另外两个metasploit的猥琐插件

w406511542

其实，这个nikto的思路跟我之前那个一样的，只是这个代码写的工整一点，郁闷。

http://code.google.com/p/msf-hack/

# arp_sweep discovery module for local networks

# wmap_nikto integration between wmap and nikto


This module integrate wmap with nikto.
install

# cp wmap_nikto.rb ./modules/auxiliary/scanner/http/

edit nikto.conf:

EXECDIR=<full path of your nikto installation>

usage

##                          ###           ##    ##
##  ##  #### ###### ####  #####   #####    ##    ####        ######
####### ##  ##  ##  ##         ## ##  ##    ##   ##  ##   ###   ##
####### ######  ##  #####   ####  ##  ##    ##   ##  ##   ##    ##
## # ##     ##  ##  ##  ## ##      #####    ##   ##  ##   ##    ##
##   ##  #### ###   #####   #####     ##   ####   ####   #### ###
##


=[ msf v3.3-dev
+ -- --=[ 391 exploits - 264 payloads
+ -- --=[ 20 encoders - 7 nops
=[ 178 aux

msf auxiliary(arp_sweep) > load db_wmap
[*] =[ WMAP v0.3 - ET LoWNOISE
[*] Successfully loaded plugin: db_wmap
msf auxiliary(arp_sweep) > db_connect /home/belch/pt/test/wmap.db
[*] Successfully connected to the database
[*] File: /home/belch/pt/test/wmap.db
msf auxiliary(arp_sweep) > wmap_targets -r
[*] Added. 87.230.87.158 80 0
[*] Added. 87.230.87.158 80 0
msf auxiliary(arp_sweep) > wmap_targets -s 1
msf auxiliary(arp_sweep) > wmap_website
[*] Website structure
[*] 87.230.87.158:80 SSL:0
ROOT_TREE
+------CVS
+------logout.php
+------cart.php
+------login.php
+------cgi-bin
+------artists.php
+------Templates
+------listproducts.php
+------icons
+------admin
+------guestbook.php
|       AJAX
|       +------styles.css
|       +------index.php
|       secured
|       +------style.css
|       +------newuser.php
+------signup.php
|       images
|       +------remark.gif
|       +------logo.gif
+------product.php
+------privacy.php
+------disclaimer.php
+------userinfo.php
+------favicon.ico
|       Flash
|       +------add.swf
+------manual
+------index.php
+------categories.php
+------style.css
+------error
+------showimage.php
[*] Done.
msf auxiliary(arp_sweep) > setg NIKTO_PATH /opt/pt/web/nikto-2.03/nikto.pl
NIKTO_PATH => /opt/pt/web/nikto-2.03/nikto.pl
msf auxiliary(arp_sweep) > setg NIKTO_OPTS -o /tmp/nikto-msf.txt
NIKTO_OPTS => -o /tmp/nikto-msf.txt
msf auxiliary(arp_sweep) > wmap_run -e /opt/pt/framework/framework-trunk/data/wmap/wmap_nikto_profile.txt
[*] Using profile /opt/pt/framework/framework-trunk/data/wmap/wmap_nikto_profile.txt.
[*] Launching auxiliary/scanner/http/wmap_nikto WMAP_DIR / against 87.230.87.158:80...
....

to grab results:

# cat /tmp/nikto-msf.txt

Arp Sweeper


Introduction

This module allow to discovery hosts on a localnetwork by sending arp-request to each of them.
install

# cp arp_sweeper.rb ./modules/auxiliary/scanner/discovery/

usage

belch@graal:/opt/pt/framework/framework-trunk# ./msfconsole -r ./arp_sweep

_                  _       _ _
| |                | |     (_) |
_ __ ___   ___| |_ __ _ ___ _ __ | | ___  _| |_
| '_ ` _ \ / _ \ __/ _` / __| '_ \| |/ _ \| | __|
| | | | | |  __/ || (_| \__ \ |_) | | (_) | | |_
|_| |_| |_|\___|\__\__,_|___/ .__/|_|\___/|_|\__|
| |
|_|


=[ msf v3.3-dev
+ -- --=[ 390 exploits - 232 payloads
+ -- --=[ 20 encoders - 7 nops
=[ 169 aux

resource> use auxiliary/scanner/discovery/arp_sweep
msf auxiliary(arp_sweep) > info

Name: Local Network Discovery
Version: $Revision:$
License: Metasploit Framework License (BSD)

Provided by:
unknown <belch>

Basic options:
Name     Current Setting  Required  Description                                 
----     ---------------  --------  -----------                                 
RHOSTS                    yes       The target address range or CIDR identifier  
SHOST                     yes       Source IP Address                           
SMAC                      yes       Source MAC Address                           
THREADS  1                yes       The number of concurrent threads            

Description:
Enumerate alive Hosts in local network using ARP raw packets

msf auxiliary(arp_sweep) > setg RHOSTS 192.168.1.0/24
RHOSTS => 192.168.1.0/24
msf auxiliary(arp_sweep) > setg SHOST 192.168.1.12
SHOST => 192.168.1.12
msf auxiliary(arp_sweep) > setg SMAC 00:22:15:eb:19:4f
SMAC => 00:22:15:eb:19:4f
msf auxiliary(arp_sweep) > run

[*] 192.168.1.1 is at 00:00:0c:07:ac:24
[*] 192.168.1.2 is at 00:1f:ca:b1:07:bf
[*] 192.168.1.3 is at 00:1f:ca:b0:e1:3f
[*] 192.168.1.21 is at 08:00:37:18:eb:ef
[*] 192.168.1.22 is at 08:00:37:37:75:d7
[*] 192.168.1.23 is at 00:14:38:d5:7c:9d
[*] 192.168.1.24 is at 00:15:99:29:30:6a