Bài Hướng Dẫn Mutillidae : Lesson 17 - Using nikto.pl

{ Using nikto.pl }

---

Section 0. Background Information

• What is Mutillidae?
  • OWASP Mutillidae II is a free, open source, deliberately vulnerable web-application providing a target for web-security enthusiast.
• What is Nikto?
  • Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 6400 potentially dangerous files/CGIs, checks for outdated versions of over 1200 servers, and version specific problems on over 270 servers
   
• Pre-Requisite Lab
  1. Mutillidae: Lesson 1: How to Install Mutillidae in Fedora
     • Note: Remote database access has been turned on to provide an additional vulnerability.
  2. BackTrack: Lesson 1: Installing BackTrack 5
     • Note: This is not absolutely necessary, but if you are a computer security student or professional, you should have a BackTrack VM.
• Lab Notes
  • In this lab we will do the following:
    1. We will use nikto.pl to scan the Mutillidae website for vulnerabilities.
    2. We will conduct some server reconnaissance using the HTTP Methods HEAD.
    3. We will exploit the PHP-Nuke Rocket Vulnerability.
    4. We will investigate the OSVBD-3233: /phpinfo.php warning.
    5. We will investigate the OSVDB-3268: Directory Indexing warning.

• Legal Disclaimer  - bài hướng dẫn chỉ dùng cho mục đích nghiên cứu và học tập

Section 1. Configure Fedora14 Virtual Machine Settings

1. Open Your VMware Player
   • Instructions:
     1. On Your Host Computer, Go To
     2. Start --> All Program --> VMWare --> VMWare Player
2. Edit Fedora Mutillidae Virtual Machine Settings
   • Instructions:
     1. Highlight fedora14
     2. Click Edit virtual machine settings
   • 
3. Edit Network Adapter
• Instructions:
  1. Highlight Network Adapter
  2. Select Bridged
  3. Click the OK Button
• 

Section 2. Login to Fedora14 - Mutillidae

1. Start Fedora14 VM Instance
   • Instructions:
     1. Start Up VMWare Player
     2. Select Fedora14 - Mutillidae
     3. Play virtual machine
   • 
2. Login to Fedora14 - Mutillidae
   • Instructions:
     1. Login: student
     2. Password: <whatever you set it to>.
   • 

Section 3. Open Console Terminal and Retrieve IP Address

1. Start a Terminal Console
   • Instructions:
     1. Applications --> Terminal
   • 
2. Switch user to root
   • Instructions:
     1. su - root
     2. <Whatever you set the root password to>
   • 
3. Get IP Address
   • Instructions:
     1. ifconfig -a
   • Notes (FYI):
     • As indicated below, my IP address is 192.168.1.111.
     • Please record your IP address.
   • 

Section 4. Configure BackTrack Virtual Machine Settings

1. Edit the BackTrack5R1 VM
   • Instructions:
     1. Select BackTrack5R1 VM
     2. Click Edit virtual machine settings
   • 
2. Edit Virtual Machine Settings
   • Instructions:
     1. Click on Network Adapter
     2. Click on the Bridged Radio button
     3. Click on the OK Button
   • 

Section 5. Play and Login to BackTrack

1. Play the BackTrack5R1 VM
   • Instructions:
     1. Click on the BackTrack5R1 VM
     2. Click on Play virtual machine
   • 
2. Login to BackTrack
   • Instructions:
     1. Login: root
     2. Password: toor or <whatever you changed it to>.
   • 
3. Bring up the GNOME
   • Instructions:
     1. Type startx
   • 

Section 6. Open Console Terminal and Retrieve IP Address

1. On BackTrack, Start up a terminal window
   • Instructions:
     1. Click on the Terminal Window
   • 
2. Obtain the IP Address
   • Instructions:
     1. ifconfig -a
   • Note(FYI):
     • My IP address 192.168.1.112.
     • In your case, it will probably be different.
     • This is the machine that will be use to attack the victim machine (Mutillidae).
   • 

Section 7. Open Mutillidae

1. On BackTrack, Open Firefox
   • Instructions:
     1. Click on the Firefox Icon
   • Notes (FYI):
     • If FireFox Icon does not exist in the Menu Bar Tray, then go to Applications --> Internet --> Firefox Web Browser
   • 
2. Open Mutillidae
   • Notes (FYI):
     1. Replace 192.168.1.111 in the following URL --> http://192.168.1.111/mutillidae, with your Mutillidae's IP Address obtained from (Section 3, Step 3)
   • Instructions:
     1. Place the following URL in the Address Bar
        • http://192.168.1.111/mutillidae/
   • 

