Network Security Learning (11) scanning and blasting

adopt VMnet1（8） The network card allows the real machine to communicate with the virtual machine

Enable virtual network card

Configure virtual machines IP Address , Make the virtual machine and the network card in the same network segment

Scanning technology

How to scan ？

Combination of hand and tool .

The following two points are generally done in scanning

Host detection ： Determine whether the target host is alive

Port scanning ： Find the port opened by the online host , And the service running on the port . Even further determine the target host operating system type and more detailed information

Common port numbers

21                        FTP

22                        SSH

23                        Telnet

25                        SMTP（ mail ）

80                        HTTP

443                      HTTPs     

445                        Shared files   

1433                    SQL Server

1521                    Oracle

3306                    MySQL

3389                    RDP（ Remote desktop ）

 Nmap Scanner

Important parameter

-sp                                ping scanning

-p                                  Specify the port range

-sv                                Service version detection （ Software using ports ）

-O（ Capitalization ）                    Start operating system detection               

-A                                  Full scan

-oN                                The scan results are saved txt

example ：

Namp -sp 10.1.1.0/24                                         scanning 10.1.1.0 The whole network segment

Nmap -p 21,23-25,3389 10.1.1.1                     (23-25 It's a scan 23,24,25)

Nmap -p 21,23 10.1.1.1 -sv                                scanning 21,23 Service version of

Nmap -A 10.1.1.1                                                  Full scan

Nmap -O 10.1.1.1                                                Scan target system version

Nmap -p 21,23 10.1.1.1 -oN e:\result                

  Hydra

Hydra -l user name -p password 10.1.1.1 telnet

Hydra -l a -P  Password dictionary 10.1.1.1 rdp

Hydra -L  User dictionary  -P  Password dictionary 10.1.1.1 rdp

Local cracking

Getpass        Extract the password from memory

Local violence cracking

pwdump        extract sam Medium Hash value

Manual will hash Value to store hash.txt in

Use saminside Software hash Brute force