WEB渗透测试（二）主动信息收集1（二层发现）

主动信息收集1（二层发现）

 

>主动信息收集

>二层主机发现

>arping

>nmap

>netdiscover

>scapy

---

>主动信息收集

1.特点：直接与目标系统交互通信，但无法避免留下痕迹

2.解决方法

• 使用受控的第三方电脑进行探测，如使用代理或已被控制的主机
• 使用噪声迷惑目标，淹没真实的探测流量
• 做好被封杀的准备

3.扫描：发送不同的探测，根据返回结果判断目标状态

4.发现

• 识别存活主机（潜在的被攻击对象）
• 输出结果（IP地址列表）
• 根据OSI的分层，在2/3/4层实现主机发现

>二层主机发现

• 原理：使用ARP协议，在网段内进行广播，看是否有回包（或直接抓包查看），若有回包，则证明主机存活
• 优点：扫描速度快、可靠
• 缺点：只能发现同一网段内的主机，且不可路由

>arping

• 扫描单个IP地址

arping

arping 192.168.10.148

arping 192.168.10.148 -c 2

arping 192.168.10.148 -w 5

arping -c 1 192.168.10.148 | grep 'reply from' | cut -d ' ' -f 4

root@xuer:~# arping    #aring用法
Usage: arping [-fqbDUAV] [-c count] [-w timeout] [-I device] [-s source] destination
  -f : quit on first reply
  -q : be quiet
  -b : keep broadcasting, don't go unicast
  -D : duplicate address detection mode
  -U : Unsolicited ARP mode, update your neighbours
  -A : ARP answer mode, update your neighbours
  -V : print version and exit
  -c count : how many packets to send
  -w timeout : how long to wait for a reply
  -I device : which ethernet device to use
  -s source : source ip address
  destination : ask for what ip address

root@xuer:~# arping 192.168.10.148    #一直持续不断地进行ping命令，可手动停止
ARPING 192.168.10.148 from 192.168.10.128 eth0
Unicast reply from 192.168.10.148 [00:0C:29:45:55:D4]  1.004ms
Unicast reply from 192.168.10.148 [00:0C:29:45:55:D4]  1.207ms
Unicast reply from 192.168.10.148 [00:0C:29:45:55:D4]  1.056ms
Unicast reply from 192.168.10.148 [00:0C:29:45:55:D4]  1.151ms
Unicast reply from 192.168.10.148 [00:0C:29:45:55:D4]  1.236ms
^CSent 5 probes (1 broadcast(s))
Received 5 response(s)

root@xuer:~# arping 192.168.10.148 -c 2    #指定发包数量
ARPING 192.168.10.148 from 192.168.10.128 eth0
Unicast reply from 192.168.10.148 [00:0C:29:45:55:D4]  2.386ms
Unicast reply from 192.168.10.148 [00:0C:29:45:55:D4]  1.307ms
Sent 2 probes (1 broadcast(s))
Received 2 response(s)

root@xuer:~# arping 192.168.10.148 -w 5    #指定超时时间，此处为：在5s内发包
ARPING 192.168.10.148 from 192.168.10.128 eth0
Unicast reply from 192.168.10.148 [00:0C:29:45:55:D4]  2.581ms
Unicast reply from 192.168.10.148 [00:0C:29:45:55:D4]  1.952ms
Unicast reply from 192.168.10.148 [00:0C:29:45:55:D4]  1.140ms
Unicast reply from 192.168.10.148 [00:0C:29:45:55:D4]  0.921ms
Unicast reply from 192.168.10.148 [00:0C:29:45:55:D4]  1.362ms
Unicast reply from 192.168.10.148 [00:0C:29:45:55:D4]  1.068ms
Sent 6 probes (1 broadcast(s))
Received 6 response(s)

root@xuer:~# arping -c 1 192.168.10.148 
ARPING 192.168.10.148 from 192.168.10.128 eth0
Unicast reply from 192.168.10.148 [00:0C:29:45:55:D4]  1.474ms
Sent 1 probes (1 broadcast(s))
Received 1 response(s)
root@xuer:~# arping -c 1 192.168.10.148 | grep 'reply from' 
Unicast reply from 192.168.10.148 [00:0C:29:45:55:D4]  1.028ms
root@xuer:~# arping -c 1 192.168.10.148 | grep 'reply from' | cut -d ' ' -f 4    #过滤出仅显示IP地址
192.168.10.148        

>nmap

• 扫描整个网段，可发现网段内本机的IP地址

nmap 192.168.10.1-254 -sn

nmap -iL iplist.txt -sn

root@xuer:~# nmap 192.168.10.1-254 -sn    #-sn 只进行主机发现，不进行端口扫描

Starting Nmap 7.40 ( https://nmap.org ) at 2019-04-24 15:47 CST
Nmap scan report for 192.168.10.1    #物理机虚拟网卡的IP地址
Host is up (0.00066s latency).
MAC Address: 00:50:56:C0:00:08 (VMware)
Nmap scan report for 192.168.10.2    #网关
Host is up (0.00029s latency).
MAC Address: 00:50:56:EA:E2:CD (VMware)
Nmap scan report for 192.168.10.148    #目标主机的IP
Host is up (0.00040s latency).
MAC Address: 00:0C:29:45:55:D4 (VMware)
Nmap scan report for 192.168.10.254    #网段边际
Host is up (0.00038s latency).
MAC Address: 00:50:56:E1:F2:34 (VMware)
Nmap scan report for 192.168.10.128    #本机IP
Host is up.
Nmap done: 254 IP addresses (5 hosts up) scanned in 2.20 seconds

root@xuer:~# leafpad iplist.txt
root@xuer:~# cat iplist.txt 
192.168.10.10
192.168.10.20
192.168.10.1
192.168.10.254
192.168.10.148
root@xuer:~# nmap -iL iplist.txt -sn    #按IP列表文件中的顺序扫描

