信息收集工具

已于 2022-05-27 11:44:19 修改
阅读量3.5k 收藏 6
点赞数
分类专栏： Kali主机 文章标签： 网络 tcp/ip 网络协议
于 2022-05-12 00:01:41 首次发布
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-NC-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/u012391293/article/details/124722099
版权

基本扫描工具

Fping

Usage: fping [options][targets…]][targets…]

ping选项:

-4，——ipv4只ping ipv4地址

-6，——ipv6只ping ipv6地址

-b，——size=要发送的ping数据的字节数，以字节为单位(默认:56)

-B，——backoff=N设置指数回退因子为N(默认为1.5)

-c，——count=N count模式:向每个目标发送N次ping

-f，——file=从文件中读取目标文件列表(-表示stdin)

-g，——generate生成目标列表(仅当没有指定-f时)

(在目标列表中给出起始和结束IP，或CIDR地址)

(如fping -g 192.168.1.0 192.168.1.255或fping -g 192.168.1.0/24)

-H，——ttl=N设置IP的ttl值(Time To Live hops)

-I，——iface= iface绑定到特定接口

-l，——loop循环模式:永远发送ping

-m，——all使用所提供主机名的所有ip(例如IPv4和IPv6)，与-A一起使用

-M，——dontfrag设置不分片标志

-O，——tos=N设置ICMP报文的服务类型tos标志

-p，——period= ping包到一个目标的MSEC间隔(毫秒)

(在循环和计数模式下，默认:1000毫秒)

-r，——retry=N次重试(默认为3次)

-R，——随机随机包数据(以防止链路数据压缩)

-S，——src=IP设置源地址

-t，——timeout=MSEC单个目标初始超时(默认:500毫秒，

除了-l/-c/ -c，这里是-p周期到2000毫秒)



输出选项:

-a，——活着展示活着的目标

-A，——addr按地址显示目标

-C，——vcount=N与-C相同，以详细格式报告结果

-D，——timestamp在每个输出行之前打印时间戳

-e，——elapsed显示返回数据包占用的时间

-i，——interval=发送ping包的MSEC间隔时间(默认为10毫秒)

-n，——name按名称显示目标(-d等效)

-N，——netdata输出兼容netdata(必须是-l -Q)

-o，——宕机显示累计宕机时间(丢失包*包间隔)

-q， -安静安静(不显示每个目标/每坪的结果)

-Q，——squiet=SECS，与-Q相同，但每n秒显示一次汇总信息

-s，——stats打印最终数据

-u，——unreach显示不可达的目标

-v，——version显示版本号

-x，——reachable=N表示>=N个主机是否可达

例子
fping -g 172.16.10.10 172.16.10.30 -a -q

nping

Usage: nping [Probe mode][Options] {target specification}

nping -c 1 -p 23 172.16.10.9-11 --tcp

Starting Nping 0.7.91 ( https://nmap.org/nping ) at 2022-05-11 20:45 CST
SENT (0.0344s) TCP 192.168.8.106:23149 > 172.16.10.9:23 S ttl=64 id=8961 iplen=40  seq=4148311577 win=1480 
SENT (1.0363s) TCP 192.168.8.106:23149 > 172.16.10.10:23 S ttl=64 id=8961 iplen=40  seq=4148311577 win=1480 
SENT (2.0382s) TCP 192.168.8.106:23149 > 172.16.10.11:23 S ttl=64 id=8961 iplen=40  seq=4148311577 win=1480 
RCVD (2.0423s) TCP 172.16.10.11:23 > 192.168.8.106:23149 RA ttl=253 id=45998 iplen=40  seq=0 win=0 
 
Statistics for host 172.16.10.9:
 |  Probes Sent: 1 | Rcvd: 0 | Lost: 1  (100.00%)
 |_ Max rtt: N/A | Min rtt: N/A | Avg rtt: N/A
Statistics for host 172.16.10.10:
 |  Probes Sent: 1 | Rcvd: 0 | Lost: 1  (100.00%)
 |_ Max rtt: N/A | Min rtt: N/A | Avg rtt: N/A
Statistics for host 172.16.10.11:
 |  Probes Sent: 1 | Rcvd: 1 | Lost: 0  (0.00%)
 |_ Max rtt: 3.829ms | Min rtt: 3.829ms | Avg rtt: 3.829ms
Raw packets sent: 3 (120B) | Rcvd: 1 (46B) | Lost: 2 (66.67%)
Nping done: 3 IP addresses pinged in 2.08 seconds

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-6ljBl3xt-1652284816349)(…/…/图片/typora/1652273175795.png)]

arping

arping  192.168.8.105 -c 1
ARPING 192.168.8.105
60 bytes from 8c:16:45:de:c2:0d (192.168.8.105): index=0 time=38.703 usec

