說到『劊客工具』，焉能不提及出了名的

John the Ripper

John the Ripper is a free password cracking software tool.^[1] Initially developed for the Unix operating system, it now runs on fifteen different platforms (eleven of which are architecture-specific versions of Unix, DOS, Win32, BeOS, and OpenVMS). It is one of the most popular password testing and breaking programs^[2] as it combines a number of password crackers into one package,autodetects password hash types, and includes a customizable cracker. It can be run against various encrypted password formats including several crypt password hash types most commonly found on various Unix versions (based on DES, MD5, or Blowfish), Kerberos AFS, and Windows NT/2000/XP/2003 LM hash. Additional modules have extended its ability to include MD4-based password hashes and passwords stored in LDAP, MySQL, and others.^[3]

Sample output

This section needs expansion.You can help by adding to it.(February 2013)

Here is a sample output in a Debian environment.

# cat pass.txt
user:AZl.zWwxIh15Q
# john -w:password.lst pass.txt
Loaded 1 password hash (Traditional DES [24/32 4K])
example         (user)
guesses: 1  time: 0:00:00:00 100%  c/s: 752  trying: 12345 - pookie

The first line is a command to expand the data stored in the file “pass.txt.” The next line is the contents of the file, i.e. the user (AZ1) and the hash associated with that user (zWwxIh15Q). The third line is the command for running John the Ripper utilizing the “-w” flag. “password.lst” is the name of a text file full of words the program will use against the hash, pass.txt makes another appearance as the file we want John to work on.

Then we see output from John working. Loaded 1 password hash – the one we saw with the “cat” command – and the type of hash John thinks it is (Traditional DES). We also see that the attempt required one guess at a time of 0 with a 100% guess rate.

Attack types

One of the modes John can use is the dictionary attack. It takes text string samples (usually from a file, called a wordlist, containing words found in a dictionary or real passwords cracked before), encrypting it in the same format as the password being examined (including both the encryption algorithm and key), and comparing the output to the encrypted string. It can also perform a variety of alterations to the dictionary words and try these. Many of these alterations are also used in John’s single attack mode, which modifies an associated plaintext (such as a username with an encrypted password) and checks the variations against the hashes.

John also offers a brute force mode. In this type of attack, the program goes through all the possible plaintexts, hashing each one and then comparing it to the input hash. John uses character frequency tables to try plaintexts containing more frequently used characters first. This method is useful for cracking passwords which do not appear in dictionary wordlists, but it takes a long time to run.

 

呢！此後『密碼字典』興起︰

Passwords

Name	Compressed	Uncompressed	Date	Notes
Rockyou	rockyou.txt.bz2 (60,498,886 bytes)	n/a	2009-12	Best list available; huge, stolen unencrypted
………

 

人們想要震撼你『rock you』呦？

praetorian-inc/Hob0Rules

 

如果你的 Kali 系統 SD 卡夠大，一次裝足︰

root@kali-pi:~# apt-get install kali-linux-all

 

要不，就選必須︰

root@kali-pi:~# apt-cache search rockyou
wordlists - Contains the rockyou wordlist

root@kali:~# apt-cache search hydra-gtk
hydra-gtk - very fast network logon cracker - GTK+ based GUI

 

root@kali-pi:~# mkdir test
root@kali-pi:~# cd test
root@kali-pi:~# cp /usr/share/wordlists/rockyou.txt.gz .
root@kali-pi:~# gzip -d rockyou.txt.gz

root@kali:~/test# wc -l rockyou.txt 
14344392 rockyou.txt

 

然後可以驅使『九頭蛇』︰

vanhauser-thc/thc-hydra

hydra

			  H Y D R A

                  (c) 2001-2018 by van Hauser / THC
         <vh@thc.org> https://github.com/vanhauser-thc/thc-hydra
   many modules were written by David (dot) Maciejak @ gmail (dot) com
             BFG code by Jan Dlabal <dlabaljan@gmail.com>

	    Licensed under AGPLv3 (see LICENSE file)

       Please do not use in military or secret service organizations,
                      or for illegal purposes.

INTRODUCTION

Number one of the biggest security holes are passwords, as every password security study shows. This tool is a proof of concept code, to give researchers and security consultants the possibility to show how easy it would be to gain unauthorized access from remote to a system.

THIS TOOL IS FOR LEGAL PURPOSES ONLY!

There are already several login hacker tools available, however none does either support more than one protocol to attack or support parallized connects.

It was tested to compile cleanly on Linux, Windows/Cygwin, Solaris, FreeBSD/OpenBSD, QNX (Blackberry 10) and MacOS.

Currently this tool supports the following protocols: Asterisk, AFP, Cisco AAA, Cisco auth, Cisco enable, CVS, Firebird, FTP, HTTP-FORM-GET, HTTP-FORM-POST, HTTP-GET, HTTP-HEAD, HTTP-POST, HTTP-PROXY, HTTPS-FORM-GET, HTTPS-FORM-POST, HTTPS-GET, HTTPS-HEAD, HTTPS-POST, HTTP-Proxy, ICQ, IMAP, IRC, LDAP, MS-SQL, MYSQL, NCP, NNTP, Oracle Listener, Oracle SID, Oracle, PC-Anywhere, PCNFS, POP3, POSTGRES, RDP, Rexec, Rlogin, Rsh, RTSP, SAP/R3, SIP, SMB, SMTP, SMTP Enum, SNMP v1+v2+v3, SOCKS5, SSH (v1 and v2), SSHKEY, Subversion, Teamspeak (TS2), Telnet, VMware-Auth, VNC and XMPP.

