mirror of
https://github.com/mubix/kaliwiki.git
synced 2025-10-29 16:59:26 +00:00
Merge pull request #52 from pwnwiki/Menu_Vulnerability_Analysis
Menu: Vulnerability Analysis / Database Assessment Complete
This commit is contained in:
WebBreacher
commit
600f17097c
31
tools/bed.md
Normal file
31
tools/bed.md
Normal file
@ -0,0 +1,31 @@
|
|||||||
|
# bed
|
||||||
|
|
||||||
|
Notes
|
||||||
|
-------
|
||||||
|
|
||||||
|
Help Text
|
||||||
|
-------
|
||||||
|
```
|
||||||
|
BED 0.5 by mjm ( www.codito.de ) & eric ( www.snake-basket.de )
|
||||||
|
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
|
||||||
|
./bed.pl -s <plugin> -t <target> -p <port> -o <timeout> [ depends on the plugin ]
|
||||||
|
|
||||||
|
<plugin> = FTP/SMTP/POP/HTTP/IRC/IMAP/PJL/LPD/FINGER/SOCKS4/SOCKS5
|
||||||
|
<target> = Host to check (default: localhost)
|
||||||
|
<port> = Port to connect to (default: standard port)
|
||||||
|
<timeout> = seconds to wait after each test (default: 2 seconds)
|
||||||
|
use "./bed.pl -s <plugin>" to obtain the parameters you need for the plugin.
|
||||||
|
|
||||||
|
Only -s is a mandatory switch.
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
Example Usage
|
||||||
|
-------
|
||||||
|
|
||||||
|
Links
|
||||||
|
-------
|
||||||
|
|
||||||
49
tools/fuzz_ip6.md
Normal file
49
tools/fuzz_ip6.md
Normal file
@ -0,0 +1,49 @@
|
|||||||
|
# fuzz_ip6
|
||||||
|
|
||||||
|
Notes
|
||||||
|
-------
|
||||||
|
|
||||||
|
Help Text
|
||||||
|
-------
|
||||||
|
```
|
||||||
|
fuzz_ip6 v2.3 (c) 2013 by van Hauser / THC <vh@thc.org> www.thc.org
|
||||||
|
|
||||||
|
Syntax: fuzz_ip6 [-x] [-t number | -T number] [-p number] [-IFSDHRJ] [-X|-1|-2|-3|-4|-5|-6|-7|-8|-9|-0 port] interface unicast-or-multicast-address [address-in-data-pkt]
|
||||||
|
|
||||||
|
Fuzzes an icmp6 packet
|
||||||
|
Options:
|
||||||
|
-X do not add any ICMP/TCP header (tranport laye)
|
||||||
|
-1 fuzz ICMP6 echo request (default)
|
||||||
|
-2 fuzz ICMP6 neighbor solicitation
|
||||||
|
-3 fuzz ICMP6 neighbor advertisement
|
||||||
|
-4 fuzz ICMP6 router advertisement
|
||||||
|
-5 fuzz multicast listener report packet
|
||||||
|
-6 fuzz multicast listener done packet
|
||||||
|
-7 fuzz multicast listener query packet
|
||||||
|
-8 fuzz multicast listener v2 report packet
|
||||||
|
-9 fuzz multicast listener v2 query packet
|
||||||
|
-0 fuzz node query packet
|
||||||
|
-s port fuzz TCP-SYN packet against port
|
||||||
|
-x tries all 256 values for flag and byte types
|
||||||
|
-t number continue from test no. number
|
||||||
|
-T number only performs test no. number
|
||||||
|
-p number perform an alive check every number of tests (default: none)
|
||||||
|
-a do not perform initial and final alive test
|
||||||
|
-n number how many times to send each packet (default: 1)
|
||||||
|
-I fuzz the IP header too
|
||||||
|
-F add one-shot fragmentation, and fuzz it too (for 1)
|
||||||
|
-S add source-routing, and fuzz it too (for 1)
|
||||||
|
-D add destination header, and fuzz it too (for 1)
|
||||||
|
-H add hop-by-hop header, and fuzz it too (for 1 and 5-9)
|
||||||
|
-R add router alert header, and fuzz it too (for 5-9 and all)
|
||||||
|
-J add jumbo packet header, and fuzz it too (for 1)
|
||||||
|
You can only define one of -0 ... -9 and -s, defaults to -1.
|
||||||
|
Returns -1 on error, 0 on tests done and targt alive or 1 on target crash.
|
||||||
|
```
|
||||||
|
|
||||||
|
Example Usage
|
||||||
|
-------
|
||||||
|
|
||||||
|
Links
|
||||||
|
-------
|
||||||
|
|
||||||
20
tools/generic_chunked.md
Normal file
20
tools/generic_chunked.md
Normal file
@ -0,0 +1,20 @@
|
|||||||
|
# generic_chunked - spike-generic_chunked
|
||||||
|
|
||||||
|
Notes
|
||||||
|
-------
|
||||||
|
|
||||||
|
Help Text
|
||||||
|
-------
|
||||||
|
```
|
||||||
|
Usage: ./generic_web_server_fuzz target port file.spk skipvariables skipfuzzstring
|
||||||
|
Example: ./gwsf exchange1 80 owa1.spk 0 0
|
||||||
|
http://www.immunitysec.com/spike.html
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
Example Usage
|
||||||
|
-------
|
||||||
|
|
||||||
|
Links
|
||||||
|
-------
|
||||||
|
|
||||||
20
tools/generic_listen_tcp.md
Normal file
20
tools/generic_listen_tcp.md
Normal file
@ -0,0 +1,20 @@
|
|||||||
|
# generic_listen_tcp - spike-generic_listen_tcp
|
||||||
|
|
||||||
|
Notes
|
||||||
|
-------
|
||||||
|
|
||||||
|
Help Text
|
||||||
|
-------
|
||||||
|
```
|
||||||
|
argc=1
|
||||||
|
Usage: ./generic_listen_tcp port spike_script
|
||||||
|
./generic_listen_tcp 70 gopherd.spk
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
Example Usage
|
||||||
|
-------
|
||||||
|
|
||||||
|
Links
|
||||||
|
-------
|
||||||
|
|
||||||
20
tools/generic_send_tcp.md
Normal file
20
tools/generic_send_tcp.md
Normal file
@ -0,0 +1,20 @@
|
|||||||
|
# generic_send_tcp - spike-generic_send_tcp
|
||||||
|
|
||||||
|
Notes
|
||||||
|
-------
|
||||||
|
|
||||||
|
Help Text
|
||||||
|
-------
|
||||||
|
```
|
||||||
|
argc=1
|
||||||
|
Usage: ./generic_send_tcp host port spike_script SKIPVAR SKIPSTR
|
||||||
|
./generic_send_tcp 192.168.1.100 701 something.spk 0 0
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
Example Usage
|
||||||
|
-------
|
||||||
|
|
||||||
|
Links
|
||||||
|
-------
|
||||||
|
|
||||||
19
tools/generic_send_udp.md
Normal file
19
tools/generic_send_udp.md
Normal file
@ -0,0 +1,19 @@
|
|||||||
|
# generic_send_udp spike-generic_send_udp
|
||||||
|
|
||||||
|
Notes
|
||||||
|
-------
|
||||||
|
|
||||||
|
Help Text
|
||||||
|
-------
|
||||||
|
```
|
||||||
|
argc=1
|
||||||
|
Usage: ./gsu target port file.spk startvariable startfuzzstring startvariable startstring totaltosend
|
||||||
|
./gsu 192.168.1.104 80 file.spk 0 0 5000
|
||||||
|
```
|
||||||
|
|
||||||
|
Example Usage
|
||||||
|
-------
|
||||||
|
|
||||||
|
Links
|
||||||
|
-------
|
||||||
|
|
||||||
81
tools/golismero.md
Normal file
81
tools/golismero.md
Normal file
@ -0,0 +1,81 @@
|
|||||||
|
# golismero.py
|
||||||
|
|
||||||
|
Notes
|
||||||
|
-------
|
||||||
|
|
||||||
|
Help Text
|
||||||
|
-------
|
||||||
|
```
|
||||||
|
/----------------------------------------------\
|
||||||
|
| GoLismero 2.0.0b3 - The Web Knife |
|
||||||
|
| Contact: golismero.project<@>gmail.com |
|
||||||
|
| |
|
||||||
|
| Daniel Garcia Garcia a.k.a cr0hn (@ggdaniel) |
|
||||||
|
| Mario Vilas (@Mario_Vilas) |
|
||||||
|
\----------------------------------------------/
|
||||||
|
|
||||||
|
usage: golismero.py COMMAND [TARGETS...] [--options]
|
||||||
|
|
||||||
|
SCAN:
|
||||||
|
Perform a vulnerability scan on the given targets. Optionally import
|
||||||
|
results from other tools and write a report. The arguments that follow may
|
||||||
|
be domain names, IP addresses or web pages.
