We have a basic understanding of how Nicto is ran against a website for general
vulnerability assessment and get an understanding of what our platform of
attack is looking like.
So basically, what makes the web server, are there anything, is there anything
that sticks out to us that we can use for exploitation?
Now, I want to show you behind the scenes how this looks on Wireshark.
And the reason for this is because as a pen tester, one of the key things for
us to remember is that we are trying to evade not only, you know, endpoint
protection, but also IDS and IPS.
So we're sneaking in ahead of time into the evasion tactics.
So let's go ahead and open Wireshark up real quick.
And I for this lab right here, we're going to be testing on ETH 1 because ETH
is zero is our listening port for other exercises.
So let's go ahead and open up ETH 1 real quick.
And then we're going to go to our terminal and go up on the actual Nicto
command itself and run it again.
And after we type in our pseudo password, you can see that a lot of traffic is
being generated on the actual Wireshark.
Now, this sticks out against IDS and IPS systems out there because you have a
lot of traffic that's being initiated really quick that's abnormal against a
regular web request.
For instance, I'm going to hit stop real quick because it's already done.
And then I'm going to open up a web browser to go to bwap.test and start up the
Wireshark before I do that, continue without saving.
So we're doing the same interface again, bwap.test.
Go over to my Wireshark and you could see here that we don't have near as many
packets as we did when we ran a Nicto against that actual web server.
This right here is what an IDS or IPS or even endpoint protection is kind of
looking for for normal traffic against a system.
So in order for us to be able to start our evasion tactics, we have to either
slow down Nicto or use something else.
Well, in this particular instance, we're going to be slowing down Nicto by
initiating a pause command.
So at the end of it, I'm just going to type in - capital P pause and then hit
output one so it doesn't go as slow.
Restart our Wireshark here and then go inside and hit begin and you can see
that our packets are still showing but not near as fast as what they were
before.
That pause command and the number following it is in seconds.
So just like when we were doing our in-map, in-map scouting across the network
and when we went into intense scan,
we slowed it down so that way we could avoid detection across the network and
potentially be able to do our exploits without being picked up.
Nicto is still going to run and complete its initial task of scouting out the
website for vulnerabilities,
but hopefully in this particular instance, there we go, right there, we can see
that it's going to go a lot slower and potentially allow us to be able to
continue to do this without,
let's say, an IPS blocking our IP address or even subnet.
Now ideally, you would want to do this behind some sort of proxy or whatever
case may be for your Pintest setup,
but this is just one thing to keep in mind when we run this.
In addition to that, Nicto has defaults.
Now I'm going to go inside of Wireshark and hit stop real quick and you can see
here that we have - let me zoom in for us real quick -
that we have a packet with the protocol of HTTP.
Now when we go into that HTTP packet, you can see that we are running with a
user agent, Mozilla 5.0.
Zoom in for us again real quick and you can see right there.
Now this doesn't really stick out as much.
It may based on the versioning.
If the security experts on their network are doing their jobs to a finite
detail,
they're even going to limit the type of user agents that are allowed on the
actual internal network or maybe even external.
Because what you don't want to have is in our previous few skills where I tried
to continue using Netscape Navigator.
Stuff like that is not common to see on the actual internet as much today.
And when you try to Pintest against the network, you want to try to blend your
traffic as closely as possible.
So think when we were in our earlier skills monitoring the network and
capturing that traffic, what user agents were common.
And we can do that by analyzing that TCP dump if we have access to that
internal network or let's say that in and out traffic.
And understand we're used to seeing Microsoft Edge, Google Chrome, Firefox, but
what version?
What are those user agent headers that we're used to seeing and blending in
normally?
Well, Nikto allows us to be able to go through and even configure the actual
user agent itself.
I'm going to go ahead and stop that.
And I'm going to remove the pause on this to make it just a little bit quicker
for us to be able to examine.
We're going to type in -user agent and then quotation mark.
And for this one, I'm just going to type in Nikto slash test and end quotation
mark.
And before I start, I'm going to go ahead and start my wire shark again real
quick and we can go ahead and begin.
Now you can see again that our Nikto is generating a lot of traffic real quick
and I can go ahead and pause there because we have enough to be able to capture
.
I'm going to go ahead and select this HTV packet here and as you can see as I
zoom in, our user agent is Nikto slash test.
So we were able to change the user agent header to try to blend into traffic.
Now does this change the results that we get from Nikto?
Well, if I allow it, just hit up and allow it to run real quick and you can see
that the traffic is still going.
It's overriding the results that we have on the desktop.
This one right here and when it completes, we will be able to open up and see
the exact same results that we saw before.
This time we're blending in with that organization's network traffic to not a
rouse any suspicion.
So now it's done.
Let's go ahead and go into our results and we can see here that we have
generally the same results that we did before.
Except if we go all the way down to the bottom, you can see here the command
that was ran with the user agent Nikto slash test.
And again, we got the same results as we did before as our basic over, you know
, scratch the surface vulnerability scanning.
So it's really important that we not only blend in with the traffic, but not
around suspicion with the actual speed at which we're trying to do our scanning
.
And a lot of the tools that we're going to be covering throughout this course,
we can throttle it based on that speed.
Now, yes, this does make it to where it takes a little bit longer to do things.
And that's why we've also been stressing, especially in the previous skill, how
you can capture some of that traffic to get it offline to analyze somewhere
else, preferably an offline setting to help you evade even more capturing of
the pen tester on the organization.
on the organization's network.