임시

Recon-ng is a full-featured Web Reconnaissance framework written in Python. Complete with independent modules, database interaction, built in convenience functions, interactive help, and command completion, Recon-ng provides a powerful environment in which open source web-based reconnaissance can be conducted quickly and thoroughly.

Recon-ng has a look and feel similar to the Metasploit Framework, reducing the learning curve for leveraging the framework. However, it is quite different. Recon-ng is not intended to compete with existing frameworks, as it is designed exclusively for web-based open source reconnaissance. If you want to exploit, use the Metasploit Framework. If you want to Social Engineer, us the Social Engineer Toolkit. If you want to conduct reconnaissance, use Recon-ng! See the Usage Guide for more information.

Recon-ng is a completely modular framework and makes it easy for even the newest of Python developers to contribute. Each module is a subclass of the “module” class. The “module” class is a customized “cmd” interpreter equipped with built-in functionality that provides simple interfaces to common tasks such as standardizing output, interacting with the database, making web requests, and managing API keys. Therefore, all the hard work has been done. Building modules is simple and takes little more than a few minutes. See the Development Guide for more information.

P0f is a tool that utilizes an array of sophisticated, purely passive traffic fingerprinting mechanisms to identify the players behind any incidental TCP/IP communications (often as little as a single normal SYN) without interfering in any way. Version 3 is a complete rewrite of the original codebase, incorporating a significant number of improvements to network-level fingerprinting, and introducing the ability to reason about application-level payloads (e.g., HTTP).

Some of p0f’s capabilities include:

• Highly scalable and extremely fast identification of the operating system and software on both endpoints of a vanilla TCP connection – especially in settings where NMap probes are blocked, too slow, unreliable, or would simply set off alarms.

• Measurement of system uptime and network hookup, distance (including topology behind NAT or packet filters), user language preferences, and so on.

• Automated detection of connection sharing / NAT, load balancing, and application-level proxying setups.

• Detection of clients and servers that forge declarative statements such as X-Mailer or User-Agent.

The tool can be operated in the foreground or as a daemon, and offers a simple real-time API for third-party components that wish to obtain additional information about the actors they are talking to.

Common uses for p0f include reconnaissance during penetration tests; routine network monitoring; detection of unauthorized network interconnects in corporate environments; providing signals for abuse-prevention tools; and miscellanous forensics.

Nmap (“Network Mapper”) is a free and open source (license) utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. It was designed to rapidly scan large networks, but works fine against single hosts. Nmap runs on all major computer operating systems, and official binary packages are available for Linux, Windows, and Mac OS X. In addition to the classic command-line Nmap executable, the Nmap suite includes an advanced GUI and results viewer (Zenmap), a flexible data transfer, redirection, and debugging tool (Ncat), a utility for comparing scan results (Ndiff), and a packet generation and response analysis tool (Nping).

Nmap was named “Security Product of the Year” by Linux Journal, Info World, LinuxQuestions.Org, and Codetalker Digest. It was even featured in twelve movies, including The Matrix Reloaded, Die Hard 4, Girl With the Dragon Tattoo, and The Bourne Ultimatum.

Miranda is a Python-based Universal Plug-N-Play client application designed to discover, query and interact with UPNP devices, particularly Internet Gateway Devices (aka, routers). It can be used to audit UPNP-enabled devices on a network for possible vulnerabilities. Some of its features include:

Interactive shell with tab completion and command history

Passive and active discovery of UPNP devices

Customizable MSEARCH queries (query for specific devices/services)

Full control over application settings such as IP addresses, ports and headers

Simple enumeration of UPNP devices, services, actions and variables

Correlation of input/output state variables with service actions

Ability to send actions to UPNP services/devices

Ability to save data to file for later analysis and collaboration

Command logging

UPnP 정의

UPnP는 네트워크 상에 있는 네트워크 장치들이 서로 연동될 수 있도록 하는 범용 표준 프로토콜이다.

UPnP는 표준 IP 프로토콜을 활용함으로 다양한 네트워크 매체를 활용할 수 있는데 즉 장치들을 네트워크로 서로 연결시키는데 활용할 수 있는 모든 매체가 UPnP 기능을 구현할 수 있다.

