{"id":269,"date":"2022-10-03T12:13:25","date_gmt":"2022-10-03T04:13:25","guid":{"rendered":"https:\/\/www.yuyiares.com\/?p=269"},"modified":"2022-10-03T12:24:21","modified_gmt":"2022-10-03T04:24:21","slug":"ceh-v11-module3-scanning-networks","status":"publish","type":"post","link":"https:\/\/www.yuyiares.com\/?p=269","title":{"rendered":"CEH v11 module3 – Scanning Networks"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

0x01 Networking<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
  • Check for <\/span>live systems<\/span><\/strong><\/li>
  • Check for <\/span>open ports<\/span><\/strong><\/li>
  • Discover <\/span>operating system<\/span><\/strong><\/li>
  • Discover <\/span>system architecture<\/span><\/strong><\/li>
  • Discover <\/span>service<\/span><\/strong><\/li>
  • dicover <\/span>vulnerabilities<\/span><\/strong><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    0x02 - TCP Communication Flags<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t
    0x02 - A TCP flag<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t
    • SYN<\/span>
      • \u5fc5\u8981\u7684flag<\/span><\/li>
      • \u901a\u77e5\u50b3\u8f38\u4e00\u500b\u65b0\u7684\u5e8f\u5217\u865f<\/span><\/li>
      • \u8a72\u6a19\u8a8c\u4e00\u822c\u4ee3\u8868\u5169\u53f0\u4e3b\u6a5f\u4e4b\u9593\u5efa\u7acb\u9023\u63a5<\/span><\/li><\/ul><\/li>
      • ACK<\/span>
        • \u5fc5\u8981\u7684flag<\/span><\/li>
        • \u78ba\u8a8d\u63a5\u6536\u5230\u50b3\u8f38\u4e26\u8b58\u5225\u4e0b\u4e00\u500b\u9810\u671f\u7684\u5e8f\u5217\u865f\u3002<\/span><\/li>
        • \u7576\u7cfb\u7d71\u6210\u529f\u63a5\u6536\u5230\u4e00\u500b\u6578\u64da\u5305\u6642\uff0c\u5b83\u6703\u5c07\u5176\u6a19\u8a8c\u7684\u503c\u8a2d\u7f6e\u70ba\u201c1\u201d\uff0c\u5f9e\u800c\u6697\u793a\u63a5\u6536\u8005\u61c9\u8a72\u6ce8\u610f\u5b83\u3002<\/span><\/li><\/ul><\/li>
        • PSH (\u63d2\u968a\u7528)<\/span>
          • \u7576\u8a2d\u7f6e\u70ba\u201c1\u201d\u6642\uff0c\u8868\u793a\u767c\u9001\u65b9\u5df2\u7d93\u5411\u63a5\u6536\u65b9\u767c\u8d77\u4e86\u63a8\u9001\u64cd\u4f5c\uff1b\u9019\u610f\u5473\u8457\u9060\u7a0b\u7cfb\u7d71\u61c9\u901a\u77e5\u63a5\u6536\u61c9\u7528\u7a0b\u5e8f\u6709\u95dc\u4f86\u81ea\u767c\u9001\u65b9\u7684\u7de9\u885d\u6578\u64da\u3002<\/span><\/li>
          • \u7cfb\u7d71\u5728\u6578\u64da\u50b3\u8f38\u7684\u958b\u59cb\u548c\u7d50\u675f\u6642\u7522\u751f PSH \u6a19\u8a8c\uff0c\u4e26\u5c07\u5176\u8a2d\u7f6e\u5728\u6587\u4ef6\u7684\u6700\u5f8c\u4e00\u6bb5\u4ee5\u9632\u6b62\u7de9\u885d\u5340\u6b7b\u9396\u3002<\/span><\/li><\/ul><\/li>
          • URG (\u63d2\u968a\u7528)<\/span>
            • \u5b83\u6307\u793a\u7cfb\u7d71\u76e1\u5feb\u8655\u7406\u6578\u64da\u5305\u4e2d\u5305\u542b\u7684\u6578\u64da\u3002<\/span><\/li>
            • \u7576\u7cfb\u7d71\u5c07\u8a72\u6a19\u8a8c\u8a2d\u7f6e\u70ba\u201c1\u201d\u6642\uff0c\u512a\u5148\u8655\u7406\u7dca\u6025\u6578\u64da\uff0c\u4e26\u505c\u6b62\u6240\u6709\u5176\u4ed6\u6578\u64da\u8655\u7406\u3002<\/span><\/li><\/ul><\/li>
            • FIN<\/span>
              • \u5fc5\u8981\u7684flag<\/span><\/li>
              • \u8a2d\u7f6e\u70ba\u201c1\u201d\u8868\u793a\u4e0d\u518d\u5411\u9060\u7a0b\u7cfb\u7d71\u767c\u9001\u50b3\u8f38\uff0c\u4e26\u4e14\u7531 SYN \u6a19\u8a8c\u5efa\u7acb\u7684\u9023\u63a5\u7d42\u6b62\u3002<\/span><\/li><\/ul><\/li>
              • RST<\/span>
                • \u5fc5\u8981\u7684flag<\/span><\/li>
                • \u524d\u9023\u63a5\u51fa\u73fe\u932f\u8aa4\u6642\uff0c\u8a72\u6a19\u8a8c\u8a2d\u7f6e\u70ba\u201c1\u201d\uff0c\u9023\u63a5\u88ab\u4e2d\u6b62\u4ee5\u97ff\u61c9\u932f\u8aa4\u3002<\/span><\/li><\/ul><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                  \n\t\t\t\t
                  \n\t\t\t\t\t
                  0x02 - B TCP Communication<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                  \n\t\t\t\t
                  \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                  \n\t\t\t\t
                  \n\t\t\t\t\t\t\t\t\t
                  • \u958b\u59cb\u50b3\u9001
                    1. \u9996\u5148\uff0cclient\u5148\u5411server\u767c\u9001\u4e00\u500bSYN<\/span><\/li>
                    2. server\u6536\u5230SYN\u5f8c\u8981\u56de\u5fa9\u4e00\u500bSYN+ACK\u56de\u53bb<\/span><\/li>
                    3. client\u5c31\u6703\u5728\u767c\u9001\u4e00\u500bACK\u904e\u53bb\u5c31\u8868\u793a\u958b\u59cb\u901a\u4fe1\u50b3\u8f38\u4e86<\/span><\/li><\/ol><\/li><\/ul>
                      • \u00a0<\/li>
                      • \u6a94\u6848\u50b3\u8f38\u5b8c\u7562(\u9700\u901a\u77e5\u7d50\u675f)
                        1. \u9996\u5148client\u5148\u5411server\u7aef\u65b9\u9001\u4e00\u500bFIN<\/span><\/li>
                        2. server\u6536\u5230\u5f8c\u56de\u8986\u4e00\u500bACK\u904e\u53bb\u8868\u793a\u6536\u5230FIN<\/span><\/li>
                        3. server\u7acb\u523b\u5728\u56de\u8986\u4e00\u500bFIN\u544a\u8a34client\u6211\u4e5f\u6e96\u5099\u597d\u7d50\u675f\u4e86<\/span><\/li>
