站点信息搜集
站点信息搜集
1. whatweb 工具
kali自带的工具, 命令:
whatweb httpbin.org
'''
http://httpbin.org [200 OK]
Country[UNITED STATES][US], Email[[email protected]], HTML5,
HTTPServer[gunicorn/19.9.0], IP[54.161.141.91], JQuery,
Script[text/javascript], Title[httpbin.org],
UncommonHeaders[access-control-allow-origin,access-control-allow-credentials]
'''
2. whois信息
到域名注册网站直接查询相关信息, 比如注册信息:
万网: https://wanwang.aliyun.com/
Whois: https://www.whois.com
Domain Information
Domain:httpbin.org
Registrar:Amazon Registrar, Inc.
Registered On:2011-06-12
Expires On:2025-06-12
Updated On:2022-12-26
Status:clientDeleteProhibited
clientTransferProhibited
clientUpdateProhibited
Name Servers:
ns-1053.awsdns-03.org
ns-1555.awsdns-02.co.uk
ns-173.awsdns-21.com
ns-884.awsdns-46.net
3. python-whois 库
from whois import whois
import json
result = whois('httpbin.org')
print(json.loads(str(result)))
{'domain_name': 'httpbin.org', 'registrar': 'Amazon Registrar, Inc.',
'whois_server': 'whois.registrar.amazon.com',
'referral_url': None,
'updated_date': '2022-12-26 23:25:54',
'creation_date': '2011-06-12 21:57:10', 'expiration_date': '2025-06-12 21:57:10',
'name_servers': ['ns-1053.awsdns-03.org', 'ns-1555.awsdns-02.co.uk', 'ns-173.awsdns-21.com', 'ns-884.awsdns-46.net', 'NS-1053.AWSDNS-03.ORG', 'NS-1555.AWSDNS-02.CO.UK', 'NS-173.AWSDNS-21.COM', 'NS-884.AWSDNS-46.NET'],
'status': ['clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited', 'clientTransferProhibited https://icann.org/epp#clientTransferProhibited', 'clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited'],
'emails': ['[email protected]', '[email protected]'],
'dnssec': 'unsigned',
'name': ['REDACTED FOR PRIVACY', 'On behalf of httpbin.org owner'],
'org': 'Identity Protection Service',
'address': ['REDACTED FOR PRIVACY', 'PO Box 786'],
'city': ['REDACTED FOR PRIVACY', 'Hayes'],
'state': 'Middlesex',
'registrant_postal_code': ['REDACTED FOR PRIVACY', 'UB3 9TR'], 'country': 'GB'}
4. nslookup 命令
该命令win和linux都有, 获取到的ip如果有多个, 可能使用了CDN服务器
nslookup httpbin.org
服务器: 192.168.1.1
Address: 192.168.1.1
非权威应答:
名称: httpbin.org
Addresses: 54.85.134.100
54.161.141.91
5. fofa 搜索引擎
探测服务器的地点, 端口, 协议, 组件(收费):
https://fofa.info/
说明: 点击 IP聚合 可以看到服务器的端口, 下方提供各个端口的访问链接
6. shodan 搜索引擎
这是一个功能非常多的搜索引擎, 可以搜索路由器, 摄像头, 打印机, 服务器等各种联网设备.
https://www.shodan.io/