Kali渗透测试之服务扫描3——防火墙识别、负载均衡识别、WAF识别
一、防火墙识别
- 公司网络的边界一般都会有防火墙进行保护，防火墙上会有一些检测机制，我们的目的是尽量隐蔽地扫描出防火墙的规则，以及开放端口。
- 扫描原理：通过发送数据包，检查回包，可能识别端口是否经过防火墙过滤。
- 设备多种多样，结果存在一定误差。
可根据下面四种方法来判断防火墙的过滤规则：
1、使用python脚本进行防火墙识别——fw_detect.py
#!/usr/bin/python
#该脚本用于实现判断防火墙的过滤端口
from scapy.all import *
import sys
if len(sys.argv) != 3:
print ("This script needs 2 args!\nExample:./fw_detect.py 192.168.0.0 80")
sys.exit()
ip = sys.argv[1]
port = int(sys.argv[2])
SYN_response = sr1(IP(dst = ip) / TCP(flags = "S", dport = port), timeout = 1, verbose = 0)
ACK_response = sr1(IP(dst = ip) / TCP(flags = "A", dport = port), timeout = 1, verbose = 0)
if (SYN_response == None) and (ACK_response == None):
print("1. Port is filtered or host is down!")
elif (SYN_response[TCP].flags == "SA" or SYN_response[TCP].flags == "SR") and (ACK_response == None):
print("2. Port is filtered!")
elif int(SYN_response[TCP].flags) == 18:
print ("Port is unfiltered and open" )
elif int(SYN_response[TCP].flags) == 20:
print ("Port is unfiltered and closed")
else:
print ("4. Port is Closed!")2、nmap
- nmap有系列防火墙过滤检测功能
root@kali:~# nmap 192.168.247.129 -p25 //默认发SYN包
Starting Nmap 7.70 ( https://nmap.org ) at 2019-05-04 17:21 CST
Nmap scan report for bogon (192.168.247.129)
Host is up (0.00027s latency).
PORT STATE SERVICE
25/tcp open smtp
MAC Address: 00:0C:29:8F:74:74 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 0.18 seconds
root@kali:~# nmap -sA 192.168.247.129 -p25 //-sA：发ACK包
Starting Nmap 7.70 ( https://nmap.org ) at 2019-05-04 17:21 CST
Nmap scan report for bogon (192.168.247.129)
Host is up (0.00037s latency).
PORT STATE SERVICE
25/tcp unfiltered smtp
MAC Address: 00:0C:29:8F:74:74 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 0.08 seconds二、负载均衡识别
负载均衡（Load Balance）其意思就是分摊到多个操作单元上进行执行，例如Web服务器、FTP服务器、企业关键应用服务器和其它关键任务服务器等，从而共同完成工作任务。
负载均衡从其应用的地理结构上分为本地负载均衡（Local Load Balance）和全局负载均衡（Global Load Balance，也叫地域负载均衡）。
- 本地负载均衡是指对本地的服务器群做负载均衡；
- 全局负载均衡是指对分别放置在不同的地理位置、有不同网络结构的服务器群间作负载均衡。
它提供了一种廉价有效透明的方法扩展网络设备和服务器的带宽、增加吞吐量、加强网络数据处理能力、提高网络的灵活性和可用性。因此，存在同一个域名对应多个IP地址（智能DNS、DNS轮询）
针对web的服务负载均衡经常使用Nginx、Apache应用层负载均衡。
1、lbd
- lbd 域名/IP
root@kali:~# lbd www.sina.com
lbd - load balancing detector 0.4 - Checks if a given domain uses load-balancing.
Written by Stefan Behte (http://ge.mine.nu)
Proof-of-concept! Might give false positives.
Checking for DNS-Loadbalancing: FOUND #一个域名被解析成两个IP地址
spool.grid.sinaedge.com has address 221.204.241.188
spool.grid.sinaedge.com has address 61.158.251.244
Checking for HTTP-Loadbalancing [Server]:
nginx
NOT FOUND
Checking for HTTP-Loadbalancing [Date]: 09:29:44, 09:29:44, 09:29:44, 09:29:44, 09:29:44, 09:29:44, 09:29:44, 09:29:45, 09:29:45, 09:29:45, 09:29:45, 09:29:45, 09:29:45, 09:29:45, 09:29:45, 09:29:45, 09:29:46, 09:29:46, 09:29:46, 09:29:46, 09:29:46, 09:29:46, 09:29:46, 09:29:46, 09:29:46, 09:29:46, 09:29:47, 09:29:47, 09:29:47, 09:29:47, 09:29:47, 09:29:47, 09:29:47, 09:29:47, 09:29:47, 09:29:48, 09:29:48, 09:29:48, 09:29:48, 09:29:48, 09:29:48, 09:29:48, 09:29:49, 09:29:49, 09:29:49, 09:29:49, 09:29:49, 09:29:49, 09:29:49, 09:29:50, NOT FOUND
Checking for HTTP-Loadbalancing [Diff]: FOUND
< X-Via-Edge: 15569621901482f568b7bf4fb9e3d2add258c
> X-Via-Edge: 15569621902842f568b7bf4fb9e3d739f6bf4
< X-Via-CDN: f=edge,s=cnc.zhengzhou.ha2ts4.201.nb.sinaedge.com,c=123.139.86.47;f=Edge,s=cnc.zhengzhou.ha2ts4.201,c=61.158.251.201
> X-Via-CDN: f=edge,s=cnc.zhengzhou.ha2ts4.197.nb.sinaedge.com,c=123.139.86.47;f=Edge,s=cnc.zhengzhou.ha2ts4.201,c=61.158.251.197
www.sina.com does Load-balancing. Found via Methods: DNS HTTP[Diff]
三、WAF识别
WAF：Web应用防护系统（也称为：网站应用级入侵防御系统。英文：Web Application Firewall，简称： WAF）。利用国际上公认的一种说法：Web应用防火墙是通过执行一系列针对HTTP/HTTPS的安全策略来专门为Web应用提供保护的一款产品。
1、wafw00f
root@kali:~# wafw00f -l #列出可检测到的WAF
^ ^
_ __ _ ____ _ __ _ _ ____
///7/ /.' \ / __7/ /,' \ ,' \ / __/
| V V // o // _/ | V V // 0 // 0 // _/
|_n_,'/_n_//_/ |_n_,' \_,' \_,'/_/
<
...'
