码迷,mamicode.com
首页 > 其他好文 > 详细

0x01.被动信息收集

时间:2017-08-20 18:32:01      阅读:154      评论:0      收藏:0      [点我收藏+]

标签:扫描   交互   addition   dns服务器   aos   类型   tld   nic   ==   

 

被动信息收集

基于公开渠道,不与目标系统产生直接交互,尽量避免留下痕迹(不进行大量扫描,正常交互范围)

 

信息收集内容

  • IP段
  • 域名
  • 邮件地址(定位邮件服务器,分为个人搭建和公网邮件系统)
  • 文档图片数据(可能是公开的、搜索引擎爬到的、泄漏的等)
  • 公司地址(可进行物理渗透)
  • 公司组织架构(针对不同部门、不同岗位展开渗透)
  • 联系电话/传真号码
  • 目标系统技术架构
  • 公开的商业信息

 

信息用途

  • 用信息描述目标
  • 发现资产架构
  • 社会工程学工具
  • 物理缺口

 

信息收集-DNS(建议尝试不同的DNS服务器做查询)

DNS——域名解析成IP地址

  • 域名与FQDN的区别(baidu.com叫域名,www.baidu.com叫FQDN-主机记录-完全限定域名)
  • 域名记录:A(主机记录)、CNAME(别名记录)、NS(域名服务器)、MX(邮件服务器)、PTR(反向域名解析-IP->域名)
  • 递归查询、迭代查询

 

DNS——nslookup

1、自动判断域名类型,逐级解析

nslookup www.sina.com(nslookup [-type=any] 163.com [8.8.8.8])

test@ubuntu:/opt/tools$ nslookup
> www.sina.com
Server:        127.0.1.1        //当前的DNS服务器
Address:    127.0.1.1#53

Non-authoritative answer:
www.sina.com    canonical name = us.sina.com.cn.        //这里没有解析出IP地址,说明www.sina.com不是主机记录是一个CNAME记录
us.sina.com.cn    canonical name = wwwus.sina.com.
Name:    wwwus.sina.com
Address: 66.102.251.33    //这里其实nslookup已经自动执行下面步骤,解析出来最终结果
> us.sina.com.cn      //CNAME
Server:        127.0.1.1
Address:    127.0.1.1#53

Non-authoritative answer:
us.sina.com.cn    canonical name = wwwus.sina.com.
Name:    wwwus.sina.com
Address: 66.102.251.33
> wwwus.sina.com      //A记录-主机记录
Server:        127.0.1.1
Address:    127.0.1.1#53

Non-authoritative answer:
Name:    wwwus.sina.com
Address: 66.102.251.33

2、手动配置类型

set type=a、nx、mx、ptr、any(或者set p=)

> set type=mx        //只查询mx记录
> sina.com
Server:        127.0.1.1
Address:    127.0.1.1#53

Non-authoritative answer:
sina.com    mail exchanger = 10 freemx2.sinamail.sina.com.cn.
sina.com    mail exchanger = 10 freemx3.sinamail.sina.com.cn.
sina.com    mail exchanger = 5 freemx1.sinamail.sina.com.cn.    //默认情况下数值越小,优先级越高

> set type=a    //查询A记录
> freemx1.sinamail.sina.com.cn
Server:        127.0.1.1
Address:    127.0.1.1#53

Non-authoritative answer:
Name:    freemx1.sinamail.sina.com.cn
Address: 60.28.113.250

> set type=ns    //NS域名服务器记录
> sina.com
Server:        127.0.1.1
Address:    127.0.1.1#53

Non-authoritative answer:
sina.com    nameserver = ns3.sina.com.
sina.com    nameserver = ns4.sina.com.cn.
sina.com    nameserver = ns2.sina.com.
sina.com    nameserver = ns2.sina.com.cn.
sina.com    nameserver = ns1.sina.com.cn.
sina.com    nameserver = ns3.sina.com.cn.
sina.com    nameserver = ns4.sina.com.
sina.com    nameserver = ns1.sina.com.
> set type=any    //查询所有记录
> oppo.com
Server:        127.0.1.1
Address:    127.0.1.1#53

Non-authoritative answer:
oppo.com
    origin = ns3.dnsv5.com
    mail addr = enterprise3dnsadmin.dnspod.com
    serial = 1501171870
    refresh = 3600
    retry = 180
    expire = 1209600
    minimum = 180    //下面的spf记录是反垃圾邮件
oppo.com    text = "v=spf1 ip4:121.12.164.116 ip4:121.10.21.117 ip4:121.12.164.114 ip4:202.153.93.143 ip4:183.129.228.7 ip4:183.129.228.6 ip4:121.10.21.118 ip4:121.10.21.114 include:spf.dynect.net  ~all"
oppo.com    text = "google-site-verification=Bck8mAGGpQV1cumrBtcI-ih3_D3LVw26TFElSeeZuXE"
oppo.com    mail exchanger = 10 mx01.oppo.com.
Name:    oppo.com
Address: 60.12.225.132
oppo.com    nameserver = ns4.dnsv5.com.
oppo.com    nameserver = ns3.dnsv5.com.

