安全牛学习笔记主动信息收集-发现
Posted
tags:
篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了安全牛学习笔记主动信息收集-发现相关的知识,希望对你有一定的参考价值。
主动信息收集-发现
主动信息收集
无法避免留下访问的痕迹
使用受控的第三方电脑进行探测
使用代理或已经被控制的主机
做好被封杀的准备
使用噪声迷惑目标,淹没真是的探测流量
扫描
发送不同的探测,根据返回根据判断目标状态
识别活着的主机
潜在的被攻击目标
输出一个IP地址列表
2、3、4层发现
OSI model Layer description Protocols
Layer 7 - Application This layer involves the application software that HTTP,FTP
is sending and receiving data and Telnet Layer 6 - Presentation This layer deines how data is formatted ASCII,JPEG,PDF
or organized PNG,and DOCX
Layer 5 - Session This layer involves application session control NetBios,PPTP
management,synchronization RPC,and SOCKS
Layer 4 - Transport This layer involves and-to-end TCP and UDP
communication services
Layer 3 - Network This layer involes logical system addressing IPv4,IPv6,ICMP,│
and IPSec
Layer 2 - Data link This layer involes physical system addressing ARP
Layer 1 - Pysical This layer involes the data stream that is
passed over the wire
发现-----二层发现
arping
arping 1.1.1.1 -c 1
arping 1.1.1.1 -d
脚本
arping1.sh eth0 > addrs
arping2.sh addrs
[课后拓展]关于kali linux中无RPM命令无法使用的问题,本人在自己的机器上通过以下方法修正了,
身为kali linux的初学者,如果你用了我的方法将问题解决了最好,如果没有解决请见谅。
------------------------------------------
RPM是RedHat Package Manager(RedHat软件包管理工具)。
在进入kali linux 终端输入RPM,如果提示没有安装的情况的时候
那么这个命令是不能使用的。解决方法是通过改用163的源,更新后使用RPM。
下载163的源
wget http://mirrors.163.com/.help/sources.list.squeeze
注释后面3行
vi sources.list.squeeze
复制到该位置
cp sources.list.squeeze /etc/apt/sources.list
apt-get update
上述操作结束后重启客户端即可使用RPM命令。
[email protected]:~# ifconfig
[email protected]:~# vi /etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
source /etc/network/interfaces.d/*
# The loopback network interface
auto lo
iface eth0 inet dhcp
# address 192.168.20.8
# netmask 255.255.255.0
# network 192.168.20.0
# broadcast 192.168.20.255
# gateway 192.168.20.2
# dns-* options are implemented by the resolvconf package, if installed
# dns-nameservers 192.168.60.101 192.168.60.102
[email protected]:~# dhclient eth0
[email protected]:~# arping 192.168.1.110
[email protected]:~# arping 192.168.1.110 -c 1
[email protected]:~# arping -h
ARPing 2.14, by Thomas Habets <[email protected]>
usage: arping [ -0aAbdDeFpPqrRuUv ] [ -w <us> ] [ -W <sec> ] [ -S <host/ip> ]
[ -T <host/ip ] [ -s <MAC> ] [ -t <MAC> ] [ -c <count> ]
[ -C <count> ] [ -i <interface> ] <host/ip/MAC | -B>
For complete usage info, use --help or check the manpage.
