Kali Linux 渗透测试之被动信息收集（三）——Recon-NG框架
Recon-NG框架
1、Recon-NG框架简介；
- Recon-NG是由python编写的一个开源的Web侦查（信息收集）框架，命令格式与msf一致；
- Recon-NG框架是一个全特性的工具，使用它可以自动的搜集信息和网络侦查。可以把查询结果结构化存储在其中，有报告模块，把结果导出为报告。下面将介绍使用Recon-NG侦查工具。
2、启动Recon-NG框架
2.1> Recon-NG框架；
root@kali:~# recon-ng
_/_/_/ _/_/_/_/ _/_/_/ _/_/_/ _/ _/ _/ _/ _/_/_/
_/ _/ _/ _/ _/ _/ _/_/ _/ _/_/ _/ _/
_/_/_/ _/_/_/ _/ _/ _/ _/ _/ _/ _/_/_/_/ _/ _/ _/ _/ _/_/_/
_/ _/ _/ _/ _/ _/ _/ _/_/ _/ _/_/ _/ _/
_/ _/ _/_/_/_/ _/_/_/ _/_/_/ _/ _/ _/ _/ _/_/_/
/\
/ \\ /\
Sponsored by... /\ /\/ \\V \/\
/ \\/ // \\\\\ \\ \/\
// // BLACK HILLS \/ \\
www.blackhillsinfosec.com
[recon-ng v4.9.6, Tim Tomes (@LaNMaSteR53)]
[81] Recon modules #81个Recon模块
[8] Reporting modules #8个报告模块
[2] Import modules #2个导入模块
[2] Exploitation modules #2个渗透攻击模块
[2] Discovery modules #2个发现模块
[recon-ng][default] > #证明框架启动成功！！！！
2.2> 进入Recon-NG框架，可以使用help命令查看搜索可执行的操作；
斜体样式
[recon-ng][default] > help
Commands (type [help|?] ):
---------------------------------
add Adds records to the database #将记录添加到数据库中
back Exits the current context #退出当前上下文
delete Deletes records from the database #从数据库中删除记录
exit Exits the framework #退出框架
help Displays this menu #显示此菜单
keys Manages framework API keys #管理框架API密钥
load Loads specified module #加载指定的模块
pdb Starts a Python Debugger session #启动Python调试器会话
query Queries the database #查询数据库
record Records commands to a resource file #将命令记录到资源文件中
reload Reloads all modules #重新加载所有模块
resource Executes commands from a resource file #从资源文件集中执行命令
search Searches available modules #寻找可用模块
set Sets module options #设置模块的选项
shell Executes shell commands #执行shell命令
show Shows various framework items #显示各种框架项
snapshots Manages workspace snapshots #管理工作区快照
spool Spools output to a file #输出到一个文件
unset Unsets module options #取消设置的模块选项
use Loads specified module #使用模块
workspaces Manages workspaces #管理工作区间
2.3> recon-NG框架的帮助信息；
[recon-ng][default] > recon-ng -h
[recon-ng][default] > recon-ng -h
[*] Command: recon-ng -h
usage: recon-ng [-h] [-v] [-w workspace] [-r filename] [--no-check] [--no-analytics]
recon-ng - Tim Tomes (@LaNMaSteR53) tjt1980[at]gmail.com
optional arguments:
-h, --help show this help message and exit #显示帮助信息并退出
-v, --version show program's version number and exit #显示版本号并退出
-w workspace load/create a workspace #创建工作区
-r filename load commands from a resource file #从资源文件加载命令
--no-check disable version check #每次启动不去检查recon-ng版本检查
--no-analytics disable analytics reporting #禁止分析报告
2.4> Reco-NG 框架自身有数据库，可以将获取到的信息放到数据库中；使用show schema可以显示Recon-NG框架中的数据结构；（后面会用到hosts表）
[recon-ng][default] > show schema
[recon-ng][default] > show schema
+---------------+
| domains |
+---------------+
| domain | TEXT |
| module | TEXT |
+---------------+
+-------------------+
| hosts | #之后会用到数据库中的hosts表；
+-------------------+
| host | TEXT |
| ip_address | TEXT |
| region | TEXT |
| country | TEXT |
| latitude | TEXT |
| longitude | TEXT |
| module | TEXT |
+-------------------+
+--------------------+
| contacts |
+--------------------+
| first_name | TEXT |
| middle_name | TEXT |
| last_name | TEXT |
| email | TEXT |
| title | TEXT |
| region | TEXT |
| country | TEXT |
| module | TEXT |
+--------------------+
+-----------------+
| credentials |
+-----------------+
| username | TEXT |
| password | TEXT |
| hash | TEXT |
| type | TEXT |
| leak | TEXT |
| module | TEXT |
+-----------------+
+-----------------------------+
| leaks |
+-----------------------------+
| leak_id | TEXT |
| description | TEXT |
| source_refs | TEXT |
| leak_type | TEXT |
| title | TEXT |
| import_date | TEXT |
| leak_date | TEXT |
| attackers | TEXT |
| num_entries | TEXT |
| score | TEXT |
| num_domains_affected | TEXT |
| attack_method | TEXT |
| target_industries | TEXT |
| password_hash | TEXT |
| password_type | TEXT |
| targets | TEXT |
| media_refs | TEXT |
| module | TEXT |
+-----------------------------+
+---------------------+
| pushpins |
+---------------------+
| source | TEXT |
| screen_name | TEXT |
| profile_name | TEXT |
| profile_url | TEXT |
| media_url | TEXT |
| thumb_url | TEXT |
| message | TEXT |
| latitude | TEXT |
| longitude | TEXT |
| time | TEXT |
| module | TEXT |
+---------------------+
+-----------------+
| profiles |
+-----------------+
| username | TEXT |
| resource | TEXT |
| url | TEXT |
| category | TEXT |
| notes | TEXT |
| module | TEXT |
+-----------------+
+--------------------+
| repositories |
+--------------------+
| name | TEXT |
| owner | TEXT |
| description | TEXT |
| resource | TEXT |
| category | TEXT |
| url | TEXT |
| module | TEXT |
+--------------------+
3、模块的使用
- Recon-NG 框架主要是通过使用各种模块，调用命令行的方式去搜索基于Web的相关信息；
- 在如下操作中，将以具体的实例（搜索sina.com域名的主机与IP地址记录）来熟悉各种模块的使用；
3.1> 创建工作区
Recon-NG有默认的工作区（default），但是为了方便管理和查询，建议去创建每次试验的工作区；
root@kali:~# recon-ng -w sina
root@kali:~# recon-ng -w sina #创建工作区
......
