HOWTO : OpenVAS on Ubuntu Desktop 12.04 LTS

OpenVAS is a framework of several services and tools offering a comprehensive and powerful vulnerability scanning and vulnerability management solution.

Step 1 :

At the time of this writing, the "stable" is version 5 while the "nightly builds" is version 6.

sudo add-apt-repository ppa:openvas/stable

or

sudo add-apt-repository ppa:openvas/nightly

sudo apt-get update
sudo apt-get install openvas-scanner openvas-manager openvas-administrator greenbone-security-assistant openvas-cli openvas-check-setup gsd

sudo apt-get install xsltproc sqlite3

Step 2 :

sudo openvas-mkcert

It will generate the following :

- Certification authority:
  Certificate = /var/lib/openvas/CA/cacert.pem
  Private key = /var/lib/openvas/private/CA/cakey.pem

- OpenVAS Server :
  Certificate = /var/lib/openvas/CA/servercert.pem
  Private key = /var/lib/openvas/private/CA/serverkey.pem

To sync the Network Vulnerability Tests (NVT) feed :

sudo openvas-nvt-sync

If you are using OpenVAS 6, you also need to sync the SCAP data :

sudo openvas-scapdata-sync

After that you have to create a client certificate using the openvas-mkcert-client tool. If -n is specified the tool doesn’t ask any questions and creates a certificate for the user "om". The -i parameter installs the certificate to be used with the OpenVAS manager.

sudo openvas-mkcert-client -n om -i

Before going further, stop the following services :

sudo /etc/init.d/openvas-scanner stop
sudo /etc/init.d/openvas-manager stop
sudo /etc/init.d/openvas-administrator stop
sudo /etc/init.d/greenbone-security-assistant stop

It needs some time to fully start it, please be patient :

sudo openvassd

Migrate and rebuild the databases. It needs some time to finish :

sudo openvasmd --migrate
sudo openvasmd --rebuild

sudo killall openvassd

To start it again but wait for some seconds before doing so as it need some time to shut down for the previous command :

sudo /etc/init.d/openvas-scanner start
sudo /etc/init.d/openvas-manager start
sudo /etc/init.d/openvas-administrator restart
sudo /etc/init.d/greenbone-security-assistant restart

To create a user "admin" with the role of "Admin" :

sudo openvasad -c add_user -n admin -r Admin

You will be asked for the password. You need to use this username and password to login to the OpenVAS.

Step 3 :

Check if your setup is correct or not.

Stable builds -
sudo openvas-check-setup

or

Nightly builds -
sudo openvas-check-setup --v6

Step 4 :

To run it. Point the Firefox to :

https://localhost:9392/

Step 5 :

To update it.

sudo openvas-nvt-sync

Step 6 (Optional) :

To start it manually instead of auto-run.

Start script -
sudo -sH
nano /etc/init.d/openvas-start

Append the following to the file :

sudo /etc/init.d/openvas-scanner start
sudo /etc/init.d/openvas-manager start
sudo /etc/init.d/openvas-administrator restart
sudo /etc/init.d/greenbone-security-assistant restart

chmod +x /etc/init.d/openvas-start

Stop script -

sudo -sH
nano /etc/init.d/openvas-stop

Append the following to the file :

sudo /etc/init.d/openvas-scanner stop
sudo /etc/init.d/openvas-manager stop
sudo /etc/init.d/openvas-administrator stop
sudo /etc/init.d/greenbone-security-assistant stop

chmod +x /etc/init.d/openvas-stop

sudo update-rc.d openvas-scanner disable
sudo update-rc.d openvas-manager disable
sudo update-rc.d openvas-administrator disable
sudo update-rc.d greenbone-security-assistant disable

To start the services :

sudo /etc/init.d/openvas-start

To stop the services :

sudo /etc/init.d/openvas-stop

That's all! See you.

HOWTO : SET on Ubuntu Desktop 12.04 LTS

The Social-Engineer Toolkit (SET) was created and written by the founder of TrustedSec. It is an open-source Python-driven tool aimed at penetration testing around Social-Engineering.

Step 1 :

sudo apt-get install git

sudo -sH
cd /opt
git clone https://github.com/trustedsec/social-engineer-toolkit/ set/
cd /opt/set
python setup.py install

Step 2 :

To run it. You can run it at any directory.

sudo -sH
se-toolkit

That's all! See you.

HOWTO : MAC Changer on Ubuntu Desktop 12.04 LTS

Mac Changer is a GNU/Linux utility for viewing/manipulating the MAC address of network interfaces.