Starting Nmap 7.40 ( https://nmap.org ) at 2019-04-24 15:51 CST
Nmap scan report for 192.168.10.1
Host is up (0.0045s latency).
MAC Address: 00:50:56:C0:00:08 (VMware)
Nmap scan report for 192.168.10.254
Host is up (0.00027s latency).
MAC Address: 00:50:56:E1:F2:34 (VMware)
Nmap scan report for 192.168.10.148
Host is up (0.00058s latency).
MAC Address: 00:0C:29:45:55:D4 (VMware)
Nmap done: 5 IP addresses (3 hosts up) scanned in 0.71 seconds

>netdiscover

• 专用于二层发现
• 应用于无线和交换网络环境中应用
• 分为主动探测和被动探测
• 无法发现自身主机的IP
• 主动探测

netdiscover -i eth0 -r 192.168.10.0/24       #netdiscover  -i  指定网卡  -r   网段

netdiscover -l iplist.txt                                #netdiscover -l 指定IP列表

root@xuer:~# netdiscover -i eth0 -r 192.168.10.0/24

 Currently scanning: Finished!   |   Screen View: Unique Hosts                 
                                                                               
 4 Captured ARP Req/Rep packets, from 4 hosts.   Total size: 240               
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
 -----------------------------------------------------------------------------
 192.168.10.1    00:50:56:c0:00:08      1      60  VMware, Inc.                
 192.168.10.2    00:50:56:ea:e2:cd      1      60  VMware, Inc.                
 192.168.10.148  00:0c:29:45:55:d4      1      60  VMware, Inc.                
 192.168.10.254  00:50:56:e1:f2:34      1      60  VMware, Inc.

root@xuer:~# cat iplist.txt 
192.168.10.10
192.168.10.20
192.168.10.1
192.168.10.254
192.168.10.148
root@xuer:~# netdiscover -l iplist.txt

 Currently scanning: Finished!   |   Screen View: Unique Hosts                 
                                                                               
 17 Captured ARP Req/Rep packets, from 3 hosts.   Total size: 1020             
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
 -----------------------------------------------------------------------------
 192.168.10.1    00:50:56:c0:00:08      5     300  VMware, Inc.                
 192.168.10.2    00:50:56:ea:e2:cd      6     360  VMware, Inc.                
 192.168.10.148  00:0c:29:45:55:d4      6     360  VMware, Inc.

• 被动探测

主动arp容易触发警报，因此也常采用被动探测的方式（实时监控）

root@xuer:~# netdiscover -p

 Currently scanning: (passive)   |   Screen View: Unique Hosts                 
                                                                               
 13 Captured ARP Req/Rep packets, from 1 hosts.   Total size: 780              
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
 -----------------------------------------------------------------------------
 192.168.10.148  00:0c:29:45:55:d4     13     780  VMware, Inc.  

>scapy

• 作为python库进行调用，也可单独作为工具使用
• 抓包、分析、修改、创建，注入网络的流量包

root@xuer:~# scapy

WARNING: No route found for IPv6 destination :: (no default route?)
INFO: Can't import python ecdsa lib. Disabled certificate manipulation tools
Welcome to Scapy (2.3.3)

>>> ARP().display()    ##显示ARP包中的信息
###[ ARP ]### 
  hwtype= 0x1
  ptype= 0x800
  hwlen= 6
  plen= 4
  op= who-has
  hwsrc= 00:0c:29:48:ba:66
  psrc= 192.168.10.128
  hwdst= 00:00:00:00:00:00
  pdst= 0.0.0.0

>>> arp=ARP()
>>> arp.pdst='192.168.10.148'    #设置目标IP
>>> arp.display()
###[ ARP ]### 
  hwtype= 0x1
  ptype= 0x800
  hwlen= 6
  plen= 4
  op= who-has
  hwsrc= 00:0c:29:48:ba:66
  psrc= 192.168.10.128
  hwdst= 00:00:00:00:00:00
  pdst= 192.168.10.148

>>> sr1(arp)    #发包
Begin emission:
*Finished to send 1 packets.

Received 1 packets, got 1 answers, remaining 0 packets
>
>>> a=sr1(arp)
Begin emission:
*Finished to send 1 packets.

Received 1 packets, got 1 answers, remaining 0 packets
>>> a.display()    #接收包
###[ ARP ]### 
  hwtype= 0x1
  ptype= 0x800
  hwlen= 6
  plen= 4
  op= is-at
  hwsrc= 00:0c:29:45:55:d4
  psrc= 192.168.10.148
  hwdst= 00:0c:29:48:ba:66
  pdst= 192.168.10.128
###[ Padding ]###     #padding为部位，当包的大小小于最小包长时，就会采用16进制0补位
     load= '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'