0X00 配置数据库

在使用wmap之前要创建一个数据库用于存放扫描数据，这个可以在启动metasploit之前进行配置，命令如下：

root@kali:~# service postgresql start  //开启postgresql数据库
root@kali:~# msfdb init                //初始化msf数据库
Creating database user 'msf'
为新角色输入的口令:
再输入一遍:
Creating databases 'msf' and 'msf_test'
Creating configuration file in /usr/share/metasploit-framework/config/database.yml
Creating initial database schema
root@kali:~# msfdb start              //启用刚才创建的数据库

0X01 启用msf、加载wmap插件

root@kali:~# msfconsole .,,.                  ..\$$$$$L..,,==aaccaacc%#s$b.       d8,    d8Pd8P        #$$$$$$$$$$$$$$$$$$$$$$$$$$$b.    `BP  d888888pd888888P      '7$$$$\""""''^^`` .7$$$|D*"'```         ?88'd8bd8b.d8p d8888b ?88' d888b8b            _.os#$|8*"`   d8P       ?8b  88P88P`?P'?P d8b_,dP 88P d8P' ?88       .oaS###S*"`       d8P d8888b $whi?88b 88bd88  d8 ?8 88b     88b 88b  ,88b .osS$$$$*" ?88,.d88b, d88 d8P' ?88 88P `?8b
d88' d88b 8b`?8888P'`?8b`?88P'.aS$$$$Q*"`    `?88'  ?88 ?88 88b  d88 d88.a#$$$$$$"`          88b  d8P  88b`?8888P',s$$$$$$$"`             888888P'   88n      _.,,,ass;:.a$$$$$$$P`               d88P'    .,.ass%#S$$$$$$$$$$$$$$'.a$###$$$P`           _.,,-aqsc#SS$$$$$$$$$$$$$$$$$$$$$$$$$$',a$$###$$P`  _.,-ass#S$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$####SSSS'.a$$$$$$$$$$SSS$$$$$$$$$$$$$$$$$$$$$$$$$$$$SS##==--""''^^/$$$$$$'
_______________________________________________________________   ,&$$$$$$'_____ll&&$$$$'.;;lll&&&&'...;;lllll&'......;;;llll;;;....` ......;;;;... .  .Frustrated with proxy pivoting? Upgrade to layer-2 VPN pivoting with
Metasploit Pro -- learn more on http://rapid7.com/metasploit=[ metasploit v4.12.20-dev                         ]
+ -- --=[ 1573 exploits - 906 auxiliary - 270 post        ]
+ -- --=[ 455 payloads - 39 encoders - 8 nops             ]
+ -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]msf > load wmap .-.-.-..-.-.-..---..---.
| | | || | | || | || |-'
`-----'`-'-'-'`-^-'`-'
[WMAP 1.5.1] ===  et [  ] metasploit.com 2012
[*] Successfully loaded plugin: wmap

0X02 查看wmap帮助

msf > helpwmap Commands
=============Command       Description-------       -----------wmap_modules  Manage wmap modules    wmap_nodes    Manage nodes           wmap_run      Test targets            wmap_sites    Manage siteswmap_targets  Manage targetswmap_vulns    Display web vulns

0X03 wmap进行web扫描的步骤

msf > wmap_sites -a http://192.168.0.22        //添加站点，这里可以说ip地址或者url，url会解析成ip地址
[*] Site created.
msf > wmap_sites -l                            //查看站点
[*] Available sites
===============Id  Host            Vhost           Port  Proto  # Pages  # Forms--  ----            -----           ----  -----  -------  -------0   192.168.0.22  192.168.0.22  80    http   0        0
msf > wmap_targets -t http://192.168.0.22      //添加扫描目标msf > wmap_run -t                              //加载扫描模块，默认加载所有扫描模块
[*] Testing target:
[*]     Site: 192.168.0.22 (192.168.0.22)
[*]     Port: 80 SSL: false
============================================================
[*] Testing started. 2016-08-28 14:42:01 +0800
[*] Loading wmap modules...
[*] 40 wmap enabled modules loaded.
[*]
=[ SSL testing ]=
============================================================
[*] Target is not SSL. SSL modules disabled.
[*]
=[ Web Server testing ]=
============================================================
[*] Module auxiliary/scanner/http/http_version
[*] Module auxiliary/scanner/http/open_proxy
[*] Module auxiliary/admin/http/tomcat_administration
[*] Module auxiliary/admin/http/tomcat_utf8_traversal
[*] Module auxiliary/scanner/http/drupal_views_user_enum
[*] Module auxiliary/scanner/http/frontpage_login
[*] Module auxiliary/scanner/http/host_header_injection
[*] Module auxiliary/scanner/http/options
[*] Module auxiliary/scanner/http/robots_txt
[*] Module auxiliary/scanner/http/scraper
[*] Module auxiliary/scanner/http/svn_scanner
[*] Module auxiliary/scanner/http/trace
[*] Module auxiliary/scanner/http/vhost_scanner
[*] Module auxiliary/scanner/http/webdav_internal_ip
[*] Module auxiliary/scanner/http/webdav_scanner
[*] Module auxiliary/scanner/http/webdav_website_content
[*]
=[ File/Dir testing ]=
============================================================
[*] Module auxiliary/dos/http/apache_range_dos
[*] Module auxiliary/scanner/http/backup_file
[*] Module auxiliary/scanner/http/brute_dirs
[*] Module auxiliary/scanner/http/copy_of_file
[*] Module auxiliary/scanner/http/dir_listing
[*] Module auxiliary/scanner/http/dir_scanner
[*] Module auxiliary/scanner/http/dir_webdav_unicode_bypass
[*] Module auxiliary/scanner/http/file_same_name_dir
[*] Module auxiliary/scanner/http/files_dir
[*] Module auxiliary/scanner/http/http_put
[*] Module auxiliary/scanner/http/ms09_020_webdav_unicode_bypass
[*] Module auxiliary/scanner/http/prev_dir_same_name_file
[*] Module auxiliary/scanner/http/replace_ext
[*] Module auxiliary/scanner/http/soap_xml
[*] Module auxiliary/scanner/http/trace_axd
[*] Module auxiliary/scanner/http/verb_auth_bypass
[*]
=[ Unique Query testing ]=
============================================================
[*] Module auxiliary/scanner/http/blind_sql_query
[*] Module auxiliary/scanner/http/error_sql_injection
[*] Module auxiliary/scanner/http/http_traversal
[*] Module auxiliary/scanner/http/rails_mass_assignment
[*] Module exploit/multi/http/lcms_php_exec
[*]
=[ Query testing ]=
============================================================
[*]
=[ General testing ]=
============================================================
msf > wmap_run -e                            //开始进行漏洞扫描，不过这扫描速度堪忧。。
[*] Using ALL wmap enabled modules.
[-] NO WMAP NODES DEFINED. Executing local modules
[*] Testing target:
[*]     Site: 192.168.0.22 (192.168.0.22)
[*]     Port: 80 SSL: false
============================================================
[*] Testing started. 2016-08-28 14:43:28 +0800//扫描完成之后msf > vulns  //查看所有漏洞详情，写博文的时候还没扫完，就没把测试站点的漏洞贴出来

其实这东西没啥用，扫描速度这么慢。。。不如其他的一些扫描器好用。。