However the module engine for new services is very easy so it won’t take a long time until even more services are supported. Your help in writing, enhancing or fixing modules is highly appreciated!! 🙂

 

自我攻防哩☺

 

咦！ Kali 之 root 密碼為 toor ，理應簡單乎？

『密碼字典』長一千四百三十幾萬筆，一分鐘嘗試不過兩百次，那需要多少時日勒☻

 

應慶幸『防者』還有『張良計』耶☆

fail2ban/fail2ban

Daemon to ban hosts that cause multiple authentication errors http://www.fail2ban.org

                     __      _ _ ___ _               
                    / _|__ _(_) |_  ) |__  __ _ _ _  
                   |  _/ _` | | |/ /| '_ \/ _` | ' \ 
                   |_| \__,_|_|_/___|_.__/\__,_|_||_|
                   v0.11.0.dev1            20??/??/??

Fail2Ban: ban hosts that cause multiple authentication errors

Fail2Ban scans log files like /var/log/auth.log and bans IP addresses conducting too many failed login attempts. It does this by updating system firewall rules to reject new connections from those IP addresses, for a configurable amount of time. Fail2Ban comes out-of-the-box ready to read many standard log files, such as those for sshd and Apache, and is easily configured to read any log file of your choosing, for any error you wish.

Though Fail2Ban is able to reduce the rate of incorrect authentication attempts, it cannot eliminate the risk presented by weak authentication. Set up services to use only two factor, or public/private authentication mechanisms if you really want to protect services.

	Since v0.10 fail2ban supports the matching of IPv6 addresses.

This README is a quick introduction to Fail2Ban. More documentation, FAQ, and HOWTOs to be found on fail2ban(1) manpage,Wiki and the website: https://www.fail2ban.org

 

不須問『攻者』若得『過牆梯』

root@kali:~# hydra -l root -e nsr 127.0.0.1 ssh
Hydra v8.6 (c) 2017 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2018-10-24 10:08:29
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 3 tasks per 1 server, overall 3 tasks, 3 login tries (l:1/p:0), ~3 try per task
[DATA] attacking ssh://127.0.0.1:22/
[22][ssh] host: 127.0.0.1   login: root   password: toor
1 of 1 target successfully completed, 1 valid password found
Hydra (http://www.thc.org/thc-hydra) finished at 2018-10-24 10:08:44

 

該如何嘛★

 

 

 

 

 

 

 

夜來有一夢，解之尋 夢書，得一詩︰

《夏日登鹤岩偶成》‧ 戴叔倫

天風吹我上層岡，
露洒長松六月凉。
愿借老僧双白鶴，
碧云深處共翱翔。

， 禹步判詞曰︰天借，長。

幽思起無明，意緒難抹滅。信手翻《  》圖冊，正遇仲夏夜之夢

 

， 跳舞的仙子。想必是『花魂』『鳥魂』已歸天界了吧！

☆ 編者言

無緣讀  夢書，沒法解  禹步，因此緣法故，只作『寓釋』講， M♪o 的心情或可體會，難以言傳。

─── 《M♪O 之學習筆記本《寅》井井︰【䷝】試釋是事》

 

幾年前，譯寫 M♪O 偶遇之『駭黑事件』，當時心卻沈重那年寶島的『網路霸凌』遺憾︰

《語‧飛語‧飛飛語；言‧流言‧流流言》

如果《飛劍》可『殺人』，《飛語》令人『心碎』；

假使《流水》能『無情』，《流言》使人『絕命』。

從《茱莉亞羅伯茨妹妹自殺原因：不堪語言暴力》這篇報導，以及《茱莉亞‧羅伯茨：妹妹自殺後苦痛難熬》那篇報導，看

《流言飛語》之『語言暴力』的『悲劇』何時休？！

 

今日恰逢提筆談『劊客』 cracker 『技倆』之際︰

當下沒心緒， W!o+ 傳話至，吱吱又咭咭。聲聲皆分明，半句難了意。細思，原來是《  》笑典裡的

《施氏食獅史》‧趙元任

石室詩士施氏，嗜獅，誓食十獅。施氏時時適市視獅。十
時，適十獅適市。是時，適施氏適市。氏視是十獅，恃矢
勢，使是十獅逝世。氏拾是十獅屍， 適石室。石室濕，氏
使侍拭石室。石室拭，氏始試食是十獅。食時，始識是十
獅，實十石獅屍 。試釋是事。

☆ 編者言

編者不知『笑典』是何典？只讀著一堆音近字，方才勉強擬以相仿的《施氏食獅史》。其實『  W!o 』以及『 M♪o 』有著特殊關聯，讀者若是不知道此事，恐將以為編者穿鑿附會，特此一併表明。

！☿☹ ，W!o 平日寡言少語，這『咭吱』文，恐有『寓意』，卻是恰在此時？☿☹☺ 該不會是『魔電』 Modem 聲吧？？這倒是點醒了我一件事。

生︰《  》網上偶讀 蠻力法

Brute-force attack

In cryptography, a brute-force attack, or exhaustive key search, is a cryptanalytic attack that can, in theory, be used against any encrypted data^[1] (except for data encrypted in an information-theoretically secure manner). Such an attack might be used when it is not possible to take advantage of other weaknesses in an encryption system (if any exist) that would make the task easier. It consists of systematically checking all possible keys or passwords until the correct one is found. In the worst case, this would involve traversing the entire search space.