|
||||||
|
|
||||||
|
PROFILES:
|
||||||
|
Show a list of available config profiles. This command takes no arguments.
|
||||||
|
|
||||||
|
PLUGINS:
|
||||||
|
Show a list of available plugins. This command takes no arguments.
|
||||||
|
|
||||||
|
INFO:
|
||||||
|
Show detailed information on a given plugin. The arguments that follow are
|
||||||
|
the plugin IDs. You can use glob-style wildcards.
|
||||||
|
|
||||||
|
REPORT:
|
||||||
|
Write a report from an earlier scan. This command takes no arguments.
|
||||||
|
To specify output files use the -o switch.
|
||||||
|
|
||||||
|
IMPORT:
|
||||||
|
Import results from other tools and optionally write a report, but don't
|
||||||
|
scan the targets. This command takes no arguments. To specify input files
|
||||||
|
use the -i switch.
|
||||||
|
|
||||||
|
DUMP:
|
||||||
|
Dump the database from an earlier scan in SQL format. This command takes no
|
||||||
|
arguments. To specify output files use the -o switch.
|
||||||
|
|
||||||
|
UPDATE:
|
||||||
|
Update GoLismero to the latest version. Requires Git to be installed and
|
||||||
|
available in the PATH. This command takes no arguments.
|
||||||
|
|
||||||
|
examples:
|
||||||
|
|
||||||
|
scan a website and show the results on screen:
|
||||||
|
golismero.py scan http://www.example.com
|
||||||
|
|
||||||
|
grab Nmap results, scan all hosts found and write an HTML report:
|
||||||
|
golismero.py scan -i nmap_output.xml -o report.html
|
||||||
|
|
||||||
|
grab results from OpenVAS and show them on screen, but don't scan anything:
|
||||||
|
golismero.py import -i openvas_output.xml
|
||||||
|
|
||||||
|
show a list of all available configuration profiles:
|
||||||
|
golismero.py profiles
|
||||||
|
|
||||||
|
show a list of all available plugins:
|
||||||
|
golismero.py plugins
|
||||||
|
|
||||||
|
show information on all bruteforcer plugins:
|
||||||
|
golismero.py info brute_*
|
||||||
|
|
||||||
|
dump the database from a previous scan:
|
||||||
|
golismero.py dump -db example.db -o dump.sql
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
Example Usage
|
||||||
|
-------
|
||||||
|
|
||||||
|
Links
|
||||||
|
-------
|
||||||
|
|
||||||
25
tools/gsd.md
Normal file
25
tools/gsd.md
Normal file
@ -0,0 +1,25 @@
|
|||||||
|
# gsd - Greenbone Security Desktop
|
||||||
|
|
||||||
|
Notes
|
||||||
|
-------
|
||||||
|
The Greenbone Security Desktop (GSD) integrates vulnerability management into the desktop user interface. Parallel access via web browser is still possible, but not mandatory.
|
||||||
|
|
||||||
|
Compared to the web interface GSD offers a faster processing as well as a seamless integration into the desktop environment. Nonetheless all data remain on the Greenbone Security Manager and are only downloaded on request. Therefore concurrent access from different GSD installations provides consistent data status.
|
||||||
|
|
||||||
|
GSD runs on various Windows, MacOSX and GNU/Linux operating systems. For installation packages please contact our support team.
|
||||||
|
|
||||||
|
Attention: The support for Greenbone Security Desktop is phased out, Greenbone OS from version 3.0 will not be supported anymore.
|
||||||
|
|
||||||
|
Help Text
|
||||||
|
-------
|
||||||
|
```
|
||||||
|
This is a GUI tool
|
||||||
|
```
|
||||||
|
|
||||||
|
Example Usage
|
||||||
|
-------
|
||||||
|
|
||||||
|
Links
|
||||||
|
-------
|
||||||
|
|
||||||
|
http://www.greenbone.net/technology/gsd.html
|
||||||
52
tools/lynis.md
Normal file
52
tools/lynis.md
Normal file
@ -0,0 +1,52 @@
|
|||||||
|
# lynis
|
||||||
|
|
||||||
|
Notes
|
||||||
|
-------
|
||||||
|
|
||||||
|
Help Text
|
||||||
|
-------
|
||||||
|
```
|
||||||
|
[ Lynis 1.4.1 ]
|
||||||
|
|
||||||
|
################################################################################
|
||||||
|
Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
|
||||||
|
welcome to redistribute it under the terms of the GNU General Public License.
|
||||||
|
See the LICENSE file for details about using this software.
|
||||||
|
|
||||||
|
Copyright 2007-2014 - Michael Boelen, http://cisofy.com
|
||||||
|
Enterprise support and plugins available via CISOfy - http://cisofy.com
|
||||||
|
################################################################################
|
||||||
|
|
||||||
|
[+] Initializing program
|
||||||
|
------------------------------------
|
||||||
|
Scan options:
|
||||||
|
--auditor "<name>" : Auditor name
|
||||||
|
--check-all (-c) : Check system
|
||||||
|
--no-log : Don't create a log file
|
||||||
|
--profile <profile> : Scan the system with the given profile file
|
||||||
|
--quick (-Q) : Quick mode, don't wait for user input
|
||||||
|
--tests "<tests>" : Run only tests defined by <tests>
|
||||||
|
--tests-category "<category>" : Run only tests defined by <category>
|
||||||
|
|
||||||
|
Layout options:
|
||||||
|
--no-colors : Don't use colors in output
|
||||||
|
--quiet (-q) : No output, except warnings
|
||||||
|
--reverse-colors : Optimize color display for light backgrounds
|
||||||
|
|
||||||
|
Misc options:
|
||||||
|
--check-update : Check for updates
|
||||||
|
--view-manpage (--man) : View man page
|
||||||
|
--version (-V) : Display version number and quit
|
||||||
|
|
||||||
|
See man page and documentation for all available options.
|
||||||
|
|
||||||
|
Exiting..
