Kali Linux - Web Penetration Testing Tools

In 2016, there were around 3424971237+ internet users worldwide. As a hub for a large number of users, we have the added responsibility of ensuring their safety. The majority of the Internet is made up of websites or web applications. So, to prevent these web applications from being exploited, payloads and malware must be tested anew, and Kali Linux provides a number of tools for this purpose.

Kali Linux has over 300 tools, many of which are useful for web penetration testing. The following is a collection of the most commonly used Web Penetration Testing tools in Kali Linux.

1. Burp Suite

One of the most widely used web application security testing tools is Burp Suite. It is utilized as a proxy, so all the requests from the browser with the proxy pass through it. And, because the requests run through the burp suite, we can make changes to it as needed, which is useful for testing vulnerabilities such as XSS or SQLi as well as any other web-related issue. Burp suite community edition is free with Kali Linux. Still, there is a premium version of this tool called burp suite professional that has a lot more features than the burp suite community edition.

To Use Burp Suite:

In order to use the burp suite, we have to use the following steps:

• First, we have to open the terminal and type "burpsuite" on the terminal.
• Then we have to go to the proxy tab and turn the interceptor switch on.
• Now visit any URL, and we will see that the request has been captured.

2. Nikto

Nikto is an Open-Source software that is written in Perl language that scans a web server for vulnerabilities that can be exploited and lead to the site's compromise. It can also check for outdated version details of 1200 servers and detect problems with particular version details of over 200 servers. It has a lot of characteristics, some of which are described here.

• Full support for SSL
• Looks for subdomains
• Supports full HTTP Proxy
• Outdated component report
• Username guessing

In order to use "nikto", we have to type "nikto" on the terminal.

3. Maltego

Maltego is a platform designed to communicate and present a clear image of the environment in which an organization owns and operates. Maltego provides a unique perspective to network as well as resource-based entities, which is the aggregation of the information delivered all over the internet- whether it is the current configuration of a router poised on the edge of our network or any other information, Maltego can locate, aggregate and visualize this information. It provides the user with extraordinary information that is leveraged and powerful.

Maltego's Uses

The following are the uses of Maltego:

• Maltego helps us to discover "hidden"
• It helps us in the thinking process by visually presenting interconnected links between searched items.
• It is used in the collection of information for all security-related It will save time and enable us to work more correctly and efficiently.
• It offers a much more powerful search, providing smarter results.
• We used this tool to show the complexity and severity of single points of failure, as well as the existing state of trust relationships within the infrastructure.

If we want to use Maltego, we have to Go to the applications menu and then select the "Maltego" tool to execute it.

4. SQL Map

SQLMap is an open-source tool that we can use to automate the process of manual SQL injection over a parameter on a website. It can detect and exploit the SQL injection parameters itself, all we need to do is to provide it with a proper request or URL. It supports 34 databases, including MySQL, Oracle, PostgreSQL, etc.

To Use Sqlmap tool:

In order to use sqlmap, we have to follow the following steps:

• Kali Linux comes with sqlmap pre-installed.
• To use this tool, simply type the following command on the terminal:

5. Whatweb

Whatweb is an abbreviation for "what is the website." It is used to find out what technologies a website uses, such as content management system (CMS), JavaScript Libraries, and so on. It serves a variety of functions, some of which are described below.

• A web application uses a Content Management System to gather the information it needs.
• It has over 1700 plugins, each of which is utilized to recognize something unique.
• To get the embedded devices attached to the web application.
• To obtain the Web Server details being used by the web application.

In order to run whatweb, we have to execute the following command and replace javatpoint.com with the domain name of our choice.

6. Whois Lookup

Whois is a database record that keeps track of all the domains that have been registered on the internet. It serves a variety of functions, some of which are described below.

• We used it to identify trademark infringement.
• It might even be used to trace down the Fraud domain's owners.
• We used it to check the availability of domains names.
• Network Administrators is use to identify and fix DNS or domain-related issues.

Enter the following command on the terminal in order to use whois lookup.