[recon-ng][sina] > #创建工作区后，将直接进去到创建的工作区中
[recon-ng][sina] > workspaces list #管理工作区
+------------+
| Workspaces |
+------------+
| sina |
| default |
| ptest |
+------------+
3.2> 使用模块进行域名查询
进入域名的模块有很多个，每个模块查询的结果可能不同；如下操作主要使用bing_domain_web模块和Brute force模块结合；
bing_domain_web模块查询：在查询过程中，Recon-NG会向bing.com网站发送大量的主机名查询；
[recon-ng][sina] > search bing #查找bing相关的模块
[*] Searching for 'bing'...
Recon
-----
recon/companies-contacts/bing_linkedin_cache
recon/domains-hosts/bing_domain_api
recon/domains-hosts/bing_domain_web
recon/hosts-hosts/bing_ip
[recon-ng][sina] > use recon/domains-hosts/bing_domain_web #使用模块进行域名查询
[recon-ng][sina][bing_domain_web] > show options #显示该模块需要设置的选项
Name Current Value Required Description
------ ------------- -------- -----------
SOURCE default yes source of input (see 'show info' for details)
[recon-ng][sina][bing_domain_web] > set SOURCE sina.com #设置选项：查询的域名
SOURCE => sina.com
[recon-ng][sina][bing_domain_web] > show info #设置好后，查看info
Name: Bing Hostname Enumerator
Path: modules/recon/domains-hosts/bing_domain_web.py
Author: Tim Tomes (@LaNMaSteR53)
Description:
Harvests hosts from Bing.com by using the 'site' search operator. Updates the 'hosts' table with the
results.
Options:
Name Current Value Required Description
------ ------------- -------- -----------
SOURCE sina.com yes source of input (see 'show info' for details)
Source Options:
default SELECT DISTINCT domain FROM domains WHERE domain IS NOT NULL
string representing a single input
path to a file containing a list of inputs
query database query returning one column of inputs
设置好选项之后，就开始执行查询，并将查询的结果保存到数据库的hosts表中；
[recon-ng][sina][bing_domain_web] > run #如果没有执行结果是，多执行几遍run，就出来了
--------
SINA.COM
--------
[*] URL: https://www.bing.com/search?first=0&q=domain%3Asina.com
[recon-ng][sina][bing_domain_web] > run #运行，开始进行查询
--------
SINA.COM
--------
[*] URL: https://www.bing.com/search?first=0&q=domain%3Asina.com
[*] [host] med.sina.com ()
[*] [host] mail.sina.com ()
[*] [host] sifa.sina.com ()
[*] [host] eva.sina.com ()
[*] [host] immigration.sina.com ()
[*] [host] zt.sina.com ()
[*] Sleeping to avoid lockout... #查询一段时间后，就会sleeping一下，避免被锁定
[*] URL: https://www.bing.com/search?first=0&q=domain%3Asina.com+-domain%3Amed.sina.com+-domain%3Amail.sina.com+-domain%3Asifa.sina.com+-domain%3Aeva.sina.com+-domain%3Aimmigration.sina.com+-domain%3Azt.sina.com
[*] [host] v.game.sina.com ()
[*] [host] xwz.sina.com ()
[*] [host] ads.sina.com ()
[*] [host] it.mn.sina.com ()
[*] [host] ued.sina.com ()
[*] [host] travel.sina.com ()
[*] [host] lymf.sina.com ()
[*] [host] slide.sports.sina.com ()
[*] [host] client.sina.com ()
[*] [host] home.games.sina.com ()
[*] [host] mt.sina.com ()
[*] [host] hainan.sina.com ()
[*] [host] ent.sina.com ()
[*] [host] mail.sina.com ()
[*] [host] dwj.sina.com ()
[*] [host] chinanews.sina.com ()
[*] [host] weekly.games.sina.com ()
[*] [host] slide.ent.sina.com ()
[*] [host] sc.sina.com ()
[*] Sleeping to avoid lockout...
[*] URL: https://www.bing.com/search?first=0&q=domain%3Asina.com+-domain%3Amed.sina.com+-domain%3Amail.sina.com+-domain%3Asifa.sina.com+-domain%3Aeva.sina.com+-domain%3Aimmigration.sina.com+-domain%3Azt.sina.com+-domain%3Av.game.sina.com+-domain%3Axwz.sina.com+-domain%3Aads.sina.com+-domain%3Ait.mn.sina.com+-domain%3Aued.sina.com+-domain%3Atravel.sina.com+-domain%3Alymf.sina.com+-domain%3Aslide.sports.sina.com+-domain%3Aclient.sina.com+-domain%3Ahome.games.sina.com+-domain%3Amt.sina.com+-domain%3Ahainan.sina.com+-domain%3Aent.sina.com+-domain%3Amail.sina.com+-domain%3Adwj.sina.com+-domain%3Achinanews.sina.com+-domain%3Aweekly.games.sina.com+-domain%3Aslide.ent.sina.com+-domain%3Asc.sina.com
[*] [host] video.sina.com ()
[*] [host] winner.sina.com ()
[*] [host] finance.sina.com ()
[*] [host] yn.house.sina.com ()
[*] [host] food.sina.com ()
[*] [host] house.sina.com ()
[*] [host] english.sina.com ()
[*] [host] exmail.sina.com ()
[*] [host] zb.sina.com ()
[*] [host] sichuan.sina.com ()
[*] [host] game.sina.com ()
[*] [host] books.sina.com ()
[*] [host] slide.fashion.sina.com ()
[*] [host] henan.sina.com ()
[*] [host] members.sina.com ()
[*] [host] auto.sina.com ()
[*] [host] maiche.sina.com ()
[*] [host] weirenwu.sina.com ()
[*] [host] wuyi.sina.com ()
[*] Sleeping to avoid lockout...
