Skip to content

Latest commit

 

History

History
executable file
·
327 lines (230 loc) · 16.6 KB

scriptwebhack.md

File metadata and controls

executable file
·
327 lines (230 loc) · 16.6 KB

CPH:SEC

A Scriptkiddies Guide to Web Hacking Using Automatic Tools

v. 0.5 beta

Disclaimer & Caveat Lector: This article is for educational purposes only. The author is not responsible for any misuse or wrong doing. Always follow the law, whitehat hacking ethics and good business practice as well as industry standards.

By Shiva : https://github.com/Shiva108 @ CPH:SEC : https://cph-sec.github.io/ Corrections by MThirup: https://hackerone.com/mthirup

Table of Contents

  1. Introduction

  2. A Word About OPSEC (OPeration SECurity)

  3. Typical Installation of Tools

  4. Recon Tools
  5. Exploit Tools
  6. Persistency Tools
  7. Multi Purpose tools
  8. Command & Control (C&C) Tools

  9. Short Tool info

  10. Reconnoitre
  11. Zeus Scanner

  12. How To Find Hackable Websites

  13. By Chance
  14. Using Dorks

  15. Scenarios

  16. WordPress Site

xxx

Introduction

This article is a guide in web hacking by using automatic tools and scripts, mainly from github. A guide for so called "newbies" and "scriptkiddies" i.e. wannabe and beginner hackers. This guide uses the common hacking methodology "hacking killchain":

  • Recon
    • Passive Recon (without scanning i.e. Wappalyzer / Shodan API / Censys / Netcraft etc.)
    • Active Recon (using scanning tools)
  • Exploitation (the actual "hack")
  • Persistence (keep presence, e.g. uploading a webshell)
    • optional: Setting up Command and Control (C&C) server

Hence, any hacking tool has to perform task(s) within one or more kill-chain categories. Before the tool section a little about OPSEC (OPeration SECurity).

A Word About OPSEC

A whitehat hacker only engages targets after receiving a written permission letter from the system owner. As a proper CMA (Cover My A$$) procedure a whitehat never begins engagement without a written permission. OPSEC is a large topic and as so it is impossible to cover all in this guide. Hence, refer to more in-dept guides¹. However, here are some points to remember:

  • Always use a VPN (Virtual Private Network), preferably one that is not paid for through your credit card, paypal or other non-anonymous . As for paying with crypto currency anonymously please refer to https://coinsutra.com/anonymous-bitcoin-transactions/ .
  • Popular VPNs are NordVPN and ExpressVPN ²:
  • Use Tor if possible. The Tor network helps you being anonymous. However, some web-servers blocks all traffic from Tor nodes or use deception against incoming Tor traffic e.g. making scanning imposible because deceptive/wrong results are feeded. An easy way to utilize Tor is the anonsurf feature in Parrot Linux³. Anonsurf is also available from github: https://github.com/Und3rf10w/kali-anonsurf .
  • Use a private proxy, either scraped or staged e.g. "private" MS-RDP connection as proxy or staging ground.³
  • Use a clean OS and browser or a virtual machine in order to avoid being fingerprinted.⁴
  • Never log in to social media, or other sites, that you normally use (including email) while hacking as it will identify you. This means, keep complete seperate identies. Never use covert identity while not being anonymous.
  • Use foreign hardware at best (other than your neighbours WiFi!⁵), never use your own hardware for hacking.
  • Dont use google, use duckduckgo instead: https://duckduckgo.com/ or on dark web: http://3g2upl4pq6kufc4m.onion/ .

![image](vpnstor2.png)

Surf:

List of Automatic Hacking Tools

Typical Installation of Tools

Please refer to the installation guide of each tool as installation procedures can differ tremendously. As goes for github tools a fast way to install is:

$ git clone https://github.com/<author>/<toolname>.git
$ cd <toolname>

![image](github_download.png)

In the case of a python script there will frequently be a setup.sh or install.sh file included and often a requirement.txt file.

$ sudo ./setup.sh install
or
$ sudo ./install.sh
$ sudo pip install -r requirements.txt

Short Tool Info

At best refer to the guide / manual for each tool. The information below is giving a short overview of selected tools only.

Reconnoitre

"A reconnaissance tool made for OSCP labs to automate information gathering and service enumeration whilst creating a directory structure to store results, findings and exploits used for each host, recommended commands to execute and directory structures for storing loot and flags."

This tool is made for much more than auto web hacking but comes in handy for web hacking too, as Reconnoitre does auto enumeration against a server. Below is example of usage against hackthebox.eu (htb) retired machine "Granny" on IP 10.10.10.15 and files are dumped in /home/e/10.10.10.15/[folders]:

python ./reconnoitre.py  -t  10.10.10.15 --services -o /home/<output directory>/

![image](reconnoitre_scan1.png)

In the "10.10.10.15" folder Reconnoitre creates a directory structure as result:

  • exploit
  • loot
  • scans

While the first two "exploit" and "loot" are a setup for OSCP certification, "scans" holds dumps of a number files including "IP_findings.txt" which includes the cli commands used and findings for the IP. ]

Zeus Scanner

"Zeus is an advanced reconnaissance utility designed to make web application reconnaissance simple. Zeus comes complete with a powerful built-in URL parsing engine, multiple search engine compatibility, the ability to extract URLs from both ban and webcache URLs, the ability to run multiple vulnerability assessments on the target, and is able to bypass search engine captchas."

