metasploit学习之情报搜集

3.1.被动信息搜集
whois查询
Netcraft

nslookup
>set type=mx
>testfire.net

Google Hacking

3.2 主动信息搜集
使用nmap进行端口扫描
-sS 隐秘的TCP扫描 ，以确定某个TCP端口是否开放
-Pn 不使用ping命令，默认所有主机都存活。适用于外网，内网不用
-A 深入的服务枚举和旗标获取

在msf中使用数据库
将nmap结果导入metasploit
/home/output# nmap -Pn -Ss -A -oX Subnet1.xml 192.168.1.0/24
db_import /home/output/Subnet1.xml

Hosts -c address

TCP空闲扫描

msf> use auxiliary/scanner/ip/ipidseq
Show options
set RHOSTS => ip
Set THREADS 50
run

Nmap -Pn -sI 192.168.1.131 132.168.1.201

在msf中运行nmap
db_nmap -sS -A 192.168.1.201

Services -u

使用msf进行端口扫描
msf> search portscan
Use auxiliary/scanner/portscan/syn
set RHOSTS
set THREADS 50
run
3 .3针对性扫描
331. 服务器消息块协议扫描
use auxiliary/scanner/smb/smb_version
show options
set RHOSTS
run
332.搜索配置不当的mssql

use auxiliary/scanner/mssql/mssql_ping
show options
set RHOSTS
set THREADS 255
run
333. SSH服务器扫描
use auxiliary/scanner/ssh/ssh_version
set RHOSTS
set THREADS 50
run
334.FTP扫描

use auxiliary/scanner/ftp/ftp_version
set RHOSTS
set THREADS 255
run
335.简单网管协议snmp扫描

msf auxiliary(scanner/ftp/ftp_version) > use auxiliary/scanner/snmp/snmp_login
msf auxiliary(scanner/snmp/snmp_login) > set RHOSTS 192.168.1.111
RHOSTS => 192.168.1.111
msf auxiliary(scanner/snmp/snmp_login) > set THREADS 50
THREADS => 50
msf auxiliary(scanner/snmp/snmp_login) > run