hey guys today we're going to learn how
to scan websites for vulnerabilities
using a tool called vega
on this episode of cyberweapons lab
[Music]
so vega is a great tool if you are a pen
tester or a website administrator or if
you're just creating your own website
it allows you to do a very thorough scan
that'll identify a bunch of potential
problems or
potential of attack vectors for a
specific website
it'll give you alerts on things like
where you could potentially inject a sql
code or
the potential for cross-site scripting
or even minor things like hey
we identified that these numbers might
be social security numbers that you have
exposed in plain text somewhere
so it's extremely detailed and it also
has a graphical user interface that
breaks down
everything according to how much risk
it's considered to have um so yeah it's
a very useful tool
now in order to install vega i believe
it comes pre-installed on most versions
of cali
except for the most recent version of
cali so um since i have ubuntu we're
gonna be gonna be going through the
installation process step by step anyway
so in order to do this all you're going
to need is a computer running linux
and also if you want to check out more
about this topic
in more detail go ahead and check out
the article link in the description
and without further ado let's get
started okay so if you have a version of
kali linux
with vega pre-installed it's going to be
under the applications menu
and then under that it's going to be
under the web analysis submenu
if you don't have kali linux or you have
a version where it is not pre-installed
in order to install it we're first going
to have to install some
dependency packages so we're going to
need to install three packages
the first one is libweb kit
gtk 1.0 the second one is the default
java development kit the default jdk
and then the last one is
unzip all right i already have all those
installed
so that was pretty fast for me once you
have all of those installed
next we need to go to the vega website
to find where to download
um vega so it's at this url subgraph.com
download
go ahead and go to download and then i'm
going to
copy this link right here the linux gtk
64-bit
i'm gonna go back now i'm going to i
like to keep everything organized so i'm
going to
navigate into my repositories folder
let's go ahead and clear the screen um
and then i'm just going to go
c wget and then paste that
link i'm going to download the zip file
once the zip file is downloaded we just
need to use that unzip package we just
installed
to let's see what the name is
unzip vega there we go
oh i already have vega installed so
let's just um replace it
install all right cool all right
now we should have vega installed we can
see we have a
vega folder let's go ahead and go into
that
and then we in order to run it all we
have to do is run
this script right here so sudo dot slash
there you go all right and now it starts
opening up for us it's nice graphical
interface
all right so oh i do want to mention one
thing if you try to run vega like that
and you get
a uh let me cancel it and you get an
error or something
i got something that said illegal
reflective access operation
and when you run vega an error message
just popped up if that happens to you
make sure you're running the right
version of java so
you can use this command sudo update
alternatives and then
tact config java and then
i'm running number two so you want to
run java 8 and you want to run it in
manual mode
originally i had it in one of these
first two options and it didn't work so
if you get an error do this and go ahead
and select a version of java 8 that's in
manual mode
so number two and then let's run vega
again
all right so this is the opening screen
to vega
it's pretty simple now first we what you
can do to configure it
we can go to preferences if you want to
run this through a proxy
you can enable socks pro socks proxy
through here i these are the default
forum through tor
so port 9050 and 12701
i'm not going to be using a tor proxy
right now because that would take the
scan much longer
i'm just going to go ahead and go to
that and then inside of scanner
maximum number of requests per second to
send now this is originally
set to 25 by default this can sometimes
be too much for a website and it'll
block you out because
it thinks it might be getting a ddos
attack or it just suspects there's an
unusual amount of traffic from your ip
address
so i set mine to five and i didn't have
any problems
so of course if you own the website you
should be able to do it as high as you
want without
so long as you're not running into any
hardware issues all right so i'm going
to set it to five
and then let's do a new scan let's go
ahead and do null bytes website
um null hyphen byte.wonderhowto.com
all right next let's just select all the
default options so i think
mostly everything is selected except for
a few uh integer
inter well integer overflow might be
interesting um blind sql injection
timing sql ejection
possibilities cross-site scripting oh i
don't think x-frame is particularly
important
oh yeah let's see if it might detect any
social security numbers
yeah all right next don't need to worry
about
any of this or specific cookies and
there's no
extra excluded parameters that we want
to include
so let's click finish
all right so the scan is going to take a
while see we already have a few
things that it's found just one
cross-type scripting vulnerability
let's wait for a good chunk of the scan
to complete before we go over some of
the results
so we ran this the vega scan for about
20 minutes
and we were only able to do about one
percent of the full website scan
so since our scan rate was so low at
five requests per second and since
millbyte is a fairly large website with
lots of articles and such
it was going to take maybe somewhere
around eight hours for us to do the full
scan
so keep that in mind if you're setting
the scan rate
