metasploitable2 - This article is part of a series.

Part 3: This Article

Scan de vulnérabilités — Metasploitable 2
#

Document de référence pour le module pentest — phase scan de vulnérabilités.
Cible lab : 192.168.56.102 · Attaquant : Kali 192.168.56.10 (host-only).

Prérequis : Reconnaissance terminée (ports, versions, tableau de corrélation).
Suite : Exploitation — choisir 2–3 cibles prouvées par le scan, pas au hasard.

Reconnaissance → Scan vulns → Exploitation → Post-exploit → Findings → Rapport

RoE lab : scan uniquement sur 192.168.56.102 — pas de scan du réseau campus / Internet.

1. Recon vs scan de vulnérabilités
#

Phase	Question	Outils	Livrable
Recon	Qu’est-ce qui est exposé ? (ports, services, versions)	`nmap`, `enum4linux`, `snmpwalk`	Cartographie L2–L7
Scan vulns	Quelles faiblesses connues ? (CVE, plugins, misconfig)	OpenVAS, Nessus, `nmap --script vuln`	Liste priorisée pour exploit
Exploit	Puis-je en profiter ? (shell, compte)	Metasploit, PoC manuels	Preuve d’accès

Le scan ne remplace pas la recon : il enrichit le tableau recon avec des alertes corrélées (CVE, criticité, recommandation).

2. Outils — comparaison rapide
#

Outil	Intérêt lab	Inconvénient
OpenVAS / GVM	Gratuit, graphique	Scan long, parfois des faux positifs
Nmap NSE vuln	Rapide, reproductible en CLI	Moins exhaustif qu’un scanner dédié
searchsploit	Vérifier exploit public	Manuel, hors scan auto

Dans le cadre de cet exercice, tester les différentes méthodes et comparer les résultats.

3. Scan avec OpenVAS
#

3.1 Installation
#

Mettre à jour la distribution : sudo apt update && sudo apt upgrade -y

Installer l’application : sudo apt install gvm -y

┌──(kali㉿kali)-[~]
└─$ sudo apt install gvm -y
The following packages were automatically installed and are no longer required:
  enchant-2        libraw23t64          openjdk-21-jre
  libavc1394-0     libsdl2-classic      openjdk-21-jre-headless
  libgdal38        libsimdutf31         postgresql-common-dev
  libio-pty-perl   libsodium23          python3-pluginbase
  libipc-run-perl  libteamdctl0         python3-pysnmp4
  libmbedcrypto16  libunibreak6         python3-tz
  libpostal-data   libxmlsec1-1
  libpostal1       libxmlsec1-openssl1
Use 'sudo apt autoremove' to remove them.

Installing:
  gvm

Installing dependencies:
  greenbone-security-assistant  gsad  gvm-tools

Summary:
  Upgrading: 0, Installing: 4, Removing: 0, Not Upgrading: 61
  Download size: 2,482 kB
  Space needed: 15.9 MB / 61.3 GB available

Get:1 http://kali.download/kali kali-rolling/non-free amd64 greenbone-security-assistant all 26.17.0-0kali1 [2,176 kB]
Get:2 http://kali.download/kali kali-rolling/main amd64 gsad amd64 24.16.0-1 [141 kB]
Get:3 http://kali.download/kali kali-rolling/main amd64 gvm all 25.04.3 [12.1 kB]
Get:4 http://kali.download/kali kali-rolling/main amd64 gvm-tools all 25.4.6-1 [153 kB]
Fetched 2,482 kB in 1s (3,084 kB/s) 
Selecting previously unselected package greenbone-security-assistant.
(Reading database… 435237 files and directories currently installed.)
Preparing to unpack …/greenbone-security-assistant_26.17.0-0kali1_all.deb…
Unpacking greenbone-security-assistant (26.17.0-0kali1)…
Selecting previously unselected package gsad.
Preparing to unpack …/gsad_24.16.0-1_amd64.deb…
Unpacking gsad (24.16.0-1)…
Selecting previously unselected package gvm.
Preparing to unpack …/archives/gvm_25.04.3_all.deb…
Unpacking gvm (25.04.3)…
Selecting previously unselected package gvm-tools.
Preparing to unpack …/gvm-tools_25.4.6-1_all.deb…
Unpacking gvm-tools (25.4.6-1)…
Setting up greenbone-security-assistant (26.17.0-0kali1)…
Setting up gsad (24.16.0-1)…
gsad.service is a disabled or a static unit, not starting it.
Setting up gvm (25.04.3)…
Setting up gvm-tools (25.4.6-1)…
Processing triggers for man-db (2.13.1-1)…
Processing triggers for kali-menu (2026.2.6)…

Lancer la configuration : sudo gvm-setup

└─$ sudo gvm-setup
This script is provided and maintained by Debian and Kali.
 If you find any issue in this script, please report it directly to Debian or Kali

