Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote -2 down vote favorite

I have backtrack and metasploitable running on my Macbook pro and I am trying to run **exploit/unix/webapp/tikiwiki_graph_formula_exec** exploit on msfconsole to penetrate the metasploitable operating system. But once i have setup the IP address of the metasploitable and I run the exploit i get the result "The target is not exploitable". On the other hand when I run the nmap command to check if there is any open port i do find that the "80/tcp open http".

My question is what could be the problem, i am using Backtrack 5 R3 and metasploitable as my testing machine. Another thing is when I try to run "*nc Ip address HEAD / HTTP 1.1"* I get that post is unreachable could some one tell me what can be the issue.

share|improve this question
1  
My powers of deduction tells me that the web server in question isn't vulnerable to that particular exploit. – Terry Chia Dec 25 '12 at 5:42
1  
Why did you choose the tikiwiki exploit? Why do you think that having port 80 open means that the exploit should work? Also, your 'nc' command is not properly formed, which is why it says 'port unreachable'. – schroeder Dec 27 '12 at 19:45

2 Answers

up vote 1 down vote

First things first, gather information on the target to determine where the vulnerabilities are. Then craft the exploit attempts accordingly. Throwing random exploits at an application will not result in success.

What other tools have you tried besides MSF? What do they report? What guide(s) are you following to help you through this process?

Penetration Testing is a complex field that can be 'point-and-click' at times, but it still requires that you have a deep understanding of how things work before you can get a particular exploit to run reliably on command.

share|improve this answer
up vote 0 down vote

Here is a thread with multiple tutorials for popping metasploitable with backtrack. Share and enjoy: http://www.backtrack-linux.org/forums/showthread.php?t=29619

share|improve this answer
Dude this video is basicly a show off it is not a tutorial. no introduction nothing, it is suitable for advance users or showing off how good you thin you are. thanks any way, but it did not answer the question. One the password files.txt are not mentioned where did you come up with then and the usernam.txt. The whole thing is just a show. – Basha Man Dec 24 '12 at 22:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.