How to Use Metasploit's WMAP Module to Scan Web Applications for Common Vulnerabilities « Null Byte :: WonderHowTo

Having an efficient workflow is an integral part of any craft, but it's especially important when it comes to probing apps for vulnerabilities. WhileMetasploitis considered the de facto standard when it comes toexploitation, it also contains modules for other activities, such asscanning. Case in point, WMAP, aweb applicationscanner available for use from within the Metasploit framework.A web application scanner is a tool used to identify vulnerabilities that are present in web applications. WMAP makes it easy to retain a smooth workflow since it can be loaded and run while working inside Metasploit. This guide will featureDVWA(Damn Vulnerable Web Application) as the target andKali Linuxand Metasploit on the offensive.Don't Miss:Scan Websites for Potential Vulnerabilities Using Vega in KaliStep 1: Set Up Metasploit DatabaseThe first thing we need to do, if it's not done already, is set up the Metasploit database, since this particular module needs it in order to run. Metasploit utilizes a PostgreSQLdatabase system, making it extremely useful to keep track of large amounts of information when conducting penetration tests. This allows for the import and export of scan results from other tools, as well as storage of discovered credentials, services, andother valuable data.We can initialize the database with themsfdb initcommand in theterminal. This will create a default database and user for Metasploit to interact with.msfdb init
[+] Starting database
[+] Creating database user 'msf'
[+] Creating databases 'msf'
[+] Creating databases 'msf_test'
[+] Creating configuration file '/usr/share/metasploit-framework/config/database.yml'
[+] Creating initial database schemaNext, start the PostgreSQL service withservice postgresql start.service postgresql startNow we can fire up Metasploit by typingmsfconsole.msfconsoleFinally, we can check that database is loaded and working properly by using thedb_statuscommand:msf > db_status
[*] postgresql connected to msfStep 2: Load WMAPIt's easy to load the WMAP module with theload wmapcommand.msf > load wmap

.-.-.-..-.-.-..---..---.
| | | || | | || | || |-'
`-----'`-'-'-'`-^-'`-'
[WMAP 1.5.1] ===  et [  ] metasploit.com 2012
[*] Successfully loaded plugin: wmapFrom here, if we type?to display Metasploit's help menu, we should see the commands for WMAP and their descriptions at the top of the menu.msf > ?

wmap Commands
=============

    Command       Description
    -------       -----------
    wmap_modules  Manage wmap modules
    wmap_nodes    Manage nodes
    wmap_run      Test targets
    wmap_sites    Manage sites
    wmap_targets  Manage targets
    wmap_vulns    Display web vulnsStep 3: Add Site to ScanType any of the commands to display their available options; Let's start by managing sites we wish to scan usingwmap_sites.msf > wmap_sites
[*] Usage: wmap_sites [options]
	-h        Display this help text
	-a [url]  Add site (vhost,url)
	-d [ids]  Delete sites (separate ids with space)
	-l        List all available sites
	-s [id]   Display site structure (vhost,url|ids) (level) (unicode output true/false)To add a site, usewmap_siteswith the-aflag followed by the site address.msf > wmap_sites -a http://172.16.1.102
[*] Site created.Now we can list the available sites usingwmap_siteswith the-lflag.msf > wmap_sites -l
[*] Available sites
===============

     Id  Host          Vhost         Port  Proto  # Pages  # Forms
     --  ----          -----         ----  -----  -------  -------
     0   172.16.1.102  172.16.1.102  80    http   0        0Step 4: Specify Target URLNext, we need to set the specific target URL we want to scan usingwmap_targets.msf > wmap_targets
[*] Usage: wmap_targets [options]
	-h 		Display this help text
	-t [urls]	Define target sites (vhost1,url[space]vhost2,url)
	-d [ids]	Define target sites (id1, id2, id3 ...)
	-c 		Clean target sites list
	-l  		List all target sitesWe can define the target usingwmap_targetswith the-tflag, followed by the URL.msf > wmap_targets -t http://172.16.1.102/dvwa/index.phpAnd usewmap_targetswith the-lflag to list the defined targets.msf > wmap_targets -l
[*] Defined targets
===============

