Using Recon-ng to find Website vulnerability

Recon-ng is a reconnaissance / OSINT tool with an interface similar to Metasploit 1 and 2. Running recon-ng from the command line speeds up the recon process as it automates gathering information from open sources. Recon-ng has a variety of options to configure, perform recon, and output results to different report types.Recon-ng can be used to look for error based SQL injections. Recon-ng can be used to find sensitive files such as robots. txt. Recon-ng can be used to find information about Geo-IP lookup, Banner grabbing, DNS lookup, port scanning, sub-domain information, reverse IP using WHOIS lookup and many more.

What is fun about Recon-ng is to that:

Recon-ng is a complete package of Information gathering tools.

Recon-ng can be used to find IP Addresses of target.

Recon-ng can be used to look for error based SQL injections.

Recon-ng can be used to find sensitive files such as robots.txt.

Recon-ng can be used to find information about Geo-IP lookup, Banner grabbing, DNS lookup, port scanning, sub-domain information, reverse IP using WHOIS lookup .

Recon-ng can be used to detects Content Management Systems (CMS) in use of a target web application, InfoSploit can be used for WHOIS data collection, Geo-IP lookup, Banner grabbing, DNS lookup, port scanning, sub-domain information, reverse IP, and MX records lookup

Recon-ng is a complete package (TOOL) for information gathering. This tool is free and Open Source.

Recon-ng subdomain finder modules is used to find subdomains of a singer domain.

Recon-ng can be used to find robots.txt file of a website.

Recon-ng port scanner modules find closes and open ports which can be used to maintain access to the server.

Recon-ng has various modules that can be used to get the information about target.

Let's get started using Recon-ng

But before we start, we need to be familiar with Recon-ng. So it is time.

Step 1

Getting familiar with Recon-ng

Let us fire up Kali Linux by typing:


~/recon-ng $ ./recon-ng

Now we see the result:


~/recon-ng $ ./recon-ng
_/_/_/    _/_/_/_/    _/_/_/    _/_/_/    _/      _/            _/      _/    _/_/_/
   _/    _/  _/        _/        _/      _/  _/_/    _/            _/_/    _/  _/
  _/_/_/    _/_/_/    _/        _/      _/  _/  _/  _/  _/_/_/_/  _/  _/  _/  _/  _/_/_/
 _/    _/  _/        _/        _/      _/  _/    _/_/            _/    _/_/  _/      _/
_/    _/  _/_/_/_/    _/_/_/    _/_/_/    _/      _/            _/      _/    _/_/_/


                                          /\
                                         / \\ /\
    Sponsored by...               /\  /\/  \\V  \/\
                                 / \\/ // \\\\\ \\ \/\
                                // // BLACK HILLS \/ \\
                               www.blackhillsinfosec.com

                  ____   ____   ____   ____ _____ _  ____   ____  ____
                 |____] | ___/ |____| |       |   | |____  |____ |
                 |      |   \_ |    | |____   |   |  ____| |____ |____
                                   www.practisec.com

                      [recon-ng v5.1.2, Tim Tomes (@lanmaster53)]

[3] Recon modules
[1] Reporting modules
[1] Exploitation modules

Simply modules are like libraries which perform specific tasks. For instance, a module in Recon-ng can be responsible for checking XSS vulnerability in a website. It like in app development where they are lib folders that contains different library for different task.

Now, let's get the help menu by typing:


[recon-ng][default] > help

Commands (type [help|?] <topic>):
---------------------------------
back            Exits the current context
dashboard       Displays a summary of activity
db              Interfaces with the workspace's database
exit            Exits the framework
help            Displays this menu
index           Creates a module index (dev only)
keys            Manages third party resource credentials
marketplace     Interfaces with the module marketplace
modules         Interfaces with installed modules
options         Manages the current context options
pdb             Starts a Python Debugger session (dev only)
script          Records and executes command scripts
shell           Executes shell commands
show            Shows various framework items
snapshots       Manages workspace snapshots
spool           Spools output to a file
workspaces      Manages workspaces

Now let us create a workspace called demo


[recon-ng][default] > workspaces create demo
[recon-ng][demo] >

So now we're a little used to Recon-NG, let's get to the hacking!