3、指定解析服务器

server 8.8.8.8(不同DNS服务器解析出来的结果可能不同,智能DNS)

> server 8.8.8.8
Default server: 8.8.8.8
Address: 8.8.8.8#53
> www.sina.com
Server:        8.8.8.8
Address:    8.8.8.8#53

Non-authoritative answer:
www.sina.com    canonical name = us.sina.com.cn.
us.sina.com.cn    canonical name = wwwus.sina.com.

Authoritative answers can be found from:
sina.com
    origin = ns1.sina.com.cn
    mail addr = zhihao.staff.sina.com.cn
    serial = 2005042601
    refresh = 900
    retry = 300
    expire = 604800
    minimum = 300

 

DNS——dig(功能强于nslooup)

dig 163.com any @8.8.8.8

test@ubuntu:~$ dig sina.com any @8.8.8.8

; <<>> DiG 9.10.3-P4-Ubuntu <<>> sina.com any @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63412
;; flags: qr rd ra; QUERY: 1, ANSWER: 10, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;sina.com.            IN    ANY

;; ANSWER SECTION:
sina.com.        214    IN    TXT    "v=spf1 include:spf.sinamail.sina.com.cn -all"
sina.com.        84745    IN    NS    ns2.sina.com.cn.
sina.com.        84745    IN    NS    ns4.sina.com.cn.
sina.com.        84745    IN    NS    ns2.sina.com.
sina.com.        84745    IN    NS    ns1.sina.com.
sina.com.        84745    IN    NS    ns1.sina.com.cn.
sina.com.        84745    IN    NS    ns4.sina.com.
sina.com.        84745    IN    NS    ns3.sina.com.cn.
sina.com.        84745    IN    NS    ns3.sina.com.
sina.com.        833    IN    A    66.102.251.33

;; Query time: 10 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Sun Aug 20 15:59:49 CST 2017
;; MSG SIZE  rcvd: 265

dig +noall mail.163.com any(什么都不显示noall)

dig +noall +answer mail.163.com any(仅显示answer)

test@ubuntu:~$ dig +noall +answer mail.163.com any
mail.163.com.        590    IN    CNAME    mail163.ntes53.netease.com.

dig +noall +answer mail.163.com any | awk ‘{print $5}‘(结合管道输出)

test@ubuntu:~$ dig +noall +answer mail.163.com any | awk {print $5}
mail163.ntes53.netease.com.

dig -x IP地址(反向查询)

test@ubuntu:~$ dig +noall +answer -x 220.181.14.135
135.14.181.220.in-addr.arpa. 86366 IN    PTR    mr14135.mail.163.com.

dig +noall +answer txt chaos VERSION.BIND @ns3.dnsv4.com(查询BIND版本,根据版本漏洞获取DNS服务器权限,拿下更多DNS记录等)

test@ubuntu:~$ dig +noall +answer txt chaos VERSION.BIND @ns3.qq.com
VERSION.BIND.        0    CH    TXT    "Why query me?Your IP had been logged!"  //现在的DNS一般都做了保护模式

dig +trace sina.com(查询过程,跳过缓存从根域开始)

test@ubuntu:~$ dig +trace www163.com

; <<>> DiG 9.10.3-P4-Ubuntu <<>> +trace www163.com
;; global options: +cmd
.            202897    IN    NS    j.root-servers.net.
.            202897    IN    NS    g.root-servers.net.
.            202897    IN    NS    b.root-servers.net.
.            202897    IN    NS    f.root-servers.net.
.            202897    IN    NS    a.root-servers.net.
.            202897    IN    NS    l.root-servers.net.
.            202897    IN    NS    i.root-servers.net.
.            202897    IN    NS    h.root-servers.net.
.            202897    IN    NS    d.root-servers.net.
.            202897    IN    NS    m.root-servers.net.
.            202897    IN    NS    c.root-servers.net.
.            202897    IN    NS    e.root-servers.net.
.            202897    IN    NS    k.root-servers.net.
.            202897    IN    RRSIG    NS 8 0 518400 20170829050000 20170816040000 15768 . Dw1E3oCc0/16dZsOu77LbkBH3J225c/tU7DOrWN6RAPmNgS7uBycwjww KVvoWqUiMRBx8zfOk3RN4svR+El5Xjy5jhN5Ba2ZhuCrrHzhNlWmOL8L EKUY9TMJEkl7kiFAOO+H25bOlrcRUV4yif67MfYMl+F7sPc56O9w1/6j E57lBdwafZAZYSZ7CThFb8UDU/QgLnI6LFta8tWjmbG3zhFXZyodOrkq tktkPgNWy9Wqcv3asRc21gEr74W5ZSo5BriJrtIVFQ+rx7ewFbb97Axo 9e3bkoNyUCgZiSdt6YfVYTnPngax9JSAiKLsiBI4NOMPaZP0kWu4ypRp NZLMCg==
;; Received 525 bytes from 127.0.1.1#53(127.0.1.1) in 21 ms

