In order for us to fix these exploits, we have to know about them.
And you may have noticed that above this video, I have a link to the OpenVAS skill
to where we actually went through and did a lot of scanning along with a couple of skills around
that one to where we targeted the BWAP system inside of our lab.
Now, I can already tell you that, yes, PHP 7 is already on Windows 10. It is on Windows
Workstation, and these are the common vulnerabilities that we did address earlier in
this course. That being said, it's not guaranteed that one vulnerability scanner is going to give
us every single vulnerability or exploit that's possible on that system. And that's why we want
to use different tools for the actual scanning and gaining as much intelligence on a target or
targets as much as we can. So I'm going to show you at least three tools and break them up into
individual sections throughout the rest of the skills so we can actually address finding these
exploits. And then we'll get into what to do with them in terms of like how to fix them.
Behold, here we are inside of Metasploit, and I already have the targeted BWAP system
connected through dummy.exe. We can verify this by typing in sessions and seeing, yep, there it is.
Now, inside of here, we've seen in the last skill, I believe it was the previous skill,
that where we can actually use the different modules within Metasploit while we are still
simultaneously connected and tie them to sessions. Now, I am not in that session of the BWAP system,
and that's because I just need to be an MSF console to be able to run this inside of Metasploit.
So bear with me here. First command and commands below, by the way, load WMAP. And WMAP is a
vulnerability assessment tool that is built into Metasploit that can basically automate the process
of running all the auxiliary modules that MSF console and Metasploit have against a targeted
website. And that's exactly what we're going to be doing here. And load WMAP is the ability to
load that module in and say, get ready, we're about to do this. So what are WMAP sites? Well,
WMAP underscore sites, and see, my touch typing is getting better. I usually am hunting pack.
We're going to say dash A for our target, 192.168.0.13, which is that BWAP system.
And when I press enter, you can see sites created. We have it ready to go as one of our
sites. So in this particular case, we also want to say that it is a target.
Targets, and you may notice that I am not touch typing that one.
Dash T, HTTP, and you do need to note whether it is HTTP or HTTPS with that SSL or TLS. In this
particular case, we know that it's a plain text site using HTTP on port 80. 192.168.0.13.
Now, I also know, and we may have to go change this in a minute, that it forwards to slash
BWAP. So keep that in the back of your mind as well, too. And simply just type in WMAP underscore
dash A, or dash E, underscore run dash E. And this may take a little bit, so you will see a
little bit of time jumping here. Not to be confused with any kind of time traveling except
into the future. That took about 10 minutes on this particular connection that I'm using,
or just in general. It may run faster now that it's preloaded inside of this Adept Lab
that I will be saving the template for. But I want to show you here, and I'm going to
scroll up and show you a couple of examples of what's actually going on here. And as you
scan through the output, you're probably wondering, oh my goodness, what's going on?
Frighteningly not. We got you covered. So as we go in and take a look here, I want to show you,
wrong one. There we go. Right there. First, it's going to start its test, as you can see in that
top line up above, loading the modules. And since we haven't identified a specific module, it's
going to go through and master blaster all of them. That being said, it's going to go down and
start going through its checks based on how the defaults of WMAP are set inside of Metasploit.
Now, do note that if you haven't ran a pseudo-app update and upgrade in a while, this is not going
to be up to date. So this tries to stay up to date with OWASP. Hint, hint, nudge, nudge. So as we go
through, we can look and see our first hit, where it says one, and let me zoom out and highlight that
for you so you can see it just a little bit gooder. I know what I said there. And I'm going to also tie
in the module that's with it as well. The reason that I'm doing this, and there we go, where you
see module auxiliary scanner HTTP HTTP version. And then right below that, it says the IP address,
port 80, Microsoft IIS 10.0. That is letting you know that that module came back with a result.
You will see other modules being listed. And if nothing comes back for them, it will just move
on to the next one. This module actually came back with a result. Now, what does this necessarily mean?
Well, it's kind of going through some of the prep work for you in automating Metasploit. See,
I told you there was other stuff in that skill. Because this right here is one of the modules
that you could pull up in Metasploit and do this manually. Or you could just run something like
WMAP and have it go through. Now, all that being said, what did we get from this? Well, as we scroll
down, you can see attempting to connect here for Tomcat UTF-8 traversal on 13 colon 80, no files
found. Right here, and I have a screenshot of this one in particular below this video, module auxiliary
scanner HTTP options. And what this basically comes back and says, this website allows the following
options. Options, trace, get, head, post, methods. Trace method allowed. Now, some of those may sound
familiar because those in fact did come up inside a directory traversal and file inclusion. So,
if we had actually done this first, we would have known that those methods would have worked
on this particular site or had a possibility of working. But if we ran this before we got
to directory traversal and file inclusion, and it said that those options weren't available,
we wouldn't even have to do those skills because it wouldn't be possible because we don't have the
get and post options. Let's see. What else? You scroll up here and see that there's an install.txt
and a readme.txt file found, identified by the 200 code. I'll let you pick on those and see what
you get. But you can see that there's many other things. But one thing that didn't come up is the
fact that there's no BWAP site. So, this means that you will have to go in and configure the
actual configuration of the actual target itself when we did the WMAP targets. So, let's do that.
WMAP, WMAP underscore, actually, I can just go up. There we go. Right there. Slash BWAP.
Now that's set, we can just simply go up a couple of times to WMAP run E, underscore run dash E,
and do this again. And now it's going to go through and check the actual target of BWAP.
You may get some different results. You may not. But there are other vulnerability assessments
that allow you to crawl that site as we've been through before and get a directory listing to see
if any of this would work against those sub directories if they have the index or start
page inside of those folders. Now, my results weren't that far apart from each other from the
setting the address to the basic IP address to the actual BWAP site. But they did ever so slightly
differ. And I challenge you, not for the challenge for the skill, but just to go through and see if
you could do this on your own and see if you spot any differences.