     Id  Vhost         Host          Port  SSL    Path
     --  -----         ----          ----  ---    ----
     0   172.16.1.102  172.16.1.102  80    false  	/dvwa/index.phpWe should be good to go at this point, so the only thing left to do is to actually run the scanner.Step 5: Run ScannerTypewmap_runat the prompt to view the options for this command.msf > wmap_run
[*] Usage: wmap_run [options]
	-h                        Display this help text
	-t                        Show all enabled modules
	-m [regex]                Launch only modules that name match provided regex.
	-p [regex]                Only test path defined by regex.
	-e [/path/to/profile]     Launch profile modules against all matched targets.
	                          (No profile file runs all enabled modules.)We can usewmap_runwith the-tflag to list all the enabled modules before we scan the target.msf > wmap_run -t
[*] Testing target:
[*] 	Site: 172.16.1.102 (172.16.1.102)
[*] 	Port: 80 SSL: false
============================================================
[*] Testing started. 2018-09-20 10:23:26 -0500
[*] Loading wmap modules...
[*] 39 wmap enabled modules loaded.
[*]
=[ SSL testing ]=
============================================================
[*] Target is not SSL. SSL modules disabled.
[*]
=[ Web Server testing ]=
============================================================
[*] Module auxiliary/scanner/http/http_version
[*] Module auxiliary/scanner/http/open_proxy
[*] Module auxiliary/admin/http/tomcat_administration
[*] Module auxiliary/admin/http/tomcat_utf8_traversal
[*] Module auxiliary/scanner/http/drupal_views_user_enum
[*] Module auxiliary/scanner/http/frontpage_login
[*] Module auxiliary/scanner/http/host_header_injection
[*] Module auxiliary/scanner/http/options
[*] Module auxiliary/scanner/http/robots_txt
[*] Module auxiliary/scanner/http/scraper
[*] Module auxiliary/scanner/http/svn_scanner
[*] Module auxiliary/scanner/http/trace
[*] Module auxiliary/scanner/http/vhost_scanner
[*] Module auxiliary/scanner/http/webdav_internal_ip
[*] Module auxiliary/scanner/http/webdav_scanner
[*] Module auxiliary/scanner/http/webdav_website_content
[*]
=[ File/Dir testing ]=
============================================================
[*] Module auxiliary/scanner/http/backup_file
[*] Module auxiliary/scanner/http/brute_dirs
[*] Module auxiliary/scanner/http/copy_of_file
[*] Module auxiliary/scanner/http/dir_listing
[*] Module auxiliary/scanner/http/dir_scanner
[*] Module auxiliary/scanner/http/dir_webdav_unicode_bypass
[*] Module auxiliary/scanner/http/file_same_name_dir
[*] Module auxiliary/scanner/http/files_dir
[*] Module auxiliary/scanner/http/http_put
[*] Module auxiliary/scanner/http/ms09_020_webdav_unicode_bypass
[*] Module auxiliary/scanner/http/prev_dir_same_name_file
[*] Module auxiliary/scanner/http/replace_ext
[*] Module auxiliary/scanner/http/soap_xml
[*] Module auxiliary/scanner/http/trace_axd
[*] Module auxiliary/scanner/http/verb_auth_bypass
[*]
=[ Unique Query testing ]=
============================================================
[*] Module auxiliary/scanner/http/blind_sql_query
[*] Module auxiliary/scanner/http/error_sql_injection
[*] Module auxiliary/scanner/http/http_traversal
[*] Module auxiliary/scanner/http/rails_mass_assignment
[*] Module exploit/multi/http/lcms_php_exec
[*]
=[ Query testing ]=
============================================================
[*]
=[ General testing ]=
============================================================
[*] Done.There are a few different categories of modules including ones for directory testing, query testing, web server testing, and SSL testing, although we can see that our target doesn't employ SSL, so these modules are disabled. To get a detailed description of any given module, use theinfocommand followed by the full path of the module that's listed. For example:msf > info auxiliary/scanner/http/http_version