Step 1 :

sudo apt-get install macchanger macchanger-gtk

Step 2 :

To run it. You can run it at any directory.

macchanger eth0

or

Graphical interface -

macchanger-gtk

That's all! See you.

HOWTO : Nmap on Ubuntu Desktop 12.04 LTS

Nmap ("Network Mapper") is a free and open source utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime.

Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. It was designed to rapidly scan large networks, but works fine against single hosts.

Nmap runs on all major computer operating systems, and official binary packages are available for Linux, Windows, and Mac OS X. In addition to the classic command-line Nmap executable, the Nmap suite includes an advanced GUI and results viewer (Zenmap), a flexible data transfer, redirection, and debugging tool (Ncat), a utility for comparing scan results (Ndiff), and a packet generation and response analysis tool (Nping).

Step 1 :

sudo apt-get install nmap zenmap

Step 2 :

To run it. You can run it at any directory.

sudo -sH
nmap -sC -PN -T4 samiux.com

or

Graphical interface -

zenmap

That's all! See you.

HOWTO : Netcat on Ubuntu Desktop 12.04 LTS

Netcat is a featured networking utility which reads and writes data across network connections, using the TCP/IP protocol.

It is designed to be a reliable "back-end" tool that can be used directly or easily driven by other programs and scripts. At the same time, it is a feature-rich network debugging and exploration tool, since it can create almost any kind of connection you would need and has several interesting built-in capabilities.

Step 1 :

sudo -sH
cd /opt

wget http://garr.dl.sourceforge.net/sourceforge/netcat/netcat-0.7.1.tar.gz

tar -xvzf netcat-0.7.1.tar.gz
rm netcat-0.7.1.tar.gz

cd /opt/netcat-0.7.1
./configure
make

cd /opt
mkdir /opt/netcat
cp /opt/netcat-0.7.1/src/netcat /opt/netcat/
rm -R netcat-0.7.1/

Step 2 :

To run it.

sudo -sH
cd /opt/netcat
./netcat -h

Remarks :

Please do not delete the built-in netcat-openbsd as it will also delete the ubuntu-mininal package at the same time. Your compiled netcat is different to the built-in one.

That's all! See you.

HOWTO : John the Ripper on Ubuntu Desktop 12.04 LTS

John the Ripper is a fast password cracker, currently available for many flavors of Unix, Windows, DOS, BeOS, and OpenVMS. Its primary purpose is to detect weak Unix passwords. Besides several crypt(3) password hash types most commonly found on various Unix systems, supported out of the box are Windows LM hashes, plus lots of other hashes and ciphers in the community-enhanced version.

Step 1 :

sudo -sH
cd /opt
wget http://www.openwall.com/john/g/john-1.7.9-jumbo-7.tar.gz
tar -xvzf john-1.7.9-jumbo-7.tar.gz
mv john-1.7.9-jumbo-7 john
rm john-1.7.9-jumbo-7.tar.gz

Step 2 :

cd /opt/john/src

For 64-bit system :
# for general -
make clean linux-x86-64
# for cuda -
make clean linux-x86-64-cuda
# for opencl -
make clean linux-x86-64-opencl

For 32-bit system :
# for general -
make clean linux-x86-sse2
# for cuda -
make clean linux-x86-cuda
# for opencl -
make clean linux-x86-opencl

Step 3 :

To run it.

sudo -sH
cd /opt/john/run
./john

That's all! See you.

HOWTO : Weevely on Ubuntu Desktop 12.04 LTS

Weevely is a stealth PHP web shell that simulate an SSH-like connection. It is an essential tool for web application post exploitation, and can be used as stealth backdoor or as a web shell to manage legit web accounts, even free hosted ones.

Step 1 :

sudo apt-get install git

sudo -sH
cd /opt
git clone git://github.com/epinna/Weevely.git

Step 2 :

To run it.

sudo -sH
cd /opt/Weevely
./weevely.py

That's all! See you.

HOWTO : Hiawatha on Ubuntu Desktop 12.04 LTS

Hiawatha is a secured web server. I use it to replace apache for the exploitation due to her lightweight.

