小白日记13:kali渗透测试之服务扫描(三)-SMTB扫描、防火墙识别、负载均衡识别、WAF识别

时间:2023-12-05 20:14:38

SMTP扫描

SMTP(Simple Mail Transfer Protocol)即简单邮件传输协议,它是一组用于由源地址到目的地址传送邮件的规则,由它来控制信件的中转方式。SMTP协议属于TCP/IP协议簇,它帮助每台计算机在发送或中转信件时找到下一个目的地。通过SMTP协议所指定的服务器,就可以把E-mail寄到收信人的服务器上了,整个过程只要几分钟。SMTP服务器则是遵循SMTP协议的发送邮件服务器,用来发送或中转发出的电子邮件。
SMB扫描针对机器去发现其漏洞,SMTP扫描为主动发现目标系统的邮件账号(被动信息收集也能收集到一些)。用途:社会工程学
初级方法
root@kali:~# nc -nv 192.168.1.107 25            #连接25端口
(UNKNOWN) [192.168.1.107] 25 (smtp) open
220 metasploitable.localdomain ESMTP Postfix (Ubuntu)
VRFY root #输入:尝试确认是否有root账号
252 2.0.0 root<strong>
</strong>

Nmap 前提:做了端口扫描知道目标主机开启25端口

扫描用户账号
root@kali:~# nmap smtp.163.com -p25 --script=smtp-enum-users.nse --script-args=smtp-enum-users.methods={VRFY}
#尝试枚举账号 #指定使用什么方式,默认用root账号,也可加别的参数(指定字典)
Starting Nmap 7.01 ( https://nmap.org ) at 2016-09-12 21:06 CST
Nmap scan report for smtp.163.com (220.181.12.16)
Host is up (0.044s latency).
Other addresses for smtp.163.com (not scanned): 220.181.12.17 220.181.12.18 220.181.12.11 220.181.12.12 220.181.12.13 220.181.12.14 220.181.12.15
rDNS record for 220.181.12.16: m12-16.163.com
PORT STATE SERVICE
25/tcp open smtp
| smtp-enum-users:
|_ Couldn't find any accounts Nmap done: 1 IP address (1 host up) scanned in 1.73 seconds

指定字典扫描邮箱账号:smtp-user-enum -M VRFY -U users.txt -t 10.0.0.1
扫描邮件开放中继:【如果开放了邮件中继,所有人都可以使用该邮件服务器】

root@kali:~# nmap smtp.163.com -p25 --script=smtp-open-relay.nse

Starting Nmap 7.01 ( https://nmap.org ) at 2016-09-12 21:11 CST
Nmap scan report for smtp.163.com (220.181.12.15)
Host is up (0.043s latency).
Other addresses for smtp.163.com (not scanned): 220.181.12.14 220.181.12.13 220.181.12.12 220.181.12.11 220.181.12.18 220.181.12.17 220.181.12.16
rDNS record for 220.181.12.15: m12-15.163.com
PORT STATE SERVICE
25/tcp open smtp
|_smtp-open-relay: Server doesn't seem to be an open relay, all tests failed Nmap done: 1 IP address (1 host up) scanned in 3.62 seconds

注:都可以用python脚本实现

防火墙识别

尽量隐蔽的情况下,扫描出防火墙上开放的端口,通过检查回包,可能识别端口是否被防火墙过滤。【被过滤的端口,不是防火墙上的端口,而是内部主机向外发起请求的临时端口】但设备多种多样,结果存在一定误差
小白日记13:kali渗透测试之服务扫描(三)-SMTB扫描、防火墙识别、负载均衡识别、WAF识别
python脚本扫描
#!/usr/bin/python

from scapy.all import*
import logging
logging.getLogger( "scapy.runtime" ).setLevel(logging.ERROR)
import sys if len( sys.argv ) !=3:
print "Usage - ./Firewalk_scan.py [Target.IP] [Target Port]"
print "Example - ./Firewalk_scan.py 1.1.1.1 443"
print "Example will determine if filtering exists on port 443 of Host 1.1.1.1"
sys.exit() ip = sys.argv[1]
port = int(sys.argv[2]) ACK_response = sr1(IP(dst=ip)/TCP(dport=port,flags="A"),timeout=1,verbose=0)
SYN_response = sr1(IP(dst=ip)/TCP(dport=port,flags="S"),timeout=1,verbose=0) if ((ACK_response == None) or (SYN_response == None)):
print "Port is either unstatefully filtered or host is down"
<strong>elif ((ACK_response == None) or (SYN_response == None)) and not ((ACK_response == None) and (SYN_response == None)):
print "Stateful filtering in place" #防火墙在线#此句有逻辑问题,尚未修改</strong>
elif int(SYN_response[TCP].flags) == 18:
print "Port is unfiltered and open"
elif int(SYN_response[TCP].flags) == 20:
print "Port is unfiltered and closed"
else:
print "Unable to determine if the port is filtered"<strong>
</strong>

Nmap对防火墙的识别

root@kali:~# nmap -p22 192.168.1.141 -sA

Starting Nmap 7.01 ( https://nmap.org ) at 2016-09-12 23:18 CST
Nmap scan report for DESKTOP-TA5DCRJ (192.168.1.141)
Host is up (0.00021s latency).
PORT STATE SERVICE
22/tcp unfiltered ssh
MAC Address: 2C:6E:85:C4:0D:5B (Intel Corporate) Nmap done: 1 IP address (1 host up) scanned in 0.44 seconds