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
Example Usage
|
||||||
|
-------
|
||||||
|
|
||||||
|
Links
|
||||||
|
-------
|
||||||
|
|
||||||
109
tools/nikto.md
Normal file
109
tools/nikto.md
Normal file
@ -0,0 +1,109 @@
|
|||||||
|
# nikto
|
||||||
|
|
||||||
|
Notes
|
||||||
|
-------
|
||||||
|
|
||||||
|
Help Text
|
||||||
|
-------
|
||||||
|
```
|
||||||
|
Options:
|
||||||
|
-ask+ Whether to ask about submitting updates
|
||||||
|
yes Ask about each (default)
|
||||||
|
no Don't ask, don't send
|
||||||
|
auto Don't ask, just send
|
||||||
|
-Cgidirs+ Scan these CGI dirs: "none", "all", or values like "/cgi/ /cgi-a/"
|
||||||
|
-config+ Use this config file
|
||||||
|
-Display+ Turn on/off display outputs:
|
||||||
|
1 Show redirects
|
||||||
|
2 Show cookies received
|
||||||
|
3 Show all 200/OK responses
|
||||||
|
4 Show URLs which require authentication
|
||||||
|
D Debug output
|
||||||
|
E Display all HTTP errors
|
||||||
|
P Print progress to STDOUT
|
||||||
|
S Scrub output of IPs and hostnames
|
||||||
|
V Verbose output
|
||||||
|
-dbcheck Check database and other key files for syntax errors
|
||||||
|
-evasion+ Encoding technique:
|
||||||
|
1 Random URI encoding (non-UTF8)
|
||||||
|
2 Directory self-reference (/./)
|
||||||
|
3 Premature URL ending
|
||||||
|
4 Prepend long random string
|
||||||
|
5 Fake parameter
|
||||||
|
6 TAB as request spacer
|
||||||
|
7 Change the case of the URL
|
||||||
|
8 Use Windows directory separator (\)
|
||||||
|
A Use a carriage return (0x0d) as a request spacer
|
||||||
|
B Use binary value 0x0b as a request spacer
|
||||||
|
-Format+ Save file (-o) format:
|
||||||
|
csv Comma-separated-value
|
||||||
|
htm HTML Format
|
||||||
|
nbe Nessus NBE format
|
||||||
|
sql Generic SQL (see docs for schema)
|
||||||
|
txt Plain text
|
||||||
|
xml XML Format
|
||||||
|
(if not specified the format will be taken from the file extension passed to -output)
|
||||||
|
-Help Extended help information
|
||||||
|
-host+ Target host
|
||||||
|
-IgnoreCode Ignore Codes--treat as negative responses
|
||||||
|
-id+ Host authentication to use, format is id:pass or id:pass:realm
|
||||||
|
-key+ Client certificate key file
|
||||||
|
-list-plugins List all available plugins, perform no testing
|
||||||
|
-maxtime+ Maximum testing time per host
|
||||||
|
-mutate+ Guess additional file names:
|
||||||
|
1 Test all files with all root directories
|
||||||
|
2 Guess for password file names
|
||||||
|
3 Enumerate user names via Apache (/~user type requests)
|
||||||
|
4 Enumerate user names via cgiwrap (/cgi-bin/cgiwrap/~user type requests)
|
||||||
|
5 Attempt to brute force sub-domain names, assume that the host name is the parent domain
|
||||||
|
6 Attempt to guess directory names from the supplied dictionary file
|
||||||
|
-mutate-options Provide information for mutates
|
||||||
|
-nointeractive Disables interactive features
|
||||||
|
-nolookup Disables DNS lookups
|
||||||
|
-nossl Disables the use of SSL
|
||||||
|
-no404 Disables nikto attempting to guess a 404 page
|
||||||
|
-Option Over-ride an option in nikto.conf, can be issued multiple times
|
||||||
|
-output+ Write output to this file ('.' for auto-name)
|
||||||
|
-Pause+ Pause between tests (seconds, integer or float)
|
||||||
|
-Plugins+ List of plugins to run (default: ALL)
|
||||||
|
-port+ Port to use (default 80)
|
||||||
|
-RSAcert+ Client certificate file
|
||||||
|
-root+ Prepend root value to all requests, format is /directory
|
||||||
|
-Save Save positive responses to this directory ('.' for auto-name)
|
||||||
|
-ssl Force ssl mode on port
|
||||||
|
-Tuning+ Scan tuning:
|
||||||
|
1 Interesting File / Seen in logs
|
||||||
|
2 Misconfiguration / Default File
|
||||||
|
3 Information Disclosure
|
||||||
|
4 Injection (XSS/Script/HTML)
|
||||||
|
5 Remote File Retrieval - Inside Web Root
|
||||||
|
6 Denial of Service
|
||||||
|
7 Remote File Retrieval - Server Wide
|
||||||
|
8 Command Execution / Remote Shell
|
||||||
|
9 SQL Injection
|
||||||
|
0 File Upload
|
||||||
|
a Authentication Bypass
|
||||||
|
b Software Identification
|
||||||
|
b Administration Console
|
||||||
|
c Remote Source Inclusion
|
||||||
|
x Reverse Tuning Options (i.e., include all except specified)
|
||||||
|
-timeout+ Timeout for requests (default 10 seconds)
|
||||||
|
-Userdbs Load only user databases, not the standard databases
|
||||||
|
all Disable standard dbs and load only user dbs
|
||||||
|
tests Disable only db_tests and load udb_tests
|
||||||
|
-useragent Over-rides the default useragent
|
||||||
|
-until Run until the specified time or duration
|
||||||
|
-update Update databases and plugins from CIRT.net
|
||||||
|
-useproxy Use the proxy defined in nikto.conf
|
||||||
|
-Version Print plugin and database versions
|
||||||
|
-vhost+ Virtual host (for Host header)
|
||||||
|
+ requires a value
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
Example Usage
|
||||||
|
-------
|
||||||
|
|
||||||
|
Links
|
||||||
|
-------
|
||||||
|
|
||||||
31
tools/ohrwurm.md
Normal file
31
tools/ohrwurm.md
Normal file
@ -0,0 +1,31 @@
|
|||||||
|
# ohrwurm
|
||||||
|
|
||||||
|
Notes
|
||||||
|
-------
|
||||||
|
|
||||||
|
Help Text
|
||||||
|
-------
|
||||||
|
```
|
||||||
|
ohrwurm-0.1
|
||||||
|
enabled kernel routing.
|
||||||
|
|
||||||
|
usage: ohrwurm -a <IP target a> -b <IP target b> [-s <randomseed>] [-e <bit error ratio in %>] [-i <interface>] [-A <RTP port a> -B <RTP port b>]
|
||||||
|
|
||||||
|
-a <IPv4 address A in dot-decimal notation> SIP phone A
|
||||||
|
-b <IPv4 address B in dot-decimal notation> SIP phone B
|
||||||
|
-s <integer> randomseed (default: read from /dev/urandom)
|
||||||
|
-e <double> bit error ratio in % (default: 1.230000)
|
||||||
|
-i <interfacename> network interface (default: eth0)
|
||||||
|
-t suppress RTCP packets (default: dont suppress)
|
||||||
|
-A <port number> of RTP port on IP a (requires -B)
|
||||||
|
-B <port number> of RTP port on IP b (requires -A)
|
||||||
|
note: using -A and -B skips SIP sniffing, any RTP can be fuzzed
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
Example Usage
|
||||||
|
-------
|
||||||
|
|
||||||
|
Links
|
||||||
|
-------
|
||||||
|
|
||||||
30
tools/openvas-check-setup.md
Normal file
30
tools/openvas-check-setup.md
Normal file
@ -0,0 +1,30 @@
|
|||||||
|
# openvas-check-setup
|
||||||
|
|
||||||
|
Notes
|
||||||
|
-------
|
||||||
|
|
||||||
|
Help Text
|
||||||
|
-------
|
||||||
|
```
|
||||||
|
openvas-check-setup 2.2.3
|
||||||
|
Test completeness and readiness of OpenVAS-6
|
||||||
|
(add '--v4', '--v5' or '--v7'
|
||||||
|
if you want to check for another OpenVAS version)
|
||||||
|
|
||||||
|
Please report us any non-detected problems and
|
||||||
|
help us to improve this check routine:
|
||||||
|
http://lists.wald.intevation.org/mailman/listinfo/openvas-discuss
|
||||||
|
|
||||||
|
Send us the log-file (/tmp/openvas-check-setup.log) to help analyze the problem.
|
||||||
|
|
||||||
|
Use the parameter --server to skip checks for client tools
|
||||||
|
like GSD and OpenVAS-CLI.
