Kail Linux渗透测试培训手册3第二章信息采集

信息收集是网络攻击中最重要的步骤之一。渗透攻击。我们需要收集各种信息目标。该信息收集。攻击成功的概率越大。介绍信息收集的相关工具。本文选自《Kail Linux渗透測试实训手冊》

3.1 Recon-NG框架

Recon-NG是由python编写的一个开源的Web侦查（信息收集）框架。Recon-ng框架是一个强大的工具，使用它能够自己主动的收集信息和网络侦查。

以下将介绍使用Recon-NG侦查工具。

启动Recon-NG框架，运行命令例如以下所看到的：本文选自《Kail Linux渗透測试实训手冊》

root@kali:~# recon-ng
_/_/_/ _/_/_/_/ _/_/_/ _/_/_/ _/ _/ _/ _/ _/_/_/
_/ _/ _/ _/ _/ _/ _/_/ _/ _/_/ _/ _/
_/_/_/ _/_/_/ _/ _/ _/ _/ _/ _/ _/_/_/_/ _/ _/ _/ _/ _/_/_/
_/ _/ _/ _/ _/ _/ _/ _/_/ _/ _/_/ _/ _/
_/ _/ _/_/_/_/ _/_/_/ _/_/_/ _/ _/ _/ _/ _/_/_/
+---------------------------------------------------------------------------+
| _ ___ _ __ |
| |_)| _ _|_ |_|.|| _ | _ |_ _ _ _ _ _|_o _ _ (_ _ _ _o_|_ |
| |_)|(_|(_|\ | ||||_\ _|_| || (_)| |||(_| | |(_)| | __)(/_(_|_|| | | \/ |
| / |
| Consulting | Research | Development | Training |
| http://www.blackhillsinfosec.com |
+---------------------------------------------------------------------------+
[recon-ng v4.1.4, Tim Tomes (@LaNMaSteR53)]
[56] Recon modules
[5] Reporting modules
[2] Exploitation modules
[2] Discovery modules
[1] Import modules
[recon-ng][default] >

以上输出信息显示了Recon-NG框架的基本信息。比如在Recon-NG框架下，包含56个侦查模块、5个报告模块、2个渗透攻击模块、2个发现模块和1个导入模块。

看到[recon-ng][default] >提示符，表示成功登录Recon-NG框架。

如今，就能够在[recon-ng][default] >提示符后面运行各种操作命令了。本文选自《Kail Linux渗透測试实训手冊》

首次使用Recon-NG框架之前，能够使用help命令查看全部可运行的命令。例如以下所看到的：

[recon-ng][default] > help
Commands (type [help|?

] <topic>):
---------------------------------
add Adds records to the database
back Exits current prompt level
del Deletes records from the database
exit Exits current prompt level
help Displays this menu
keys Manages framework API keys
load Loads specified module
pdb Starts a Python Debugger session
query Queries the database
record Records commands to a resource file
reload Reloads all modules
resource Executes commands from a resource file
search Searches available modules
set Sets module options
shell Executes shell commands
show Shows various framework items
spool Spools output to a file
unset Unsets module options
use Loads specified module
workspaces Manages workspaces

以上输出信息显示了在Recon-NG框架中可执行的命令。该框架和Metasploit框架类似。相同也支持非常多模块。此时。能够使用show modules命令查看全部有效的模块列表。执行命令例如以下所看到的：本文选自《Kail Linux渗透測试实训手冊》

[recon-ng][default] > show modules
Discovery
---------
discovery/info_disclosure/cache_snoop
discovery/info_disclosure/interesting_files
Exploitation
------------
exploitation/injection/command_injector
exploitation/injection/xpath_bruter
Import
------
import/csv_file
Recon
-----
recon/companies-contacts/facebook
recon/companies-contacts/jigsaw
recon/companies-contacts/jigsaw/point_usage
recon/companies-contacts/jigsaw/purchase_contact
recon/companies-contacts/jigsaw/search_contacts
recon/companies-contacts/linkedin_auth
recon/contacts-contacts/mangle
recon/contacts-contacts/namechk
recon/contacts-contacts/rapportive
recon/contacts-creds/haveibeenpwned
……
recon/hosts-hosts/bing_ip
recon/hosts-hosts/ip_neighbor
recon/hosts-hosts/ipinfodb
recon/hosts-hosts/resolve
recon/hosts-hosts/reverse_resolve
recon/locations-locations/geocode
recon/locations-locations/reverse_geocode
recon/locations-pushpins/flickr
recon/locations-pushpins/picasa
recon/locations-pushpins/shodan
recon/locations-pushpins/twitter
recon/locations-pushpins/youtube
recon/netblocks-hosts/reverse_resolve
recon/netblocks-hosts/shodan_net
recon/netblocks-ports/census_2012
Reporting
---------
reporting/csv
reporting/html
reporting/list
reporting/pushpin
reporting/xml
[recon-ng][default] >

从信息输出，能够看到五个部分的显示。每个模块包含几个部分。开始Recon-NG后的帧中可以看出。用户可以使用不同的模块。各种信息收集。

本文选自《Kail Linux渗透测试培训手册》