[>] Starting PostgreSQL service

[>] Creating GVM's certificate files

[>] Creating PostgreSQL database

[*] Creating database user

[*] Creating database

[*] Creating permissions
CREATE ROLE

[*] Applying permissions
GRANT ROLE

[*] Creating extension uuid-ossp
CREATE EXTENSION

[*] Creating extension pgcrypto
CREATE EXTENSION

[*] Creating extension pg-gvm
CREATE EXTENSION
[>] Migrating database
[>] Checking for GVM admin user
[*] Creating user admin for gvm
[*] Please note the generated admin password
[*] User created with password '7596e387-4d90-408a-aa5b-88eeaca1f5e4'.
[*] Configure Feed Import Owner
[*] Define Feed Import Owner
[*] Update GVM feeds
Running as root. Switching to user '_gvm' and group '_gvm'.
Trying to acquire lock on /var/lib/openvas/feed-update.lock
Acquired lock on /var/lib/openvas/feed-update.lock
⠼ Downloading Notus files from 
rsync://feed.community.greenbone.net/community/vulnerability-feed/24.10/vt-da
ta/notus/ to /var/lib/notus
⠼ Downloading NASL files from 
rsync://feed.community.greenbone.net/community/vulnerability-feed/24.10/vt-da
ta/nasl/ to /var/lib/openvas/plugins
Releasing lock on /var/lib/openvas/feed-update.lock

Trying to acquire lock on /var/lib/gvm/feed-update.lock
Acquired lock on /var/lib/gvm/feed-update.lock
⠴ Downloading SCAP data from 
rsync://feed.community.greenbone.net/community/vulnerability-feed/24.10/scap-
data/ to /var/lib/gvm/scap-data
⠏ Downloading CERT-Bund data from 
rsync://feed.community.greenbone.net/community/vulnerability-feed/24.10/cert-
data/ to /var/lib/gvm/cert-data
⠙ Downloading gvmd data from 
rsync://feed.community.greenbone.net/community/data-feed/24.10/ to 
/var/lib/gvm/data-objects/gvmd
Releasing lock on /var/lib/gvm/feed-update.lock

[*] Checking Default scanner
08b69003-5fc2-4037-a479-93b440211c73  OpenVAS  /run/ospd/ospd-openvas.sock  0  OpenVAS Default
[i] No need to alter default scanner

[+] Done
[*] Please note the password for the admin user
[*] User created with password '7596e387-4d90-408a-aa5b-88eeaca1f5e4'.

[>] You can now run gvm-check-setup to make sure everything is correctly configured
                               

Warning

Noter le mot de passe qui est aléatoirement généré dans les logs.

Lancer la vérification de l’installation : sudo gvm-check-setup

└─$ sudo gvm-check-setup
[sudo] password for kali: 
gvm-check-setup 25.04.0
 This script is provided and maintained by Debian and Kali.
  Test completeness and readiness of GVM-25.04.0
Step 1: Checking OpenVAS (Scanner)... 
        OK: OpenVAS Scanner is present in version 23.45.1.
        OK: Notus Scanner is present in version 22.7.2.
        OK: Server CA Certificate is present as /var/lib/gvm/CA/servercert.pem.
Checking permissions of /var/lib/openvas/gnupg/*
        OK: _gvm owns all files in /var/lib/openvas/gnupg
        OK: redis-server is present.
        OK: scanner (db_address setting) is configured properly using the redis-server socket: /var/run/redis-openvas/redis-server.sock
        OK: the mqtt_server_uri is defined in /etc/openvas/openvas.conf
        OK: _gvm owns all files in /var/lib/openvas/plugins
        OK: NVT collection in /var/lib/openvas/plugins contains 95089 NVTs.
        OK: The notus directory /var/lib/notus/products contains 517 NVTs.
Checking that the obsolete redis database has been removed
Could not connect to Redis at /var/run/redis-openvas/redis-server.sock: No such file or directory
        OK: No old Redis DB
        Starting ospd-openvas service
        Waiting for ospd-openvas service
        OK: ospd-openvas service is active.
        OK: ospd-OpenVAS is present in version 22.10.0.
Step 2: Checking GVMD Manager ... 
        OK: GVM Manager (gvmd) is present in version 26.24.0.
Step 3: Checking Certificates ... 
        OK: GVM client certificate is valid and present as /var/lib/gvm/CA/clientcert.pem.
        OK: Your GVM certificate infrastructure passed validation.
Step 4: Checking data ... 
        OK: SCAP data found in /var/lib/gvm/scap-data.
        OK: CERT data found in /var/lib/gvm/cert-data.
Step 5: Checking Postgresql DB and user ... 
        OK: Postgresql version and default port are OK.
 gvmd      | _gvm     | UTF8     | libc            | en_US.UTF-8 | en_US.UTF-8 |        |           | 
16437|pg-gvm|10|2200|f|22.6||
        OK: At least one user exists.
Step 6: Checking Greenbone Security Assistant (GSA) ... 