       Name: HTTP Version Detection
     Module: auxiliary/scanner/http/http_version
    License: Metasploit Framework License (BSD)
       Rank: Normal

Provided by:
  hdm <x@hdm.io>

Basic options:
  Name     Current Setting  Required  Description
  ----     ---------------  --------  -----------
  Proxies                   no        A proxy chain of format type:host:port[,type:host:port][...]
  RHOSTS                    yes       The target address range or CIDR identifier
  RPORT    80               yes       The target port (TCP)
  SSL      false            no        Negotiate SSL/TLS for outgoing connections
  THREADS  1                yes       The number of concurrent threads
  VHOST                     no        HTTP server virtual host

Description:
  Display version information about each system.Back to scanning. Let's begin the scan by usingwmap_runwith the-eflag, which will run all of the modules instead of just a specified one. Depending on the target site and the number of enabled modules, the scan can take quite some time to finish. Once it's done, the scan will show how long it took to complete.msf > wmap_run -e
[*] Using ALL wmap enabled modules.
[-] NO WMAP NODES DEFINED. Executing local modules
[*] Testing target:
[*] 	Site: 172.16.1.102 (172.16.1.102)
[*] 	Port: 80 SSL: false
============================================================
[*] Testing started. 2018-09-20 10:24:33 -0500
[*]
=[ SSL testing ]=
============================================================
[*] Target is not SSL. SSL modules disabled.
[*]
=[ Web Server testing ]=
============================================================
[*] Module auxiliary/scanner/http/http_version

[+] 172.16.1.102:80 Apache/2.2.8 (Ubuntu) DAV/2 ( Powered by PHP/5.2.4-2ubuntu5.24 )
[*] Module auxiliary/scanner/http/open_proxy
[*] Module auxiliary/admin/http/tomcat_administration
[*] Module auxiliary/admin/http/tomcat_utf8_traversal

...

=[ Unique Query testing ]=
============================================================
[*] Module auxiliary/scanner/http/blind_sql_query
[*] Module auxiliary/scanner/http/error_sql_injection
[*] Module auxiliary/scanner/http/http_traversal
[*] Module auxiliary/scanner/http/rails_mass_assignment
[*] Module exploit/multi/http/lcms_php_exec
[*]
=[ Query testing ]=
============================================================
[*]
=[ General testing ]=
============================================================
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Launch completed in 337.37769508361816 seconds.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
[*] Done.Step 6: Interpret ResultsFinally, we can type thewmap_vulns -lcommand to display the results of the scan.msf > wmap_vulns -l
[*] + [172.16.1.102] (172.16.1.102): scraper /
[*] 	scraper Scraper
[*] 	GET Metasploitable2 - Linux
[*] + [172.16.1.102] (172.16.1.102): directory /dav/
[*] 	directory Directory found.
[*] 	GET Res code: 200
[*] + [172.16.1.102] (172.16.1.102): directory /cgi-bin/
[*] 	directory Directoy found.
[*] 	GET Res code: 403
[*] + [172.16.1.102] (172.16.1.102): directory /doc/
[*] 	directory Directoy found.
[*] 	GET Res code: 200
[*] + [172.16.1.102] (172.16.1.102): directory /icons/
[*] 	directory Directoy found.
[*] 	GET Res code: 200
[*] + [172.16.1.102] (172.16.1.102): directory /index/
[*] 	directory Directoy found.
[*] 	GET Res code: 200
[*] + [172.16.1.102] (172.16.1.102): directory /phpMyAdmin/
[*] 	directory Directoy found.
[*] 	GET Res code: 200

