Jok3r - Network Too Spider Web Pentest Framework - Hi friends mederc, In the article that you read this time with the title Jok3r - Network Too Spider Web Pentest Framework, We have prepared this article well for you to read and retrieve information from it. hopefully fill the posts Article Exploiting Vulnerabilities, Article Jok3R, Article Linux, Article Network Pentest Framework, Article Vulnerability Scanners, Article Web Pentest Framework, we write this you can understand. Alright, happy reading.

Title : Jok3r - Network Too Spider Web Pentest Framework
link : Jok3r - Network Too Spider Web Pentest Framework

Jok3r - Network Too Spider Web Pentest Framework

Jok3r is a Python3 CLI application which is aimed at helping penetration testers for network infrastructure too spider web black-box safety tests.
Its primary destination is to save fourth dimension on everything that tin survive automated during network/web pentest inward lodge to savor to a greater extent than fourth dimension on to a greater extent than interesting too challenging stuff.
To accomplish that, it combines open-source Hacking tools to run diverse safety checks against all mutual network services.


Main features
Toolbox management:

• Install automatically all the hacking tools used yesteryear Jok3r,
• Keep the toolbox up-to-date,
• Easily add together novel tools.

Attack automation:

• Target most mutual network services (including web),
• Run safety checks yesteryear chaining hacking tools, next criterion procedure (Reconaissance, Vulnerability scanning, Exploitation, Account bruteforce, (Basic) Post-exploitation).
• Let Jok3r automatically pick out the checks to run according to the context too noesis almost the target,

Mission administration / Local database:

• Organize targets yesteryear missions inward local database,
• Fully deal missions too targets (hosts/services) via interactive compaction (like msfconsole db),
• Access results from safety checks.

Jok3r has been built amongst the ambition to survive easily too rapidly customizable: Tools, safety checks, supported network services... tin survive easily added/edited/removed yesteryear editing settings files amongst an easy-to-understand syntax.


Installation
The recommended agency to purpose Jok3r is within a Docker container therefore yous volition non convey to worry almost dependencies issues too installing the diverse hacking tools of the toolbox.

Influenza A virus subtype H5N1 Docker ikon is available on Docker Hub too automatically re-built at each update: https://hub.docker.com/r/koutto/jok3r/. It is initially based on official Kali Linux Docker ikon (kalilinux/kali-linux-docker).

Pull Jok3r Docker Image:

sudo docker delineate koutto/jok3r

Run fresh Docker container:

sudo docker run -i -t --name jok3r-container -w /root/jok3r --net=host koutto/jok3r

Important: --net=host pick is required to portion host's interface. It is needed for contrary connections (e.g. Ping to container when testing for RCE, Get a contrary shell)
Jok3r too its toolbox is ready-to-use !

• To re-run a stopped container:

sudo docker outset -i jok3r-container

• To opened upwards multiple shells within the container:

sudo docker exec -it jok3r-container bash

For information almost edifice your ain Docker ikon or installing Jok3r on your organisation without using Docker, refer to https://jok3r.readthedocs.io/en/latest/installation.html


Quick usage examples
Show all the tools inward the toolbox

python3 jok3r.py toolbox --show-all

Install all the tools inward the toolbox

python3 jok3r.py toolbox --install-all --fast

Update all the tools inward the toolbox

python3 jok3r.py toolbox --update-all --fast

List supported services

python3 jok3r.py information --services

Show safety checks for HTTP

python3 jok3r.py information --checks http

Create a novel mission inward local database

python3 jok3r.py db  jok3rdb[default]> mission -a MayhemProject  [+] Mission "MayhemProject" successfully added [*] Selected mission is straightaway MayhemProject  jok3rdb[MayhemProject]>

Run safety checks against an URL too add together results to the mission

python3 jok3r.py laid on -t https://www.example.com/webapp/ --add MayhemProject

Run safety checks against a MSSQL service (without user-interaction) too add together results to the mission

python3 jok3r.py laid on -t 192.168.1.42:1433 -s mssql --add MayhemProject --fast

Import hosts/services from Nmap results into the mission scope

python3 jok3r.py db  jok3rdb[default]> mission MayhemProject  [*] Selected mission is straightaway MayhemProject  jok3rdb[MayhemProject]> nmap results.xml