                        4. client\u518d\u56de\u5fa9\u4e00\u500bACK\u8868\u793a\u6536\u5230 \u9019\u6a23\u5c31\u5b8c\u6210\u96d9\u65b9\u65b7\u7dda\u6d41\u7a0b<\/span><\/li><\/ol><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                          \n\t\t\t\t
                          \n\t\t\t\t\t

                          0x03- Important ICMP codes<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                          \n\t\t\t\t
                          \n\t\t\t\t\t\t\t\t\t
                          • 0: Echo Reply<\/span>
                            • Answer to a Type 8 Echo Request<\/span><\/li><\/ul><\/li>
                            • 3<\/span>
                              • Destination Unreachable<\/span><\/li><\/ul><\/li>
                              • 5 Redirect<\/span>
                                • Sent when there are two or more gateways available for the sender to use. Followed by these codes:<\/span>
                                  • 0 – Redirect datagram for the network<\/span><\/li>
                                  • 1 – Redirect datagram for the host<\/span><\/li><\/ul><\/li><\/ul><\/li>
                                  • 8<\/span>
                                    • Echo Request<\/span><\/li><\/ul><\/li>
                                    • 11<\/span>
                                      • Time Exceeded<\/span><\/li><\/ul><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                        \n\t\t\t\t
                                        \n\t\t\t\t\t

                                        0x04- hping<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                        \n\t\t\t\t
                                        \n\t\t\t\t\t\t\t\t\t
                                        • — flooding \u760b\u72c2\u767c\u9001\u5c01\u5305(\u6d2a\u6c34\u653b\u64ca)
                                          <\/code><\/li>
                                        • -a <\/code> \u5047\u4f86\u6e90<\/span><\/li>
                                        • -c<\/code> count<\/span><\/li>
                                        • -F<\/code> FIN scan<\/span><\/li>
                                        • -P<\/code> PUSH scan<\/span><\/li>
                                        • -U <\/code> URG scan<\/span><\/li>
                                        • --rand-dest<\/code> random destionation address mode<\/span><\/li>
                                        • -I <interface><\/code> network interface name<\/span><\/li>
                                        • hping3 -s 192.168.1.1 -a 192.168.1.254 -p 22 --flood<\/code><\/li>
                                        • -1<\/code> Sets ICMP mode<\/span><\/li>
                                        • -2<\/code> Sets UDP mode<\/span><\/li>
                                        • -8<\/code> Sets scan mode. Expects port range without -p flag<\/span><\/li>
                                        • -9<\/code> Listen mode. Expects signature (e.g. HTTP) and interface (-I eth0)<\/span>
                                          \u2013flood Sends packets as fast as possible without showing incoming replies<\/span><\/li>
                                        • -Q<\/code> Collects sequence numbers generated by the host<\/span><\/li>
                                        • -p<\/code> Sets port number<\/span><\/li>
                                        • -F<\/code> Sets the FIN flag<\/span><\/li>
                                        • -S<\/code> Sets the SYN flag<\/span><\/li>
                                        • -R<\/code> Sets the RST flag<\/span><\/li>
                                        • -P<\/code> Sets the PSH flag<\/span><\/li>
                                        • -A<\/code> Sets the ACK flag<\/span><\/li>
                                        • -U<\/code> Sets the URG flag<\/span><\/li>
                                        • -X<\/code> Sets the XMAS scan flags<\/span><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                          \n\t\t\t\t
                                          \n\t\t\t\t\t

                                          0x05- nmap<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                          \n\t\t\t\t
                                          \n\t\t\t\t\t
                                          0x05 - A nmap \u6307\u4ee4<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                          \n\t\t\t\t
                                          \n\t\t\t\t\t\t\t\t\t
                                          • -sn<\/code> \u78ba\u8a8d\u662f\u5426\u5b58\u5728\u8a2d\u5099<\/span><\/li>
                                          • -PE<\/code> ping scan<\/span><\/li>
                                          • -PR<\/code> ARP scan<\/span><\/li>
                                          • -PU<\/code> UDP Ping Scan<\/span><\/li>
                                          • -sA<\/code> ACK scan<\/span><\/li>
                                          • -sF<\/code> FIN scan<\/span><\/li>
                                          • -sI<\/code> IDLE scan<\/span><\/li>