com.            114894    IN    NS    e.gtld-servers.net.
com.            114894    IN    NS    g.gtld-servers.net.
com.            114894    IN    NS    f.gtld-servers.net.
com.            114894    IN    NS    a.gtld-servers.net.
com.            114894    IN    NS    m.gtld-servers.net.
com.            114894    IN    NS    c.gtld-servers.net.
com.            114894    IN    NS    h.gtld-servers.net.
com.            114894    IN    NS    k.gtld-servers.net.
com.            114894    IN    NS    l.gtld-servers.net.
com.            114894    IN    NS    i.gtld-servers.net.
com.            114894    IN    NS    b.gtld-servers.net.
com.            114894    IN    NS    j.gtld-servers.net.
com.            114894    IN    NS    d.gtld-servers.net.
com.            31125    IN    DS    30909 8 2 E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CF C41A5766
com.            31125    IN    RRSIG    DS 8 1 86400 20170901170000 20170819160000 15768 . EmAR+AZJ7iqSBsOfa8pawMWgsVe35TdvIVJh6Pg2lHlthvIhi2nxaV0n wEy7ZV7/WDMsR5ZDO9Msh7q3RTMUkqkXFrVVK301tdgq7xcDVyToIV3Y tonYkV0Ig5H1qptYHOnPyDSeeABurkmdkI6/PqgJMgFWyhBvvAB3qz0e xahU8P0VMSPCQ1bZKtpvGhKz0sUc3fRM0dZC8E2varrxSjSnEpY71EDl X7HyrlCCpyTgpa4ge6mQ2ayZrMTUmYFKt2eN7WZmVNATTAfap78QlGRx FbBOsrRmTNev2E/IMutbvPChm2K5FO1PmrrmxrdUqchh293pCswg8eKc BOsaUQ==
;; Received 1170 bytes from 192.58.128.30#53(j.root-servers.net) in 10 ms

www163.com.        10349    IN    NS    dns1.acsite.net.
www163.com.        10349    IN    NS    dns2.acsite.net.
;; Received 87 bytes from 192.33.14.30#53(b.gtld-servers.net) in 10 ms

www163.com.        10344    IN    NS    dns1.acsite.net.
www163.com.        10344    IN    NS    dns2.acsite.net.
;; BAD (HORIZONTAL) REFERRAL
;; Received 119 bytes from 198.15.68.212#53(dns2.acsite.net) in 29 ms

com.            114880    IN    NS    f.gtld-servers.net.
com.            114880    IN    NS    m.gtld-servers.net.
com.            114880    IN    NS    l.gtld-servers.net.
com.            114880    IN    NS    b.gtld-servers.net.
com.            114880    IN    NS    d.gtld-servers.net.
com.            114880    IN    NS    h.gtld-servers.net.
com.            114880    IN    NS    g.gtld-servers.net.
com.            114880    IN    NS    a.gtld-servers.net.
com.            114880    IN    NS    j.gtld-servers.net.
com.            114880    IN    NS    k.gtld-servers.net.
com.            114880    IN    NS    c.gtld-servers.net.
com.            114880    IN    NS    i.gtld-servers.net.
com.            114880    IN    NS    e.gtld-servers.net.
com.            31111    IN    DS    30909 8 2 E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CF C41A5766
com.            31111    IN    RRSIG    DS 8 1 86400 20170901170000 20170819160000 15768 . EmAR+AZJ7iqSBsOfa8pawMWgsVe35TdvIVJh6Pg2lHlthvIhi2nxaV0n wEy7ZV7/WDMsR5ZDO9Msh7q3RTMUkqkXFrVVK301tdgq7xcDVyToIV3Y tonYkV0Ig5H1qptYHOnPyDSeeABurkmdkI6/PqgJMgFWyhBvvAB3qz0e xahU8P0VMSPCQ1bZKtpvGhKz0sUc3fRM0dZC8E2varrxSjSnEpY71EDl X7HyrlCCpyTgpa4ge6mQ2ayZrMTUmYFKt2eN7WZmVNATTAfap78QlGRx FbBOsrRmTNev2E/IMutbvPChm2K5FO1PmrrmxrdUqchh293pCswg8eKc BOsaUQ==
;; BAD REFERRAL
;; Received 1170 bytes from 174.128.253.29#53(dns1.acsite.net) in 13 ms

 

DNS——区域传输

dig @ns1.example.com example.com axfr

host -T -l example.com ns1.example.com(-T使用TCP,-l进行域传输)

 

0x01.被动信息收集

标签:扫描   交互   addition   dns服务器   aos   类型   tld   nic   ==   

原文地址:http://www.cnblogs.com/captainRoB/p/7400551.html

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!