How to Detect Vulnerabilities in a Web Application with Uniscan « Null Byte :: WonderHowTo

With the number of web applications out there today, it comes as no surprise that there are just as many vulnerabilities waiting for hackers to discover. Finding those vulnerabilities can be a difficult task, but there are plenty of tools available to make the process easier. While it won't help find any zero-days, web scanners such as Uniscan will detect common vulnerabilities.Uniscanis a simple web vulnerability scanner that searches for common flaws likelocal file include,remote command execution, andremote file includevulnerabilities. It's also able to fingerprint and enumerate web services, interesting files and directories, and server information. This tool is written in Perl and is available as an intuitive command line tool or as a GUI.Don't Miss:Scan Websites for Vulnerabilities Using an Android PhoneIf you're using Kali Linux as your pentesting station, Uniscan is included in it so there's no need to install anything. For everyone else, you can download it fromSourceForge. In this guide, we'll be testing Uniscan out against the vulnerable virtual machineMetasploitable 2.Scanning the TargetUniscan has a number of different options we can employ for a scan. Simply open up theterminaland typeuniscanoruniscan -hat the prompt, and it will display version information, available options to set, and a few usage examples. If you don't see this screen in Kali, you don't have it installed somehow, but you can get it quickly usingapt install uniscan.uniscan

####################################
# Uniscan project                  #
# http://uniscan.sourceforge.net/  #
####################################
V. 6.3

OPTIONS:
    -h  help
    -u  <url> example: https://www.example.com/
    -f  <file> list of url's
    -b  Uniscan go to background
    -q  Enable Directory checks
    -w  Enable File checks
    -e  Enable robots.txt and sitemap.xml check
    -d  Enable Dynamic checks
    -s  Enable Static checks
    -r  Enable Stress checks
    -i  <dork> Bing search
    -o  <dork> Google search
    -g  Web fingerprint
    -j  Server fingerprint

usage:
[1] perl ./uniscan.pl -u http://www.example.com/ -qweds
[2] perl ./uniscan.pl -f sites.txt -bqweds
[3] perl ./uniscan.pl -i uniscan
[4] perl ./uniscan.pl -i "ip:xxx.xxx.xxx.xxx"
[5] perl ./uniscan.pl -o "inurl:test"
[6] perl ./uniscan.pl -u https://www.example.com/ -rThe most basic way to use this tool is to give it a URL to scan by setting the-uflag, followed by the domain of interest, as shown below. It will return a brief summary, including information about the server and IP address.uniscan -u http://172.16.1.102

####################################
# Uniscan project                  #
# http://uniscan.sourceforge.net/  #
####################################
V. 6.3

Scan date: 29-1-2019 14:52:26
===================================================================================================
| Domain: http://172.16.1.102/
| Server: Apache/2.2.8 (Ubuntu) DAV/2
| IP: 172.16.1.102
===================================================================================================
===================================================================================================
Scan end date: 29-1-2019 14:52:26

HTML report saved in: report/172.16.1.102.htmlWe can also perform more detailed server fingerprinting by using the-joption — simply append it to the end of the command. This will run a ping test and traceroute to determine the network connectivity status, followed by an nslookup (name server lookup) to obtain anyDNS recordsthat are available. This option will also kick off anNmap scanto discover any open services and ports, so be aware of the target as some defenses will consider this aggressive.uniscan -u http://172.16.1.102 -j

####################################
# Uniscan project                  #
# http://uniscan.sourceforge.net/  #
####################################
V. 6.3

Scan date: 29-1-2019 14:53:23
===================================================================================================
| Domain: http://172.16.1.102/
| Server: Apache/2.2.8 (Ubuntu) DAV/2
| IP: 172.16.1.102
===================================================================================================
===================================================================================================
| PING
|
| PING 172.16.1.102 (172.16.1.102) 56(84) bytes of data.
| 64 bytes from 172.16.1.102: icmp_seq=1 ttl=64 time=0.937 ms
| 64 bytes from 172.16.1.102: icmp_seq=2 ttl=64 time=1.77 ms
| 64 bytes from 172.16.1.102: icmp_seq=3 ttl=64 time=1.16 ms
| 64 bytes from 172.16.1.102: icmp_seq=4 ttl=64 time=1.18 ms
|
| --- 172.16.1.102 ping statistics ---
| 4 packets transmitted, 4 received, 0% packet loss, time 8ms
| rtt min/avg/max/mdev = 0.937/1.261/1.767/0.309 ms
===================================================================================================
| TRACEROUTE
|
| traceroute to 172.16.1.102 (172.16.1.102), 30 hops max, 60 byte packets
|  1  172.16.1.102 (172.16.1.102)  1.314 ms  1.554 ms  1.782 ms

