Web Penetration Test
https://hack.me/
CAPITAL UNIVERSITY OF SCIENCE AND TECHNOLOGY
2020
Report by: Muhammad Sohaib Imtiaz
Contents
DNS ENUMERATION....................................................................................................... 2
INTRODUCTION ............................................................................................................. 2
WHAT’S DNS ENUMERATION? .................................................................................... 2
IMPACT .................................................................................................................... 3
LET’S EXPLORE THE BEST WAYS TO PERFORM A DNS ENUMERATION. ................................. 3
1. DIG ...................................................................................................................... 3
2. HOST ................................................................................................................... 3
3. DNSENUM ............................................................................................................ 4
4. NMAP ................................................................................................................... 6
5. DNS RECON ......................................................................................................... 7
6. FIERCE ................................................................................................................. 7
DNS INFO COLLECTION ................................................................................................. 8
1. WHOIS ................................................................................................................. 8
2. ARIN REGISTRY .................................................................................................... 8
3. NET DISCOVERS ................................................................................................... 13
4. ZENMAP .............................................................................................................. 14
USING WIRESHARK ...................................................................................................... 15
USING THE VEGA WEB SCANNER TO FIND VULNERABILITIES ............................................. 23
USING TCP DUMP........................................................................................................ 29
Web Penetration Test | 1/9/2020
1
Web Penetration Test
DNS Enumeration
Introduction
DNS servers are the heart and soul of the Internet. Without them we couldn’t resolve hostnames
and domain names into IP addresses.
However, DNS is also one of the most frequently attacked protocols, where
different types of DNS attacks are spread from home users to small, mid and
large companies.
That’s why, in the information gathering process, the most common practice is to
create a full inventory of all internet-connected devices and domain names from
the company you’re investigating.
We all know that DNS servers are basically computers connected to the Internet,
and that helps us to resolve hostnames into IP addresses. They’re in charge of
managing and processing DNS requests from clients that need to fetch fresh
domain name information, along with DNS records.
That’s where the weak link shows up, thanks to the way the DNS was built. It’s a
bit vulnerable, which allows us to perform DNS enumeration (also known as DNS
recon) easily.
Network Penetration Test | 7/1/2008
What’s DNS enumeration?
DNS enumeration is one of the most popular reconnaissance tasks there is for
building a profile of your target.
In plain English, it’s the act of detecting and enumerating all possible DNS
records from a domain name. This includes hostnames, DNS record names,
DNS record types, TTLs, IP addresses, and a bit more, depending on how much
information you’re looking for.
2
With effective DNS enumeration, you can clone DNS zones manually, using
scripts or by exploiting DNS zone transfer vulnerabilities, known
as AXFR (Asynchronous Transfer Full Range) Transfer. This latter type of DNS
transfer takes place when an attacker detects a misconfigured DNS server that is
actually responding to AXFR requests.
Impact
Once DNS enumeration is completed, unauthenticated users may use this
information to observe internal network records, grabbing useful DNS information
that provides the attacker access to a full DNS map. This allows him to explore
the attack surface area of any company, so he can later scan it, collect data, and
while he’s at it exploit it if there’s an open opportunity.
Let’s explore the best ways to perform a DNS enumeration .
1. Dig
Web Penetration Test | 1/9/2020
2. Host
3
3. DNSenum
Network Penetration Test | 7/1/2008
4
Web Penetration Test | 1/9/2020
5
4. Nmap
Network Penetration Test | 7/1/2008
6
Web Penetration Test | 1/9/2020
7
6. Fierce
5. DNS Recon
DNS Info collection
1. Whois
Network Penetration Test | 7/1/2008
2. ARIN registry
8
Web Penetration Test | 1/9/2020
9
Network Penetration Test | 7/1/2008
10
Web Penetration Test | 1/9/2020
11
Network Penetration Test | 7/1/2008
12
Web Penetration Test | 1/9/2020
13
3. Net discovers
4. ZenMap
Network Penetration Test | 7/1/2008
14
Web Penetration Test | 1/9/2020
Using Wireshark
Capture packets related to TCP protocol and identify the Three-way hand shake
sequences.
15
Network Penetration Test | 7/1/2008
16
Web Penetration Test | 1/9/2020
17
Capture packets of http protocol.
Network Penetration Test | 7/1/2008
18
Capture packets of UDP protocol.
Web Penetration Test | 1/9/2020
19
Network Penetration Test | 7/1/2008
Capture packets of ARP requests and reply.
20
Web Penetration Test | 1/9/2020
Try to find user name and password in plain text format for a website using simple
HTTP protocol by using its login form
21
Network Penetration Test | 7/1/2008
22
Using the VEGA web scanner to find vulnerabilities
Web Penetration Test | 1/9/2020
23
Network Penetration Test | 7/1/2008
24
Web Penetration Test | 1/9/2020
25
Network Penetration Test | 7/1/2008
26
Web Penetration Test | 1/9/2020
27
Network Penetration Test | 7/1/2008
28
Web Penetration Test | 1/9/2020
Using TCP dump
Capture packets related to TCP protocol and identify the Three-way hand shake
sequences.
29
Capture packets of http protocol.
Network Penetration Test | 7/1/2008
30
Capture packets of UDP protocol.
Capture packets of ARP requests and reply.
Web Penetration Test | 1/9/2020
31
Try to find user name and password in plain text format for a website using simple
HTTP protocol by using its login form. Find the name and passwords in plain text form
in packet dump.
Network Penetration Test | 7/1/2008
32
