And it's going to take a little while and it'll come back with some information.
All right.
Now we're going to load that map.
So this is the plug in everyone's VW map underscore sites dash a for any use local host if this is a
remote host, she loves to use the host IP and port number.
And the site has been created.
And to type the map and score sites.
Dash L.
And we see we've got some available.
Sites here now.
So now we're going to use map underscore target dash D zero.
And W map underscore run dash.
E.
Let's see.
Something went wrong with the target selection.
So again, sometimes these commands do change.
So just be aware that some time, some commands may change between versions of Metasploit.
So I had a small typo in there.
Its targets is the command.
So now I've got my target.
So now I can run my map run command.
And it's going to start doing a test against the local website.
Port 9000.
And it's going to load in those modules.
And we can see the time the testing started.
And I'll take a little bit of time to finish.
Now we're going to take a look at some SQL injection, which is also known as School II.
It's a common attack vector that uses malicious SQL code for back end databases, essentially things
that the developer or the creator of the database maybe didn't necessarily intend on being displayed.
SQL injection is very common on.
Matter of fact, one of the top vulnerabilities that is out there on OWASP.
The Open Web Application Security Project.
So if we go out to.
Our browser.
And we look up OWASP top ten, we can see that SQL injection.
Is essentially the number one flaw, not just skill, but any kind of command injection, essentially
where some information gets sent that maybe the application wasn't expecting.
So the only way to prevent these types of injections is through input sanitization, which we'll get
into a little bit later.
But OWASP has a cheat sheet for how to prevent the different.
Types of SQL injection.
SQL injection may result in the authorized viewing of passwords, maybe deleting tables or dumping out
the hashed versions of passwords, since in many cases, passwords are no longer stored in plain text.
They're stored in their hashed version.
Ultimately, if a website is vulnerable to SQL injection, then that means that an attacker can do many,
many things to exploit that site and gain access to potentially private company data.
So this is an example.
When you go to a web storefront and you click on an item, notice this item is has an ID number, and
then at the very end it has this little or one equals one.
So.
What that means is that over one equals one is always true.
So if when you're doing a select which that is the way in which you select tables of information inside
of sequel and sequel is the back end logic.
So that web page that you're viewing the store on in your browser has to convert that query to a SQL
query, and then it has to take that and essentially say select item name item description from the
table called items where the item number is nine, 99 or one equals one.
So instead of just returning that item, it's going to return everything potentially in the database.
So that's one example of a sequel injection attack using a pathology.
And we'll see how this is done.
Of course, you can manually do this, but there are automated tools that will do this as well.
So maybe in this case, the attacker sends the the web string and we're going to.
Debbie.
Debbie, Debbie.
Adopt East Tor.com slash items slash items that ASP and item ID equals 999 semicolon and then drop table.
So essentially this could be drop table users.
So if the database is vulnerable, then that website is going to convert that string into a query and
it's going to go back and it's going to delete the user tables.
You can also use the union command, which if you want to essentially get data from a database and stick
it on top of your query, you can use the union command essentially just taking two columns and putting
them on top of each other.
Unless you're if you're doing row by row, that's called a join.
So let's look at some of the tools inside of Call for doing SQL injection.
We have a tool called SQL Map and it's actually in the menu.
If you go to a Web application analysis, it's in this.
Menu right here, but we'll go ahead and look at the main page.
So SQL Map is an automatic SQL injection tool.
So the basic way of doing SQL injections you don't need to do because this will this Python script will
handle it for you.
So you basically do SQL map.
Dash, you know, the URL, you pick out what you want it to do, what sites you want it to go after.
So let's go ahead and scroll down.
And the nice thing about the main page is it even gives you some examples.
So that you can do regular expressions, you can do OS shells, you can do elevation of privileges,
lots of different things with SQL injection.
So here we have a site that we're allowed to actually go after with school maps.
So we're going to.
We're going to go after this test site.
We're going to try to enumerate what type of database it actually has.
So of course, using SQL injection for science you don't have permission for is problematic.
We're testing on a get parameter, which is a.
A GDP parameter to see if it might be vulnerable.
To cross-site scripting so you can sometimes combine.
These attacks together.
So it looks like the back end database management system is my ask.
You are and do I want to skip the payloads for other ones?