Run safety checks against all services inward the given mission too shop results inward the database

python3 jok3r.py laid on -m MayhemProject --fast

Run safety checks against exclusively FTP services running on ports 21/tcp too 2121/tcp from the mission

python3 jok3r.py laid on -m MayhemProject -f "port=21,2121;service=ftp" --fast

Run safety checks against exclusively FTP services running on ports 2121/tcp too all HTTP services on 192.168.1.42 from the mission

python3 jok3r.py laid on -m MayhemProject -f "port=2121;service=ftp" -f "ip=192.168.1.42;service=http"

Typical usage example
You cause a pentest amongst several servers inward the scope. Here is a typical event of usage of JoK3r:

1. You run Nmap scan on the servers inward the scope.
2. You practise a novel mission (let's tell "MayhemProject") inward the local database:

python3 jok3r.py db  jok3rdb[default]> mission -a MayhemProject  [+] Mission "MayhemProject" successfully added [*] Selected mission is straightaway MayhemProject  jok3rdb[MayhemProject]>

3. You import your results from Nmap scan inward the database:

jok3rdb[MayhemProject]> nmap results.xml

4. You tin too therefore convey a quick overview of all services too hosts inward the scope, add together unopen to comments, add together unopen to credentials if yous already convey unopen to noesis almost the targets (grey box pentest), too therefore on

jok3rdb[MayhemProject]> hosts  [...]  jok3rdb[MayhemProject]> services  [...]

5. Now, yous tin run safety checks against unopen to targets inward the scope. For example, if yous desire to run checks against all Java-RMI services inward the scope, yous tin run the next command:

python3 jok3r.py laid on -m MayhemProject -f "service=java-rmi" --fast

6. You tin stance the results from the safety checks either inward alive when the tools are executed or subsequently from the database using the next command:

jok3rdb[MayhemProject]> results

Full Documentation
Documentation is available at: https://jok3r.readthedocs.io/


Supported Services & Security Checks 
Lots of checks rest to survive implemented too services must survive added !! Work inward progress ...

• AJP (default 8009/tcp)
• FTP (default 21/tcp)
• HTTP (default 80/tcp)
• Java-RMI (default 1099/tcp)
• JDWP (default 9000/tcp)
• MSSQL (default 1433/tcp)
• MySQL (default 3306/tcp)
• Oracle (default 1521/tcp)
• PostgreSQL (default 5432/tcp)
• RDP (default 3389/tcp)
• SMB (default 445/tcp)
• SMTP (default 25/tcp)
• SNMP (default 161/udp)
• SSH (default 22/tcp)
• Telnet (default 21/tcp)
• VNC (default 5900/tcp)

AJP (default 8009/tcp)

+------------------------+------------+-------------------------------------------------------------------------------------------------+----------------+ | Name                   | Category   | Description                                                                                     | Tool used      | +------------------------+------------+-------------------------------------------------------------------------------------------------+----------------+ | nmap-recon             | recon      | Recon using Nmap AJP scripts                                                                    | nmap           | | tomcat-version         | recon      | Fingerprint Tomcat version through AJP                                                          | ajpy           | | vuln-lookup            | vulnscan   | Vulnerability lookup inward Vulners.com (NSE scripts) too exploit-db.com (lots of faux positive !) | vuln-databases | | default-creds-tomcat   | bruteforce | Check default credentials for Tomcat Application Manager                                        | ajpy           | | deploy-webshell-tomcat | exploit    | Deploy a webshell on Tomcat through AJP                                                         | ajpy           | +------------------------+------------+-------------------------------------------------------------------------------------------------+----------------+

FTP (default 21/tcp)

+------------------+------------+-------------------------------------------------------------------------------------------------+----------------+ | Name             | Category   | Description                                                                                     | Tool used      | +------------------+------------+-------------------------------------------------------------------------------------------------+----------------+ | nmap-recon       | recon      | Recon using Nmap FTP scripts                                                                    | nmap           | | nmap-vuln-lookup | vulnscan   | Vulnerability lookup inward Vulners.com (NSE scripts) too exploit-db.com (lots of faux positive !) | vuln-databases | | ftpmap-scan      | vulnscan   | Identify FTP server soft/version too banking enterprise fit for known vulns                                      | ftpmap         | | common-creds     | bruteforce | Check mutual credentials on FTP server                                                          | patator        | | bruteforce-creds | bruteforce | Bruteforce FTP accounts                                                                         | patator        | +------------------+------------+-------------------------------------------------------------------------------------------------+----------------+