When password guessing, this method is very fast when used to check all short passwords, but for longer passwords other methods such as the dictionary attack are used because of the time a brute-force search takes.

When key guessing, the key length used in the cipher determines the practical feasibility of performing a brute-force attack, with longer keys exponentially more difficult to crack than shorter ones. A cipher with a key length of N bits can be broken in a worst-case time proportional to 2^N and an average time of half that.

Brute-force attacks can be made less effective by obfuscating the data to be encoded, something that makes it more difficult for an attacker to recognize when he/she has cracked the code. One of the measures of the strength of an encryption system is how long it would theoretically take an attacker to mount a successful brute-force attack against it.

Brute-force attacks are an application of brute-force search, the general problem-solving technique of enumerating all candidates and checking each one.

The term “brute-force” is not the only term to name such a type of attack. It can also be called “bruteforce”, “brute force” and just “brute” (that is common in names of programs that perform brute-force attacks).

 

， 本想閑時再驗證。何不就趁今日。☺☿

碼︰無 習。無課。

☿ 行︰雖說是蠻力法，實則乃用『窮舉』，數ㄕㄨˇ數ㄕㄨˋ數不盡，耗時難為功，怎曉 機心迅捷後，此法遂真可行耶！？實習所用機，登入採『學號』與『針碼』【※ Pin Code 四位數字碼】 。『學號』之制 ── 班碼-位碼 ──，班不過十，位少於百，故而極其數不足千。針碼有四位，總其量，只有萬。試而盡之，『千萬』已『窮舉』。問題當在『咸澤碼訊』有多快？『登錄』之法有多嚴 ？破解程式幾人會？設使一應具足，那個『駭黑』之事，怕是恐難免！！

理雖通，程式而今初學，實作難？！☿☹。苦思腸，難不成不能『仍舊』用著『試誤法』，一探究竟！？ ☿☺ 。

# 登入情況分析
pi@raspberrypi ~  

 

經過了一番折騰，總算完成了 M♪oautologin.py ，雖看來事情並不容易 ，但是…再熟悉一點之後…… ☿☺ ，恐非難事。

 

誰知又遭台鐵『普悠瑪』慘痛事故★

能以為不巧『月行黑道』乎？

陰陽之不測，人事務求其免也☻

派︰聽聞學長說，實習機器故障，所以停課。也常常上課不實習。故不故障、上不上課、實不實習，豈關聯！事出必有因，費疑猜！！

─── 《M♪O 之學習筆記本《寅》井井︰【青木春】驚駭來黑》

 

故說『劊客』者流，無有多餘的『情報』︰

root@kali-pi:~# hydra -l root -e nsr 5.168.168.9 ssh
Hydra v8.6 (c) 2017 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2018-10-23 19:49:11
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 3 tasks per 1 server, overall 3 tasks, 3 login tries (l:1/p:0), ~3 try per task
[DATA] attacking ssh://5.168.168.9:22/
[22][ssh] host: 5.168.168.9   login: root   password: toor
1 of 1 target successfully completed, 1 valid password found
Hydra (http://www.thc.org/thc-hydra) finished at 2018-10-23 19:49:15
root@kali-pi:~#

 

只靠『蠻力』硬幹，恐路人皆知的矣☆

 

 

 

 

 

 

 

據聞 Unix 有個『傳統』︰

Unix security

Unix security refers to the means of securing a Unix or Unix-like operating system. A secure environment is achieved not only by the design concepts of these operating systems, but also through vigilant user and administrative practices.

……

Root access

Most Unix and Unix-like systems have an account or group which enables a user to exact complete control over the system, often known as a root account. If access to this account is gained by an unwanted user, this results in a complete breach of the system. A root account however is necessary for administrative purposes, and for the above security reasons the root account is seldom used for day to day purposes (the sudo program is more commonly used), so usage of the root account can be more closely monitored.

Root access “as it should be” can be visualised by those familiar with the Superman stories using the following analogy:

Using a root account is rather like being Superman; an administrator’s regular user is more like Clark Kent. Clark Kent becomes Superman for only as long as necessary, in order to save people. He then reverts to his “disguise”. Root access should be used in the same fashion. The Clark Kent disguise doesn’t really restrict him though, as he is still able to use his super powers. This is analogous to using the sudo program.

 

使得『超級使用者』 root 不應『登入』 GUI 『 x 視窗』，不當ssh 『遠端連線』，最好只在『本機』只用『終端機』也？

切莫忘了 Unix 也有

su (Unix)

The Unix command su, which stands for substitute user is used by a computer user to execute commands with the privileges of another user account. When executed it invokes a shell without changing the current working directory or the user environment.

When the command is used without specifying the new user id as a command line argument, it defaults to using the superuser account (user id 0) of the system.