So if it finds my sequel, single map can also look at things like Postgres database, it can look at
Microsoft sequel, it can look at Oracles.
So they're very, very similar relational database management languages.
But in the order of time, we'll go ahead and skip.
And says, Do I want to include all the tests for my sequel provided level one and risk value.
So I say yes.
So it's going to run through some different testing.
And it's going to even do some blind SQL injection where it's querying with a sleep function to see
how long it takes to come back.
So blind SQL injection works in a way that essentially, if you're not getting any output, you can
send things to the screen or send commands.
Whereas even if you don't get any output return, you can just tell by how long it takes for something
to come back.
What type of database management system it might run.
So this particular one is a it is vulnerable.
So do I want to keep testing the others and we'll just say no because we already found the vulnerable
one.
So we we now have the database name.
And we have the information schema, which is the information about the different tables.
So most SQL or MySchool has a table called Information Schema Tables, which is actually essentially
the like a table of tables.
It's the information that is on the back end of the database.
So now that we have our database names, we're going to go ahead and run this command.
We're going to test out to see what actual tables we can get.
So it found out that it's greater than 5.0 and.
It did not paste correctly.
So let's try that one more time.
Now we're going to run this command with the correct parameters.
And it's trying to do a union of the table so those unable to retrieve the table names for the database,
do you want to use common table exist and check and say yes.
So this does happen.
And we're just going to press enter.
And in the number of threads we're going to do one.
Says If we run it in single thread mode, it could take a while.
So we'll pause and we'll come back when this is finished.
So our database test didn't return any tables, but we did get.
Confirmation of the database existing.
And we got a little bit of information from it.
Again, this is just a sample of how you do a website to test and see whether it's vulnerable to SQL
injection.
And there are several different other SQL injection tools like SQL Mapper, Burp Suite, many, many
other tools.
So how do we protect against SQL injection?
Well, there's, of course, source code review, and there are tools to employ to help fix the vulnerabilities
that lead to sequel injection.
You can utilize something called a secure library, which.
That will help you to an extent.
Another option is to.
Utilize prepared statements.
Sanitise your inputs.
Make sure that you only allow.
Sanitised inputs and appropriate characters.
Certain characters that are unsafe.
You need to make sure that your developers know to filter those things out.
Of course, checking account permissions to the database is also important.
Using strong passwords for your essay and any administrator accounts you have.
Intrusion detection systems and improvement prevention systems like SNORT can also go a long way to
help protect against sequel injection.
Because SQL injection is such a.
Dangerous threat to proprietary data, company data, private data.
All these things that attackers might seek to exploit to get access to other systems.
So ultimately, you want to use the best.
Protection possible.
OWASP recommends use of prepared statements which are parameter IIS queries instead of taking direct
input from the user.
I put parameters instead of the just raw input data store procedures, which are essentially just groups
of signal statements that can be used of course.
Input, validation and escaping user supplied input.
So waitlist is really a secondary defense.
So now let's talk about some of the other types of our abilities cross-site scripting.
This is otherwise known as X, s s.
This is a one of the most well known application layer attacks.
And if you want to look and see.
Just how bad some of these vulnerabilities can be.
We can go over to exploit DB AECOM, not the Google hacking database, but we can actually search cross-site
scripting and we can see that they are still vulnerable.
Are they are still showing up even today.
And then we have SQL injection as well.
So if SQL injection is still alive and well, and if you click on one of the exploits, you can actually
just copy the code and run it on a vulnerable website.
So these are for this particular content management system.
So SQL injection can be done with minimal tools.
And of course, we've talked about the legal repercussions and then we have cross-site scripting.
So cross-site scripting is usually done by storing some information on a page that gets run client side.
So you have client side versus server side.
Client side is basically the browser.
The server side is of course the back end logic where everything is stored at.
So the idea of cross-site scripting is to be able to modify a web application to run some code, maybe
install some content on a page, and cross-site scripting attacks can be done via the.
Web page itself, or it can be sent via email.
Many different ways of getting a cross-site scripting attack onto a web application.
So this is the basic flowchart.
You've got the attacker and the user.
The attacker puts the malicious script on a vulnerable website.
The user takes the vulnerable website and sends data to the attacker.
And then the malicious script can also go into the backend database and steal data and whatnot.
So there are some different types of cross-site scripting attacks.
