root@kali:~# ping url
root@kali:~# nmap -T4 -v -A ip
root@kali:~# nmap -sV ip
检测Waf:
root@kali:~# nmap -p 80 --script http-waf-detect.nse url
发送32位字节绕过:
root@kali:~# nmap --mtu 32 ip
随机数据包绕过
root@kali:~# nmap --data-length ip
诱骗扫描绕过:
root@kali:~# nmap –D RND:10 ip
高级欺骗绕过:
root@kali:~# nmap –D decoy1,decoy2,decoy3 ip
连续扫描绕过:
root@kali:~# nmap --randomize-hosts ip
MAC欺骗绕过:
root@kali:~# nmap -sT -PN –spoof-mac aa:bb:cc:dd:ee:ff ip
IP隐蔽扫描:
root@kali:~# nmap -D decoy1,decoy2,decoy3 ip
端口扫描:
root@kali:~# nmap --source-port 135 ip
Sun RPC远程过程调用扫描:
root@kali:~# rpcinfo
root@kali:~# rpcinfo --p dns
查看网页源码:
root@kali:~# curl url
SSL协议扫描:
root@kali:~#nmap -Pn -sSV -T4 –F url
Http请求扫描:
root@kali:~# nmap -p80,443 --script http-methods --script-args http-methods.urlpath=/root/Desktpp/ url
HTTP代理检测扫描:
root@kali:~# nmap --script http-open-proxy -p8080 url
HTTP User Agent过滤认证扫描:
root@kali:~# nmap -p80,443 --script http-methods --script-args http-methods.url path=/root/Desktop/ url
Http URL验证扫描:
root@kali:~# nmap --script http-open-proxy --script-args http-open-proxy.url=http://whatsmyip.org,http-open-.pattern=”Your IP address is” -p8080 url
Http目录扫描:
root@kali:~# nmap --script http-enum -p80 url
查看Web站点目录:
root@kali:~# locate /nselib/data/http-fingerprints.xxx
root@kali:~# cd /usr/local/share/nmap/nslib/data
root@kali:~# ls -a
root@kali:~# nmap script http-enum http-enum.displayall -p80 url
指定不同User Agent绕过:
root@kali:~# nmap -p80 --script http-enum --script-args http.useragent=”Mozilla 5″ url
指定HTTP管道数目加快扫描:
root@kali:~# nmap -p80 --script http-enum --script-args http.pipeline=25 url
指定http-brute脚本暴力破解HTTP身份:
root@kali:~# nmap -p80 --script http-brute --script-args userdb=/var/usernames.txt,passdb=/var/passwords.txt <target>
指定http-brute userdb用户爆破模式:
root@kali:~# nmap --script http-brute --script-args brute.mode=user <target>
指定http-brute-passdb密码爆破模式:
root@kali:~# nmap --script http-brute --script-args brute.mode=pass <target>
指定brute.credfile证书验证模式:
root@kali:~# nmap --script http-brute --script-args brute.mode=creds,brute.credfile=./creds.txt <target>
清除HTTP登录默认凭证:
root@kali:~# nmap -p80 --script http-default-accounts <target>
Apache-UserDir用户目录扫描:
root@kali:~# nmap -p80 –script http-userdir-enum url
WordPress弱口令审计:
root@kali:~# nmap -p80 --script http-wordpress-brute url
使用http-wordpress-brute.threads线程扫描:
root@kali:~# nmap -p80 --script http-wordpress-brute --script-args http-wordpressbrute.threads=5 url
WordPress虚拟机平台探测:
root@kali:~# nmap -p80 --script http-wordpress-brute --script-args http-wordpressbrute.hostname=”ahostname.wordpress.com” url
设置不同http-wordpress-brute.uri登录:
root@kali:~# nmap -p80 --script http-wordpress-brute --script-args http-wordpressbrute.uri=”/hidden-wp-login.php” url
使用http-wordpress-brute.uservar/http-wordpress-brute.passvar改变用户存储密码:
root@kali:~# nmap -p80 --script http-wordpress-brute --script-args http-wordpressbrute.uservar=usuario,http-wordpress-brute.passvar=pasguord url
Joomla CMS审计扫描:
root@kali:~# nmap -p80 --script http-joomla-brute url
Web应用防火墙检测扫描:
root@kali:~# nmap -p80 --script http-waf-detect url
通过响应内容变化检测防火墙:
root@kali:~# nmap -p80 --script http-waf-detect --script-args=”http-waf-detect.detectBodyChanges” url
root@kali:~# nmap -p80 --script http-waf-detect --script-args=”http-waf-detect.aggro” url
CSRF跨站脚本漏洞跟踪:
检测HttpOnly是否启用TRACE获取Cookies:
root@kali:~# nmap -p80 --script http-methods,http-trace --script-args http-methods.retest url
CSRF跨站脚本漏洞检测:
允许攻击者执行任意JavaScript代码:
root@kali:~# nmap -p80 --script http-unsafe-output-escaping url
SQL注入漏洞检测:
root@kali:~# nmap -p80 --script http-sql-injection url
设置httpspider.maxpagecount加快扫描速度:
root@kali:~# nmap -p80 --script http-sql-injection --script-args httpspider.maxpagecount=200 url
禁用httpspider.withinhost主机站点爬行设置:
root@kali:~# nmap -p80 --script http-sql-injection --script-args httpspider.withinhost=false url
设置User Agent代理/HTTP管道扫描数目:
root@kali:~# nmap -p80 --script http-sql-injection --script-args http.useragent=”Mozilla 42″ url
网友评论