                                          • -sL<\/code> DNS scan (list scan)<\/span><\/li>
                                          • -sN<\/code> NULL scan<\/span><\/li>
                                          • -sO<\/code> Protocol scan (tests which IP protocols respond)<\/span><\/li>
                                          • -sP<\/code> or <\/span>-sn<\/code> Ping scan<\/span><\/li>
                                          • -sR<\/code> RPC scan<\/span><\/li>
                                          • -sS<\/code> SYN scan<\/span><\/li>
                                          • -sT<\/code> TCP connect scan<\/span><\/li>
                                          • -sW<\/code> Window scan<\/span><\/li>
                                          • -sX<\/code> XMAS scan<\/span><\/li>
                                          • -A<\/code> OS detection, version detection, script scanning and traceroute<\/span><\/li>
                                          • -sV<\/code> Determine only service\/version info<\/span><\/li>
                                          • -PI<\/code> ICMP ping<\/span><\/li>
                                          • -Pn<\/code> No ping<\/span><\/li>
                                          • -Po<\/code> No ping<\/span><\/li>
                                          • -PS<\/code> SYN ping<\/span><\/li>
                                          • -PT<\/code> TCP ping<\/span><\/li>
                                          • -oN<\/code> Normal output<\/span><\/li>
                                          • -oX<\/code> XML output<\/span><\/li>
                                          • -n<\/code> Never do DNS resolution\/Always resolve<\/span><\/li>
                                          • -f<\/code> –mtu : fragment packets (optionally w\/given MTU)<\/span><\/li>
                                          • -D<\/code> IP address Decoy: <decoy1,decoy2[,ME],\u2026>: Cloak a scan with decoys<\/span><\/li>
                                          • -F<\/code> Fast mode – Scan fewer ports than the default scan<\/span><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                            \n\t\t\t\t
                                            \n\t\t\t\t\t
                                            0x05 - B Stealth Scan<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                            \n\t\t\t\t
                                            \n\t\t\t\t\t\t\t\t\t
                                            • only SYN packets sent. Responses same as full.<\/span>
                                              • Half-open scan<\/span><\/li>
                                              • SYN scan<\/span><\/li><\/ul><\/li>
                                              • Useful for hiding efforts and evading firewalls<\/span><\/li>
                                              • \u6307\u4ee4: nmap -sS <target IP><\/code><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                                \n\t\t\t\t
                                                \n\t\t\t\t\t
                                                0x05 - C Full connect<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                                \n\t\t\t\t
                                                \n\t\t\t\t\t\t\t\t\t
                                                • Full connection and then tears down with RST.<\/span><\/li>
                                                • Easiest to detect, but most reliable (\u6613\u88ab\u767c\u73fe\uff0c\u4f46\u7d50\u679c\u6700\u53ef\u9760)<\/span><\/li>
                                                • \u6307\u4ee4 : nmap -sT <target IP><\/code><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                                  \n\t\t\t\t
                                                  \n\t\t\t\t\t
                                                  0x05 - D TCP ACK scan \/ flag probe - multiple methods<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                                  \n\t\t\t\t
                                                  \n\t\t\t\t\t\t\t\t\t
                                                  • TTL version – if TTL of RST packet < 64, port is open<\/span><\/li>
                                                  • Window version – if the Window on the RST packet is anything other than 0, port open<\/span><\/li>
                                                  • Window version – if the Window on the RST packet is anything other than 0, port open (\u78ba\u8a8d\u662f\u5426\u6709\u9632\u706b\u7246)<\/span><\/li>
                                                  • \u6307\u4ee4 : nmap -sA <target IP><\/code> (ACK scan)<\/span><\/li>
                                                  • \u6307\u4ee4 : nmap -sW <target IP><\/code> (Window scan)<\/span><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                                    \n\t\t\t\t
                                                    \n\t\t\t\t\t
                                                    0x05 - E NULL, FIN and Xmas Scan<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                                    \n\t\t\t\t
