Banner Information Collection
Banner information, welcome words, the banner can get software developers, software name, version, type of service and other information, you can use some of this information directly to the tool by using the corresponding exp to attack
Prerequisites: needs and objectives to establish a connection, only to establish a link in order to obtain the corresponding banner information
On the target server might be banner information is hidden or prohibit reading
Collection methods:
1, using the NC ( netcat , Swiss Army Knife)
nc-nv 192.168.0.1 80
-n represents shown numerically IP -v show details
2, using Dmitry (A software scan server-based scanning full links)
dmitry -pb target ip
-p scan all tcp ports -b collect banner information
3, nmap -sT -p1-200 --script = banner goal ip
-sT representation based TCP ways to scan
-p1-200 a scanning port is 1-200
--script indication banner script
4, amap -B 192.168.11.1 1-200
-B represents obtain banner information
1-2001-200 port
5, by means of a Firefox browser plug-ins: Wappalyzer , analysis platform architecture of the target site, the site environment, server configuration environment, programming language and so on.
6, using the tool bar packet connection response packet, the packet can be seen in the corresponding server information
BP\Tamper Data、Live HTTP herdes等
Need to focus on the response packet of two parameters: Server-the X-Powered-by
medusa (Medusa), open source, there is a lot of support services, such as the FTP, SSH, MySQL,
Syntax: Medusa [-h Host | -H File] [-u username | -U File] [-p password | - file P] [-C file] -M Module1 [OPT]
-H host blasting the IP
-H set the IP
-u username
-U user dictionary
-p password
-P password dictionary
-C composition file entries username: password
-M module
-O blasting output to a file
-e n (blank password) s (same user name and password)
-n using the specified port
-t to set the thread
-f to find the correct account password to stop blast
-r set the retry interval
-d View All modules
medusa -h 192.168.1.1 -u admin -P /root/top1000_password.txt -M ftp -e ns -t 10 -f -r 0 -O ./result_ftp.txt