Step 2

Install and configure Recon-NG

Now you've probably be wondering why I use Github in most of my pages. There are many reasons, but some are:

It's used for storing, tracking, and collaborating on software projects, It makes it easy for developers to share code files and collaborate with fellow developers on open-source projects,It is 100% safe, and It is a contribution of idea of code from people all over the world rather than just a single organisation.

Clone Recon-NG by typing:


 ~ $ git clone https://github.com/lanmaster53/recon-ng.git
 
Cloning into 'recon-ng'...
remote: Enumerating objects: 9522, done.

remote: Counting objects: 100% (19/19), done.

remote: Compressing objects: 100% (16/16), done.

Receiving objects:   5% (477/9522), 108.01 KiB | 192.0Receiving objects:   6% (572/9522), 108.01 KiB | 192.0Receiving objects:   7% 
(667/9522), 108.01 KiB | 192.0Receiving objects:   8% (762/9522), 108.01 KiB | 192.0Receiving objects:   9% (857/9522), 108.01 KiB | 192.0Receiving objects:  10% (953/9522), 108.01 KiB | 192.0Receiving objects:  11% (1048/9522), 108.01 KiB | 192.Receiving objects:  11% (1062/9522), 108.01 KiB | 192.cdReceiving objects:  11% (1142/9522), 612.01 KiB | 29 Receiving objects:  12% (1143/9522), 612.01 KiB | 292Receiving objects:  13% (1238/9522), 612.01 KiB | 292.Receiving objects:  14% (1334/9522), 612.01 KiB | 292.Receiving objects:  15% (1429/9522), 612.01 KiB | 292.Receiving objects:  16% (1524/9522), 612.01 KiB | 292.Receiving objects:  17% (1619/9522), 612.01 KiB | 292.Receiving objects:  18% (1714/9522), 836.01 KiB | 320.Receiving objects:  19% (1810/9522), 836.01 KiB | 320.Receiving objects:  20% (1905/9522), 836.01 KiB | 320.Receiving objects:  21% (2000/9522), 836.01 KiB | 320.Receiving objects:  22% (2095/9522), 836.01 KiB | 320.Receiving objects:  23% (2191/9522), 836.01 KiB | 320.Receiving objects:  24% (2286/9522), 836.01 KiB | 320.Receiving objects:  24% (2315/9522), 836.01 KiB | 320.Receiving objects:  25% (2381/9522), 1.06 MiB | 349.00Receiving objects:  26% (2476/9522), 1.06 MiB | 349.00Receiving objects:  27% (2571/9522), 1.30 MiB | 368.00Receiving objects:  28% (2667/9522), 1.30 MiB | 368.00Receiving objects:  29% (2762/9522), 1.30 MiB | 368.00Receiving objects:  30% (2857/9522), 1.30 MiB | 368.00Receiving objects:  31% (2952/9522), 1.30 MiB | 368.00Receiving objects:  32% (3048/9522), 1.30 MiB | 368.00Receiving objects:  33% (3143/9522), 1.30 MiB | 368.00Receiving objects:  34% (3238/9522), 1.30 MiB | 368.00Receiving objects:  35% (3333/9522), 1.30 MiB | 368.00Receiving objects:  35% (3402/9522), 1.30 MiB | 368.00Receiving objects:  36% (3428/9522), 1.30 MiB | 368.00Receiving objects:  37% (3524/9522), 1.30 MiB | 368.00Receiving objects:  38% (3619/9522), 1.30 MiB | 368.00Receiving objects:  39% (3714/9522), 1.30 MiB | 368.00Receiving objects:  40% (3809/9522), 1.30 MiB | 368.00Receiving objects:  41% (3905/9522), 1.30 MiB | 368.00Receiving objects:  42% (4000/9522), 1.30 MiB | 368.00Receiving objects:  43% (4095/9522), 1.30 MiB | 368.00Receiving objects:  44% (4190/9522), 1.30 MiB | 368.00Receiving objects:  45% (4285/9522), 1.62 MiB | 401.00Receiving objects:  