There's the stored cross-site scripting attack or type one.
These are usually persistent where the input is stored on the server, such as a database in a message
forum, maybe in a blog post.
So essentially the victim retrieves the stored data from the application without that data being made
safe in the browser.
Then there's the reflected cross-site scripting, which is also known as non persistent or type two.
This is essentially when user input gets immediately returned by the web application in an error message,
search result or any other response that includes some or all of the input.
So all of these attacks essentially come down to the concept of malicious code running on your site,
for example, JavaScript.
So the ability to execute arbitrary JavaScript on another user's browser can allow attackers to perform
theft of things like session cookies, session IDs, log keystrokes.
It could be even used in phishing attacks so an attacker could send a fake login form.
Through direct object manipulation, which is the the third type, which is otherwise known as type
zero.
But this is essentially where the entire.
Data flow or the source of data is in direct object access and it never leaves the browser.
So the attacker will set a form in a web page to target his own malicious server and trick the user
into submitting sensitive information.
So you might ask, how can attacks like this succeed?
Well, reflected attacks might seem harmless because it requires the victim to actually send a request
containing a malicious string since nobody would willingly attack themselves.
Well, there seems to be no way of performing the actual attack.
As it turns out, there are at least two common ways to get a victim to launch a reflected attack against
their self.
So an attacker can send a malicious URL to the victim, either via email or instant message, and trick
him into visiting it.
If the user targets a large group of people, he could potentially put the link to his own website or
and be honest, social network like Facebook or maybe on a site that a lot of individuals from his target
the company visit.
The attacker will craft a URL containing the malicious string and send it to the victim.
The victim was tricked by the attacker into requesting that URL from the website.
The website gets the request but doesn't include the malicious string in the response.
So now the browser looks at the JavaScript and says That's legitimate.
I'm going to run that.
I'm going to run that code.
And the browser executes the malicious script, thus sending the victim's cookies to the attacker's
server.
Now let's look at how this actually works in.
But in a sample environment or a test environment.
We're going to go to first before we do that.
There's actually a website called Cross-Site Scripting.
It's essentially all the different attacks, information on cross-site scripting and submit data now.
But you can see all the different sites that have been.
Victim to cross-site scripting, the L.A. Tribune, Microsoft, Harvard, every major site at one point
or another has had.
This type of threat.
So let's open up the cross-site scripting game and this is actually a free website.
You can actually run this yourself.
I've done this demo before, and in this case I'm just going to.
Write some code to pop up an alert message.
And essentially that alert message is everything that is contained within this script.
Now, imagine if you were to write this on a on a box, on a website, and as long as the code is valid
and as long as the box is big enough, then potentially you can run this vulnerability on a vulnerable
site.
Forgot the.
This should be.
I noticed that we were able to pop up an alert box on the screen, which means that we were effectively.
Taken over the website or the site is in fact vulnerable.
So there are different hints here you can use and it'll tell you to see the source of the application.
You can right click and you can view the actual code of the website and see that it is actually vulnerable.
And it'll show you other hands, too, like when you when you change different tags to the code.
So what if you were to modify this inside of the developer options on Chrome?
The script and then something to learn.
So we go to the next level and this one, this is actually just a sample blog that is vulnerable.
So the welcome page has a HTML in it.
So you'll notice that this is a telltale sign that this does not escape.
Strings properly.
So we can't do a script tag on this one.
We have to do an element with a JavaScript attribute.
So there are lots of different cross-site scripting tools that are out there.
If we want to be able to
prevent cross-site scripting, we can go to OWASP and they have a whole cheat sheet for doing just that
and different ways to be able to prevent.
So essentially never allow untrusted data inside of the script, always do premature eyes, quite make
sure you properly escape your untrusted data so you convert what they mean by escaping as you're going
to take your unsafe characters like Ampersand and convert it to the Ampersand amp semicolon and you're
less than symbol into this ampersand less than sign.
So that's properly escaping.
Characters, of course, there's other things you can do.
And the libraries that call this will.
We'll help you.
Using a secure library will help you prevent some of these.
But whatever you're going to do, make sure that you use a secure library.
There's lots of different cross-site scripting tools like OWASP, Zap, Zen Attack, Proxy, Burp Suite
and many others.
So again, never insert untrusted data except in allowed locations.