[email protected]:~# arping 192.168.1.1 -d
[email protected]:~# arping -c 192.168.1.1 | grep "bytes from" | cut -d" " -f 5 | cut -d "(" -f 2 | cut -d")" -f 1
[email protected]:~# arping 192.168.1.1
ARPING 192.168.1.1
60 bytes from f0:eb:d0:22:46:b4 (192.168.1.1): index=0 time=8.086 msec
60 bytes from f0:eb:d0:22:46:b4 (192.168.1.1): index=1 time=13.558 msec
60 bytes from f0:eb:d0:22:46:b4 (192.168.1.1): index=2 time=7.545 msec
60 bytes from f0:eb:d0:22:46:b4 (192.168.1.1): index=3 time=13.376 msec
^C
--- 192.168.1.1 statistics ---
4 packets transmitted, 4 packets received, 0% unanswered (0 extra)
rtt min/avg/max/std-dev = 7.545/10.641/13.558/2.833 ms
╭────────────────────────────────────────────╮
[arping1.sh]
#!/bin/bash
if{"$#"-ne 1};then
echo"Usage - ./arping.sh {interface}"
echo"Example - ./arping.sh eth0"
echo"Example will perform an ARP scan of the local subnet to which eth0 is assigned"
exit
fi
interface=$1
prefix=$(ifconfig sinterface | grep ‘inter addr‘ | cut -d ‘:‘ -f 2 | cut -d ‘ ‘ -f 1 | cut -d ‘.‘ -f 1-3)
for addr in$(seq 1 254);do
arping -c | Sprefix.Saddr | grep "bytes from" | cut -d ‘ ‘ -f 5 | cut -d ‘(‘ -f 2 | cut -d ‘)‘ -f 1 >> addr.txt
done
╰────────────────────────────────────────────╯
[email protected]:~# ifconfig eth0 | grep ‘inter addr‘ | cut -d ‘:‘ -f 2 | cut -d ‘ ‘ -f 1 | cut -d ‘.‘ -f 1-3
[email protected]:~# arping1.sh eth0
╭────────────────────────────────────────────╮
[arping2.sh]
#!/bin/bash
if{"$#"-ne 1};then
echo"Usage - ./arping.sh {interface}"
echo"Example - ./arping.sh eth0"
echo"Example will perform an ARP scan of the local subnet to which eth0 is assigned"
exit
fi
file=$1
for addr in $(cat $file); do
arping -c 1 $addr | grep "bytes from" | cut -d ‘ ‘ -f 5 | cut -d ‘(‘ -f 2 | cut -d ‘)‘ -f 1
╰────────────────────────────────────────────╯
[email protected]:~# arping2.sh addr
发现-----二层发现
nmap 1.1.1.1-254-sn
nmap -iL iplist.txt -sn
Nmap很轻大,后面单独介绍
[email protected]:~# nmap
Nmap 6.49BETA4 ( https://nmap.org )
Usage: nmap [Scan Type(s)] [Options] {target specification}
TARGET SPECIFICATION:
Can pass hostnames, IP addresses, networks, etc.
Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
-iL <inputfilename>: Input from list of hosts/networks
-iR <num hosts>: Choose random targets
--exclude <host1[,host2][,host3],...>: Exclude hosts/networks
--excludefile <exclude_file>: Exclude list from file
HOST DISCOVERY:
-sL: List Scan - simply list targets to scan
-sn: Ping Scan - disable port scan
-Pn: Treat all hosts as online -- skip host discovery
-PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports
-PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
-PO[protocol list]: IP Protocol Ping
-n/-R: Never do DNS resolution/Always resolve [default: sometimes]
--dns-servers <serv1[,serv2],...>: Specify custom DNS servers
--system-dns: Use OS‘s DNS resolver
--traceroute: Trace hop path to each host
SCAN TECHNIQUES:
-sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
-sU: UDP Scan
-sN/sF/sX: TCP Null, FIN, and Xmas scans
--scanflags <flags>: Customize TCP scan flags
-sI <zombie host[:probeport]>: Idle scan
-sY/sZ: SCTP INIT/COOKIE-ECHO scans
-sO: IP protocol scan
-b <FTP relay host>: FTP bounce scan
PORT SPECIFICATION AND SCAN ORDER:
-p <port ranges>: Only scan specified ports
Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9
--exclude-ports <port ranges>: Exclude the specified ports from scanning
-F: Fast mode - Scan fewer ports than the default scan
-r: Scan ports consecutively - don‘t randomize
--top-ports <number>: Scan <number> most common ports
--port-ratio <ratio>: Scan ports more common than <ratio>
SERVICE/VERSION DETECTION:
-sV: Probe open ports to determine service/version info
--version-intensity <level>: Set from 0 (light) to 9 (try all probes)
--version-light: Limit to most likely probes (intensity 2)
--version-all: Try every single probe (intensity 9)
--version-trace: Show detailed version scan activity (for debugging)
SCRIPT SCAN:
-sC: equivalent to --script=default
--script=<Lua scripts>: <Lua scripts> is a comma separated list of
directories, script-files or script-categories
--script-args=<n1=v1,[n2=v2,...]>: provide arguments to scripts
--script-args-file=filename: provide NSE script args in a file
--script-trace: Show all data sent and received
--script-updatedb: Update the script database.
