Kali 滲透測試- 全主動信息收集-發現
╋━━━━━━━━━━━━━━━━━━━━━╋
┃主動信息收集 ┃
┃無法避免留下訪問的痕跡 ┃
┃使用受控的第三方電腦進行探測 ┃
┃ 使用代理或已經被控制的主機 ┃
┃ 做好被封殺的準備 ┃
┃ 使用噪聲迷惑目標，淹沒真是的探測流量 ┃
┃掃描 ┃
┃ 發送不同的探測，根據返回根據判斷目標狀態┃
╋━━━━━━━━━━━━━━━━━━━━━╋
╋━━━━━━━━━━╋
┃識別活著的主機 ┃
┃ 潛在的被攻擊目標 ┃
┃輸出一個IP地址列表 ┃
┃2、3、4層發現 ┃
╋━━━━━━━━━━╋
┌───────────────────────────────────────────────┐
│OSI model Layer description Protocols │
├───────────────────────────────────────────────┤
│Layer 7 - Application This layer involves the application software that HTTP,FTP │
│ is sending and receiving data and Telnet │
│Layer 6 - Presentation This layer deines how data is formatted ASCII,JPEG,PDF │
│ or organized PNG,and DOCX │
│Layer 5 - Session This layer involves application session control NetBIOS,PPTP │
│ management,synchronization RPC,and SOCKS │
│Layer 4 - Transport This layer involves and-to-end TCP and UDP │
│ communication services │
│Layer 3 - Network This layer involes logical system addressing IPv4,IPv6,ICMP,│
│ and IPSec │
│Layer 2 - Data link This layer involes physical system addressing ARP │
│Layer 1 - Pysical This layer involes the data stream that is │
│ passed over the wire │
└───────────────────────────────────────────────┘
╋━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╋
┃發現-----二層發現 ┃
┃ arping ┃
┃ arping 1.1.1.1 -c 1 ┃
┃ arping 1.1.1.1 -d ┃
┃ arping -c 1.1.1.1 | grep "bytes from" | cut -d"" -f 5 | cut -d "(" -f 2 | cut -d")" -f 1 ┃
┃ 腳本 ┃
┃ arping1.sh eth0 > addrs ┃
┃ arping2.sh addrs ┃
╋━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╋
[課後拓展]關於kali linux中無RPM命令無法使用的問題，本人在自己的機器上通過以下方法修正了，
身為kali linux的初學者，如果你用了我的方法將問題解決了最好，如果沒有解決請見諒。
------------------------------------------
RPM是RedHat Package Manager(RedHat軟件包管理工具)。
在進入kali linux 終端輸入RPM，如果提示沒有安裝的情況的時候
那麽這個命令是不能使用的。解決方法是通過改用163的源，更新後使用RPM。
下載163的源
wget http://mirrors.163.com/.help/sources.list.squeeze
註釋後面3行
vi sources.list.squeeze
復制到該位置
cp sources.list.squeeze /etc/apt/sources.list
apt-get update
上述操作結束後重啟客戶端即可使用RPM命令。
[email protected]:~# ifconfig
[email protected]:~# vi /etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
source /etc/network/interfaces.d/*
# The loopback network interface
auto lo
iface eth0 inet dhcp
# address 192.168.20.8
# netmask 255.255.255.0
# network 192.168.20.0
# broadcast 192.168.20.255
# gateway 192.168.20.2
# dns-* options are implemented by the resolvconf package, if installed
# dns-nameservers 192.168.60.101 192.168.60.102
[email protected]:~# dhclient eth0
[email protected]:~# arping 192.168.1.110
[email protected]:~# arping 192.168.1.110 -c 1
[email protected]:~# arping -h
ARPing 2.14, by Thomas Habets <[email protected]>
usage: arping [ -0aAbdDeFpPqrRuUv ] [ -w <us> ] [ -W <sec> ] [ -S <host/ip> ]
[ -T <host/ip ] [ -s <MAC> ] [ -t <MAC> ] [ -c <count> ]
[ -C <count> ] [ -i <interface> ] <host/ip/MAC | -B>
For complete usage info, use --help or check the manpage.
