nmap(zenmap)使用

這是針對 apple finder 通訊協定內漏洞 進行暴力攻擊 nmap官方說明 local afp = require "afp" local nmap = require "nmap" local shortport = require "shortport" local stdnse = require "stdnse" local string = require "string" local table = require "table" local unpwdb = require "unpwdb" -- we don't really need openssl here, but let's attempt to load it as a way -- to simply prevent the script from running, in case we don't have it local openssl = stdnse.silent_require("openssl") description = [[ Performs password guessing against Apple Filing Protocol (AFP). ]] --- -- @usage -- nmap -p 548 --script afp-brute <host> -- -- @output -- PORT    STATE SERVICE -- 548/tcp open  afp -- | afp-brute: -- |_  admin:KenSentMe => Valid credentials -- Information on AFP implementations -- -- Snow Leopard -- ------------ -- - Delay 10 seconds for accounts with more than 5 incorrect login attempts...

用來針對目標分析 参考: http://fanli7.net/a/bianchengyuyan/C__/20160720/569565.html 下載： description = [[ A simple banner grabber which connects to an open TCP port and prints out anything sent by the listening service within five seconds. If no banner is received, a HTTP GET request is sent and the response recorded. Banners which contain telnet sequences will trigger telnet option negotiation, with the intent to get far enough into the handshake that we can receive the real banner. If data is received, more data will be read for up to fifteen seconds. ]] --- -- @output -- 21/tcp open ftp -- |_ banner-plus: 220 FTP version 1.0\x0D\x0A author = "hdm" license = "Same as Nmap--See http://nmap.org/book/man-legal.html" categories = {"discovery", "safe"} local nmap = require "nmap" local comm = require "comm" local stdnse = require "stdnse" local strbuf = require "strbuf" local nsedebug = require "n...

查看  Apache JServ 里頭提供哪些Method(PUT, GET 等等) 官方網站:  https://nmap.org/nsedoc/scripts/ajp-methods.html 內容: local ajp = require "ajp" local shortport = require "shortport" local stdnse = require "stdnse" local table = require "table" description = [[ Discovers which options are supported by the AJP (Apache JServ Protocol) server by sending an OPTIONS request and lists potentially risky methods. In this script, "potentially risky" methods are anything except GET, HEAD, POST, and OPTIONS. If the script reports potentially risky methods, they may not all be security risks, but you should check to make sure. This page lists the dangers of some common methods: http://www.owasp.org/index.php/Testing_for_HTTP_Methods_and_XST_%28OWASP-CM-008%29 ]] --- -- @usage -- nmap -p 8009 <ip> --script ajp-methods -- -- @output -- PORT     STATE SERVICE -- 8009/tcp open  ajp13 -- | ajp-methods: -- |   Supported methods: GET ...

針對  AFP (apple) 與 ACLs 看mount的訊息 官方:   https://nmap.org/nsedoc/scripts/afp-showmount.html 內容: local afp = require "afp" local nmap = require "nmap" local shortport = require "shortport" local stdnse = require "stdnse" local table = require "table" description = [[ Shows AFP shares and ACLs. ]] --- -- --@output -- PORT    STATE SERVICE -- 548/tcp open  afp -- | afp-showmount: -- |   Yoda's Public Folder -- |     Owner: Search,Read,Write -- |     Group: Search,Read -- |     Everyone: Search,Read -- |     User: Search,Read -- |   Vader's Public Folder -- |     Owner: Search,Read,Write -- |     Group: Search,Read -- |     Everyone: Search,Read -- |     User: Search,Read -- |_    Options: IsOwner -- Version 0.4 -- Created 01/03/2010 - v0.1 - created by Patrik Karlsson -- Revised 01/13/2010 - v0.2 - Fixed a bug where a single share ...

查詢伺服器 一些訊息 指令:  nmap --script afp-serverinfo.nse 192.168.8.251 官方說明: https://nmap.org/nsedoc/scripts/afp-serverinfo.html 內容: local afp = require "afp" local nmap = require "nmap" local shortport = require "shortport" local stdnse = require "stdnse" local table = require "table" description = [[ Shows AFP server information. This information includes the server's hostname, IPv4 and IPv6 addresses, and hardware type (for example <code>Macmini</code> or <code>MacBookPro</code>). ]] --- -- @output -- PORT    STATE SERVICE -- 548/tcp open  afp -- | afp-serverinfo: -- |   Server Flags: -- |     Flags hex: 0x837d -- |     Super Client: true -- |     UUIDs: false -- |     UTF8 Server Name: true -- |     Open Directory: true -- |     Reconnect: false -- |     Server Notifications: true -- |     TCP/IP: true -- |     Server...

Detects the Mac OS X AFP directory traversal vulnerability 判斷 MacOS 那台  是否可以被暴力攻擊破解目錄 官方說明: https://nmap.org/nsedoc/scripts/afp-path-vuln.html 参考: https://www.cqure.net/wp/2010/03/detecting-apple-mac-os-x-afp-vulnerability-cve-2010-0533-with-nmap/ 內容: local afp = require "afp" local nmap = require "nmap" local shortport = require "shortport" local stdnse = require "stdnse" local table = require "table" local vulns = require "vulns" description = [[ Detects the Mac OS X AFP directory traversal vulnerability, CVE-2010-0533. This script attempts to iterate over all AFP shares on the remote host. For each share it attempts to access the parent directory by exploiting the directory traversal vulnerability as described in CVE-2010-0533. The script reports whether the system is vulnerable or not. In addition it lists the contents of the parent and child directories to a max depth of 2. When running in verbo...

指令: nmap --script address-info.nse IP 官方:  https://nmap.org/nsedoc/scripts/address-info.html 內容: local bit = require "bit" local datafiles = require "datafiles" local nmap = require "nmap" local stdnse = require "stdnse" local string = require "string" local table = require "table" description = [[ Shows extra information about IPv6 addresses, such as embedded MAC or IPv4 addresses when available. Some IP address formats encode extra information; for example some IPv6 addresses encode an IPv4 address or MAC address. This script can decode these address formats: * IPv4-compatible IPv6 addresses, * IPv4-mapped IPv6 addresses, * Teredo IPv6 addresses, * 6to4 IPv6 addresses, * IPv6 addresses using an EUI-64 interface ID, * IPv4-embedded IPv6 addresses, * IPv4-translated IPv6 addresses and * ISATAP Modified EUI-64 IPv6 addresses. See RFC 4291 for general IPv6 addressing architecture and the definit...