[*] URL: https://www.bing.com/search?first=0&q=domain%3Asina.com+-domain%3Amed.sina.com+-domain%3Amail.sina.com+-domain%3Asifa.sina.com+-domain%3Aeva.sina.com+-domain%3Aimmigration.sina.com+-domain%3Azt.sina.com+-domain%3Av.game.sina.com+-domain%3Axwz.sina.com+-domain%3Aads.sina.com+-domain%3Ait.mn.sina.com+-domain%3Aued.sina.com+-domain%3Atravel.sina.com+-domain%3Alymf.sina.com+-domain%3Aslide.sports.sina.com+-domain%3Aclient.sina.com+-domain%3Ahome.games.sina.com+-domain%3Amt.sina.com+-domain%3Ahainan.sina.com+-domain%3Aent.sina.com+-domain%3Amail.sina.com+-domain%3Adwj.sina.com+-domain%3Achinanews.sina.com+-domain%3Aweekly.games.sina.com+-domain%3Aslide.ent.sina.com+-domain%3Asc.sina.com+-domain%3Avideo.sina.com+-domain%3Awinner.sina.com+-domain%3Afinance.sina.com+-domain%3Ayn.house.sina.com+-domain%3Afood.sina.com+-domain%3Ahouse.sina.com+-domain%3Aenglish.sina.com+-domain%3Aexmail.sina.com+-domain%3Azb.sina.com+-domain%3Asichuan.sina.com+-domain%3Agame.sina.com+-domain%3Abooks.sina.com+-domain%3Aslide.fashion.sina.com+-domain%3Ahenan.sina.com+-domain%3Amembers.sina.com+-domain%3Aauto.sina.com+-domain%3Amaiche.sina.com+-domain%3Aweirenwu.sina.com+-domain%3Awuyi.sina.com
[*] [host] dhl.sina.com ()
[*] [host] gb.comic.sina.com ()
[*] [host] wyq.sina.com ()
[*] [host] pay.sina.com ()
[*] [host] gb.nba.sina.com ()
[*] [host] wifi.sina.com ()
[*] [host] vip.sina.com ()
[*] [host] m.us.sina.com ()
[*] [host] gb.2006.sina.com ()
[*] [host] magazine.sina.com ()
[*] [host] weibous.sina.com ()
[*] [host] pasadera.sina.com ()
[*] [host] ischool.edu.sina.com ()
[*] [host] mgame.sina.com ()
[*] [host] opay.sina.com ()
[*] Sleeping to avoid lockout...
^C
-------
SUMMARY
-------
[*] 59 total (59 new) hosts found.
[recon-ng][sina][bing_domain_web] >
3.3> 查询hosts表，查看上述结果；
[recon-ng][sina][bing_domain_web] > show hosts
[recon-ng][sina][bing_domain_web] > show hosts
+---------------------------------------------------------------------------------------------------------+
| rowid | host | ip_address | region | country | latitude | longitude | module |
+---------------------------------------------------------------------------------------------------------+
| 1 | med.sina.com | | | | | | bing_domain_web |
| 2 | mail.sina.com | | | | | | bing_domain_web |
| 3 | sifa.sina.com | | | | | | bing_domain_web |
| 4 | eva.sina.com | | | | | | bing_domain_web |
| 5 | immigration.sina.com | | | | | | bing_domain_web |
| 6 | zt.sina.com | | | | | | bing_domain_web |
| 7 | v.game.sina.com | | | | | | bing_domain_web |
| 8 | xwz.sina.com | | | | | | bing_domain_web |
| 9 | ads.sina.com | | | | | | bing_domain_web |
| 10 | it.mn.sina.com | | | | | | bing_domain_web |
| 11 | ued.sina.com | | | | | | bing_domain_web |
| 12 | travel.sina.com | | | | | | bing_domain_web |
| 13 | lymf.sina.com | | | | | | bing_domain_web |
| 14 | slide.sports.sina.com | | | | | | bing_domain_web |
| 15 | client.sina.com | | | | | | bing_domain_web |
| 16 | home.games.sina.com | | | | | | bing_domain_web |
| 17 | mt.sina.com | | | | | | bing_domain_web |
| 18 | hainan.sina.com | | | | | | bing_domain_web |
| 19 | ent.sina.com | | | | | | bing_domain_web |
| 20 | mail.sina.com | | | | | | bing_domain_web |
| 21 | dwj.sina.com | | | | | | bing_domain_web |
| 22 | chinanews.sina.com | | | | | | bing_domain_web |
| 23 | weekly.games.sina.com | | | | | | bing_domain_web |
| 24 | slide.ent.sina.com | | | | | | bing_domain_web |
| 25 | sc.sina.com | | | | | | bing_domain_web |
| 26 | video.sina.com | | | | | | bing_domain_web |
| 27 | winner.sina.com | | | | | | bing_domain_web |
| 28 | finance.sina.com | | | | | | bing_domain_web |