                                                    \n\t\t\t\t\t\t\t\t\t
                                                    • \u53ef\u4ee5\u7e5e\u904e\u7121\u72c0\u614b\u9632\u706b\u7246<\/li>
                                                    • Open gives no response. Closed gives RST\/ACK<\/span>
                                                      • \u6307\u4ee4 : nmap -sN <target IP><\/code> (Null scan)<\/span><\/li>
                                                      • \u6307\u4ee4: nmap -sF <target IP><\/code> (FIN scan)<\/span><\/li><\/ul><\/li>
                                                      • Xmas Scan<\/span>
                                                        • Sets the FIN, PSH, and URG flags, lighting the packet up like a Christmas tree.<\/span><\/li>
                                                        • Responses are same as Inverse TCP scan<\/span><\/li>
                                                        • Do not work against Windows machines<\/span><\/li>
                                                        • \u6307\u4ee4 : nmap -sX <target IP><\/code><\/li><\/ul><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                                          \n\t\t\t\t
                                                          \n\t\t\t\t\t
                                                          0x05 - F IDLE Scan<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                                          \n\t\t\t\t
                                                          \n\t\t\t\t\t\t\t\t\t
                                                          • uses a third party to check if a port is open<\/span>
                                                            • \u6307\u4ee4 : nmap -sI <zombie host> <target IP><\/code><\/li><\/ul><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                                              \n\t\t\t\t
                                                              \n\t\t\t\t\t
                                                              0x05 - G Spoofing<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                                              \n\t\t\t\t
                                                              \n\t\t\t\t\t\t\t\t\t
                                                              • Decoy:<\/span>
                                                                • \u6307\u4ee4 : nmap -Pn -D <spoofed IP> <target><\/code><\/li>
                                                                • This will perform a spoofed ping scan.<\/span><\/li><\/ul><\/li>
                                                                • Source Address Spoofing:<\/span>
                                                                  • \u6307\u4ee4 : <\/code>nmap -e <network interface> -S <IP source> <target><\/code><\/li>
                                                                  • \u6307\u4ee4 : <\/code>nmap -e eth0 -S 10.0.0.140 10.0.0.165<\/code><\/li><\/ul><\/li>
                                                                  • MAC Address Spoofing:<\/span>
                                                                    • \u6307\u4ee4 : <\/code>nmap --spoof-mac <MAC|Vendor> <target><\/code><\/li>
                                                                    • Example --> nmap --spoof-mac Cis 10.0.0.140<\/code><\/li><\/ul><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                                                      \n\t\t\t\t
                                                                      \n\t\t\t\t\t
                                                                      0x05 - H Firewall Evasion<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                                                      \n\t\t\t\t
                                                                      \n\t\t\t\t\t\t\t\t\t
                                                                      • Multiple Decoy IP addresses<\/span>
                                                                        • \u6307\u4ee4 :nmap -D RND:<number> <target><\/code><\/li>
                                                                        • \u6307\u4ee4 :nmap -D RND:10 192.168.62.4<\/code><\/li><\/ul><\/li>
                                                                        • IP Fragmentation (\u5c01\u5305\u5207\u5272)<\/span>
                                                                          • \u6307\u4ee4 :nmap -f <target><\/code><\/li><\/ul><\/li>
                                                                          • Maximum Transmission Unit<\/span>
                                                                            • This command is used to transmit smaller packets instead of sending one complete packet at a time.<\/span><\/li>
                                                                            • \u6307\u4ee4 :nmap -mtu 8 <target><\/code>
