Scan Website for Vulnerabilities with Uniscan

Uniscan is a vulnerability scanner that can scan websites aulnerability Assessment > Web Application Assessment > Web Vulnerability Scanner > uniscannd web applications for various security issues like LFI, RFI, sql injection, xss etc. Its written in perl. Its open source and can be downloaded from sourceforge project page at http://sourceforge.net/projects/uniscan/

It is included in Kali Linux, Parrot and BackTrack and can be found at the following directory

/pentest/web/uniscan

In the Backtrack menu its located But
On Parrot and Kali Linux run it directly from terminal by issuing the command 'uniscan'.

In this post we shall learn how to use this tool to scan websites. Usage is quite simple. Run the script uniscan.pl to see the options and examples

Basic scanning



The usage section shows examples on using it. To scan a website, use the first example from the usage section.

root@Exploded:~# uniscan -u http://www.example.com/ -qweds
The above example scans a single url. With the f option multiple sites can be put under the scanner. The list has to be provided as a txt file.

Fingerprinting

With the option 'j' uniscan would fingerprint the server of the url. Server fingerprinting simply runs commands like ping, traceroute, nslookup, nmap on the server ip address and packs the results together.

root@Exploded:~# uniscan -u http://www.example.com -j
Another option is 'g' which does web based fingerprinting. It looks up specific urls.

root@Exploded:~# uniscan -u http://www.example.com -g
Searching google and bing
Apart from scanning websites, uniscan has another cool feature of performing google and bing searches and collecting the results in a simple text file. The i option can be used for searching bing and o operator for google. To search bing for all domains hosted on a given ip address issue the following command

root@Exploded:~# uniscan -i "ip:xxx.xxx.xxx.xxx"
Replace the x with the ip. The results are saved in a file called sites.txt which can be found at '/usr/share/uniscan'. They should ideally be saved in the home directory of the user or the working directory.

To search google using a term

root@Exploded:~# uniscan -o 'inurl:"section.php?id="'
However google will block too many automated search queries. So use the tool carefully.

Share :

Tweet

✚

Related Post