| 29 | yn.house.sina.com | | | | | | bing_domain_web |
| 30 | food.sina.com | | | | | | bing_domain_web |
| 31 | house.sina.com | | | | | | bing_domain_web |
| 32 | english.sina.com | | | | | | bing_domain_web |
| 33 | exmail.sina.com | | | | | | bing_domain_web |
| 34 | zb.sina.com | | | | | | bing_domain_web |
| 35 | sichuan.sina.com | | | | | | bing_domain_web |
| 36 | game.sina.com | | | | | | bing_domain_web |
| 37 | books.sina.com | | | | | | bing_domain_web |
| 38 | slide.fashion.sina.com | | | | | | bing_domain_web |
| 39 | henan.sina.com | | | | | | bing_domain_web |
| 40 | members.sina.com | | | | | | bing_domain_web |
| 41 | auto.sina.com | | | | | | bing_domain_web |
| 42 | maiche.sina.com | | | | | | bing_domain_web |
| 43 | weirenwu.sina.com | | | | | | bing_domain_web |
| 44 | wuyi.sina.com | | | | | | bing_domain_web |
| 45 | dhl.sina.com | | | | | | bing_domain_web |
| 46 | gb.comic.sina.com | | | | | | bing_domain_web |
| 47 | wyq.sina.com | | | | | | bing_domain_web |
| 48 | pay.sina.com | | | | | | bing_domain_web |
| 49 | gb.nba.sina.com | | | | | | bing_domain_web |
| 50 | wifi.sina.com | | | | | | bing_domain_web |
| 51 | vip.sina.com | | | | | | bing_domain_web |
| 52 | m.us.sina.com | | | | | | bing_domain_web |
| 53 | gb.2006.sina.com | | | | | | bing_domain_web |
| 54 | magazine.sina.com | | | | | | bing_domain_web |
| 55 | weibous.sina.com | | | | | | bing_domain_web |
| 56 | pasadera.sina.com | | | | | | bing_domain_web |
| 57 | ischool.edu.sina.com | | | | | | bing_domain_web |
| 58 | mgame.sina.com | | | | | | bing_domain_web |
| 59 | opay.sina.com | | | | | | bing_domain_web |
+---------------------------------------------------------------------------------------------------------+
[*] 59 rows returned
3.4> 使用Brute force暴力破解模块，弥补上面部分没有在搜索引擎中搜索到的域名；使搜索到的结果更加全面；
brute_hosts模块查询：自带字典，也可以替换自带的字典；
[recon-ng][sina][bing_domain_web] > search brute
[*] Searching for 'brute'...
Exploitation
------------
exploitation/injection/xpath_bruter
Recon
-----
recon/domains-domains/brute_suffix
recon/domains-hosts/brute_hosts
[recon-ng][sina] > use recon/domains-hosts/brute_hosts
[recon-ng][sina][brute_hosts] > show options
Name Current Value Required Description
-------- ------------- -------- -----------
SOURCE default yes source of input (see 'show info' for details)
WORDLIST /usr/share/recon-ng/data/hostnames.txt yes path to hostname wordlist
[recon-ng][sina][brute_hosts] > set SOURCE sina.com
SOURCE => sina.com
[recon-ng][sina][brute_hosts] > run
--------
SINA.COM
--------
[*] No Wildcard DNS entry found.
[*] 03.sina.com => No record found.
[*] 10.sina.com => No record found.
[*] 01.sina.com => No record found.
[*] 02.sina.com => No record found.
[*] 13.sina.com => No record found.
[*] 1.sina.com => No record found.
[*] 12.sina.com => No record found.
[*] 2.sina.com => No record found.
[*] 18.sina.com => No record found.
[*] 16.sina.com => No record found.
[*] 3com.sina.com => No record found.
[*] 4.sina.com => No record found.
[*] 6.sina.com => No record found.
[*] 5.sina.com => No record found.
[*] 7.sina.com => No record found.
[*] 8.sina.com => No record found.
[*] 9.sina.com => No record found.
[*] ILMI.sina.com => No record found.
[*] a.auth-ns.sina.com => No record found.
[*] a.sina.com => No record found.
...... #由于字典过大，省略很多信息
[*] 15.sina.com => No record found.
[*] 17.sina.com => No record found.
[*] 19.sina.com => No record found.
[*] 20.sina.com => No record found.
[*] 3com.sina.com => No record found.
[*] 12.sina.com => No record found.
[*] 6.sina.com => No record found.
....... #由于字典过大，省略很多信息
[*] cust22.sina.com => Request timed out.
