小白日记6：kali渗透测试之被动信息收集（五）-Recon-ng
Recon-ng
Recon-NG是由python编写的一个开源的Web侦查（信息收集）框架。Recon-ng框架是一个全特性的工具，使用它可以自动的收集信息和网络侦查。其命令格式与Metasploit！默认集成数据库，可把查询结果结构化存储在其中，有报告模块，把结果导出为报告。点击打开链接
1、启动Recon-NG框架
[recon-ng][default] >提示符表示启动成功
root@kali:~# recon-ng _/_/_/ _/_/_/_/ _/_/_/ _/_/_/ _/ _/ _/ _/ _/_/_/ _/ _/ _/ _/ _/ _/ _/_/ _/ _/_/ _/ _/ _/_/_/ _/_/_/ _/ _/ _/ _/ _/ _/ _/_/_/_/ _/ _/ _/ _/ _/_/_/ _/ _/ _/ _/ _/ _/ _/ _/_/ _/ _/_/ _/ _/ _/ _/ _/_/_/_/ _/_/_/ _/_/_/ _/ _/ _/ _/ _/_/_/ +---------------------------------------------------------------------------+ | _ ___ _ __ | | |_)| _ _|_ |_|.|| _ | _ |_ _ _ _ _ _|_o _ _ (_ _ _ _o_|_ | | |_)|(_|(_|\ | ||||_\ _|_| || (_)| |||(_| | |(_)| | __)(/_(_|_|| | | \/ | | / | | Consulting | Research | Development | Training | | http://www.blackhillsinfosec.com | +---------------------------------------------------------------------------+ [recon-ng v4.6.3, Tim Tomes (@LaNMaSteR53)] [71] Recon modules #71个侦查模块 [7] Reporting modules #7个报告模块 [2] Import modules #2个导入模块 [2] Exploitation modules #2个渗透攻击模块 [2] Discovery modules #2个发现模块
使用help命令查看所有可执行的命令或-h
[recon-ng][default] > help Commands (type [help|?]): --------------------------------- add Adds records to the database #将记录添加到数据库中 back Exits the current context #退出当前上下文 delete Deletes records from the database exit Exits the framework help Displays this menu keys Manages framework API keys #管理框架API load Loads specified module #加载指定模块 pdb Starts a Python Debugger session #启动python调试器 query Queries the database #查询数据库 record Records commands to a resource file #记录命令到源文件中 reload Reloads all modules #重新加载所有模块 resource Executes commands from a resource file #在框架下从源文件中执行命令 search Searches available modules #搜索可用模块 set Sets module options #设置模块参数 shell Executes shell commands #执行shell命令 show Shows various framework items #显示各种框架项目 snapshots Manages workspace snapshots #管理工作区快照 spool Spools output to a file #输出到一个文件上 unset Unsets module options #复原模块参数 use Loads specified module #加载指定模块 workspaces Manages workspaces #管理工作区
root@kali:~# recon-ng -h usage: recon-ng [-h] [-v] [-w workspace] [-r filename] [--no-check] [--no-analytics] recon-ng - Tim Tomes (@LaNMaSteR53) tjt1980[at]gmail.com optional arguments: -h, --help show this help message and exit -v, --version show program's version number and exit -w workspace load/create a workspace #设置不同工作区 -r filename load commands from a resource file#把recon-ng框架下的命令存成文本文件，可自动执行里面的指令 --no-check disable version check #每次启动不去检查recon-ng版本检查 --no-analytics disable analytics reporting #每次启动不去检查工作报告注:可用抓包发现USER-AFENT[recon-ng][sina.com] > show options Name Current Value Required Description ---------- ------------- -------- ----------- DEBUG False yes enable debugging output NAMESERVER 8.8.8.8 yes nameserver for DNS interrogation PROXY no proxy server (address:port) THREADS 10 yes number of threads (where applicable) TIMEOUT 10 yes socket timeout (seconds) USER-AGENT Recon-ng/v4 yes user-agent string #伪装USER-AFENT VERBOSE True yes enable verbose output
2、最常用命令use[recon-ng][sina.com] > show schema #显示数据库中的数据结构双击tab键 #显示模块， 可用search 寻找模块[recon-ng][sina.com] > use
无Google API 使用recon/domains-hosts/google_site_web使用show options/info先看一下参数指定域[recon-ng][sina.com][google_site_web] > show Shows various framework items Usage: show [companies|contacts|credentials|dashboard|domains|globals|hosts|info|inputs|leaks|locations|modules|netblocks|options|ports|profiles|pushpins|schema|source|vulnerabilities] [recon-ng][sina.com][google_site_web] > show options Name Current Value Required Description ------ ------------- -------- ----------- SOURCE default yes source of input (see 'show info' for details) [recon-ng][sina.com][google_site_web] > show info Name: Google Hostname Enumerator Path: modules/recon/domains-hosts/google_site_web.py Author: Tim Tomes (@LaNMaSteR53) Description: Harvests hosts from Google.com by using the 'site' search operator. Updates the 'hosts' table with the results. Options: Name Current Value Required Description ------ ------------- -------- ----------- SOURCE default yes source of input (see 'show info' for details) Source Options: default SELECT DISTINCT domain FROM domains WHERE domain IS NOT NULL ORDER BY domainstring representing a single input path to a file containing a list of inputs query database query returning one column of inputs [recon-ng][sina.com][google_site_web] > show s schema source [recon-ng][sina.com][google_site_web] > show schema