...We can see it found some potentially interesting directories that could be worth investigating further:The /cgi-bin/ directory allows scripts to be executed and perform console-like functions directly on the server.The /phpMyAdmin/ directory is an open-source administration tool for MySQL database systems.The /dav/ directory allows users to collaborate and perform web authoring activities remotely.WMAP might not return as detailed results as other web application vulnerability scanners, but this information can be a useful jumping off point to explore different avenues of attack. The fact that this scanner can be easily loaded and utilized from within the Metasploit Framework makes it a useful tool to know how to use.Wrapping UpMetasploit is a powerful tool which can not only be used for exploitation but also features tons of other modules that can be loaded and ran from directly within the framework, making it an absolute powerhouse when it comes to penetration testing and ethical hacking.In this tutorial, we learned how to quickly get Metasploit's database system up and running, as well as how to use the WMAP plugin to scan a web application for vulnerabilities. This is just one of many incredibly useful modules available as part of the Metasploit Framework, with more being written each day to satisfy the needs of white hats everywhere.Don't Miss:More Metasploit Guides on Null ByteFollow Null Byte onTwitter,Flipboard, andYouTubeSign up forNull Byte's weekly newsletterFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image byTBIT/Pixabay; Screenshots by drd_/Null ByteRelatedHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHack Like a Pro:Metasploit for the Aspiring Hacker, Part 10 (Finding Deleted Webpages)How To:Detect Vulnerabilities in a Web Application with UniscanHow To:Probe Websites for Vulnerabilities More Easily with the TIDoS FrameworkHack Like a Pro:Reconnaissance with Recon-Ng, Part 1 (Getting Started)How To:Use Metasploit's Web Delivery Script & Command Injection to Pop a ShellHow To:Exploit Remote File Inclusion to Get a ShellHow To:Audit Web Applications & Servers with TishnaHow To:Hack Apache Tomcat via Malicious WAR File UploadHow To:Quickly Gather Target Information with Metasploit Post ModulesHow To:Scan for Vulnerabilities on Any Website Using NiktoHack Like a Pro:Hacking the Heartbleed VulnerabilityHow to Hack Databases:Hunting for Microsoft's SQL ServerHow to Hack Like a Pro:Hacking Windows Vista by Exploiting SMB2 VulnerabilitiesHow to Hack Like a Pro:Getting Started with MetasploitHow To:Discover Computers Vulnerable to EternalBlue & EternalRomance Zero-DaysHow To:Exploit Java Remote Method Invocation to Get RootHack Like a Pro:Exploring the Inner Architecture of MetasploitHow To:Exploit Shellshock on a Web Server Using MetasploitHack Like a Pro:How to Hack Windows Vista, 7, & 8 with the New Media Center ExploitHow To:Discover Open Ports Using Metasploit's Built-in Port ScannerHack Like a Pro:How to Use Hacking Team's Adobe Flash ExploitHack Like a Pro:How to Hack Web Apps, Part 1 (Getting Started)Hack Like a Pro:How to Hack the Shellshock VulnerabilityHack Like a Pro:Using Nexpose to Scan for Network & System VulnerabilitiesHack Like a Pro:Exploring Metasploit Auxiliary Modules (FTP Fuzzing)Android for Hackers:How to Scan Websites for Vulnerabilities Using an Android Phone Without RootHack Like a Pro:Metasploit for the Aspiring Hacker, Part 4 (Armitage)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 1 (Primer & Overview)How To:Seize Control of a Router with RouterSploitHack Like a Pro:Metasploit for the Aspiring Hacker, Part 9 (How to Install New Modules)Hack Like a Pro:Hacking Windows XP Through Windows 8 Using Adobe Flash PlayerHack Like a Pro:How to Crash Your Roommate's Windows 7 PC with a LinkHow To:Use Websploit to Scan Websites for Hidden DirectoriesHack Like a Pro:How to Scan for Vulnerabilities with NessusHow To:Enumerate MySQL Databases with MetasploitHow To:Top 10 Exploit Databases for Finding VulnerabilitiesHack Like a Pro:Metasploit for the Aspiring Hacker, Part 13 (Web Delivery for Windows)IPsec Tools of the Trade:Don't Bring a Knife to a GunfightHow To:Spider Web Pages with Nmap for SQLi Vulnerabilities