溫馨提示×
您好，登錄后才能下訂單哦！
點擊 登錄注冊 即表示同意《億速云用戶服務條款》
您好，登錄后才能下訂單哦！
Metasploit是一個極其強大的***測試框架，包含了巨量模塊。但是，模塊數量眾多，使得在使用的時候也很不方便。于是就有了WMAP。這個工具可以一次運用多個模塊，并將結果保存在數據庫中，十分方便。
由于在學習過程中，在百度上搜索時沒能找到WMAP的較為專門描述的文章，就打算翻譯一個英文教程，讓大家的學習更方便。
以下是文章正文：
什么是WMAP？
WMAP 是一款最初由 SQLMap 創建而來的多功能網絡應用漏洞掃描器.這個工具整合在Metasploit中，并且可以從Metasploit Framework中啟動進行 網站掃描.
用WMAP進行漏洞掃描
我們首先要創建一個數據庫來保存我們的 WMAP 掃描結果, 加載 “wmap” 插件, 然后輸入 “help”來看看我們多了哪些新命令可以使用.
msf > load wmap.-.-.-..-.-.-..---..---. | | | || | | || | || |-' `-----'`-'-'-'`-^-'`-'[WMAP 1.5.1] === et [ ] metasploit.com 2012[*] Successfully loaded plugin: wmap msf > helpwmap Commands ============= Command Description ------- ----------- wmap_modules Manage wmap modules wmap_nodes Manage nodes wmap_run Test targets wmap_sites Manage sites wmap_targets Manage targets wmap_vulns Display web vulns...snip...
wmap命令 ================= 命令 描述 ---------- ---------------------------- wmap_modules 管理wmap模塊 wmap_nodes 管理結點 wmap_run 測試目標 wmap_sites 管理站點 wmap_targets 管理目標 wmap_vulns 顯示掃描到的漏洞
在進行掃描之前, 我們需要用 “wmap_sites”.和“-a”參數來添加一個新的目標url. 然后, 執行 “wmap_sites -l” 命令打印出所有已添加目標.
msf > wmap_sites -h [*]Usage: wmap_targets [options] -h Display this help text -a [url] Add site (vhost,url) -l List all available sites -s [id] Display site structure (vhost,url|ids) (level) msf > wmap_sites -a http://172.16.194.172 [*] Site created. msf > wmap_sites -l [*] Available sites =============== Id Host Vhost Port Proto # Pages # Forms -- ---- ----- ---- ----- ------- ------- 0 172.16.194.172 172.16.194.172 80 http 0 0
msf > wmap_sites -h [*] Usage: wmap_sites [options] -h 顯示幫助說明 -a [url] 添加站點(vhost,url) -d [ids] 刪除站點(用空格將id隔開) -l 列出所有站點 -s [id] 顯示url結構 (vhost,url|ids) (level)
接著, 用 “wmap_targets”命令添加一個目標.
msf > wmap_targets -h[*] Usage: wmap_targets [options] -h Display this help text -t [urls] Define target sites (vhost1,url[space]vhost2,url) -d [ids] Define target sites (id1, id2, id3 ...) -c Clean target sites list -l List all target sites msf > wmap_targets -t http://172.16.194.172/mutillidae/index.php
msf > wmap_targets -h [*] Usage: wmap_targets [options] -h 顯示幫助說明 -t [urls] 用url將已經添加的一個或者多個站點定義為目標。url用空格隔開。(vhost1,url[space]vhost2,url) -d [ids] 用id將已經添加的一個或者多個站點定義為目標。 id用逗號隔開。(id1, id2, id3 ...) -c 清除目標列表 -l 顯示所有目標
添加目標后, 我們可以用 ‘-l’ 顯示所有目標.
msf > wmap_targets -l [*] Defined targets =============== Id Vhost Host Port SSL Path -- ----- ---- ---- --- ---- 0 172.16.194.172 172.16.194.172 80 false /mutillidae/index.php
用“wmap_run” 命令就可以開始掃描目標了.
msf > wmap_run -h[*] Usage: wmap_run [options] -h Display this help text -t Show all enabled modules -m [regex] Launch only modules that name match provided regex. -p [regex] Only test path defined by regex. -e [/path/to/profile] Launch profile modules against all matched targets. (No profile file runs all enabled modules.)
msf > wmap_run -h [*] Usage: wmap_run [options] -h 顯示幫助說明 -t 顯示所有可用模塊 -m [regex] 啟用名字匹配正則表達式的模塊. -p [regex] 只測試匹配正則表達式的路徑. -e [/path/to/profile] 對所有匹配的目標啟用配置中的模塊. (若無配置，則啟用所有可用模塊.)