(gsad:93455): GLib-CRITICAL **: 11:10:18.461: g_file_get_contents: assertion 'filename != NULL' failed
        OK: Greenbone Security Assistant is present in version Deamon 24.16.0~git.
Step 7: Checking if GVM services are up and running ... 
        Starting gvmd service
        Waiting for gvmd service
        OK: gvmd service is active.
        Starting gsad service
        Waiting for gsad service
        OK: gsad service is active.
Step 8: Checking few other requirements...
        OK: nmap is present.
        OK: ssh-keygen found, LSC credential generation for GNU/Linux targets is likely to work.
        OK: nsis found, LSC credential package generation for Microsoft Windows targets is likely to work.
        OK: xsltproc found.
        WARNING: Your password policy is empty.
        SUGGEST: Edit the /etc/gvm/pwpolicy.conf file to set a password policy.
Step 9: Checking greenbone-security-assistant...
        OK: greenbone-security-assistant is installed

It seems like your GVM-25.04.0 installation is OK.

Si besoin, lancer manuellement le service: sudo gvm-start
Il est aussi possible, parfois de devoir relancer postgresql manuellement : sudo service postgresql start
Lancer la mise à jour manuelle des feeds : sudo greenbone-feed-sync

3.2 Lancement du premier scan
#

Se connecter à l’interface web

 URL : https://127.0.0.1:9392
 Username : admin
 Password : cf celui affiché dans les logs de gvm-setup

Écran de login OpenVAS — Écran de connexion OepnVas avec login et mot de passe

Configurer son premier scan
Il est possible de voir le message Failed to create a new task because the default Scan Config is not available [...], cela veut dire que la synchronisation est toujours en cours. Il faut simplement attendre.
Pour voir le statut de la mise à jour des feeds :

Une fois la synchronisation des feeds terminés, et le premier scan créé, lancer l’analyse

3.3 Analyse des résultats
#

L’analyse prend du temps. Lorsqu’elle se termine, consulter le rapport, puis lister les CVEs.