HTTP (default 80/tcp)

+--------------------------------------+-------------+--------------------------------------------------------------------------------------------------+--------------------------------+ | Name                                 | Category    | Description                                                                                      | Tool used                      | +--------------------------------------+-------------+--------------------------------------------------------------------------------------------------+--------------------------------+ | nmap-recon                           | recon       | Recon using Nmap HTTP scripts                                                                    | nmap                           | | load-balancing-detection             | recon       | HTTP charge balancer detection                                                                     | halberd                        | | waf-detection                        | recon       | Identify too fingerprint WAF products protecting website                                         | wafw00f                        | | tls-probing                          | recon       | Identify the implementation inward purpose yesteryear SSL/TLS servers (might allow server fingerprinting)        | tls-prober                     | | fingerprinting-multi-whatweb         | recon       | Identify CMS, blogging platforms, JS libraries, Web servers                                      | whatweb                        | | fingerprinting-app-server            | recon       | Fingerprint application server (JBoss, ColdFusion, Weblogic, Tomcat, Railo, Axis2, Glassfish)    | clusterd                       | | fingerprinting-server-domino         | recon       | Fingerprint IBM/Lotus Domino server                                                              | domiowned                      | | fingerprinting-cms-wig               | recon       | Identify several CMS too other administrative applications                                       | wig                            | | fingerprinting-cms-cmseek            | recon       | Detect CMS (130+ supported), discovery version on Drupal, advanced scan on Wordpress/Joomla         | cmseek                         | | fingerprinting-cms-fingerprinter     | recon       | Fingerprint exactly CMS versions (based on files checksums)                                    | fingerprinter                  | | fingerprinting-cms-cmsexplorer       | recon       | Find plugins too themes (using bruteforce) installed inward a CMS (Wordpress, Drupal, Joomla, Mambo) | cmsexplorer                    | | fingerprinting-drupal                | recon       | Fingerprint Drupal 7/8: users, nodes, default files, modules, themes enumeration                 | drupwn                         | | crawling-fast                        | recon       | Crawl website quickly, analyze interesting files/directories                                     | dirhunt                        | | crawling-fast2                       | recon       | Crawl website too extract URLs, files, intel & endpoints                                         | photon                         | | vuln-lookup                          | vulnscan    | Vulnerability lookup inward Vulners.com (NSE scripts) too exploit-db.com (lots of faux positive !)  | vuln-databases                 | | ssl-check                            | vulnscan    | Check for SSL/TLS configuration                                                                  | testssl                        | | vulnscan-multi-nikto                 | vulnscan    | Check for multiple spider web vulnerabilities/misconfigurations                                         | nikto                          | | default-creds-web-multi              | vulnscan    | Check for default credentials on diverse spider web interfaces                                          | changeme                       | | webdav-scan-davscan                  | vulnscan    | Scan HTTP WebDAV                                                                                 | davscan                        | | webdav-scan-msf                      | vulnscan    | Scan HTTP WebDAV                                                                                 | metasploit                     | | webdav-internal-ip-disclosure        | vulnscan    | Check for WebDAV internal IP disclosure                                                          | metasploit                     | | webdav-website-content               | vulnscan    | Detect webservers disclosing its content through WebDAV                                          | metasploit                     | | http-put-check                       | vulnscan    | Detect the back upwards of unsafe HTTP PUT method                                                  | metasploit                     | | apache-optionsbleed-check            | vulnscan    | Test for the Optionsbleed põrnikas inward Apache httpd (CVE-2017-9798)                                    | optionsbleed                   | | shellshock-scan                      | vulnscan    | Detect if spider web server is vulnerable to Shellshock (CVE-2014-6271)                                 | shocker                        | | iis-shortname-scan                   | vulnscan    | Scan for IIS brusk filename (8.3) disclosure vulnerability                                       | iis-shortname-scanner          | | iis-internal-ip-disclosure           | vulnscan    | Check for IIS internal IP disclosure                                                             | metasploit                     | | tomcat-user-enum                     | vulnscan    | Enumerate users on Tomcat 4.1.0 - 4.1.39, 5.5.0 - 5.5.27, too 6.0.0 - 6.0.18                     | metasploit                     | | jboss-vulnscan-multi                 | vulnscan    | Scan JBoss application server for multiple vulnerabilities                                       | metasploit                     | | jboss-status-infoleak                | vulnscan    | Queries JBoss condition servlet to collect sensitive information (JBoss 4.0, 4.2.2 too 4.2.3)       | metasploit                     | | jenkins-infoleak                     | vulnscan    | Enumerate a remote Jenkins-CI installation inward an unauthenticated trend                          | metasploit                     | | cms-multi-vulnscan-cmsmap            | vulnscan    | Check for vulnerabilities inward