                                                                              • Maximum Transmission Unit (-mtu) and 8 bytes of packets.<\/span><\/li><\/ul><\/li><\/ul><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                                                                \n\t\t\t\t
                                                                                \n\t\t\t\t\t
                                                                                0x05 - I Timing & Performance<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                                                                \n\t\t\t\t
                                                                                \n\t\t\t\t\t\t\t\t\t
                                                                                • \u6307\u4ee4 :nmap <target> -T0<\/code>
                                                                                  • 1~5<\/span><\/li>
                                                                                  • 3 \u9810\u8a2d<\/span><\/li>
                                                                                  • 5 \u5feb\u901f<\/span><\/li>
                                                                                  • 1 \u8d85\u8a73\u7d30<\/span><\/li><\/ul><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                                                                    \n\t\t\t\t
                                                                                    \n\t\t\t\t\t

                                                                                    0x06 ProxyChains<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                                                                    \n\t\t\t\t
                                                                                    \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                                                                    \n\t\t\t\t
                                                                                    \n\t\t\t\t\t\t\t\t\t
                                                                                    • Support <\/span>SOCKS5<\/span><\/strong>, <\/span>SOCKS4<\/span><\/strong>, and HTTP\/HTTPS<\/strong> CONNECT proxy servers.<\/span><\/li>
                                                                                    • \u4ee3\u7406\u4e0a\u7db2
                                                                                      <\/span><\/li><\/ul>
                                                                                      • \u76f8\u95dc\u5de5\u5177
                                                                                        • Proxy Switcher<\/span><\/li>
                                                                                        • GyberGhost VPN<\/span><\/li>
                                                                                        • Burpsuit<\/span><\/li>
                                                                                        • Tor<\/span><\/li><\/ul><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                                                                          \n\t\t\t\t
                                                                                          \n\t\t\t\t\t

                                                                                          0x07 - scanning tool<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                                                                          \n\t\t\t\t
                                                                                          \n\t\t\t\t\t\t\t\t\t
                                                                                          • Metasploit<\/span><\/li>
                                                                                          • NetScanTools Pro<\/span><\/li>
                                                                                          • Unicornscan<\/span><\/li>
                                                                                          • SolarWinds Port Scaaner<\/span><\/li>
                                                                                          • PRTG Network Monitor<\/span><\/li>
                                                                                          • OmniPeel Network Protocol Analyzer (\u7121\u7dda\u7db2\u8def)<\/span><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

