1,Nmap
Nmap工具是用于端口扫描和漏洞诊断的代表性工具。
/usr/share/nmap
# nmap -v
Starting Nmap 7.01 ( https://nmap.org ) at 2016-05-14 17:27 UTC
常用参数：
-sT : TCP open扫描
-sS: TCP half open扫描，不建立SYN扫描
-sF: TCP FIN扫描利用，fin数据包扫描
-sN: TCP NULL扫描，利用NULL数据包扫描
-sX: TCP Xmas扫描，利用FIN，PSH，URG数据包扫描
-sP: 利用ping协议查看主机激活状态
-sU: UDP端口扫描
-O: 辨认对象主机操作系统
Example:
# nmap -sT -p22 121.42.27.192
# nmap -sS -p 80,8080,8081,8082,8088,9000 192.168.1.0/24 -oA file.xml
2,Nmap NSE
Nmap NSE比Nmap更强大且灵活，不仅可以搜集，NFS,SMB,RPC等信息，而且还可以执行域名查询，whios搜集以及其他网络频段服务器的后门安装检测，漏洞诊断等诸多业务。
/usr/share/nmap/scripts 所有脚本的存放路径。使用nmap –script=scriptname 就可以使用。
#nmap –script-update 可以更新脚本数据
http://nmap.org/nsedoc/lib/nmap.html
Example:
# nmap –script=default www.mrliangqi.com
Starting Nmap 7.01 ( https://nmap.org ) at 2016-05-14 17:32 UTC
Nmap scan report for www.mrliangqi.com (121.42.27.192)
Host is up (0.063s latency).
Not shown: 994 closed ports
PORT STATE SERVICE
22/tcp open ssh
| ssh-hostkey:
| 1024 b8:0f:34:1b:4d:a2:88:0e:ef:ad:5d:81:5f:b1:9d:cf (DSA)
|_ 2048 84:75:c3:3b:67:a7:9e:92:c1:d4:df:a1:5d:80:c3:89 (RSA)
80/tcp open http
|_http-title: Waf\xE9\x98\xB2\xE7\x81\xAB\xE5\xA2\x99
139/tcp filtered netbios-ssn
443/tcp open https
|_http-title: Waf\xE9\x98\xB2\xE7\x81\xAB\xE5\xA2\x99
| ssl-cert: Subject: commonName=mrliangqi.com
| Not valid before: 2016-04-28T09:23:49
|_Not valid after: 2018-04-28T09:23:49
|_ssl-date: 2016-05-14T09:32:21+00:00; -8h00m05s from scanner time.
| tls-nextprotoneg:
|_ http/1.1
1720/tcp filtered h323q931
3306/tcp open mysql
| mysql-info:
| Protocol: 53
| Version: .6.29
| Thread ID: 135524
| Capabilities flags: 63487
| Some Capabilities: IgnoreSigpipes, ConnectWithDatabase, Speaks41ProtocolOld, DontAllowDatabaseTableColumn, SupportsTransactions, Support41Auth, InteractiveClient, IgnoreSpaceBeforeParenthesis, FoundRows, LongPassword, ODBCClient, SupportsCompression, Speaks41ProtocolNew, SupportsLoadDataLocal, LongColumnFlag
| Status: Autocommit
|_ Salt: Qv!=PXJL}Q[Ux{%AXudu
3,Dmitry
dmitry是简单的控制台环境应用程序，在linux中尽可能更多的收集相关主机信息，由c编写，dmitry的基本功能是利用启动时间报告和TCP端口扫描信息，简单的whios查询来获取对象主机信息。
Usage: dmitry [-winsepfb] [-t 0-9] [-o %host.txt] host
-o Save output to %host.txt or to file specified by -o file 将内容保存文件
-i Perform a whois lookup on the IP address of a host 对ip进行whios查询
-w Perform a whois lookup on the domain name of a host 对域名进行whios查询
-n Retrieve Netcraft.com information on a host 搜索主机的netcraft.com信息
-s Perform a search for possible subdomains 搜索正在使用的下级域名
-e Perform a search for possible email addresses 搜索正在使用的下级邮箱
-p Perform a TCP port scan on a host TCP端口扫描
-f Perform a TCP port scan on a host showing output reporting filtered ports 执行TCP端口扫描并同时显示筛选端口
-b Read in the banner received from the scanned port 读取被扫描端口发送的标志
-t 0-9 Set the TTL in seconds when scanning a TCP port ( Default 2 )Requires the -p flagged to be passed 进行TCP端口扫描作业时指定的TTL值默认2
Example:
# dmitry -p 5 www.mrliangqi.com
4,Wafw00f （查看IDS/IPS是否启用）
wafwoof是python脚本写的，用于监测网络服务器是否处于网络WAF保护状态，这个不仅可以发展测试战略，还能开发出绕过WAF的高级应用。
Options:
-h, –help show this help message and exit
-v, –verbose enable verbosity – multiple -v options increase
verbosity
-a, –findall Find all WAFs, do not stop testing on the first one
-r, –disableredirect
Do not follow redirections given by 3xx responses
-t TEST, –test=TEST Test for one specific WAF
-l, –list List all WAFs that we are able to detect
–xmlrpc Switch on the XML-RPC interface instead of CUI
–xmlrpcport=XMLRPCPORT
Specify an alternative port to listen on, default 8001
-V, –version Print out the version
Example:
# wafw00f www.mrliangqi.com
^ ^
_ __ _ ____ _ __ _ _ ____
///7/ /.’ \ / __////7/ /,’ \ ,’ \ / __/
| V V // o // _/ | V V // 0 // 0 // _/
|_n_,’/_n_//_/ |_n_,’ \_,’ \_,’/_/
< …’
WAFW00F – Web Application Firewall Detection Tool
By Sandro Gauci && Wendel G. Henrique
Checking http://www.mrliangqi.com
Generic Detection results:
#No WAF detected by the generic detection #当看到这段，表示没有waf.感觉也不是非常准确。
Number of requests: 14
5,UA-tester （收集网络服务信息）
UA-tester是在user-agent字符串目录基础上比较网络服务器回应头的渗透测试python脚本。
Usage :
-u / –url Complete URL
-f / –file <Path to User Agent file>
-s / –single provide single user-agent string
-d / –default Select the UA String type(s) to check.
-o / –output <Path to output file> CSV formated output
-v / –verbose results>> Recommended
–debug See debug messages (This isn’t the switch you’re looking for)
Example :
# ua-tester -d -m -u www.mrliangqi.com
more Example:
./UATester.py -u www.example.com -f ./useragentlist.txt -v
./UATester.py -u https://www.wordpress.com
./UATester.py -u http://www.defaultserver.com -v –debug
./UATester.py -u facebook.com -v -d MDBX
./UATester.py -u https://www.google.com -s “MySpecialUserAgent”
./UATester.py -u blog.c22.cc -d MC -o ./output.csv
以上内容pdf版本下载：kali下服务信息搜集及Wafw00f 检测IDS_IPS.pdf