4. Scan avec Nmap
#

Utiliser Nmap NSE pour l’identification des vulnérabilités nmap -script vuln

─$ sudo nmap -script vuln 172.16.211.128
Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-09 17:15 -0400
Nmap scan report for 172.16.211.128
Host is up (0.0017s latency).
Not shown: 977 closed tcp ports (reset)
PORT     STATE SERVICE
21/tcp   open  ftp
| ftp-vsftpd-backdoor: 
|   VULNERABLE:
|   vsFTPd version 2.3.4 backdoor
|     State: VULNERABLE (Exploitable)
|     IDs:  BID:48539  CVE:CVE-2011-2523
|       vsFTPd version 2.3.4 backdoor, this was reported on 2011-07-04.
|     Disclosure date: 2011-07-03
|     Exploit results:
|       Shell command: id
|       Results: uid=0(root) gid=0(root)
|     References:
|       http://scarybeastsecurity.blogspot.com/2011/07/alert-vsftpd-download-backdoored.html
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2523
|       https://www.securityfocus.com/bid/48539
|_      https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/ftp/vsftpd_234_backdoor.rb
22/tcp   open  ssh
23/tcp   open  telnet
25/tcp   open  smtp
| ssl-poodle: 
|   VULNERABLE:
|   SSL POODLE information leak
|     State: VULNERABLE
|     IDs:  BID:70574  CVE:CVE-2014-3566
|           The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other
|           products, uses nondeterministic CBC padding, which makes it easier
|           for man-in-the-middle attackers to obtain cleartext data via a
|           padding-oracle attack, aka the "POODLE" issue.
|     Disclosure date: 2014-10-14
|     Check results:
|       TLS_RSA_WITH_AES_128_CBC_SHA
|     References:
|       https://www.securityfocus.com/bid/70574
|       https://www.imperialviolet.org/2014/10/14/poodle.html
|       https://www.openssl.org/~bodo/ssl-poodle.pdf
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566
|_sslv2-drown: ERROR: Script execution failed (use -d to debug)
| ssl-dh-params: 
|   VULNERABLE:
|   Anonymous Diffie-Hellman Key Exchange MitM Vulnerability
|     State: VULNERABLE
|       Transport Layer Security (TLS) services that use anonymous
|       Diffie-Hellman key exchange only provide protection against passive
|       eavesdropping, and are vulnerable to active man-in-the-middle attacks
|       which could completely compromise the confidentiality and integrity
|       of any data exchanged over the resulting session.
|     Check results:
|       ANONYMOUS DH GROUP 1
|             Cipher Suite: TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA
|             Modulus Type: Safe prime
|             Modulus Source: Unknown/Custom-generated
|             Modulus Length: 512
|             Generator Length: 8
|             Public Key Length: 512
|     References:
|       https://www.ietf.org/rfc/rfc2246.txt
|   
|   Transport Layer Security (TLS) Protocol DHE_EXPORT Ciphers Downgrade MitM (Logjam)
|     State: VULNERABLE
|     IDs:  BID:74733  CVE:CVE-2015-4000
|       The Transport Layer Security (TLS) protocol contains a flaw that is
|       triggered when handling Diffie-Hellman key exchanges defined with
|       the DHE_EXPORT cipher. This may allow a man-in-the-middle attacker
|       to downgrade the security of a TLS session to 512-bit export-grade
|       cryptography, which is significantly weaker, allowing the attacker
|       to more easily break the encryption and monitor or tamper with
|       the encrypted stream.
|     Disclosure date: 2015-5-19
|     Check results:
|       EXPORT-GRADE DH GROUP 1
|             Cipher Suite: TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA
|             Modulus Type: Safe prime
|             Modulus Source: Unknown/Custom-generated
|             Modulus Length: 512
|             Generator Length: 8
|             Public Key Length: 512
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000
|       https://www.securityfocus.com/bid/74733
|       https://weakdh.org
|   
|   Diffie-Hellman Key Exchange Insufficient Group Strength
|     State: VULNERABLE
|       Transport Layer Security (TLS) services that use Diffie-Hellman groups
|       of insufficient strength, especially those using one of a few commonly
|       shared groups, may be susceptible to passive eavesdropping attacks.
|     Check results:
|       WEAK DH GROUP 1
|             Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
|             Modulus Type: Safe prime
|             Modulus Source: postfix builtin
|             Modulus Length: 1024
|             Generator Length: 8
|             Public Key Length: 1024
|     References:
|_      https://weakdh.org
| smtp-vuln-cve2010-4344: 
|_  The SMTP server is not Exim: NOT VULNERABLE
53/tcp   open  domain
80/tcp   open  http
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-trace: TRACE is enabled
|_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)
|_http-dombased-xss: Couldn't find any DOM based XSS.
| http-sql-injection: 
|   Possible sqli for queries:
|     http://172.16.211.128:80/dav/?C=N%3BO%3DD%27%20OR%20sqlspider
|     http://172.16.211.128:80/dav/?C=S%3BO%3DA%27%20OR%20sqlspider
|     http://172.16.211.128:80/dav/?C=M%3BO%3DA%27%20OR%20sqlspider
|     http://172.16.211.128:80/dav/?C=D%3BO%3DA%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=change-log.htm%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=installation.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=home.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=user-poll.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=documentation%2Fvulnerabilities.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=credits.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=browser-info.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=php-errors.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=show-log.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=register.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=show-log.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=notes.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=documentation%2Fhow-to-access-Mutillidae-over-Virtual-Box-network.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=usage-instructions.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=framing.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=set-background-color.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=captured-data.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=login.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=credits.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=user-info.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?username=anonymous&page=password-generator.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=capture-data.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=user-info.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=source-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=pen-test-tool-lookup.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=login.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=arbitrary-file-inclusion.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=secret-administrative-pages.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=source-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?do=toggle-security%27%20OR%20sqlspider&page=home.php
|     http://172.16.211.128:80/mutillidae/index.php?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?do=toggle-hints%27%20OR%20sqlspider&page=home.php
|     http://172.16.211.128:80/mutillidae/index.php?page=site-footer-xss-discussion.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=html5-storage.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=dns-lookup.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/dav/?C=S%3BO%3DA%27%20OR%20sqlspider
|     http://172.16.211.128:80/dav/?C=M%3BO%3DA%27%20OR%20sqlspider
|     http://172.16.211.128:80/dav/?C=N%3BO%3DA%27%20OR%20sqlspider
|     http://172.16.211.128:80/dav/?C=D%3BO%3DA%27%20OR%20sqlspider
|     http://172.16.211.128:80/dav/?C=S%3BO%3DD%27%20OR%20sqlspider
|     http://172.16.211.128:80/dav/?C=M%3BO%3DA%27%20OR%20sqlspider
|     http://172.16.211.128:80/dav/?C=N%3BO%3DA%27%20OR%20sqlspider
|     http://172.16.211.128:80/dav/?C=D%3BO%3DA%27%20OR%20sqlspider
|     http://172.16.211.128:80/dav/?C=M%3BO%3DD%27%20OR%20sqlspider
|     http://172.16.211.128:80/dav/?C=S%3BO%3DA%27%20OR%20sqlspider
|     http://172.16.211.128:80/dav/?C=D%3BO%3DA%27%20OR%20sqlspider
