跳到主要内容

常用命令

· 阅读需 2 分钟

主机发现​

arp-scan​

arp-scan -l

netdiscover​

指定网段扫描

netdiscover -r 192.168.56.0/24

指定网卡扫描

netdiscover -i eth0 -r 192.168.56.0/24

TCP的全端口扫描​

nmap -sT --min-rate 10000 -p- 192.168.56.122

详细扫描端口​

nmap -sT -sV -sC -O -p21,22,80 192.168.56.122

FTP匿名登录​

ftp 192.168.56.122
anonymous

SSH登录​

爆破

hydra -l renu -P /usr/share/seclists/Passwords/2023-200_most_used_passwords.txt ssh://192.168.56.120
ssh w1r3s@192.168.56.127 -i id_rsa

目录扫描​

gobuster​

gobuster dir -u http://192.168.56.122/ -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -x php,html

dirsearch​

dirsearch -u http://192.168.56.101 -w zidian.txt -e php

dirb​

dirb http://192.168.56.100 /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt

feroxbuster​

feroxbuster --scan-limit 2 -t 1 --filter-status 404 -u http://192.168.56.108

字典​

kali linux中自带的一些字典

/usr/share/wordlists/dirbuster/directory-list-2.3-*.txt
/usr/share/wordlists/dirbuster/directory-list-1.0.txt
/usr/share/wordlists/dirb/big.txt
/usr/share/wordlists/dirb/common.txt
/usr/share/wordlists/dirb/small.txt
/usr/share/wordlists/dirb/extensions_common.txt

还有secLists的字典

apt install secLists
/usr/share/seclists/

提权​

寻找特殊程序能力​

getcap -r / 2>/dev/null

find查找suid权限的文件​

find / -type f -perm -4000 2>/dev/null
find / -perm -u=s -type f 2>/dev/null

sudo​

sudo -l

定时任务​

cat /etc/crontab

内核​

uname -a

可写文件​

find / -writable 2>/dev/null