[zee eichel]

hmmmm.. salah satu tools yang dapat kita pergunakan dalam menguji sistem keamanan khusus web aplication heheheh .. tools ini dapat memeriksa beberapa jenis web attack seperti RFI, LFI dan SQL Injection.

ok nama toolsnya sudah ane taro di judul atas ... lanjut bro ..

pertama-tama download dulu ya toolsnya pada saat thread ini ditulis uniscan telah mencapai versi 4.1

Code:

wget http://nchc.dl.sourceforge.net/project/uniscan/4.1/uniscan.tar

nah klo udah extract waee

Code:

tar xvwf uniscan.tar

chmod biar bisa di esekusi

Code:

root@zee-eichel{/pentest/zee}:cd uniscan-code/
./   CHANGES.txt  Directory  LFI  RFI       uniscan.conf
../  c.txt        Files      RCE  Uniscan/  uniscan.pl*
root@zee-eichel{/pentest/zee/uniscan-code}:chmod +x uniscan.pl

ya udah coba di esekusi .. klo keluar tampilan error itu karena dia membutuhkan beberapa resource lib

Code:

apt-get install libmoose-perl

selow down bro ... ok kita lanjut ..

Code:

root@zee-eichel{/pentest/zee/uniscan-code}:perl uniscan.pl
###############################
# Uniscan project             #
# http://www.uniscan.com.br/  #
###############################
V. 4.1


OPTIONS:
    -h     help
    -u     <url> example: https://www.example.com/
    -f     <file> list of url's
    -b     Uniscan go to background
    -q     Disable Directory checks
    -w     Disable File checks
    -e     Disable Backup file checks
    -r     Disable RFI checks by Crawler
    -t     Disable LFI checks by Crawler
    -y     Disable RCE checks by Crawler
    -i     Disable SQL checks by Crawler
    -o     Disable XSS checks by Crawler
    -p     Disable static RFI checks
    -a     Disable static LFI checks
    -s     Disable static RCE checks
    -d     Disable /robots.txt check
    -g     Disable PUT method check
    -j     Not show e-mails found by Crawler

    Option -u or -f is required, all others no.

usage:
[1] perl uniscan.pl -u http://www.example.com/
[2] perl uniscan.pl -f /home/user/file.txt -b
[3] perl uniscan.pl -u https://www.example.com/

lihat usagenya bro terus di coba aja .... ane dah coba and its works

[iKONspirasi]

wah wah wah, ga ada habisnya nih, ngikutin aja capek ane bro wkwkwk suram...

buat testing website kantor aah :ngacir

[koecroet]

ea, om zee lagi bae banget nih ngeshare toolsnya

[sasaka]

perasaan kalo ane di markas, om zee ga pernah bahas ginian ,,,hehehehe
lumayan buat scan web :apn:

[Minbar]

Ijin dicoba dulu om zhee,
btw itu pas ane ektrak .tarnya itu ektrak filenya satu per satu, kalau biar langsung ektrak semuanya sekaligus gimana ya om?

[cassaprodigy]

lha perintah tar zxvf itu sudah sekaligus kok om

[Minbar]

iya om, kudu ketik enter terus2an baru bisa di ektrak semuanya
Btw, lama banget ya nungguinnya :hammer: saking banyaknya yg kudu discan, btw, boleh liat contoh hasilnya ga ya? ane dah coba 1 website tapi hasilnya nihil

[Junior Riau]

| [*] Checking: http://www.****.id/aw-cgi/
| [*] Checking: http://www.****.id/awk/
| [+] CODE: 200 URL: http://www.****.id/icons/
| [+] CODE: 200 URL: http://www.****.id/images/
| [+] CODE: 200 URL: http://www.****.id/include/
| [+] CODE: 200 URL: http://www.****.id/jquery/
| [+] CODE: 200 URL: http://www.****.id/phpmyadmin/
| [+] CODE: 200 URL: http://www.****.id/register/
| [+] CODE: 401 URL: http://www.****.id/stats/
| [+] CODE: 200 URL: http://www.****.id/user/

maksud yang ini apaan kak ===>>> | [+] CODE: 401 URL: http://www.****.id/stats/

---

yang ini paan maksudnya ??

| Check robots.txt:
| [+] *
| [+] /stats/
| Crawler Started:
| [+] Crawling finished, 58 URL's found!
|
| [+] E-mail Found: [email protected] 1x times
| [+] E-mail Found: [email protected] 1x times
blaaaaa.....blaaa....

| Check if PUT method is enabled:
| Checking for backup files:
| RFI tests:
Unmatched ) in regex; marked by <-- HERE in m/urlParts.path==baseUrlParts.path) <-- HERE return/ at Uniscan/Scan.pm line 785.

terus setelah ini mesti napain?

[ali3nd]

ijin nyobak kk

[cassaprodigy]

error 401 berarti file atau folder tersebut di set permissionnya tidak untuk public

check robot.txt.. uniscan memang gitu ,.., tapi lom tentu robot.txt ada di situs target