tcpdump nc tcpdump使用简介使用简介

最新推荐文章于 2022-07-21 16:52:33 发布

kc87654321

最新推荐文章于 2022-07-21 16:52:33 发布

阅读量586

点赞数

SmartSniff 过滤器的规则

[require|exclude] : [local|remote|both] : [tcp|udp|tcpudp|icmp|all] : [IP Range|Ports Range]
[显示|排除] : [本地|远程|双向] : [tcp|udp|tcpudp|icmp|all] : [ip地址范围|端口范围]

  
  
   
   监听
   
   nc -l 8888
nc -k -l 8888 # 持续监听

   
   连接
   
   nc 127.0.0.1 8888

   
   检查端口
   
   nc -v -w 5 127.0.0.1 8888

   
   端口扫描
   
   nc -v -w 2 -z 127.0.0.1 20-80 # -w 超时时间 -z 发送0值
nc -u -v -w 2 -z 127.0.0.1 20-80 # udp

   
   文件传输
   
   nc -l 8888 > data.gz
nc 127.0.0.1 8888 < data.gz

   
   多个文件或大文件传输
   
   nc -l 8888 | tar -C /www -xz
tar cz /www | nc 127.0.0.1 8888

   
   加密传输
   
   nc -l 8888 | openssl enc -aes-256-cbc -d -pass pass:dotcoo | tar -C /www -xz
tar cz /www | openssl enc -aes-256-cbc -pass pass:dotcoo | nc 127.0.0.1 8888

   
   发送/接收
   
   while true ; do date "+%Y-%m-%d %H:%M:%D"; done | nc 127.0.0.1 8888
nc -k -l 8888 | while read line ; do echo $line; done

   
   请求/响应
   
   mkfifo msg & tail -f msg | nc -k -l 8888 | while read req; do echo Request ":" $req ; echo world > msg; echo Response ":" world; done
echo hello | nc 127.0.0.1 8888

   
   广播/订阅
   
   # 广播 用golang 或 nodejs实现比较好
nc 127.0.0.1 8888 | while read line ; do echo $line; done # 订阅 

cat list.txt | while read host port ; do echo close | nc $host $port; done # 广播
nc -k -l 8888 | while read line ; do echo $line; done # 订阅

   
   复杂远程调用
   
   cat << EOF | nc 127.0.0.1 80
GET / HTTP/1.1
Host: 127.0.0.1

EOF

  
   
  
  
   
   指定网卡
   
   tcpdump -i lo

   
   指定IP
   
   tcpdump host 192.168.1.101

   
   指定通讯双方IP
   
   tcpdump host 192.168.1.101 and \(192.168.1.102 or 192.168.1.103\)

   
   排除IP
   
   tcpdump host 192.168.1.102 and not 192.168.1.103

   
   来源IP
   
   tcpdump src host 192.168.1.102

   
   目标IP
   
   tcpdump dst host 192.168.1.102

   
   指定端口
   
   tcpdump port 80

   
   TCP数据
   
   tcpdump tcp

   
   UDP数据
   
   tcpdump udp

   
   打印数据包内容
   
   tcpdump -A

   
   写入文件
   
   tcpdump -w data.pcap

   
   读取文件
   
   tcpdump -r data.pcap

   
   显示IP不显示域名
   
   tcpdump -n

   
   HTTP请求
   
   sudo tcpdump -Xs 0 \(tcp[20:4]=0x47455420 or tcp[20:4]=0x504f5354 or tcp[20:4]=0x48545450\) and host 192.168.1.120 and port 80
sudo tcpdump -Xs 0 -i lo0 \(tcp[20:4]=0x47455420 or tcp[20:4]=0x504f5354 or tcp[20:4]=0x48545450\)

   
   GUI工具
   
   CocoaPacketAnalyzer
SmartSniff
Wireshark

   
   更多参考
   
   http://drops.wooyun.org/%E8%BF%90%E7%BB%B4%E5%AE%89%E5%85%A8/8885