UPnP가 사용하는 프로토콜

    <UPnP 프로토콜 스택>

1)TCP/IP

-TCP/IP 네트워킹 프로토콜 스택은 나머지 모든 UPnP 프로토콜을 구축하는 기반 역할

-TCP/IP 서비스(DHCP, DNS 등) 뿐만 아니라 TCP, UDP, IGMP, ARP , IP 등 TCP/IP 스택에 있는 많은 프로토콜을 사용

2)HTTP, HTTPU, HTTPMU

-HTTP를 기본 프로토콜로하여 유니캐스트, 멀티캐스트를 지원하는 프로토콜

-HTTP는 TCP/IP기반, HTTPU, HTTPMU는 UDP/IP 기반 위에서 동작

3)SSDP

-SDP(Simple Service Discovery Protocol)는 네트워크 서비스를 네트워크 상에서 검색하는 방법을 정의

-SSDP는 HTTPU 및 HTTPMU 기반 위에 구축되며, 제어 포인트가 네트워크 상에서 원하는 리소스를 검색하는 방법 및 장치들이 네트워크상에서 자신들이 가용상태에 있음을 알리는 방법을 정의

-제어 포인트 및 장치 모두가 SSDP를 사용하는데 UPnP 제어 포인트는 부팅이 되자마자 SSDP 검색 요청(HTTPMU을 사용함)을 보내서 네트워크에서 활용 가능한 장치와 서비스를 검색

-UPnP 장치는 멀티캐스트 포트 정보를 수신하고, 검색 요청을 수신하자마자 장치는 일치 여부를 확인하기 위하여 검색 조건을 점검. 만약 일치된 것이 발견되면 유니캐스트 SSDP (HTTPU를 사용) 응답이 제어 포인트로 전송

-이외에도 SSDP는 장치 및 장치 관련 서비스가 네트워크와의 연결을 원활하게 끊는 방법을 포함하고 있으며, 또한 자체적인 문제 해결을 위하여 유해 정보를 정화하는데 사용되는 캐시 타임아웃(cache timeouts)을 포함

4)GENA

-GENA (Generic Event Notification Architecture)는 TCP/IP를 통한 HTTP 및 멀티캐스트 UDP를 사용하여 통보(notifications)를 송수신하는 기능을 제공

-또한 GENA은 이벤트 실행을 위하여 가입자 및 통보 발행자의 개념을 정의

-UPnP는 GENA 포맷을 사용하여 존재 발표 내용을 생성한 후에 SSDP 프로토콜을 통하여 전송하고 UPnP 이벤트 작업의 서비스 상태 변화를 신호로 알려주는 기능 수행

5)SOAP
-SOAP (Simple Object Access Protocol)는 XML 및 HTTP의 용법을 정의하여 원격 프로시저 호출을 실행

-SOAP는 또한 보안용으로 SSL (Secure Sockets Layer)을 활용하고 HTTP의 연결 관리 기능을 활용

6)XML

-XML(Extensible Markup Language)은 웹 상의 구조화된 데이터를 위한 범용 포맷

-XML은 태그와 특성(tags, attributes)을 사용한다는 측면에서 보면 HTML과 유사한 점이 많지만, XML은 그러한 태그와 특성들이 일반적으로 정의된 것이 아니라 사용되는 컨텍스트 내에서 해석된다는 관점에서 보면 상당히 다름

-XML은 장치 및 서비스 설명서, 제어 메시지 및 이벤트에 사용되는 UPnP의 핵심적 부분

UPnP 위험성 언급

-UPnP implementations are at more risk than others; several UPnP-enabled IGDs allow the DNS settings to be directly altered via UPnP, which is just begging for a MITM/phishing attack. Still others, particularly those devices that use some form of embedded Linux, actually use the un-sanitized values they receive via UPnP requests as part of executed shell commands, leaving them open to command-injection attacks. A list of some known vulnerable routers can be found here.

UPnP protocol overview

-The UPnP protocol uses a multicast address of 239.255.255.250 and TCP port 1900. 

Devices that offer UPnP services will periodically send out SSDP NOTIFY messages to 239:255:255:250:1900, announcing themselves to any UPnP clients that are listening. 

Likewise, UPnP clients can send SSDP M-SEARCH requests to 239:255:255:250:1900 to see if any UPnP devices respond. Clients can send an M-SEARCH request looking for any UPnP device, or they can specify that they are looking for a particular UPnP device, or they can query only for a device that supports a specific UPnP service. UPnP hosts that match the devices/services requested will respond with a SSDP RESPONSE message, which contains the same information sent in an SSDP NOTIFY message.

-An SSDP NOTIFY message sent by a UPnP host contains a ‘Location’ header which specifies the location of an XML file. This file contains XML data indicating, among other things, the UPnP device type(s) and services supported by the host, 

as well as paths to additional XML documents that describe the various services in detail. In order to discover the full UPnP capabilities of an IGD, you must parse through all the XML files to extract the devices types, services, and actions offered by the IGD.

-UPnP devices support various services that advertise what actions they support. 

