When it comes to web server’s penetration-testing, a DNS server is always on the top of the list because DNS server is the core gateway of an internal enterprise to the mighty internet. Information gathering, as we all know is an important part of Penetration, so gathering information about the DNS is just as important as the DNS server. Even if an attacker can enumerate a DNS server it can prove very lethal to the Organization whose information is stored on the server.

In this tutorial we will be looking at several tools and their usage by which we can enumerate a DNS server in several ways.

For this we will open CMD shell in BT and type cd /pentest/enumeration/dns

Then type ls

The list of DNS enumeration tools will appear and we will take a look at the use of all tools. 

First we will use dnsenum tool.
It is very easy to use this tool, just type the command in the format perl dnsenum.pl 

It will generate results as shown in below picture.

It provided us with the list of entire IPs used by the website including the mail servers. 

Now the trick to extract information that we need for further phases of Pen-testing e.g if you want to test the mail server you can telnet it and exploit it by foot-printing (will be explained in upcoming tutorials). The next tool that we will use is dnswalk. 

It is also a very good tool for enumerating and provides with filtered information of the target.You can access it by cd dns command in dns folder. Only the difference in the input is In Dnswalk the target ends with a “.” 

We got the results here, as we have mentioned earlier dnswalk only provides basic information like SOA server and warnings. It is a partial enumeration testing tool. 

Next tool we will be digging is called dnsrecon, You can find this in the dns folder, It is a tool written python scripting.

Now as you can see below that we have performed multiple operations with dnsrecon which will be explained further. You can retrieve SRV records of the target also query SOA etc.

For retrieving SRV records you have to type the command ./dnsrecon.py –t srv –d target name.

Now here is how the result of the srv records look like:

And here’s how we query the SOA, NS and MX of the servers using the command ./dnsrecon.py –t std –d
And here how the result will look like:

By DNS enumeration you can gather a lot of information about the target and it can prove to be very helpful in a penetration test.

One of the most complex steps in Penetration-Testing is information gathering about the target. It is also necessary because as much as accurate information the Pen-tester would have the more efficient the pen-test would be. In this article we will be looking into a tool that is very popular among Pen-Testers when it comes to Information Gathering. This tool is called Maltego. We will be looking into several aspects that how Maltego works? Maltego comes with both Linux and windows versions, it is also built in Backtrack.

Once we get registered on Matelgo, we will be seeing a graph on our screen. We will look at the possibilities of Information gathering through this tool. On the left hand you will see a palette which contains transforms you can run. Here’s how it will look like.

Now here you can see a number of transforms that used for information gathering. First, we will gather information about a website. In the palette we will look under the Infrastructure and then a website. We will put the name of the website in the information and click “Run all Transforms”. And this is what we will get.

Now as you can see we have got quite a bit of information here about Mile2 including its Public IP, the websites it’s connected to, and e-mail addresses etc. Now this information can be very helpful if you are an out-bound Penetration-Tester. Next, we will look at how we can use Maltego as a search engine to find certain entities for us that normal search engines won’t provide publicly on the web. For this example we will select the Document Entity in palette. Let suppose we want to search a document named Pentest-mag.

Now as you can see in above image it has provided me some links of different articles given Pen test-mag. Having seen that it has also given us a direct link to those articles without wasting our time on searching them out. Now let’s assume that during a critical Pentest we want to gather information about a particular person, Maltego can help us with that as well. We will have to select the Person Entity in the Palette and it will provide us with all the information on the web related to that person instantly. 

As the result on the graph we have some useful information about the particular person including telephone number, associated social networks, accounts and some emails. Now the accuracy of this information is not often guaranteed but it can be a handy tool.

These are just a few drills that Maltego can perform, it depends on your objective that what information you want to extract about what entity. This tool can make quite a difference sometimes during an operation while its uses are dependent upon the Pen-tester.

Armitage is a scriptable red team collaboration tool for Metasploit that visualizes targets, recommends exploits, and exposes the advanced post-operation functions below:

 
• Use the same sessions
• Sharing hosts, recorded data and downloaded files
• Communicate via a shared event log
• Run bots to red team to automate tasks

 
Armitage has 3 interfaces. We will work in GUI form of Metasploit framework. Vulnerable targets are displayed in its session’s windows. Below the modules and targets are the tabs. Each exploited has been highlighted and can be further exploited to use queries. So here we will perform a few steps to hack LINUX.

Step 1: Scanning

As you know the first step is reconnaissance for any type of attack. Armitage is integrated with all tools. Port and vulnerability scans can also be done within the tool. First let’s scan using Nmap and import the results. The following command is used to launch port scan specifically against Linux targets.

nmap -p 1-65535 -T5 -A -v 172.16.146.0/24 -oX scan.xml

You can type any IP address but for testing purpose I am using my own. You can also import Nmap results in Armitage and also use the built-in Nmap scanner. Let us now get to the main part.

To view the particular results follow NMap scan: right-click the host and select Services. A tab will be shown to you similar to the one below will bring up the Linux IP services. The results are grouped into name, port, proto, and info columns.

Step 2: Simple Remote Exploitation

Metasploit has over 650 exploits. We are generally not sure which one to use for it. Armitage helps is that it can select the attack by itself. Right click on the target select options then find attacks. It will select the attacks by itself and prompt you with windows. From there you can carry on your Pen-Test

Right-click on the target and you’ll see an attack menu. It will have sub-categories containing some attacks but not all of these exploits are applicable, but these are the best candidates.

From the above report we can see that the Metasploit ProFTPD service is running on the target. Go to Attack -> ftp and select one of the ProFTPD exploits. By doing this you will be prompted with a dialogue box for your adjustment purposes. But wait we also have to see for the version now here’s the tricky part the version is not vulnerable for the exploit.

Let’s try another way. Right click target and select samba. We observed that exploit version ranges from 3.0.20-25 and the target in the same side is running Samba 3.x. Even if don’t have the exact version but it’s worth giving a shot so let’s try it. Let’s exploit. We do not need to change any settings for this matter.

If the target is exploited then there will be a red lightning bolt around it. Well we have exploited the target. Now we can have a shell session or do whatever we want with the data use its resources.

The best advantage of Armitage is that it is automated and that’s also the biggest flaw it sometimes gives false positives as well but it’s a resource we can use and proves to be helpful in many things like the one we done above.