Ch6

Question 1

whois command

Answer 1

whois nino.com -h [who-is-server-ip]

Question 2

Netcraft 是干什么的

Answer 2

https://www.netcraft.com/
可以看到所用的tech，whois info

Question 3

Opensource search

Answer 3

Google -
gitleaks - 找寻aws keys - https://github.com/zricethezav/gitleaks

Question 4

Security Headers & SSL

Answer 4

https://securityheaders.com/
https://www.ssllabs.com/ssltest/

Question 5

DNS Enumeration

Answer 5

host nino.com
host -t mx nino.com

nslookup -type=TXT nino.com 192.168.1.40

Question 6

DNS Enumeration Automation

Answer 6

dnsrecon -d nino.com -t std

dnsenum nino.com

自带字典：
dnsenum -f dns.txt nino.com

Question 7

netcat

Answer 7

-n: no DNS
nc -nv -z -w 1 192.168.1.123 3388-3900

-u: UDP
nc -nv -u -z -w 1 192.168.50.149 120-123

Question 8

nmap 最快的scan 方式

Answer 8

SYN scan

-sS

Question 9

nmap 的scan方式

Answer 9

-sT
-sS
-sU
-sn: host discovery. 发送ICMP, 再发SYN到443， ACK到80
-O: OS fingerprint, 后加–osscan-guess，会强制让nmap猜OS version
-sV: version scan
-A: 大包围

Question 10

nmap NSE的位置
script 的帮助

Answer 10

/usr/share/nmap/scripts

搜索script - ls -1 /usr/share/nmap/scripts/smb*
nmap –script-help http-title

Question 11

nmap 扫面文件的IP

Answer 11

nmap -sS -iL /path/to/file.txt

Question 12

nmap 扫 whois server

Answer 12

whois server port是443
nmap -sS -p 443 -iL ip.txt

Question 13

nc connect to a port

Answer 13

nc -v 192.168.1.123 8080

Question 14

当nmap没有结果，尝试使用

Answer 14

-Pn, -T4

Question 15

SMTP VRFY command

Answer 15

1. 先用nc 连过去
   nc -v 192.168.1.123 25
2. 发送 VRFY root

Question 16

SNMP - TCP or UDP? Port?

Answer 16

UDP, port 161

Question 17

Query snmp tool?

Answer 17

snmpwalk

snmpwalk -c public -v1 -t 10 192.168.1.123

Question 18

Bruteforce snmp tool?

Answer 18

onesixtyone - 161

echo public&raquo_space; community
onesixtyone -c community -i ips

Question 19

SMB port

Answer 19

Port 137 is for providing name services over TCP or UDP for SMB over NetBIOS.

Port 139 is for providing session services over TCP or UDP for SMB over NetBIOS.

Port 445 is for directly-hosted SMB over TCP or UDP without the need of NetBIOS.

Question 20

SMB scanning tool - Linux

Answer 20

sudo nbtscan -r 192.168.50.1-254
-r表示 port 137

nmap -v -p 139,445 –script smb-os-discovery 192.168.50.152

Question 21

SMP scanning tool windows

Answer 21

net view \dc01 /all