小白日记2：kali渗透测试之被动信息收集（一）

一、被动信息收集

被动信息收集指的是通过公开渠道可获得的信息，与目标系统不产生直接交互，尽量避免留下一切痕迹的信息探测。被动探测技术收集的信息可以大致分为两类, 即配置信息和状态信息。

被动探测可收集的信息

特征	被动技术
IP地址或地址段	探测是否存活
MAC地址	内部嗅探ARP，DHCP
域名信息和主机名	外部嗅探DNS，内部嗅探NetBIOS，ARP，DHCP
操作系统和版本	指纹信息
运行的应用软件
用户名和密码
设备类型（服务器、客户机）	端口和协议使用，ICMP
运行的服务	端口和协议的使用
设备运行状态	活动水平和ICMP
应用状态	在应用端口上设备的对外活动水平
链路运行状态	活动水平和ICMP
链路利用	活动水平
设备逻辑位置	基于TTL的距离跳数
邮件地址，公司地址，公司组织架构，联系电话/传真号码，人员姓名/职务	为社会工程学做准备
文档图片数据
公开商业信息

关于开源智能信息收集文章：
美国军方：http://www.fas.org/irp/dodair/army/atp2-22-2.pdf
北大西洋公约组织：http://information-retireval.info/docs/NATO-OSINT.html

二、域名系统DNS

域名系统（Domain Name System，DNS）是因特网的一项服务。它作为将域名和IP地址相互映射的一个分布式数据库，能够使人更方便地访问互联网。DNS使用TCP和UDP端口53。当前，对于每一级域名长度的限制是63个字符，域名总长度则不能超过253个字符。

 

DNS与FQND

FQDN：(Fully Qualified Domain Name)完全合格域名/全称域名，是指主机名加上全路径，全路径中列出了序列中所有域成员。全域名可以从逻辑上准确地表示出主机在什么地方，也可以说全域名是主机名的一种完全表示形式。（例如：DNS：sina.com；FQND:www.sina.com）

 

主机名到IP地址的映射有两种方式：

1）静态映射，每台设备上都配置主机到IP地址的映射，各设备独立维护自己的映射表，而且只供本设备使用；

2）动态映射，建立一套域名解析系统（DNS），只在专门的DNS服务器上配置主机到IP地址的映射，网络上需要使用主机名通信的设备，首先需要到DNS服务器查询主机所对应的IP地址。

 

域名结构

通常 Internet 主机域名的一般结构为：主机名.三级域名.二级域名.顶级域名。 Internet 的顶级域名由 Internet网络协会域名注册查询负责网络地址分配的委员会进行登记和管理，它还为 Internet的每一台主机分配唯一的 IP 地址。全世界现有三个大的网络信息中心： 位于美国的 Inter-NIC，负责美国及其他地区； 位于荷兰的RIPE-NIC，负责欧洲地区；位于日本的APNIC ，负责亚太地区。

 

记录类型

1.主机记录（A记录）：A记录是用于名称解析的重要记录，它将特定的主机名映射到对应主机的IP地址上。

2.别名记录（CNAME记录）: CNAME记录用于将某个别名指向到某个A记录上，这样就不需要再为某个新名字另外创建一条新的A记录。

3.IPv6主机记录（AAAA记录）: 与A记录对应，用于将特定的主机名映射到一个主机的IPv6地址。

4.邮件交换记录（MX记录）：用于将以该域名为结尾的电子邮件指向对应的邮件服务器以进行处理

5.域名服务器记录（NS记录 ）：用来表明由哪台服务器对该域名进行解析。可以查询某一子域名的DNS记录

6.PTR记录，是电子邮件记录中的邮件交换记录的一种，被用于电子邮件发送过程中的反向地址解析

7.服务位置记录（SRV记录）: 用于定义提供特定服务的服务器的位置，如主机（hostname），端口（port number）等。

8.NAPTR记录：它提供了正则表达式方式去映射一个域名。NAPTR记录非常著名的一个应用是用于ENUM查询。

 

域名解析

DNS查询有两种方式：递归和迭代。DNS客户端设置使用的DNS服务器一般都是递归服务器，它负责全权处理客户端的DNS查询请求，直到返回最终结果。而DNS服务器之间一般采用迭代查询方式。