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
Example Usage
|
||||||
|
-------
|
||||||
|
|
||||||
|
Links
|
||||||
|
-------
|
||||||
|
|
||||||
27
tools/openvas-feed-update.md
Normal file
27
tools/openvas-feed-update.md
Normal file
@ -0,0 +1,27 @@
|
|||||||
|
# openvas-feed-update
|
||||||
|
|
||||||
|
Notes
|
||||||
|
-------
|
||||||
|
|
||||||
|
Help Text
|
||||||
|
-------
|
||||||
|
```
|
||||||
|
Updating OpenVas Feeds
|
||||||
|
[i] This script synchronizes an NVT collection with the 'OpenVAS NVT Feed'.
|
||||||
|
[i] The 'OpenVAS NVT Feed' is provided by 'The OpenVAS Project'.
|
||||||
|
[i] Online information about this feed: 'http://www.openvas.org/openvas-nvt-feed.html'.
|
||||||
|
[i] NVT dir: /var/lib/openvas/plugins
|
||||||
|
[i] Will use rsync
|
||||||
|
[i] Using rsync: /usr/bin/rsync
|
||||||
|
[i] Configured NVT rsync feed: rsync://feed.openvas.org:/nvt-feed
|
||||||
|
[w] Private directory '/var/lib/openvas/plugins/private' not found.
|
||||||
|
[w] Non-feed NVTs not migrated there will be deleted by rsync.
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
Example Usage
|
||||||
|
-------
|
||||||
|
|
||||||
|
Links
|
||||||
|
-------
|
||||||
|
|
||||||
25
tools/openvas-setup.md
Normal file
25
tools/openvas-setup.md
Normal file
@ -0,0 +1,25 @@
|
|||||||
|
# openvas-setup
|
||||||
|
|
||||||
|
Notes
|
||||||
|
-------
|
||||||
|
|
||||||
|
Help Text
|
||||||
|
-------
|
||||||
|
```
|
||||||
|
[i] This script synchronizes an NVT collection with the 'OpenVAS NVT Feed'.
|
||||||
|
[i] The 'OpenVAS NVT Feed' is provided by 'The OpenVAS Project'.
|
||||||
|
[i] Online information about this feed: 'http://www.openvas.org/openvas-nvt-feed.html'.
|
||||||
|
[i] NVT dir: /var/lib/openvas/plugins
|
||||||
|
[i] Will use rsync
|
||||||
|
[i] Using rsync: /usr/bin/rsync
|
||||||
|
[i] Configured NVT rsync feed: rsync://feed.openvas.org:/nvt-feed
|
||||||
|
[w] Private directory '/var/lib/openvas/plugins/private' not found.
|
||||||
|
[w] Non-feed NVTs not migrated there will be deleted by rsync.
|
||||||
|
```
|
||||||
|
|
||||||
|
Example Usage
|
||||||
|
-------
|
||||||
|
|
||||||
|
Links
|
||||||
|
-------
|
||||||
|
|
||||||
18
tools/openvas-start.md
Normal file
18
tools/openvas-start.md
Normal file
@ -0,0 +1,18 @@
|
|||||||
|
# openvas-start
|
||||||
|
|
||||||
|
Notes
|
||||||
|
-------
|
||||||
|
Start Script for openvas
|
||||||
|
|
||||||
|
Help Text
|
||||||
|
-------
|
||||||
|
```
|
||||||
|
Text output goes here
|
||||||
|
```
|
||||||
|
|
||||||
|
Example Usage
|
||||||
|
-------
|
||||||
|
|
||||||
|
Links
|
||||||
|
-------
|
||||||
|
|
||||||
18
tools/openvas-stop.md
Normal file
18
tools/openvas-stop.md
Normal file
@ -0,0 +1,18 @@
|
|||||||
|
# openvas-stop
|
||||||
|
|
||||||
|
Notes
|
||||||
|
-------
|
||||||
|
Stop script for openvas
|
||||||
|
|
||||||
|
Help Text
|
||||||
|
-------
|
||||||
|
```
|
||||||
|
Text output goes here
|
||||||
|
```
|
||||||
|
|
||||||
|
Example Usage
|
||||||
|
-------
|
||||||
|
|
||||||
|
Links
|
||||||
|
-------
|
||||||
|
|
||||||
24
tools/oscanner.md
Normal file
24
tools/oscanner.md
Normal file
@ -0,0 +1,24 @@
|
|||||||
|
# OracleScanner
|
||||||
|
|
||||||
|
Notes
|
||||||
|
-------
|
||||||
|
|
||||||
|
Help Text
|
||||||
|
-------
|
||||||
|
```
|
||||||
|
Oracle Scanner 1.0.6 by patrik@cqure.net
|
||||||
|
--------------------------------------
|
||||||
|
OracleScanner -s <ip> -r <repfile> [options]
|
||||||
|
-s <servername>
|
||||||
|
-f <serverlist>
|
||||||
|
-P <portnr>
|
||||||
|
-v be verbose
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
Example Usage
|
||||||
|
-------
|
||||||
|
|
||||||
|
Links
|
||||||
|
-------
|
||||||
|
|
||||||
29
tools/powerfuzzer.md
Normal file
29
tools/powerfuzzer.md
Normal file
@ -0,0 +1,29 @@
|
|||||||
|
# powerfuzzer
|
||||||
|
|
||||||
|
Notes
|
||||||
|
-------
|
||||||
|
Powerfuzzer is a highly automated and fully customizable web fuzzer (HTTP protocol based application fuzzer) based on many other Open Source fuzzers available and information gathered from numerous security resources and websites. It was designed to be user friendly, modern, effective and working.
|
||||||
|
|
||||||
|
Don't have a clue what a Fuzzer/Fuzz testing is ? Not a problem, read on [here](http://en.wikipedia.org/wiki/Fuzz_testing)
|
||||||
|
|
||||||
|
Currently, it is capable of identifying these problems:
|
||||||
|
- Cross Site Scripting (XSS)
|
||||||
|
- Injections (SQL, LDAP, code, commands, and XPATH)
|
||||||
|
- CRLF
|
||||||
|
- HTTP 500 statuses (usually indicative of a possible misconfiguration/security flaw incl. buffer overflow)
|
||||||
|
|
||||||
|
Designed and coded to be modular and extendable. Adding new checks should simply entail adding new methods.
