WEB

WEB

1. ENUMERAÇÃO

   • Arquivos/Diretórios
     • DIRB
       • dirb site.com /usr/worlist/dirb/big.txt -X .sql
         • -a USER_AGENT
         • -o output
         • -X <extensions>
         • -c <cookie_string>
         • -r Don't Search Recursively
         • -p proxy (IP:port)
         • -z milisecs (delay)
         • -H headers
     • GOBUSTER
       • gobuster dir -u http://site.com -w /usrshare/wordlist/dirb/big.txt -o out.txt
         • -a USER_AGENT
         • -o output
         • -x <extensions>
         • -c <cookie_string>
         • -e Expanded Mode
         • -k Skip SSL certificate verification
         • -t threads
         • -p proxy
     • WFUZZ
       • wfuzz -c -z file, /usr/share/wordlist/dirb/big.txt http://site.com/wp-login.php
         • -c colorful output
         • -z : payload/wordlist
         • --hs : ignore response containing Invalid, h in this instance being hide and s is actually the regex switch in this instance
         • -d : the post request
         • Exemplos
           • Verificar usuário e senha
             • wfuzz -c -z file, users.txt-z file,pass.txt --sc 200 http://site.com/index.php? user=FUZZ&pass=FUZ2Z
           • Verificar mais de um parâmetro
             • wfuzz -c -z file, /usr/share/wordlist/dirb/big.txt--hs Invalid --hs incorrect -d “log= FUZZ-z file, /usr/share/wordlist/dirb/big.txt &pwd= FUZ2Z” http://site.com/wp-login.php
           • Bruteforce em diretórios
             • wfuzz -c -z file,/usr/share/wordlist/dirb/big.txt --hc 404 http://site.com/FUZZ
           • Testar um cookie
             • wfuzz -c -w users.txt - ss "Welcome " -H "Cookie:id=1312321&user=FUZZ" "http://site.com/index.php"
           • Testar User-Agent
             • wfuzz -c -w user-agents.txt -p 127.0.0.1:8080 --ss "Welcome " -H "User-Agent: FUZZ" "http://site.com/index.php"
           • Testar métodos HTTP
             • wfuzz -z list,GET-HEAD-POST-TRACE-OPTIONS -X FUZZ http://site.com/
             • wfuzz -c -w methods.txt -p 127.0.0.1:8080 --sc 200 -X FUZZ "http://site.com/index.php"
     • NIKTO
       • nikto -h http://site.com -p 80,88,8080
         • -useragent USER_AGENT
         • -o output
         • -evasion utiliza tecnicas de evasão
           • 1 Random URI encoding (non-UTF8) 2 Directory self-reference (/./) 3 Premature URL ending 4 Prepend long random string 5 Fake parameter 6 TAB as request spacer 7 Change the case of the URL 8 Use Windows directory separator (\) A Use a carriage return (0x0d) as a request spacer B Use binary value 0x0b as a request spacer
         • -Tuning realiza testes específicos
           • 9 SQL Injection
           • 1 Interesting File / Seen in logs
           • 2 Misconfiguration / Default File
           • 3 Information Disclosure
           • 4 Injection (XSS/Script/HTML
           • 5 Remote File Retrieval - Inside Web Root
           • 6 Denial of Service
           • 7 Remote File Retrieval - Server Wide
           • 8 Command Execution / Remote Shell
           • 0 File Upload
           • a Authentication Bypass
           • b Software Identification
           • c Remote Source Inclusion
     • WAPITI
   • Bruteforce