Step 0 :

In case /etc/init.d/tntnet is exist, you should disable it before going further.

sudo update-rc.d tntnet disable
sudo /etc/init.d/tntnet stop

Step 1 :

sudo apt-get install build-essential libc6-dev libssl-dev dpkg-dev debhelper fakeroot libxml2-dev libxslt1-dev

wget http://www.cmake.org/files/v2.8/cmake-2.8.10.2.tar.gz
tar -xvzf cmake-2.8.10.2.tar.gz
cd cmake-2.8.10.2
./configure
make
sudo make install

wget http://www.hiawatha-webserver.org/files/hiawatha-9.1.tar.gz
tar -xzvf hiawatha-9.1.tar.gz
cd hiawatha-9.1/extra

./make_debian_package

cd ..

sudo dpkg -i hiawatha_9.1_amd64.deb

or

sudo dpkg -i hiawatha_9.1_i386.deb

In case the init script does not at /etc/init.d/, you need to copy it manully.

sudo cp hiawatha-9.1/extra/debian/init.d/hiawatha /etc/init.d/

Step 2 :

update-rc.d hiawatha disable

Step 3 :

To run it.

sudo /etc/init.d/hiawatha start

To stop it.

sudo /etc/init.d/hiawatha stop

Step 4 :

Web shell site :

http://pentestmonkey.net/category/tools/web-shells

Download the php reverse shell.

sudo -sH
cd /opt

wget http://pentestmonkey.net/tools/php-reverse-shell/php-reverse-shell-1.0.tar.gz

tar -xvzf php-reverse-shell-1.0.tar.gz
mv php-reverse-shell-1.0 php-reverse-shell
rm php-reverse-shell-1.0.tar.gz
cp php-reverse-shell.php /var/www/hiawatha/

That's all! See you.

HOWTO : Hydra on Ubuntu Desktop 12.04 LTS

THC-Hydra is a very fast network logon cracker which support many different services.

Step 1 :

sudo apt-get install libssl-dev libssh-dev libidn11-dev libpcre3-dev libgtk2.0-dev libmysqlclient-dev libpq-dev libsvn-dev firebird2.1-dev libncp-dev libncurses5-dev

sudo -sH
cd /opt

wget http://www.thc.org/releases/hydra-7.4.2.tar.gz

tar -xvzf hydra-7.4.2.tar.gz

mv hydra-7.4.2 hydra
rm hydra-7.4.2.tar.gz

cd /opt/hydra

./configure
make
make install

Step 2 :

To run it in GUI in any directory.

xhydra

To run it in console in any directory.

hydra

That's all! See you.

HOWTO : Burp Suite on Ubuntu Desktop 12.04 LTS

Burp Suite helps you secure your web applications by finding the vulnerabilities they contain.

Step 1 :

sudo -sH
cd /opt
mkdir burpsuite
cd /opt/burpsuite

wget http://portswigger.net/burp/burpsuite_free_v1.5.jar

Step 2 :

To run it.

sudo -sH
cd /opt/burpsuite
java -jar burpsuite_free_v1.5.jar

You can create a shell script to make the run more easier.

That's all! See you.

HOWTO : OWASP Zaproxy on Ubuntu Desktop 12.04 LTS

The Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications.

It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing.

ZAP provides automated scanners as well as a set of tools that allow you to find security vulnerabilities manually.

Step 1 :

sudo apt-get install openjdk-7-jre-lib openjdk-7-jre-headless openjdk-7-jre icedtea-7-jre-jamvm icedtea-7-jre-cacao icedtea-7-plugin

To select version 7.

sudo update-alternatives --config java

wget http://zaproxy.googlecode.com/files/ZAP_2.1.0_Linux.tar.gz
tar -xzvf ZAP_2.1.0_Linux.tar.gz

sudo cp -Ra ZAP_2.1.0 /opt/zaproxy

Step 2 :

To run it.

sudo -sH
cd /opt/zaproxy
./zap.sh

That's all! See you.

HOWTO : Freemind on Ubuntu Desktop 12.04 LTS

FreeMind is a premier free mind-mapping software written in Java. It can be used for keeping the information gathered in the exploitation phases.

Step 1 :

sudo apt-get install freemind freemind-browser freemind-doc freemind-plugins-svg freemind-plugins-script freemind-plugins-help

Step 2 :

To run it by clicking the Freemind icon or by command :

freemind

That's all! See you.

HOWTO : SlowHTTPTest on Ubuntu Desktop 12.04 LTS

SlowHTTPTest is a highly configurable tool that simulates some Application Layer Denial of Service attacks. It works on majority of Linux platforms, OSX and Cygwin - a Unix-like environment and command-line interface for Microsoft Windows.

It implements most common low-bandwidth Application Layer DoS attacks, such as slowloris, Slow HTTP POST, Slow Read attack (based on TCP persist timer exploit) by draining concurrent connections pool, as well as Apache Range Header attack by causing very significant memory and CPU usage on the server.

