Metasploit是一個極其強(qiáng)大的***測試框架，包含了巨量模塊。但是，模塊數(shù)量眾多，使得在使用的時候也很不方便。于是就有了WMAP。這個工具可以一次運(yùn)用多個模塊，并將結(jié)果保存在數(shù)據(jù)庫中，十分方便。
由于在學(xué)習(xí)過程中，在百度上搜索時沒能找到WMAP的較為專門描述的文章，就打算翻譯一個英文教程，讓大家的學(xué)習(xí)更方便。
以下是文章正文：
什么是WMAP？
WMAP 是一款最初由 SQLMap 創(chuàng)建而來的多功能網(wǎng)絡(luò)應(yīng)用漏洞掃描器.這個工具整合在Metasploit中，并且可以從Metasploit Framework中啟動進(jìn)行 網(wǎng)站掃描.
用WMAP進(jìn)行漏洞掃描
我們首先要創(chuàng)建一個數(shù)據(jù)庫來保存我們的 WMAP 掃描結(jié)果, 加載 “wmap” 插件, 然后輸入 “help”來看看我們多了哪些新命令可以使用.
msf > load wmap.-.-.-..-.-.-..---..---. | | | || | | || | || |-' `-----'`-'-'-'`-^-'`-'[WMAP 1.5.1] === et [ ] metasploit.com 2012[*] Successfully loaded plugin: wmap msf > helpwmap Commands ============= Command Description ------- ----------- wmap_modules Manage wmap modules wmap_nodes Manage nodes wmap_run Test targets wmap_sites Manage sites wmap_targets Manage targets wmap_vulns Display web vulns...snip...
wmap命令 ================= 命令 描述 ---------- ---------------------------- wmap_modules 管理wmap模塊 wmap_nodes 管理結(jié)點 wmap_run 測試目標(biāo) wmap_sites 管理站點 wmap_targets 管理目標(biāo) wmap_vulns 顯示掃描到的漏洞
在進(jìn)行掃描之前, 我們需要用 “wmap_sites”.和“-a”參數(shù)來添加一個新的目標(biāo)url. 然后, 執(zhí)行 “wmap_sites -l” 命令打印出所有已添加目標(biāo).
msf > wmap_sites -h [*]Usage: wmap_targets [options] -h Display this help text -a [url] Add site (vhost,url) -l List all available sites -s [id] Display site structure (vhost,url|ids) (level) msf > wmap_sites -a http://172.16.194.172 [*] Site created. msf > wmap_sites -l [*] Available sites =============== Id Host Vhost Port Proto # Pages # Forms -- ---- ----- ---- ----- ------- ------- 0 172.16.194.172 172.16.194.172 80 http 0 0
msf > wmap_sites -h [*] Usage: wmap_sites [options] -h 顯示幫助說明 -a [url] 添加站點(vhost,url) -d [ids] 刪除站點(用空格將id隔開) -l 列出所有站點 -s [id] 顯示url結(jié)構(gòu) (vhost,url|ids) (level)
接著, 用 “wmap_targets”命令添加一個目標(biāo).
msf > wmap_targets -h[*] Usage: wmap_targets [options] -h Display this help text -t [urls] Define target sites (vhost1,url[space]vhost2,url) -d [ids] Define target sites (id1, id2, id3 ...) -c Clean target sites list -l List all target sites msf > wmap_targets -t http://172.16.194.172/mutillidae/index.php
msf > wmap_targets -h [*] Usage: wmap_targets [options] -h 顯示幫助說明 -t [urls] 用url將已經(jīng)添加的一個或者多個站點定義為目標(biāo)。url用空格隔開。(vhost1,url[space]vhost2,url) -d [ids] 用id將已經(jīng)添加的一個或者多個站點定義為目標(biāo)。 id用逗號隔開。(id1, id2, id3 ...) -c 清除目標(biāo)列表 -l 顯示所有目標(biāo)
添加目標(biāo)后, 我們可以用 ‘-l’ 顯示所有目標(biāo).
msf > wmap_targets -l [*] Defined targets =============== Id Vhost Host Port SSL Path -- ----- ---- ---- --- ---- 0 172.16.194.172 172.16.194.172 80 false /mutillidae/index.php
用“wmap_run” 命令就可以開始掃描目標(biāo)了.
msf > wmap_run -h[*] Usage: wmap_run [options] -h Display this help text -t Show all enabled modules -m [regex] Launch only modules that name match provided regex. -p [regex] Only test path defined by regex. -e [/path/to/profile] Launch profile modules against all matched targets. (No profile file runs all enabled modules.)
msf > wmap_run -h [*] Usage: wmap_run [options] -h 顯示幫助說明 -t 顯示所有可用模塊 -m [regex] 啟用名字匹配正則表達(dá)式的模塊. -p [regex] 只測試匹配正則表達(dá)式的路徑. -e [/path/to/profile] 對所有匹配的目標(biāo)啟用配置中的模塊. (若無配置，則啟用所有可用模塊.)