 

指令，可以分擔『管理工作』哩！

以至今天『個人』使用者『實務』上幾乎都是『 sudoer 』呦！！

sudo

Sudo （substitute user [或 superuser] do），是一種程式，用於類Unix作業系統如BSD，Mac OS X，以及GNU/Linux以允許使用者透過安全的方式使用特殊的權限執行程式 （通常為系統的超級使用者）。

原理

在sudo於1980年前後被寫出之前^[2]，一般使用者管理系統的方式是利用 su 切換為超級使用者。但是使用su的缺點之一在於必須要先告知超級使用者的密碼。

sudo使一般使用者不需要知道超級使用者的密碼即可獲得權限。首先超級使用者將普通用戶的名字、可以執行的特定命令、按照哪種用戶或用戶組的身分執行等資訊，登記在特殊的檔案中（通常是/etc/sudoers），即完成對該使用者的授權（此時該使用者稱為「sudoer」）^[3]；在一般使用者需要取得特殊權限時，其可在命令前加上「sudo」，此時sudo將會詢問該使用者自己的密碼（以確認終端機前的是該使用者本人），回答後系統即會將該命令的行程以超級使用者的權限執行。之後的一段時間內（預設為5分鐘^[4]，可在/etc/sudoers自訂），使用sudo不需要再次輸入密碼。

由於不需要超級使用者的密碼，部分Unix系統甚至利用sudo使一般使用者取代超級使用者作為管理帳號，例如Ubuntu、Mac OS X等。

 

然而那個『應當爭議』尚未停歇，不同 Linux 發行版各有堅持！？

想這味『咖哩』 Kali 系統，『預設』只有一個 root 使用者，又以『x 視窗』環境『登入』，當真奇怪耶？！

『鎖』住大門，僅許『持鑰人』開門，可謂『安』乎？

誰人知有無『病毒』井通，已經貫穿『內外』勒！

『功夫』的修煉固不能『強求快慢』☺

『心法』之深入哪容得『掛一漏萬』☆

 

也許『圖禪』 之興非無由矣◎

Chapter 12. Zenmap GUI Users’ Guide

Zenmap is the official graphical user interface (GUI) for the Nmap Security Scanner. It is a multi-platform, free and open-source application designed to make Nmap easy for beginners to use while providing advanced features for experienced Nmap users. Frequently used scans can be saved as profiles to make them easy to run repeatedly. A command creator allows interactive creation of Nmap command lines. Scan results can be saved and viewed later. Saved scans can be compared with one another to see how they differ. The results of recent scans are stored in a searchable database. A typical Zenmap screen shot is shown in Figure 12.1. See the official Zenmap web page for more screen shots.

 

This guide is meant to make Nmap and Zenmap easy to use together, even if you haven’t used either before. For the parts of this guide that deal specifically with Nmap (command-line options and such), refer to Chapter 15, Nmap Reference Guide.

 

※ 註︰手冊

http://nmap.org/data/nmap.usage.txt

Nmap 7.70SVN ( https://nmap.org )
Usage: nmap [Scan Type(s)] [Options] {target specification}

TARGET SPECIFICATION:
  Can pass hostnames, IP addresses, networks, etc.
  Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
  -iL <inputfilename>: Input from list of hosts/networks
  -iR <num hosts>: Choose random targets
  --exclude <host1[,host2][,host3],...>: Exclude hosts/networks
  --excludefile <exclude_file>: Exclude list from file

HOST DISCOVERY:
  -sL: List Scan - simply list targets to scan
  -sn: Ping Scan - disable port scan
  -Pn: Treat all hosts as online -- skip host discovery
  -PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports
  -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
  -PO[protocol list]: IP Protocol Ping
  -n/-R: Never do DNS resolution/Always resolve [default: sometimes]
  --dns-servers <serv1[,serv2],...>: Specify custom DNS servers
  --system-dns: Use OS's DNS resolver
  --traceroute: Trace hop path to each host

SCAN TECHNIQUES:
  -sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
  -sU: UDP Scan
  -sN/sF/sX: TCP Null, FIN, and Xmas scans
  --scanflags <flags>: Customize TCP scan flags
  -sI <zombie host[:probeport]>: Idle scan
  -sY/sZ: SCTP INIT/COOKIE-ECHO scans
  -sO: IP protocol scan
  -b <FTP relay host>: FTP bounce scan

PORT SPECIFICATION AND SCAN ORDER:
  -p <port ranges>: Only scan specified ports
    Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9
  --exclude-ports <port ranges>: Exclude the specified ports from scanning
  -F: Fast mode - Scan fewer ports than the default scan
  -r: Scan ports consecutively - don't randomize
  --top-ports <number>: Scan <number> most common ports
  --port-ratio <ratio>: Scan ports more common than <ratio>

SERVICE/VERSION DETECTION:
  -sV: Probe open ports to determine service/version info
  --version-intensity <level>: Set from 0 (light) to 9 (try all probes)
  --version-light: Limit to most likely probes (intensity 2)
  --version-all: Try every single probe (intensity 9)
  --version-trace: Show detailed version scan activity (for debugging)

SCRIPT SCAN:
  -sC: equivalent to --script=default
  --script=<Lua scripts>: <Lua scripts> is a comma separated list of
           directories, script-files or script-categories
  --script-args=<n1=v1,[n2=v2,...]>: provide arguments to scripts
  --script-args-file=filename: provide NSE script args in a file
  --script-trace: Show all data sent and received
  --script-updatedb: Update the script database.
  --script-help=<Lua scripts>: Show help about scripts.
           <Lua scripts> is a comma-separated list of script-files or
           script-categories.