^C[*] cust22.sina.com => No record found. #字典才搜索到c开头的信息，还有很多的信息；
-------
SUMMARY
-------
[*] 54 total (49 new) hosts found. #在之前搜索的基础上，又发现了49个新的主机记录
3.5> 再次查看hosts表，查看上述结果；
[recon-ng][sina][brute_hosts] > show hosts
+----------------------------------------------------------------------------------------------------------------------+
| rowid | host | ip_address | region | country | latitude | longitude | module |
+----------------------------------------------------------------------------------------------------------------------+
| 1 | med.sina.com | | | | | | bing_domain_web |
| 2 | mail.sina.com | | | | | | bing_domain_web |
| 3 | sifa.sina.com | | | | | | bing_domain_web |
| 4 | eva.sina.com | | | | | | bing_domain_web |
| 5 | immigration.sina.com | | | | | | bing_domain_web |
| 6 | zt.sina.com | | | | | | bing_domain_web |
| 7 | v.game.sina.com | | | | | | bing_domain_web |
| 8 | xwz.sina.com | | | | | | bing_domain_web |
| 9 | ads.sina.com | | | | | | bing_domain_web |
| 10 | it.mn.sina.com | | | | | | bing_domain_web |
| 11 | ued.sina.com | | | | | | bing_domain_web |
| 12 | travel.sina.com | | | | | | bing_domain_web |
| 13 | lymf.sina.com | | | | | | bing_domain_web |
| 14 | slide.sports.sina.com | | | | | | bing_domain_web |
| 15 | client.sina.com | | | | | | bing_domain_web |
| 16 | home.games.sina.com | | | | | | bing_domain_web |
| 17 | mt.sina.com | | | | | | bing_domain_web |
| 18 | hainan.sina.com | | | | | | bing_domain_web |
| 19 | ent.sina.com | | | | | | bing_domain_web |
| 20 | mail.sina.com | | | | | | bing_domain_web |
| 21 | dwj.sina.com | | | | | | bing_domain_web |
| 22 | chinanews.sina.com | | | | | | bing_domain_web |
| 23 | weekly.games.sina.com | | | | | | bing_domain_web |
| 24 | slide.ent.sina.com | | | | | | bing_domain_web |
| 25 | sc.sina.com | | | | | | bing_domain_web |
| 26 | video.sina.com | | | | | | bing_domain_web |
| 27 | winner.sina.com | | | | | | bing_domain_web |
| 28 | finance.sina.com | | | | | | bing_domain_web |
| 29 | yn.house.sina.com | | | | | | bing_domain_web |
| 30 | food.sina.com | | | | | | bing_domain_web |
| 31 | house.sina.com | | | | | | bing_domain_web |
| 32 | english.sina.com | | | | | | bing_domain_web |
| 33 | exmail.sina.com | | | | | | bing_domain_web |
| 34 | zb.sina.com | | | | | | bing_domain_web |
| 35 | sichuan.sina.com | | | | | | bing_domain_web |
| 36 | game.sina.com | | | | | | bing_domain_web |
| 37 | books.sina.com | | | | | | bing_domain_web |
| 38 | slide.fashion.sina.com | | | | | | bing_domain_web |
| 39 | henan.sina.com | | | | | | bing_domain_web |
| 40 | members.sina.com | | | | | | bing_domain_web |
| 41 | auto.sina.com | | | | | | bing_domain_web |
| 42 | maiche.sina.com | | | | | | bing_domain_web |
| 43 | weirenwu.sina.com | | | | | | bing_domain_web |
| 44 | wuyi.sina.com | | | | | | bing_domain_web |
| 45 | dhl.sina.com | | | | | | bing_domain_web |
| 46 | gb.comic.sina.com | | | | | | bing_domain_web |
| 47 | wyq.sina.com | | | | | | bing_domain_web |
| 48 | pay.sina.com | | | | | | bing_domain_web |
| 49 | gb.nba.sina.com | | | | | | bing_domain_web |
| 50 | wifi.sina.com | | | | | | bing_domain_web |
| 51 | vip.sina.com | | | | | | bing_domain_web |
| 52 | m.us.sina.com | | | | | | bing_domain_web |
| 53 | gb.2006.sina.com | | | | | | bing_domain_web |
| 54 | magazine.sina.com | | | | | | bing_domain_web |
| 55 | weibous.sina.com | | | | | | bing_domain_web |
| 56 | pasadera.sina.com | | | | | | bing_domain_web |
| 57 | ischool.edu.sina.com | | | | | | bing_domain_web |
| 58 | mgame.sina.com | | | | | | bing_domain_web |
| 59 | opay.sina.com | | | | | | bing_domain_web |
| 60 | ww1.sinaimg.cn.w.alikunlun.com | | | | | | brute_hosts |
| 61 | ads.sina.com | 118.180.35.233 | | | | | brute_hosts |
| 62 | ads.sina.com | 118.180.35.104 | | | | | brute_hosts |
| 63 | ads.sina.com | 118.180.35.234 | | | | | brute_hosts |
| 64 | ads.sina.com | 118.180.35.105 | | | | | brute_hosts |
| 65 | ads.sina.com | 118.180.35.235 | | | | | brute_hosts |
| 66 | ads.sina.com | 118.180.35.106 | | | | | brute_hosts |
| 67 | ads.sina.com | 118.180.35.236 | | | | | brute_hosts |
| 68 | ads.sina.com | 118.180.35.107 | | | | | brute_hosts |
| 69 | ads.sina.com | 118.180.35.237 | | | | | brute_hosts |
| 70 | ads.sina.com | 118.180.35.108 | | | | | brute_hosts |
| 71 | ads.sina.com | 118.180.35.109 | | | | | brute_hosts |
| 72 | ads.sina.com | 118.180.35.110 | | | | | brute_hosts |
| 73 | apple.sina.com | 71.5.7.45 | | | | | brute_hosts |
| 74 | thad-test.sina.com | | | | | | brute_hosts |
