Testing http authentication via netcat

Question

I'm currently trying to track down what I think is a false positive from Nessus, my attempts to netcat into the device are failing, but I believe the service is shut off anyway and Nessus is being Nessus.

This brought up a question I've had for a while and any time I look it up on Google, I get 9001 answers to different things... How do vuln scanners authenticate to web services using either bash or cmd. I know it can be done with netcat or ncat, but I can't seem to find proper results. How is it done?

edit: forgot to mention this is http.

Answer 1

If you want to test a protocol with netcat, then you need to manually send everything that a normal client would send. For HTTP, it would look something like this:

GET / HTTP/1.1
Host: example.com
Authorization: Basic QWxhZGluOnNlc2FtIG9wZW4=
User-Agent: Some call me... Tim

Of course, you'd have to change all the fields to reflect what you'd want to send. You're better off using a tool that actually knows how to speak HTTP.

I'm partial to perl's lwp-request package, which most people know as simply the GET and POST commands. It would look something like this:

GET -USse -C someuser:somepass http://example.com/

See the man page for options, but -U=Request headers, -S=Status chain, -s=Status code, -e=response headers, -C=credentials

It's simple, capable, and flexible.

curl is also a very popular package for doing this sort of thing and can match the lwp-request functionality pretty much point-for-point and then some, but it's more complex. Same goes for wget, another popular option.

Answer 2

EDIT: If you are testing HTTP authentication, use a browser or curl on the command line.

In order for a network vulnerability scanner to be at all useful it must be able to interact with a wide verity of protocols. You have made no mention as to what protocol you are dealing with, so no one can help you with the specifics.

In general, you can fire up wireshark, filter by the port of interest and intercept the packets that Nessues is producing. If this is over TCP then netcat can be used to replay some of these requests. Netcat being used by a human can be very slow and cause timeouts. Python, or another scripting language can also be used to replay captured traffic and can do so much faster than a human using netcat.

Answer 3

Other answers have talked about clients for testing HTTP authentication, and are good, but looking at the wording of your question, it sounds like your more basic question is whether the port is open or not (e.g., you "believe the service is shut off").

A portscanner like nmap will allow you to check particular ports for sure. Which is what Nessus is using, of course. You may also want to consider running tcpdump and recording the scan, then you can go back and see which ports were responding to Nessus; sometimes you may read the reports as meaning one service is there when in fact the results reflect a different network listener than the one you're thinking of.