Scanning for vulnerabilities in web applications Welcome to the video enumerating Web sites.
In this video we will review how we can use and map to identify sites running Web services within our
network.
Use a free tool called whap Gleiser to figure out what technologies are running on a given Web site
and we also look at a few internet resources that are useful for identifying this type of port and service
information.
In this final section of the course I wanted to expand upon what we've been learning about network and
vulnerabilities scanning by putting us a little deeper into the mindset of a penetration tester.
For example you might end up working for a security firm that does web application penetration tests.
And so one skill you should have is the ability to identify what various technologies are running on
a Web site so that you can better gauge what kind of attacks you want to run against it.
Before we start down that path though let's back up and do a little review in some of the past videos
we covered how we can use and map to output results into three different formats.
Let's review that command again.
First I'm going to look at my subnet stop T6 t to make sure it contains all the targets in scope for
eventual penetration testing.
Then I'm going to run and map space TAC lowercase i capital L and reference the subnet statics t file
then I'm going to add a tack lower lowercase o capital A and then the name of what the output file will
be.
I'll just call this targets because and map will automatically add the appropriate extensions of SML
and map and G and map next.
Let's review how we used the SML output in combination with a tool like eyewitness to take screenshots
of any webservices found in our and map scan to do that.
We call eyewitness by its full path.
And for me that's in the slash Opt. slash eyewitness folder and then we add a TAC X followed by the
SML file we just created and then we add a tak tak web to the end.
When eyewitness's done doing its operation we'll be asked if we want to open the report.
So we'll type Y and press enter.
And here we can see I-Witness has taken a screenshot of what looks to be an Apache Tomcat server and
a link router.
Now along the left side here we get a little bit of additional information such as the page title and
potential server version.
We've also covered a bit of the unmap script engine and how we can leverage those scripts to really
dig deep into a host's services for detailed information.
For example I'll run and map plus TAC tax script space HTP TAC in-room NSC Plus the IP of the target
host followed by TAC P 1880 which specifies the port the services running on this HTP noom script does
some fingerprinting of the web service and gives us a little more information about it.
And again as we've covered in the past and map has many scripts you can run both for H TDP as well as
a whole slew of other services to probe your host for a trove of information.
However when it comes to assignments you might receive as a penetration tester you're likely going to
be testing applications in the cloud and you will probably want to do some initial recon on the site
to learn about the technologies that the applications use.
But you want to tread carefully here.
In my opinion you shouldn't actively scan a customer's site until the engagement formally begins.
But the good news is you can gather a lot of good enumeration data either through Web sites that collect
this information or plugins you can install in your browser.
For example let's open up a browser and go to built with dotcom built with makes it easy for you to
figure out naturally what technologies sites were built with.
So I'm just going to type in 7 mins SEC here which is my corporate Web site and we can see that built
with returns a ton of useful information including the type of analytics and tracking tools I use installed
widgets the content management system javascript libraries and even some information about my DNS configuration
email hosting and SSL certificate provider this information can be incredibly helpful not just for web
penetration testing but a more broad engagement where you might be tasked with sending phishing emails
to an organization.
For example if someone was doing a fishing campaign against seven minute security users they could craft
a realistic looking message that asks users to change their office 365 password and the attacker would
likely have success because an average user could think oh I have Office 365 so I better click this
link right now.
Anyway back to Neumar raiding Web sites.
Another good site I like for this type of info gathering is W3 TX dot com.
It has the same kind of setup.
We simply type in a URL click site info and W3 Tex spits out a nice table of information with the Web
site's summary how long it has been online.
The content management system it's using etc..
Now I personally find it handy to be able to glean some of this web technology information with just
a single click right from within my browser.
So I want to show you a plugin called whap Elisir.
You can find it pretty quickly by doing a search for Apple Isar on Google and then I'm just going to
kind of follow the link trail here to get this installed for my browser.
Once appetizer is installed it will passively gather information about every site we visit so let's
Google for a wasp Jew shop which is one of my favorite tools for practicing web application pen testing.
It looks like their main site is hosted over at a wasp dot org and now that the site is loaded in my
browser Let's click this little icon in the far right of our address bar and will see that weap Lizer
has identified this site as running media wiki.
Version 1 2 7 2.
It uses Google Analytics.
It's running on an Apache server and is based in THP having the software version of 6:59.
In this case can be really handy as we might then want to hop over to a site like exploit D-B like we
have in past videos and we can search for any exploits that might be available for that specific version
of Media wiki.
I highly recommend you take some time and do your homework on your targets using these kind of sites
and plugins so that you can have a more efficient and focused penetration test.
Once it begins in our next video we'll look at a built in tool called nikto to find a low hanging Web
site vulnerabilities.