Hack Tools

How to Recon and Exploit Web Applications Using Penblood Tool?

Penblood is a web information gathering and vulnerabilities assessment tool. It can help penetration testers in mapping the attack vectors. The tool is capable of collecting the following information automatically.

Banner grabbing
Port scanning
DNS look
WHOIS record
Traceroute
Zone transfer lookup
CMS identification
Admin panel and external links identification
Directory and files fuzzing
Shodan search and hosts lookup
Reverse IP scanning
Subdomain data extraction

Besides information gathering, the Penblood tool is also capable of finding SQL and WordPress-related vulnerabilities. Bruteforce analysis and plugins security assessment are the core WordPress security auditing features of the Penblood tool.

How to Install Penblood Tool?

Penblood is a Python tool supported by Linux and Windows operating systems. The source code of the tool is available at the following two different Github repositories.

https://github.com/cr4shcod3/pureblood (# Created in 2018)
https://github.com/LinterexEvilCommunity/penblood (#Forked in 2020)

The updated version of the tool can be downloaded using the following link.

 git clone git clone https://github.com/cr4shcod3/pureblood

The tool requires some additional modules like Python-Whois, DnsPython, and Shodan to perform the information gathering tasks. All such modules and packages are mentioned in the requirements.txt file that can be executed using the following command.

pip install –r requirements.txt

How Penblood Tool Works?

The following Python command opens the main menu of the tool.

python3 penblood.py

As we can see in the screenshot, there are three main sections on the home page of the tool. The first section represents the information gathering modules. The second part holds the web auditing features. The last section comprises miscellaneous utilities.

Information Gathering Modules

If we open the information-gathering section, we see the following list of modules that can be used to collect variable information.

Each module can be set into action by selecting its sequence number. Before proceeding with any of these modules, set the target web application using the Select Target (#95) option from the list.

Once the target is selected, running the other modules is a fairly simple process. Each module automatically runs by simply typing its sequence number in the command prompt. For instance, we can perform the banner grabbing by typing ‘1’ in the terminal. The resultant banner record appears on the screen as shown in the following snapshot.

Similarly, we can check the reverse IP hosting record by providing the respective (reverse IP) sequence number in the list.

The port scanning feature requires an additional upper limit to scan the desired range of ports. Once the maximum limit is provided, the tool scans and presents all the available TCP ports in the following format.

The process of running the rest of the information gathering modules is similar to the aforementioned examples.

Web Attack Modules

The Penblood tool consists of two main web attacks (or auditing) categories. The web attack menu can be seen in the following screenshot.

The WordPress attack feature consists of WordPress brute-force attack, plugins auditing, and WordPress vulnerabilities assessment using the WPScan tool integration.

The SQL injection is a very handy attack option available in the tool. We can run the SQL injection test after selecting the target as mentioned previously.

After setting the target host, execute the SQL injection utility from the list. If the target web domain is vulnerable to SQL injection, the tool displays the backend database and table information.

We can further explore the vulnerabilities in the database by executing the target link in the terminal with slight parameter modification (replacing php?id=3 with php?id=-3). The tool tries to find out the vulnerable columns in the target database. The data exposed during this process can be viewed in the following screenshot.

The backend table information is also exposed during the scanning.

We can take this vulnerability assessment one step further by typing the table and column names. For instance, the example database shows an Accounts table with uname and passwd columns. These columns possibly hold the secret credentials. We can dump the content of these columns using the following commands.

The screenshot shows that the respective columns contain usernames and passwords in hash format. The password cracking tools like John the Ripper and Hashcat can be brought in to decrypt these ciphered credentials.

Conclusion

Penblood is a decent information gathering and SQL vulnerabilities assessment tool. The WordPress vulnerabilities assessment scope of the tool is dependent on the WPScan framework. Although the tool offers a lot of information gathering features, some modules like the port scanner lack the ability to gather and present detailed information.

How to Use Eazy Modules for Web Information Gathering Tasks?

Information gathering is the foundation to the web-security testing pyramid. A stronger foundation (wealth of information) means less difficulty in staging the next phases of the penetration testing cycle. However, web application firewalls and Cloudflare-like technologies make the web information gathering process difficult. There are only a few tools with the ability to bypass these security challenges and get the desired in-depth information. In this article, we shall analyze the Eazy tool that claims to provide the desired web information along with vulnerabilities assessment features.

The Eazy tool is loaded with multiple information gathering and vulnerabilities assessment modules. Each module is a standalone utility maintained by different developers. The information-gathering modules are dominant as compared to the vulnerabilities’ auditing modules. The Eazy tool’s information-related modules can gather the following important information with good accuracy.

WHOIS record
Ports information
Subdomains results
Directory search
External links finding

HOW TO GET EAZY TOOL?

The Eazy tool is a combination of Python modules that can be downloaded from Github using the following command.

git clone https://github.com/devcrax/Eazy

All the modules’ scripts come pre-packed with the cloned Eazy directory.

HOW TO MANAGE EAZY TOOL?

