Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Has anyone built a metascript, or a `script of scripts' useful during a penetration-test?

Do you use Metasploit RC files? A network vulnerability scanner in a special way? A command-line, custom, or headless web application security scanner?

Any other ways (or even ideas) to speed up penetration-tests that you would be willing to share? Do you use the Dradis Framework with other team members, or to organize your penetration-test results (or to produce reports)?

Are there open-source projects to do this (besides Metasploit RC files or the `save' command under the MSF console)?

share|improve this question

4 Answers 4

Try SET from Social-Engineer.org. Whole site is a great resource.

share|improve this answer
Very nice comment, I knew about SET but not this wiki page! –  atdre Nov 17 '10 at 22:52

I have a few anecdotes I’d like to share pertaining to the “A network vulnerability scanner in a special way?” question above.

Before jumping in though I’d like to note that for most scanning tools speed is the antithesis of accuracy. Speed kills.

speed kills

Port scanning:

Tweaking nmap for balls out speed (a la –min-hostgroup, --min-parallelism, and friends) is awesome for watching the packet counters on iptraf go blurry, but you can be assured accuracy will suffer.

My typical hedge on going fast is to run multiple rounds of nmap scans: Preferably on different days and at different times. This helps to minimize accuracy-killing hazards like scheduled backups that saturate bandwidth.

For really big scans try unicornscan. It has been awhile, but I took notes that last time I did a respectably large Internet based port scan:

To recap: We performed a sweep of 400,000+ public IPs across multiple continents by configuring the scans to do a full TCP port scan of each IP, sustained ~55 Mbits/s using between 3 and 5 systems, and completed it in a matter of days.

This is pretty good considering by sending two SYN probes per port it meant sending ~52.5 billion packets and producing some 3 Terabytes of data.

Vulnerability scanning:

This may not be true so much today, but a few years back popular commercial vuln. scanners would optimize their scans out of the box for speed. Marketing and sales pushed for it because customers tie quality to how fast they get scan results.

So as a vendor (disclosure: I used to work for one) the game was to reduce the number of checks in favor of speed. Full TCP or UDP scans? No way. Individual vulnerability checks that take time? Bury them.

You can see where this is going - if you want accuracy then spend a few minutes and customize your preferred vulnerability scanner(s) for accuracy (and coverage). If you want speed then know you are sacrificing those properties.

Combining the above:

I’m bored with how often port scan results differ from tool to tool on the same engagements. I hate it when I pay for a per IP vulnerability scan (e.g. Qualys) and the tool repeatedly misses open ports that I verified to be open. I like to take the results from my port scans (see above) and customize every vulnerability scan tool I’m using to only hit those ports my custom scans discovered to be open. This can save TONs of time.

Cloud boosting:

For Internet based scans I now almost exclusively use cloud VMs. My favorite is linode.com. Linode’s AUP so far doesn’t forbid port scanning (Amazon’s does). Spinning up 30 VMs to distribute scanning efforts across non-regional data centers can put the fun back into port scanning. It’s easier to get aggressive with tuning as well given the favorable latency and bandwidth conditions. My point here is cloud VMs are awesome for boosting scanning capacity.

share|improve this answer
I use iftop instead of iptraf. Which is better? As for 'Re:per-IP vuln scans', I think that identifying reliable open ports and what's running on them (what specific app version in a specific environment) is extremely important, and then run OpenVAS/Nessus on the specific vulns on that specific port that you think that they affect. You forgot to mention how you do brute-forcing! –  atdre Nov 18 '10 at 10:32
All great information, but I don't see where you actually hit on automation. –  Ormis Apr 11 '11 at 13:49
@Ormis as i mentioned in my first sentence, i was attempting to add value around dre's "A network vulnerability scanner in a special way?" part of the question. actually, my answer is probably the opposite of automation, it mostly implies more human work :) –  Tate Hansen Apr 11 '11 at 14:00

Some thoughts I had while reading this question...

Penetration Testing is very dependent on the circumstances. Yes, there are automated tools, but even if they help, they cannot do everything. From my experience, automation gets in the way unless applied to a specific step in the pen-testing/auditing process.

I actually just got interested in OpenVAS. It's not technically a penetration-testing tool, but it's very helpful with reconnaissance. And if you look it up, keep in mind that a new version (3.2.3) released this morning.

This isn't open source, but another tool to investigate is CoreInsight. I'm in the process of getting a chance to play with it and, though i understand that it won't have the maneuverability of Core Impact, it should be a very interesting and helpful tool.

Though i have my doubts about automation in pen-test, i'm interested in what others have to say.... (+1 to you, sir)

share|improve this answer
Huh. Core Insight fell off my radar, or I didn't know about it (obviously know about Core Impact). It appears that Trustwave wants to get into this product space with their PenTest Manager as well -- hostingpublicity.com/2011/03/… –  atdre Apr 11 '11 at 17:52
@atdre that's interesting, i'll have to look more into trustwave's pen testing application, especially if there's a scheduler built in. –  Ormis Apr 11 '11 at 20:01
@atdre actually, it seems that product is simply a dynamic deliverable from their external auditors/tests.... That's what i got out of a quick glance, I'll look into it later too. Thanks for the lead. –  Ormis Apr 11 '11 at 20:07

If you need to bruteforce a website and act like a real browser with javascript you could write a couple of lines in http://zombie.labnotes.org/. I used it for user-enumeration, wordlist-generation out of userinfos and bruteforcing at the same time.

var zombie = require("zombie"); var assert = require("assert");

// Load the page from localhost zombie.visit("http://localhost:3000/", function (err, browser, status) {

  // Fill email, password and submit form   browser.
    fill("email", "zombie@underworld.dead").
    fill("password", "eat-the-living").
    pressButton("Sign Me Up!", function(err, browser, status) {

      // Form submitted, new page loaded.
      assert.equal(browser.text("title"), "Welcome To Brains Depot");



Without the Javascript-feature i use ruby - mechanize.

share|improve this answer
This looks really cool! It's probably an excellent way to defeat Roboo -- ecl-labs.org/2011/03/17/roboo-http-mitigator.html –  atdre Apr 11 '11 at 17:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.