A UPnP client can send a UPnP device an action request at any time; this could be a request to open up a port, change the default DNS server, or anything else that the UPnP device supports. 

Input/output data for action requests and responses are sent using SOAP, which uses XML to structure information sent between two parties. 

SOAP requests are essentially HTTP POST requests with some additional SOAP headers included in the HTTP headers.

upnp> host send 0 WANConnectionDevice WANIPConnection AddPortMapping

Required argument:

     Argument Name:  NewPortMappingDescription

     Data Type:      string

     Allowed Values: []

     Set NewPortMappingDescription value to: All your ports are belong to us

Required argument:

     Argument Name:  NewLeaseDuration

     Data Type:      ui4

     Allowed Values: []

     Set NewLeaseDuration value to: 0

Required argument:

     Argument Name:  NewInternalClient

     Data Type:      string

     Allowed Values: []

     Set NewInternalClient value to: 192.168.0.1

Required argument:

     Argument Name:  NewEnabled

     Data Type:      boolean

     Allowed Values: []

     Set NewEnabled value to: 1

Required argument:

     Argument Name:  NewExternalPort

     Data Type:      ui2

     Allowed Values: []

     Set NewExternalPort value to: 8080

Required argument:

     Argument Name:  NewRemoteHost

     Data Type:      string

     Allowed Values: []

     Set NewRemoteHost value to:

Required argument:

     Argument Name:  NewProtocol

     Data Type:      string

     Allowed Values: [‘TCP’, ‘UDP’]

     Set NewProtocol value to: TCP

Required argument:

     Argument Name:  NewInternalPort

     Data Type:      ui2

     Allowed Values: []

     Set NewInternalPort value to: 80

upnp> host send 0 WANConnectionDevice WANIPConnection GetSpecificPortMappingEntry

Required argument:

     Argument Name:  NewExternalPort

     Data Type:      ui2

     Allowed Values: []

      Set NewExternalPort value to: 8080

Required argument:

     Argument Name:  NewRemoteHost

     Data Type:      string

     Allowed Values: []

     Set NewRemoteHost value to:

Required argument:

     Argument Name:  NewProtocol

     Data Type:      string

     Allowed Values: [‘TCP’, ‘UDP’]

     Set NewProtocol value to: TCP

NewPortMappingDescription : All your ports are belong to us

NewLeaseDuration : 0

NewInternalClient : 192.168.0.1

NewEnabled : 1

NewInternalPort : 80

upnp> host send 0 WANConnectionDevice WANIPConnection DeletePortMapping

Required argument:

     Argument Name:  NewProtocol

     Data Type:      string

     Allowed Values: [‘TCP’, ‘UDP’]

     Set NewProtocol value to: TCP

Required argument:

     Argument Name:  NewExternalPort

     Data Type:      ui2

     Allowed Values: []

     Set NewExternalPort value to: 8080

Required argument:

     Argument Name:  NewRemoteHost

     Data Type:      string

     Allowed Values: []

     Set NewRemoteHost value to:

This is the fastest Internet port scanner. It can scan the entire Internet in under 6 minutes, transmitting 10 million packets per second.

It produces results similar to nmap, the most famous port scanner. Internally, it operates more like scanrand, unicornscan, and ZMap, using asynchronous transmission. The major difference is that it’s faster than these other scanners. In addition, it’s more flexible, allowing arbitrary address ranges and port ranges.

NOTE: masscan uses a custom TCP/IP stack. Anything other than simple port scans will cause conflict with the local TCP/IP stack. This means you need to either use the -S option to use a separate IP address, or configure your operating system to firewall the ports that masscan uses.

# Example conf for masscan                                                                                                     

rate =  100000.00                                                                                                              

output-format = grepable                                                                                                       

output-filename = nope                                                                                                         

ports = 80                                                                                                                     

includefile = include.txt                                                                                                      

excludefile = exclude.txt  

hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn’t only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.

While hping was mainly used as a security tool in the past, it can be used in many ways by people that don’t care about security to test networks and hosts. A subset of the stuff you can do using hping:

-Firewall testing

-Advanced port scanning

-Network testing, using different protocols, TOS, fragmentation

-Manual path MTU discovery

-Advanced traceroute, under all the supported protocols

-Remote OS fingerprinting

-Remote uptime guessing

-TCP/IP stacks auditing

-hping can also be useful to students that are learning TCP/IP.

Base

-c, --count: 지정한 패킷만 전송 후 종료

-i, --interval: 간격 정하기

 --fast      alias for -i u10000 (10 packets for second)

      --faster    alias for -i u1000 (100 packets for second)

      --flood    sent packets as fast as possible. Don't show replies.