The Eazy tool can be operated from the core Python file in the package. Navigate to the tool’s directory and run the (Eazy.py) file using the following command.

cd Eazy
python2 Eazy.py

The above command opens the Eazy terminal to run Eazy modules scripts and get the results. We can get an overview of all the modules using the help command.

help

Apart from the aforementioned modules, there are some exploitation scripts related to WordPress and Prestashop technologies.

WHOIS RECORD EXAMPLE:

Information gathering with the Eazy tool is pretty simple. We can type the module name and –help argument to get the syntax for each command. For example, we can see the command structure and supported arguments for the WHOIS module using the following command.

whois --help

We can use the WHOIS module with the following command syntax to get the domain information.

whois -u <target URL>

For example:

whois  -u webscantest.com

The above screenshot shows all the important domain-related passive information that can help penetration testers in narrowing down the enumeration and attack schemas.

BRUTEFORCE ATTACK EXAMPLE:

Some of the Eazy tool modules rely on the brute-force technique to fetch the results. The tool has a built-in wordlist directory with some decent wordlist files as shown in the following screenshot.

These wordlists can be manually updated with the latest keywords to get the best brute-force results. We have tested the existing wordlist files for the Admin console finder and Directory search module. The admin module wordlist consists of 4K+ entries. The module managed to find the existing admin panel on the target web server in a few seconds.

The directory scan results were also satisfactory.

PORT SCAN EXAMPLE:

Port scanning is one of the critical penetration testing tasks as it gives an insight into different possible entry points for the target web application. The Eazy port scanner utilizes the Nmap services to find all the open ports and the associated services using the SYN scanning mode.

Eazy DORK EXAMPLE:

Dorking is a technique used to find information that is kept hidden from the public for security reasons. Security researchers use the technique to find the web flaws that are vulnerable or exploitable. Though the Eazy dork module is not as efficient as some other dedicated dork frameworks, the tool gives decent results for target strings or keywords.

NMAP EXAMPLE:

Nmap is a key integrated module in the Eazy tool. We can use the Eazy-Nmap utility for the following information and vulnerability assessment tasks.

We have tested the Nmap-SQLi feature. The module managed to find some links on the target web domain that is vulnerable to SQL injection.

MISCELLANEOUS EXAMPLES:

Besides the aforementioned modules, there are many other modules that can be used to get useful web information. For instance, we can use the page link module to grab all the outgoing links on a target web page.

WordPress and Prestashop-related modules can be used to find CMS-related vulnerabilities.

CONCLUSION

Eazy framework is a decent collection of information gathering modules. Though there are some security audit features, the tool lacks the ability to be used as a standalone vulnerabilities analyzer. The available vulnerability scanner modules support only WordPress and PrestaShop CMS with very limited scope.

The Absolute Best Way To Install OpenVAS On Kali Linux

If you need to conduct vulnerability assessments or need to do some scanning as part of a penetration test you would be doing yourself a disservice if you didn’t include OpenVAS as one of your top tools. This resource was created to help you install OpenVAS for Kali Linux and get using it most efficiently.

OpenVAS is the Open Vulnerability Assessment Scanner, developed and maintained by Greenbone Networks. It offers multiple security assessment options, such as authenticated tests, unauthenticated tests, internet protocols verification, industrial protocols validation, and custom vulnerabilities analysis. The OpenVAS scan engine can take a single target IP or range of IP addresses to find vulnerabilities in target hosts. The vulnerabilities are divided into low, medium, and high-level categories using the Common Vulnerability Scoring System (CVSS). A detailed audit report is generated for each scan, showing the discovered vulnerabilities and remediation techniques.

How to Install OpenVAS for Kali Linux?

The OpenVAS Linux installation requires OS packages update before installing the scanner. The update process can be completed using the following command.

sudo apt-get update

The next step is to install the OpenVAS scanner using the following command.

sudo apt install gvm –y

Note: The earlier OpenVAS installations were performed using the ‘sudo apt install openvas –y’ command. However, the installation process has been modified to replace the openvas with gvm.

The installation process may take a while to install all the OpenVAS dependencies.

Once the installation process is completed, run the following setup command to auto-configure the scanner.

sudo gvm-setup

The OpenVAS secret credentials are also generated during the setup process. These credentials are required for the OpenVAS web interface login.

How OpenVAS on Kali Linux Works?

The gvm-start command activates the OpenVAS web User Interface (UI) at 127.0.0.1:9392.

sudo gvm-start

Typing the UI address in the preferred browser opens the following OpenVAS admin page. Provide the credentials obtained during the GVM setup phase to sign in to the OpenVAS dashboard.

The following screenshot gives a broader overview of the OpenVAS dashboard. The taskbar in the following screenshot shows all important tabs.

Each tab contains different functions and features populated in a drop-down menu. In order to scan a host or network, the OpenVAS requires the IP or range of IP addresses of the target host/network. Click on the Targets option from the Configuration tab menu as shown in the following snapshot.

The action opens the new target window with multiple configuration options. Provide a name and IP address of the target host machine as shown below.

Note: We have used the Metasploitable machine configured at 10.0.2.6 to demonstrate the OpenVAS working.

After configuring the target, navigate to the Scans tab and click on the Tasks menu to schedule the scanning process.

Click on the new task option.

