NEW TOOL RELEASE: WisQuas

Revealing What May Be Hidden...

---

"Wis Quas strips illusion from creatures hidden by the cloak of invisibility, instantly revealing their position. Nightshade cut many times to form a paper-like sheet, then carved into lace is secured by spider silk. It is glazed, dried in the sun, then crystallized into a shiny powder that must be tossed in the sky over the field of battle as the spell is cast."

What is WisQuas? 

A simple 'URL Revealer' (fast and lightweight scanner, enumerator, fingerprinter, fuzzer, assessor, and collector). Assists with finding vulnerabilities, anomalies, unique servers, available files/dirs, methods, and containers, in addition to auto-decoding headers and cookies.

---

Where can you find WisQuas?

https://github.com/LostRabbitLabs/wisquas

# git clone https://github.com/LostRabbitLabs/wisquas

---

How does it work? 
Provide a URL to WisQuas and it will perform the following functions...

1. Resolve hostname to IP address
2. Perform ASN lookup on IP address to provide ownership info and possible geolocation
3. Inventories all received headers and cookies and attempts to auto-decode their values (hex/b64)
4. Baseline original URL request (with SSL cert info if HTTPS) to compare to all other requests
5. Tactical fuzzing and enumeration to generate unique errors and reveal layered web services
6. Inspect robots.txt file if available
7. Enumerate through possible HTTP Verbs
8. Perform Host Header Manipulation to detect additional accessible containers

Example commands and usage...

WisQuas on URL using 'Desktop Browser' profile:
./wisquas.py -1 "http://www.lost-rabbit.com/"

WisQuas on URL using 'Mobile Browser' profile:
./wisquas.py -2 "http://www.lost-rabbit.com/"

WisQuas on URL using custom 'host header' on requests:
./wisquas.py -1 "http://www.lost-rabbit.com/" customhostname

Create a PDF report from output (requires additional software):
./wisquas.py -1 "http://lost-rabbit.com/" > lost-rabbit.com.txt ; cat lost-rabbit.com.txt | aha -b | wkhtmltopdf - lost-rabbit.com.pdf

---

WisQuas Walkthrough

1. Clone the 'WisQuas' package from Github...

2. You may need to do the following to install the 'tldextract' library...

# pip install tldextract --upgrade

3. Run 'WisQuas' on desired URL (be sure to include trailing slash)...

#./wisquas.py -1 "http://www.angry_monkey.com/"

4. Analyze the results to reveal information about your URL...

WisQuas will connect to the target URL, and gather information about the original request. Collected headers and cookies will be analyzed and auto-decoded (if they are detected to be Hex or Base64).

In our example above, there is a cookie and a header that contain a Base64 encoded string, that were auto-decoded by WisQuas (highlighted with bright green text).

Original request information and totals, along with final landing page are displayed. Below that, you will find columnized, colorized output of tactical payload requests. Easily find patterns in similar types of requests, identify WAFs, discover hidden web servers and content, and confirm default installations and technologies used within a URL and its web services.

WEB RESPONSE COLOR CODES:

200 = GREEN (Successful request)

40x = YELLOW (Not authorized)

404 = WHITE (Not found)

414 = BLUE (Flooded)

50x = RED (Major Error)

The contents of the discovered 'robots.txt' file is displayed next for review. Available HTTP Verb requests are validated followed by 'Host Header Manipulation' attempts using a small list of custom hostnames.

Certain response code combinations, number of cookies and headers, and content-length can provide insight as to specific software or techniques in use, and may offer a clue on how to further communicate with the system.

More on that soon...until then...

If you have any questions or comments you can reach out to us at  lostrabbitlabs@gmail.com.