46% (4381/9522), 1.62 MiB | 401.00Receiving objects:  47% (4476/9522), 1.62 MiB | 401.00Receiving objects:  48% (4571/9522), 1.62 MiB | 401.00Receiving objects:  49% (4666/9522), 1.62 MiB | 401.00Receiving objects:  50% (4761/9522), 1.62 MiB | 401.00Receiving objects:  51% (4857/9522), 1.62 MiB | 401.00Receiving objects:  52% (4952/9522), 1.62 MiB | 401.00Receiving objects:  53% (5047/9522), 1.62 MiB | 401.00Receiving objects:  54% (5142/9522), 1.62 MiB | 401.00Receiving objects:  55% (5238/9522), 1.62 MiB | 401.00Receiving objects:  56% (5333/9522), 1.62 MiB | 401.00Receiving objects:  57% (5428/9522), 1.62 MiB | 401.00Receiving objects:  58% (5523/9522), 1.62 MiB | 401.00Receiving objects:  59% (5618/9522), 1.62 MiB | 401.00Receiving objects:  60% (5714/9522), 1.62 MiB | 401.00Receiving objects:  61% (5809/9522), 1.62 MiB | 401.00Receiving objects:  62% (5904/9522), 1.62 MiB | 401.00Receiving objects:  63% (5999/9522), 1.62 MiB | 401.00Receiving objects:  64% (6095/9522), 1.62 MiB | 401.00Receiving objects:  65% (6190/9522), 1.62 MiB | 401.00Receiving objects:  66% (6285/9522), 1.62 MiB | 401.00Receiving objects:  67% (6380/9522), 1.62 MiB | 401.00Receiving objects:  68% (6475/9522), 1.62 MiB | 401.00Receiving objects:  69% (6571/9522), 1.62 MiB | 401.00Receiving objects:  70% (6666/9522), 1.97 MiB | 435.00Receiving objects:  71% (6761/9522), 1.97 MiB | 435.00Receiving objects:  72% (6856/9522), 1.97 MiB | 435.00Receiving objects:  73% (6952/9522), 1.97 MiB | 435.00Receiving objects:  74% (7047/9522), 1.97 MiB | 435.00Receiving objects:  75% (7142/9522), 1.97 MiB | 435.00Receiving objects:  76% (7237/9522), 1.97 MiB | 435.00Receiving objects:  77% (7332/9522), 1.97 MiB | 435.00Receiving objects:  78% (7428/9522), 1.97 MiB | 435.00Receiving objects:  79% (7523/9522), 1.97 MiB | 435.00Receiving objects:  80% (7618/9522), 1.97 MiB | 435.00Receiving objects:  81% (7713/9522), 1.97 MiB | 435.00Receiving objects:  82% (7809/9522), 1.97 MiB | 435.00Receiving objects:  83% (7904/9522), 1.97 MiB | 435.00Receiving objects:  84% (7999/9522), 1.97 MiB | 435.00Receiving objects:  85% (8094/9522), 1.97 MiB | 435.00Receiving objects:  86% (8189/9522), 1.97 MiB | 435.00Receiving objects:  87% (8285/9522), 1.97 MiB | 435.00Receiving objects:  88% (8380/9522), 1.97 MiB | 435.00Receiving objects:  89% (8475/9522), 1.97 MiB | 435.00Receiving objects:  90% (8570/9522), 1.97 MiB | 435.00Receiving objects:  90% (8576/9522), 1.97 MiB | 435.00Receiving objects:  91% (8666/9522), 2.34 MiB | 496.00Receiving objects:  92% (8761/9522), 2.34 MiB | 496.00Receiving objects:  93% (8856/9522), 2.34 MiB | 496.00Receiving objects:  94% (8951/9522), 2.34 MiB | 496.00Receiving objects:  95% (9046/9522), 2.78 MiB | 559.00Receiving objects:  96% (9142/9522), 2.78 MiB | 559.00Receiving objects:  97% (9237/9522), 2.78 MiB | 559.00Receiving objects:  98% (9332/9522), 2.78 MiB | 559.00Receiving objects:  99% (9427/9522), 2.78 MiB | 559.00remote: Total 9522 (delta 3), reused 14 (delta 3), pack-reused 9503
Receiving objects: 100% (9522/9522), 2.78 MiB | 559.00Receiving objects: 100% (9522/9522), 3.06 MiB | 529.00 KiB/s, done.
Resolving deltas: 100% (4958/4958), done.