| 75 | auth.sina.com | | | | | | brute_hosts |
| 76 | auth.sina.com | 71.5.7.247 | | | | | brute_hosts |
| 77 | xczspool.grid.sinaedge.com | | | | | | brute_hosts |
| 78 | auto.sina.com | 113.137.58.67 | | | | | brute_hosts |
| 79 | bbs.sina.com | 10.10.10.10 | | | | | brute_hosts |
| 80 | ads.sina.com | 118.180.35.238 | | | | | brute_hosts |
| 81 | ads.sina.com | 118.180.35.239 | | | | | brute_hosts |
| 82 | blog.sina.com.cn | | | | | | brute_hosts |
| 83 | blog.sina.com | | | | | | brute_hosts |
| 84 | blogx.sina.com.cn | | | | | | brute_hosts |
| 85 | blog.sina.com | 49.7.37.126 | | | | | brute_hosts |
| 86 | calendar.sina.com | 71.5.7.99 | | | | | brute_hosts |
| 87 | careers.sina.com | 71.5.7.240 | | | | | brute_hosts |
| 88 | spit.sina.com | | | | | | brute_hosts |
| 89 | chat.sina.com | | | | | | brute_hosts |
| 90 | chat.sina.com | 71.5.7.171 | | | | | brute_hosts |
| 91 | checkpoint.sina.com | 71.5.7.98 | | | | | brute_hosts |
| 92 | classifieds.sina.com | | | | | | brute_hosts |
| 93 | classifieds.sina.com | 71.5.7.171 | | | | | brute_hosts |
| 94 | client.sina.com | 66.102.251.24 | | | | | brute_hosts |
| 95 | ww7.sina.com | | | | | | brute_hosts |
| 96 | club.sina.com | | | | | | brute_hosts |
| 97 | club.sina.com | 71.5.7.191 | | | | | brute_hosts |
| 98 | cn.sina.com | 209.66.98.24 | | | | | brute_hosts |
| 99 | commerce.sina.com | 71.5.7.170 | | | | | brute_hosts |
| 100 | theone.sina.com.cn | | | | | | brute_hosts |
| 101 | corp.sina.com | | | | | | brute_hosts |
| 102 | corp.sina.com | 123.126.53.69 | | | | | brute_hosts |
| 103 | cs.sina.com | | | | | | brute_hosts |
| 104 | cs.sina.com | 71.5.7.171 | | | | | brute_hosts |
| 105 | content.sina.com | 71.5.7.194 | | | | | brute_hosts |
| 106 | data.weibo.com | | | | | | brute_hosts |
| 107 | data.sina.com | | | | | | brute_hosts |
| 108 | w3.dpool.sina.com.cn | | | | | | brute_hosts |
| 109 | data.sina.com | 49.7.36.27 | | | | | brute_hosts |
| 110 | europe.sina.com | | | | | | brute_hosts |
| 111 | europe.sina.com | 71.5.7.171 | | | | | brute_hosts |
| 112 | events.sina.com | | | | | | brute_hosts |
| 113 | events.sina.com | 118.180.35.108 | | | | | brute_hosts |
| 114 | events.sina.com | 118.180.35.232 | | | | | brute_hosts |
| 115 | events.sina.com | 118.180.35.109 | | | | | brute_hosts |
| 116 | events.sina.com | 118.180.35.233 | | | | | brute_hosts |
| 117 | events.sina.com | 118.180.35.110 | | | | | brute_hosts |
| 118 | events.sina.com | 118.180.35.234 | | | | | brute_hosts |
| 119 | events.sina.com | 118.180.35.111 | | | | | brute_hosts |
| 120 | events.sina.com | 118.180.35.235 | | | | | brute_hosts |
| 121 | events.sina.com | 118.180.35.104 | | | | | brute_hosts |
| 122 | events.sina.com | 118.180.35.236 | | | | | brute_hosts |
| 123 | events.sina.com | 118.180.35.105 | | | | | brute_hosts |
| 124 | events.sina.com | 118.180.35.106 | | | | | brute_hosts |
| 125 | exchange.sina.com | 71.5.7.86 | | | | | brute_hosts |
| 126 | us.sina.com | | | | | | brute_hosts |
| 127 | forum.sina.com | | | | | | brute_hosts |
| 128 | forum.sina.com | 66.102.251.24 | | | | | brute_hosts |
| 129 | forums.sina.com | | | | | | brute_hosts |
| 130 | forums.sina.com | 66.102.251.24 | | | | | brute_hosts |
| 131 | fj.sina.com | | | | | | brute_hosts |
| 132 | fj.sina.com | 113.137.58.67 | | | | | brute_hosts |
| 133 | blossom.sina.com | | | | | | brute_hosts |
| 134 | ftp.sina.com | | | | | | brute_hosts |
| 135 | ftp.sina.com | 71.5.7.14 | | | | | brute_hosts |
| 136 | g.sina.com | 219.142.118.250 | | | | | brute_hosts |
| 137 | gd.sina.com.cn | | | | | | brute_hosts |
| 138 | gd.sina.com | | | | | | brute_hosts |
| 139 | gd.sina.com | 113.137.58.67 | | | | | brute_hosts |
| 140 | ww8.sina.com | | | | | | brute_hosts |
| 141 | go.sina.com | | | | | | brute_hosts |
| 142 | go.sina.com | 71.5.7.191 | | | | | brute_hosts |
| 143 | www.vip9999.com | | | | | | brute_hosts |
| 144 | gold.sina.com | | | | | | brute_hosts |
| 145 | gold.sina.com | 121.40.176.71 | | | | | brute_hosts |
| 146 | japan.sina.com | | | | | | brute_hosts |
| 147 | germany.sina.com | | | | | | brute_hosts |
| 148 | germany.sina.com | 71.5.7.149 | | | | | brute_hosts |
| 149 | games.sina.com | | | | | | brute_hosts |
| 150 | games.sina.com | 27.221.32.27 | | | | | brute_hosts |
| 151 | home.sina.com | 10.10.10.10 | | | | | brute_hosts |
| 152 | tux2-vip.sina.com | | | | | | brute_hosts |
| 153 | hotjobs.sina.com | | | | | | brute_hosts |
| 154 | hotjobs.sina.com | 71.5.7.218 | | | | | brute_hosts |
| 155 | images.sina.com | | | | | | brute_hosts |