|     http://172.16.211.128:80/dav/?C=N%3BO%3DA%27%20OR%20sqlspider
|     http://172.16.211.128:80/dav/?C=D%3BO%3DD%27%20OR%20sqlspider
|     http://172.16.211.128:80/dav/?C=S%3BO%3DA%27%20OR%20sqlspider
|     http://172.16.211.128:80/dav/?C=M%3BO%3DA%27%20OR%20sqlspider
|     http://172.16.211.128:80/dav/?C=N%3BO%3DA%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=change-log.htm%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=installation.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?do=toggle-security%27%20OR%20sqlspider&page=change-log.htm
|     http://172.16.211.128:80/mutillidae/index.php?page=home.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=user-poll.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=documentation%2Fvulnerabilities.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=credits.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=browser-info.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=show-log.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=register.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=show-log.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=documentation%2Fhow-to-access-Mutillidae-over-Virtual-Box-network.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=set-background-color.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=framing.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=captured-data.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=login.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=capture-data.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=user-info.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?username=anonymous&page=password-generator.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=credits.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=user-info.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=login.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=pen-test-tool-lookup.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=source-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=arbitrary-file-inclusion.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=secret-administrative-pages.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=source-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?do=toggle-hints%27%20OR%20sqlspider&page=change-log.htm
|     http://172.16.211.128:80/mutillidae/index.php?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=site-footer-xss-discussion.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=html5-storage.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=dns-lookup.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=change-log.htm%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=installation.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=home.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=user-poll.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=documentation%2Fvulnerabilities.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=credits.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=browser-info.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=show-log.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=register.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=show-log.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=documentation%2Fhow-to-access-Mutillidae-over-Virtual-Box-network.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=framing.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=set-background-color.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=captured-data.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=login.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=user-info.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?username=anonymous&page=password-generator.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=credits.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=secret-administrative-pages.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=user-info.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=login.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=pen-test-tool-lookup.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=source-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=arbitrary-file-inclusion.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=source-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=capture-data.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=site-footer-xss-discussion.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=html5-storage.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=dns-lookup.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=change-log.htm%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=installation.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=home.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=user-poll.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=documentation%2Fvulnerabilities.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=credits.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=browser-info.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=php-errors.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=show-log.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=register.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=show-log.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=notes.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=documentation%2Fhow-to-access-Mutillidae-over-Virtual-Box-network.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=usage-instructions.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=framing.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=set-background-color.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=captured-data.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=login.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=credits.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=user-info.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?username=anonymous&page=password-generator.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=capture-data.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=user-info.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=source-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=pen-test-tool-lookup.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=login.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=arbitrary-file-inclusion.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=secret-administrative-pages.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=source-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?do=toggle-security%27%20OR%20sqlspider&page=home.php
|     http://172.16.211.128:80/mutillidae/index.php?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?do=toggle-hints%27%20OR%20sqlspider&page=home.php
|     http://172.16.211.128:80/mutillidae/index.php?page=site-footer-xss-discussion.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=html5-storage.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=dns-lookup.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=change-log.htm%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=installation.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=home.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=user-poll.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=documentation%2Fvulnerabilities.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=credits.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=browser-info.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=show-log.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=register.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=show-log.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=documentation%2Fhow-to-access-Mutillidae-over-Virtual-Box-network.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=framing.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=set-background-color.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=captured-data.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=login.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=credits.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=user-info.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?username=anonymous&page=password-generator.