We have installed the resposity, we are going to install the python required tools in the REQUIREMENTS file. Type:


~/recon-ng $ pip install REQUIREMENTS

And we see all sorts of tools being installed.

And most importantly, we need some sort of things called keys. Keys are like id for particular modules. Like assume your Facebook id or phone number. This can be a lot of stress but let us use a module that does not require a key. Let's usethe module recon/domains-vulnerabilities/xssed. Install by typing:


~/recon-ng $ ./recon-ng
[recon-ng][demo] > marketplace install recon/domains-vulnerabilities/xssed
[*] Module installed: recon/domains-vulnerabilities/xssed
[*] Reloading modules...
[recon-ng][demo] >

Step 3

Find that vulnerability

This is the final and last step. This is where we're going to find the vulnerability of the webpage.

We're going to use the module recon/domains-vulnerabilities/xssed because it doesn&apios;t require any special keys or dependency. Our two target to test will be Google and GigoCyberSpace. This set of commands will load our demo workspace, load our recon module and test Google and GIGOCYBERSPACE. This are the commands:


[recon-ng][default] > workspaces
Manages workspaces

Usage: workspaces <create|list|load|remove> [...]

[recon-ng][default] > workspaces list

  +----------------------------------+
  | Workspaces |       Modified      |
  +----------------------------------+
  | default    | 2023-01-25 16:36:40 |
  | demo       | 2023-01-22 05:04:30 |
  | loophole   | 2023-01-10 08:10:42 |
  +----------------------------------+