| 156 | images.sina.com | 118.180.35.235 | | | | | brute_hosts |
| 157 | images.sina.com | 118.180.35.107 | | | | | brute_hosts |
| 158 | images.sina.com | 118.180.35.104 | | | | | brute_hosts |
| 159 | images.sina.com | 118.180.35.105 | | | | | brute_hosts |
| 160 | images.sina.com | 118.180.35.109 | | | | | brute_hosts |
| 161 | images.sina.com | 118.180.35.108 | | | | | brute_hosts |
| 162 | images.sina.com | 118.180.35.111 | | | | | brute_hosts |
| 163 | images.sina.com | 118.180.35.106 | | | | | brute_hosts |
| 164 | images.sina.com | 118.180.35.234 | | | | | brute_hosts |
| 165 | images.sina.com | 118.180.35.237 | | | | | brute_hosts |
| 166 | images.sina.com | 118.180.35.236 | | | | | brute_hosts |
| 167 | images.sina.com | 118.180.35.233 | | | | | brute_hosts |
| 168 | imap.sina.com.cn | | | | | | brute_hosts |
| 169 | imap.sina.com | | | | | | brute_hosts |
| 170 | imap.sina.com | 39.156.6.106 | | | | | brute_hosts |
| 171 | img.sina.com | 66.102.251.24 | | | | | brute_hosts |
| 172 | japan.sina.com | 71.5.7.149 | | | | | brute_hosts |
| 173 | jedi.sina.com | 71.5.7.219 | | | | | brute_hosts |
| 174 | jobs.sina.com | | | | | | brute_hosts |
| 175 | jobs.sina.com | 71.5.7.171 | | | | | brute_hosts |
| 176 | korea.sina.com | | | | | | brute_hosts |
| 177 | korea.sina.com | 71.5.7.149 | | | | | brute_hosts |
| 178 | la.sina.com | 71.5.7.102 | | | | | brute_hosts |
| 179 | sina.gcs-web.com | | | | | | brute_hosts |
| 180 | ir.sina.com | | | | | | brute_hosts |
| 181 | wildcard.gcs-web.com | | | | | | brute_hosts |
| 182 | wildcard.gcs-web.edgekey.net | | | | | | brute_hosts |
| 183 | e11065.a.akamaiedge.net | | | | | | brute_hosts |
| 184 | ir.sina.com | 104.71.168.129 | | | | | brute_hosts |
| 185 | lists.sina.com | 66.102.251.33 | | | | | brute_hosts |
| 186 | localhost.sina.com | 127.0.0.1 | | | | | brute_hosts |
| 187 | login.sina.com | 66.102.251.33 | | | | | brute_hosts |
| 188 | mail.sina.com.cn | | | | | | brute_hosts |
| 189 | common7.dpool.sina.com.cn | | | | | | brute_hosts |
| 190 | mail.sina.com | 49.7.36.27 | | | | | brute_hosts |
| 191 | maint.sina.com | 71.5.7.5 | | | | | brute_hosts |
| 192 | mall.sina.com.cn | | | | | | brute_hosts |
| 193 | mall.sina.com | | | | | | brute_hosts |
| 194 | w5.dpool.sina.com.cn | | | | | | brute_hosts |
| 195 | mall.sina.com | 49.7.36.27 | | | | | brute_hosts |
| 196 | management.sina.com | 10.255.0.132 | | | | | brute_hosts |
| 197 | bizkit-vip.sina.com | | | | | | brute_hosts |
| 198 | maps.sina.com | | | | | | brute_hosts |
| 199 | maps.sina.com | 71.5.7.159 | | | | | brute_hosts |
| 200 | marketplace.sina.com | | | | | | brute_hosts |
| 201 | marketplace.sina.com | 118.180.35.234 | | | | | brute_hosts |
| 202 | marketplace.sina.com | 118.180.35.109 | | | | | brute_hosts |
| 203 | marketplace.sina.com | 118.180.35.235 | | | | | brute_hosts |
| 204 | marketplace.sina.com | 118.180.35.110 | | | | | brute_hosts |
| 205 | marketplace.sina.com | 118.180.35.236 | | | | | brute_hosts |
| 206 | marketplace.sina.com | 118.180.35.111 | | | | | brute_hosts |
| 207 | marketplace.sina.com | 118.180.35.237 | | | | | brute_hosts |
| 208 | marketplace.sina.com | 118.180.35.104 | | | | | brute_hosts |
| 209 | marketplace.sina.com | 118.180.35.238 | | | | | brute_hosts |
| 210 | marketplace.sina.com | 118.180.35.105 | | | | | brute_hosts |
| 211 | marketplace.sina.com | 118.180.35.106 | | | | | brute_hosts |
| 212 | marketplace.sina.com | 118.180.35.107 | | | | | brute_hosts |
| 213 | marketing.sina.com | 71.5.7.205 | | | | | brute_hosts |
| 214 | m.sina.com | 218.104.80.165 | | | | | brute_hosts |
| 215 | members.sina.com | 66.102.251.33 | | | | | brute_hosts |
| 216 | monitor.sina.com | 10.1.1.50 | | | | | brute_hosts |
| 217 | mt.sina.com | 27.221.32.27 | | | | | brute_hosts |
| 218 | content.dpool.weibo.com | | | | | | brute_hosts |
| 219 | music.sina.com | | | | | | brute_hosts |
| 220 | music.sina.com | 180.149.134.217 | | | | | brute_hosts |
| 221 | my.sina.com | | | | | | brute_hosts |
| 222 | my.sina.com | 71.5.7.171 | | | | | brute_hosts |
| 223 | news.sina.com | 10.10.10.10 | | | | | brute_hosts |
| 224 | resolver3.sina.com | | | | | | brute_hosts |
| 225 | ns.sina.com | | | | | | brute_hosts |
| 226 | ns.sina.com | 71.5.7.135 | | | | | brute_hosts |
| 227 | ns1.sina.com | 114.134.80.144 | | | | | brute_hosts |
| 228 | ns2.sina.com | 114.134.80.145 | | | | | brute_hosts |
| 229 | ns3.sina.com | 180.149.138.199 | | | | | brute_hosts |
| 230 | ns4.sina.com | 123.125.29.99 | | | | | brute_hosts |
| 231 | ny.sina.com | | | | | | brute_hosts |
