Ethical Hacking 简明教程

Ethical Hacking - Fingerprinting

道德黑客中的术语 OS 指纹识别是指用来确定远程计算机上运行什么操作系统的任何方法。这可能是−

The term OS fingerprinting in Ethical Hacking refers to any method used to determine what operating system is running on a remote computer. This could be −

Active Fingerprinting − Active fingerprinting is accomplished by sending specially crafted packets to a target machine and then noting down its response and analyzing the gathered information to determine the target OS. In the following section, we have given an example to explain how you can use NMAP tool to detect the OS of a target domain.
Passive Fingerprinting − Passive fingerprinting is based on sniffer traces from the remote system. Based on the sniffer traces (such as Wireshark) of the packets, you can determine the operating system of the remote host.

我们有以下四个重要元素，我们将在其中查看这些元素以确定操作系统−

We have the following four important elements that we will look at to determine the operating system −

TTL − What the operating system sets the Time-To-Live on the outbound packet.
Window Size − What the operating system sets the Window Size at.
DF − Does the operating system set the Don’t Fragment bit.
TOS − Does the operating system set the Type of Service, and if so, at what.

通过分析数据包的这些因素，你能确定远程操作系统。此系统并非 100% 准确，且适用于某些操作系统，而不适用于其他操作系统。

By analyzing these factors of a packet, you may be able to determine the remote operating system. This system is not 100% accurate, and works better for some operating systems than others.

Basic Steps

在攻击系统之前，你必须知道是哪些操作系统承载网站。一旦知道了目标操作系统，就很容易确定可能存在哪些漏洞以利用目标系统。

Before attacking a system, it is required that you know what operating system is hosting a website. Once a target OS is known, then it becomes easy to determine which vulnerabilities might be present to exploit the target system.

下面是一个简单的 nmap 命令，可以用来识别用于承载网站的操作系统，以及与域名相关的所有已打开端口，即 IP 地址。

Below is a simple nmap command which can be used to identify the operating system serving a website and all the opened ports associated with the domain name, i.e., the IP address.

$nmap -O -v tutorialspoint.com

它将向你展示有关给定域名或 IP 地址的以下敏感信息：

It will show you the following sensitive information about the given domain name or IP address −

Starting Nmap 5.51 ( http://nmap.org ) at 2015-10-04 09:57 CDT
Initiating Parallel DNS resolution of 1 host. at 09:57
Completed Parallel DNS resolution of 1 host. at 09:57, 0.00s elapsed
Initiating SYN Stealth Scan at 09:57
Scanning tutorialspoint.com (66.135.33.172) [1000 ports]
Discovered open port 22/tcp on 66.135.33.172
Discovered open port 3306/tcp on 66.135.33.172
Discovered open port 80/tcp on 66.135.33.172
Discovered open port 443/tcp on 66.135.33.172
Completed SYN Stealth Scan at 09:57, 0.04s elapsed (1000 total ports)
Initiating OS detection (try #1) against tutorialspoint.com (66.135.33.172)
Retrying OS detection (try #2) against tutorialspoint.com (66.135.33.172)
Retrying OS detection (try #3) against tutorialspoint.com (66.135.33.172)
Retrying OS detection (try #4) against tutorialspoint.com (66.135.33.172)
Retrying OS detection (try #5) against tutorialspoint.com (66.135.33.172)
Nmap scan report for tutorialspoint.com (66.135.33.172)
Host is up (0.000038s latency).
Not shown: 996 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
443/tcp  open  https
3306/tcp open  mysql

TCP/IP fingerprint:
OS:SCAN(V=5.51%D=10/4%OT=22%CT=1%CU=40379%PV=N%DS=0%DC=L%G=Y%TM=56113E6D%P=
OS:x86_64-redhat-linux-gnu)SEQ(SP=106%GCD=1%ISR=109%TI=Z%CI=Z%II=I%TS=A)OPS
OS:(O1=MFFD7ST11NW7%O2=MFFD7ST11NW7%O3=MFFD7NNT11NW7%O4=MFFD7ST11NW7%O5=MFF
OS:D7ST11NW7%O6=MFFD7ST11)WIN(W1=FFCB%W2=FFCB%W3=FFCB%W4=FFCB%W5=FFCB%W6=FF
OS:CB)ECN(R=Y%DF=Y%T=40%W=FFD7%O=MFFD7NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A
OS:=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%
OS:Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=
OS:A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=
OS:Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%
OS:T=40%CD=S)

如果你没有在 Linux 系统上安装 nmap 命令，那么你可以使用以下 yum 命令安装它：

If you do not have nmap command installed on your Linux system, then you can install it using the following yum command −

$yum install nmap

你可以仔细查看 nmap 命令来检查和了解与系统相关并保护其免遭恶意攻击的不同功能。

You can go through nmap command in detail to check and understand the different features associated with a system and secure it against malicious attacks.