                                                                                            0x01 Networking Check for live systems Check for open ports Discover operating system Discover system architecture Discover service dicover vulnerabilities 0x02 – TCP Communication Flags 0x02 – A TCP flag SYN \u5fc5\u8981\u7684flag \u901a\u77e5\u50b3\u8f38\u4e00\u500b\u65b0\u7684\u5e8f\u5217\u865f \u8a72\u6a19\u8a8c\u4e00\u822c\u4ee3\u8868\u5169\u53f0\u4e3b\u6a5f\u4e4b\u9593\u5efa\u7acb\u9023\u63a5 ACK \u5fc5\u8981\u7684flag \u78ba\u8a8d\u63a5\u6536\u5230\u50b3\u8f38\u4e26\u8b58\u5225\u4e0b\u4e00\u500b\u9810\u671f\u7684\u5e8f\u5217\u865f\u3002 \u7576\u7cfb\u7d71\u6210\u529f\u63a5\u6536\u5230\u4e00\u500b\u6578\u64da\u5305\u6642\uff0c\u5b83\u6703\u5c07\u5176\u6a19\u8a8c\u7684\u503c\u8a2d\u7f6e\u70ba\u201c1\u201d\uff0c\u5f9e\u800c\u6697\u793a\u63a5\u6536\u8005\u61c9\u8a72\u6ce8\u610f\u5b83\u3002 PSH (\u63d2\u968a\u7528) \u7576\u8a2d\u7f6e\u70ba\u201c1\u201d\u6642\uff0c\u8868\u793a\u767c\u9001\u65b9\u5df2\u7d93\u5411\u63a5\u6536\u65b9\u767c\u8d77\u4e86\u63a8\u9001\u64cd\u4f5c\uff1b\u9019\u610f\u5473\u8457\u9060\u7a0b\u7cfb\u7d71\u61c9\u901a\u77e5\u63a5\u6536\u61c9\u7528\u7a0b\u5e8f\u6709\u95dc\u4f86\u81ea\u767c\u9001\u65b9\u7684\u7de9\u885d\u6578\u64da\u3002 \u7cfb\u7d71\u5728\u6578\u64da\u50b3\u8f38\u7684\u958b\u59cb\u548c\u7d50\u675f\u6642\u7522\u751f PSH \u6a19\u8a8c\uff0c\u4e26\u5c07\u5176\u8a2d\u7f6e\u5728\u6587\u4ef6\u7684\u6700\u5f8c\u4e00\u6bb5\u4ee5\u9632\u6b62\u7de9\u885d\u5340\u6b7b\u9396\u3002 URG (\u63d2\u968a\u7528) \u5b83\u6307\u793a\u7cfb\u7d71\u76e1\u5feb\u8655\u7406\u6578\u64da\u5305\u4e2d\u5305\u542b\u7684\u6578\u64da\u3002 \u7576\u7cfb\u7d71\u5c07\u8a72\u6a19\u8a8c\u8a2d\u7f6e\u70ba\u201c1\u201d\u6642\uff0c\u512a\u5148\u8655\u7406\u7dca\u6025\u6578\u64da\uff0c\u4e26\u505c\u6b62\u6240\u6709\u5176\u4ed6\u6578\u64da\u8655\u7406\u3002 FIN \u5fc5\u8981\u7684flag \u8a2d\u7f6e\u70ba\u201c1\u201d\u8868\u793a\u4e0d\u518d\u5411\u9060\u7a0b\u7cfb\u7d71\u767c\u9001\u50b3\u8f38\uff0c\u4e26\u4e14\u7531 SYN \u6a19\u8a8c\u5efa\u7acb\u7684\u9023\u63a5\u7d42\u6b62\u3002 RST \u5fc5\u8981\u7684flag \u524d\u9023\u63a5\u51fa\u73fe\u932f\u8aa4\u6642\uff0c\u8a72\u6a19\u8a8c\u8a2d\u7f6e\u70ba\u201c1\u201d\uff0c\u9023\u63a5\u88ab\u4e2d\u6b62\u4ee5\u97ff\u61c9\u932f\u8aa4\u3002 0x02 – B TCP Communication \u958b\u59cb\u50b3\u9001 \u9996\u5148\uff0cclient\u5148\u5411server\u767c\u9001\u4e00\u500bSYN server\u6536\u5230SYN\u5f8c\u8981\u56de\u5fa9\u4e00\u500bSYN+ACK\u56de\u53bb client\u5c31\u6703\u5728\u767c\u9001\u4e00\u500bACK\u904e\u53bb\u5c31\u8868\u793a\u958b\u59cb\u901a\u4fe1\u50b3\u8f38\u4e86 \u00a0 \u6a94\u6848\u50b3\u8f38\u5b8c\u7562(\u9700\u901a\u77e5\u7d50\u675f) \u9996\u5148client\u5148\u5411server\u7aef\u65b9\u9001\u4e00\u500bFIN server\u6536\u5230\u5f8c\u56de\u8986\u4e00\u500bACK\u904e\u53bb\u8868\u793a\u6536\u5230FIN server\u7acb\u523b\u5728\u56de\u8986\u4e00\u500bFIN\u544a\u8a34client\u6211\u4e5f\u6e96\u5099\u597d\u7d50\u675f\u4e86 client\u518d\u56de\u5fa9\u4e00\u500bACK\u8868\u793a\u6536\u5230 \u9019\u6a23\u5c31\u5b8c\u6210\u96d9\u65b9\u65b7\u7dda\u6d41\u7a0b 0x03- Important ICMP codes 0: Echo Reply Answer to a Type 8 Echo Request 3 Destination Unreachable 5 Redirect Sent when there are two or more gateways available for the sender to use. Followed by these codes: 0 – Redirect datagram for the network 1 – Redirect datagram for the host 8 Echo Request 11 Time Exceeded 0x04- hping — flooding \u760b\u72c2\u767c\u9001\u5c01\u5305(\u6d2a\u6c34\u653b\u64ca) -a \u5047\u4f86\u6e90 -c count -F FIN scan -P PUSH scan -U URG scan –rand-dest random destionation address mode -I <interface> network interface name hping3 -s 192.168.1.1 -a 192.168.1.254 -p 22 –flood -1 Sets ICMP mode -2 Sets UDP mode -8 Sets scan mode. Expects port range without -p flag -9 Listen mode. Expects signature (e.g. HTTP) and interface (-I eth0)\u2013flood Sends packets as fast as possible without showing incoming replies -Q Collects sequence numbers generated by the host -p Sets port number -F Sets the FIN flag -S Sets the SYN flag -R Sets the RST flag -P Sets the PSH flag -A Sets the ACK flag -U Sets the URG flag -X Sets the XMAS scan flags 0x05- nmap 0x05 – A nmap \u6307\u4ee4 -sn \u78ba\u8a8d\u662f\u5426\u5b58\u5728\u8a2d\u5099 -PE ping scan -PR ARP scan -PU UDP Ping Scan -sA ACK scan -sF FIN scan…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[22,5],"tags":[],"class_list":["post-269","post","type-post","status-publish","format-standard","hentry","category-ceh-research-study","category-research-study"],"yoast_head":"\nCEH v11 module3 - Scanning Networks - Ares Vlog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.yuyiares.com\/?p=269\" \/>\n<meta property=\"og:locale\" content=\"zh_TW\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CEH v11 module3 - Scanning Networks - Ares Vlog\" \/>\n<meta property=\"og:description\" content=\"0x01 Networking Check for live systems Check for open ports Discover operating system Discover system architecture Discover service dicover vulnerabilities 0x02 – TCP Communication Flags 0x02 – A TCP flag SYN \u5fc5\u8981\u7684flag \u901a\u77e5\u50b3\u8f38\u4e00\u500b\u65b0\u7684\u5e8f\u5217\u865f \u8a72\u6a19\u8a8c\u4e00\u822c\u4ee3\u8868\u5169\u53f0\u4e3b\u6a5f\u4e4b\u9593\u5efa\u7acb\u9023\u63a5 ACK \u5fc5\u8981\u7684flag \u78ba\u8a8d\u63a5\u6536\u5230\u50b3\u8f38\u4e26\u8b58\u5225\u4e0b\u4e00\u500b\u9810\u671f\u7684\u5e8f\u5217\u865f\u3002 \u7576\u7cfb\u7d71\u6210\u529f\u63a5\u6536\u5230\u4e00\u500b\u6578\u64da\u5305\u6642\uff0c\u5b83\u6703\u5c07\u5176\u6a19\u8a8c\u7684\u503c\u8a2d\u7f6e\u70ba\u201c1\u201d\uff0c\u5f9e\u800c\u6697\u793a\u63a5\u6536\u8005\u61c9\u8a72\u6ce8\u610f\u5b83\u3002 