WebApp Information Gatherer – WIG

Footprinting and information gathering, the first and most
important step of penetration testing. To become a successful ethical hacker
you need to implement every step and process of pentesting, not only implement but
to implement it efficiently. If we talk about web application penetration testing then it is very important to identify the software running behind a
target website, most of the websites are now based on CMS (content management
system) so we need to identify the name and version of the CMS.




These information are very helpful to identify the
vulnerabilities on a website, imagine if you know the software name with its
version then you can find the exploits available on Internet (how easy is to
hack into a website). But CMS identification requires some time and effort,
this is why developers have created automatic tools to do the job.

You might have heard about whatweb and blindelephant, yes
these tools are used to identify the CMS running on a website; whether it is
wordpress, Joomla and any other. Now at this stage I would like to share
another tool called WIG.

WebApp Information Gatherer

wig identifies a websites CMS by searching for
fingerprints of static files and extracting version numbers from known files.
OS identification is done by using the value of
the ‘server’ and ‘X-Powered-By’ in the response header. These values are
compared to a database of which package versions are include with different
operating systems.
There are currently three profiles:
1. Only send one request: wig only sends a request for ‘/’. All
fingerprints matching this url are tested.
2. Only send one request per plugin: The url used in most fingerprints is used
4. All fingerprints: All fingerprints are tested
Example of
WIG

# python3 wig.py www.example.com
CMS                 
Drupal CMS: [7.25, 7.24, 7.26, 7.23, 7.22]
Operating System    
Microsoft Windows Server: [2008 R2]
Server Info         
Microsoft-IIS: [7.5, 6.0]
______________________________________________________________
Time: 18.0 sec | Plugins: 65 | Urls: 324 | Fingerprints: 14178



Ehacking Staff
With more than 50 global partners, we are proud to count the world’s leading cybersecurity training provider. EH Academy is the brainchild of Ehacking, which has been involved in the field of training since the past Five years and continues to help in creating professional IT experts.

Most Popular

How to Exploit Heartbleed using Metasploit in Kali Linux

Heartbleed vulnerability (registered as CVE-2014-0160) is a security bug present in the older version of OpenSSL cryptographic library. OpenSSL is a cryptographic toolkit used...

How to Install Parrot Security OS on VirtualBox in 2020

Parrot Security OS is a free GNU/LINUX distribution, released on 10th April 2013. It is a mixture of Kali Linux and Frozenbox OS, aims to...

How to Install Kali Linux on VirtualBox [Windows Host] in 2020

Kali Linux is a Debian based Linux distribution, released on the 13th March 2013 as a complete rebuild of BackTrack Linux. It is one of...

Acunetix v13 Release Introduces Groundbreaking Innovations

The newest release of the Acunetix Web Vulnerability Scanner further improves performance and premieres best-of-breed technologies London, United Kingdom – February 5, 2019 – Acunetix,...