-V, --verbose: 자세히 보기

IP Related

-a, --spoof: 출발지 ip 변조 (상당히 강력)

--rand-source: 출발지 ip를 랜덤값으로 바꿈(MAC 주소는 안바뀐다고 들었는데 확인 필요)

TCP/UDP Related

-p, --destport: 목적지 port

TCP Flags

-F --fin,  -S --syn, -R --rst, -A --ack

MODE

-1: icmp

-2: udp

-8: scan

Use this tool to search for a specific file type in a given domain.

GoLismero is an open source framework for security testing. It’s currently geared towards web security, but it can easily be expanded to other kinds of scans.

The most interesting features of the framework are:

Real platform independence. Tested on Windows, Linux, *BSD and OS X.

No native library dependencies. All of the framework has been written in pure Python.

Good performance when compared with other frameworks written in Python and other scripting languages.

Very easy to use.

Plugin development is extremely simple.

The framework also collects and unifies the results of well known tools: sqlmap, xsser, openvas, dnsrecon, theharvester

Integration with standards: CWE, CVE and OWASP.

Designed for cluster deployment in mind (not available yet).

$su

# apt-get install python2.7 python2.7-dev python-pip python-docutils git perl nmap sslscan

#cd /opt

#git clone https://github.com/golismero/golismero.git

#cd golismero

#pip install -r requirements.txt

#pip install -r requirements_unix.txt

#ln -s /opt/golismero/golismero.py /usr/bin/golismero

#exit

$sudo -s

#easy_install-2.7 -U distribute

#easy_install install pip

#port install nmap sslscan

#cd /opt

#git clone https://github.com/golismero/golismero.git

#cd golismero

#pip install -r requirements.txt

#pip install -r requirements_unix.txt

#ln -s /opt/golismero/golismero.py /usr/bin/golismero

#exit

cd %HOME%

git clone https://github.com/golismero/golismero.git

cd golismero

pip install -r requirements.txt

Plugin list

-------------

-= Import plugins =-

csv_nikto:

    Import the results of a Nikto scan in CSV format.

csv_spiderfoot:

    Import the results of a SpiderFoot scan in CSV format.

xml_nmap:

    Import the results of an Nmap scan in XML format.

xml_openvas:

    Import the results of an OpenVAS scan in XML format.

xml_sslscan:

    Import the results of an SSLScan run in XML format.

-= Recon plugins =-

dns:

    DNS resolver plugin.

    Without it, GoLismero can't resolve domain names to IP addresses.

dns_malware:

    Detect if a domain has been potentially spoofed, hijacked.

exploitdb:

    Integration with Exploit-DB (http://www.exploit-db.com/)

    This plugin requires a working Internet connection to run.

fingerprint_web:

    Fingerprinter of web servers.

geoip:

    Geolocates IP addresses using online services.

    This plugin requires a working Internet connection to run.

punkspider:

    Integration with PunkSPIDER (http://punkspider.hyperiongray.com/)

    This plugin requires a working Internet connection to run.

robots:

    Analyzes robots.txt files and extracts their links.

shodan:

    Integration with Shodan: http://www.shodanhq.com/

    This plugin requires a working Internet connection to run.

spider:

    Web spider plugin.

    Without it, GoLismero can't crawl web sites.

spiderfoot:

    Integration with SpiderFoot: http://www.spiderfoot.net/

theharvester:

    Integration with theHarvester: https://github.com/MarioVilas/theHarvester/

-= Scan plugins =-

brute_directories:

    Tries to discover hidden folders by brute force:

    www.site.com/folder/ -> www.site.com/folder2 www.site.com/folder3 ...

brute_dns:

    Tries to find hidden subdomains by brute force.

brute_url_extensions:

    Tries to discover hidden files by brute force:

    www.site.com/index.php -> www.site.com/index.php.old

brute_url_permutations:

    Tries to discover hidden files by bruteforcing the extension:

    www.site.com/index.php -> www.site.com/index.php2

brute_url_predictables:

    Tries to discover hidden files at predictable locations.

    For example: (Apache) www.site.com/error_log

brute_url_prefixes:

    Tries to discover hidden files by bruteforcing prefixes:

    www.site.com/index.php -> www.site.com/~index.php

brute_url_suffixes:

    Tries to discover hidden files by bruteforcing suffixes:

    www.site.com/index.php -> www.site.com/index2.php

nikto:

    Integration with Nikto: https://www.cirt.net/nikto2

nmap:

    Integration with Nmap: http://nmap.org/

openvas:

    Integration with OpenVAS: http://www.openvas.org/

plecost:

    WordPress vulnerabilities analyzer, completely rewritten for GoLismero,

    based on the original idea of Plecost (https://code.google.com/p/plecost/)

    and their team: @ffranz and @ggdaniel

sslscan:

    Integration with SSLScan: http://sourceforge.net/projects/sslscan/

zone_transfer:

    Detects and exploits DNS zone transfer vulnerabilities.

