一.枚举服务
枚举允许用户从网络中收集一类的所有相关信息
1.DNS枚举工具DNSenum功能：
1.通过谷歌或字典猜测可能存在的域名
2.对一个网段进行反向查询
3.查询网站的主机地址信息，域名服务器和邮件交换记录
4.在域名服务器上执行axfr请求，然后通过谷歌脚本得到扩展域名信息，提取子域名并查询，最后计算C类地址并执行whois查询，执行反向查询，把地址段写入文件。
输入dnsenum --enum benet.com 结果如下：
Smartmatch is experimental at /usr/bin/dnsenum line 698. Smartmatch is experimental at /usr/bin/dnsenum line 698. dnsenum VERSION:1.2.4 Warning: can't load Net::Whois::IP module, whois queries disabled. Warning: can't load WWW::Mechanize module, Google scraping desabled.
----- benet.com -----Host's addresses:__________________
benet.com. 300 IN A 69.172.201.153
Wildcard detection using: axzajtibcbxx_______________________________________
axzajtibcbxx.benet.com. 300 IN A 69.172.201.153
!!!!!!!!!!!!!!!!!!!!!!!!!!!! Wildcards detected, all subdomains will point to the same IP address Omitting results containing 69.172.201.153. Maybe you are using OpenDNS servers.!!!!!!!!!!!!!!!!!!!!!!!!!!!!Name Servers:______________
ns2.uniregistrymarket.link. 60 IN A 176.74.176.175 ns2.uniregistrymarket.link. 60 IN A 176.74.176.176 ns1.uniregistrymarket.link. 60 IN A 64.96.240.54 ns1.uniregistrymarket.link. 60 IN A 64.96.241.73
Mail (MX) Servers:___________________Trying Zone Transfers and getting Bind Versions:_________________________________________________
Trying Zone Transfer for benet.com on ns2.uniregistrymarket.link ... AXFR record query failed: NOTAUTH Trying Zone Transfer for benet.com on ns1.uniregistrymarket.link ... AXFR record query failed: NOTAUTH brute force file not specified, bay.
输出信息显示了DNS服务的详细信息。包括主机地址，域名服务器地址和邮件服务地址。
2.DNS枚举工具fierce
功能：
对子域名进行扫描和收集信息
使用fierce工具获取一个目标主机上所有IP地址和主机信息。执行命令如下
root@kali:~#fierce -dns baidu.com
结果省略
输出的信息显示了baidu.com下所有的子域。
3.SNMP枚举工具Snmpwalk
snmpwalk是一个SNMP应用程序。使用SNMP的GETNEXT请求，查询指定的所有OID（SNMP协议中的对象标识）树信息，并显示给用户。
root@kali：~# snmpwalk -c public 192.168.41.138 -v 2c
尝试失败。。。
4.SNMP枚举工具Snmpcheck
root@kali：~# snmpcheck -t 192.168.41.138
同样尝试失败。。。
5.SMTP枚举工具smtp-user-enum
root@kali:~# smtp-user-enum -M VRFY -U /tmp/users.txt -t 192.168.41.138
二.测试网络范围
1.域名查询工具DMitryDMitry工具是用来查询IP或WHOIS信息的。
WHOIS是用来查询域名是否已经被注册及已经注册域名的详细信息的数据库。
root@kali:~# dmitry -wnpb rzchina.net
子网掩码转换
root@kali:~# netmask -s rzchina.net
180.178.61.83/255.255.255.255
2.路由跟踪工具Scapy功能：
交互式生成数据包或数据包集合
对数据包进行操作
发送数据包
包嗅探
应答和反馈匹配
root@kali:~# scapy WARNING: No route found for IPv6 destination :: (no default route?) INFO: Can't import python ecdsa lib. Disabled certificate manipulation tools Welcome to Scapy (2.3.3) >>> ans,unans=sr(IP(dst="www.rzchina.net/30",ttl=(1,6))/TCP()) Begin emission: ....................**.**.**.**.**..****..**..............Finished to send 24 packets. .................................................................................................... .................................................................................................................................................................................................Traceback (most recent call last): File "<console>", line 1, in <module> File "/usr/lib/python2.7/dist-packages/scapy/sendrecv.py", line 337, in sr a,b=sndrcv(s,x,*args,**kargs) File "/usr/lib/python2.7/dist-packages/scapy/sendrecv.py", line 137, in sndrcv inp, out, err = select(inmask,[],[], remaintime) error: (4, 'Interrupted system call') >>>
以表的形式查看数据包发送情况，执行命令如下所示：
>>ans.make_table(lambda(s,r):(s.dst,s.ttl,r.src))
尝试失败。。。
使用scapy查看TCP路由跟踪信息
>>> res,unans=traceroute(["www.google.com","www.kali.org","www.rzchina.net"],dport=[80,443],maxttl=20,retry=-2)
Begin emission:
*.*.*.*.*.*.*.*.*.*.*.*.Finished to send 120 packets.
Begin emission:
Finished to send 108 packets.
Begin emission:
Finished to send 108 packets.
..
Received 26 packets, got 12 answers, remaining 108 packets
180.178.61.83:tcp443 180.178.61.83:tcp80 192.124.249.10:tcp443 192.124.249.10:tcp80 31.13.84.1:tcp443 31.13.84.1:tcp80
1 192.168.1.1 11 192.168.1.1 11 192.168.1.1 11 192.168.1.1 11 192.168.1.1 11 192.168.1.1 11
2 42.198.120.1 11 42.198.120.1 11 42.198.120.1 11 42.198.120.1 11 42.198.120.1 11 42.198.120.1 11
>>>