--script-help=<Lua scripts>: Show help about scripts.
<Lua scripts> is a comma-separated list of script-files or
script-categories.
OS DETECTION:
-O: Enable OS detection
--osscan-limit: Limit OS detection to promising targets
--osscan-guess: Guess OS more aggressively
TIMING AND PERFORMANCE:
Options which take <time> are in seconds, or append ‘ms‘ (milliseconds),
‘s‘ (seconds), ‘m‘ (minutes), or ‘h‘ (hours) to the value (e.g. 30m).
-T<0-5>: Set timing template (higher is faster)
--min-hostgroup/max-hostgroup <size>: Parallel host scan group sizes
--min-parallelism/max-parallelism <numprobes>: Probe parallelization
--min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <time>: Specifies
probe round trip time.
--max-retries <tries>: Caps number of port scan probe retransmissions.
--host-timeout <time>: Give up on target after this long
--scan-delay/--max-scan-delay <time>: Adjust delay between probes
--min-rate <number>: Send packets no slower than <number> per second
--max-rate <number>: Send packets no faster than <number> per second
FIREWALL/IDS EVASION AND SPOOFING:
-f; --mtu <val>: fragment packets (optionally w/given MTU)
-D <decoy1,decoy2[,ME],...>: Cloak a scan with decoys
-S <IP_Address>: Spoof source address
-e <iface>: Use specified interface
-g/--source-port <portnum>: Use given port number
--proxies <url1,[url2],...>: Relay connections through HTTP/SOCKS4 proxies
--data <hex string>: Append a custom payload to sent packets
--data-string <string>: Append a custom ASCII string to sent packets
--data-length <num>: Append random data to sent packets
--ip-options <options>: Send packets with specified ip options
--ttl <val>: Set IP time-to-live field
--spoof-mac <mac address/prefix/vendor name>: Spoof your MAC address
--badsum: Send packets with a bogus TCP/UDP/SCTP checksum
OUTPUT:
-oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3,
and Grepable format, respectively, to the given filename.
-oA <basename>: Output in the three major formats at once
-v: Increase verbosity level (use -vv or more for greater effect)
-d: Increase debugging level (use -dd or more for greater effect)
--reason: Display the reason a port is in a particular state
--open: Only show open (or possibly open) ports
--packet-trace: Show all packets sent and received
--iflist: Print host interfaces and routes (for debugging)
--append-output: Append to rather than clobber specified output files
--resume <filename>: Resume an aborted scan
--stylesheet <path/URL>: XSL stylesheet to transform XML output to html
--webxml: Reference stylesheet from Nmap.Org for more portable XML
--no-stylesheet: Prevent associating of XSL stylesheet w/XML output
MISC:
-6: Enable IPv6 scanning
-A: Enable OS detection, version detection, script scanning, and traceroute
--datadir <dirname>: Specify custom Nmap data file location
--send-eth/--send-ip: Send using raw ethernet frames or IP packets
--privileged: Assume that the user is fully privileged
--unprivileged: Assume the user lacks raw socket privileges
-V: Print version number
-h: Print this help summary page.
EXAMPLES:
nmap -v -A scanme.nmap.org
nmap -v -sn 192.168.0.0/16 10.0.0.0/8
nmap -v -iR 10000 -Pn -p 80
SEE THE MAN PAGE (https://nmap.org/book/man.html) FOR MORE OPTIONS AND EXAMPLES
[email protected]:~# nmap -sn 192.168.1.0/24
Starting Nmap 6.49BETA4 ( https://nmap.org ) at 2015-09-24 14:04 CST
Nmap scan report for 192.168.1.1
Host is up (0.0055s latency).