Quick Fix

你可以在一个安全代理服务器或 VPN 背后隐藏你的主系统，这样你的完整身份就是安全的，而且最终你的主系统保持安全。

You can hide your main system behind a secure proxy server or a VPN so that your complete identity is safe and ultimately your main system remains safe.

Port Scanning

我们刚刚看到 nmap 命令给出的信息。此命令会列出给定服务器上所有打开的端口。

We have just seen information given by nmap command. This command lists down all the open ports on a given server.

PORT       STATE   SERVICE
22/tcp     open    ssh
80/tcp     open    http
443/tcp    open    https
3306/tcp   open    mysql

你还可以使用以下命令检查是否打开了特定的端口：

You can also check if a particular port is opened or not using the following command −

$nmap -sT -p 443 tutorialspoint.com

它将产生以下结果 −

It will produce the following result −

Starting Nmap 5.51 ( http://nmap.org ) at 2015-10-04 10:19 CDT
Nmap scan report for tutorialspoint.com (66.135.33.172)
Host is up (0.000067s latency).
PORT    STATE SERVICE
443/tcp open  https

Nmap done: 1 IP address (1 host up) scanned in 0.04 seconds

一旦黑客知道打开的端口，那么他就可以通过打开的端口计划不同的攻击技术。

Once a hacker knows about open ports, then he can plan different attack techniques through the open ports.

Quick Fix

始终建议检查并关闭所有不需要的端口，以保护系统免受恶意攻击。

It is always recommended to check and close all the unwanted ports to safeguard the system from malicious attacks.

Ping Sweep

Ping 扫描是一种网络扫描技术，你可以使用它来确定 IP 地址范围内的哪些 IP 地址映射到活动主机。Ping 扫描也称为 ICMP sweep 。

A ping sweep is a network scanning technique that you can use to determine which IP address from a range of IP addresses map to live hosts. Ping Sweep is also known as ICMP sweep.

你可以对 Ping 扫描使用 fping 命令。此命令是一个类似 ping 的程序，它使用因特网控制消息协议 (ICMP) 回声请求来确定主机是否已启动。

You can use fping command for ping sweep. This command is a ping-like program which uses the Internet Control Message Protocol (ICMP) echo request to determine if a host is up.

fping 不同于 ping ，因为你可以在命令行上指定任意数量的主机，或指定包含要 ping 的主机列表的文件。如果主机在某个时间限制和/或重试限制内没有响应，它将被认为不可达。

fping is different from ping in that you can specify any number of hosts on the command line, or specify a file containing the lists of hosts to ping. If a host does not respond within a certain time limit and/or retry limit, it will be considered unreachable.

Quick Fix

要在网络上禁用 ping 扫描，你可以阻止来自外部来源的 ICMP ECHO 请求。你可以使用以下命令来完成此操作，这将在 iptable 中创建一个防火墙规则。

To disable ping sweeps on a network, you can block ICMP ECHO requests from outside sources. This can be done using the following command which will create a firewall rule in iptable.

$iptables -A OUTPUT -p icmp --icmp-type echo-request -j DROP

DNS Enumeration

域名服务器 (DNS) 像地图或地址簿。事实上，它就像一个分布式数据库，用于将 IP 地址 192.111.1.120 转换为名称 www.example.com, 反之亦然。

Domain Name Server (DNS) is like a map or an address book. In fact, it is like a distributed database which is used to translate an IP address 192.111.1.120 to a name www.example.com and vice versa.

DNS 枚举是查找所有 DNS 服务器及其对应记录的过程。其目的是在发起攻击之前尽可能收集有关目标的有趣详细信息。

DNS enumeration is the process of locating all the DNS servers and their corresponding records for an organization. The idea is to gather as much interesting details as possible about your target before initiating an attack.

你可以在 Linux 上使用 nslookup 命令来获取 DNS 和主机相关信息。此外，你可以使用以下 DNSenum 脚本来获取有关域名的详细信息：

You can use nslookup command available on Linux to get DNS and host-related information. In addition, you can use the following DNSenum script to get detailed information about a domain −

DNSenum.pl

DNSenum 脚本可以执行以下重要操作 −

DNSenum script can perform the following important operations −

Get the host’s addresses
Get the nameservers
Get the MX record
Perform axfr queries on nameservers
Get extra names and subdomains via Google scraping
Brute force subdomains from file can also perform recursion on subdomain that has NS records
Calculate C class domain network ranges and perform whois queries on them
Perform reverse lookups on netranges

Quick Fix

DNS 枚举没有快速修复程序，并且它确实超出了本教程的范围。防止 DNS 枚举是一个重大挑战。

DNS Enumeration does not have a quick fix and it is really beyond the scope of this tutorial. Preventing DNS Enumeration is a big challenge.

如果您的 DNS 未以安全的方式配置，网络和组织的大量敏感信息可能会泄露出去，并且不受信任的 Internet 用户可能会执行 DNS 区域传输。

If your DNS is not configured in a secure way, it is possible that lots of sensitive information about the network and organization can go outside and an untrusted Internet user can perform a DNS zone transfer.