 

 

三、DNS-nslookup

Nslookup 是一个监测网络中DNS服务器是否能正确实现域名解析的命令行工具。用于查询DNS的记录，查看域名解析是否正常，在网络故障的时候用来诊断网络问题它在 Windows NT/2000/XP(在之后的windows系统也都可以用的，比如win7,win8等) 中均可使用。

操作手册查询：man nslookup

<span style="font-size:18px;">NSLOOKUP(1)                         BIND9                         NSLOOKUP(1)

NAME
       nslookup - query Internet name servers interactively

SYNOPSIS
       nslookup [-option] [name | -] [server]

DESCRIPTION
       Nslookup is a program to query Internet domain name servers.  Nslookup
       has two modes: interactive and non-interactive. Interactive mode
       allows the user to query name servers for information about various
       hosts and domains or to print a list of hosts in a domain.
       Non-interactive mode is used to print just the name and requested
       information for a host or domain.

ARGUMENTS
       Interactive mode is entered in the following cases:

       1.  when no arguments are given (the default name server will be used)

       2.  when the first argument is a hyphen (-) and the second argument is the host name or Internet address of a name server.

Non-interactive mode is used when the name or Internet address of the host to
be looked up is given as the first argument. The optional second argument
specifies the host name or address of a name server.

Options can also be specified on the command line if they precede the
arguments and are prefixed with a hyphen. For example, to change the default
query type to host information, and the initial timeout to 10 seconds, type:

    nslookup -query=hinfo  -timeout=10                                    #-查询=hinfo 超时=10

INTERACTIVE COMMANDS                                                      #交互式命令
       host [server]
           Look up information for host using the current default server or
           using server, if specified. If host is an Internet address and the
           query type is A or PTR, the name of the host is returned. If host
           is a name and does not have a trailing period, the search list is
           used to qualify the name.

           To look up a host not in the current domain, append a period to
           the name.
       server domain

       lserver domain
           Change the default server to domain; lserver uses the initial
           server to look up information about domain, while server uses the
           current default server. If an authoritative answer can't be found,
           the names of servers that might have the answer are returned.

       root
           not implemented

       finger
           not implemented

       ls
           not implemented

       view
           not implemented

       help
           not implemented

       ?
           not implemented

       exit
           Exits the program.

       set keyword[=value]
           This command is used to change state information that affects the
           lookups. Valid keywords are:

               all
                   Prints the current values of the frequently used options
                   to set. Information about the current default server and
                   host is also printed.

               class="value"
                   Change the query class to one of:

                       IN
                           the Internet class

                       CH
                          the Chaos class

                       HS
                           the Hesiod class

                       ANY
                           wildcard

                       The class specifies the protocol group of the
                       information.

                       (Default = IN; abbreviation = cl)

                [no]debug
                   Turn on or off the display of the full response packet and
                   any intermediate response packets when searching.

                   (Default = nodebug; abbreviation = [no]deb)

                [no]d2
                   Turn debugging mode on or off. This displays more about
                   what nslookup is doing.
                   (Default = nod2)

               domain=name
                   Sets the search list to name.

                [no]search
                   If the lookup request contains at least one period but
                   doesn't end with a trailing period, append the domain
                   names in the domain search list to the request until an
                   answer is received.

                   (Default = search)

               port=value
                   Change the default TCP/UDP name server port to value.

                   (Default = 53; abbreviation = po)

               querytype=value

               type=value
                   Change the type of the information query.

                   (Default = A; abbreviations = q, ty)

                [no]recurse
                   Tell the name server to query other servers if it does not
                   have the information.

                   (Default = recurse; abbreviation = [no]rec)

               ndots=number
                   Set the number of dots (label separators) in a domain that
                   will disable searching. Absolute names always stop
                   searching.

               retry=number
                   Set the number of retries to number.

               timeout=number
                   Change the initial timeout interval for waiting for a
                   reply to number seconds.

                [no]vc
                   Always use a virtual circuit when sending requests to the
                   server.

