Vanguard

The end-user is liable for his-or her own actions with the use of this software. Running this against a system you do not own without written authorization is a criminal act.

Description

Vanguard is a comprehensive web pen testing tool that identifies vulnerabilities in web applications.

Features

Main application features:

• Fully Configurable
• WebCrawlers crawl all open HTTP and HTTPS ports output from nmap
• LibWhisker2 For HTTP IDS Evasion (Same options as nikto)
• Tests via GET,POST, and COOKIE

Web penetration tests:

• SQL injection (This test is signature free!)
• LDAP Injection
• XSS
• File inclusion
• Command Injection

Usage

 perl scan.pl -h [hostname] -e [evasion option]

Installation

Application Dependencies

You must have nmap from http://nmap.org installed to run this application correctly.

Notice: You must run this application as root.

Protip: You can undo the root requirement by removing the check for root and modifying the nmap configuration.

Configuration

Main Configuration

This is the configuration in config.yml.

---
rewrite: 0
use_whitelist: 1
module_whitelist:
  - WEBAPPS
  - SHELL
  - NMAP
  - CRAWL
  - XSS_GET
  - SQL_GET
  - LFI_GET
  - RCI_GET

WebCrawler

This configuration is located in /modules/recon/CRAWL/conf.yml

---
depth: 20

Nmap Module

---
flags: "-P0 --defeat-rst-ratelimit -sSV -F"

Protip: The S in -sSV is the reason this scan requires root.

Local File Inclusion

You can find this blah

---
lfi_test: '%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd'
lfi_match: "root\:.\:0\:0"
lfi_exits:
  - '%00'
  -

LDAP

--- ldap_true:

 - ")(&"
 - ")(&)("

ldap_false:

 - ")(|"
 - ")(|)("

RFI

--- rfi_test: http://asdf.com/ rfi_match: 89asdf.gi

Command Injection

---
entries:
  - '|'
  - ';'
  - '&&'

SQL injection

You can find these configuration files & options in modules/test/SQL_GET/conf.yml and modules/test/SQL_POST/conf.yml.

This file defines several variables for automated SQL injection testing. --- sql_spacers: - '%20' - '+' sql_entries: - "" - '%27' - '%bf%27' sql_exits: - -- - /* - )-- - )/*

Other Tools

• Lfi_autopwn.pl
• GScrape
• MySql 5 Enumeration

See Also

• Web Exploitation