Search Engine Assessment Tool (a.k.a. SEAT) is an application that gathers information from various search engines (Google, Yahoo, MSN, AltaVista, AllTheWeb, AOL, DMOZ) and Vulnerability Databases (GHDB, NIKTO, GSDB, WMAP, URLCHK, NESTEA). Its multi-threading capabilities make it quick. In addition, it embeds an abstraction layer that enables to adapt a unique query language to all supported search engines languages.
Full documentation is available on the official website: http://midnightresearch.com/common/seat/documentation.pdf
Install following packages:
$ sudo apt-get install perl libxml-smart-perl
Then install necessary perl modules via cpan:
$ sudo cpan cpan > install Gtk2 cpan > install threads cpan > install threads::shared cpan > install XML::Smart
If you get a compilation error while trying to install Gtk2, you can rather install it via the packages:
$ sudo apt-get install libgtk2-perl
Installation of SEAT
Following commands will install SEAT in /pentest/enumeration/seat/
$ cd /data/src/ $ wget http://midnightresearch.com/common/seat/seat-0.3.tar.bz2 $ mkdir -p /pentest/enumeration/ $ bzip2 -cd seat-0.3.tar.bz2 | tar xf - -C /pentest/enumeration/
To start SEAT, open a terminal and issue following command:
$ cd /pentest/enumeration/seat/ $ ./seat
If all required dependencies are found, you should get a similar screen:
This section refers to the first tab: Preparation.
Select the "Preparation" tab and enter one or more target(s). Targets can be IP addresses (e.g. 192.168.1.*) or domain names (e.g. target.com).
By using the icons, you can:
- Add a new target
- Delete the selected target
- Clear the list
- Load a list of targets from a file
- Save the list of targets in a file
- Check/Uncheck all targets
To add queries, either:
- enter queries manually,
- or load a predefined set of queries by loading a file (use the load icon to select a signature file, located in the databases/ directory of your SEAT installation):
By clicking on a query, a description of the payload is displayed in the description field.
You also have the possibility to check/uncheck some payloads.
This section refers to the second tab: Execution.
Search engines selection
Before launching the scan, select the search engines to imply in the scan. You can load the default list by clicking on the load icon and by selecting the default.xml file, located in the searchengines/ directory of your SEAT installation.
You can select/unselect search engines by using the checkboxes.
You also have the possibility to add search engines. In this case, you will have to provide SEAT with the template to use for language conversions (abstraction layer).
This panel enables you to fine-tune the scan:
- search depth: defines how many levels of search results SEAT will traverse/digg. 0 will order to give up after the first page.
- use mined results: during the scan, SEAT will try to mine domains that are related to the original target domain.
- Never: don't use mined domains
- Save for later: adds mined domains in the list of targets for a future scan
- Immediately request: adds mined domains to current scan
- sleep time between runs: specifies the time between 2 requests.
- Number of threads: specifies the number of requests to send in parallel.
- User Agent: Enables to specify a fixed or random user agent (SEAT, Google Bot, MSN Bot, Slurp, Random Bot, Random Browser)
- Use Proxy Server: eventually scan through a proxy server
Once you have setup all the parameters of your scan, click on the Execute icon from the center panel. At any time during the scan, notice that you can pause/resume the scan or completely abort it by clicking on the appropriate buttons.