|
||||||
|
|
||||||
|
|
||||||
|
Help Text
|
||||||
|
-------
|
||||||
|
```
|
||||||
|
GUI Tool
|
||||||
|
```
|
||||||
|
|
||||||
|
Example Usage
|
||||||
|
-------
|
||||||
|
|
||||||
|
Links
|
||||||
|
-------
|
||||||
|
http://www.powerfuzzer.com/
|
||||||
46
tools/sfuzz.md
Normal file
46
tools/sfuzz.md
Normal file
@ -0,0 +1,46 @@
|
|||||||
|
# sfuzz - Simple Fuzzer
|
||||||
|
|
||||||
|
Notes
|
||||||
|
-------
|
||||||
|
|
||||||
|
Help Text
|
||||||
|
-------
|
||||||
|
```
|
||||||
|
Simple Fuzzer
|
||||||
|
By: Aaron Conole
|
||||||
|
version: 0.7.0
|
||||||
|
url: http://aconole.brad-x.com/programs/sfuzz.html
|
||||||
|
EMAIL: apconole@yahoo.com
|
||||||
|
Build-prefix: /usr
|
||||||
|
-h This message.
|
||||||
|
-V Version information.
|
||||||
|
|
||||||
|
networking / output:
|
||||||
|
-v Verbose output
|
||||||
|
-q Silent output mode (generally for CLI fuzzing)
|
||||||
|
-X prints the output in hex
|
||||||
|
|
||||||
|
-b Begin fuzzing at the test specified.
|
||||||
|
-e End testing on failure.
|
||||||
|
-t Wait time for reading the socket
|
||||||
|
-S Remote host
|
||||||
|
-p Port
|
||||||
|
-T|-U|-O TCP|UDP|Output mode
|
||||||
|
-R Refrain from closing connections (ie: "leak" them)
|
||||||
|
|
||||||
|
-f Config File
|
||||||
|
-L Log file
|
||||||
|
-n Create a new logfile after each fuzz
|
||||||
|
-r Trim the tailing newline
|
||||||
|
-D Define a symbol and value (X=y).
|
||||||
|
-l Only perform literal fuzzing
|
||||||
|
-s Only perform sequence fuzzing
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
Example Usage
|
||||||
|
-------
|
||||||
|
|
||||||
|
Links
|
||||||
|
-------
|
||||||
|
|
||||||
25
tools/sidguess.md
Normal file
25
tools/sidguess.md
Normal file
@ -0,0 +1,25 @@
|
|||||||
|
# sidguess - SidGuesser
|
||||||
|
|
||||||
|
Notes
|
||||||
|
-------
|
||||||
|
|
||||||
|
Help Text
|
||||||
|
-------
|
||||||
|
```
|
||||||
|
SIDGuesser v1.0.5 by patrik@cqure.net
|
||||||
|
-------------------------------------
|
||||||
|
sidguess -i <ip> -d <dictionary> [options]
|
||||||
|
|
||||||
|
options:
|
||||||
|
-p <portnr> Use specific port (default 1521)
|
||||||
|
-r <report> Report to file
|
||||||
|
-m <mode> findfirst OR findall(default)
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
Example Usage
|
||||||
|
-------
|
||||||
|
|
||||||
|
Links
|
||||||
|
-------
|
||||||
|
|
||||||
19
tools/siparmyknife.md
Normal file
19
tools/siparmyknife.md
Normal file
@ -0,0 +1,19 @@
|
|||||||
|
# siparmyknife - SIP Army Knife
|
||||||
|
|
||||||
|
Notes
|
||||||
|
-------
|
||||||
|
SIP Army Knife is a fuzzer that searches for cross site scripting, SQL injection, log injection, format strings, buffer overflows, and more.
|
||||||
|
|
||||||
|
|
||||||
|
Help Text
|
||||||
|
-------
|
||||||
|
```
|
||||||
|
-h, Enter host
|
||||||
|
```
|
||||||
|
|
||||||
|
Example Usage
|
||||||
|
-------
|
||||||
|
|
||||||
|
Links
|
||||||
|
-------
|
||||||
|
|
||||||
20
tools/sqldict.md
Normal file
20
tools/sqldict.md
Normal file
@ -0,0 +1,20 @@
|
|||||||
|
# sqldict
|
||||||
|
|
||||||
|
Notes
|
||||||
|
-------
|
||||||
|
Compiler's note: need to add visual screen shots of this tool.
|
||||||
|
|
||||||
|
Help Text
|
||||||
|
-------
|
||||||
|
```
|
||||||
|
Usage instructions
|
||||||
|
|
||||||
|
Download the exe file and run it. Specify the target server IP address, the target account name, and select a password list file to use for the dictionary attack.
|
||||||
|
```
|
||||||
|
|
||||||
|
Example Usage
|
||||||
|
-------
|
||||||
|
|
||||||
|
Links
|
||||||
|
-------
|
||||||
|
|
||||||
248
tools/sqlmap.md
Normal file
248
tools/sqlmap.md
Normal file
@ -0,0 +1,248 @@
|
|||||||
|
# sqlmap
|
||||||
|
|
||||||
|
Notes
|
||||||
|
-------
|
||||||
|
|
||||||
|
Help Text
|
||||||
|
-------
|
||||||
|
```
|
||||||
|
Options:
|
||||||
|
-h, --help Show basic help message and exit
|
||||||
|
-hh Show advanced help message and exit
|
||||||
|
--version Show program's version number and exit
|
||||||
|
-v VERBOSE Verbosity level: 0-6 (default 1)
|
||||||
|
|
||||||
|
Target:
|
||||||
|
At least one of these options has to be provided to set the target(s)
|
||||||
|
|
||||||
|
-d DIRECT Direct connection to the database
|
||||||
|
-u URL, --url=URL Target URL (e.g. "www.target.com/vuln.php?id=1")
|
||||||
|
-l LOGFILE Parse targets from Burp or WebScarab proxy logs
|
||||||
|
-m BULKFILE Scan multiple targets enlisted in a given textual file
|
||||||
|
-r REQUESTFILE Load HTTP request from a file
|
||||||
|
-g GOOGLEDORK Process Google dork results as target URLs
|
||||||
|
-c CONFIGFILE Load options from a configuration INI file
|
||||||
|
|
||||||
|
Request:
|
||||||
|
These options can be used to specify how to connect to the target URL
|
||||||
|
|
||||||
|
--data=DATA Data string to be sent through POST
|
||||||
|
--param-del=PDEL Character used for splitting parameter values
|
||||||
|
--cookie=COOKIE HTTP Cookie header
|
||||||
|
--cookie-del=CDEL Character used for splitting cookie values
|
||||||
|
--load-cookies=L.. File containing cookies in Netscape/wget format
|
||||||
|
--drop-set-cookie Ignore Set-Cookie header from response
|
||||||
|
--user-agent=AGENT HTTP User-Agent header
|
||||||
|
--random-agent Use randomly selected HTTP User-Agent header
|
||||||
|
--host=HOST HTTP Host header
|
||||||
|
--referer=REFERER HTTP Referer header
|
||||||
|
--headers=HEADERS Extra headers (e.g. "Accept-Language: fr\nETag: 123")
|
||||||
|
--auth-type=AUTH.. HTTP authentication type (Basic, Digest, NTLM or PKI)
|
||||||
|
--auth-cred=AUTH.. HTTP authentication credentials (name:password)
|
||||||
|
--auth-private=A.. HTTP authentication PEM private key file
|
||||||
|
--proxy=PROXY Use a proxy to connect to the target URL
|
||||||
|
--proxy-cred=PRO.. Proxy authentication credentials (name:password)
|
||||||
|
--proxy-file=PRO.. Load proxy list from a file
|
||||||
|
--ignore-proxy Ignore system default proxy settings
|
||||||
|
--tor Use Tor anonymity network
|
||||||
|
--tor-port=TORPORT Set Tor proxy port other than default
|
||||||
|
--tor-type=TORTYPE Set Tor proxy type (HTTP (default), SOCKS4 or SOCKS5)
|
||||||
|
--check-tor Check to see if Tor is used properly
|
||||||
|
--delay=DELAY Delay in seconds between each HTTP request
|
||||||
|
--timeout=TIMEOUT Seconds to wait before timeout connection (default 30)
|
||||||
|
--retries=RETRIES Retries when the connection timeouts (default 3)
|
||||||
|
--randomize=RPARAM Randomly change value for given parameter(s)
|
||||||
|
--safe-url=SAFURL URL address to visit frequently during testing
|
||||||
|
--safe-freq=SAFREQ Test requests between two visits to a given safe URL
|
||||||
|
--skip-urlencode Skip URL encoding of payload data
|
||||||
|
--force-ssl Force usage of SSL/HTTPS
|
||||||
|
--hpp Use HTTP parameter pollution
|
||||||
|
--eval=EVALCODE Evaluate provided Python code before the request (e.g.