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=capture-data.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=user-info.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=source-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=pen-test-tool-lookup.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=login.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=arbitrary-file-inclusion.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=secret-administrative-pages.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=source-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=site-footer-xss-discussion.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=html5-storage.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=dns-lookup.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=change-log.htm%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=installation.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=home.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=user-poll.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=documentation%2Fvulnerabilities.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=credits.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=browser-info.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=show-log.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=register.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=show-log.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=documentation%2Fhow-to-access-Mutillidae-over-Virtual-Box-network.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=set-background-color.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=captured-data.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=login.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=framing.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=user-info.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?username=anonymous&page=password-generator.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=credits.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=user-info.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=login.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=pen-test-tool-lookup.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=source-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=arbitrary-file-inclusion.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=secret-administrative-pages.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=source-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=site-footer-xss-discussion.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=html5-storage.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=capture-data.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=dns-lookup.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=change-log.htm%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=installation.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=home.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=user-poll.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=documentation%2Fvulnerabilities.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=credits.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?forwardurl=https%3A%2F%2Faddons.mozilla.org%2Fen-US%2Ffirefox%2Fcollections%2Fjdruin%2Fpr%2F&page=redirectandlog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=browser-info.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?forwardurl=http%3A%2F%2Fwww.irongeek.com%2F&page=redirectandlog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?forwardurl=http%3A%2F%2Fwww.pocodoy.com%2Fblog%2F&page=redirectandlog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?forwardurl=http%3A%2F%2Fwww.owasp.org&page=redirectandlog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=show-log.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?forwardurl=http%3A%2F%2Fwww.issa-kentuckiana.org%2F&page=redirectandlog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?forwardurl=http%3A%2F%2Fwww.room362.com%2F&page=redirectandlog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?forwardurl=http%3A%2F%2Fpauldotcom.com%2F&page=redirectandlog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=register.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?forwardurl=http%3A%2F%2Fwww.isd-podcast.com%2F&page=redirectandlog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=show-log.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?forwardurl=http%3A%2F%2Fwww.php.net%2F&page=redirectandlog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=documentation%2Fhow-to-access-Mutillidae-over-Virtual-Box-network.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?forwardurl=http%3A%2F%2Fwww.owasp.org%2Findex.php%2FLouisville&page=redirectandlog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=framing.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=set-background-color.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=source-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=captured-data.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=login.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=credits.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=user-info.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?username=anonymous&page=password-generator.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=capture-data.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=user-info.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=source-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=pen-test-tool-lookup.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=arbitrary-file-inclusion.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=secret-administrative-pages.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=site-footer-xss-discussion.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=login.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=html5-storage.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=dns-lookup.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=change-log.htm%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=installation.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=home.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=user-poll.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=documentation%2Fvulnerabilities.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=credits.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=browser-info.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=show-log.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=register.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=show-log.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=documentation%2Fhow-to-access-Mutillidae-over-Virtual-Box-network.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=set-background-color.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=framing.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=captured-data.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=login.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=user-info.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?username=anonymous&page=password-generator.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=credits.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=user-info.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=login.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=pen-test-tool-lookup.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=source-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=arbitrary-file-inclusion.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=secret-administrative-pages.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=source-viewer.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=site-footer-xss-discussion.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=capture-data.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=html5-storage.php%27%20OR%20sqlspider
|     http://172.16.211.128:80/mutillidae/index.php?page=dns-lookup.php%27%20OR%20sqlspider
|   Possible sqli for forms:
|     Form at path: /mutillidae/index.php, form's action: index.php. Fields that might be vulnerable:
|       choice
|       choice
|       choice
|       choice
|       choice
|       choice
|       choice
|       choice
|       choice
|       choice