--- 192.168.8.105 statistics ---
1 packets transmitted, 1 packets received,   0% unanswered (0 extra)
rtt min/avg/max/std-dev = 0.039/0.039/0.039/0.000 ms

nbtscan

Usage:
nbtscan [-v] [-d] [-e] [-l] [-t timeout] [-b bandwidth] [-r] [-q] [-s separator] [-m retransmits] (-f filename)|(<scan_range>) 


 nbtscan -r 192.168.1.0/24
                Scans the whole C-class network.
        nbtscan 192.168.1.25-137
                Scans a range from 192.168.1.25 to 192.168.1.137
        nbtscan -v -s : 192.168.1.0/24
                Scans C-class network. Prints results in script-friendly
                format using colon as field separator.
                Produces output like that:
                192.168.0.1:NT_SERVER:00U
                192.168.0.1:MY_DOMAIN:00G
                192.168.0.1:ADMINISTRATOR:03U
                192.168.0.2:OTHER_BOX:00U
                ...
        nbtscan -f iplist
                Scans IP addresses specified in file iplist.


nbtscan 192.168.8.105                
Doing NBT name scan for addresses from 192.168.8.105

IP address       NetBIOS Name     Server    User             MAC address      
------------------------------------------------------------------------------
192.168.8.105    LAPTOP-ORJB0FKO  <server>  <unknown>        8c:16:45:de:c2:0d

# nbtscan -hv 172.16.237.1                                                                                                                                      
Doing NBT name scan for addresses from 172.16.237.1


NetBIOS Name Table for Host 172.16.237.1:

Incomplete packet, 191 bytes long.
Name             Service          Type             
----------------------------------------
ADSH01           Workstation Service
SMVIC            Domain Name
SMVIC            Domain Controllers
ADSH01           File Server Service
SMVIC            Domain Master Browser

Adapter address: 24:a5:2c:06:e2:05

onesixtyone 破解SNMP

onesixtyone -c dict.txt 172.16.190.2 -d
Debug level 1
Target ip read from command line: 172.16.190.2
Using community file dict.txt
4 communities: Sjzx@201909! admin@123 %^%#_yE+4zDbwE3(f1#KzJK3k3D\6jd 
Waiting for 10 milliseconds between packets
Scanning 1 hosts, 4 communities
Trying community Sjzx@201909!
Trying community admin@123
Trying community %^%#_yE+4zDbwE3(f1#KzJK3k3D\6jd
Trying community 
All packets sent, waiting for responses.
done.

NMAP

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-GbPoecyr-1652284816350)(../../图片/typora/1652274466694.png)]