OS DETECTION:
  -O: Enable OS detection
  --osscan-limit: Limit OS detection to promising targets
  --osscan-guess: Guess OS more aggressively

TIMING AND PERFORMANCE:
  Options which take <time> are in seconds, or append 'ms' (milliseconds),
  's' (seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m).
  -T<0-5>: Set timing template (higher is faster)
  --min-hostgroup/max-hostgroup <size>: Parallel host scan group sizes
  --min-parallelism/max-parallelism <numprobes>: Probe parallelization
  --min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <time>: Specifies
      probe round trip time.
  --max-retries <tries>: Caps number of port scan probe retransmissions.
  --host-timeout <time>: Give up on target after this long
  --scan-delay/--max-scan-delay <time>: Adjust delay between probes
  --min-rate <number>: Send packets no slower than <number> per second
  --max-rate <number>: Send packets no faster than <number> per second

FIREWALL/IDS EVASION AND SPOOFING:
  -f; --mtu <val>: fragment packets (optionally w/given MTU)
  -D <decoy1,decoy2[,ME],...>: Cloak a scan with decoys
  -S <IP_Address>: Spoof source address
  -e <iface>: Use specified interface
  -g/--source-port <portnum>: Use given port number
  --proxies <url1,[url2],...>: Relay connections through 

HTTP/SOCKS4 proxies
  --data <hex string>: Append a custom payload to sent packets
  --data-string <string>: Append a custom ASCII string to sent packets
  --data-length <num>: Append random data to sent packets
  --ip-options <options>: Send packets with specified ip options
  --ttl <val>: Set IP time-to-live field
  --spoof-mac <mac address/prefix/vendor name>: Spoof your MAC address
  --badsum: Send packets with a bogus TCP/UDP/SCTP checksum

OUTPUT:
  -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3,
     and Grepable format, respectively, to the given filename.
  -oA <basename>: Output in the three major formats at once
  -v: Increase verbosity level (use -vv or more for greater effect)
  -d: Increase debugging level (use -dd or more for greater effect)
  --reason: Display the reason a port is in a particular state
  --open: Only show open (or possibly open) ports
  --packet-trace: Show all packets sent and received
  --iflist: Print host interfaces and routes (for debugging)
  --append-output: Append to rather than clobber specified output files
  --resume <filename>: Resume an aborted scan
  --stylesheet <path/URL>: XSL stylesheet to transform 

XML output to HTML
  --webxml: Reference stylesheet from Nmap.Org for more portable XML
  --no-stylesheet: Prevent associating of XSL stylesheet w/XML output

MISC:
  -6: Enable IPv6 scanning
  -A: Enable OS detection, version detection, script scanning, and traceroute
  --datadir <dirname>: Specify custom Nmap data file location
  --send-eth/--send-ip: Send using raw ethernet frames or IP packets
  --privileged: Assume that the user is fully privileged
  --unprivileged: Assume the user lacks raw socket privileges
  -V: Print version number
  -h: Print this help summary page.

EXAMPLES:
  nmap -v -A scanme.nmap.org
  nmap -v -sn 192.168.0.0/16 10.0.0.0/8
  nmap -v -iR 10000 -Pn -p 80

SEE THE MAN PAGE (https://nmap.org/book/man.html) FOR MORE OPTIONS AND EXAMPLES

 

 

 

 

 

 

 

 

所以曾有『八腳章魚』『強力膠』之稱的 python 也可能『古義』『不傳』的吧！！也許一篇早年的文章《 Glue It All Together With Python 》

Glue It All Together With Python

Guido van Rossum
CNRI
1895 Preston White Drive
Reston, VA 20191
Email: guido@cnri.reston.va.us, guido@python.orgPosition paper for the OMG-DARPA-MCC Workshop on Compositional Software Architecture in Monterey, California, January 6-8, 1998.

Introduction

Python is an advanced scripting language that is being used successfully to glue together large software components. It spans multiple platforms, middleware products, and application domains. Python is an object-oriented language with high-level data structures, dynamic typing, and dynamic binding. Python has been around since 1991, and has a very active user community. For more information, see the Python website http://www.python.org.

Like Tcl, Python is easily extensible with C/C++/Java code, and easily embeddable in applications. Python even uses Tk, the Tcl GUI toolkit, for a de-facto standard portable GUI toolkit. Unlike Tcl, however, Python supports object-oriented programming. Python programmers can create classes, use multiple inheritance, define methods, overload operators, and so on.

……

現今讀來反倒新鮮有趣，真的有此一說的嘛！！所以『走馬看花』就是走過『人』走的『道路』！也許沒有什麼『另闢蹊徑』之事？宛如『偶或』發生於『歷史記載』之事。實在說︰

於理所必然，當推而可知。

這『偶然』卻正是『冠冕』，人可得之於『神明』之『契機』的哩 ！！

因此，若有人瀏覽、詳讀、略讀《 The Python Standard Library 》三遍以上，且於其『名目』如數家珍者，必許進入『派生殿堂』，方可傳其 Python 『心法』。

─── 《《派生》 PYTHON 作坊【丁】陽燧月鑑》

 

如何掌握 nmap 工具呢？

何不跟著原作者 Gordon “Fyodor” Lyon 學習也！

 