Slowloris and Slow HTTP POST DoS attacks rely on the fact that the HTTP protocol, by design, requires requests to be completely received by the server before they are processed. If an HTTP request is not complete, or if the transfer rate is very low, the server keeps its resources busy waiting for the rest of the data. If the server keeps too many resources busy, this creates a denial of service. This tool is sending partial HTTP requests, trying to get denial of service from target HTTP server.

Slow Read DoS attack aims the same resources as slowloris and slow POST, but instead of prolonging the request, it sends legitimate HTTP request and reads the response slowly.

Step 1 :

sudo -sH
cd /opt

apt-get install subversion

svn checkout http://slowhttptest.googlecode.com/svn/trunk/ slowhttptest

cd /opt/slowhttptest
./configure
make
make install

Step 2 :

You can run it at any directory.

slowhttptest -h

Step 3 :

To uninstall it.

cd /opt/slowhttptest
sudo make uninstall

That's all! See you.

HOWTO : Sqlmap on Ubuntu Desktop 12.04 LTS

Sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.

Full support for MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, IBM DB2, SQLite, Firebird, Sybase and SAP MaxDB database management systems.

Full support for six SQL injection techniques: boolean-based blind, time-based blind, error-based, UNION query, stacked queries and out-of-band.

Step 1 :

sudo -sH
cd /opt

apt-get install git
git clone git://github.com/sqlmapproject/sqlmap.git

Step 2 :

To run it.

sudo -sH
cd /opt
python sqlmap.py

That's all! See you.

HOWTO : W3af on Ubuntu Desktop 12.04 LTS

W3af is a Web Application Attack and Audit Framework. The project’s goal is to create a framework to help you secure your web applications by finding and exploiting all web application vulnerabilities.

Step 1 :

Make sure you follow the steps below one by one.

sudo -sH
cd /opt

apt-get update
apt-get install git build-essential

git clone https://github.com/andresriancho/w3af.git

apt-get install python2.7-dev python-setuptools python-pip

pip install PyGithub GitPython pybloomfiltermmap esmre nltk pdfminer futures scapy-real guess-language cluster msgpack-python python-ntlm

pip install -e git+git://github.com/ramen/phply.git#egg=phply

apt-get install graphviz python-gtksourceview2

pip install xdot

Step 2 :

To run it.

sudo -sH
cd /opt/w3af

./w3af_gui

or

./w3af_console

Step 3 :

Make sure you change the path of the Metasploit at "Configuration" -- "Miscellaneous" -- "Metasploit".

e.g. /opt/metasploit/app/
e.g. /opt/metasploit/apps/pro/msf3/

Remarks :



Automated Audit using W3AF

That's all! See you.

HOWTO : Metasploit on Ubuntu Desktop 12.04 LTS

Metasploit is an exploitation framework.

Step 1 :

If the following packages not installed, you need to install them.

sudo apt-get install ruby1.9.1 build-essential

To download it.

For 64-bit systems :

wget http://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run

chmod +x metasploit-latest-linux-x64-installer.run

sudo ./metasploit-latest-linux-x64-installer.run

For 32-bit systems :

wget http://downloads.metasploit.com/data/releases/metasploit-latest-linux-x32-installer.run

chmod +x metasploit-latest-linux-x32-installer.run

sudo ./metasploit-latest-linux-x32-installer.run

Follow the instruction on the screen. You can choose your installed directory, default is /opt/metasploit. Select to install Metasploit as service.

Step 2 :

To register your community edition. If you don't, you cannot update the Metasploit. Point your Firefox to the following url :

https://localhost/:3790

You need to wait for about 5 minutes for the initialization. Please be patient.

Fill in the blank and you will receive the license key for activation. Then, activate the copy.

Step 2a :

sudo update-rc.d metasploit disable

Step 3 :

To run it.

sudo -sH
/etc/init.d/metasploit start
cd /opt/metasploit/app
sudo msfconsole

Step 4 :

To update it.

sudo -sH
/etc/init.d/metasploit start
cd /opt/metasploit/app
msfupdate

*** Make sure you wait for at least 3 minutes before executing "msfupdate". As it need time to load all the necessary modules after the Metasploit is started.

Remarks :

If you do not select to install as service, you need to do the following to start the Metasploit.

sudo /opt/metasploit/ctlscript.sh start

That's all! See you.

HOWTO : BeEF and Metasploit Integration on Ubuntu Desktop 12.04 LTS

Step 1 :

nano beef/extensions/metasploit/config.yaml

Make change to "host", "callback_host" and "msf_path". Where the last entry at "msf_path" should be the path of the Metasploit.

