Nmap Scan Information Collection

1. Port Mirror Ports Mirroring

function through the switch or on the router, one or more of the source port of the data traffic makeup of a specified port to enable monitoring of the network, the specified port becomes the mirror port or destination port.

2. ARP Attack capture Packet

When the user does not have the Internet function, can be initiated by the ARP attack to capture data on the target host, Apr attack is through the forgery of IP address and MAC address to achieve ARP spoofing, can generate a large number of ARP traffic in the network to block the network, so that continue to launch attacks, The IP-MAC entry in the target host ARP cache is updated, causing a network outage or a man-in-the-middle attack.

3. Fetching packets with pseudo AP

4. Filter packets using WIRESAHRK

Set in Capture/option, filter conditions specify capture port number

PORT: Ports or TCP 80

Set IP address filtering conditions SRC Host IP address specifies the capture source IP address package, which is the client-requested package

The DST host IP address specifies the package where the source IP is the destination address, that is, the server response

Use the Domain name Address Resolution tool Nslookup to view the server IP address

Nslookup www.baidu.com

Use a MAC address query, and then use P0F to parse the packet

Host Mac

After you have queried the MAC address, you can use the MAC address http://mac.51240.com/

Use association filters host 192.168.2.1 and parking ticket PORT80

5. Enumerating Services

NDS enumeration collects the user name, computer name, IP address, etc. of the target organization.

Dnsenum is based on Google's dictionary files to guess the existence of the domain name, and the site to reverse query, query site host address information domain name, server and mail exchange records, but the database is based on Google query, so the domestic enumeration information is not complete. Here I take Baidu's test:

Another tool for DNS enumeration is fierce, which is primarily used for sub-domain queries.

Snmpwalk is an SNMP application that uses SNMP GetNext requests, queries the specified all OID (object flags in SNMP protocol) tree information, displays it,

6, Nmap information Scanning collection

Nmap can be used to discover the host, scan the host open port, and run the program to infer the computer running operating system. Scan Tool for evaluating network security, also known as a network sniffer (Networkmapper)

Then Nmap main features include four aspects of the content, namely, host discovery, port scanning, application and version detection, operating system detection. Nmap detects the host port by sending a series of packets, and matches the information in the fingerprint library according to the information returned, thus determining the target host operating system is tired and the service type.

Installing the sub-operation commands under Linux systems

File format differentiate installation:. Deb using Dpkg-i

。 TAR.BZ2 using TAR-ZXVF

Use Nmap to scan the host to be aware of the full scan Nou some host performance is not very good, may lead to host crashes, downtime, data loss.

Nmap scan can be specified using IPv4 or IPv6 scanning: nmap-6 12:02:0f:0b:c0

When scanning a large number of main address, you can use the IP address can be unloaded text, command nmap-il +IP address List Nmap-il List.txt

You can also scan with non-class inter-domain routing addresses when unsure of the target host. Nmap 192.168.1.0/24

Scan with a network that excludes scans--exclude command to exclude from hosts that do not need to be scanned

Nmap 192.168.2.0/24--exclude 192.168.2.2 or exclude an entire IP address of nmap 192.168.2.0/24--excliude 192.168.2.3-192.168.2.23 or exclude with this List of IP addresses nmap 192.168.2.0/24--exclude list.txt

Nmap uses full scan parameters nmap-a This parameter will carry out a full frontal scan of the target host. Includes various service information

Use the following command to discover the use of IGMP protocol in LAN

Use enumeration to brute force DNS host name

Nmap--script Dns-brute lut.cn

Nmap Scan Information Collection