Zeus has, among other functions, a dork (more about dorks later) scanner. To do a basic dork scan type, in this case for sites vulnerable to SQLi (SQL-injection):

python zeus.py -d inurl:php?id=

The result will be similar to this:

![image](zeus_dork_sqli.png)

The output reveals the following:

  • successfully wrote found items to '/root/Zeus-Scanner/log/url-log/url-log-2.log'
  • found a total of 22 URLs with given query 'inurl:php?id='

Which means the output is stored in '/root/Zeus-Scanner/log/url-log/url-log-2.log' :

![image](zeus_dork_scan_sqli_result.png)

Now the Zeus list, of sites that are likely to be vulnerable to SQLi, can be passed on to SQLMAP (an auto SQLi exploitation script) or let Zeus handle it.

For more information please visit: https://latesthackingnews.com/2018/09/06/zeus-scanner-dork-searching-and-web-applications-vulnerability-assessment-tool/

python zeus.py –s –d <target website> --sqlmap-args=”threads 5, level=3, risk=3, randomAgent true”

This will use the SQLMAP API and with SQLMAP output as result.

![image](sqlmapapi_output2.png)

How To Find Hackable Websites

There are multiple ways to find vulnerable/hackable websites. Two of these are covered in this guide:

  • By Chance
  • Using Dorks

By Chance

One of the ways to find hackable websites is to be observant while surfing and using browser addons for passive recon i.e. without scanning (see hacker killchain in "Introduction" section). Main browser extension for passive recon is Wappalyzer but others are useful as well:

A View of a Vulnerable Site

This section shows what a hacker can see on a vulnerable site using the aforementioned addons. First wappalyzer:

![image](wappalyzer2.png)

One gets a lot of interesting information just from this passive recon using WA:

  • CMS type and version: WordPress 4.6.12 - Old version, current is 4.9.8
  • Ecommerce type and version: WooCommerce 3.2.6 - a vulnerable version
  • Web Server type and version: Apache 2.4.34
  • Programming Language: PHP - gives a hint for shell language
  • Operative System: Debian
  • and more...

Already from this information it can be deducted that the site is running an old version of WP and version of WC with know vulnerabilities. All this from just one plugin! This site is hacked in the "Scenarios: WordPress" section later.

Another example, this time Microsoft web-server:

![image](wapp_iis_2.png)

WA reveals that server is running IIS 8.5 and therefore a simple duckduckgo search on "Microsoft IIS 8.5 CVE" (Common Vulnerabilities and Exposures) reveals multiple vulnerabilities for this type of server. One such exploit is MS15-034¹ and allows Remote Code Execution (RCE), or "remote hack" against version 8.5 of IIS. Note that only unpached servers with IIS 8.5 are vulnerable to MS15-034. However this is a web hacking guide, as goes for server hacking look for upcoming articles [Ed./Shiva: Meaning after 10/2018].

The Shodan Firefox addon shows a somewhat different info about websites, meaning exclusively information about the server:

![image](shodan_github2)

In this case the site is, the well known, github.com. The Shodan browser plugin reveals information such as:

  • IP address
  • C-name
  • Open Ports

This information is especially interesting if a site uses a Content Delivery Network (CDN)² or similar.

Surf:

By Using Dorks

Another, and common way, for hackers to find vulnerable sites is by using specific search terms in search engines, so called dorks¹ or by using scripts that search search engine API's or cache. This was demonstrated earlier in the "Zeus Scanner" chapter. There is a constant evolution in dorks and so the scriptkiddie should continuously keep updated by visiting sites with new dork lists. regularly to know the latest dorks. The main site for dorks is GHDB (Google Hacking Databse)²:

![image](ghdb_joomla.png)

In the illustrated example joomla dorks from 2018 are found using GHDB.

Surf:

Scenarios

Scenario 1: WordPress Site

More than 30% of sites on WWW are running WordPress CMS and so it's a needed skill for any web hacker to hack WP sites. It was common to find (very) old versions of WP installed everywhere but after "Automattic", the developer organisation behind WP, made automatic upgrading a default setting, this issue has been somewhat redeemed. However when developing a website, bureaus often disable automatic updating so the site wont break because of updating. As many customers do not pay for maintenance cost this leads to old versions of WP sites still running out there. This especially goes for sites running WooCommerce (WC) or other shopping addons with customizations, as it might be expensive and time-consuming to update. Furthermore, many WP plugin developers are amateur enthusiasts with no idea about secure coding. This leads to many other attack vectors / exploit possibilites.

In the following section it is demonstrated how to automatically hack a vulnerable WP site with the "X Attacker" (XA) tool.

![image](xattacker_banner.png)

"X Attacker" got several modes, the easiest one is a list of sites from file, which in this case is "sites.txt" with the URL "http://127.0.0.1/wordpress/".

The tool is automatic and the next output is a list of exploits and whether they worked or not.

![image](xattacker_blaze_hack.png)

The site has the "Blaze" vulnerability and "X Attacker" auto hacked the site and gives link[?] for uploading of webshell. Visiting the link with the PHP file uploaded by XA looks like this in the browser:

![image](xattacker_shell_upload.png)

To upload a shell, "weevely" is utilized:

$ weevely generate verystrongpassword /<output>/<directory>/<shell file name>.php

The result will look similar to this screenshot:

![image](weeve_gen_shell.png)

After uploading the shell XA even provides success messeage.

![image](xattacker_backdoor_up_succes.png)

This means the site is hacked and the shell is ready, which means persistency. Just click the "Succes Upload" link to enjoy the backdoored WP site.

Surf