根据其对SYN和ACK包的应答,去匹配上图类型

负载均衡识别

负载均衡从其应用的地理结构上分为本地负载均衡(Local Load Balance)和全局负载均衡(Global Load Balance,也叫地域负载均衡),本地负载均衡是指对本地的服务器群做负载均衡,全局负载均衡是指对分别放置在不同的地理位置、有不同网络结构的服务器群间作负载均衡。它提供了一种廉价有效透明的方法扩展网络设备和服务器的带宽、增加吞吐量、加强网络数据处理能力、提高网络的灵活性和可用性。
简单来说是DNS,即同一个域名对应不同IP。
基于web的服务负载均衡经常使用Nginx、Apache应用层负载均衡
Lbd(直接加域名,或者加IP)
root@kali:~# lbd www.baidu.com

lbd - load balancing detector 0.4 - Checks if a given domain uses load-balancing.
Written by Stefan Behte (http://ge.mine.nu)
Proof-of-concept! Might give false positives. <strong>Checking for DNS-Loadbalancing: FOUND
www.a.shifen.com has address 14.215.177.38
www.a.shifen.com has address 14.215.177.37 Checking for HTTP-Loadbalancing [Server]: #应用层负载均衡
bfe/1.0.8.18
NOT FOUND</strong> Checking for HTTP-Loadbalancing [Date]: 15:36:24, 15:36:24, 15:36:24, 15:36:24, 15:36:24, 15:36:24, 15:36:24, 15:36:24, 15:36:24, 15:36:24, 15:36:24, 15:36:24, 15:36:24, 15:36:24, 15:36:24, 15:36:25, 15:36:25, 15:36:25, 15:36:25, 15:36:25, 15:36:25, 15:36:25, 15:36:25, 15:36:25, 15:36:26, 15:36:26, 15:36:26, 15:36:26, 15:36:26, 15:36:26, 15:36:27, 15:36:27, 15:36:27, 15:36:27, 15:36:27, 15:36:27, 15:36:27, 15:36:27, 15:36:27, 15:36:27, 15:36:27, 15:36:27, 15:36:27, 15:36:27, 15:36:27, 15:36:27, 15:36:27, 15:36:27, 15:36:27, 15:36:27, NOT FOUND Checking for HTTP-Loadbalancing [Diff]: FOUND
< Last-Modified: Mon, 13 Jun 2016 02:50:17 GMT
> Last-Modified: Mon, 13 Jun 2016 02:50:12 GMT
< ETag: "575e1f69-115"
> ETag: "575e1f64-115" www.baidu.com does Load-balancing. Found via Methods: DNS HTTP[Diff]<strong>
</strong>

WAF识别

WAF(Web Application Firewall)的中文名称叫做“Web应用防火墙”,利用国际上公认的一种说法,WAF的定义是这样的:Web应用防火墙是通过执行一系列针对HTTP/HTTPS的安全策略来专门为Web应用提供保护的一款产品。通过从上面对WAF的定义中,我们可以很清晰的了解到,WAF是一种工作在应用层的、通过特定的安全策略来专门为Web应用提供安全防护的产品。
基于规则WAF过滤【可绕过】,基于机器学习结合语法词法分析的WAF将成为主流,几乎可防止所有的SQL注入
wafw00f 
<strong>root@kali:~# wafw00f -l                         #列出其可检测的WAF
</strong>
^ ^
_ __ _ ____ _ __ _ _ ____
///7/ /.' \ / __////7/ /,' \ ,' \ / __/
| V V // o // _/ | V V // 0 // 0 // _/
|_n_,'/_n_//_/ |_n_,' \_,' \_,'/_/
<
...' WAFW00F - Web Application Firewall Detection Tool By Sandro Gauci && Wendel G. Henrique Can test for these WAFs: Profense
NetContinuum
Barracuda
HyperGuard
BinarySec
Teros
F5 Trafficshield
F5 ASM
Airlock
Citrix NetScaler
ModSecurity
IBM Web Application Security
IBM DataPower
DenyALL
dotDefender
webApp.secure
BIG-IP
URLScan
WebKnight
SecureIIS
Imperva
ISA Server
<strong>root@kali:~# wafw00f http://www.microsoft.com</strong>

                                 ^     ^
_ __ _ ____ _ __ _ _ ____
///7/ /.' \ / __////7/ /,' \ ,' \ / __/
| V V // o // _/ | V V // 0 // 0 // _/
|_n_,'/_n_//_/ |_n_,' \_,' \_,'/_/
<
...' WAFW00F - Web Application Firewall Detection Tool By Sandro Gauci && Wendel G. Henrique Checking http://www.microsoft.com
Generic Detection results:
The site http://www.microsoft.com seems to be behind a WAF
Reason: The server returned a different response code when a string trigged the blacklist.
Normal response code is "400", while the response code to an attack is "403"
Number of requests: 16

nmap检测WAF

root@kali:~# nmap www.microsoft.com <strong>--script=http-waf-detect.nse</strong>

Starting Nmap 7.01 ( https://nmap.org ) at 2016-09-12 23:51 CST

小白日记,未完待续……