| 232 | ny.sina.com | 71.5.7.102 | | | | | brute_hosts |
| 233 | nz.sina.com | 71.5.7.32 | | | | | brute_hosts |
| 234 | partners.sina.com | | | | | | brute_hosts |
| 235 | partners.sina.com | 71.5.7.171 | | | | | brute_hosts |
| 236 | pop3.sina.com.cn | | | | | | brute_hosts |
| 237 | pop.sina.com | | | | | | brute_hosts |
| 238 | pop.sina.com | 121.14.32.133 | | | | | brute_hosts |
| 239 | pop3.sina.com | | | | | | brute_hosts |
| 240 | pop3.sina.com | 121.14.32.133 | | | | | brute_hosts |
| 241 | proxy.sina.com | 71.5.7.50 | | | | | brute_hosts |
| 242 | radio.sina.com | 202.108.37.148 | | | | | brute_hosts |
| 243 | radio.sina.com | 202.108.37.149 | | | | | brute_hosts |
| 244 | radio.sina.com | 202.108.37.150 | | | | | brute_hosts |
| 245 | register.sina.com | 71.5.7.111 | | | | | brute_hosts |
| 246 | reports.sina.com | 71.5.7.56 | | | | | brute_hosts |
| 247 | search.sina.com | 71.5.7.11 | | | | | brute_hosts |
| 248 | security.sina.com | 10.41.13.132 | | | | | brute_hosts |
| 249 | sanjose.sina.com | 71.5.7.28 | | | | | brute_hosts |
| 250 | shopping.sina.com | 10.10.10.10 | | | | | brute_hosts |
| 251 | sc.sina.com | 113.137.58.67 | | | | | brute_hosts |
| 252 | sh.sina.com | | | | | | brute_hosts |
| 253 | sh.sina.com | 113.137.58.67 | | | | | brute_hosts |
+----------------------------------------------------------------------------------------------------------------------+
[*] 253 rows returned
3.6> 解析域名对应的IP地址
[recon-ng][sina][brute_hosts] > search resolve
[*] Searching for 'resolve'...
Recon
-----
recon/hosts-hosts/resolve
recon/hosts-hosts/reverse_resolve
recon/netblocks-hosts/reverse_resolve
[recon-ng][sina][brute_hosts] > use recon/hosts-hosts/resolve
[recon-ng][sina][resolve] > show options
Name Current Value Required Description
------ ------------- -------- -----------
SOURCE default yes source of input (see 'show info' for details)
[recon-ng][sina][resolve] > set SOURCE query select host from hosts
SOURCE => query select host from hosts
[recon-ng][sina][resolve] > run
[*] med.sina.com => 175.6.235.227
[*] mail.sina.com => 49.7.36.59
[*] sifa.sina.com => 120.55.197.36
[*] eva.sina.com => 220.181.84.153
[*] immigration.sina.com => 118.180.35.109
[*] immigration.sina.com => 118.180.35.232
[*] immigration.sina.com => 118.180.35.110
[*] immigration.sina.com => 118.180.35.233
[*] immigration.sina.com => 118.180.35.111
[*] immigration.sina.com => 118.180.35.234
[*] immigration.sina.com => 118.180.35.104
[*] immigration.sina.com => 118.180.35.235
[*] immigration.sina.com => 118.180.35.105
[*] immigration.sina.com => 118.180.35.236
[*] immigration.sina.com => 118.180.35.106
[*] immigration.sina.com => 118.180.35.107
[*] zt.sina.com => 123.126.45.135
[*] v.game.sina.com => 49.7.36.27
[*] xwz.sina.com => 49.7.36.27
[*] ads.sina.com => 118.180.35.236
[*] ads.sina.com => 118.180.35.106
[*] ads.sina.com => 118.180.35.237
[*] ads.sina.com => 118.180.35.107
[*] ads.sina.com => 118.180.35.238
[*] ads.sina.com => 118.180.35.108
[*] ads.sina.com => 118.180.35.239
[*] ads.sina.com => 118.180.35.109
[*] ads.sina.com => 118.180.35.232
[*] ads.sina.com => 118.180.35.110
[*] ads.sina.com => 118.180.35.111
[*] ads.sina.com => 118.180.35.104
[*] it.mn.sina.com => 106.14.250.6
[*] ued.sina.com => 220.181.136.144
[*] travel.sina.com => DNS Error
[*] lymf.sina.com => 27.221.32.27
[*] slide.sports.sina.com => 66.102.251.24
[*] client.sina.com => 66.102.251.24
[*] home.games.sina.com => 123.126.45.49
[*] mt.sina.com => 27.221.32.27
[*] hainan.sina.com => 113.137.58.67
^C
-------
SUMMARY
-------
[*] 22 total (22 new) hosts found.
3.7> 将解析出来的结果导出为报告；
[recon-ng][sina][resolve] > search report
[*] Searching for 'report'...
Reporting
---------
reporting/csv
reporting/html
reporting/json
reporting/list
reporting/proxifier
reporting/pushpin
reporting/xlsx
reporting/xml
[recon-ng][sina][resolve] > use reporting/html
[recon-ng][sina][html] > show options
Name Current Value Required Description
-------- ------------- -------- -----------
CREATOR yes creator name for the report footer
CUSTOMER yes customer name for the report header
FILENAME /root/.recon-ng/workspaces/sina/results.html yes path and filename for report output
SANITIZE True yes mask sensitive data in the report
[recon-ng][sina][html] > set CREATOR sina...
CREATOR => sina...
[recon-ng][sina][html] > set CUSTOMER scan_sina.com
CUSTOMER => scan_sina.com
[recon-ng][sina][html] > set FILENAME /root/sina.html
FILENAME => /root/sina.html
[recon-ng][sina][html] > run
[*] Report generated at '/root/sina.com'.
3.8> 查看导出的报告