[email protected]:~# arping 192.168.1.1 -d
[email protected]:~# arping -c 192.168.1.1 | grep "bytes from" | cut -d" " -f 5 | cut -d "(" -f 2 | cut -d")" -f 1
[email protected]:~# arping 192.168.1.1
ARPING 192.168.1.1
60 bytes from f0:eb:d0:22:46:b4 (192.168.1.1): index=0 time=8.086 msec
60 bytes from f0:eb:d0:22:46:b4 (192.168.1.1): index=1 time=13.558 msec
60 bytes from f0:eb:d0:22:46:b4 (192.168.1.1): index=2 time=7.545 msec
60 bytes from f0:eb:d0:22:46:b4 (192.168.1.1): index=3 time=13.376 msec
^C
--- 192.168.1.1 statistics ---
4 packets transmitted, 4 packets received, 0% unanswered (0 extra)
rtt min/avg/max/std-dev = 7.545/10.641/13.558/2.833 ms
╭────────────────────────────────────────────╮
[arping1.sh]
#!/bin/bash
if{"$#"-ne 1};then
echo"Usage - ./arping.sh {interface}"
echo"Example - ./arping.sh eth0"
echo"Example will perform an ARP scan of the local subnet to which eth0 is assigned"
exit
fi
interface=$1
prefix=$(ifconfig sinterface | grep ‘inter addr‘ | cut -d ‘:‘ -f 2 | cut -d ‘ ‘ -f 1 | cut -d ‘.‘ -f 1-3)
for addr in$(seq 1 254);do
arping -c | Sprefix.Saddr | grep "bytes from" | cut -d ‘ ‘ -f 5 | cut -d ‘(‘ -f 2 | cut -d ‘)‘ -f 1 >> addr.txt
done
╰────────────────────────────────────────────╯
[email protected]:~# ifconfig eth0 | grep ‘inter addr‘ | cut -d ‘:‘ -f 2 | cut -d ‘ ‘ -f 1 | cut -d ‘.‘ -f 1-3
[email protected]:~# arping1.sh eth0
╭────────────────────────────────────────────╮
[arping2.sh]
#!/bin/bash
if{"$#"-ne 1};then
echo"Usage - ./arping.sh {interface}"
echo"Example - ./arping.sh eth0"
echo"Example will perform an ARP scan of the local subnet to which eth0 is assigned"
exit
fi
file=$1
for addr in $(cat $file); do
arping -c 1 $addr | grep "bytes from" | cut -d ‘ ‘ -f 5 | cut -d ‘(‘ -f 2 | cut -d ‘)‘ -f 1
╰────────────────────────────────────────────╯
[email protected]:~# arping2.sh addr
╋━━━━━━━━━━━━╋
┃發現-----二層發現 ┃
┃nmap 1.1.1.1-254-sn ┃
┃nmap -iL iplist.txt -sn ┃
┃ ┃
┃Nmap很輕大，後面單獨介紹┃
╋━━━━━━━━━━━━╋
[email protected]:~# nmap
Nmap 6.49BETA4 ( https://nmap.org )
Usage: nmap [Scan Type(s)] [Options] {target specification}
TARGET SPECIFICATION:
Can pass hostnames, IP addresses, networks, etc.
Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
-iL <inputfilename>: Input from list of hosts/networks
-iR <num hosts>: Choose random targets
--exclude <host1[,host2][,host3],...>: Exclude hosts/networks
--excludefile <exclude_file>: Exclude list from file
HOST DISCOVERY:
-sL: List Scan - simply list targets to scan
-sn: Ping Scan - disable port scan
-Pn: Treat all hosts as online -- skip host discovery
-PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports
-PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
-PO[protocol list]: IP Protocol Ping
-n/-R: Never do DNS resolution/Always resolve [default: sometimes]
--dns-servers <serv1[,serv2],...>: Specify custom DNS servers
--system-dns: Use OS‘s DNS resolver
--traceroute: Trace hop path to each host
SCAN TECHNIQUES:
-sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
-sU: UDP Scan
-sN/sF/sX: TCP Null, FIN, and Xmas scans
--scanflags <flags>: Customize TCP scan flags
-sI <zombie host[:probeport]>: Idle scan
-sY/sZ: SCTP INIT/COOKIE-ECHO scans
-sO: IP protocol scan
-b <FTP relay host>: FTP bounce scan
PORT SPECIFICATION AND SCAN ORDER:
-p <port ranges>: Only scan specified ports
Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9
--exclude-ports <port ranges>: Exclude the specified ports from scanning
-F: Fast mode - Scan fewer ports than the default scan
-r: Scan ports consecutively - don‘t randomize
--top-ports <number>: Scan <number> most common ports
--port-ratio <ratio>: Scan ports more common than <ratio>
SERVICE/VERSION DETECTION:
-sV: Probe open ports to determine service/version info
--version-intensity <level>: Set from 0 (light) to 9 (try all probes)
--version-light: Limit to most likely probes (intensity 2)
--version-all: Try every single probe (intensity 9)
--version-trace: Show detailed version scan activity (for debugging)
SCRIPT SCAN:
-sC: equivalent to --script=default
--script=<Lua scripts>: <Lua scripts> is a comma separated list of
directories, script-files or script-categories
--script-args=<n1=v1,[n2=v2,...]>: provide arguments to scripts
--script-args-file=filename: provide NSE script args in a file
--script-trace: Show all data sent and received
--script-updatedb: Update the script database.