|
||||||
|
"import hashlib;id2=hashlib.md5(id).hexdigest()")
|
||||||
|
|
||||||
|
Optimization:
|
||||||
|
These options can be used to optimize the performance of sqlmap
|
||||||
|
|
||||||
|
-o Turn on all optimization switches
|
||||||
|
--predict-output Predict common queries output
|
||||||
|
--keep-alive Use persistent HTTP(s) connections
|
||||||
|
--null-connection Retrieve page length without actual HTTP response body
|
||||||
|
--threads=THREADS Max number of concurrent HTTP(s) requests (default 1)
|
||||||
|
|
||||||
|
Injection:
|
||||||
|
These options can be used to specify which parameters to test for,
|
||||||
|
provide custom injection payloads and optional tampering scripts
|
||||||
|
|
||||||
|
-p TESTPARAMETER Testable parameter(s)
|
||||||
|
--skip=SKIP Skip testing for given parameter(s)
|
||||||
|
--dbms=DBMS Force back-end DBMS to this value
|
||||||
|
--dbms-cred=DBMS.. DBMS authentication credentials (user:password)
|
||||||
|
--os=OS Force back-end DBMS operating system to this value
|
||||||
|
--invalid-bignum Use big numbers for invalidating values
|
||||||
|
--invalid-logical Use logical operations for invalidating values
|
||||||
|
--invalid-string Use random strings for invalidating values
|
||||||
|
--no-cast Turn off payload casting mechanism
|
||||||
|
--no-escape Turn off string escaping mechanism
|
||||||
|
--prefix=PREFIX Injection payload prefix string
|
||||||
|
--suffix=SUFFIX Injection payload suffix string
|
||||||
|
--tamper=TAMPER Use given script(s) for tampering injection data
|
||||||
|
|
||||||
|
Detection:
|
||||||
|
These options can be used to customize the detection phase
|
||||||
|
|
||||||
|
--level=LEVEL Level of tests to perform (1-5, default 1)
|
||||||
|
--risk=RISK Risk of tests to perform (0-3, default 1)
|
||||||
|
--string=STRING String to match when query is evaluated to True
|
||||||
|
--not-string=NOT.. String to match when query is evaluated to False
|
||||||
|
--regexp=REGEXP Regexp to match when query is evaluated to True
|
||||||
|
--code=CODE HTTP code to match when query is evaluated to True
|
||||||
|
--text-only Compare pages based only on the textual content
|
||||||
|
--titles Compare pages based only on their titles
|
||||||
|
|
||||||
|
Techniques:
|
||||||
|
These options can be used to tweak testing of specific SQL injection
|
||||||
|
techniques
|
||||||
|
|
||||||
|
--technique=TECH SQL injection techniques to use (default "BEUSTQ")
|
||||||
|
--time-sec=TIMESEC Seconds to delay the DBMS response (default 5)
|
||||||
|
--union-cols=UCOLS Range of columns to test for UNION query SQL injection
|
||||||
|
--union-char=UCHAR Character to use for bruteforcing number of columns
|
||||||
|
--union-from=UFROM Table to use in FROM part of UNION query SQL injection
|
||||||
|
--dns-domain=DNS.. Domain name used for DNS exfiltration attack
|
||||||
|
--second-order=S.. Resulting page URL searched for second-order response
|
||||||
|
|
||||||
|
Fingerprint:
|
||||||
|
-f, --fingerprint Perform an extensive DBMS version fingerprint
|
||||||
|
|
||||||
|
Enumeration:
|
||||||
|
These options can be used to enumerate the back-end database
|
||||||
|
management system information, structure and data contained in the
|
||||||
|
tables. Moreover you can run your own SQL statements
|
||||||
|
|
||||||
|
-a, --all Retrieve everything
|
||||||
|
-b, --banner Retrieve DBMS banner
|
||||||
|
--current-user Retrieve DBMS current user
|
||||||
|
--current-db Retrieve DBMS current database
|
||||||
|
--hostname Retrieve DBMS server hostname
|
||||||
|
--is-dba Detect if the DBMS current user is DBA
|
||||||
|
--users Enumerate DBMS users
|
||||||
|
--passwords Enumerate DBMS users password hashes
|
||||||
|
--privileges Enumerate DBMS users privileges
|
||||||
|
--roles Enumerate DBMS users roles
|
||||||
|
--dbs Enumerate DBMS databases
|
||||||
|
--tables Enumerate DBMS database tables
|
||||||
|
--columns Enumerate DBMS database table columns
|
||||||
|
--schema Enumerate DBMS schema
|
||||||
|
--count Retrieve number of entries for table(s)
|
||||||
|
--dump Dump DBMS database table entries
|
||||||
|
--dump-all Dump all DBMS databases tables entries
|
||||||
|
--search Search column(s), table(s) and/or database name(s)
|
||||||
|
--comments Retrieve DBMS comments
|
||||||
|
-D DB DBMS database to enumerate
|
||||||
|
-T TBL DBMS database table(s) to enumerate
|
||||||
|
-C COL DBMS database table column(s) to enumerate
|
||||||
|
-X EXCLUDECOL DBMS database table column(s) to not enumerate
|
||||||
|
-U USER DBMS user to enumerate
|
||||||
|
--exclude-sysdbs Exclude DBMS system databases when enumerating tables
|
||||||
|
--where=DUMPWHERE Use WHERE condition while table dumping
|
||||||
|
--start=LIMITSTART First query output entry to retrieve
|
||||||
|
--stop=LIMITSTOP Last query output entry to retrieve
|
||||||
|
--first=FIRSTCHAR First query output word character to retrieve
|
||||||
|
--last=LASTCHAR Last query output word character to retrieve
|
||||||
|
--sql-query=QUERY SQL statement to be executed
|
||||||
|
--sql-shell Prompt for an interactive SQL shell
|
||||||
|
--sql-file=SQLFILE Execute SQL statements from given file(s)
|
||||||
|
|
||||||
|
Brute force:
|
||||||
|
These options can be used to run brute force checks
|
||||||
|
|
||||||
|
--common-tables Check existence of common tables
|
||||||
|
--common-columns Check existence of common columns
|
||||||
|
|
||||||
|
User-defined function injection:
|
||||||
|
These options can be used to create custom user-defined functions
|
||||||
|
|
||||||
|
--udf-inject Inject custom user-defined functions
|
||||||
|
--shared-lib=SHLIB Local path of the shared library
|
||||||
|
|
||||||
|
File system access:
|
||||||
|
These options can be used to access the back-end database management
|
||||||
|
system underlying file system
|
||||||
|
|
||||||
|
--file-read=RFILE Read a file from the back-end DBMS file system
|
||||||
|
--file-write=WFILE Write a local file on the back-end DBMS file system
|
||||||
|
--file-dest=DFILE Back-end DBMS absolute filepath to write to
|
||||||
|
|
||||||
|
Operating system access:
|
||||||
|
These options can be used to access the back-end database management
|
||||||
|
system underlying operating system
|
||||||
|
|
||||||
|
--os-cmd=OSCMD Execute an operating system command
|
||||||
|
--os-shell Prompt for an interactive operating system shell
|
||||||
|
--os-pwn Prompt for an OOB shell, meterpreter or VNC
|
||||||
|
--os-smbrelay One click prompt for an OOB shell, meterpreter or VNC