Usage: nmap [Scan Type(s)] [Options] {target specification}

TARGET SPECIFICATION:
  Can pass hostnames, IP addresses, networks, etc.
  Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
  -iL <inputfilename>: Input from list of hosts/networks
  -iR <num hosts>: Choose random targets
  --exclude <host1[,host2][,host3],...>: Exclude hosts/networks
  --excludefile <exclude_file>: Exclude list from file
HOST DISCOVERY:
  -sL: List Scan - simply list targets to scan
  -sn: Ping Scan - disable port scan
  -Pn: Treat all hosts as online -- skip host discovery
  -PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports
  -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
  -PO[protocol list]: IP Protocol Ping
  -n/-R: Never do DNS resolution/Always resolve [default: sometimes]
  --dns-servers <serv1[,serv2],...>: Specify custom DNS servers
  --system-dns: Use OS's DNS resolver
  --traceroute: Trace hop path to each host
SCAN TECHNIQUES:
  -sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
  -sU: UDP Scan
  -sN/sF/sX: TCP Null, FIN, and Xmas scans
  --scanflags <flags>: Customize TCP scan flags
  -sI <zombie host[:probeport]>: Idle scan
  -sY/sZ: SCTP INIT/COOKIE-ECHO scans
  -sO: IP protocol scan
  -b <FTP relay host>: FTP bounce scan
PORT SPECIFICATION AND SCAN ORDER:
  -p <port ranges>: Only scan specified ports
    Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9
  --exclude-ports <port ranges>: Exclude the specified ports from scanning
  -F: Fast mode - Scan fewer ports than the default scan
  -r: Scan ports consecutively - don't randomize
  --top-ports <number>: Scan <number> most common ports
  --port-ratio <ratio>: Scan ports more common than <ratio>
SERVICE/VERSION DETECTION:
  -sV: Probe open ports to determine service/version info
  --version-intensity <level>: Set from 0 (light) to 9 (try all probes)                                                                                                
  --version-light: Limit to most likely probes (intensity 2)                                                                                                           
  --version-all: Try every single probe (intensity 9)
  --version-trace: Show detailed version scan activity (for debugging)
SCRIPT SCAN:
  -sC: equivalent to --script=default
  --script=<Lua scripts>: <Lua scripts> is a comma separated list of
           directories, script-files or script-categories
  --script-args=<n1=v1,[n2=v2,...]>: provide arguments to scripts
  --script-args-file=filename: provide NSE script args in a file
  --script-trace: Show all data sent and received
  --script-updatedb: Update the script database.
  --script-help=<Lua scripts>: Show help about scripts.
           <Lua scripts> is a comma-separated list of script-files or
           script-categories.
OS DETECTION:
  -O: Enable OS detection
  --osscan-limit: Limit OS detection to promising targets
  --osscan-guess: Guess OS more aggressively
TIMING AND PERFORMANCE:
  Options which take <time> are in seconds, or append 'ms' (milliseconds),
  's' (seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m).
  -T<0-5>: Set timing template (higher is faster)
  --min-hostgroup/max-hostgroup <size>: Parallel host scan group sizes
  --min-parallelism/max-parallelism <numprobes>: Probe parallelization
  --min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <time>: Specifies
      probe round trip time.
  --max-retries <tries>: Caps number of port scan probe retransmissions.
  --host-timeout <time>: Give up on target after this long
  --scan-delay/--max-scan-delay <time>: Adjust delay between probes
  --min-rate <number>: Send packets no slower than <number> per second
  --max-rate <number>: Send packets no faster than <number> per second
FIREWALL/IDS EVASION AND SPOOFING:
  -f; --mtu <val>: fragment packets (optionally w/given MTU)
  -D <decoy1,decoy2[,ME],...>: Cloak a scan with decoys
  -S <IP_Address>: Spoof source address
  -e <iface>: Use specified interface
  -g/--source-port <portnum>: Use given port number
  --proxies <url1,[url2],...>: Relay connections through HTTP/SOCKS4 proxies
  --data <hex string>: Append a custom payload to sent packets
  --data-string <string>: Append a custom ASCII string to sent packets
  --data-length <num>: Append random data to sent packets
  --ip-options <options>: Send packets with specified ip options
  --ttl <val>: Set IP time-to-live field
  --spoof-mac <mac address/prefix/vendor name>: Spoof your MAC address
  --badsum: Send packets with a bogus TCP/UDP/SCTP checksum
OUTPUT:
  -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3,
     and Grepable format, respectively, to the given filename.
  -oA <basename>: Output in the three major formats at once
  -v: Increase verbosity level (use -vv or more for greater effect)
  -d: Increase debugging level (use -dd or more for greater effect)
  --reason: Display the reason a port is in a particular state
  --open: Only show open (or possibly open) ports
  --packet-trace: Show all packets sent and received
  --iflist: Print host interfaces and routes (for debugging)
  --append-output: Append to rather than clobber specified output files
  --resume <filename>: Resume an aborted scan
  --stylesheet <path/URL>: XSL stylesheet to transform XML output to HTML
  --webxml: Reference stylesheet from Nmap.Org for more portable XML
  --no-stylesheet: Prevent associating of XSL stylesheet w/XML output
MISC:
  -6: Enable IPv6 scanning
  -A: Enable OS detection, version detection, script scanning, and traceroute
  --datadir <dirname>: Specify custom Nmap data file location
  --send-eth/--send-ip: Send using raw ethernet frames or IP packets
  --privileged: Assume that the user is fully privileged
  --unprivileged: Assume the user lacks raw socket privileges
  -V: Print version number
  -h: Print this help summary page.
EXAMPLES:
  nmap -v -A scanme.nmap.org
  nmap -v -sn 192.168.0.0/16 10.0.0.0/8
  nmap -v -iR 10000 -Pn -p 80
SEE THE MAN PAGE (https://nmap.org/book/man.html) FOR MORE OPTIONS AND EXAMPLES

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-MuhaBCqj-1652284816351)(../../图片/typora/1652274699562.png)]

#nmap  -sS 192.168.8.1   
Starting Nmap 7.91 ( https://nmap.org ) at 2022-05-11 21:15 CST
Nmap scan report for homerouter.cpe (192.168.8.1)
Host is up (0.0023s latency).
Not shown: 997 closed ports
PORT    STATE SERVICE
53/tcp  open  domain
80/tcp  open  http
443/tcp open  https
MAC Address: 20:DA:22:32:D4:1E (Huawei Technologies)

Nmap done: 1 IP address (1 host up) scanned in 0.29 seconds
 
# nmap -sT 192.168.8.1
Starting Nmap 7.91 ( https://nmap.org ) at 2022-05-11 21:48 CST
Nmap scan report for homerouter.cpe (192.168.8.1)
Host is up (0.0075s latency).
Not shown: 997 closed ports
PORT    STATE SERVICE
53/tcp  open  domain
80/tcp  open  http
443/tcp open  https
MAC Address: 20:DA:22:32:D4:1E (Huawei Technologies)

Nmap done: 1 IP address (1 host up) scanned in 0.22 seconds
                                                                                                 
# nmap -sF 192.168.8.105
Starting Nmap 7.91 ( https://nmap.org ) at 2022-05-11 21:53 CST
Nmap scan report for LAPTOP-ORJB0FKO (192.168.8.105)
Host is up (0.00012s latency).
All 1000 scanned ports on LAPTOP-ORJB0FKO (192.168.8.105) are open|filtered
MAC Address: 8C:16:45:DE:C2:0D (Lcfc(hefei) Electronics Technology)