CMS Wordpress, Drupal, Joomla                                       | cmsmap                         | | wordpress-vulscan                    | vulnscan    | Scan for vulnerabilities inward CMS Wordpress                                                        | wpscan                         | | wordpress-vulscan2                   | vulnscan    | Scan for vulnerabilities inward CMS Wordpress                                                        | wpseku                         | | joomla-vulnscan                      | vulnscan    | Scan for vulnerabilities inward CMS Joomla                                                           | joomscan                       | | joomla-vulnscan2                     | vulnscan    | Scan for vulnerabilities inward CMS Joomla                                                           | joomlascan                     | | joomla-vulnscan3                     | vulnscan    | Scan for vulnerabilities inward CMS Joomla                                                           | joomlavs                       | | drupal-vulnscan                      | vulnscan    | Scan for vulnerabilities inward CMS Drupal                                                           | droopescan                     | | magento-vulnscan                     | vulnscan    | Check for misconfigurations inward CMS Magento                                                       | magescan                       | | silverstripe-vulnscan                | vulnscan    | Scan for vulnerabilities inward CMS Silverstripe                                                     | droopescan                     | | vbulletin-vulnscan                   | vulnscan    | Scan for vulnerabilities inward CMS vBulletin                                                        | vbscan                         | | liferay-vulnscan                     | vulnscan    | Scan for vulnerabilities inward CMS Liferay                                                          | liferayscan                    | | angularjs-csti-scan                  | vulnscan    | Scan for AngularJS Client-Side Template Injection                                                | angularjs-csti-scanner         | | jboss-deploy-shell                   | exploit     | Try to deploy compaction on JBoss server (jmx|web|admin-console, JMXInvokerServlet)                   | jexboss                        | | struts2-rce-cve2017-5638             | exploit     | Exploit Apache Struts2 DKI Jakarta Multipart parser RCE (CVE-2017-5638)                              | jexboss                        | | struts2-rce-cve2017-9805             | exploit     | Exploit Apache Struts2 REST Plugin XStream RCE (CVE-2017-9805)                                   | struts-pwn-cve2017-9805        | | struts2-rce-cve2018-11776            | exploit     | Exploit Apache Struts2 misconfiguration RCE (CVE-2018-11776)                                     | struts-pwn-cve2018-11776       | | tomcat-rce-cve2017-12617             | exploit     | Exploit for Apache Tomcat JSP Upload Bypass RCE (CVE-2017-12617)                                 | exploit-tomcat-cve2017-12617   | | jenkins-cliport-deserialize          | exploit     | Exploit Java deserialization inward Jenkins CLI port                                                 | jexboss                        | | weblogic-t3-deserialize-cve2015-4852 | exploit     | Exploit Java deserialization inward Weblogic T3(s) (CVE-2015-4852)                                   | loubia                         | | weblogic-t3-deserialize-cve2017-3248 | exploit     | Exploit Java deserialization inward Weblogic T3(s) (CVE-2017-3248)                                   | exploit-weblogic-cve2017-3248  | | weblogic-t3-deserialize-cve2018-2893 | exploit     | Exploit Java deserialization inward Weblogic T3(s) (CVE-2018-2893)                                   | exploit-weblogic-cve2018-2893  | | weblogic-wls-wsat-cve2017-10271      | exploit     | Exploit WLS-WSAT inward Weblogic - CVE-2017-10271                                                    | exploit-weblogic-cve2017-10271 | | drupal-cve-exploit                   | exploit     | Check too exploit CVEs inward CMS Drupal 7/8 (include Drupalgeddon2) (require user interaction)      | drupwn                         | | bruteforce-domino                    | bruteforce  | Bruteforce against IBM/Lotus Domino server                                                       | domiowned                      | | bruteforce-wordpress                 | bruteforce  | Bruteforce Wordpress accounts                                                                    | wpseku                         | | bruteforce-joomla                    | bruteforce  | Bruteforce Joomla trouble organisation human relationship                                                                        | xbruteforcer                   | | bruteforce-drupal                    | bruteforce  | Bruteforce Drupal trouble organisation human relationship                                                                        | xbruteforcer                   | | bruteforce-opencart                  | bruteforce  | Bruteforce Opencart trouble organisation human relationship                                                                      | xbruteforcer                   | | bruteforce-magento                   | bruteforce  | Bruteforce Magento trouble organisation human relationship                                                                       | xbruteforcer                   | | web-path-bruteforce-targeted         | bruteforce  | Bruteforce spider web paths when linguistic communication is known (extensions adapted) (use raft wordlist)             | dirsearch                      | | web-path-bruteforce-blind            | bruteforce  | Bruteforce spider web paths when linguistic communication is unknown (use raft wordlist)                                | wfuzz                          | | web-path-bruteforce-opendoor         | bruteforce  | Bruteforce spider web paths using OWASP OpenDoor wordlist                                               | wfuzz                          | | wordpress-shell-upload               | postexploit | Upload compaction on Wordpress if admin credentials are known                                         | wpforce                        | +--------------------------------------+-------------+--------------------------------------------------------------------------------------------------+--------------------------------+