我們可以用 “-t” 參數(shù)來列出掃描中將要用到的模塊.
msf > wmap_run -t
[*] Testing target:
[*] Site: 192.168.1.100 (192.168.1.100)
[*] Port: 80 SSL: false
[*] ============================================================
[*] Testing started. 2012-01-16 15:46:42 -0500
[*]
=[ SSL testing ]=
[*] ============================================================
[*] Target is not SSL. SSL modules disabled.
[*]
=[ Web Server testing ]=
[*] ============================================================
[*] Loaded auxiliary/admin/http/contentkeeper_fileaccess ...
[*] Loaded auxiliary/admin/http/tomcat_administration ...
[*] Loaded auxiliary/admin/http/tomcat_utf8_traversal ...
[*] Loaded auxiliary/admin/http/trendmicro_dlp_traversal ...
..snip...
msf >
剩下的步驟就是對我們的目標(biāo)啟動 WMAP掃描.
msf > wmap_run -e [*]Using ALL wmap enabled modules. [-]NO WMAP NODES DEFINED. Executing local modules [*]Testing target: [*]Site: 172.16.194.172 (172.16.194.172) [*]Port: 80 SSL: false ============================================================ [*]Testing started. 2012-06-27 09:29:13 -0400 [*] =[ SSL testing ]= ============================================================ [*]Target is not SSL. SSL modules disabled. [*] =[ Web Server testing ]= ============================================================ [*]Module auxiliary/scanner/http/http_version [*]172.16.194.172:80 Apache/2.2.8 (Ubuntu) DAV/2 ( Powered by PHP/5.2.4-2ubuntu5.10 ) [*]Module auxiliary/scanner/http/open_proxy [*] Module auxiliary/scanner/http/robots_txt ..snip... ..snip... ..snip... [*]Module auxiliary/scanner/http/soap_xml [*]Path: / [*]Server 172.16.194.172:80 returned HTTP 404 for /. Use a different one. [*]Module auxiliary/scanner/http/trace_axd [*]Path: / [*]Module auxiliary/scanner/http/verb_auth_bypass [*] =[ Unique Query testing ]= ============================================================ [*]Module auxiliary/scanner/http/blind_sql_query [*]Module auxiliary/scanner/http/error_sql_injection [*]Module auxiliary/scanner/http/http_traversal [*]Module auxiliary/scanner/http/rails_mass_assignment [*]Module exploit/multi/http/lcms_php_exec [*] =[ Query testing ]= ============================================================ [*] =[ General testing ]= ============================================================ ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Launch completed in 212.01512002944946 seconds. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ [*]Done.
掃描結(jié)束后, 我們可以查看數(shù)據(jù)庫，看看 WMAP給我們找到了什么有趣的東西.
msf > wmap_vulns -l [*] + [172.16.194.172] (172.16.194.172): scraper / [*] scraper Scraper [*] GET Metasploitable2 - Linux [*] + [172.16.194.172] (172.16.194.172): directory /dav/ [*] directory Directory found. [*] GET Res code: 200 [*] + [172.16.194.172] (172.16.194.172): directory /cgi-bin/ [*] directory Directoy found. [*] GET Res code: 403...snip...msf >
上面的信息告訴我們 WMAP 找到了一個可用漏洞. 執(zhí)行“vulns” 命令來查看詳細(xì)信息.
msf > vulns[*] Time: 2012-01-16 20:58:49 UTC Vuln: host=172.16.2.207 port=80 proto=tcp name=auxiliary/scanner/http/options refs=CVE-2005-3398,CVE-2005-3498,OSVDB-877,BID-11604,BID-9506,BID-9561 msf >
用了WMAP進(jìn)行 漏洞掃描 后, 我們能夠使用這些掃描結(jié)果來對報告的漏洞收集更深入的信息. 作為***測試人員, 我們要更深入的調(diào)查每個發(fā)現(xiàn)，并找出是否有潛在的***方法.
總結(jié)一下WMAP的用法：
msf>wmap_sites -a url 添加url
msf>wmap_targets -t url 添加目標(biāo)
msf>wmap_run -e 開搞
msf>vulns 查看漏洞詳細(xì)信息
另外有需要云服務(wù)器可以了解下創(chuàng)新互聯(lián)scvps.cn，海內(nèi)外云服務(wù)器15元起步，三天無理由+7*72小時售后在線，公司持有idc許可證，提供“云服務(wù)器、裸金屬服務(wù)器、高防服務(wù)器、香港服務(wù)器、美國服務(wù)器、虛擬主機(jī)、免備案服務(wù)器”等云主機(jī)租用服務(wù)以及企業(yè)上云的綜合解決方案，具有“安全穩(wěn)定、簡單易用、服務(wù)可用性高、性價比高”等特點與優(yōu)勢，專為企業(yè)上云打造定制，能夠滿足用戶豐富、多元化的應(yīng)用場景需求。
重慶分公司
重慶分公司