全書至少略讀一遍，然後詳讀

3. Host Discovery (“Ping Scanning”)

4. Port Scanning Overview

5. Port Scanning Techniques and Algorithms

這幾篇章。

再將參考指南擺在身旁︰

動手下去玩呦☆

root@kali:~# nmap -v scanme.nmap.org
Starting Nmap 7.70 ( https://nmap.org ) at 2018-10-21 09:07 UTC
Initiating Ping Scan at 09:07
Scanning scanme.nmap.org (45.33.32.156) [4 ports]
Completed Ping Scan at 09:07, 0.24s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 09:07
Completed Parallel DNS resolution of 1 host. at 09:07, 0.00s elapsed
Initiating SYN Stealth Scan at 09:07
Scanning scanme.nmap.org (45.33.32.156) [1000 ports]
Discovered open port 80/tcp on 45.33.32.156
Discovered open port 22/tcp on 45.33.32.156
Discovered open port 9929/tcp on 45.33.32.156
Discovered open port 31337/tcp on 45.33.32.156
Completed SYN Stealth Scan at 09:07, 3.20s elapsed (1000 total ports)
Nmap scan report for scanme.nmap.org (45.33.32.156)
Host is up (0.14s latency).
Other addresses for scanme.nmap.org (not scanned): 2600:3c01::f03c:91ff:fe18:bb2f
Not shown: 995 closed ports
PORT      STATE    SERVICE
22/tcp    open     ssh
80/tcp    open     http
139/tcp   filtered netbios-ssn
9929/tcp  open     nping-echo
31337/tcp open     Elite

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 4.22 seconds
           Raw packets sent: 1005 (44.196KB) | Rcvd: 1000 (40.016KB)

 

勇猛精進者，自可依循派生古意︰

python-nmap : nmap from python

About

python-nmap is a python library which helps in using nmap port scanner. It allows to easilly manipulate nmap scan results and will be a perfect tool for systems administrators who want to automatize scanning task and reports. It also supports nmap script outputs.

It can even be used asynchronously. Results are returned one host at a time to a callback function defined by the user.

 

將 nmap 『自動化』哩◎

root@kali:~# python
Python 2.7.15+ (default, Aug 31 2018, 11:56:52) 
[GCC 8.2.0] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import nmap
>>> nm = nmap.PortScanner()
>>> nm.scan('127.0.0.1', '22-443')
{'nmap': {'scanstats': {'uphosts': '1', 'timestr': 'Sun Oct 21 08:27:05 2018', 'downhosts': '0', 'totalhosts': '1', 'elapsed': '2.92'}, 'scaninfo': {'tcp': {'services': '22-443', 'method': 'syn'}}, 'command_line': 'nmap -oX - -p 22-443 -sV 127.0.0.1'}, 'scan': {'127.0.0.1': {'status': {'state': 'up', 'reason': 'localhost-response'}, 'hostnames': [{'type': 'PTR', 'name': 'kali'}], 'vendor': {}, 'addresses': {'ipv4': '127.0.0.1'}, 'tcp': {22: {'product': 'OpenSSH', 'state': 'open', 'version': '7.8p1 Debian 1', 'name': 'ssh', 'conf': '10', 'extrainfo': 'protocol 2.0', 'reason': 'syn-ack', 'cpe': 'cpe:/o:linux:linux_kernel'}}}}}
>>> nm.command_line()
'nmap -oX - -p 22-443 -sV 127.0.0.1'
>>> nm.scaninfo()
{'tcp': {'services': '22-443', 'method': 'syn'}}
>>> nm.all_hosts()
['127.0.0.1']
>>> nm['127.0.0.1'].hostname()
'kali'
>>> nm['127.0.0.1'].state()
'up'
>>> nm['127.0.0.1'].all_protocols()
['tcp']
>>> nm['127.0.0.1']['tcp'].keys()
[22]
>>> nm['127.0.0.1'].has_tcp(22)
True
>>> nm['127.0.0.1'].has_tcp(23)
False
>>> nm['127.0.0.1']['tcp'][22]
{'product': 'OpenSSH', 'state': 'open', 'version': '7.8p1 Debian 1', 'name': 'ssh', 'conf': '10', 'extrainfo': 'protocol 2.0', 'reason': 'syn-ack', 'cpe': 'cpe:/o:linux:linux_kernel'}
>>> nm['127.0.0.1'].tcp(22)
{'product': 'OpenSSH', 'state': 'open', 'version': '7.8p1 Debian 1', 'name': 'ssh', 'conf': '10', 'extrainfo': 'protocol 2.0', 'reason': 'syn-ack', 'cpe': 'cpe:/o:linux:linux_kernel'}
>>> nm['127.0.0.1']['tcp'][22]['state']
'open'
>>> print(nm.csv())
host;hostname;hostname_type;protocol;port;name;state;product;extrainfo;reason;version;conf;cpe
127.0.0.1;kali;PTR;tcp;22;ssh;open;OpenSSH;protocol 2.0;syn-ack;7.8p1 Debian 1;10;cpe:/o:linux:linux_kernel

>>> 

 

 

 

 

 

 

 

《三十六計》南北朝‧檀道濟

《瞞天過海》

備周則意怠；常見則不疑。陰在陽之內，不在陰之外。太陽，太陰 。

唐太宗貞觀十七年，太宗領軍三十萬東征，太宗會暈船，薛仁貴怕皇上不敢過海而退兵，故假扮為一豪民，拜見唐太宗，邀請太宗文武百官到他家作客，豪民家飾以繡幔彩錦，環繞於室，好不漂亮，太宗與百官遂於豪民家飲酒作樂。不久，房室搖晃，杯酒落地，太宗等人驚嚇，揭開繡幔彩錦，發現他與三十萬大軍已在海上。古時皇帝自稱天子，故瞞「天」過海的天，指的是皇帝，此計遂稱為瞞天過海。