PSH (\u63d2\u968a\u7528) \u7576\u8a2d\u7f6e\u70ba\u201c1\u201d\u6642\uff0c\u8868\u793a\u767c\u9001\u65b9\u5df2\u7d93\u5411\u63a5\u6536\u65b9\u767c\u8d77\u4e86\u63a8\u9001\u64cd\u4f5c\uff1b\u9019\u610f\u5473\u8457\u9060\u7a0b\u7cfb\u7d71\u61c9\u901a\u77e5\u63a5\u6536\u61c9\u7528\u7a0b\u5e8f\u6709\u95dc\u4f86\u81ea\u767c\u9001\u65b9\u7684\u7de9\u885d\u6578\u64da\u3002 \u7cfb\u7d71\u5728\u6578\u64da\u50b3\u8f38\u7684\u958b\u59cb\u548c\u7d50\u675f\u6642\u7522\u751f PSH \u6a19\u8a8c\uff0c\u4e26\u5c07\u5176\u8a2d\u7f6e\u5728\u6587\u4ef6\u7684\u6700\u5f8c\u4e00\u6bb5\u4ee5\u9632\u6b62\u7de9\u885d\u5340\u6b7b\u9396\u3002 URG (\u63d2\u968a\u7528) \u5b83\u6307\u793a\u7cfb\u7d71\u76e1\u5feb\u8655\u7406\u6578\u64da\u5305\u4e2d\u5305\u542b\u7684\u6578\u64da\u3002 \u7576\u7cfb\u7d71\u5c07\u8a72\u6a19\u8a8c\u8a2d\u7f6e\u70ba\u201c1\u201d\u6642\uff0c\u512a\u5148\u8655\u7406\u7dca\u6025\u6578\u64da\uff0c\u4e26\u505c\u6b62\u6240\u6709\u5176\u4ed6\u6578\u64da\u8655\u7406\u3002 FIN \u5fc5\u8981\u7684flag \u8a2d\u7f6e\u70ba\u201c1\u201d\u8868\u793a\u4e0d\u518d\u5411\u9060\u7a0b\u7cfb\u7d71\u767c\u9001\u50b3\u8f38\uff0c\u4e26\u4e14\u7531 SYN \u6a19\u8a8c\u5efa\u7acb\u7684\u9023\u63a5\u7d42\u6b62\u3002 RST \u5fc5\u8981\u7684flag \u524d\u9023\u63a5\u51fa\u73fe\u932f\u8aa4\u6642\uff0c\u8a72\u6a19\u8a8c\u8a2d\u7f6e\u70ba\u201c1\u201d\uff0c\u9023\u63a5\u88ab\u4e2d\u6b62\u4ee5\u97ff\u61c9\u932f\u8aa4\u3002 0x02 – B TCP Communication \u958b\u59cb\u50b3\u9001 \u9996\u5148\uff0cclient\u5148\u5411server\u767c\u9001\u4e00\u500bSYN server\u6536\u5230SYN\u5f8c\u8981\u56de\u5fa9\u4e00\u500bSYN+ACK\u56de\u53bb client\u5c31\u6703\u5728\u767c\u9001\u4e00\u500bACK\u904e\u53bb\u5c31\u8868\u793a\u958b\u59cb\u901a\u4fe1\u50b3\u8f38\u4e86 \u00a0 \u6a94\u6848\u50b3\u8f38\u5b8c\u7562(\u9700\u901a\u77e5\u7d50\u675f) \u9996\u5148client\u5148\u5411server\u7aef\u65b9\u9001\u4e00\u500bFIN server\u6536\u5230\u5f8c\u56de\u8986\u4e00\u500bACK\u904e\u53bb\u8868\u793a\u6536\u5230FIN server\u7acb\u523b\u5728\u56de\u8986\u4e00\u500bFIN\u544a\u8a34client\u6211\u4e5f\u6e96\u5099\u597d\u7d50\u675f\u4e86 client\u518d\u56de\u5fa9\u4e00\u500bACK\u8868\u793a\u6536\u5230 \u9019\u6a23\u5c31\u5b8c\u6210\u96d9\u65b9\u65b7\u7dda\u6d41\u7a0b 0x03- Important ICMP codes 0: Echo Reply Answer to a Type 8 Echo Request 3 Destination Unreachable 5 Redirect Sent when there are two or more gateways available for the sender to use. Followed by these codes: 0 – Redirect datagram for the network 1 – Redirect datagram for the host 8 Echo Request 11 Time Exceeded 0x04- hping — flooding \u760b\u72c2\u767c\u9001\u5c01\u5305(\u6d2a\u6c34\u653b\u64ca) -a \u5047\u4f86\u6e90 -c count -F FIN scan -P PUSH scan -U URG scan --rand-dest random destionation address mode -I <interface> network interface name hping3 -s 192.168.1.1 -a 192.168.1.254 -p 22 --flood -1 Sets ICMP mode -2 Sets UDP mode -8 Sets scan mode. Expects port range without -p flag -9 Listen mode. Expects signature (e.g. HTTP) and interface (-I eth0)\u2013flood Sends packets as fast as possible without showing incoming replies -Q Collects sequence numbers generated by the host -p Sets port number -F Sets the FIN flag -S Sets the SYN flag -R Sets the RST flag -P Sets the PSH flag -A Sets the ACK flag -U Sets the URG flag -X Sets the XMAS scan flags 0x05- nmap 0x05 – A nmap \u6307\u4ee4 -sn \u78ba\u8a8d\u662f\u5426\u5b58\u5728\u8a2d\u5099 -PE ping scan -PR ARP scan -PU UDP Ping Scan -sA ACK scan -sF FIN scan...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.yuyiares.com\/?p=269\" \/>\n<meta property=\"og:site_name\" content=\"Ares Vlog\" \/>\n<meta property=\"article:published_time\" content=\"2022-10-03T04:13:25+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-10-03T04:24:21+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.yuyiares.com\/wp-content\/uploads\/2022\/10\/CEH-Proxy-chains.drawio-1024x763.png\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005:\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9810\u4f30\u95b1\u8b80\u6642\u9593\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 \u5206\u9418\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.yuyiares.com\\\/?p=269#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.yuyiares.com\\\/?p=269\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\\\/\\\/www.yuyiares.com\\\/#\\\/schema\\\/person\\\/3d4db07eab24e08cc9eea662ef3053ac\"},\"headline\":\"CEH v11 module3 – Scanning Networks\",\"datePublished\":\"2022-10-03T04:13:25+00:00\",\"dateModified\":\"2022-10-03T04:24:21+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.yuyiares.com\\\/?p=269\"},\"wordCount\":593,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/www.yuyiares.com\\\/?p=269#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.yuyiares.com\\\/wp-content\\\/uploads\\\/2022\\\/10\\\/CEH-Proxy-chains.drawio-1024x763.png\",\"articleSection\":[\"CEH\",\"Research & Study\"],\"inLanguage\":\"zh-TW\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.yuyiares.com\\\/?p=269#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.yuyiares.com\\\/?p=269\",\"url\":\"https:\\\/\\\/www.yuyiares.com\\\/?p=269\",\"name\":\"CEH v11 module3 - Scanning Networks - Ares Vlog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.yuyiares.