Nmap done: 1 IP address (1 host up) scanned in 21.63 seconds

# nmap -sU 192.168.8.105
Starting Nmap 7.91 ( https://nmap.org ) at 2022-05-11 21:51 CST
Nmap scan report for LAPTOP-ORJB0FKO (192.168.8.105)
Host is up (0.00016s latency).
All 1000 scanned ports on LAPTOP-ORJB0FKO (192.168.8.105) are open|filtered
MAC Address: 8C:16:45:DE:C2:0D (Lcfc(hefei) Electronics Technology)

Nmap done: 1 IP address (1 host up) scanned in 21.63 seconds
                                                                                         .168.8.105
Starting Nmap 7.91 ( https://nmap.org ) at 2022-05-11 21:53 CST
Nmap scan report for LAPTOP-ORJB0FKO (192.168.8.105)
Host is up (0.00012s latency).
All 1000 scanned ports on LAPTOP-ORJB0FKO (192.168.8.105) are open|filtered
MAC Address: 8C:16:45:DE:C2:0D (Lcfc(hefei) Electronics Technology)

Nmap done: 1 IP address (1 host up) scanned in 21.63 seconds

nmap -sV 172.16.223.90                
Starting Nmap 7.91 ( https://nmap.org ) at 2022-05-11 21:55 CST
Nmap scan report for 172.16.223.90
Host is up (0.0061s latency).
Not shown: 986 closed ports
PORT     STATE SERVICE    VERSION
22/tcp   open  ssh        OpenSSH 8.0 (protocol 2.0)
80/tcp   open  http       nginx 1.20.1
111/tcp  open  rpcbind    2-4 (RPC #100000)
443/tcp  open  ssl/http   nginx 1.20.1
5222/tcp open  jabber
7070/tcp open  http       nginx 1.20.1
8001/tcp open  http       nginx 1.20.1
8080/tcp open  http       nginx 1.20.1
8081/tcp open  http       nginx 1.20.1
8088/tcp open  http       nginx 1.20.1
8090/tcp open  http       nginx 1.20.1
9002/tcp open  http       nginx 1.20.1
9003/tcp open  http       nginx 1.20.1
9100/tcp open  jetdirect?
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port5222-TCP:V=7.91%I=7%D=5/11%Time=627BC081%P=x86_64-pc-linux-gnu%r(RP
SF:CCheck,9B,"<stream:error\x20xmlns:stream=\"http://etherx\.jabber\.org/s
SF:treams\"><not-well-formed\x20xmlns=\"urn:ietf:params:xml:ns:xmpp-stream
SF:s\"/></stream:error></stream:stream>");

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 45.34 seconds


nmap -A 172.16.10.136
Starting Nmap 7.91 ( https://nmap.org ) at 2022-05-11 21:57 CST
Nmap scan report for 172.16.10.136
Host is up (0.0019s latency).
Not shown: 997 closed ports
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.4p1 Debian 10+deb9u7 (protocol 2.0)
| ssh-hostkey: 
|   2048 10:63:66:e3:bd:bb:9a:87:64:22:de:27:0e:1d:b4:b7 (RSA)
|   256 19:30:6f:fd:fe:aa:69:22:65:6e:00:77:19:a6:ad:f6 (ECDSA)
|_  256 2a:ae:47:01:f9:54:7b:32:f3:2a:b8:ff:88:2b:d0:e3 (ED25519)
53/tcp   open  domain  (unknown banner: none)
| dns-nsid: 
|_  bind.version: none
| fingerprint-strings: 
|   DNSVersionBindReqTCP: 
|     version
|     bind
|_    none
7911/tcp open  omapi   ISC (BIND|DHCPD) OMAPI
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port53-TCP:V=7.91%I=7%D=5/11%Time=627BC0D8%P=x86_64-pc-linux-gnu%r(DNSV
SF:ersionBindReqTCP,3F,"\0=\0\x06\x85\0\0\x01\0\x01\0\x01\0\0\x07version\x
SF:04bind\0\0\x10\0\x03\xc0\x0c\0\x10\0\x03\0\0\0\0\0\x05\x04none\xc0\x0c\
SF:0\x02\0\x03\0\0\0\0\0\x02\xc0\x0c");
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
#系统指纹
OS:SCAN(V=7.91%E=4%D=5/11%OT=22%CT=1%CU=43858%PV=Y%DS=3%DC=T%G=Y%TM=627BC0F
OS:C%P=x86_64-pc-linux-gnu)SEQ(SP=FC%GCD=1%ISR=10D%TI=Z%CI=Z%II=I%TS=8)OPS(
OS:O1=M584ST11NW7%O2=M584ST11NW7%O3=M584NNT11NW7%O4=M584ST11NW7%O5=M584ST11
OS:NW7%O6=M584ST11)WIN(W1=7120%W2=7120%W3=7120%W4=7120%W5=7120%W6=7120)ECN(
OS:R=Y%DF=Y%T=40%W=7210%O=M584NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS
OS:%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=
OS:Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=
OS:R%O=%RD=0%Q=)T7(R=N)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%R
OS:UCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)