兵法講究『陰陽』，伺候打探『消息』，事件給予『情報』。常見則『發生頻率』高，因太普通故不生疑，認為少有『資訊價值』也 ！若說有人能從此處建立『資訊理論』，當真是『資訊 bit 』比特值極高的乎？

克勞德·夏農

克勞德·艾爾伍德·夏農（Claude Elwood Shannon，1916年4月30日－2001年2月26日），美國數學家、電子工程師和密碼學家，被譽為資訊理論的創始人。^[1][2]夏農是密西根大學學士，麻省理工學院博士。

1948年，夏農發表了劃時代的論文——通訊的數學原理，奠定了現代資訊理論的基礎。不僅如此，夏農還被認為是數位計算機理論和數位電路設計理論的創始人。1937年，21歲的夏農是麻省理工學院的碩士研究生，他在其碩士論文中提出，將布爾代數應用於電子領域，能夠構建並解決任何邏輯和數值關係，被譽為有史以來最具水平的碩士論文之一^[3]。二戰期間，夏農為軍事領域的密分碼析——密碼破譯和保密通訊——做出了很大貢獻。

───

無奈這把『資訊尺』用了許多 丈二金剛摸不着頭的『術語』───傳輸器、通道、接收器、雜訊源、熵、期望值、機率、資訊內容… ，維基百科詞條讀來宛若『天書』耶？？

Entropy (information theory)

In information theory, systems are modeled by a transmitter, channel, and receiver. The transmitter produces messages that are sent through the channel. The channel modifies the message in some way. The receiver attempts to infer which message was sent. In this context, entropy (more specifically, Shannon entropy) is the expected value (average) of the information contained in each message. ‘Messages’ can be modeled by any flow of information.

In a more technical sense, there are reasons (explained below) to define information as the negative of the logarithm of the probability distribution. The probability distribution of the events, coupled with the information amount of every event, forms a random variable whose expected value is the average amount of information, or entropy, generated by this distribution. Units of entropy are the shannon, nat, or hartley, depending on the base of the logarithm used to define it, though the shannon is commonly referred to as a bit.

The logarithm of the probability distribution is useful as a measure of entropy because it is additive for independent sources. For instance, the entropy of a coin toss is 1 shannon, whereas of m tosses it is m shannons. Generally, you need log₂(n) bits to represent a variable that can take one of n values if n is a power of 2. If these values are equally probable, the entropy (in shannons) is equal to the number of bits. Equality between number of bits and shannons holds only while all outcomes are equally probable. If one of the events is more probable than others, observation of that event is less informative. Conversely, rarer events provide more information when observed. Since observation of less probable events occurs more rarely, the net effect is that the entropy (thought of as average information) received from non-uniformly distributed data is less than log₂(n). Entropy is zero when one outcome is certain. Shannon entropy quantifies all these considerations exactly when a probability distribution of the source is known. The meaning of the events observed (the meaning of messages) does not matter in the definition of entropy. Entropy only takes into account the probability of observing a specific event, so the information it encapsulates is information about the underlying probability distribution, not the meaning of the events themselves.

Generally, entropy refers to disorder or uncertainty. Shannon entropy was introduced by Claude E. Shannon in his 1948 paper “A Mathematical Theory of Communication“.^[1] Shannon entropy provides an absolute limit on the best possible average length of lossless encoding or compression of an information source. Rényi entropy generalizes Shannon entropy.

Definition

Named after Boltzmann’s Η-theorem, Shannon defined the entropy Η (Greek letter Eta) of a discrete random variable X with possible values {x₁, …, x_n} and probability mass function P(X) as:

Here E is the expected value operator, and I is the information content of X.^[4][5] I(X) is itself a random variable.

The entropy can explicitly be written as

where b is the base of the logarithm used. Common values of b are 2, Euler’s number e, and 10, and the unit of entropy is shannon for b = 2, nat for b = e, and hartley for b = 10.^[6] When b = 2, the units of entropy are also commonly referred to as bits.

In the case of p(x_i) = 0 for some i, the value of the corresponding summand 0 log_b(0) is taken to be 0, which is consistent with the limit:

When the distribution is continuous rather than discrete, the sum is replaced with an integral as

where P(x) represents a probability density function.

One may also define the conditional entropy of two events X and Y taking values x_i and y_j respectively, as

where p(x_i, y_j) is the probability that X = x_i and Y = y_j. This quantity should be understood as the amount of randomness in the random variable X given the event Y.

─── 《W!O+ 的《小伶鼬工坊演義》︰神經網絡【學而堯曰】六》

 

藉由『輸入』引發『輸出』回復之『特徵』分析，

Nmap

Nmap (Network Mapper) is a free and open-source security scanner, originally written by Gordon Lyon (also known by his pseudonym Fyodor Vaskovich),^[2] used to discover hosts and services on a computer network, thus building a “map” of the network. To accomplish its goal, Nmap sends specially crafted packets to the target host(s) and then analyzes the responses.

The software provides a number of features for probing computer networks, including host discovery and service and operating-system detection. These features are extensible by scripts that provide more advanced service detection,^[3] vulnerability detection,^[3] and other features. Nmap can adapt to network conditions including latency and congestion during a scan. The Nmap user community continues to develop and refine the tool.

