Metasploit for Web Applications is covered in the slides. Please refer to http://www.github.com/nipunjaswal for more

1. METASPLOIT and the
WEB…
By: Nipun Jaswal, Director of Cyber Security,
Lucrypt Limited UK

2. msf(about_me)>
 Author of Mastering Metasploit
 6+ Years of Experience
 Expertise: Wireless, Exploit Writing, Malware Dev
 Expertise: Radio Frequencies, Surveillance Products
 15+ Hall of Fames
 Director of Cyber Security, Lucrypt Ltd. UK
 Worked with Elite LEAs throughout the World
 More at: nipunjaswal.com, nipunjaswal.info

3. Do You Expect NETAPI Today? Ms_08_067?

4. Familiar With Metasploit?

5. Familiar With Metasploit?

6. Metasploit for Web
 SQL Injections
 Scanner
 Login Brute Forcers
 RCE Injection
 And Many More
 WMAP Integration
 In Built Support for Many CMS and Variety of HTTP Functions

7. Metasploit for Web Advantages
 Support Variety of Functions and In Built Modules for Web
 Can work over Large Ranges
 Integration to Report Database and Reporting Features
 Extensible Support and Wide Community of Developers
 Easy to Code

8. Heart of Metasploit: Its Library

9. Metasploit and HTTP
https://github.com/rapid7/metasploit-framework/blob/master/lib/rex/proto/http/client_request.rb

10. Let’s Write an Example Module to Check
Wordpress Version
.HTML

11. Tools of the Trade

12. Conventionally:
 1. Intercept the Request/Response
 2. Find out Version From Readme.html Page
 3. Print on Screen

13. Conventionally:

14. Conventionally:

15. The MSF Way:

16. The MSF Way:

17. The MSF Way:

18. The MSF Way Admin Check:

19. The MSF Way Admin Check:

20. The MSF Way Admin Check:

21. Exploiting SQL Injections with MSF

22. RCE Based Backdoor Using MSF

23. DEMOTwit:@nipunjaswal
FB: nipun.jaswal