2. 程式人生 > 實用技巧 >Penetration Test - Survey the Target(1)

Penetration Test - Survey the Target(1)

阿新 • • 發佈：2020-07-30

Scanning and Enumeration

INFORMATION GATHERING
  • Scanning
    • Process of looking at some number of "things" to determine characteristics
    • Commonly used in pen testing to uncover target vulnerabilities
  • Many types of scan targets
    • Networks
    • Network devices
    • Computers
    • Applications/services
Enumeration
  • Counting the detected instances of some target class
  • Pen testing target classes
    • Hosts
    • Networks
    • Domains
    • Users
    • Groups
    • Network shares
    • Web pages
    • Applications
    • Services
    • Tokens
    • Social networking sites
QUICK REVIEW
  • Scanning helps to determine what is "out there"
  • Don't just scan for computers - look for all devices and services
  • Start collecting and classifying target information
  • Use more than just utilities that scan networks

Demo

Target 1: Metasploitable VM

Target 2: DVWA VM

Attacker: Kali Linux VM

Scan Method 1 - nmap

nmap -sP 10.0.0.0/24

Scan Method 2 - ARP

arp-scan 10.0.0.0/24

Scan Method 3 - Whois Lookup http://whois.domaintools.com/

QUICK REVIEW
  • nmap is the most common tool you'll see
  • Know how to use nmap and what the main options do
  • Be able to explain nmap output

相關推薦

Penetration Test - Survey the Target(1)

Scanning and Enumeration INFORMATION GATHERING Scanning Process of looking at some number of "things" to determine characteristics

SpringBoot專案使用JRebel啟動專案提示：Disconnected from the target VM, address: ‘127.0.0.1:63878‘, transport: ‘

解決方案擺在前面，增加服務執行記憶體，避免JRebel檢測失敗： -Djava.awt.headless=true -Xms2048m -Xmx2048m

[UVA100] The 3n + 1 problem.題解

這道橙題也太水了吧！直接模擬輸出流程就可以了！ 老規矩，先看題目。 這題讓我們尋找輸入的每對(i,j)中[i,j]內所有數字區間長度的max值。我們可以用模擬遞推對[i,j]內所有的數進行相同的操作。操作流程如下:

Penetration Test - Planning and Scoping(8)

Lab Environment Setup ENV1: Kali Linux Install a Kali Linux Virtual Machine. https://www.kali.org/ ENV2: DVWA - DAMN VULNERABLE WEB APPLICATION

configparser讀取含有中文的配置(Windows) configparser.MissingSectionHeaderError: File contains no section headers. file: 'test.cfg', line: 1 '\ufeff[test]\n'------------轉載

configparser讀取含有中文的配置(Windows) 2019獨角獸企業重金招聘Python工程師標準>>>

關於Tomcat出現The origin server did not find a current representation for the target resourc...的問題

寫在前面 “The origin server did not find a current representation for the target resource or is not willing todisclose that one exists.”，在web開發的過程中，看到這一段錯誤提示，不管是在入門階段還是已

Penetration Test - Select Your Attacks(19)

Post-exploitation Techniques POST-EXPLOITATION TECHNIQUES What to do once you\'re in Make it easier next time

Penetration Test - Selecting_Pen_Testing_Tools(6)

Open-Source Research Tools OPEN SOURCE INTELLIGENCE (OSINT) TOOLS Tool Notes URL Whois Domain details (contacts, name servers, etc.)

Penetration Test - Using_Scripting_in_Pen_Testing(2)

Bash Scripting Basics COMMENTS Help you remember what you were thinking All comments start with the \'#\' character

Penetration Test - Using_Scripting_in_Pen_Testing(3)

Bash scripting techniques BASH SCRIPTING I/O I/O - File vs. terminal vs. network Input from a terminal read -p \"Enter your name:\" name; echo \"Hi,\" $name

frame報錯 Failed to set the 'href' property on 'Location': The current window does not have permission to navigate the target frame to...

之所以報這個錯的原因是因為你巢狀在frame中的網頁，居然檢視幹掉現在連結，重新開一個視窗，為了防止xss攻擊，frame表示我不同意堅決不同意

Cannot inline bytecode built with JVM target 1.8 into bytecode that is being built with JVM target

Cannot inline bytecode built with JVM target 1.8 into bytecode that is being built with JVM target 解決方案: 在build.grade(app)中新增如下程式碼

The 3n + 1 problem

Problems in Computer Science are often classified as belonging to a certain class of problems (e.g., NP, Unsolvable, Recursive). In this problem you will be analyzing a property of an algorithm

HTTP Status 406 – Not Acceptable The target resource does not have a current representation that

技術標籤：bugjavassm 部落格來源： 專案中 新建HTML頁面然後執行專案的時候發現報錯，報錯如下

複習_2: Find the toppest 1

技術標籤：複習 記得這道題好像是之前一次筆試的題目。。當時想了想沒想出來，考完了就知道怎麼寫了，可能這就是筆試吧

JMeter壓測出現“the target server failed to respond“的解決辦法

壓測介面的時候，遇到了這個問題，在網上找到解決方案，試一下還挺管用，800併發沒改前20%以上的報錯率，改完800併發0.00%報錯率。

解決Android studio 3.6.1 出現Cause: unable to find valid certification path to requested target 報錯的問題

1、首先修改根目錄下的build.gradle成如下格式 // Top-level build file where you can add configuration options common to all sub-projects/modules.

Springboot 報錯 Invalid character found in the request target. The valid characters are defined in RFC 7230 and RFC 3986

今天看專案日誌，發現報這個異常。 是tomcat容器的問題，因為出現了特殊字元，所以報異常了。Invalid character found in the request target. The valid characters are defined in RFC 7230 and RFC 3986

1-The next outbreak we're not ready

When I was a kid, the disaster we worried about most was a nuclear war. [wen aɪ wəzəkɪd]

sonar-scanner報錯Caused by: net.sourceforge.pmd.lang.java.ast.ParseException: Line 88, Column 37: Cannot use the diamond generic notation when running in JDK inferior to 1.7 mode!

原因是沒有加jdk的編譯版本 如果是在命令列執行，則需要加-Dsonar.java.source=11 如果使用到了sonar-project.properties, 則加入sonar.java.source=11即可