MAC Address: F0:EB:D0:22:46:B4 (Shanghai Feixun Communication Co.)
Nmap scan report for 192.168.1.101
Host is up (0.00030s latency).
MAC Address: 00:5A:39:B0:ED:D2 (Shenzhen Fast Technologies CO.)
Nmap scan report for 192.168.1.110
Host is up.
Nmap done: 256 IP addresses (3 hosts up) scanned in 2.09 seconds
[email protected]:~# nmap -iL addr -sn
该笔记为安全牛课堂学员笔记,想看此课程或者信息安全类干货可以移步到安全牛课堂
Security+认证为什么是互联网+时代最火爆的认证?
牛妹先给大家介绍一下Security+
Security+ 认证是一种中立第三方认证,其发证机构为美国计算机行业协会CompTIA ;是和CISSP、ITIL 等共同包含在内的国际 IT 业 10 大热门认证之一,和CISSP偏重信息安全管理相比,Security+ 认证更偏重信息安全技术和操作。
通过该认证证明了您具备网络安全,合规性和操作安全,威胁和漏洞,应用程序、数据和主机安全,访问控制和身份管理以及加密技术等方面的能力。因其考试难度不易,含金量较高,目前已被全球企业和安全专业人士所普遍采纳。
Security+认证如此火爆的原因?
原因一:在所有信息安全认证当中,偏重信息安全技术的认证是空白的, Security+认证正好可以弥补信息安全技术领域的空白 。
目前行业内受认可的信息安全认证主要有CISP和CISSP,但是无论CISP还是CISSP都是偏重信息安全管理的,技术知识讲的宽泛且浅显,考试都是一带而过。而且CISSP要求持证人员的信息安全工作经验都要5年以上,CISP也要求大专学历4年以上工作经验,这些要求无疑把有能力且上进的年轻人的持证之路堵住。在现实社会中,无论是找工作还是升职加薪,或是投标时候报人员,认证都是必不可少的,这给年轻人带来了很多不公平。而Security+的出现可以扫清这些年轻人职业发展中的障碍,由于Security+偏重信息安全技术,所以对工作经验没有特别的要求。只要你有IT相关背景,追求进步就可以学习和考试。
原因二: IT运维人员工作与翻身的利器。
在银行、证券、保险、信息通讯等行业,IT运维人员非常多,IT运维涉及的工作面也非常广。是一个集网络、系统、安全、应用架构、存储为一体的综合性技术岗。虽然没有程序猿们“生当做光棍,死亦写代码”的悲壮,但也有着“锄禾日当午,不如运维苦“的感慨。天天对着电脑和机器,时间长了难免有对于职业发展的迷茫和困惑。Security+国际认证的出现可以让有追求的IT运维人员学习网络安全知识,掌握网络安全实践。职业发展朝着网络安全的方向发展,解决国内信息安全人才的匮乏问题。另外,即使不转型,要做好运维工作,学习安全知识取得安全认证也是必不可少的。
原因三:接地气、国际范儿、考试方便、费用适中!
CompTIA作为全球ICT领域最具影响力的全球领先机构,在信息安全人才认证方面是专业、公平、公正的。Security+认证偏重操作且和一线工程师的日常工作息息相关。适合银行、证券、保险、互联网公司等IT相关人员学习。作为国际认证在全球147个国家受到广泛的认可。
在目前的信息安全大潮之下,人才是信息安全发展的关键。而目前国内的信息安全人才是非常匮乏的,相信Security+认证一定会成为最火爆的信息安全认证。
近期,安全牛课堂在做此类线上培训,感兴趣可以了解
本文出自 “11662938” 博客,请务必保留此出处http://11672938.blog.51cto.com/11662938/1964398
以上是关于安全牛学习笔记主动信息收集-发现的主要内容,如果未能解决你的问题,请参考以下文章