网络安全工具篇3--信息收集篇3

我是K，我致力于网络安全。

在之前的学习中，我们已经学习了一些有关网络安全的工具的使用，我们今天继续讲一些有关网络安全信息收集工具的使用。今天我们讲的是信息收集工具中，用于情报分析的工具。

1. spiderfoot

1.1 简介

spiderfoot 是一款侦察工具，可自动查询 100 多个公共数据源 (OSINT)，以收集有关 IP 地址、域名、电子邮件地址、姓名等的情报。您只需指定要调查的目标，选择要启用的模块，然后 SpiderFoot 将收集数据展示给你。SpiderFoot 将扫描返回的数据将揭示有关目标的大量信息，从而深入了解可能的数据泄漏、漏洞或其他敏感信息。在渗透测试和HW行动等红蓝攻防对抗的场景中被大量使用。大家也可以在自己的网络中尝试一下，看看自己在网络上暴露了什么信息。

1.2 参数

  -h, --help            show this help message and exit
  -d, --debug           Enable debug output.
  -l IP:poot            IP and port to listen on.
  -m mod1,mod2,...      Modules to enable.
  -M, --modules         List available modules.
  -C scanID, --correlate scan ID
                        Run correlation rules against a scan ID.
  -s TARGET             Target for the scan.
  -t type1,type2,...    Event types to collect(modules selected automatically).
  -u {all,footprint,investigate,passive}
                        Select modules automatically by use case
  -T, --types           List available event types.
  -o {tab,csv,json}     Output format. Tab is default.
  -H                    Don't print filed headers,just data.
  -n                    Strip newlines from data.
  -r                    Include the source data filed in tab/csv output
  -S LENGTH             Maximum data length to display .By default,all data is shown.
  -D DELIMITER          Delimiter to use for CSV output. Default is ,.
  -f                    Filter out other event types that weren't requested with -t.
  -F ytpe1,type2,...    Show only a set of event types, comma-separated.
  -x                    STRICT MODE.Will only enable modules that can direcyly consume 
                        your target, and if -t was specified only those events will be 
                        consume by modules. This overrides -t and -m options.
  -q                    Display logging. This will also hide errors!
  -V, --version         Display the version of Spiderfoot and exit.
  -max-threads MAX_THREADS
                        Max number of modules to run concurrently.

1.3 实例

（1）spiderfoot -h

  -h, --help            show this help message and exit
  -d, --debug           Enable debug output.
  -l IP:poot            IP and port to listen on.
  -m mod1,mod2,...      Modules to enable.
  -M, --modules         List available modules.
  -C scanID, --correlate scan ID
                        Run correlation rules against a scan ID.
  -s TARGET             Target for the scan.
  -t type1,type2,...    Event types to collect(modules selected automatically).
  -u {all,footprint,investigate,passive}
                        Select modules automatically by use case
  -T, --types           List available event types.
  -o {tab,csv,json}     Output format. Tab is default.
  -H                    Don't print filed headers,just data.
  -n                    Strip newlines from data.
  -r                    Include the source data filed in tab/csv output
  -S LENGTH             Maximum data length to display .By default,all data is shown.
  -D DELIMITER          Delimiter to use for CSV output. Default is ,.
  -f                    Filter out other event types that weren't requested with -t.
  -F ytpe1,type2,...    Show only a set of event types, comma-separated.
  -x                    STRICT MODE.Will only enable modules that can direcyly consume 
                        your target, and if -t was specified only those events will be 
                        consume by modules. This overrides -t and -m options.
  -q                    Display logging. This will also hide errors!
  -V, --version         Display the version of Spiderfoot and exit.
  -max-threads MAX_THREADS
                        Max number of modules to run concurrently.

（2）spiderfoot -d

spiderfoot -d sqlite:///sfdb.sqlite