buenas tardes compañeros me pueden ayudar con este caso estoy aprendiendo cada dia mas xD bueno esto es lo que quiero
ingresar a un router cisco y esta es la info que tengo hasta ahora:
Nikto v2.1.6
+ Target IP: 2-x-x-x-x-x-
+ Target Hostname: xxx-xx-xxx-x
+ Target Port: 80
+ Start Time: 2016-05-26 08:56:08 (GMT-4.5)
+ Server: Virata-EmWeb/R6_0_1
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ Root page / redirects to: http://xxx-xxx-xx-x/redirect.html
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Virata-EmWeb/R6 0 appears to be outdated (current is at least R6_2_1)
+ Public HTTP Methods: HEAD, GET, POST, PUT, DELETE, OPTIONS
+ OSVDB-397: HTTP method ('Public' Header): 'PUT' method could allow clients to save files on the web server.
+ OSVDB-5646: HTTP method ('Public' Header): 'DELETE' may allow clients to remove files on the web server.
+ ERROR: Error limit (20) reached for host, giving up. Last error:
+ Scan terminated: 6 error(s) and 7 item(s) reported on remote host
+ End Time: 2016-05-26 09:05:36 (GMT-4.5) (568 seconds)
y de nmap esto
PORT STATE SERVICE
22/tcp open ssh NetScreen sshd (protocol 2.0)
23/tcp open telnet Netscreen ScreenOS telnetd
80/tcp open http Virata-EmWeb 6.0.1
443/tcp open https microsoft-ds
Device type: specialized|VoIP phone|webcam|broadband router|printer|WAP
Running: CipherLab embedded, Cisco embedded, D-Link embedded, Efficient Networks embedded, Hioki embedded, Panasonic embedded, Symbol embedded
OS CPE: cpe:/h:cisco:unified_ip_phone_7941 cpe:/h:efficientnetworks:speedstream_4100 cpe:/h:panasonic:db-3510 cpe:/h:panasonic:db-3520 cpe:/h:panasonic:kx-hcm270 cpe:/h:spectrum24_4131
Too many fingerprints match this host to give specific OS details
Service Info: Device: firewall
mi pregunta es que posivilidades tengo de ingresar al router o como busco mas vulneravilidades o que pued hacer no solcito que me digan paso a paso solo un aporte para seguir investigando
CitarPORT STATE SERVICE
22/tcp open ssh NetScreen sshd (protocol 2.0)
23/tcp open telnet Netscreen ScreenOS telnetd
80/tcp open http Virata-EmWeb 6.0.1
443/tcp open https microsoft-ds
El fingerprint de Nmap arroja demasiadas coincidencias, pero si nos fijamos en el escaneo de los puertos y los servicios que corre podemos ver que tanto por SSH (puerto 22) y telnet (puerto 23) el servicio corriendo es NetScreen sshd & NetScreenOS y con una ligera busqueda en Google te daras cuenta que es un sistema operativo propiedad de
Juniper Si seguimos buscando eventualmente nos encontraremos con alguna vulnerabilidad, una como esta:
https://community.rapid7.com/community/infosec/blog/2015/12/20/cve-2015-7755-juniper-screenos-authentication-backdoor (https://community.rapid7.com/community/infosec/blog/2015/12/20/cve-2015-7755-juniper-screenos-authentication-backdoor)
Saludos.