Java-RMI (default 1099/tcp)

+--------------------------------+-------------+--------------------------------------------------------------------------------------------------------+----------------+ | Name                           | Category    | Description                                                                                            | Tool used      | +--------------------------------+-------------+--------------------------------------------------------------------------------------------------------+----------------+ | nmap-recon                     | recon       | Attempt to dump all objects from Java-RMI service                                                      | nmap           | | rmi-enum                       | recon       | Enumerate RMI services                                                                                 | barmie         | | jmx-info                       | recon       | Get information almost JMX too the MBean server                                                         | twiddle        | | vuln-lookup                    | vulnscan    | Vulnerability lookup inward Vulners.com (NSE scripts) too exploit-db.com (lots of faux positive !)        | vuln-databases | | jmx-bruteforce                 | bruteforce  | Bruteforce creds to connect to JMX registry                                                            | jmxbf          | | exploit-rmi-default-config     | exploit     | Exploit default config inward RMI Registry to charge classes from whatsoever remote URL (not working against JMX)   | metasploit     | | exploit-jmx-insecure-config    | exploit     | Exploit JMX insecure config. Auth disabled: should survive vuln. Auth enabled: vuln if weak config          | metasploit     | | jmx-auth-disabled-deploy-class | exploit     | Deploy malicious MBean on JMX service amongst auth disabled (alternative to msf module)                   | sjet           | | tomcat-jmxrmi-deserialize      | exploit     | Exploit Java-RMI deserialize inward Tomcat (CVE-2016-8735, CVE-2016-8735), req. JmxRemoteLifecycleListener | jexboss        | | rmi-deserialize-all-payloads   | exploit     | Attempt to exploit Java deserialize against Java RMI Registry amongst all ysoserial payloads              | ysoserial      | | tomcat-jmxrmi-manager-creds    | postexploit | Retrieve Manager creds on Tomcat JMX (req. auth disabled or creds known on JMX)                        | jmxploit       | +--------------------------------+-------------+--------------------------------------------------------------------------------------------------------+----------------+

JDWP (default 9000/tcp)

+------------+----------+-----------------------------------------------------+-----------------+ | Name       | Category | Description                                         | Tool used       | +------------+----------+-----------------------------------------------------+-----------------+ | nmap-recon | recon    | Recon using Nmap JDWP scripts                       | nmap            | | jdwp-rce   | exploit  | Gain RCE on JDWP service (show OS/Java information equally PoC) | jdwp-shellifier | +------------+----------+-----------------------------------------------------+-----------------+

MSSQL (default 1433/tcp)

+-----------------------+-------------+--------------------------------------------------------------------------------------------------------------+-----------+ | Name                  | Category    | Description                                                                                                  | Tool used | +-----------------------+-------------+--------------------------------------------------------------------------------------------------------------+-----------+ | nmap-recon            | recon       | Recon using Nmap MSSQL scripts                                                                               | nmap      | | mssqlinfo             | recon       | Get technical information almost a remote MSSQL server (use TDS protocol too SQL browser Server)              | msdat     | | common-creds          | bruteforce  | Check common/default credentials on MSSQL server                                                             | msdat     | | bruteforce-sa-account | bruteforce  | Bruteforce MSSQL "sa" trouble organisation human relationship                                                                                | msdat     | | audit-mssql-postauth  | postexploit | Check permissive privileges, methods allowing ascendency execution, weak accounts after authenticating on MSSQL | msdat     | +-----------------------+-------------+--------------------------------------------------------------------------------------------------------------+-----------+