|       choice
|       choice
|_      initials
| http-csrf: 
| Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=172.16.211.128
|   Found the following possible CSRF vulnerabilities: 
|     
|     Path: http://172.16.211.128:80/dvwa/
|     Form id: 
|     Form action: login.php
|     
|     Path: http://172.16.211.128:80/mutillidae/index.php?page=user-poll.php
|     Form id: idpollform
|_    Form action: index.php
| http-slowloris-check: 
|   VULNERABLE:
|   Slowloris DOS attack
|     State: LIKELY VULNERABLE
|     IDs:  CVE:CVE-2007-6750
|       Slowloris tries to keep many connections to the target web server open and hold
|       them open as long as possible.  It accomplishes this by opening connections to
|       the target web server and sending a partial request. By doing so, it starves
|       the http server's resources causing Denial Of Service.
|       
|     Disclosure date: 2009-09-17
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
|_      http://ha.ckers.org/slowloris/
| http-enum: 
|   /tikiwiki/: Tikiwiki
|   /test/: Test page
|   /phpinfo.php: Possible information file
|   /phpMyAdmin/: phpMyAdmin
|   /doc/: Potentially interesting directory w/ listing on 'apache/2.2.8 (ubuntu) dav/2'
|   /icons/: Potentially interesting folder w/ directory listing
|_  /index/: Potentially interesting folder
111/tcp  open  rpcbind
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
512/tcp  open  exec
513/tcp  open  login
514/tcp  open  shell
1099/tcp open  rmiregistry
| rmi-vuln-classloader: 
|   VULNERABLE:
|   RMI registry default configuration remote code execution vulnerability
|     State: VULNERABLE
|       Default configuration of RMI registry allows loading classes from remote URLs which can lead to remote code execution.
|       
|     References:
|_      https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/java_rmi_server.rb
1524/tcp open  ingreslock
2049/tcp open  nfs
2121/tcp open  ccproxy-ftp
3306/tcp open  mysql
|_ssl-ccs-injection: No reply from server (TIMEOUT)
5432/tcp open  postgresql
| ssl-ccs-injection: 
|   VULNERABLE:
|   SSL/TLS MITM vulnerability (CCS Injection)
|     State: VULNERABLE
|     Risk factor: High
|       OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h
|       does not properly restrict processing of ChangeCipherSpec messages,
|       which allows man-in-the-middle attackers to trigger use of a zero
|       length master key in certain OpenSSL-to-OpenSSL communications, and
|       consequently hijack sessions or obtain sensitive information, via
|       a crafted TLS handshake, aka the "CCS Injection" vulnerability.
|           
|     References:
|       http://www.cvedetails.com/cve/2014-0224
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224
|_      http://www.openssl.org/news/secadv_20140605.txt
| ssl-dh-params: 
|   VULNERABLE:
|   Diffie-Hellman Key Exchange Insufficient Group Strength
|     State: VULNERABLE
|       Transport Layer Security (TLS) services that use Diffie-Hellman groups
|       of insufficient strength, especially those using one of a few commonly
|       shared groups, may be susceptible to passive eavesdropping attacks.
|     Check results:
|       WEAK DH GROUP 1
|             Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
|             Modulus Type: Safe prime
|             Modulus Source: Unknown/Custom-generated
|             Modulus Length: 1024
|             Generator Length: 8
|             Public Key Length: 1024
|     References:
|_      https://weakdh.org
| ssl-poodle: 
|   VULNERABLE:
|   SSL POODLE information leak
|     State: VULNERABLE
|     IDs:  BID:70574  CVE:CVE-2014-3566
|           The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other
|           products, uses nondeterministic CBC padding, which makes it easier
|           for man-in-the-middle attackers to obtain cleartext data via a
|           padding-oracle attack, aka the "POODLE" issue.
|     Disclosure date: 2014-10-14
|     Check results:
|       TLS_RSA_WITH_AES_128_CBC_SHA
|     References:
|       https://www.securityfocus.com/bid/70574
|       https://www.imperialviolet.org/2014/10/14/poodle.html
|       https://www.openssl.org/~bodo/ssl-poodle.pdf
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566
5900/tcp open  vnc
6000/tcp open  X11
6667/tcp open  irc
|_irc-unrealircd-backdoor: Looks like trojaned version of unrealircd. See http://seclists.org/fulldisclosure/2010/Jun/277
8009/tcp open  ajp13
8180/tcp open  unknown
| http-cookie-flags: 
|   /admin/: 
|     JSESSIONID: 
|       httponly flag not set
|   /admin/index.html: 
|     JSESSIONID: 
|       httponly flag not set
|   /admin/login.html: 
|     JSESSIONID: 
|       httponly flag not set
|   /admin/admin.html: 
|     JSESSIONID: 
|       httponly flag not set
|   /admin/account.html: 
|     JSESSIONID: 
|       httponly flag not set
|   /admin/admin_login.html: 
|     JSESSIONID: 
|       httponly flag not set
|   /admin/home.html: 
|     JSESSIONID: 
|       httponly flag not set
|   /admin/admin-login.html: 
|     JSESSIONID: 
|       httponly flag not set
|   /admin/adminLogin.html: 
|     JSESSIONID: 
|       httponly flag not set
|   /admin/controlpanel.html: 
|     JSESSIONID: 
|       httponly flag not set
|   /admin/cp.html: 
|     JSESSIONID: 
|       httponly flag not set
|   /admin/index.jsp: 
|     JSESSIONID: 
|       httponly flag not set
|   /admin/login.jsp: 
|     JSESSIONID: 
|       httponly flag not set
|   /admin/admin.jsp: 
|     JSESSIONID: 
|       httponly flag not set
|   /admin/home.jsp: 
|     JSESSIONID: 
|       httponly flag not set
|   /admin/controlpanel.jsp: 
|     JSESSIONID: 
|       httponly flag not set
|   /admin/admin-login.jsp: 
|     JSESSIONID: 
|       httponly flag not set
|   /admin/cp.jsp: 
|     JSESSIONID: 
|       httponly flag not set
|   /admin/account.jsp: 
|     JSESSIONID: 
|       httponly flag not set
|   /admin/admin_login.jsp: 
|     JSESSIONID: 
|       httponly flag not set
|   /admin/adminLogin.jsp: 
|     JSESSIONID: 
|       httponly flag not set
|   /admin/view/javascript/fckeditor/editor/filemanager/connectors/test.html: 
|     JSESSIONID: 
|       httponly flag not set
|   /admin/includes/FCKeditor/editor/filemanager/upload/test.html: 
|     JSESSIONID: 
|       httponly flag not set
|   /admin/jscript/upload.html: 
|     JSESSIONID: 
|_      httponly flag not set
| http-slowloris-check: 
|   VULNERABLE:
|   Slowloris DOS attack
|     State: LIKELY VULNERABLE
|     IDs:  CVE:CVE-2007-6750
|       Slowloris tries to keep many connections to the target web server open and hold
|       them open as long as possible.  It accomplishes this by opening connections to
|       the target web server and sending a partial request. By doing so, it starves
|       the http server's resources causing Denial Of Service.
|       
|     Disclosure date: 2009-09-17
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
|_      http://ha.ckers.org/slowloris/
| http-enum: 
|   /admin/: Possible admin folder
|   /admin/index.html: Possible admin folder
|   /admin/login.html: Possible admin folder
|   /admin/admin.html: Possible admin folder
|   /admin/account.html: Possible admin folder
|   /admin/admin_login.html: Possible admin folder
|   /admin/home.html: Possible admin folder
|   /admin/admin-login.html: Possible admin folder
|   /admin/adminLogin.html: Possible admin folder
|   /admin/controlpanel.html: Possible admin folder
|   /admin/cp.html: Possible admin folder
|   /admin/index.jsp: Possible admin folder
|   /admin/login.jsp: Possible admin folder
|   /admin/admin.jsp: Possible admin folder
|   /admin/home.jsp: Possible admin folder
|   /admin/controlpanel.jsp: Possible admin folder
|   /admin/admin-login.jsp: Possible admin folder
|   /admin/cp.jsp: Possible admin folder
|   /admin/account.jsp: Possible admin folder
|   /admin/admin_login.jsp: Possible admin folder
|   /admin/adminLogin.jsp: Possible admin folder
|   /manager/html/upload: Apache Tomcat (401 Unauthorized)
|   /manager/html: Apache Tomcat (401 Unauthorized)
|   /admin/view/javascript/fckeditor/editor/filemanager/connectors/test.html: OpenCart/FCKeditor File upload
|   /admin/includes/FCKeditor/editor/filemanager/upload/test.html: ASP Simple Blog / FCKeditor File Upload
|   /admin/jscript/upload.html: Lizard Cart/Remote File upload
|_  /webdav/: Potentially interesting folder
MAC Address: 00:0C:29:DE:C8:07 (VMware)