A new task window pops-up with target selection and different scanning options. Select the desired target; provide a name to the newly created task, and save the changes.

Refreshing the Tasks menu shows all the tasks along with their name and status as shown in the fowling screenshot. Although there is an option to schedule the task, we can force start the scanning process by clicking the run button under the Actions column.

The scanning process takes some time, depending on the scope of the used scanning methodology and the target. The task snippet takes the following shape after running all the tests and completing the scanning process.

Clicking the campaign displays an overview of the scanning process and major findings.

The Results, Vulnerabilities, and Reports are the main sections to explore and analyze the scanning results. A brief summary of these sections is presented below.

Results: If we click on the Results option, we see a graphical representation of the results classified into low, medium, and high-level vulnerabilities.

The classified results can further be explored by clicking on the graphs. For instance, if we click on the red-colored portion, all the high-level (severe) vulnerabilities are displayed in the following manner.

Vulnerabilities: The Vulnerabilities section presents the vulnerabilities in more detail. Different graphs are generated to give a broader overview of the scan results.

The discovered vulnerabilities are recorded in the following format.

The detailed results about each security breach along with suggested remediation is provided upon clicking a specific vulnerability from the record.

Reports: From the Reports section, we can export the scan results in different formats as shown in the following screenshot.

CONCLUSION

OpenVAS maintains a database of more than 50000 Network Vulnerability Tests (NVTs) feed to keep its scanning capabilities updated and effective against the advanced vulnerabilities. It offers rich scanning options to find security flaws in networks, servers, applications, devices, and internet protocols. The scanner generates in-depth reports to help penetration testers in finding the security bugs and suggest possible mitigation solutions.

How to Find Targeted Directories and Files Using Dirsearch Tool?

Penetration testing without information gathering is incomplete. Information is required to narrow down the attack vectors. In the case of web penetration testing, ethical hackers need to understand the web design topology in order to enumerate and attack the target web server or application. This includes the backend web content and links that form the frontend of the web host. The manual collection and validation of all this information is a towing job. However, there are tools available to automate the process. There are web fuzzers like wfuzz or traditional web traversal tools, such as Dirsearch to collect desired content or links from target web services. This article is about Dirsearch, a command-line tool that helps penetration testers to extract the hidden files from the directories and sub-directories of the target web server. The tool comes with a predefined long list of file extensions stored in the form of a wordlist in the Dirsearch source package. It applies the brute-force technique to go through each directory, sub-directory, and links on the target server. The .php, .htm, .xml, .tar, .zip, .txt, and .pdf are some common example extensions listed in the precompiled wordlist. The tool has the ability to ignore specific files or directories during the scan process.

Dirsearch Installation

The Dirsearch installation is a fairly simple process.

1) Download the source code from Github using the following command.

git clone https://github.com/maurosoria/dirsearch.git

2) Navigate to the dirsearch directory to locate the requirements.txt file.

cd dirsearch

3) Finally, execute the requirements.txt file using the following Python3 command.

pip3 install -r requirements.txt

How Dirsearch Works?

The Dirsearch has a rich help menu that can be explored using the following command.

python3 dirsearch.py --help

The help menu can be categorized into five sections. The first section is an options menu showing all the necessary parameters to write and execute the commands.

There are certain settings options listed in the help menu. The dictionary settings show different flags that can be used to refine the basic scan functionality of the Dirsearch tool.

The connections settings include options to customize the communication process between the Dirsearch tool and the target web server.

The general settings represent mostly the optimization parameters.

The last section of the Dirsearch help menu shows different formats to store the scan results. The default output format is the text file containing all the scanning results.

Dirsearch Scan Examples

The following command is the basic format of scanning the target web server without any filters.

python3 dirsearch.py -u <target web server>

The command directs the tool to scan all the directories, sub-directories, and files available on the target web host. We can run the command against a demo web server (webscantest.com) to analyze the scanning process.

python3 dirsearch.py -u https://webscantest.com

The initial screen shows important information regarding the scanning procedure, such as the wordlist size; target file extensions; the number of threads; request methods; errors log file; and output file location.

In the next phase, the tool starts the brute-force process and compiles the following data results.

(i) Directories, subdirectories, and files’ paths discovered during the scanning process.

(ii) Status code for each valid file.

(iii) Size of each directory, sub-directory, and discovered file.

Data refining or filtering is a handy feature in the Dirsearch tool. We can use different parameters to include or exclude certain file types or directories during the scanning process. For example, we can tell the scanner to exclude the .php extensions using the following command.

python3 dirsearch.py -u http://testphp.vulnweb.com -X .php

Similarly, we can program the Dirsearch to show results for only specific file types using the suffix parameter. For instance, we can use the –suffix parameter to get only .php results.

python3 dirsearch.py -u http://testphp.vulnweb.com --suffix .php

Conclusion

The Dirsearch can make complex content discovery easier for penetration testers. Deep scanning is a powerful feature of the tool. The Discovery of directories, sub-directories, and custom files with any known extension makes the tool an ultimate choice for serious penetration testing projects. The only drawback of Dirsearch is the slow Bruteforce process that can take a lot of time against heavy web servers.