运行：run #搜索部分结果会短暂sleep，防止被搜索引擎屏蔽[recon-ng][sina.com][google_site_web] > set SOURCE sina.com SOURCE => sina.com
没找到结果
query 使用数据库语句 select * from hosts#Select * from hosts where host like ‘%baidu.com%’ order by ip_address#select * from hosts where host like '%www%'
3、Brute force #暴力破解模块，如果搜不出来
4、解析IP地址（查询数据库）[recon-ng][sina.com][bing_domain_web] > search brut [*] Searching for 'brut'... Exploitation ------------ exploitation/injection/xpath_bruter Recon ----- recon/domains-domains/brute_suffix recon/domains-hosts/brute_hosts [recon-ng][sina.com][bing_domain_web] > use recon/domains-hosts/brute_hosts [recon-ng][sina.com][brute_hosts] > show options Name Current Value Required Description -------- ------------- -------- ----------- SOURCE default yes source of input (see 'show info' for details) WORDLIST /usr/share/recon-ng/data/hostnames.txt yes path to hostname wordlist [recon-ng][sina.com][brute_hosts] > set SOURCE sina.com SOURCE => sina.com [recon-ng][sina.com][brute_hosts] > run--------
5、导出为报告模块[recon-ng][sina.com][brute_hosts] > search res [*] Searching for 'res'... Discovery --------- discovery/info_disclosure/interesting_files Recon ----- recon/hosts-hosts/resolve recon/hosts-hosts/reverse_resolve recon/netblocks-hosts/reverse_resolve [recon-ng][sina.com][brute_hosts] > use recon/hosts-hosts/resolve [recon-ng][sina.com][resolve] > show options Name Current Value Required Description ------ ------------- -------- ----------- SOURCE default yes source of input (see 'show info' for details) [recon-ng][sina.com][resolve] > show info Name: Hostname Resolver Path: modules/recon/hosts-hosts/resolve.py Author: Tim Tomes (@LaNMaSteR53) Description: Resolves the IP address for a host. Updates the 'hosts' table with the results. Options: Name Current Value Required Description ------ ------------- -------- ----------- SOURCE default yes source of input (see 'show info' for details) Source Options: default SELECT DISTINCT host FROM hosts WHERE host IS NOT NULL AND ip_address IS NULL#负载均衡，一个域名可能被解析为多个IP地址string representing a single input path to a file containing a list of inputs query database query returning one column of inputs Comments: * Note: Nameserver must be in IP form.
[recon-ng][sina.com][resolve] > set SOURCE query select host from hosts where host like '%youku.com%'### SQL语句， SOURCE => query select host from hosts where host like '%youku.com%' [recon-ng][sina.com][resolve] > run
小白日记，未完待续……[recon-ng][sina.com][resolve] > search report [*] Searching for 'report'... Reporting --------- reporting/csv reporting/html reporting/json reporting/list reporting/pushpin reporting/xlsx reporting/xml [recon-ng][sina.com][resolve] > use reporting/html [recon-ng][sina.com][html] > show options Name Current Value Required Description -------- ------------- -------- ----------- CREATOR yes creator name for the report footer CUSTOMER yes customer name for the report header FILENAME /root/.recon-ng/workspaces/default/results.html yes path and filename for report output SANITIZE True yes mask sensitive data in the report [recon-ng][sina.com][html] > [recon-ng][sina.com][html] > set CREATOR ZiXuan CREATOR => ZiXuan [recon-ng][sina.com][html] > set CUSTOMER youku.com CUSTOMER => youku.com [recon-ng][sina.com][html] > set FILENAME /root/sina.html FILENAME => /root/sina.html [recon-ng][sina.com][html] > run [*] Report generated at '/root/sina.html'.