WAFW00F - Web Application Firewall Detection Tool
By Sandro Gauci && Wendel G. Henrique
Can test for these WAFs:
Profense
NetContinuum
Incapsula WAF
CloudFlare
NSFocus
Safedog
Mission Control Application Shield
USP Secure Entry Server
Cisco ACE XML Gateway
Barracuda Application Firewall
Art of Defence HyperGuard
BinarySec
Teros WAF
F5 BIG-IP LTM
F5 BIG-IP APM
F5 BIG-IP ASM
F5 FirePass
F5 Trafficshield
InfoGuard Airlock
Citrix NetScaler
Trustwave ModSecurity
IBM Web Application Security
IBM DataPower
DenyALL WAF
Applicure dotDefender
Juniper WebApp Secure
Microsoft URLScan
Aqtronix WebKnight
eEye Digital Security SecureIIS
Imperva SecureSphere
Microsoft ISA Server
root@kali:~# wafw00f http://www.baidu.com
^ ^
_ __ _ ____ _ __ _ _ ____
///7/ /.' \ / __7/ /,' \ ,' \ / __/
| V V // o // _/ | V V // 0 // 0 // _/
|_n_,'/_n_//_/ |_n_,' \_,' \_,'/_/
<
...'
WAFW00F - Web Application Firewall Detection Tool
By Sandro Gauci && Wendel G. Henrique
Checking http://www.baidu.com
Generic Detection results:
The site http://www.baidu.com seems to be behind a WAF or some sort of security solution
Reason: The server returned a different response code when a string trigged the blacklist.
Normal response code is "200", while the response code to an attack is "302"
Number of requests: 12
2、nmap
root@kali:~# nmap www.baidu.com --script=http-waf-detect.nse
Starting Nmap 7.70 ( https://nmap.org ) at 2019-05-05 09:37 CST
Nmap scan report for www.baidu.com (61.135.169.125)
Host is up (0.022s latency).
Other addresses for www.baidu.com (not scanned): 61.135.169.121
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp open http
| http-waf-detect: IDS/IPS/WAF detected:
|_www.baidu.com:80/?p4yl04d3=
443/tcp open https
| http-waf-detect: IDS/IPS/WAF detected:
|_www.baidu.com:443/?p4yl04d3=
Nmap done: 1 IP address (1 host up) scanned in 59.83 seconds四、nmap
虽然前面介绍了那么多的扫描方法，但是nmap仍是最强大的扫描器，现将nmap的帮助信息显示如下：
oot@kali:~# nmap
Nmap 7.70 ( https://nmap.org )
Usage: nmap [Scan Type(s)] [Options] {target specification}
TARGET SPECIFICATION: #目标主机说明
Can pass hostnames, IP addresses, networks, etc.
Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
-iL : Input from list of hosts/networks
-iR : Choose random targets
--exclude : Exclude hosts/networks
--excludefile : Exclude list from file
HOST DISCOVERY: #主机发现
-sL: List Scan - simply list targets to scan
-sn: Ping Scan - disable port scan
-Pn: Treat all hosts as online -- skip host discovery
-PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports
-PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
-PO[protocol list]: IP Protocol Ping
-n/-R: Never do DNS resolution/Always resolve [default: sometimes]
--dns-servers : Specify custom DNS servers
--system-dns: Use OS's DNS resolver
--traceroute: Trace hop path to each host
SCAN TECHNIQUES: #扫描技术
-sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
-sU: UDP Scan
-sN/sF/sX: TCP Null, FIN, and Xmas scans
--scanflags : Customize TCP scan flags
-sI : Idle scan
-sY/sZ: SCTP INIT/COOKIE-ECHO scans
-sO: IP protocol scan
-b : FTP bounce scan
PORT SPECIFICATION AND SCAN ORDER: #端口说明和扫描顺序
-p : Only scan specified ports
Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9
--exclude-ports : Exclude the specified ports from scanning
-F: Fast mode - Scan fewer ports than the default scan
-r: Scan ports consecutively - don't randomize
--top-ports : Scan most common ports
--port-ratio : Scan ports more common than
SERVICE/VERSION DETECTION: #服务/版本探测
-sV: Probe open ports to determine service/version info
--version-intensity : Set from 0 (light) to 9 (try all probes)
--version-light: Limit to most likely probes (intensity 2)
--version-all: Try every single probe (intensity 9)
--version-trace: Show detailed version scan activity (for debugging)
SCRIPT SCAN: #脚本扫描
-sC: equivalent to --script=default
--script=: is a comma separated list of
directories, script-files or script-categories
--script-args=: provide arguments to scripts
--script-args-file=filename: provide NSE script args in a file
--script-trace: Show all data sent and received
--script-updatedb: Update the script database.
--script-help=: Show help about scripts.
is a comma-separated list of script-files or
script-categories.
OS DETECTION: #操作系统探测
-O: Enable OS detection
--osscan-limit: Limit OS detection to promising targets
--osscan-guess: Guess OS more aggressively
TIMING AND PERFORMANCE: #时间和性能
Options which take