我們可以用 “-t” 參數來列出掃描中將要用到的模塊.
msf > wmap_run -t
[*] Testing target:
[*] Site: 192.168.1.100 (192.168.1.100)
[*] Port: 80 SSL: false
[*] ============================================================
[*] Testing started. 2012-01-16 15:46:42 -0500
[*]
=[ SSL testing ]=
[*] ============================================================
[*] Target is not SSL. SSL modules disabled.
[*]
=[ Web Server testing ]=
[*] ============================================================
[*] Loaded auxiliary/admin/http/contentkeeper_fileaccess ...
[*] Loaded auxiliary/admin/http/tomcat_administration ...
[*] Loaded auxiliary/admin/http/tomcat_utf8_traversal ...
[*] Loaded auxiliary/admin/http/trendmicro_dlp_traversal ...
..snip...
msf >
剩下的步驟就是對我們的目標啟動 WMAP掃描.
msf > wmap_run -e [*]Using ALL wmap enabled modules. [-]NO WMAP NODES DEFINED. Executing local modules [*]Testing target: [*]Site: 172.16.194.172 (172.16.194.172) [*]Port: 80 SSL: false ============================================================ [*]Testing started. 2012-06-27 09:29:13 -0400 [*] =[ SSL testing ]= ============================================================ [*]Target is not SSL. SSL modules disabled. [*] =[ Web Server testing ]= ============================================================ [*]Module auxiliary/scanner/http/http_version [*]172.16.194.172:80 Apache/2.2.8 (Ubuntu) DAV/2 ( Powered by PHP/5.2.4-2ubuntu5.10 ) [*]Module auxiliary/scanner/http/open_proxy [*] Module auxiliary/scanner/http/robots_txt ..snip... ..snip... ..snip... [*]Module auxiliary/scanner/http/soap_xml [*]Path: / [*]Server 172.16.194.172:80 returned HTTP 404 for /. Use a different one. [*]Module auxiliary/scanner/http/trace_axd [*]Path: / [*]Module auxiliary/scanner/http/verb_auth_bypass [*] =[ Unique Query testing ]= ============================================================ [*]Module auxiliary/scanner/http/blind_sql_query [*]Module auxiliary/scanner/http/error_sql_injection [*]Module auxiliary/scanner/http/http_traversal [*]Module auxiliary/scanner/http/rails_mass_assignment [*]Module exploit/multi/http/lcms_php_exec [*] =[ Query testing ]= ============================================================ [*] =[ General testing ]= ============================================================ ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Launch completed in 212.01512002944946 seconds. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ [*]Done.
掃描結束后, 我們可以查看數據庫，看看 WMAP給我們找到了什么有趣的東西.
msf > wmap_vulns -l [*] + [172.16.194.172] (172.16.194.172): scraper / [*] scraper Scraper [*] GET Metasploitable2 - Linux [*] + [172.16.194.172] (172.16.194.172): directory /dav/ [*] directory Directory found. [*] GET Res code: 200 [*] + [172.16.194.172] (172.16.194.172): directory /cgi-bin/ [*] directory Directoy found. [*] GET Res code: 403...snip...msf >
上面的信息告訴我們 WMAP 找到了一個可用漏洞. 執行“vulns” 命令來查看詳細信息.
msf > vulns[*] Time: 2012-01-16 20:58:49 UTC Vuln: host=172.16.2.207 port=80 proto=tcp name=auxiliary/scanner/http/options refs=CVE-2005-3398,CVE-2005-3498,OSVDB-877,BID-11604,BID-9506,BID-9561 msf >
用了WMAP進行 漏洞掃描 后, 我們能夠使用這些掃描結果來對報告的漏洞收集更深入的信息. 作為***測試人員, 我們要更深入的調查每個發現，并找出是否有潛在的***方法.
總結一下WMAP的用法：
msf>wmap_sites -a url 添加url
msf>wmap_targets -t url 添加目標
msf>wmap_run -e 開搞
msf>vulns 查看漏洞詳細信息
免責聲明：本站發布的內容（圖片、視頻和文字）以原創、轉載和分享為主，文章觀點不代表本網站立場，如果涉及侵權請聯系站長郵箱：is@yisu.com進行舉報，并提供相關證據，一經查實，將立刻刪除涉嫌侵權內容。