Host script results:
|_smb-vuln-regsvc-dos: ERROR: Script execution failed (use -d to debug)
|_smb-vuln-ms10-061: false
|_smb-vuln-ms10-054: false

Nmap done: 1 IP address (1 host up) scanned in 322.45 seconds

Info

Extraire les lignes VULNERABLE: ou CVE- pour alimenter le tableau de priorités.

5. Recherche manuelle hors-ligne avec Searchsploit
#

Searchsploit permet de faire une recherche

soit par version de logiciel searchsploit --title

┌──(kali㉿kali)-[~]
└─$ searchsploit --title vsftpd 2.3.4
------------------------------------------- ---------------------------------
 Exploit Title                             |  Path
------------------------------------------- ---------------------------------
vsftpd 2.3.4 - Backdoor Command Execution  | unix/remote/17491.rb
vsftpd 2.3.4 - Backdoor Command Execution  | unix/remote/49757.py
------------------------------------------- ---------------------------------

soit par CVE searchsploit --cve

┌──(kali㉿kali)-[~]
└─$ searchsploit --cve CVE-2011-2523
------------------------------------------- ---------------------------------
 Exploit Title                             |  Path
------------------------------------------- ---------------------------------
vsftpd 2.3.4 - Backdoor Command Execution  | unix/remote/17491.rb
vsftpd 2.3.4 - Backdoor Command Execution  | unix/remote/49757.py
------------------------------------------- ---------------------------------
Shellcodes: No Results

6. Recherche en ligne sur exploitdb
#

Il est possible de consulter les différentes vulnérabilités et exploits correspondants sur https://www.exploit-db.com/

7. Tableau de priorités (modèle livrable)
#

Avant de passer à la phase d’exploitation :

Récapituler les éléments identifiés dans un tableau.

Prio	Service	Port	Alerte scan (CVE / plugin)	Confirmé recon ?	Exploit MSF / piste	Justification
P1	vsFTPd	21	CVE-2011-2523	Oui `2.3.4`	`vsftpd_234_backdoor`	RCE facile, démo
P1	Samba	445	CVE-2007-2447	Oui	`usermap_script`	RCE, souvent root
P1	distcc	3632	CVE-2004-2687	Oui	`distcc_exec`	RCE root
P2	Telnet	23	Weak / default creds	Oui	`msfadmin`	Accès compte
P2	MySQL	3306	Weak password	Oui	`mysql_login`	Accès BDD
P3	HTTP / PHP	80	CGI / anciennes apps	Variable	`php_cgi_arg_injection`	Vérifier version

Joindre le rapport OpenVAS
Joindre le résultat du scan nmap

8. Suite de la démarche
#

Phase actuelle : Scan de vulnérabilités — alertes OpenVAS/Nmap et tableau de priorités consolidé.

[✓] Mise en place  →  [✓] Reconnaissance  →  [✓] Scan vulns  →  [●] Exploitation  →  [ ] Post-exploit  →  [ ] Findings  →  [ ] Rapport

Étape suivante : Exploitation — obtenir 2 à 3 footholds documentés sur MS2.

metasploitable2 - This article is part of a series.

Part 3: This Article

Scan de vulnérabilités — Metasploitable 2#

1. Recon vs scan de vulnérabilités#

2. Outils — comparaison rapide#

3. Scan avec OpenVAS#

3.1 Installation#

3.2 Lancement du premier scan#

3.3 Analyse des résultats#

4. Scan avec Nmap#

5. Recherche manuelle hors-ligne avec Searchsploit#

6. Recherche en ligne sur exploitdb#

7. Tableau de priorités (modèle livrable)#

8. Suite de la démarche#

Scan de vulnérabilités — Metasploitable 2
#

1. Recon vs scan de vulnérabilités
#

2. Outils — comparaison rapide
#

3. Scan avec OpenVAS
#

3.1 Installation
#

3.2 Lancement du premier scan
#

3.3 Analyse des résultats
#

4. Scan avec Nmap
#

5. Recherche manuelle hors-ligne avec Searchsploit
#

6. Recherche en ligne sur exploitdb
#

7. Tableau de priorités (modèle livrable)
#

8. Suite de la démarche
#