--script-help=<Lua scripts>: Show help about scripts.
<Lua scripts> is a comma-separated list of script-files or
script-categories.
OS DETECTION:
-O: Enable OS detection
--osscan-limit: Limit OS detection to promising targets
--osscan-guess: Guess OS more aggressively
TIMING AND PERFORMANCE:
Options which take <time> are in seconds, or append ‘ms‘ (milliseconds),
‘s‘ (seconds), ‘m‘ (minutes), or ‘h‘ (hours) to the value (e.g. 30m).
-T<0-5>: Set timing template (higher is faster)
--min-hostgroup/max-hostgroup <size>: Parallel host scan group sizes
--min-parallelism/max-parallelism <numprobes>: Probe parallelization
--min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <time>: Specifies
probe round trip time.
--max-retries <tries>: Caps number of port scan probe retransmissions.
--host-timeout <time>: Give up on target after this long
--scan-delay/--max-scan-delay <time>: Adjust delay between probes
--min-rate <number>: Send packets no slower than <number> per second
--max-rate <number>: Send packets no faster than <number> per second
FIREWALL/IDS EVASION AND SPOOFING:
-f; --mtu <val>: fragment packets (optionally w/given MTU)
-D <decoy1,decoy2[,ME],...>: Cloak a scan with decoys
-S <IP_Address>: Spoof source address
-e <iface>: Use specified interface
-g/--source-port <portnum>: Use given port number
--proxies <url1,[url2],...>: Relay connections through HTTP/SOCKS4 proxies
--data <hex string>: Append a custom payload to sent packets
--data-string <string>: Append a custom ASCII string to sent packets
--data-length <num>: Append random data to sent packets
--ip-options <options>: Send packets with specified ip options
--ttl <val>: Set IP time-to-live field
--spoof-mac <mac address/prefix/vendor name>: Spoof your MAC address
--badsum: Send packets with a bogus TCP/UDP/SCTP checksum
OUTPUT:
-oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3,
and Grepable format, respectively, to the given filename.
-oA <basename>: Output in the three major formats at once
-v: Increase verbosity level (use -vv or more for greater effect)
-d: Increase debugging level (use -dd or more for greater effect)
--reason: Display the reason a port is in a particular state
--open: Only show open (or possibly open) ports
--packet-trace: Show all packets sent and received
--iflist: Print host interfaces and routes (for debugging)
--append-output: Append to rather than clobber specified output files
--resume <filename>: Resume an aborted scan
--stylesheet <path/URL>: XSL stylesheet to transform XML output to HTML
--webxml: Reference stylesheet from Nmap.Org for more portable XML
--no-stylesheet: Prevent associating of XSL stylesheet w/XML output
MISC:
-6: Enable IPv6 scanning
-A: Enable OS detection, version detection, script scanning, and traceroute
--datadir <dirname>: Specify custom Nmap data file location
--send-eth/--send-ip: Send using raw ethernet frames or IP packets
--privileged: Assume that the user is fully privileged
--unprivileged: Assume the user lacks raw socket privileges
-V: Print version number
-h: Print this help summary page.
EXAMPLES:
nmap -v -A scanme.nmap.org
nmap -v -sn 192.168.0.0/16 10.0.0.0/8
nmap -v -iR 10000 -Pn -p 80
SEE THE MAN PAGE (https://nmap.org/book/man.html) FOR MORE OPTIONS AND EXAMPLES
[email protected]:~# nmap -sn 192.168.1.0/24
Starting Nmap 6.49BETA4 ( https://nmap.org ) at 2015-09-24 14:04 CST
Nmap scan report for 192.168.1.1
Host is up (0.0055s latency).
MAC Address: F0:EB:D0:22:46:B4 (Shanghai Feixun Communication Co.)
Nmap scan report for 192.168.1.101
Host is up (0.00030s latency).
MAC Address: 00:5A:39:B0:ED:D2 (Shenzhen Fast Technologies CO.)
Nmap scan report for 192.168.1.110
Host is up.
Nmap done: 256 IP addresses (3 hosts up) scanned in 2.09 seconds
[email protected]:~# nmap -iL addr -sn
本文出自 “白帽生活” 博客，請務必保留此出處http://klmy0.blog.51cto.com/12377962/1947883
Kali 滲透測試- 全主動信息收集-發現