本文记录 Kali Linux 2018.1 学习使用和渗透测试的详细过程，教程为安全牛课堂里的《Kali Linux 渗透测试》课程
1. DIG
2. 区域传送
3. 帮助文件
1. DIG
- dig @8.8.8.8 www.sina.com mx
- dig www.sina.com any
- 反向查询：dig +noall +answer -x 8.8.8.8
- bind版本信息： dig +noall +answer txt chaos VERSION.BIND @ns3.dnsv4.com
- DNS追踪： dig +trace example.com
- 抓包比较递归查询、迭代查询过程的区别
-
默认使用 /etc/resplv.conf 指定的域名服务器
root@kali:~# nslookup sina.com -type=any 8.8.8.8 Server: 8.8.8.8 Address: 8.8.8.8#53 Non-authoritative answer: Name: sina.com Address: 66.102.251.33 #默认使用 /etc/resplv.conf 指定的域名服务器 root@kali:~# dig sina.com any
# 指定域名服务器 root@kali:~# dig sina.com any @8.8.8.8
# 尝试指定不同的域名服务器 root@kali:~# dig sina.com any @202.106.2.20 root@kali:~# dig sina.com any @114.114.114.114 root@kali:~# dig sina.com any @8.8.8.8 -
迭代别名记录查询
# 修改默认域名服务器 root@kali:~# cat /etc/resolv.conf domain localdomain search localdomain nameserver 114.114.114.114 root@kali:~# dig mail.163.com any
-
一些参数
-
+noall：不显示信息
-
+answer：显示结果
root@kali:~# dig +noall +answer mail.163.com any mail.163.com. 131 IN CNAME mail163.ntes53.netease.com. root@kali:~# dig +noall +answer mail.163.com any | awk '{print $5}'
-
-
反向查询
root@kali:~# dig 163.com
# 反向查询 PTR记录 root@kali:~# dig -x 123.58.180.8
-
查询 bind 版本信息
# 使用 dig 默认只会查询当前 fqdn 名称，不会查询所有的记录 # dig 可以查询 bind 版本信息，根据 bind 漏洞，就可以全部获取 DNS 服务器权限 root@kali:~# dig sina.com any
# 查询结果为空（被隐藏） root@kali:~# dig +noall +answer txt chaos VERSION.BIND @ns2.sina.com. VERSION.BIND. 0 CH TXT " " -
DNS 追踪
# 跟踪过程：直接迭代查询，不经过本地缓存域名0服务器（从根域开始） root@kali:~# dig +trace 163.com
抓包比较递归查询、迭代查询过程的区别
2. 区域传送
-
区域传送：在本域的各个域名服务器之间进行信息同步
-
区域传送
# dig @ns1.example.com example.com axfr root@kali:~# dig sina.com any
root@kali:~# dig @ns2.sina.com sina.com axfr
# host -T -l sina.com 8.8.8.8 root@kali:~# host -T -l sina.com ns2.sina.com.
#3. 帮助文件 #
root@kali:~# dig -h
Usage: dig [@global-server] [domain] [q-type] [q-class] {q-opt}
{global-d-opt} host [@local-server] {local-d-opt}
[ host [@local-server] {local-d-opt} [...]]