Make sure you do those escape characters, escape your JavaScript properly.
Sanitize your HTML inputs with a library that's meant for that.
Use a CDP only cookie flags.
So the way there's a browser extension is very useful, and I actually want to give that to you guys
as well.
It's called edit this cookie, and I believe that they have it for most of the browsers as well.
Essentially, it's one of the most popular cookie editors for Chrome, and it allows you to edit cookies,
export cookies.
And essentially on this site we're currently on, we can see all of the cookies that are here in the
browser.
So and what they're used for and the type of cookies or whether they're HTP only or whether they're
secure and the different flags that are set on them.
So it's a very useful tool for cookies.
Then let's talk about directory listing.
So a directory listing.
Is a function that essentially displays all the files when there is not a index file like index TCP
IP.
Or something like that.
So Web servers, you know, have to have if they don't have the record page, an attacker will be able
to more easily find things.
So if you go to a website without specifying a file, that request is going to get processed by the
web server and it's going to return back that index file.
The index does not exist.
Then the web server must return a list of the contents.
So this could be something like the directory structure on Windows.
So for example, if we go to this website.
Then close some of these tabs down.
So this is one example of what would be returned from a vulnerable website.
So if it returned something like this, the directory and it also notice at the bottom it gives you
the version of Apache and what library it's actually running.
This can be advantageous for an attacker to be able to get directory information.
So things like passwords, database connections, logs, those types of information can be found from
directory listings.
So there's not really a good reason to provide directory listings and disabling them may at least put
some level of protection against an attacker.
So you want to configure whatever web server that you're using to prevent directory listings for all
paths beneath the web route and place into that directory an index dot h HTML or some type of index
file that the website will display instead of returning a directory listing.
So in summary, we talked about in the Metasploit framework and the ability to conduct exploits and
pen test systems.
We looked at the various payloads interfaces that can be used.
We talked about vulnerabilities and vulnerability, how they lead to exploits.
And so exploits are part of Metasploit, but there are some exploits that are custom that are outside
of Metasploit.
We looked at how Metasploit should.
Shows you the different exploits that are available and how they map to different vulnerabilities.
We also looked at payload creation and generation.
So once you create a payload, you can send payloads by email, SMS, drive by download and many other
ways.
We also looked at some of the auxiliary modules for doing things like data collection, port mapping.
Etcetera.
So we looked at the different stages in attacking a web application using and map.
That would be a map.
We looked at Metasploit.
And how Metasploit can integrate with the browser exploitation framework.
We also looked at ways in which we could discover databases that are vulnerable to signal injection.
We can use Google Dorking or the Google Hacking database as well as SQL Map to automate the process
of enumerating Web servers.
These are some of the acronyms.
This is not an all inclusive list, but there are many more.
To add to our already growing list of acronyms for this course.
Now let's do some practice questions.
So what are the little programs which are used to perform malicious act to actions on a particular vulnerability
in order to get into a system called.
A vulnerability.
B A payload.
C MSF or.
D Exploits.
Answer.
It is exploits deep.
These are the vulnerabilities or the the malicious code or the malicious action to exploit the vulnerability.
Number two, which one of the following is not a type of payload in line b stagger c multi-line or D
interpreter?
Answer is c multi-line so inline stagger and interpreter are types of payloads and metasploit.
Then we have number three.
What is the module in Metasploit which is used to generate payloads without accessing the Metasploit
console?
MSF venom, MSF, MSF, DV, IRM or MSF console.
The answer is, of course, a massive venom.
So if you want to generate payloads outside of the Metasploit console, you can do that.
Number four, what is the module which is used to embed the payload with the exploit?
Is it console virus maker, a rapper or an even better.
Answer is see the rapper.
Number five, which of the following is not a security exploit?
A eavesdropping.
B Cross-Site scripting.
C Authentication or signal injection?
Or E none of the above.
The correct answer is C.
Authentication.
Authentication is not a type of exploit.
It is a type of security parameter.
Eavesdropping is where you're listening on someone else's communication, either via email sniffing.
Tapping someone's cell phone, things like that.
And then, of course, we talked about cross-site scripting and sequel injection.
And that is the end of the Web application, vulnerability module and exploit module.
I appreciate your attention and hope you learn a lot about exploit development, Metasploit Cross-Site
Scripting, and we'll see you in the next module.