itsec.siers.ch

This is a quasi-update to my old blogpost Fun with Fiori

I recently discovered a tool call EyeWitness by Christopher Truncer.
Most of you will already know it, but for those who don't, let me give you a short introduction:

EyeWitness lets you take screenshots from web pages, RDP Login Screens and VNC Servers that don't use passwords.
The tool can use lists of URLs that you create yourself and that you generated with other tools like nmap or nessus.
After the scan EyeWitness will generate a report that contains information about the page/service and a screenshot.
All in all it's way better and faster then the method I used in my Fiori blogpost.

Installation

To install EyeWitness on Kali, you have to clone the repo with the command

git clone https://github.com/ChrisTruncer/EyeWitness.git

then cd into the EyeWitness directory and run the setup script

cd EyeWitness
./setup/setup.sh

Now you should be able to start EyeWitness with the command ./EyeWitness.py

In my case I had to install phantomjs manually, as it was not found by EyeWitness after the setup.
When I tried to take screenshots with the option --headless I got the error "Error: You are missing your phantomjs binary!"

To get EyeWitness to run properly, I downloaded phantomjs manually

wget https://bitbucket.org/ariya/phantomjs/downloads/phantomjs-2.1.1-linux-i686.tar.bz2

and unpacked it

tar -xvf phantomjs-2.1.1-linux-i686.tar.bz2

then I copied the binary to the EyeWitness binary directory

cp phantomjs-2.1.1-linux-x86_64/bin/phantomjs /EyeWitness/bin

After that, change into the EyeWitness directory and run it.

./EyeWitness.py -f url.txt --headless

-f specifies the file with urls that you are using
--headless lets you run EyeWitness without a desktop-environment.

################################################################################
# EyeWitness #
################################################################################

Starting Web Requests (3 Hosts)
Attempting to screenshot https://SECRETURL.ch
Attempting to screenshot https://what.SECRETURL.ch
Attempting to screenshot https://mega.SECRFETURL.ch
Finished in 6.76950407028 seconds

[*] Done! Report written in the /EyeWitness/03092017_112728 folder!
Would you like to open the report now? [Y/n] n

In the directory you will find the html-Report as report.html, as well as the necessary files for the report:

ew.db
jquery-1.11.3.min.js
screens style.css
ghostdriver.log
report.html
source

Now that you have the report, you can open it in a browser.


A little side note:
I'm running kali as a docker container, so I was looking for a way to export the report from the container to my docker-server.
This can be done by exporting it with the following docker-command from the docker-server:

docker cp CONTAINER-ID:/PATH/FILE /TARGETDIRECTORY

in my case it was

docker cp kaliremote:/EyeWitness/03092017_112728 /transfer