[recon-ng][default] > workspaces load demo
[recon-ng][demo] > modules load recon/domains-vulnerabilities/xssed
[recon-ng][demo][xssed] > options set SOURCE google.com
SOURCE => google.com
[recon-ng][demo][xssed] > run                              
----------
GOOGLE.COM
----------
[*] Category: Redirect
[*] Example: https://accounts.google.com/o/oauth2/auth?redirect_uri=http://www.something.com
[*] Host: accounts.google.com
[*] Notes: None
[*] Publish_Date: 2012-01-13 00:00:00
[*] Reference: http://xssed.com/mirror/75532/
[*] Status: unfixed
[*] --------------------------------------------------
[*] Category: Redirect
[*] Example: http://books.google.com/search?btnI&q=http://www.yahoo.com
[*] Host: books.google.com
[*] Notes: None
[*] Publish_Date: 2011-12-21 00:00:00
[*] Reference: http://xssed.com/mirror/71083/
[*] Status: unfixed
[*] --------------------------------------------------
[*] Category: Redirect
[*] Example: http://www.google.com/search?btnI&q=allinurl:http://www.xssed.com/
[*] Host: www.google.com
[*] Notes: None
[*] Publish_Date: 2010-10-15 00:00:00
[*] Reference: http://xssed.com/mirror/67132/
[*] Status: unfixed
[*] --------------------------------------------------
[*] Category: XSS
[*] Example: http://www.google.com/search?source=ig&rlz=&q=WTF?&undefined=cr&um=1&ie=UTF-8&tbo=1&tbs=%22%3E%3Cscr
ipt%3Ealert%28document.cookie%29%3C%2fscript%3E&sa=N&tab=wb
[*] Host: www.google.com
[*] Notes: None
[*] Publish_Date: 2010-05-18 00:00:00
[*] Reference: http://xssed.com/mirror/66724/
[*] Status: fixed
[*] --------------------------------------------------
[*] Category: XSS
[*] Example: https://www.google.com/support/bin/answer.py?%22%3E%3C/script%3E%3Cscript%3Ealert(%22BlackHacker[dot
]Coder[at]Gmail[dot]com%22)%3C/script%3E=00000&hl=tr
[*] Host: www.google.com
[*] Notes: None
[*] Publish_Date: 2009-05-06 00:00:00
[*] Reference: http://xssed.com/mirror/60278/
[*] Status: fixed
[*] --------------------------------------------------
[*] Category: XSS
[*] Example: http://knol.google.com/k/knol/system/knol/pages/SearchToolkit?show=off&q=%3E%3Cscript%3Ealert(/xss/)
%3C/script%3E&qexact=&qor1=%3E%3Cscript%3Ealert(/xss%20by%20azat/)%3C/script%3E&qor2=%3E%3Cscript%3E
alert(/xss%20by%20azat/)%3C/script%3E&qor3=&qneg=&doctype=0&loc0=on&loc1=on&loc3=on&loc4=on&loc5=on&
loc7=on&restrict=3&url=%3E%3Cscript%3Ealert(/xss/)%3C/script%3E&editdate=0&createdate=0&language=0&l
icense=0&collab=0&link=%3E%3Cscript%3Ealert(/xss/)%3C/script%3E&templateUrl=%3E%3Cscript%3Ealert(/xs
s/)%3C/script%3E&promo=&sort=0&num=10
[*] Host: knol.google.com
[*] Notes: None
[*] Publish_Date: 2009-05-06 00:00:00
[*] Reference: http://xssed.com/mirror/60339/
[*] Status: fixed
[*] --------------------------------------------------
[*] Category: XSS
[*] Example: http://books.google.com/books?q=%22%3B%3E%3C%2Fnoscript%3E%3Cscript%3Ealert(%27test%27)%3B%3C%2Fscri
pt%3E&btnG=Kitaplar%C4%B1+Ara&hl=tr
[*] Host: books.google.com
[*] Notes: None
[*] Publish_Date: 2009-05-06 00:00:00
[*] Reference: http://xssed.com/mirror/59699/
[*] Status: fixed
[*] --------------------------------------------------
[*] Category: XSS
[*] Example: http://groups.google.com/groups/dir?sel=usenet%3D%3C/noscript%3E%3Cscript%3Ealert(%27HacKSever%27)%3
C/script%3E
[*] Host: groups.google.com
[*] Notes: None
[*] Publish_Date: 2009-04-16 00:00:00
[*] Reference: http://xssed.com/mirror/59598/
[*] Status: fixed
[*] --------------------------------------------------
[*] Category: XSS
[*] Example: https://www.google.com/accounts/ServiceLoginAuth?service=jotspot&continue=http%3A%2F%2Fsites.google.
com%2F%3Fhl%3Dfr&service=jotspot&ul=1&ul=1&sulf=1&UniversalLoginEmail=%22%27%2F%3E%3Cscript%3Ealert(
%27Xssed%20by%20Pierre%20Gardenat%27)%3C%2Fscript%3E&uls=Valider
[*] Host: www.google.com
[*] Notes: None
[*] Publish_Date: 2009-01-30 00:00:00
[*] Reference: http://xssed.com/mirror/57587/
[*] Status: fixed
[*] --------------------------------------------------
[*] Category: Redirect
[*] Example: http://www.google.com/ig/redir?url=http://uber0n.darkillusion.org/xsspage.htm
[*] Host: www.google.com
[*] Notes: None
[*] Publish_Date: 2009-01-30 00:00:00
