【安全牛学习笔记】主动信息收集-发现（二）
╋━━━━━━━━━━━━━━━━━━╋
┃发现-----二层发现 ┃
┃Netdiscover ┃
┃ 专门于二层发现 ┃
┃ 可用于无线和交换网络环境 ┃
┃ 主动和被动探测 ┃
┃主动 ┃
┃ netdiscover -i eth0 -r 1.1.1.0/24 ┃
┃ netdiscover -l iplist.txt ┃
┃被动 ┃
┃ netdiscover -p ┃
┃ 主动arp容易触发报警 ┃
╋━━━━━━━━━━━━━━━━━━╋
root@kali:~# netdiscover -i eth0 -r 1.1.1.0/24
[3;J
Currently scanning: Finished! | Screen View: Unique Hosts
3 Captured ARP Req/Rep packets, from 1 hosts. Total size: 180
_____________________________________________________________________________
IP At MAC Address Count Len MAC Vendor
-----------------------------------------------------------------------------
192.168.1.1 f0:eb:d0:22:46:b4 03 180 Unknown vendor
root@kali:~# netdiscover -p
[3;J
Currently scanning: (passive) | Screen View: Unique Hosts
36 Captured ARP Req/Rep packets, from 1 hosts. Total size: 2160
____________________________________________________________________________
IP At MAC Address Count Len MAC Vendor
-----------------------------------------------------------------------------
192.168.1.1 f0:eb:d0:22:46:b4 36 2160 Unknown vendor
root@kali:~# arping 192.168.1.1
╋━━━━━━━━━━━━━━━━━━━╋
┃发现-----二层发现 ┃
┃Scapy ┃
┃ 作为Python库进行调用 ┃
┃ 也可作为单独的工具使用 ┃
┃ 抓包、分析、创建、修改、注入网络流量┃
┃apt-get install python-gnuplot ┃
┃Scapy ┃
┃ ARP().display() ┃
┃ Sr1() ┃
┃Python脚本 ┃
┃ Arp1.py ┃
┃ Arp2.py ┃
╋━━━━━━━━━━━━━━━━━━━╋
root@kali:~# scapy
INFO: Can't import python gnuplot wrapper . Won't be able to plot.
WARNING: No route found for IPv6 destination :: (no default route?)
Welcome to Scapy (2.2.0)
>>> exit()
"WARNING: No route found for IPv6 destination"这个信息表示缺少gnuplot
root@kali:~# apt-get install python-gnuplot
正在读取软件包列表... 完成
正在分析软件包的依赖关系树
正在读取状态信息... 完成
将会安装下列额外的软件包：
python-central
下列【新】软件包将被安装：
python-central python-gnuplot
升级了 0 个软件包，新安装了 2 个软件包，要卸载 0 个软件包，有 1 个软件包未被升级。
需要下载 153 kB 的软件包。
解压缩后会消耗掉 1,229 kB 的额外空间。
您希望继续执行吗？ [Y/n] y
获取：1 http://mirrors.163.com/debian/ squeeze/main python-central all 0.6.16+nmu1 [47.4 kB]
获取：2 http://mirrors.163.com/debian/ squeeze/main python-gnuplot all 1.8-1.1 [106 kB]
下载 153 kB，耗时 0秒 (400 kB/s)
正在选中未选择的软件包 python-central。
(正在读取数据库 ... 系统当前共安装有 337367 个文件和目录。)
正准备解包 .../python-central_0.6.16+nmu1_all.deb ...
正在解包 python-central (0.6.16+nmu1) ...
正在选中未选择的软件包 python-gnuplot。
正准备解包 .../python-gnuplot_1.8-1.1_all.deb ...
正在解包 python-gnuplot (1.8-1.1) ...
正在处理用于 man-db (2.7.0.2-5) 的触发器 ...
正在设置 python-central (0.6.16+nmu1) ...
正在设置 python-gnuplot (1.8-1.1) ...
正在处理用于 python-central (0.6.16+nmu1) 的触发器 ...
root@kali:~# scapy
WARNING: No route found for IPv6 destination :: (no default route?)