Network Distance: 3 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 80/tcp)
HOP RTT     ADDRESS
1   1.43 ms homerouter.cpe (192.168.8.1)
2   3.44 ms 10.232.101.254
3   1.91 ms 172.16.10.136

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 59.47 seconds

DNS信息收集

whois

whois baid.com 
   Domain Name: BAID.COM
   Registry Domain ID: 27507695_DOMAIN_COM-VRSN
   Registrar WHOIS Server: whois.godaddy.com
   Registrar URL: http://www.godaddy.com
   Updated Date: 2021-11-16T05:56:15Z
   Creation Date: 2000-05-20T10:21:11Z
   Registry Expiry Date: 2024-05-20T10:21:11Z
   Registrar: GoDaddy.com, LLC
   Registrar IANA ID: 146
   Registrar Abuse Contact Email: abuse@godaddy.com
   Registrar Abuse Contact Phone: 480-624-2505
   Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
   Domain Status: clientRenewProhibited https://icann.org/epp#clientRenewProhibited
   Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
   Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
   Name Server: NS1.DNSYUN.VIP
   Name Server: NS2.DNSCLOUDVIP.COM
   DNSSEC: unsigned
   URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
>>> Last update of whois database: 2022-05-11T14:41:06Z <<<

For more information on Whois status codes, please visit https://icann.org/epp

NOTICE: The expiration date displayed in this record is the date the
registrar's sponsorship of the domain name registration in the registry is
currently set to expire. This date does not necessarily reflect the expiration
date of the domain name registrant's agreement with the sponsoring
registrar.  Users may consult the sponsoring registrar's Whois database to
view the registrar's reported date of expiration for this registration.

TERMS OF USE: You are not authorized to access or query our Whois
database through the use of electronic processes that are high-volume and
automated except as reasonably necessary to register domain names or
modify existing registrations; the Data in VeriSign Global Registry
Services' ("VeriSign") Whois database is provided by VeriSign for
information purposes only, and to assist persons in obtaining information
about or related to a domain name registration record. VeriSign does not
guarantee its accuracy. By submitting a Whois query, you agree to abide
by the following terms of use: You agree that you may use this Data only
for lawful purposes and that under no circumstances will you use this Data
to: (1) allow, enable, or otherwise support the transmission of mass
unsolicited, commercial advertising or solicitations via e-mail, telephone,
or facsimile; or (2) enable high volume, automated, electronic processes
that apply to VeriSign (or its computer systems). The compilation,
repackaging, dissemination or other use of this Data is expressly
prohibited without the prior written consent of VeriSign. You agree not to
use electronic processes that are automated and high-volume to access or
query the Whois database except as reasonably necessary to register
domain names or modify existing registrations. VeriSign reserves the right
to restrict your access to the Whois database in its sole discretion to ensure
operational stability.  VeriSign may restrict or terminate your access to the
Whois database for failure to abide by these terms of use. VeriSign
reserves the right to modify these terms at any time.

The Registry database contains ONLY .COM, .NET, .EDU domains and
Registrars.
Domain Name: baid.com
Registry Domain ID: 27507695_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.godaddy.com
Registrar URL: https://www.godaddy.com
Updated Date: 2021-03-28T23:56:03Z
Creation Date: 2000-05-20T05:21:11Z
Registrar Registration Expiration Date: 2024-05-20T05:21:11Z
Registrar: GoDaddy.com, LLC
Registrar IANA ID: 146
Registrar Abuse Contact Email: abuse@godaddy.com
Registrar Abuse Contact Phone: +1.4806242505
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
Domain Status: clientRenewProhibited https://icann.org/epp#clientRenewProhibited
Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Registrant Organization:
Registrant State/Province: TAIBEI
Registrant Country: CN
Registrant Email: Select Contact Domain Holder link at https://www.godaddy.com/whois/results.aspx?domain=baid.com
Tech Email: Select Contact Domain Holder link at https://www.godaddy.com/whois/results.aspx?domain=baid.com
Admin Email: Select Contact Domain Holder link at https://www.godaddy.com/whois/results.aspx?domain=baid.com
Name Server: NS1.DNSYUN.VIP
Name Server: NS2.DNSCLOUDVIP.COM
DNSSEC: unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
>>> Last update of WHOIS database: 2022-05-11T14:41:23Z <<<
For more information on Whois status codes, please visit https://icann.org/epp

TERMS OF USE: The data contained in this registrar's Whois database, while believed by the
registrar to be reliable, is provided "as is" with no guarantee or warranties regarding its
accuracy. This information is provided for the sole purpose of assisting you in obtaining
information about domain name registration records. Any use of this data for any other purpose
is expressly forbidden without the prior written permission of this registrar. By submitting
an inquiry, you agree to these terms and limitations of warranty. In particular, you agree not
to use this data to allow, enable, or otherwise support the dissemination or collection of this
data, in part or in its entirety, for any purpose, such as transmission by e-mail, telephone,
postal mail, facsimile or other means of mass unsolicited, commercial advertising or solicitations
of any kind, including spam. You further agree not to use this data to enable high volume, automated
or robotic electronic processes designed to collect or compile this data for any purpose, including
mining this data for your own personal or commercial purposes. Failure to comply with these terms
may result in termination of access to the Whois database. These terms may be subject to modification
at any time without notice.