                   (Default = novc)

                [no]fail
                   Try the next nameserver if a nameserver responds with
                   SERVFAIL or a referral (nofail) or terminate query (fail)
                   on such a response.

                   (Default = nofail)

FILES
       /etc/resolv.conf

SEE ALSO
       dig(1), host(1), named(8).

AUTHOR
       Andrew Cherenson

COPYRIGHT
       Copyright © 2004-2007, 2010, 2013, 2014 Internet Systems Consortium,
      Inc. ("ISC")

BIND9                            Jun 30, 2000                     NSLOOKUP(1)
</span>

查询范例

<span style="font-size:18px;">root@kali:~# nslookup                                                    #进入nslookup模式
> server                                                                 #查询本机DNS服务器
Default server: 192.168.1.1
Address: 192.168.1.1#53
> sina.com
Server:		192.168.1.1
Address:	192.168.1.1#53

Non-authoritative answer:
Name:	sina.com
Address: 66.102.251.33
> set type=a                                                             #指定类型为A
> sina.com
Server:		192.168.1.1
Address:	192.168.1.1#53

Non-authoritative answer:
Name:	sina.com
Address: 66.102.251.33
> set type=MX                                                           #指定类型为MX
> sina.com                                                              #注：不能输入www.sina.com等主机域名
Server:		192.168.1.1
Address:	192.168.1.1#53

Non-authoritative answer:                                               #优先级
sina.com	mail exchanger = 10 freemx3.sinamail.sina.com.cn.
sina.com	mail exchanger = 5 freemx1.sinamail.sina.com.cn.
sina.com	mail exchanger = 10 freemx2.sinamail.sina.com.cn.

Authoritative answers can be found from:
com	nameserver = k.gtld-servers.net.
com	nameserver = f.gtld-servers.net.
com	nameserver = g.gtld-servers.net.
com	nameserver = m.gtld-servers.net.
com	nameserver = h.gtld-servers.net.
com	nameserver = l.gtld-servers.net.
com	nameserver = a.gtld-servers.net.
com	nameserver = d.gtld-servers.net.
com	nameserver = j.gtld-servers.net.
com	nameserver = i.gtld-servers.net.
com	nameserver = b.gtld-servers.net.
com	nameserver = e.gtld-servers.net.
com	nameserver = c.gtld-servers.net.
g.gtld-servers.net	internet address = 192.42.93.30
j.gtld-servers.net	internet address = 192.48.79.30
i.gtld-servers.net	internet address = 192.43.172.30
e.gtld-servers.net	internet address = 192.12.94.30
a.gtld-servers.net	internet address = 192.5.6.30
a.gtld-servers.net	has AAAA address 2001:503:a83e::2:30
h.gtld-servers.net	internet address = 192.54.112.30
f.gtld-servers.net	internet address = 192.35.51.30
b.gtld-servers.net	internet address = 192.33.14.30
</span>

指定域名解析服务器

<span style="font-size:18px;">root@kali:~# nslookup
> server 156.154.70.22                          #指定域名解析服务器
Default server: 156.154.70.22
Address: 156.154.70.22#53
> sina.com
Server:		156.154.70.22
Address:	156.154.70.22#53

Non-authoritative answer:
Name:	sina.com
Address: 66.102.251.33
> </span>

长指令

<span style="font-size:18px;">root@kali:~# nslookup -q=ns sina.com 156.154.70.22                       #-q是type简写，156..为指定DNS服务器
Server:		156.154.70.22
Address:	156.154.70.22#53

Non-authoritative answer:
sina.com	nameserver = ns2.sina.com.cn.
sina.com	nameserver = ns1.sina.com.
sina.com	nameserver = ns1.sina.com.cn.
sina.com	nameserver = ns2.sina.com.
sina.com	nameserver = ns4.sina.com.cn.
sina.com	nameserver = ns4.sina.com.
sina.com	nameserver = ns3.sina.com.cn.
sina.com	nameserver = ns3.sina.com.

Authoritative answers can be found from:
ns1.sina.com	internet address = 114.134.80.144
ns2.sina.com	internet address = 114.134.80.145
ns3.sina.com	internet address = 61.172.201.254
ns4.sina.com	internet address = 123.125.29.99
</span>