Where: domain is in the Domain Name System
q-class is one of (in,hs,ch,...) [default: in]
q-type is one of (a,any,mx,ns,soa,hinfo,axfr,txt,...) [default:a]
(Use ixfr=version for type ixfr)
q-opt is one of:
-4 (use IPv4 query transport only)
-6 (use IPv6 query transport only)
-b address[#port] (bind to source address/port)
-c class (specify query class)
-f filename (batch mode)
-i (use IP6.INT for IPv6 reverse lookups)
-k keyfile (specify tsig key file)
-m (enable memory usage debugging)
-p port (specify port number)
-q name (specify query name)
-t type (specify query type)
-u (display times in usec instead of msec)
-x dot-notation (shortcut for reverse lookups)
-y [hmac:]name:key (specify named base64 tsig key)
d-opt is of the form +keyword[=value], where keyword is:
+[no]aaflag (Set AA flag in query (+[no]aaflag))
+[no]aaonly (Set AA flag in query (+[no]aaflag))
+[no]additional (Control display of additional section)
+[no]adflag (Set AD flag in query (default on))
+[no]all (Set or clear all display flags)
+[no]answer (Control display of answer section)
+[no]authority (Control display of authority section)
+[no]badcookie (Retry BADCOOKIE responses)
+[no]besteffort (Try to parse even illegal messages)
+bufsize=### (Set EDNS0 Max UDP packet size)
+[no]cdflag (Set checking disabled flag in query)
+[no]class (Control display of class in records)
+[no]cmd (Control display of command line)
+[no]comments (Control display of comment lines)
+[no]cookie (Add a COOKIE option to the request)
+[no]crypto (Control display of cryptographic fields in records)
+[no]defname (Use search list (+[no]search))
+[no]dnssec (Request DNSSEC records)
+domain=### (Set default domainname)
+[no]dscp[=###] (Set the DSCP value to ### [0..63])
+[no]edns[=###] (Set EDNS version) [0]
+ednsflags=### (Set EDNS flag bits)
+[no]ednsnegotiation (Set EDNS version negotiation)
+ednsopt=###[:value] (Send specified EDNS option)
+noednsopt (Clear list of +ednsopt options)
+[no]expire (Request time to expire)
+[no]fail (Don't try next server on SERVFAIL)
+[no]header-only (Send query without a question section)
+[no]identify (ID responders in short answers)
+[no]idnout (convert IDN response)
+[no]ignore (Don't revert to TCP for TC responses.)
+[no]keepopen (Keep the TCP socket open between queries)
+[no]mapped (Allow mapped IPv4 over IPv6)
+[no]multiline (Print records in an expanded format)
+ndots=### (Set search NDOTS value)
+[no]nsid (Request Name Server ID)
+[no]nssearch (Search all authoritative nameservers)
+[no]onesoa (AXFR prints only one soa record)
+[no]opcode=### (Set the opcode of the request)
+[no]qr (Print question before sending)
+[no]question (Control display of question section)
+[no]rdflag (Recursive mode (+[no]recurse))
+[no]recurse (Recursive mode (+[no]rdflag))
+retry=### (Set number of UDP retries) [2]
+[no]rrcomments (Control display of per-record comments)
+[no]search (Set whether to use searchlist)
+[no]short (Display nothing except short
form of answer)
+[no]showsearch (Search with intermediate results)
+[no]sigchase (Chase DNSSEC signatures)
+[no]split=## (Split hex/base64 fields into chunks)
+[no]stats (Control display of statistics)
+subnet=addr (Set edns-client-subnet option)
+[no]tcp (TCP mode (+[no]vc))
+timeout=### (Set query timeout) [5]
+[no]topdown (Do +sigchase in top-down mode)
+[no]trace (Trace delegation down from root [+dnssec])
+trusted-key=#### (Trusted Key to use with +sigchase)
+tries=### (Set number of UDP attempts) [3]
+[no]ttlid (Control display of ttls in records)
+[no]ttlunits (Display TTLs in human-readable units)
+[no]unknownformat (Print RDATA in RFC 3597 "unknown" format)
+[no]vc (TCP mode (+[no]tcp))
+[no]zflag (Set Z flag in query)
global d-opts and servers (before host name) affect all queries.
local d-opts and servers (after host name) affect only that lookup.
-h (print help and exit)
-v (print version and exit)
root@kali:~# host -h
host: illegal option -- h
Usage: host [-aCdilrTvVw] [-c class] [-N ndots] [-t type] [-W time]
[-R number] [-m flag] hostname [server]
-a is equivalent to -v -t ANY
-c specifies query class for non-IN data
-C compares SOA records on authoritative nameservers
-d is equivalent to -v
-i IP6.INT reverse lookups
-l lists all hosts in a domain, using AXFR
-m set memory debugging flag (trace|record|usage)
-N changes the number of dots allowed before root lookup is done
-r disables recursive processing
-R specifies number of retries for UDP packets
-s a SERVFAIL response should stop query
-t specifies the query type
-T enables TCP/IP mode
-v enables verbose output
-V print version number and exit
-w specifies to wait forever for a reply
-W specifies how long to wait for a reply
-4 use IPv4 query transport only
-6 use IPv6 query transport only
扫一扫
1100
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