|
||||||
|
--os-bof Stored procedure buffer overflow exploitation
|
||||||
|
--priv-esc Database process user privilege escalation
|
||||||
|
--msf-path=MSFPATH Local path where Metasploit Framework is installed
|
||||||
|
--tmp-path=TMPPATH Remote absolute path of temporary files directory
|
||||||
|
|
||||||
|
Windows registry access:
|
||||||
|
These options can be used to access the back-end database management
|
||||||
|
system Windows registry
|
||||||
|
|
||||||
|
--reg-read Read a Windows registry key value
|
||||||
|
--reg-add Write a Windows registry key value data
|
||||||
|
--reg-del Delete a Windows registry key value
|
||||||
|
--reg-key=REGKEY Windows registry key
|
||||||
|
--reg-value=REGVAL Windows registry key value
|
||||||
|
--reg-data=REGDATA Windows registry key value data
|
||||||
|
--reg-type=REGTYPE Windows registry key value type
|
||||||
|
|
||||||
|
General:
|
||||||
|
These options can be used to set some general working parameters
|
||||||
|
|
||||||
|
-s SESSIONFILE Load session from a stored (.sqlite) file
|
||||||
|
-t TRAFFICFILE Log all HTTP traffic into a textual file
|
||||||
|
--batch Never ask for user input, use the default behaviour
|
||||||
|
--charset=CHARSET Force character encoding used for data retrieval
|
||||||
|
--crawl=CRAWLDEPTH Crawl the website starting from the target URL
|
||||||
|
--csv-del=CSVDEL Delimiting character used in CSV output (default ",")
|
||||||
|
--dump-format=DU.. Format of dumped data (CSV (default), HTML or SQLITE)
|
||||||
|
--eta Display for each output the estimated time of arrival
|
||||||
|
--flush-session Flush session files for current target
|
||||||
|
--forms Parse and test forms on target URL
|
||||||
|
--fresh-queries Ignore query results stored in session file
|
||||||
|
--hex Use DBMS hex function(s) for data retrieval
|
||||||
|
--output-dir=ODIR Custom output directory path
|
||||||
|
--parse-errors Parse and display DBMS error messages from responses
|
||||||
|
--pivot-column=P.. Pivot column name
|
||||||
|
--save Save options to a configuration INI file
|
||||||
|
--scope=SCOPE Regexp to filter targets from provided proxy log
|
||||||
|
--test-filter=TE.. Select tests by payloads and/or titles (e.g. ROW)
|
||||||
|
--update Update sqlmap
|
||||||
|
|
||||||
|
Miscellaneous:
|
||||||
|
-z MNEMONICS Use short mnemonics (e.g. "flu,bat,ban,tec=EU")
|
||||||
|
--alert=ALERT Run host OS command(s) when SQL injection is found
|
||||||
|
--answers=ANSWERS Set question answers (e.g. "quit=N,follow=N")
|
||||||
|
--beep Make a beep sound when SQL injection is found
|
||||||
|
--check-waf Heuristically check for WAF/IPS/IDS protection
|
||||||
|
--cleanup Clean up the DBMS from sqlmap specific UDF and tables
|
||||||
|
--dependencies Check for missing (non-core) sqlmap dependencies
|
||||||
|
--disable-coloring Disable console output coloring
|
||||||
|
--gpage=GOOGLEPAGE Use Google dork results from specified page number
|
||||||
|
--identify-waf Make a through testing for a WAF/IPS/IDS protection
|
||||||
|
--mobile Imitate smartphone through HTTP User-Agent header
|
||||||
|
--page-rank Display page rank (PR) for Google dork results
|
||||||
|
--purge-output Safely remove all content from output directory
|
||||||
|
--smart Conduct through tests only if positive heuristic(s)
|
||||||
|
--wizard Simple wizard interface for beginner users
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
Example Usage
|
||||||
|
-------
|
||||||
|
|
||||||
|
Links
|
||||||
|
-------
|
||||||
|
|
||||||
46
tools/sqlninja.md
Normal file
46
tools/sqlninja.md
Normal file
@ -0,0 +1,46 @@
|
|||||||
|
# sqlninja
|
||||||
|
|
||||||
|
Notes
|
||||||
|
-------
|
||||||
|
|
||||||
|
Help Text
|
||||||
|
-------
|
||||||
|
```
|
||||||
|
Sqlninja rel. 0.2.6-r1
|
||||||
|
Copyright (C) 2006-2011 icesurfer <r00t@northernfortress.net>
|
||||||
|
Usage: /usr/bin/sqlninja
|
||||||
|
-m <mode> : Required. Available modes are:
|
||||||
|
t/test - test whether the injection is working
|
||||||
|
f/fingerprint - fingerprint user, xp_cmdshell and more
|
||||||
|
b/bruteforce - bruteforce sa account
|
||||||
|
e/escalation - add user to sysadmin server role
|
||||||
|
x/resurrectxp - try to recreate xp_cmdshell
|
||||||
|
u/upload - upload a .scr file
|
||||||
|
s/dirshell - start a direct shell
|
||||||
|
k/backscan - look for an open outbound port
|
||||||
|
r/revshell - start a reverse shell
|
||||||
|
d/dnstunnel - attempt a dns tunneled shell
|
||||||
|
i/icmpshell - start a reverse ICMP shell
|
||||||
|
c/sqlcmd - issue a 'blind' OS command
|
||||||
|
m/metasploit - wrapper to Metasploit stagers
|
||||||
|
-f <file> : configuration file (default: sqlninja.conf)
|
||||||
|
-p <password> : sa password
|
||||||
|
-w <wordlist> : wordlist to use in bruteforce mode (dictionary method
|
||||||
|
only)
|
||||||
|
-g : generate debug script and exit (only valid in upload mode)
|
||||||
|
-v : verbose output
|
||||||
|
-d <mode> : activate debug
|
||||||
|
1 - print each injected command
|
||||||
|
2 - print each raw HTTP request
|
||||||
|
3 - print each raw HTTP response
|
||||||
|
all - all of the above
|
||||||
|
...see sqlninja-howto.html for details
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
Example Usage
|
||||||
|
-------
|
||||||
|
|
||||||
|
Links
|
||||||
|
-------
|
||||||
|
|
||||||
29
tools/sqlsus.md
Normal file
29
tools/sqlsus.md
Normal file
@ -0,0 +1,29 @@
|
|||||||
|
# sqlsus
|
||||||
|
|
||||||
|
Notes
|
||||||
|
-------
|
||||||
|
|
||||||
|
Help Text
|
||||||
|
-------
|
||||||
|
```
|
||||||
|
sqlsus version 0.7.2
|
||||||
|
|
||||||
|
Copyright (c) 2008-2011 Jérémy Ruffet (sativouf)
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
sqlsus [options] [config file]
|
||||||
|
|
||||||
|
Options:
|
||||||
|
-h, --help brief help message
|
||||||
|
-v, --version version information
|
||||||
|
-e, --execute <commands> execute commands and exit
|
||||||
|
-g, --genconf <filename> generate configuration file
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
Example Usage
|
||||||
|
-------
|
||||||
|
|
||||||
|
Links
|
||||||
|
-------
|
||||||
|
|
||||||
26
tools/tnscmd10g.md
Normal file
26
tools/tnscmd10g.md
Normal file
@ -0,0 +1,26 @@
|
|||||||
|
# tnscmd10g
|
||||||
|
|
||||||
|
Notes
|
||||||
|
-------
|
||||||
|
|
||||||
|
Help Text
|
||||||
|
-------
|
||||||
|
```
|
||||||
|
usage: /usr/bin/tnscmd10g [command] -h hostname
|
||||||
|
where 'command' is something like ping, version, status, etc.