fierce、dnsrecon dnsenum

#fierce --domain baidu.com                                                              130 ⨯
NS: ns4.baidu.com. ns2.baidu.com. ns3.baidu.com. dns.baidu.com. ns7.baidu.com.
SOA: dns.baidu.com. (110.242.68.134)
Zone: failure
Wildcard: failure
Found: 0.baidu.com. (180.149.144.203)
Found: 01.baidu.com. (124.237.176.247)
Found: 11.baidu.com. (182.61.62.50)
Found: 8.baidu.com. (220.181.33.181)
Found: a.baidu.com. (112.80.248.124)


#dnsenum VERSION:1.2.6

-----   baidu.com   -----                                                                        
                                                                                                 
                                                                                                 
Host's addresses:                                                                                
__________________                                                                               
                                                                                                 
baidu.com.                               40       IN    A        220.181.38.251                  
baidu.com.                               40       IN    A        220.181.38.148

                                                                                                 
Name Servers:                                                                                    
______________                                                                                   
                                                                                                 
dns.baidu.com.                           289      IN    A        110.242.68.134                  
ns3.baidu.com.                           312      IN    A        112.80.248.64
ns4.baidu.com.                           923      IN    A        14.215.178.80
ns7.baidu.com.                           1925     IN    A        180.76.76.92
ns2.baidu.com.                           1985     IN    A        220.181.33.31

                                                                                                 
Mail (MX) Servers:                                                                               
___________________                                                                              
                                                                                                 
mx.maillb.baidu.com.                     1        IN    A        111.202.115.85                  
mx50.baidu.com.                          1        IN    A        12.0.243.41
mx.n.shifen.com.                         56       IN    A        220.181.3.85
mx.n.shifen.com.                         56       IN    A        220.181.50.185
mx1.baidu.com.                           1        IN    A        111.202.115.85
mx1.baidu.com.                           1        IN    A        220.181.3.85
jpmx.baidu.com.                          1        IN    A        119.63.196.201
usmx01.baidu.com.                        3210     IN    A        12.0.243.41

                                                                                                 
Trying Zone Transfers and getting Bind Versions:                                                 
_________________________________________________                                                
                                                                                                 
                                                                                                 
Trying Zone Transfer for baidu.com on dns.baidu.com ... 
AXFR record query failed: REFUSED

Trying Zone Transfer for baidu.com on ns3.baidu.com ... 
AXFR record query failed: REFUSED

Trying Zone Transfer for baidu.com on ns4.baidu.com ... 
AXFR record query failed: REFUSED

Trying Zone Transfer for baidu.com on ns7.baidu.com ... 
AXFR record query failed: REFUSED

Trying Zone Transfer for baidu.com on ns2.baidu.com ... 
AXFR record query failed: REFUSED

                                                                                                 
Brute forcing with /usr/share/dnsenum/dns.txt:                                                   
_______________________________________________                                                  
                                                                                                 
11.baidu.com.                            1        IN    CNAME    jpaasmatrix.e.shifen.com.       
jpaasmatrix.e.shifen.com.                1        IN    CNAME    domain-offline.baidu.com.
domain-offline.baidu.com.                1        IN    A        182.61.62.50






# dnsrecon -d baidu.com                                                                    2 ⨯
[*] Performing General Enumeration of Domain: baidu.com
[-] DNSSEC is not configured for baidu.com
[*]      SOA dns.baidu.com 110.242.68.134
[*]      NS ns4.baidu.com 14.215.178.80
[*]      NS ns2.baidu.com 220.181.33.31
[*]      NS ns3.baidu.com 112.80.248.64
[*]      NS dns.baidu.com 110.242.68.134
[*]      NS ns7.baidu.com 180.76.76.92
[*]      NS ns7.baidu.com 240e:bf:b801:1002:0:ff:b024:26de
[*]      NS ns7.baidu.com 240e:940:603:4:0:ff:b01b:589a
[*]      MX mx.maillb.baidu.com 111.202.115.85
[*]      MX mx50.baidu.com 12.0.243.41
[*]      MX usmx01.baidu.com 12.0.243.41
[*]      MX mx1.baidu.com 220.181.3.85
[*]      MX mx1.baidu.com 111.202.115.85
[*]      MX mx.n.shifen.com 220.181.50.185
[*]      MX mx.n.shifen.com 220.181.3.85
[*]      MX jpmx.baidu.com 119.63.196.201
[*]      A baidu.com 220.181.38.148
[*]      A baidu.com 220.181.38.251
[*] Enumerating SRV Records

路由信息手机

netdiscover

Usage: netdiscover [-i device] [-r range | -l file | -p] [-m file] [-F filter] [-s time] [-c count] [-n node] [-dfPLNS]

