Hack Like a Pro: Metasploit for the Aspiring Hacker, Part 10 (Finding Deleted Webpages) « Null Byte :: WonderHowTo

Welcome back, my greenhorn hackers!Throughoutthis series on Metasploit, and in most of my hacking tutorials here on Null Byte that use Metasploit (there are many; type "metasploit" into the search bar and you will find dozens), I have focused primarily on just two types of modules: exploits and payloads. Remember, Metasploit hassix types of modules:ExploitPayloadAuxiliaryNOP (no operation)Post (post exploitation)EncoderAlthough most hackers and pentesters focus on the exploits and payloads, there is significant capability in the auxiliary modules that is often overlooked and ignored. About one-third of all of Metasploit—measured by lines of code—is auxiliary modules. These auxiliary modules encompass the capabilities of many other tools that a hacker requires, and include various types of scanners (includingNmap),denial-of-servicemodules, fake servers for capturing (admin) credentials,fuzzers, and many more.In this tutorial, I want to explore and illuminate one of the auxiliary modules that can make hacking with Metasploit much more effective and efficient.Step 1: List the ModulesFirst, let's fire upKaliand open a terminal. In Kali, Metasploit modules are stored at:/usr/share/metasploit-framework/modulesLet's navigate there:kali > cd /usr/share/metasploit-framework/modules/Then, let's list the contents of that directory:kali > ls -lAs you can see, there are six types of modules in Metasploit, as mentioned before. Let's focus our attention on the auxiliary modules.Step 2: List the Auxiliary ModulesFirst, navigate to the auxiliary module directory and list its contents:kali > cd auxiliarykali > ls -lAs you can see, there are numerous subdirectories of auxiliary modules. Inan earlier tutorial, I pointed out that there are hundreds of auxiliary modules for DoSing in Metasploit. In this tutorial, we want to work with the scanner modules. Metasploit has scanning modules of just about every type, includingNmapand website vulnerability scanning.Step 3: The Wayback MachineAs many of you know, recent years have seen an increased emphasis on information security. Webmasters and IT security personnel are more vigilant about what goes onto their website, trying to make certain that information that might be used to compromise their security is not posted.If we go back just a few years, that was not the case. Companies often would post email addresses, passwords, vulnerability scans, network diagrams, etc. on their website, not aware that someone might find these and use them for malicious purposes. Although I still occassional find a company listing email addresses and passwords on their website, this has become much less common.Fortunately for us, nothing ever disappears from the web. If it's here today, it will be here 20 years from now (keep that in mind when posting on Facebook or other social media sites).The Internet Archive (Archive.org) was established to save free books, movies, music, software, along with all of the old web information via itsWayback Machinetool (which is a reference to an old cartoon where the main characters, Mr. Peabody and Sherman, would travel back in time in a time machine they called the "WABAC Machine"). This means that if a company had, at one time, stored email addresses and passwords on their webpages, or Nessus scans, it is still around somewhere on Archive.org.Step 4: Use Metasploit to Retrieve Deleted WebpagesFortunately for us, Metasploit has an auxiliary module that is capable of retrieving all of the old URLs from Archive.org that are stored for a particular domain. Since the Internet Archive's website tool is referred to as theWayback Machine, Metasploit has a module calledenum_wayback, short for "enumerate wayback" machine.Let's start the Metasploit console and load it:kali > msfconsoleWhen the msfconsole opens, let's load the wayback module by typing:msf > use auxiliary/scanner/http/enum_waybackThis module basically has just two parameters to set:The domain we want to search for on archive.orgThe file we want to save the information inSince we will be using theSANS.orgas our target, let's set the output to a file namedsans_wayback:msf > set OUTFILE sans_waybackNext, let's set the domain to our favorite IT Security domain:msf > set DOMAIN sans.orgStep 5: Start the Wayback MachineUnlike exploits in Metasploit where we typeexploitto start them, auxiliary modules are initiated by typingruninstead:msf > runThis module will now go to Archive.org and begin to retrieve every saved URL of SANS.org over the years. In the case of SANS.org, it is over 96,000 URLs! Since we told this module to store all of the URLs in a file named "sans_wayback," all these URLs are written to this file.When the module is done running, we can look inside this file by typing:kali > more sans_waybackWhen we do, we can see that Archive.org has stored the first URL from 1998. With over 90,000 URLs, visual inspection looking for interesting information is not really practical. Fortunately, god gave us thegrepcommand.If we want to find the URLs with emails stored in them, we can type:kali > more sans_wayback | grep emailAs you can see in the screenshot above, there are quite a few URLs pertaining to email. The one I have circled in red looks particularly interesting,email_list.htm.It is not unheard of for companies to put their vulnerability scans on their website for the security and network personnel to view (and the rest of us). As Nessus is the world's most widely used vulnerability scanner, let's see whether we can find it among these old webpages.kali > more sans_wayback | grep nessusAs you can see above, we have found three webpages with Nessus in them in the "audit" directory. Hmmm... that might be interesting... maybe some Nessus scan reports from the past?This approach to finding deleted information is limited to the information in the URL. We could actually take these URLs and view them in our browser at Archive.org to see whether we can find text information on the page that might be useful. Maybe a better approach would be to download the interesting URLs that this module enumerated directly to a hard drive usingHTTrack, then do a text search on the entire web content.Keep coming back, my greenhorn hackers, as we explore the workings of the hacker's best friend,Metasploit!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image viaShutterstockRelatedNews:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHow to Hack Like a Pro:Getting Started with MetasploitHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 4 (Armitage)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 14 (Creating Resource Script Files)How To:The Essential Skills to Becoming a Master HackerHack Like a Pro:Metasploit for the Aspiring Hacker, Part 1 (Primer & Overview)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 8 (Setting Up a Fake SMB Server to Capture Domain Passwords)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 2 (Keywords)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 13 (Web Delivery for Windows)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 7 (Autopwn)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 6 (Gaining Access to Tokens)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 5 (Msfvenom)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 11 (Post-Exploitation with Mimikatz)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 9 (How to Install New Modules)Hack Like a Pro:How to Use Hacking Team's Adobe Flash ExploitHack Like a Pro:How to Remotely Install a Keylogger onto Your Girlfriend's ComputerHack Like a Pro:Metasploit for the Aspiring Hacker, Part 3 (Payloads)Mac for Hackers:How to Install the Metasploit FrameworkHow to Hack Databases:Hunting for Microsoft's SQL ServerHack Like a Pro:Windows CMD Remote Commands for the Aspiring Hacker, Part 1Hack Like a Pro:Exploring Metasploit Auxiliary Modules (FTP Fuzzing)Safari 101:How to Save a Website or Webpage to Your Home Screen for Instant AccessGoodnight Byte:HackThisSite Walkthrough, Part 4 - Legal Hacker TrainingGoodnight Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 5 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsGoodnight Byte:HackThisSite Walkthrough, Part 9 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 10 - Legal Hacker TrainingHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterCommunity Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsCommunity Byte:HackThisSite Walkthrough, Part 10 - Legal Hacker TrainingHow To:Conceal a USB Flash Drive in Everyday ItemsCommunity Byte:HackThisSite, Realistic 2 - Real Hacking Simulations