to something really low like i am it's
going to take a long time and if the
website's very large it's also going to
take a very long time
however if you are the website
administrator
and you don't it doesn't matter how many
times you're scanning the site or how
many requests you're putting out per
second
you can put that all the way up to 100
and if it's a small site it can only
take you know five minutes so
yeah just something to bear in mind so
even though we only got one percent done
we were still able
to find 450 alerts
and then vega gives you this skin alert
summary the summary is broken down into
four
sections or four grades i suppose high
risk medium risk low risk and then just
some information
so we can see in the high-risk category
it founds
161 instances of potential um cross-site
scripting vulnerabilities
and it also found some potential social
security numbers and social
insurance numbers now a lot of these are
going to be false positives
let's go ahead and take a deeper dive
into some of these higher risk
alerts so over here on the side we can
you click this drop down arrow
on the scan drop down for the website
and we can drop down the high
risk section so under cross-site
scripting
there's all of these instances of where
it found potential vulnerabilities
so if we go to one of them we can see
a breakdown of this particular instance
so it shows us
though where exactly we can find it the
risk
it gives us a link to the place where we
can look at actually in the code at what
the alert is
and here in the resource content you can
see okay it was at no bite but you can
also see that the
cross site script was a google api so
in reality this is a false positive
because
there's not a whole lot to worry about
using a script from a
google api source because unless someone
is able to hack google
you're not really going to get malicious
content from there but
vega is very thorough and it will throw
up a lot of these false positives
in the sake of just being thorough and
making sure that every single thing is
addressed and then it also discusses
exactly or it gives you a breakdown of
what this vulnerability is the impact it
has
how to fix it or some things you can do
to fix it and then it also gives you an
external link that shows you
that shows you uh where you can find
more information about that particular
vulnerability
so if we go up and we look at the
request section we can click on here
and then we can see exactly where
the request was found so right here we
can see
it's a google api so not a whole lot to
worry about there and then i believe
actually on null by all of these cross
site scripting
vulnerabilities are actually all google
apis like if we go to another random one
yeah it's a google api same thing so
again these are all false positives
and if we go over to
the possible social security number
detected let's look at that one
all right it found these numbers now
these are just numbers that match the
pattern of a social security number so
if we go to
the actual get request let's go down
so you can see that the number was just
found inside of a link
to what looks like a image or just an
html page so
yeah an image so also again a false
positive
it's just the the numerical name of a
picture
all right let's go down to some more
some medium
now you on nullabyte we have a lot of
articles that
have text boxes that show directories
inside of computers or navigating
through a linux file system so it found
a bunch of those here
c slash bin slash x slash etc slash apt
sources.list so it's just giving us a
heads up
that directories are being specifically
spelled out in text on your website
with no byte that's not a big issue and
then if we go to low
yeah we can see there are some ip
addresses displayed in plain text on the
website which
normally wouldn't be a good thing or i
guess it depends on what your website is
in null bytes case obviously since we do
a lot of
hacking videos there's going to be a lot
of ip addresses mentioned and you can
see this one is just a
local ip addressing the default so yeah
in other website scans that i've done i
have found
plenty of sql injection vulnerabilities
i have found
actual social security numbers for
obvious reasons we're not going to show
you scans of those websites on this
video
but it's really surprising after i
started using this tool just how many
websites
have many vulnerabilities out there so
this is an extremely useful tool
and i hope you guys are able to use it
in a constructive way
if you like this tutorial be sure to
check out our website where we have
hundreds of free articles and videos
as well as premium paid content like the
ethical hacking certification bundle
which features pen testing with obos zap
wordpress hacking and hardening
and the comptia cyber security analyst
prep course
check out the link in the description
below so as we can see vega gives us a
huge amount of potential vulnerabilities
now remember that some of these are
false positives
so everything that vega alerts us to
isn't necessarily a problem that we have
to take care of just something that vega
wants us to look into
um with that in mind this is a great
tool
for both pen testers and also for
website owners website administrators it
works on both ends so
it tells you exactly what the
vulnerabilities are and how they can be
attacked essentially
or it can show you where you need to
work on your website in order to make it
more secure
so it's a very useful tool in that
regard but
obviously it doesn't actually do any of
that work for you it doesn't fix the
problems for you
nor does it allow you to exploit them
directly it just gives you a report
so use that information for good or bad
i guess
anyway if you'd like to learn more about
this topic go ahead and check out the
article link in the description
don't forget to like comment and
subscribe and go ahead and follow me on
twitter at tim51092
see you next time guys bye
you