MySQL (default 3306/tcp)

+----------------------------------+-------------+-------------------------------------------------------------------------+---------------+ | Name                             | Category    | Description                                                             | Tool used     | +----------------------------------+-------------+-------------------------------------------------------------------------+---------------+ | nmap-recon                       | recon       | Recon using Nmap MySQL scripts                                          | nmap          | | mysql-auth-bypass-cve2012-2122   | exploit     | Exploit password bypass vulnerability inward MySQL - CVE-2012-2122          | metasploit    | | default-creds                    | bruteforce  | Check default credentials on MySQL server                               | patator       | | mysql-hashdump                   | postexploit | Retrieve usernames too password hashes from MySQL database (req. creds) | metasploit    | | mysql-interesting-tables-columns | postexploit | Search for interesting tables too columns inward database                   | jok3r-scripts | +----------------------------------+-------------+-------------------------------------------------------------------------+---------------+

Oracle (default 1521/tcp)

+--------------------------+-------------+--------------------------------------------------------------------------------------------------------------+-----------+ | Name                     | Category    | Description                                                                                                  | Tool used | +--------------------------+-------------+--------------------------------------------------------------------------------------------------------------+-----------+ | tnscmd                   | recon       | Connect to TNS Listener too number commands Ping, Status, Version                                             | odat      | | tnspoisoning             | vulnscan    | Test if TNS Listener is vulnerable to TNS Poisoning (CVE-2012-1675)                                          | odat      | | common-creds             | bruteforce  | Check common/default credentials on Oracle server                                                            | odat      | | bruteforce-creds         | bruteforce  | Bruteforce Oracle accounts (might block unopen to accounts !)                                                     | odat      | | audit-oracle-postauth    | postexploit | Check for privesc vectors, config leading to ascendency execution, weak accounts after authenticating on Oracle | odat      | | search-columns-passwords | postexploit | Search for columns storing passwords inward the database                                                         | odat      | +--------------------------+-------------+--------------------------------------------------------------------------------------------------------------+-----------+

PostgreSQL (default 5432/tcp)

+---------------+------------+------------------------------------------------+-----------+ | Name          | Category   | Description                                    | Tool used | +---------------+------------+------------------------------------------------+-----------+ | default-creds | bruteforce | Check default credentials on PostgreSQL server | patator   | +---------------+------------+------------------------------------------------+-----------+

RDP (default 3389/tcp)

+----------+----------+-----------------------------------------------------------------------+------------+ | Name     | Category | Description                                                           | Tool used  | +----------+----------+-----------------------------------------------------------------------+------------+ | ms12-020 | vulnscan | Check for MS12-020 RCE vulnerability (any Windows earlier xiii Mar 2012) | metasploit | +---------+----------+-----------------------------------------------------------------------+------------+

SMB (default 445/tcp)

+-----------------------------------+-------------+-------------------------------------------------------------------------------+------------+ | Name                              | Category    | Description                                                                   | Tool used  | +-----------------------------------+-------------+-------------------------------------------------------------------------------+------------+ | nmap-recon                        | recon       | Recon using Nmap SMB scripts                                                  | nmap       | | anonymous-enum-smb                | recon       | Attempt to perform enum (users, shares...) without trouble organisation human relationship                    | nullinux   | | nmap-vulnscan                     | vulnscan    | Check for vulns inward SMB (MS17-010, MS10-061, MS10-054, MS08-067...) using Nmap | nmap       | | detect-ms17-010                   | vulnscan    | Detect MS17-010 SMB RCE                                                       | metasploit | | samba-rce-cve2015-0240            | vulnscan    | Detect RCE vuln (CVE-2015-0240) inward Samba 3.5.x too 3.6.X                      | metasploit | | exploit-rce-ms08-067              | exploit     | Exploit for RCE vuln MS08-067 on SMB                                          | metasploit | | exploit-rce-ms17-010-eternalblue  | exploit     | Exploit for RCE vuln MS17-010 EternalBlue on SMB                              | metasploit | | exploit-sambacry-rce-cve2017-7494 | exploit     | Exploit for SambaCry RCE on Samba <= 4.5.9 (CVE-2017-7494)                    | metasploit | | auth-enum-smb                     | postexploit | Authenticated enumeration (users, groups, shares) on SMB                      | nullinux   | | auth-shares-perm                  | postexploit | Get R/W permissions on SMB shares                                             | smbmap     | | smb-exec                          | postexploit | Attempt to larn a remote compaction (psexec-like, requires Administrator creds)     | impacket   | +-----------------------------------+-------------+-------------------------------------------------------------------------------+------------+

