4.2web漏洞扫描探测

1.辅助模块

wmap Web扫描器

load wmap
help
wmap_sites -a http://202.112.50.74
wmap_sites -l

msf > load wmap

.-.-.-..-.-.-..---..---.
| | | || | | || | || |-'
`-----'`-'-'-'`-^-'`-'
[WMAP 1.5.1] ===  et [  ] metasploit.com 2012
[*] Successfully loaded plugin: wmap
msf > wmap_sites -a http://202.112.50.74   (添加要扫描的网站)
[*] Site created.
msf > wmap_sites -l
[*] Available sites
===============

     Id  Host           Vhost          Port  Proto  # Pages  # Forms
     --  ----           -----          ----  -----  -------  -------
     0   65.61.137.117  65.61.137.117  80    http   0        0
     1   202.112.50.74  202.112.50.74  80    http   0        0

sf > wmap_targets -t http://202.112.50.74  (把添加的网站作为扫描目标)
msf > wmap_run -t     (同时查看哪些模块中将会在扫描中使用)
[*] Testing target:
[*]  Site: 202.112.50.74 (202.112.50.74)
[*]  Port: 80 SSL: false
============================================================
[*] Testing started. 2014-10-14 05:15:02 -0400
[*] Loading wmap modules...
[*]
=[ SSL testing ]=
============================================================
[*] Target is not SSL. SSL modules disabled.
[*]
=[ Web Server testing ]=
============================================================
[*] Module auxiliary/scanner/http/http_version
[*] Module auxiliary/scanner/http/open_proxy
[*] Module auxiliary/scanner/http/robots_txt
[*] Module auxiliary/scanner/http/frontpage_login
[*] Module auxiliary/admin/http/tomcat_administration
[*] Module auxiliary/admin/http/tomcat_utf8_traversal
[*] Module auxiliary/scanner/http/options
[*] Module auxiliary/scanner/http/drupal_views_user_enum
[*] Module auxiliary/scanner/http/scraper
[*] Module auxiliary/scanner/http/svn_scanner
[*] Module auxiliary/scanner/http/trace
[*] Module auxiliary/scanner/http/vhost_scanner
[*] Module auxiliary/scanner/http/webdav_internal_ip
[*] Module auxiliary/scanner/http/webdav_scanner
[*] Module auxiliary/scanner/http/webdav_website_content
[*]
=[ File/Dir testing ]=
============================================================
[*] Module auxiliary/dos/http/apache_range_dos
[*] Module auxiliary/scanner/http/backup_file
[*] Module auxiliary/scanner/http/brute_dirs
[*] Module auxiliary/scanner/http/copy_of_file
[*] Module auxiliary/scanner/http/dir_listing
[*] Module auxiliary/scanner/http/dir_scanner
[*] Module auxiliary/scanner/http/dir_webdav_unicode_bypass
[*] Module auxiliary/scanner/http/file_same_name_dir
[*] Module auxiliary/scanner/http/files_dir
[*] Module auxiliary/scanner/http/http_put
[*] Module auxiliary/scanner/http/ms09_020_webdav_unicode_bypass
[*] Module auxiliary/scanner/http/prev_dir_same_name_file
[*] Module auxiliary/scanner/http/replace_ext
[*] Module auxiliary/scanner/http/soap_xml
[*] Module auxiliary/scanner/http/trace_axd
[*] Module auxiliary/scanner/http/verb_auth_bypass
[*]
=[ Unique Query testing ]=
============================================================
[*] Module auxiliary/scanner/http/blind_sql_query
[*] Module auxiliary/scanner/http/error_sql_injection
[*] Module auxiliary/scanner/http/http_traversal
[*] Module auxiliary/scanner/http/rails_mass_assignment
[*] Module exploit/multi/http/lcms_php_exec
[*]
=[ Query testing ]=
============================================================
[*]
=[ General testing ]=
============================================================
[*] Done.

运行后，wmap会调用配置好的辅助模块对目标进行扫描，然后通过命令查看结果

msf > wmap_run -e
[*] Using ALL wmap enabled modules.
[-] NO WMAP NODES DEFINED. Executing local modules
[*] Testing target:
[*]  Site: 202.112.50.74 (202.112.50.74)
[*]  Port: 80 SSL: false
============================================================
[*] Testing started. 2014-10-14 05:22:04 -0400
[*]
=[ SSL testing ]=
============================================================
[*] Target is not SSL. SSL modules disabled.
[*]
=[ Web Server testing ]=
============================================================
[*] Module auxiliary/scanner/http/http_version

[*] 202.112.50.74:80
[*] Module auxiliary/scanner/http/open_proxy
[*] Module auxiliary/scanner/http/robots_txt
[*] Module auxiliary/scanner/http/frontpage_login
[*] http://202.112.50.74/ may not support FrontPage Server Extensions
[*] Module auxiliary/admin/http/tomcat_administration
[*] Module auxiliary/admin/http/tomcat_utf8_traversal
[*] Attempting to connect to 202.112.50.74:80
[+] No File(s) found
[*] Module auxiliary/scanner/http/options
[*] 202.112.50.74 allows GET,HEAD,POST,OPTIONS methods
[*] Module auxiliary/scanner/http/drupal_views_user_enum
[-] 202.112.50.74 does not appear to be vulnerable, will not continue
[*] Module auxiliary/scanner/http/scraper
[*] Module auxiliary/scanner/http/svn_scanner
[*] Using code '404' as not found.
[*] Module auxiliary/scanner/http/trace
[-] Received 405 TRACE is not enabled for 202.112.50.74:80
[*] Module auxiliary/scanner/http/vhost_scanner
[*]  >> Exception during launch from auxiliary/scanner/http/vhost_scanner: The following options failed to validate: DOMAIN.
[*] Module auxiliary/scanner/http/webdav_internal_ip
[*] Module auxiliary/scanner/http/webdav_scanner
[*] 202.112.50.74 (Apache/2.2.22 (Ubuntu)) WebDAV disabled.
[*] Module auxiliary/scanner/http/webdav_website_content
[*]
=[ File/Dir testing ]=
============================================================
[*] Module auxiliary/dos/http/apache_range_dos
[*] Module auxiliary/scanner/http/backup_file
[*] Module auxiliary/scanner/http/brute_dirs
[*] Path: /
[*] Using code '404' as not found.
[*] Found http://202.112.50.74:80/axq/ 200

2.渗透模块

exploit/unix/webapp....exploit/windows/http....exploit/multi/http

极其复杂，有针对主流CMS的漏洞，也有各种数据库漏洞的模块

##以下工具与metasploit结合比较完善

W3AF      综合性Web应用扫描和审计工具     开源，功能全面，部分功能待完善
SQLMap    SQL注入和攻击工具    开源，全面
wXf       开源Web渗透测试框架    专门准对Web应用的渗透测试框架。功能待完善
XSSF   跨站脚本攻击框架    利用XSS漏洞配合Metasploit展现出强大的渗透功能
BeEF   浏览器攻击平台框架    通过XSS漏洞配合Metasploit进行各种渗透功能