...Uniscan has an option to fingerprint web services, too. Use the-goption to do so. This will look for interesting HTTP methods, error information, and HTML strings, as well as other little tidbits that might aid in reconnaissance. We can see below that it found a couple of 404 errors and the greeting information when logging into Metasploitable.uniscan -u http://172.16.1.102 -g

####################################
# Uniscan project                  #
# http://uniscan.sourceforge.net/  #
####################################
V. 6.3

Scan date: 29-1-2019 14:54:43
===================================================================================================
| Domain: http://172.16.1.102/
| Server: Apache/2.2.8 (Ubuntu) DAV/2
| IP: 172.16.1.102
===================================================================================================
===================================================================================================
| Looking for Drupal plugins/modules
|
| GET,HEAD,POST,OPTIONS,TRACE
===================================================================================================
===================================================================================================
| WEB SERVICES
|
===================================================================================================
| FAVICON.ICO
|
===================================================================================================
| ERROR INFORMATION
|
|  404 Not Found Not Found The requested URL /lKBpm&lt;^reGdK(QpcajL+ was not found on this server. Apache/2.2.8 (Ubuntu) DAV/2 Server at 172.16.1.102 Port 80
|  404 Not Found Not Found The requested URL /7)DGG`[0wNqh&quot;&quot;2Q1,LY was not found on this server. Apache/2.2.8 (Ubuntu) DAV/2 Server at 172.16.1.102 Port 80
===================================================================================================
| TYPE ERROR
|
===================================================================================================
| SERVER MOBILE
|
===================================================================================================
| LANGUAGE
|
===================================================================================================
| INTERESTING STRINGS IN HTML
|
| Warning: Never expose this VM to an untrusted network! Contact: msfdev[at]metasploit.com Login with msfadmin/msfadmin to get started
| a href="/phpMyAdmin/">phpMyAdmin
===================================================================================================
| WHOIS
|
getaddrinfo(whois.arin.net): Name or service not known
===================================================================================================
| BANNER GRABBING:
===================================================================================================
===================================================================================================We can crawl for directories located on the target by setting the-qflag. In my example, it looks like it discovered some directories that might be of interest, including what appears to be documentation andPHPconfiguration information.uniscan -u http://172.16.1.102 -q

####################################
# Uniscan project                  #
# http://uniscan.sourceforge.net/  #
####################################
V. 6.3

Scan date: 29-1-2019 14:56:28
===================================================================================================
| Domain: http://172.16.1.102/
| Server: Apache/2.2.8 (Ubuntu) DAV/2
| IP: 172.16.1.102
===================================================================================================
|
| Directory check:
| [+] CODE: 200 URL: http://172.16.1.102/doc/
| [+] CODE: 200 URL: http://172.16.1.102/icons/
| [+] CODE: 200 URL: http://172.16.1.102/index/
| [+] CODE: 200 URL: http://172.16.1.102/phpinfo/
| [+] CODE: 200 URL: http://172.16.1.102/payload/
===================================================================================================
===================================================================================================We can also enable file checks with the-wflag. Below we can see that it found a few files which could yield valuable information.uniscan -u http://172.16.1.102 -w

####################################
# Uniscan project                  #
# http://uniscan.sourceforge.net/  #
####################################
V. 6.3

Scan date: 29-1-2019 14:57:46
===================================================================================================
| Domain: http://172.16.1.102/
| Server: Apache/2.2.8 (Ubuntu) DAV/2
| IP: 172.16.1.102
===================================================================================================
|
| File check:
| [+] CODE: 200 URL: http://172.16.1.102/test
| [+] CODE: 200 URL: http://172.16.1.102/index.php
| [+] CODE: 200 URL: http://172.16.1.102/phpinfo.php
===================================================================================================
===================================================================================================Uniscan has the ability to automatically check a website for a robots.txt file and a sitemap by using the-eoption. In my example, those files do not appear to be present on the target, but nonetheless, it is a useful option when probing other sites.uniscan -u http://172.16.1.102 -e