Nmap started as a Linux-only utility,^[4] but porting to Windows, Solaris, HP-UX, BSD variants (including macOS), AmigaOS, and IRIX have followed.^[5] Linux is the most popular platform, followed closely by Windows.^[6]

Features

Nmap features include:

• Host discovery – Identifying hosts on a network. For example, listing the hosts that respond to TCP and/or ICMP requests or have a particular port open.
• Port scanning – Enumerating the open ports on target hosts.
• Version detection – Interrogating network services on remote devices to determine application name and version number.^[7]
• OS detection – Determining the operating system and hardware characteristics of network devices.
• Scriptable interaction with the target – using Nmap Scripting Engine^[8] (NSE) and Lua programming language.

Nmap can provide further information on targets, including reverse DNS names, device types, and MAC addresses.^[9]

Typical uses of Nmap:

• Auditing the security of a device or firewall by identifying the network connections which can be made to, or through it.^[10]
• Identifying open ports on a target host in preparation for auditing.^[11]
• Network inventory, network mapping, maintenance and asset management.
• Auditing the security of a network by identifying new servers.^[12]
• Generating traffic to hosts on a network, response analysis and response time measurement.^[13]
• Finding and exploiting vulnerabilities in a network.^[14]
• DNS queries and subdomain search

………

 

打響了網路管理員必備軟件的名號︰

Nmap 核心功能

主機發現

用於發現目標主機是否處於活動狀態。
Nmap 提供了多種檢測機制，可以更有效地辨識主機。例如可用來列舉目標網路中哪些主機已經開啟，類似於Ping命令的功能。

埠掃描

用於掃描主機上的埠狀態。
Nmap可以將埠辨識為開放（Open）、關閉（Closed）、過濾（Filtered）、未過濾（Unfiltered）、開放或過濾（Open|Filtered）、關閉或過濾（Closed|Filtered）。預設情況下，Nmap會掃描1660個常用的埠^[1]，可以覆蓋大多數基本應用情況。

版本偵測

用於辨識埠上執行的應用程式與程式版本。
Nmap目前可以辨識數千種應用的簽章（Signatures）,檢測數百種應用協定。而對於不辨識的應用，Nmap預設會將應用的指紋(Fingerprint)列印出來，如果用戶確知該應用程式，那麼用戶可以將資訊提交到社群，為社群做貢獻。

作業系統偵測

用於辨識目標主機的作業系統類型、版本編號及裝置類型。
Nmap目前提供1500個作業系統或裝置的指紋資料庫^[2]，可以辨識通用PC系統、路由器、交換機等裝置類型。

防火牆/IDS規避和哄騙

Nmap提供多種機制來規避防火牆、IDS的的封鎖和檢查，便於秘密地探查目標主機的狀況。
基本的規避方式包括：分片、IP誘騙、IP偽裝、MAC位址偽裝。

NSE指令碼引擎

NSE是Nmap最強大最靈活的特性之一，可以用於增強主機發現、埠掃描、版本偵測和作業系統偵測等功能，還可以用來擴充進階的功能如web掃描、漏洞發現和漏洞利用等。Nmap使用Lua語言來作為NSE手稿語言，目前的Nmap指令碼庫已經支援350多個指令碼。

───

 

更是駭客愛用的工具也。

將之對著 OpenWrt 3B 『路由器』作次『掃描』 scan ︰

※ zenmap

apt-get install zenmap

 

不知多少『敏感資訊』暴露眼前︰

root@kali:~# nmap -A -T4 5.168.168.20
Starting Nmap 7.70 ( https://nmap.org ) at 2018-10-20 09:22 UTC
Nmap scan report for 5.168.168.20
Host is up (0.00048s latency).
Not shown: 998 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     Dropbear sshd (protocol 2.0)
80/tcp open  http    LuCI Lua http config
|_http-title: Site doesn't have a title (text/html).
MAC Address: B8:27:EB:D9:D7:2F (Raspberry Pi Foundation)
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.70%E=4%D=10/20%OT=22%CT=1%CU=34614%PV=N%DS=1%DC=D%G=Y%M=B827EB%
OS:TM=5BCAF44B%P=arm-unknown-linux-gnueabihf)SEQ(SP=101%GCD=1%ISR=10F%TI=Z%
OS:CI=Z%II=I%TS=7)OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4
OS:ST11NW7%O5=M5B4ST11NW7%O6=M5B4ST11)WIN(W1=7120%W2=7120%W3=7120%W4=7120%W
OS:5=7120%W6=7120)ECN(R=Y%DF=Y%T=40%W=7210%O=M5B4NNSNW7%CC=N%Q=)T1(R=Y%DF=Y
OS:%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F
OS:=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%
OS:T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=N)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIP
OS:L=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)

Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.48 ms 5.168.168.20

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 94.15 seconds

 

就從聽個故事開始吧◎

Nmap Network Scanning

Nmap Overview and Demonstration

Chapter 1. Getting Started with Nmap

Sometimes the best way to understand something is to see it in action. This section includes examples of Nmap used in (mostly) fictional yet typical circumstances. Nmap newbies should not expect to understand everything at once. This is simply a broad overview of features that are described in depth in later chapters. The “solutions” included throughout this book demonstrate many other common Nmap tasks for security auditors and network administrators.

………