[*] Reference: http://xssed.com/mirror/41767/
[*] Status: fixed
[*] --------------------------------------------------
[*] Category: XSS
[*] Example: https://www.google.com/accounts/ServiceLogin?service=websiteoptimizer&hl=e'%22%3E%3C/title%3E%3Cscri
pt%3Ealert(1337)%3C/script%3E%3E%3Cmarquee%3E%3Ch1%3EXSS%20by%20Xylitol%3C/h1%3E%3C/marquee%3En&cont
inue=https%3A%2F%2Fwww.google.com%2Fanalytics%2Fsiteopt%2F%3Fet%3Dreset%26hl%3Den&utm_source=service
s&utm_medium=redirect&utm_campaign=standalone
[*] Host: www.google.com
[*] Notes: None
[*] Publish_Date: 2008-11-12 00:00:00
[*] Reference: http://xssed.com/mirror/54247/
[*] Status: fixed
[*] --------------------------------------------------
[*] Category: XSS
[*] Example: http://suggestqueries.google.com/complete/search?qu=%3Cb%3E%3C/b%3E
[*] Host: suggestqueries.google.com
[*] Notes: None
[*] Publish_Date: 2008-07-23 00:00:00
[*] Reference: http://xssed.com/mirror/45680/
[*] Status: fixed
[*] --------------------------------------------------
[*] Category: Redirect
[*] Example: http://www.google.com/search?btnI&q=site:http://www.xssed.com/
[*] Host: www.google.com
[*] Notes: None
[*] Publish_Date: 2008-07-12 00:00:00
[*] Reference: http://xssed.com/mirror/42495/
[*] Status: fixed
[*] --------------------------------------------------
[*] Category: Script Insertion
[*] Example: http://groups.google.com/groups/abuse?group=titlescriptalertdocumentcookiescript&type=file&url=XSSED
&_done=%2Fgroup%2Ftitlescriptalertdocumentcookiescript%2Ffiles%3F&
[*] Host: groups.google.com
[*] Notes: None
[*] Publish_Date: 2008-04-27 00:00:00
[*] Reference: http://xssed.com/mirror/36747/
[*] Status: fixed
[*] --------------------------------------------------
[*] Category: XSS
[*] Example: https://www.google.com/adsense/preview?snippet=%3Cscript%20type%3D%22text%2Fjavascript%22%3Ealert(do
cument.cookie);%20%3C%2Fscript%3E
[*] Host: www.google.com
[*] Notes: None
[*] Publish_Date: 2008-04-23 00:00:00
[*] Reference: http://xssed.com/mirror/36391/
[*] Status: fixed
[*] --------------------------------------------------
[*] Category: XSS
[*] Example: http://www.google.com/s2/ui/photopicker.PhotoPicker?done=%22%3E&js=RAW&pop=TRUE&dn=%22%3E&profileMod
e=1&userId=%22%3Exss&urlEnabled=1&extraUploadParams=out%3D%22%3E%3CIMG%20%22%22%22%3E%3CSCRIPT%3Eale
rt(%22mox%22)%3C/SCRIPT%3E%22%3E&suppressHide=1
[*] Host: www.google.com
[*] Notes: None
[*] Publish_Date: 2008-04-23 00:00:00
[*] Reference: http://xssed.com/mirror/35547/
[*] Status: fixed
[*] --------------------------------------------------
[*] Category: Frame Redirect
[*] Example: http://images.google.com/imgres?imgurl=Redirect_By_RedTuning&imgrefurl=http://elredtuning.altervista
.org&h=0&w=0&sz=0&tbnid=o78WRIXSFwEmKM:&tbnh=0&tbnw=0&prev=&start=1&ei=5WruR7f6OIv6-QKR8KgW&sig2=HHg
kU9dTcoljTKv_6Uo-Sg&sa=X&oi=images&ct=image&cd=1
[*] Host: images.google.com
[*] Notes: None
[*] Publish_Date: 2008-03-31 00:00:00
[*] Reference: http://xssed.com/mirror/34714/
[*] Status: unfixed
[*] --------------------------------------------------
[*] Category: Redirect
[*] Example: http://www.google.com/gwt/n?u=http://www.xssed.com
[*] Host: www.google.com
[*] Notes: None
[*] Publish_Date: 2008-03-07 00:00:00
[*] Reference: http://xssed.com/mirror/33416/
[*] Status: unfixed
[*] --------------------------------------------------
[*] Category: XSS
[*] Example: http://finance.google.com/finance/portfolio?action=add&hash=0bdb25b244bb4501
[*] Host: finance.google.com
[*] Notes: None
[*] Publish_Date: 2007-12-03 00:00:00
[*] Reference: http://xssed.com/mirror/27391/
[*] Status: fixed
[*] --------------------------------------------------

-------
SUMMARY
-------
[*] 19 total (19 new) vulnerabilities found.
[recon-ng][demo][xssed] > options set SOURCE gigocyberspace.com
SOURCE => gigocyberspace.com
[recon-ng][demo][xssed] > run

------------------
GIGOCYBERSPACE.COM
------------------
[*] No vulnerabilites found.
[recon-ng][demo][xssed] >

And we find our GigoCyberSpace is not with any XSS vulnerability (Wow).

This have been a very nice post. See you next time!

GigoCyberSpace

Light / Dark

Collections

series

More

How To

Use Recon-ng to Find Website Vulnerability