黑客手工踩点技术详解.docxVIP

黑客手工踩点技术详解在进行一次渗透测试的时候，首先第一步是踩点，踩点即收集目标的信息方便后面渗透到思路利用及综合分析。本文描述不需要任何工具的踩点技术踩点思路。本文来源：/2012/10/219.html在进行一次渗透测试的时候，首先第一步是踩点，踩点即收集目标的信息方便后面渗透到思路利用及综合分析。本文描述不需要任何工具的踩点技术踩点思路。1.探测web架构(1)telnet 80 返回下：htmlheadtitle400 Bad Request/title/headbody bgcolor=”white”centerh1400 Bad Request/h1/centerhrcenternginx/0.8.53/center/body/html得到了nginx/0.8.53 ,虽然还没办法判断是什么系统，按照这个判断大致可以判断是Linux（偶尔有些奇特的管理员在windows搭建nginx）如果判断是Linux，尝试22，telnet 22 可以连接说明打开，有时候会返回SSH版本。SSH-2.0-OpenSSH_5.2同理也要尝试21端口telnet 21 返回220———- Welcome to Pure-FTPd [privsep] [TLS] ———-220-You are user number 1 of 30 allowed.220-Local time is now 05:28. Server port: 21.220-This is a private system – No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.得知对方是Pure-FTPd搭建的ftp，并且可以进一步确认使用的是Linux系统。如果是window你可以尝试你关心的端口开放情况，比如3389，8080，21，445，139等，当然端口开放情况可以应用所有平台。有时候端口被修改，你就借助工具来扫描了。但是有一种情况比较难以判断，在t00ls上看到端口有大于65535的。实例：telnet 80 然后输入head返回：HTTP/1.0 400 Bad RequestServer: squid/2.7.STABLE8Date: Tue, 14 Jun 2011 05:17:08 GMTContent-Type: text/htmlContent-Length: 1213X-Squid-Error: ERR_INVALID_REQ 0X-Cache: MISS from WIN-S6AV24UOFUFX-Cache-Lookup: NONE from WIN-S6AV24UOFUF:80Via: 1.0 WIN-S6AV24UOFUF:80 (squid/2.7.STABLE8)Connection: close!DOCTYPE HTML PUBLIC “-//W3C//DTD HTML 4.01 Transitional//EN” “/TR/html4/loose.dtd”HTMLHEADMETA HTTP-EQUIV=”Content-Type” CONTENT=”text/html; charset=iso-8859-1″TITLEERROR: The requested URL could not be retrieved/TITLESTYLE type=”text/css”!–BODY{background-color:#ffffff;font-family:verdana,sans-serif}PRE{font-family:sans-serif}–/STYLE/HEADBODYH1ERROR/H1H2The requested URL could not be retrieved/H2HR noshade size=”1px”PWhile trying to process the request:PREheader/PREPThe following error was encountered:ULLISTRONGInvalid Request/STRONG/ULPSome aspect of the HTTP Request is invalid. Possible problems:ULLIMissing or unknown request methodLIMissing URLLIMissing HTTP Identifier (HTTP/1.0)LIRequest is too largeLICont