Welcome to Scapy (2.2.0)
>>> ARP()
>>> ARP().display()
###[ ARP ]###
hwtype= 0x1
ptype= 0x800
hwlen= 6
plen= 4
op= who-has
hwsrc= 00:0c:29:c6:89:56
psrc= 192.168.1.110
hwdst= 00:00:00:00:00:00
pdst= 0.0.0.0
════════════════════════════
Hardware type: Ethernet (1)
Protocol type: IP(0x0800)
Hardware size: 6
Protocol size: 4
Opcode: request (1)
Sender MAC address: CadmusCo_a7:ce:cd(08:00:27:a7:ce:cd)
Sender IP address: 192.168.1.132(192.168.1.132)
Target Mac address: 00:00:00_00:00:00 (00:00:00:00:00:00)
Target IP address: 192.168.1.118(192.168.1.118)
════════════════════════════
>>> arp=ARP()
>>> arp.display()
###[ ARP ]###
hwtype= 0x1
ptype= 0x800
hwlen= 6
plen= 4
op= who-has
hwsrc= 00:0c:29:c6:89:56
psrc= 192.168.1.110
hwdst= 00:00:00:00:00:00
pdst= 0.0.0.0
>>> arp.pdst="192.168.1.1"
>>> arp.display()
###[ ARP ]###
hwtype= 0x1
ptype= 0x800
hwlen= 6
plen= 4
op= who-has
hwsrc= 00:0c:29:c6:89:56
psrc= 192.168.1.110
hwdst= 00:00:00:00:00:00
pdst= 192.168.1.1
>> sr1(arp)
Begin emission:
*Finished to send 1 packets.
Received 1 packets, got 1 answers, remaining 0 packets
>>> answer=sr1(arp)
Begin emission:
*Finished to send 1 packets.
Received 1 packets, got 1 answers, remaining 0 packets
>> answer.display()
###[ ARP ]###
hwtype= 0x1
ptype= 0x800
hwlen= 6
plen= 4
op= is-at
hwsrc= f0:eb:d0:22:46:b4
psrc= 192.168.1.1
hwdst= 00:0c:29:c6:89:56
pdst= 192.168.1.110
###[ Padding ]###
load= '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
>>> arp=ARP()
>>> (ARP(pdst="192.168.1.1"))
>>>> sr1(ARP(pdst="192.168.1.11"))
Begin emission:
WARNING: Mac address to reach destination not found. Using broadcast.
Finished to send 1 packets.
.^C
Received 1 packets, got 0 answers, remaining 1 packets
>>> sr1(ARP(pdst="192.168.1.11"),timeout=1,verbose=1)
Begin emission:
WARNING: Mac address to reach destination not found. Using broadcast.
Finished to send 1 packets.
Received 0 packets, got 0 answers, remaining 1 packets
╭────────────────────────────────────────────╮
[arp1.py]
#!/usr/bin/python
import logging
import subprocess
logging.getLogger("scapy.runting).setLeve(logging.ERROR)
from scapy.all import *
if len(sys.argv)1=2;
print"Usage - ./arp_disc.py {interface}"
print"Example - ./arping.sh eth0"
print"Example will perform an ARP scan of the local subnet to which eth0 is assigned"
sys.exit()
interface=str(sys.argv[1])
ip=subprocess.check_output("ifconfig"+interfac.e+" | grep 'inet addr' | cut -d ':' -f 2 | cut -d ' ' -f 1",shell=True).strip() prefix=ip.split('.')[0]+ ''+ip.split('.')[1]+ '.'+ip.split('.')[2]+ '.'
for addr in range(0.254)
anser = sr1(ARP(pdst=prefix+str(addr)),timeout=0.1,verbose=0)
if answer == None;
pass
else:
print prefix+str(addr)
╰────────────────────────────────────────────╯
root@kali:~# chmod u+x arp1.py //赋予执行权限
root@kali:~# python arp1.py //这样也可以执行
root@kali:~# ./arp1.py
sage - ./arp_disc.py {interface}
Example - ./arping.sh eth0
Example will perform an ARP scan of the local subnet to which eth0 is assigned
root@kali:~# ./arp1.py eth0
192.168.1.1
╭────────────────────────────────────────────╮
arp2.py]
#!/usr/bin/python
import logging
logging.getLogger("scapy.runting).setLeve(logging.ERROR)
from scapy.all import *
if len(sys.argv)1=2;
print"Usage - ./arp_disc.py {interface}"
print"Example - ./arping.sh eth0"
print"Example will perform an ARP scan of the local subnet to which eth0 is assigned"
sys.exit()
filename = str(sys.argv[])
file = open(filename,'r')
for addr in file
anser = sr1(ARP(pdst=prefix+str(addr)),timeout=0.1,verbose=0)
if answer == None;
pass
else:
print addr.strip()
╰────────────────────────────────────────────╯
root@kali:~# chmod u+x arp2.py //赋予执行权限
root@kali:~# ./arp2.py adds