 ┌──(root💀VM-Kali)-[~]
└─# netdiscover -i eth0                                                                   
 Currently scanning: 192.168.24.0/16   |   Screen View: Unique Hosts                            
                                                                                                
 21 Captured ARP Req/Rep packets, from 2 hosts.   Total size: 1260                              
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
 -----------------------------------------------------------------------------
 192.168.8.1     20:da:22:32:d4:1e     20    1200  HUAWEI TECHNOLOGIES CO.,LTD                  
 192.168.8.105   8c:16:45:de:c2:0d      1      60  LCFC(HeFei) Electronics Technology co., ltd

netmask

┌──(root💀VM-Kali)-[~]
└─# netmask -r 172.16.10.0/24
    172.16.10.0-172.16.10.255   (256)
                                                                                                 
┌──(root💀VM-Kali)-[~]
└─# netmask -v -r 172.16.10.0/24
netmask, version 2.4.4
                                                                                                 
┌──(root💀VM-Kali)-[~]
└─# netmask -o 172.16.10.0/24
025404005000/037777777400

智能信息收集

maltego

在这里插入图片描述

期待未来的男孩
关注
  • 0
    点赞
  • 踩
  • 6
    收藏
    觉得还不错? 一键收藏
  • 打赏
    打赏
  • 0
    评论
专栏目录
信息收集常用的工具
d1996a的博客
09-17 4455
信息收集一、对象二、网站操作类型识别方式三、网站指纹识别工具四、目录扫描/敏感文件扫描五、IP查询六、端口扫描七、whois查询八、子域名查询九、空间搜索引擎十、常见端口 一、对象 1.网站 ：源码 robots文件 后台登录 2.服务器 ：IP地址 服务器操作系统类型和版本 端口开放情况 3.管理员 ：个人信息 手机号 社交账号 常用密码 敏感数字 二、网站操作类型识别方式 windows ：不区分大小写 Linux ：区分大小写 三、网站指纹识别工具 御剑指纹识别 云悉在线指
信息收集工具总结
weixin_34358365的博客
12-02 460
DMitry（Deepmagic Information Gathering Tool）是一个一体化的信息收集工具。它可以用来收集以下信息：1.端口扫描2.whois主机IP和域名信息3.从Netcraft.com获取主机信息4.子域名5.域名中包含的邮件地址尽管这些信息可以在Kali中通过多种工具获取，但是使用DMitry可以将收集的信息保存在一个文件中，方便查看...
2024版最新超全信息收集工具（非常详细）零基础入门到精通，收藏这一篇就够了
最新发布
Python_0011的博客
07-12 2070
要说简单粗暴还是子域名枚举爆破，通过不断的拼接字典中的子域名前缀去枚举域名的A记录进行DNS解析，如果成功解析说明子域名存在。如xxx.com拼接前缀test组合成test.xxx.com，再对其进行验证。但是域名如果使用泛解析的话，则会导致所有的域名都能成功解析，使得子域名枚举变得不精准。nslookup验证下~泛解析域名，成功解析不存在的域名。普通解析，不存在的域名解析会失败。泛解析：使用通配符来匹配所有的子域名，从而实现所有的子级域名均指向相同网站空间。会存在域名劫持、域名恶意泛解析风险。
C#信息采集工具实现
wangxiaohigh
06-01 404
简单C#信息采集工具实现 最近想整只爬虫玩玩，顺便熟悉下正则表达式。 开发环境 vs2008 sql2000 实现方法如下 1.先抓取网页代码 2.通过正则匹配出你需要的内容 比如http://www.soso.com/q?w=%C4%E3%BA%C3&amp;pg=1 页面中 搜索结果的标题跟连接地址。具体可以根据你的需要填写合适的地址跟正则。 3.把匹配出的内容保存到数据...
信息搜集工具使用
秋水的博客
10-06 1287
首先说明一下，本章节介绍的工具都很简单 layer子域名收集工具 如果要使用自定义字典，请把字典文件命名为dic，放到跟程序同目录下，程序会自动加载字典。 如果没有自定义字典，程序会自动使用内置字典，内置字典总共两万多条数据，内容包括了常用子域名，以及3000+常用单词和1-3位所有字母。 如果要爆破二级以下域名，可以直接填入要爆破的子域名，程序会自动拼接下一级子域。比如填入hi.bai...
JS前端信息收集工具包
01-24