Section 8. Use nikto.pl

1. Navigate to nikto.pl
   • Instructions:
     1. cd /pentest/web/nikto
     2. ls -l
   • 
2. Update nikto
   • Instructions:
     1. ./nikto.pl -update
   • 
3. Show Options
   • Instructions:
     1. ./nikto.pl -help
   • 
4. Scan with nikto
   • Note(FYI):
     • Replace 192.168.1.111 with your mutilldae IP Address obtained from (Section 3, Step 3)
   • Instructions:
     1. ./nikto.pl -host http://192.168.1.111/mutillidae | tee mutillidae.txt
   • 
5. View nikto Scan Results
   • Note(FYI):
     1. Right away Nikto identifies the Apache Web Server Version (2.2.17) and the Operating System (Fedora).
     2. In addition, Nikto indicates that the Apache Web Server is running an outdated version.
     3. Immediately, Nikto has uncovered a PHP-Nuke Vulnerability
   • 

Section 9. Allowed HTTP Methods: GET, HEAD, POST, OPTIONS, TRACE

1. Allowed HTTP Methods: GET, HEAD, POST, OPTIONS, TRACE
   • Note(FYI):
     1. Replace 192.168.1.111 with your mutilldae IP Address obtained from (Section 3, Step 3)
     2. Netcat is a computer networking service for reading from and writing to network connections using TCP or UDP.
     3. The HEAD method is identical to GET except that the server MUST NOT return a message-body in the response.  This method is often used for testing hypertext links for validity, accessibility, and recent modification.
   • Instructions:
     1. netcat  192.168.1.111 80
     2. HEAD /mutillidae/index.php HTTP/1.1
        • 
          
     3. Host: 192.168.1.111
     4. <Press Enter>
     5. <Press Enter>
   • 

Section 10. Allowed PHP-Nuke Rocket Vulnerability

1. Test PHP-Nuke Rocket Vulnerability
   • Note(FYI):
     1. Replace 192.168.1.111 with your mutilldae IP Address obtained from (Section 3, Step 3)
     2. This attack is call a local file inclusion attack that can execute code -OR- in this case to view a sensitive file (e.g., /etc/passwd).
   • Instructions:
     1. Place the following URL in the address box
        • http://192.168.1.111/mutillidae/index.php?page=../../../../../../../../../../etc/passwd
   • 

Section 11. OSVBD-3233: /phpinfo.php: Contains PHP configuration information

1. OSVDB-3233: /phpinfo.php: Contains PHP configuration information
   • Note(FYI):
     1. Replace 192.168.1.111 with your mutilldae IP Address obtained from (Section 3, Step 3)
     2. While there is no known vulnerability or exploit associated with this, default files often reveal sensitive information or contain unknown or undisclosed vulnerabilities. The presence of such files may also reveal information about the web server version or operating system (e.g., fedora 14).
     3. Read More
   • Instructions:
     1. Place the following URL in the address box
        • http://192.168.1.111/mutillidae/phpinfo.php
   • 

Section 12. OSVBD-3092: Multiple Web Server Interesting Web Document Found

1. OSVDB-3092: /includes/
   • Note(FYI):
     1. Replace 192.168.1.111 with your mutilldae IP Address obtained from (Section 3, Step 3)
     2. A potentially interesting configuration directory was found on the web server. While there is no known vulnerability or exploit associated with this, it may contain sensitive information (i.e., authentication) which can be disclosed to unauthenticated remote users, or aid in more focused attacks.
     3. Read More
   • Instructions:
     1. Place the following URL in the address box
        • http://192.168.1.111/mutillidae/includes/
     2. Click the config.inc
   • 
2. OSVDB-3092 Results
   • Note(FYI):
     1. In the old days (i.e., Last 10 Years), Web Administrators would commonly make a mistake of placing sensitive authentication/connection information in include files, which were publically accessible.
     2. Image an automated Internet Bot that does nothing but search the web for include files!!!
   • 

Section 13. OSVDB-3268: Directory Indexing

1. OSVDB-3268: Directory Indexing
   • Note(FYI):
     1. Replace 192.168.1.111 with your mutilldae IP Address obtained from (Section 3, Step 3)
     2. Directory indexing has been found to be enabled on the web server.  While there is might not be vulnerability or exploit associated with this, it may reveal sensitive or "hidden" files or directories to remote users, or aid in more focused attacks.  (e.g., a test file full of password information).
     3. Read More
   • Instructions:
     1. Place the following URL in the address box
        • http://192.168.1.111/mutillidae/passwords/
     2. Click the accounts.txt
   • 
2. OSVDB-3268: Directory Indexing Results
   • Note(FYI):
     1. So, we know the author intentionally included this. 
     2. But, this is a typical accident that might occur for many innocent reasons.  (e.g., development).
     3. How about people's credit card (SOX) or Health Information (HIPAA) being exposed by accident.
   • 

Section 14. Proof of Lab

1. On BackTrack, Start up a terminal window
   • Instructions:
     1. Click on the Terminal Window
   • 
    
2. Proof of Lab, (On a BackTrack Terminal)
   • Instructions:
     1. cd /pentest/web/nikto
     2. ls -l mutillidae.txt
     3. grep -i nuke mutillidae.txt
     4. date
     5. echo "Your Name"
        • Replace the string "Your Name" with your actual name.
        • e.g., echo "John Gray"
   • Proof of Lab Instructions:
     1. Do a PrtScn
     2. Paste into a word document
     3. Upload to website www.antoanthongtin.edu.vn
   •