It will look like this :



Remarks : you are not required to change the "host", you can keep it as 127.0.0.1. However, you need to change the "callback_host" as it is the reverse connection IP address and it should be a public IP address.

Step 2 :

nano beef/config.yaml

Go to "extension:" and change the "false" to "true" under "metasploit".

It will look like this.



Step 3 :

Start Metasploit :

sudo /etc/init.d/metasploit start
cd /opt/metasploit/app
sudo msfconsole
db_connect

Under the msfconsole :

load msgrpc ServerHost=127.0.0.1 Pass=abc123

Start BeEF :

cd beef
./beef

Point your Firefox to the following url :

http://192.168.1.102:3000/ui/panel

Enter username and password for both "beef" to login.

Remarks :

Please note that the above IP address (192.168.1.102) is just an example.



The BeEF site has a tutorial for browser autopwn with Metasploit. You can refer to here.

That's all! See you.

HOWTO : Joomscan on Ubuntu Desktop 12.04 LTS

Joomscan is OWASP Joomla Vulnerability Scanner.

Joomla! is probably the most widely-used CMS out there due to its flexibility, user-friendlinesss, extensibility to name a few. So, watching its vulnerabilities and adding such vulnerabilities as KB to Joomla scanner takes ongoing activity.It will help web developers and web masters to help identify possible security weaknesses on their deployed Joomla! sites.

However, it is not up-to-date. The latest version of vulnerability database is on October 22, 2012 (at the time of this writing).

Step 1 :

sudo apt-get install libwww-perl libwww-mechanize-perl

Joomscan is written in Perl. Download it.

sudo -sH
cd /opt
wget "http://downloads.sourceforge.net/project/joomscan/joomscan/2012-03-10/joomscan-latest.zip?r=http%3A%2F%2Fsourceforge.net%2Fprojects%2Fjoomscan%2F%3Fsource%3Ddlp&ts=1368806935&use_mirror=ncu" -O joomscan-latest.zip

Step 2 :

Once downloaded, you need to extract the content.

sudo -sH
cd /opt
mkdir joomscan

cp joomscan-latest.zip /opt/joomscan/
rm joomscan-latest.zip

cd /opt/joomscan

unzip joomscan-latest.zip

Step 3 :

To run it.

sudo -sH
cd /opt/joomscan

perl joomscan.pl -u http://www.samiux.com

Step 4 :

To update it.

sudo -sH
cd /opt/joomscan

perl joomscan.pl update

That's all! See you.

HOWTO : WPScan on Ubuntu Desktop 12.04 LTS

WPScan is a black box WordPress vulnerability scanner.

Step 1 :

To install wpscan and her related packages.

sudo apt-get install git libcurl4-gnutls-dev libruby libxml2 libxml2-dev libxslt1-dev ruby1.9.1-dev

sudo -sH
cd /opt
git clone https://github.com/wpscanteam/wpscan.git

cd wpscan

sudo gem install bundler

sudo bundle install --without test developement

Step 2 :

To run it.

sudo -sH
cd /opt/wpscan

./wpscan.rb --url http://www.samiux.com

Step 3 :

To update it.

sudo -sH
cd /opt/wpscan

./wpscan.rb --update

That's all! See you.

HOWTO : BeEF on Ubuntu Desktop 12.04 LTS

BeEF - The Browser Exploitation Framework Project is a penetration testing tool that focuses on the web browser.

Amid growing concerns about web-borne attacks against clients, including mobile clients, BeEF allows the professional penetration tester to assess the actual security posture of a target environment by using client-side attack vectors. Unlike other security frameworks, BeEF looks past the hardened network perimeter and client system, and examines exploitability within the context of the one open door: the web browser. BeEF will hook one or more web browsers and use them as beachheads for launching directed command modules and further attacks against the system from within the browser context.

Step 1 :

To download the latest version of BeEF to the current directory.

sudo -sH
cd /opt
apt-get install git
git clone git://github.com/beefproject/beef.git

Step 2 :

To install BeEF and her related packages.

cd beef

sudo apt-get install ruby1.9.1-dev libsqlite3-dev sqlite3 sqlite3-doc build-essentail

sudo gem install bundler

sudo bundle install

Step 3 :

To run it.

sudo -sH
cd /opt/beef

./beef

Then point the Firefox to http://[your IP address]:3000/ui/panel

Step 4 :

To update it.

sudo -sH
cd /opt/beef

./update-beef

Remarks :

If you also installed Metasploit, you can integrate Metasploit to BeEF to perform attacks, such as browsers autopwn.

That's all! See you.