####################################
# Uniscan project                  #
# http://uniscan.sourceforge.net/  #
####################################
V. 6.3

Scan date: 29-1-2019 14:58:36
===================================================================================================
| Domain: http://172.16.1.102/
| Server: Apache/2.2.8 (Ubuntu) DAV/2
| IP: 172.16.1.102
===================================================================================================
|
| Check robots.txt:
|
| Check sitemap.xml:
===================================================================================================
===================================================================================================Uniscan will load some plugins to perform dynamic checks on the target, including email identification, backdoor detection, and discovery ofSQLand other types of injection points. Set the-dflag to do this. This can take quite some time to run, and it doesn't always work correctly, so use at your own discretion.uniscan -u http://172.16.1.102 -d

####################################
# Uniscan project                  #
# http://uniscan.sourceforge.net/  #
####################################
V. 6.3

Scan date: 29-1-2019 14:59:13
===================================================================================================
| Domain: http://172.16.1.102/
| Server: Apache/2.2.8 (Ubuntu) DAV/2
| IP: 172.16.1.102
===================================================================================================
|
| Crawler Started:
| Plugin name: Web Backdoor Disclosure v.1.1 Loaded.
| Plugin name: Upload Form Detect v.1.1 Loaded.
| Plugin name: phpinfo() Disclosure v.1 Loaded.
| Plugin name: External Host Detect v.1.2 Loaded.
| Plugin name: FCKeditor upload test v.1 Loaded.
| Plugin name: E-mail Detection v.1.1 Loaded.
| Plugin name: Code Disclosure v.1.1 Loaded.
| Plugin name: Timthumb <= 1.32 vulnerability v.1 Loaded.
| [*] Crawling: [28 - 134]

...We can also enable some static checks on the target with the-soption. This will run tests that detect local file include, remote command execution, and remote file include vulnerabilities.uniscan -u http://172.16.1.102 -s

####################################
# Uniscan project                  #
# http://uniscan.sourceforge.net/  #
####################################
V. 6.3

Scan date: 29-1-2019 15:12:3
===================================================================================================
| Domain: http://172.16.1.102/
| Server: Apache/2.2.8 (Ubuntu) DAV/2
| IP: 172.16.1.102
===================================================================================================
===================================================================================================
| Static tests:
| Plugin name: Local File Include tests v.1.1 Loaded.
| Plugin name: Remote Command Execution tests v.1.1 Loaded.
| Plugin name: Remote File Include tests v.1.1 Loaded.
|
|
| Local File Include:
|
|
| Remote Command Execution:
|
|
| Remote File Include:
[*] Remaining tests: 1

