First, passive information collection1, whois query to find out the domain name of a site server using a DNS server for the zone transfer attacks and other types of attacks, attackers can often expose a site and the outside of a lot of information ... When the discovery domain name server is provided by Akam.net, this is a typical example of an unauthorized system that cannot be attacked .... 2, Netcraft (http://searchdns.netcraft.com) is a web interface tool. Discover the server IP address of a particular website 3, nslookup 4, Google hakingIi. Active Information collection1. Nmap-ss-pn-a 192.168.38.129-SS performs a stealth TCP scan to determine whether a particular TCP port is open-PN tells Nmap not to use ping to prejudge whether the host is alive or not. -A For more informationSet Payload GENERIC/SHELL_REVERSE_TCP sets the attack payload. 2. Running Db_nmap in the MSF terminal db_nmap-ss-pn-a 192.168.2.23. Using Metasploit for port scanningUse Auxiliary/scanner/portscan/syn
4. SMB Scan
Use auxiliary/scanner/smb/smb_version5. Search for improperly configured MSSQLUse auxiliary/scanner/mssql/mssql_ping6. SSH Server ScanUse Auxiliary/scanner/ssh/ssh_versio7. FTP ScanUse auxiliaty/scanner/ftp/ftp_version8. SNMP ScanUse auxiliary/scanner/snmp/snmp_login
metasploit--(i) Information collection