-= Attack plugins =-

heartbleed:

    Test for the CVE-2014-0160 vulnerability (aka "heartbleed attack").

sqlmap:

    SQL Injection plugin, using SQLMap.

    Only retrieves the DB banner, does not exploit any vulnerabilities.

xsser:

    Integration with XSSer: http://xsser.sourceforge.net/

-= Report plugins =-

bson:

    BSON (Binary JSON) output for programmatic access.

csv:

    Writes reports in Comma Separated Values format.

html:

    Writes reports as offline web pages.

json:

    JSON output for programmatic access.

latex:

    Writes reports in LaTeX document format (.tex).

log:

    Extracts only the logs.

ltsv:

    Extracts only the logs, in labeled tab-separated values format.

msgpack:

    MessagePack output for programmatic access.

    See: http://msgpack.org/

odt:

    Writes reports in OpenOffice document format (.odt).

rst:

    Writes reports in reStructured Text format.

text:

    Writes plain text reports to a file or on screen.

xml:

    XML output for programmatic access.

yaml:

    YAML output for programmatic access.

-= UI plugins =-

console:

    Console user interface. This is the default.

disabled:

    Empty user interface. Used by some unit tests.

[openvas]

host = localhost

[testing/scan/openvas]

user = admin

password = <your password>

[shodan:Configuration]

apikey = <your shodan key>

http://goo.gl/im2FLe for detailed instructions on setting up OpenVAS

http://www.shodanhq.com/account/register for a shodan API key

This program was written in the hopes that a more precise testing methodology might be applied to the area of network intrusion detection, which is still a black art at best.

Conceptually, fragrouter is just a one-way fragmenting router – IP packets get sent from the attacker to the fragrouter, which transforms them into a fragmented data stream to forward to the victim.

ettercap: http://kkn1220.tistory.com/63 참고

dsniff: http://kkn1220.tistory.com/72 참고 

fragrouter 부분 또한 http://kkn1220.tistory.com/72 에서 dnsspoof 부분을 참고

실제 웹페이지 패스워드 도청: http://kkn1220.tistory.com/32 참고

First what Fierce is not. Fierce is not an IP scanner, it is not a DDoS tool, it is not designed to scan the whole Internet or perform any un-targeted attacks. It is meant specifically to locate likely targets both inside and outside a corporate network. Only those targets are listed (unless the -nopattern switch is used). No exploitation is performed (unless you do something intentionally malicious with the -connect switch). Fierce is a reconnaissance tool. Fierce is a PERL script that quickly scans domains (usually in just a few minutes, assuming no network lag) using several tactics.

syntax: #fierce -dns example.com

-delay    The number of seconds to wait between lookups.

-dns     The domain you would like scanned.

-dnsfile   Use DNS servers provided by a file (one per line) for reverse lookups (brute force).

-dnsserver Use a particular DNS server for reverse lookups 

-file A file you would like to output to be logged to.

-help This screen.

-range Scan an internal IP range (must be combined with -dnsserver).  

Usage: #fierce-range 111.222.333.0-255 -dnsserver ns1.example.co

-search  Search list.  When fierce attempts to traverse up and

down ipspace it may encounter other servers within other

domains that may belong to the same company.  If you supply a 

comma delimited list to fierce it will report anything found.

This is especially useful if the corporate servers are named

different from the public facing website.  

Usage: #fierce -dns examplecompany.com -search corpcompany,blahcompany 

Note that using search could also greatly expand the number of

hosts found, as it will continue to traverse once it locates

servers that you specified in your search list.  The more the

better.

-traverse Specify a number of IPs above and below whatever IP you

have found to look for nearby IPs.  Default is 5 above and 

below.  Traverse will not move into other C blocks.

-wordlist Use a seperate wordlist (one word per line).  

Usage: #fierce -dns examplecompany.com -wordlist dictionary.txt

output("Okay, trying the good old fashioned way... brute force"); 

$wordlist = $wordlist || 'hosts.txt'; 

if (-e $wordlist) { 

# user provided or default 

open (WORDLIST, '<', $wordlist) or 

open (WORDLIST, '<', 'hosts.txt') or 

quit_early("Can't open $wordlist or the default wordlist");