...In addition to the command line tool, Uniscan has as a GUI. Simply typeuniscan-guiat the terminal prompt to launch the program. From here, it operates pretty much the same as in the command line interface; We can list the target URL and any options we want to be enabled, then hit "Start scan" to kick it off.Personally, I like the command line tool a little better since it runs the scan in the same way, plus you have to open the terminal up anyway to launch the GUI, but to each his own. It should be noted that in the command line version multiple options can also be set at the same time, like so:uniscan -u http://172.16.1.102 -qwdsUniscan also saves each scan as an HTML file under/usr/share/uniscan/report/if scan results are needed at a later time.Uniscan vs. Other ScannersThere is a lot of variety when it comes to web vulnerability scanners, and different tools can often accomplish the same goals. However, in certain situations, it pays to know what tool is right for the job. Let's take a brief look at a few other popular web scanners and how they compare to Uniscan.WMAPis a scanner available as a module inMetasploit. It performs a lot of the same tests as Uniscan, including HTTP method detection, directory enumeration, and a robots.txt search. It's useful when working within Metasploit's framework, but Uniscan is nice because it can be fired up quickly and utilized right in the terminal.Burp Suiteis a name synonymous with web application testing, and in many situations, it will outperform any other scanner. The major downside with Burp is the free Community Edition does not include the automatic scanner. It can still be used as a manual tool and proxy to great effect, but Uniscan has the advantage since it does a few things simply and doesn't cost a dime.Vegais another web scanner that is similar to Burp in many ways. It can also be used effectively as a proxy but is free and open source. Like Uniscan, Vega will find file include vulnerabilities in addition to other injection flaws. This tool is flexible since it can run on Linux, Mac, and Windows, but only in GUI form. Sometimes you just want an uncomplicated command line tool, and Uniscan wins in that regard.Niktois a popular web server scanner that is also written in Perl. The command line tool has a ton of features, and there is also a GUI version available. Similar to Uniscan, it also reports interesting HTTP headers, crawls directories, and fingerprints server information. Nikto is the scanner to use when a very detailed picture of the target is needed, but the slew of settings and options can sometimes be discouraging for a beginner. Again, for this reason, Uniscan excels at being a no-frills web vulnerability scanner.While all of these scanners are great tools for testing web apps for common flaws, Uniscan is the one to come back to when you need a quick-and-dirty web scanner that's noob-friendly.Don't Miss:How to Leverage a Directory Traversal Vulnerability into Code ExecutionFollow Null Byte onTwitter,Flipboard, andYouTubeSign up forNull Byte's weekly newsletterFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image byar130405/Pixabay; Screenshots by drd_/Null ByteRelatedAndroid for Hackers:How to Scan Websites for Vulnerabilities Using an Android Phone Without RootHow To:Probe Websites for Vulnerabilities More Easily with the TIDoS FrameworkHack Like a Pro:How to Hack Web Apps, Part 1 (Getting Started)Hack Like a Pro:How to Hack Web Apps, Part 6 (Using OWASP ZAP to Find Vulnerabilities)How To:Use export plug-ins in ApertureHow To:Exploit Remote File Inclusion to Get a ShellAdvanced Nmap:Top 5 Intrusive Nmap Scripts Hackers & Pentesters Should KnowHack Like a Pro:How to Scan for Vulnerabilities with NessusHow To:Top 10 Exploit Databases for Finding VulnerabilitiesHow To:Use Metasploit's WMAP Module to Scan Web Applications for Common VulnerabilitiesHow To:Use NMAP 7 to Discover Vulnerabilities, Launch DoS Attacks and More!How To:Beginner's Guide to OWASP Juice Shop, Your Practice Hacking Grounds for the 10 Most Common Web App VulnerabilitiesHack Like a Pro:How to Find Almost Every Known Vulnerability & Exploit Out ThereHow To:Hack Apache Tomcat via Malicious WAR File UploadHow To:The Art of 0-Day Vulnerabilities, Part2: Manually FuzzingHow To:Audit Web Applications & Servers with TishnaHow To:Discover XSS Security Flaws by Fuzzing with Burp Suite, Wfuzz & XSStrikeHow To:Abuse Session Management with OWASP ZAPHack Like a Pro:How to Scan the Internet for Heartbleed VulnerabilitiesHow To:Firefox 16 Is Vulnerable to Hackers—Here's How to Downgrade to the Safer Firefox 15 VersionHow To:Leverage a Directory Traversal Vulnerability into Code ExecutionHow To:The Art of 0-Day Vulnerabilities, Part 1: STATIC ANALYSISHack Like a Pro:Hacking Windows XP Through Windows 8 Using Adobe Flash PlayerHack Like a Pro:How to Find the Latest Exploits and Vulnerabilities—Directly from MicrosoftHow To:Identify Web Application Firewalls with Wafw00f & NmapHow To:Exploit Java Remote Method Invocation to Get RootHack Like a Pro:Using Nexpose to Scan for Network & System VulnerabilitiesHack Like a Pro:How to Find Website Vulnerabilities Using WiktoHeartbleed Still Lingers:How to Check Your Android Device for VulnerabilitiesHow To:Use Metasploit's Web Delivery Script & Command Injection to Pop a ShellHow To:Trick Apps That Won't Run if Your Phone Is Rooted into Thinking Its Not on the Galaxy Note 3IPsec Tools of the Trade:Don't Bring a Knife to a GunfightNews:Half a Million Macs Affected by Flashback Trojan! Eradicate It Before It's Too LateNews:Flaw in Facebook & Google Allows Phishing, Spam & MoreHow To:Is Your Website Vulnerable to XSS Injections? Here's How to Protect Your VisitorsNews:Bugzilla Cross Site Request ForgeryHow To:10+ Time Saving Menu Bar Applications for MacNews:SENDtoREADER appHow To:Detect hackers on your network with EttercapForbes Exploited:XSS Vulnerabilities Allow Phishers to Hijack Sessions & Steal Logins