|
||||||
|
(default is ping)
|
||||||
|
[-p port] - alternate TCP port to use (default is 1521)
|
||||||
|
[--logfile logfile] - write raw packets to specified logfile
|
||||||
|
[--indent] - indent & outdent on parens
|
||||||
|
[--10G] - make it work against 10G
|
||||||
|
[--rawcmd command] - build your own CONNECT_DATA string
|
||||||
|
[--cmdsize bytes] - fake TNS command size (reveals packet leakage)
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
Example Usage
|
||||||
|
-------
|
||||||
|
|
||||||
|
Links
|
||||||
|
-------
|
||||||
|
|
||||||
38
tools/unix-privesc-check.md
Normal file
38
tools/unix-privesc-check.md
Normal file
@ -0,0 +1,38 @@
|
|||||||
|
# unix-privesc-check
|
||||||
|
|
||||||
|
Notes
|
||||||
|
-------
|
||||||
|
|
||||||
|
Help Text
|
||||||
|
-------
|
||||||
|
```
|
||||||
|
unix-privesc-check v1.4 ( http://pentestmonkey.net/tools/unix-privesc-check )
|
||||||
|
|
||||||
|
Usage: unix-privesc-check { standard | detailed }
|
||||||
|
|
||||||
|
"standard" mode: Speed-optimised check of lots of security settings.
|
||||||
|
|
||||||
|
"detailed" mode: Same as standard mode, but also checks perms of open file
|
||||||
|
handles and called files (e.g. parsed from shell scripts,
|
||||||
|
linked .so files). This mode is slow and prone to false
|
||||||
|
positives but might help you find more subtle flaws in 3rd
|
||||||
|
party programs.
|
||||||
|
|
||||||
|
This script checks file permissions and other settings that could allow
|
||||||
|
local users to escalate privileges.
|
||||||
|
|
||||||
|
Use of this script is only permitted on systems which you have been granted
|
||||||
|
legal permission to perform a security assessment of. Apart from this
|
||||||
|
condition the GPL v2 applies.
|
||||||
|
|
||||||
|
Search the output for the word 'WARNING'. If you don't see it then this
|
||||||
|
script didn't find any problems.
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
Example Usage
|
||||||
|
-------
|
||||||
|
|
||||||
|
Links
|
||||||
|
-------
|
||||||
|
|
||||||
@ -18,52 +18,51 @@ Database Assessment
|
|||||||
* [mdb-export](../tools/mdb-export.md)
|
* [mdb-export](../tools/mdb-export.md)
|
||||||
* [mdb-hexdump](../tools/mdb-dump.md)
|
* [mdb-hexdump](../tools/mdb-dump.md)
|
||||||
* [mdb-parsecsv](../tools/mdb-parsecsv.md)
|
* [mdb-parsecsv](../tools/mdb-parsecsv.md)
|
||||||
* [mdb-sql](../tools/mdb-sql)
|
* [mdb-sql](../tools/mdb-sql.md)
|
||||||
* [mdb-tables](../tools/mdb-tables)
|
* [mdb-tables](../tools/mdb-tables.md)
|
||||||
* [oscanner]
|
* [oscanner](../tools/oscanner.md)
|
||||||
* [sidguesser]
|
* [sidguesser](../tools/sidguess.md)
|
||||||
* [sqldict]
|
* [sqldict](../tools/sqldict.md)
|
||||||
* [sqlmap]
|
* [sqlmap](../tools/sqlmap.md)
|
||||||
* [sqlninja]
|
* [sqlninja](../tools/sqlninja.md)
|
||||||
* [sqlsus]
|
* [sqlsus](../tools/sqlsus.md)
|
||||||
* [tnscmd10g]
|
* [tnscmd10g](../tools/tnscmd10g.md)
|
||||||
|
|
||||||
Fuzzing Tools
|
Fuzzing Tools
|
||||||
-------------
|
-------------
|
||||||
|
|
||||||
* [bed]
|
* [bed](../tools/bed.md)
|
||||||
* [fuzz_ip6]
|
* [fuzz_ip6](../tools/fuzz_ip6.md)
|
||||||
* [ohrwurm]
|
* [ohrwurm](../tools/ohrwurm.md)
|
||||||
* [powerfuzzer]
|
* [powerfuzzer](../tools/powerfuzzer.md)
|
||||||
* [sfuzz]
|
* [sfuzz](../tools/sfuzz.md)
|
||||||
* [siparmyknife]
|
* [siparmyknife](../tools/siparmyknife.md)
|
||||||
* [spike-generic_chunked]
|
* [spike-generic_chunked](../tools/generic_chunked.md)
|
||||||
* [spike-generic_listen_tcp]
|
* [spike-generic_listen_tcp](../tools/generic_listen_tcp.md)
|
||||||
* [spike-generic_send_tcp]
|
* [spike-generic_send_tcp](../tools/generic_send_tcp.md)
|
||||||
* [spike-generic_send_udp]
|
* [spike-generic_send_udp](../tools/generic_send_udp.md)
|
||||||
|
|
||||||
Misc Scanners
|
Misc Scanners
|
||||||
-------------
|
-------------
|
||||||
|
|
||||||
* [golismero]
|
* [golismero](../tools/golismero.md)
|
||||||
* [lynis]
|
* [lynis](../tools/lynis.md)
|
||||||
* [nikto]
|
* [nikto](../tools/nikto.md)
|
||||||
* [nmap](../tools/nmap.md)
|
* [nmap](../tools/nmap.md)
|
||||||
* [unix-privesc-check]
|
* [unix-privesc-check](../tools/unix-privesc-check.md)
|
||||||
* [zenmap](../tools/zenmap.md)
|
|
||||||
|
|
||||||
Open Source Assessment
|
Open Source Assessment
|
||||||
----------------------
|
----------------------
|
||||||
|
|
||||||
* [casefile]
|
* [casefile](../tools/casefile.md)
|
||||||
* [maltego]
|
* [maltego](../toools/maltego.md)
|
||||||
|
|
||||||
OpenVAS
|
OpenVAS
|
||||||
-------
|
-------
|
||||||
|
|
||||||
* [openvas check setup]
|
* [openvas check setup](../tools/openvas-check-setup.md)
|
||||||
* [openvas feedupdate]
|
* [openvas feed update](../tools/openvas-feed-update.md)
|
||||||
* [openvas-gsd]
|
* [openvas-gsd](../tools/gsd.md)
|
||||||
* [openvas initial setup]
|
* [openvas initial setup](../tools/openvas-setup.md)
|
||||||
* [openvas start]
|
* [openvas start](../tools/openvas-start.md)
|
||||||
* [openvas stop]
|
* [openvas stop](../tools/openvas-stop.md)
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user