20154307 "Network Confrontation" Exp6 Information Collection and Vulnerability Scanning
1. Answers to basic questions
(1) Which organizations are responsible for the management of DNS and IP.
A: The global root servers are managed by ICANN, which is authorized by the US government, and is responsible for the management of global domain name root servers, DNS and IP addresses.
Global root domain name servers: the vast majority are in Europe and North America (13 worldwide, numbered with A~M), and China only has mirror servers (backup).
There are 5 regional registries worldwide:
1. ARIN is mainly responsible for business in North America
2. RIPE is mainly responsible for business in Europe
3. APNIC is mainly responsible for business in the Asia-Pacific region
4.LACNIC is mainly responsible for Latin America business
5.AfriNIC is responsible for the business in Africa
(2) What is 3R information.
The 3Rs are
Registrant
Registrar
Official Registry (Registry)
(3) Evaluate the accuracy of the scan results.
The accuracy of each different scanning tool is different, but they are all quite accurate. It's really like complaining about openvas. The installation and configuration environment is really troublesome. . . .
2. Experimental content
2.1whois query
whois checked the Hangzhou government network
I saw the 3r information, as well as the server registration time information. . . .
2.2nslookup and dig query
I used nslookup and dig respectively
I found that the address information is 113.200.91.197, and then I started to find the IP address. The following are several ways to find the IP address
I used sodan search engine first
The address turned out to be Xi'an. . . . .
ip reverse domain name query
This is the IP address searched by Baidu
2.3tracert route detection
I first used it on kali to traceroute 113.200.91.197
see the forwarding path
The result seems to be invisible. . . .
So I looked at the forwarding path in win7
Then I checked the source of each ip online. . .
2.4 Search engine query technology
It seems that there are not many ppts about the network
Physics is a lot
2.5netdiscover query
Use netdiscover
host detection on private network segments
2.6 The use of nmap scan ports
Enter nmap -sn 192.168.120.*
to find active hosts under this network segment
found four
tcp port scan for 192.168.120.1
I tried other host's ip, no open tcp port was found
udp port scan for host
Send tcp ack packets for detection, you can detect whether the host is alive
Scan the host's operating system
You can see that the operating system is win7
Scanning of host Microsoft service version information
2.7 smb service enumeration
Enter msf mode, search_version
and find the auxiliary module of smb.
Modify the parameters, and then run, you can see the host smb version information win7 sp1
2.8 openvas vulnerability scan
After installing openvas many times, it was not installed, and kali crashed several times, so I scanned my win7 vulnerability on the computer of my classmate. . .
Click full and fast to view its details
Here I chose brute force attacks
On the net I found an explanation about brute force attacks:
A brute force attack is a trial-and-error method used to obtain information, such as user passwords or personal identification numbers (PINs). During a brute force attack, automated software is used to generate a large number of consecutive guesses of the value of the required data. Brute force attacks can be used by criminals or by cybersecurity analysts passing security testing organizations to crack encrypted data.
I went in and saw nine loopholes
So I chose a vulnerability with the highest risk factor
This script attempts to authenticate to the VNC server with the password set in the password preferences.
Some VNC services have a blacklist scheme that blocks IP addresses after five unsuccessful connection attempts over a period of time. The script will abort the brute force attack if it is blocked. Also note that passwords can be up to 8 characters.
I don't understand this vulnerability very well, it is probably a vulnerability of remote connection brute force login. . . . .
3. Experimental summary and experience
This experiment is a scanning of computer information (port opening, software version, etc.) to collect vulnerabilities. For attackers, vulnerability scanning and information scanning are necessary. As far as users are concerned, it is the most critical to protect their own host information, properly close unnecessary ports, and promptly repair the loopholes in their own hosts, so as to prevent them from being attacked. . .
Since I have been preparing for the exam this week, the time is tight, and the offensive and defensive experiments have been delayed again and again, so I am very sorry for the late completion. . . .