Attacking WebServers - Different Vectors - Tutorial
Before i talk about this post you should read my other 2 guides i wrote about
just click my profile then go to threads and you will see those 2
This Guide is to teach you how to do Information Gathering and attacking your targets
Today hackers mainly only target web hosting servers this guide is
different this guide teaches you how to attack targeted servers
Lets say you have a Medical Hospital that you are wanting to target.
Now lets face it 9 * out of 10 all of you hackers would only target the website because thats what your used to
Well today im teaching you how to do more then just that
Tools:
1.nmap
2.Maltego
3.DirBuster
4.smbclient
5.Cain and abel
+ More
Lets say a medical company has a subnet ip range of
224.231.12-224.231.12.255
Your First targeted ip address is 224.231.12.234
First thing you need to do is run a Nmap Scan on the Targeted IP address
example
Code:
Discovered open port 443/tcp on 74.125.227.37
Discovered open port 80/tcp on 74.125.227.37
Now lets just say assume there are more ports open what do you do first.
Allow the nmap scan to finish and lets say it finds ports
7717
Which is a service controller for a Software that allows Remote connections to it via a Terminal service
Lets say you logged into it and you dont know the passwords - Google
the service provide and check the default username passwords for the
service
okay so lets say that doesnt work this ip address only has 2 ports open
What do you do now
So now its time to move onto the next ip address
open up maltego input the ip address and click run all transformations
you will then see the subnets and then you can right click on the subnets to spread out all the ip addresses
Or if your on windows use angry ip scanner to get the IP subnets
Now you have a list of over 100+ ip addresses and you dont know what to do
First thing is run nmap - http Print Scan ( Google it )
What that does is it connects to every ip address does a nmap scan on
it and connects to all ports and displays to you the Fingerprint of it
such as
nmap --->scan ip 127.0.0.1 --> open ports 21,80,53
http print scan -> Port 80 "Welcome to Service Station"
So now you know what all services are running on the whole entire network
now You go to random ip addresses and start issuing off exploits based off the knowledge you got
Lets say one ip address has a Folder that is not viewabled to the
public but you know the user rights on it allows you to view other
folders such as
127.0.0.1/ ( not viewable)
127.0.0.1/FolderName/File.txt (Viewable)
127.0.0.1/FolderName/Folder/(viewable)
What that means is that the admin didnt set the policy correctly for the Can View cant View folder directories
What you would do with this situation is run a bruteforce attack
By using DirBuster which uses Parallel Asynnorization (however you spell it )
Which means it can scan multiple things at every second instead of just
scanning 1 thread it will scan lets say 10 at the same time for faster
stuff
By running DirBuster you can now get a list of the viewable folders (hopefully) depending on your DirList
Sometimes you can get the Full Directory and sometimes there can be
usernames passwords or basic info to help you in your further attacks.
----------------------------------------------------------------------------------------------
Now Lets say your targeting a Windows Server that has SMB running on it with Anonymous Login
Code:
Anonymous login successful
Sharename Type Comment
--------- ---- -------
Error returning browse list: NT_STATUS_ACCESS_DENIED
session request to 173.254.196.118 failed (Called name not present)
session request to 173 failed (Called name not present)
Anonymous login successful
Server Comment
--------- -------
AIM-BCRTR-6930
AIM-CAYSH
AIM-GLB
AIM-USPRAUVE7
AIMCHANEXCH
AIMCHANMBX1
By using SMBCLIENT
Code:
open {host,port} - opens a SMB connection against the target host/port
login {username,passwd} - logs into the current SMB connection
login_hash {username,lmhash,nthash} - logs into the current SMB connection using the password hashes
logoff - logs off
shares - list available shares
use {sharename} - connect to an specific share
cd {path} - changes the current directory to {path}
pwd - shows current remote directory
ls {wildcard} - lists all the files in the current directory
rm {file} - removes the selected file
mkdir {dirname} - creates the directory under the current path
rmdir {dirname} - removes the directory under the current path
put {filename} - uploads the filename into the current path
get {filename} - downloads the filename from the current path
close - closes the current SMB Session
exit - terminates the server process (and this session)
You can connect to its service and do the avaiable options up above
Not only that with the SMB service it displays multiple usernames and
Names of the Staff - You can use that to help further your attack for
Bruteforcing
If your on the local network you can run cain and able to do a ARP
Poisoning attack Which will sniff the whole entire network and giving
you hash codes - usernames - passwords etc etc
Which is also good for getting access to private company INTRANET ip address port 80 websites
Thanks