"JS前端信息收集工具包"正是一款专为此目的设计的实用资源。这个工具包包含了多种工具，可以帮助安全专家和研究人员快速有效地获取Web应用程序的前端信息，从而识别潜在的安全漏洞。 首先，我们来看jsfinder。这是...
信息收集工具browsinghistoryview.zip
05-28
《信息收集工具BrowsingHistoryView：揭示网络浏览历史的秘密》 在网络安全与信息调查领域，了解用户的网络浏览历史是一项至关重要的任务。BrowsingHistoryView就是这样一款实用的信息收集工具，它能够帮助用户或...
IP信息收集工具.zip
12-22
网络安全ip信息收集工具网络安全ip信息收集工具网络安全ip信息收集工具网络安全ip信息收集工具网络安全ip信息收集工具网络安全ip信息收集工具网络安全ip信息收集工具网络安全ip信息收集工具网络安全ip信息收集工具...
幼儿园学籍信息采集工具
09-24
幼儿园长登录后即可发布本园二维码或网址到家长手机，家长点开后即可填报小孩学籍信息。本工具支持即时查看填报进度，完成填报名单，一键导出所有学籍信息，完全符合全国学前教育管理信息系统导入模板。
URLfinder 信息收集工具
12-22
URLfinder是一款强大的信息收集工具，专为网络安全专业人士和研究人员设计，它在软件/插件类别中占据了一席之地。这款工具的核心功能在于帮助用户高效地挖掘和提取网络上的URL链接，从而进行深入的网络情报分析和...
信息收集工具Fastir_Collector-master.zip
05-28
信息收集工具Fastir_Collector-master.zip
最新，最牛的信息收集工具--MaltegoSetup.v4.2.13.13462
09-26
Maltego是国际知名的一款信息收集和分析工具，太强大，太牛了！kali自带的Maltego无法注册，因为无法显示验证码，
Web安全和渗透测试有什么关系？
Python_0011的博客
03-31 661
做渗透测试的一个环节就是测试web安全，需要明白漏洞产生原理，通过信息收集互联网暴露面，进行漏洞扫描，漏洞利用，必要时进行脚本自编写和手工测试，力求挖出目标存在的漏洞并提出整改建议，当然如果技术再精一些，还要学习内网渗透（工作组和域环境），白盒审计，app，小程序渗透那些了......可以说是最科学最系统的学习路线，大家跟着这个大的方向学习准没问题。当然除了有配套的视频，同时也为大家整理了各种文档和书籍资料&工具，并且已经帮大家分好类了。总之，web安全包含于渗透测试，但不是渗透测试的全部。
信息收集工具(kali 和 etc)
m0_61506558的博客
08-02 1195
使用NMAP，whataweb，nikto，Vulners，Hydra，SMBenum，dirbuster，sslyzer，2.中文翻译 https://github.com/Jack-Liang/kalitools。1.软件清单 https://tools.kali.org/tools-listing。子域，电子邮件地址，正常运行时间信息，tcp 端口扫描，whois。多线程perl脚本枚举域的DNS信息并发现非连续的IP段工具。将ARP和/或ICMP请求发送到指定的主机。信息收集和网络侦查工具。..
信息收集工具 -- Hacking-tools
weixin_41489908的博客
02-02 758
关于 Sublist115r Sublist115r是一个 python 工具，旨在使用 OSINT 枚举网站的子域。它帮助渗透测试人员和漏洞猎手收集和收集他们所针对的域的子域。Sublist115r 使用许多搜索引擎（例如 Google、Yahoo、Bing、Baidu 和 Ask）枚举子域。Sublist115r 还使用 Netcraft、Virustotal、ThreatCrowd、DNSdumpster 和 ReverseDNS 枚举子域。0x02 安装与使用。
信息搜集工具 之 Nmap
Finch_Alan的博客
02-12 557
信息搜集工具 之 Nmap Nmap是目前较为广泛使用的一款功能全面的端口扫描工具，它由Fyodor编写并维护，由于Nmap的使用灵活，操作方便，它已经是渗透测试人员必备的一个工具 安装工具方法: Linux: apt-get install nmap Windows: [下载链接](https://nmap.org/dist/nmap-7.70-setup.exe) GUI图形工具 除...
信息收集工具-FinalRecon
qq_42184699的博客
05-31 336
转载请注明出处！ github：https://github.com/thewhiteh4t/FinalRecon 个人博客：forever121.cn FinalRecon是用python3开发的一款开源的多功能网络侦察工具 需要调用的python3第三方库 requests ipwhois beautifulsoup4 lxml 支持平台： kali linux B...
信息收集与常用工具
weixin_49472648的博客
04-05 7381
信息收集与常用工具 文章目录信息收集与常用工具前言一、收集域名信息a） whois查询b） 备案信息查询二、收集敏感信息a） 谷歌语法b） 黑暗引擎c） 历史漏洞信息三、收集子域名信息a） 子域名检测工具b） 搜索引擎枚举c） 第三方聚合应用枚举d） 证书透明度公开日志枚举四、收集常用端口信息a） 扫描工具b） 常见端口服务及漏洞五、指纹识别a) 指纹识别b) 常见的CMSc) CMS扫描工具六、查找真实IPa) 判断该网站是否存在CDNb) 绕过CDN寻找真实IPc) 使用网站与工具七、收集敏感目录文件a
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包

打赏作者

期待未来的男孩

你的鼓励将是我创作的最大动力

¥1 ¥2 ¥4 ¥6 ¥10 ¥20
扫码支付：¥1
获取中
扫码支付

您的余额不足，请更换扫码支付或充值

打赏作者

实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值