SMTP (default 25/tcp)

+----------------+----------+--------------------------------------------------------------------------------------------+----------------+ | Name           | Category | Description                                                                                | Tool used      | +----------------+----------+--------------------------------------------------------------------------------------------+----------------+ | smtp-cve       | vulnscan | Scan for vulnerabilities (CVE-2010-4344, CVE-2011-1720, CVE-2011-1764, open-relay) on SMTP | nmap           | | smtp-user-enum | vulnscan | Attempt to perform user enumeration via SMTP commands EXPN, VRFY too RCPT TO               | smtp-user-enum | +----------------+----------+--------------------------------------------------------------------------------------------+----------------+

SNMP (default 161/udp)

+--------------------------+-------------+---------------------------------------------------------------------+------------+ | Name                     | Category    | Description                                                         | Tool used  | +--------------------------+-------------+---------------------------------------------------------------------+------------+ | common-community-strings | bruteforce  | Check mutual community strings on SNMP server                       | metasploit | | snmpv3-bruteforce-creds  | bruteforce  | Bruteforce SNMPv3 credentials                                       | snmpwn     | | enumerate-info           | postexploit | Enumerate information provided yesteryear SNMP (and banking enterprise fit for write access) | snmp-check | +--------------------------+-------------+---------------------------------------------------------------------+------------+

SSH (default 22/tcp)

+--------------------------------+------------+--------------------------------------------------------------------------------------------+-----------+ | Name                           | Category   | Description                                                                                | Tool used | +--------------------------------+------------+--------------------------------------------------------------------------------------------+-----------+ | vulns-algos-scan               | vulnscan   | Scan supported algorithms too safety information on SSH server                                  | ssh-audit | | user-enumeration-timing-attack | exploit    | Try to perform OpenSSH (versions <= 7.2 too >= 5.*) user enumeration timing laid on OpenSSH | osueta    | | default-ssh-key                | bruteforce | Try to authenticate on SSH server using known SSH keys                                     | changeme  | | default-creds                  | bruteforce | Check default credentials on SSH                                                           | patator   | +--------------------------------+------------+--------------------------------------------------------------------------------------------+-----------+

Telnet (default 21/tcp)

+-------------------------+------------+----------------------------------------------------------------------------------+-----------+ | Name                    | Category   | Description                                                                      | Tool used | +-------------------------+------------+----------------------------------------------------------------------------------+-----------+ | nmap-recon              | recon      | Recon using Nmap Telnet scripts                                                  | nmap      | | default-creds           | bruteforce | Check default credentials on Telnet (dictionary from https://cirt.net/passwords) | patator   | | bruteforce-root-account | bruteforce | Bruteforce "root" trouble organisation human relationship on Telnet                                              | patator   | +-------------------------+------------+----------------------------------------------------------------------------------+-----------+

VNC (default 5900/tcp)

+-----------------+------------+-------------------------------------------------------------------------------------------------+----------------+ | Name            | Category   | Description                                                                                     | Tool used      | +-----------------+------------+-------------------------------------------------------------------------------------------------+----------------+ | nmap-recon      | recon      | Recon using Nmap VNC scripts                                                                    | nmap           | | vuln-lookup     | vulnscan   | Vulnerability lookup inward Vulners.com (NSE scripts) too exploit-db.com (lots of faux positive !) | vuln-databases | | bruteforce-pass | bruteforce | Bruteforce VNC password                                                                         | patator        | +-----------------+------------+-------------------------------------------------------------------------------------------------+----------------+

Download Jok3R

Thus the article Jok3r - Network Too Spider Web Pentest Framework

That's all the article Jok3r - Network Too Spider Web Pentest Framework this time, hopefully can benefit you all. okay, see you in another article posting.

You are now reading the article Jok3r - Network Too Spider Web Pentest Framework with the link address https://mederc.blogspot.com/2019/09/jok3r-network-too-spider-web-pentest.html

Share this post