红队测试-网络侦查工具

• ACLight - Script for advanced discovery of sensitive Privileged Accounts - includes Shadow Admins.
• CloudFail - Unmask server IP addresses hidden behind Cloudflare by searching old database records and detecting misconfigured DNS.
• DNSDumpster - Online DNS recon and search service.
• Mass Scan - TCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes.
• ScanCannon - Python script to quickly enumerate large networks by calling masscan to quickly identify open ports and then nmap to gain details on the systems/services on those ports.
• XRay - Network (sub)domain discovery and reconnaissance automation tool.
• dnsenum - Perl script that enumerates DNS information from a domain, attempts zone transfers, performs a brute force dictionary style attack, and then performs reverse look-ups on the results.
• dnsmap - Passive DNS network mapper.
• dnsrecon - DNS enumeration script.
• dnstracer - Determines where a given DNS server gets its information from, and follows the chain of DNS servers.
• fierce - Python3 port of the original fierce.pl DNS reconnaissance tool for locating non-contiguous IP space.
• nmap - Free security scanner for network exploration & security audits.
• passivedns-client - Library and query tool for querying several passive DNS providers.
• passivedns - Network sniffer that logs all DNS server replies for use in a passive DNS setup.
• scanless - Utility for using websites to perform port scans on your behalf so as not to reveal your own IP.
• smbmap - Handy SMB enumeration tool.
• zmap - Open source network scanner that enables researchers to easily perform Internet-wide network studies.