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.yuyiares.com\\\/?p=269#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.yuyiares.com\\\/?p=269#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.yuyiares.com\\\/wp-content\\\/uploads\\\/2022\\\/10\\\/CEH-Proxy-chains.drawio-1024x763.png\",\"datePublished\":\"2022-10-03T04:13:25+00:00\",\"dateModified\":\"2022-10-03T04:24:21+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.yuyiares.com\\\/#\\\/schema\\\/person\\\/3d4db07eab24e08cc9eea662ef3053ac\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.yuyiares.com\\\/?p=269#breadcrumb\"},\"inLanguage\":\"zh-TW\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.yuyiares.com\\\/?p=269\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-TW\",\"@id\":\"https:\\\/\\\/www.yuyiares.com\\\/?p=269#primaryimage\",\"url\":\"https:\\\/\\\/www.yuyiares.com\\\/wp-content\\\/uploads\\\/2022\\\/10\\\/CEH-Proxy-chains.drawio.png\",\"contentUrl\":\"https:\\\/\\\/www.yuyiares.com\\\/wp-content\\\/uploads\\\/2022\\\/10\\\/CEH-Proxy-chains.drawio.png\",\"width\":2428,\"height\":1808},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.yuyiares.com\\\/?p=269#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.yuyiares.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CEH v11 module3 – Scanning Networks\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.yuyiares.com\\\/#website\",\"url\":\"https:\\\/\\\/www.yuyiares.com\\\/\",\"name\":\"Ares Vlog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.yuyiares.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"zh-TW\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.yuyiares.com\\\/#\\\/schema\\\/person\\\/3d4db07eab24e08cc9eea662ef3053ac\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-TW\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/7a48eb75ce0e81d088764746bc78b3a75ae3f2fbe40d6f69bbc7cfd2fa004a03?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/7a48eb75ce0e81d088764746bc78b3a75ae3f2fbe40d6f69bbc7cfd2fa004a03?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/7a48eb75ce0e81d088764746bc78b3a75ae3f2fbe40d6f69bbc7cfd2fa004a03?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"https:\\\/\\\/www.yuyiares.com\"],\"url\":\"https:\\\/\\\/www.yuyiares.com\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CEH v11 module3 - Scanning Networks - Ares Vlog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.yuyiares.com\/?p=269","og_locale":"zh_TW","og_type":"article","og_title":"CEH v11 module3 - Scanning Networks - Ares Vlog","og_description":"0x01 Networking Check for live systems Check for open ports Discover operating system Discover system architecture Discover service dicover vulnerabilities 0x02 – TCP Communication Flags 0x02 – A TCP flag SYN \u5fc5\u8981\u7684flag \u901a\u77e5\u50b3\u8f38\u4e00\u500b\u65b0\u7684\u5e8f\u5217\u865f \u8a72\u6a19\u8a8c\u4e00\u822c\u4ee3\u8868\u5169\u53f0\u4e3b\u6a5f\u4e4b\u9593\u5efa\u7acb\u9023\u63a5 ACK \u5fc5\u8981\u7684flag \u78ba\u8a8d\u63a5\u6536\u5230\u50b3\u8f38\u4e26\u8b58\u5225\u4e0b\u4e00\u500b\u9810\u671f\u7684\u5e8f\u5217\u865f\u3002 \u7576\u7cfb\u7d71\u6210\u529f\u63a5\u6536\u5230\u4e00\u500b\u6578\u64da\u5305\u6642\uff0c\u5b83\u6703\u5c07\u5176\u6a19\u8a8c\u7684\u503c\u8a2d\u7f6e\u70ba\u201c1\u201d\uff0c\u5f9e\u800c\u6697\u793a\u63a5\u6536\u8005\u61c9\u8a72\u6ce8\u610f\u5b83\u3002 PSH (\u63d2\u968a\u7528) \u7576\u8a2d\u7f6e\u70ba\u201c1\u201d\u6642\uff0c\u8868\u793a\u767c\u9001\u65b9\u5df2\u7d93\u5411\u63a5\u6536\u65b9\u767c\u8d77\u4e86\u63a8\u9001\u64cd\u4f5c\uff1b\u9019\u610f\u5473\u8457\u9060\u7a0b\u7cfb\u7d71\u61c9\u901a\u77e5\u63a5\u6536\u61c9\u7528\u7a0b\u5e8f\u6709\u95dc\u4f86\u81ea\u767c\u9001\u65b9\u7684\u7de9\u885d\u6578\u64da\u3002 \u7cfb\u7d71\u5728\u6578\u64da\u50b3\u8f38\u7684\u958b\u59cb\u548c\u7d50\u675f\u6642\u7522\u751f PSH \u6a19\u8a8c\uff0c\u4e26\u5c07\u5176\u8a2d\u7f6e\u5728\u6587\u4ef6\u7684\u6700\u5f8c\u4e00\u6bb5\u4ee5\u9632\u6b62\u7de9\u885d\u5340\u6b7b\u9396\u3002 URG (\u63d2\u968a\u7528) \u5b83\u6307\u793a\u7cfb\u7d71\u76e1\u5feb\u8655\u7406\u6578\u64da\u5305\u4e2d\u5305\u542b\u7684\u6578\u64da\u3002 \u7576\u7cfb\u7d71\u5c07\u8a72\u6a19\u8a8c\u8a2d\u7f6e\u70ba\u201c1\u201d\u6642\uff0c\u512a\u5148\u8655\u7406\u7dca\u6025\u6578\u64da\uff0c\u4e26\u505c\u6b62\u6240\u6709\u5176\u4ed6\u6578\u64da\u8655\u7406\u3002 FIN \u5fc5\u8981\u7684flag \u8a2d\u7f6e\u70ba\u201c1\u201d\u8868\u793a\u4e0d\u518d\u5411\u9060\u7a0b\u7cfb\u7d71\u767c\u9001\u50b3\u8f38\uff0c\u4e26\u4e14\u7531 SYN \u6a19\u8a8c\u5efa\u7acb\u7684\u9023\u63a5\u7d42\u6b62\u3002 RST \u5fc5\u8981\u7684flag \u524d\u9023\u63a5\u51fa\u73fe\u932f\u8aa4\u6642\uff0c\u8a72\u6a19\u8a8c\u8a2d\u7f6e\u70ba\u201c1\u201d\uff0c\u9023\u63a5\u88ab\u4e2d\u6b62\u4ee5\u97ff\u61c9\u932f\u8aa4\u3002 0x02 – B TCP Communication \u958b\u59cb\u50b3\u9001 \u9996\u5148\uff0cclient\u5148\u5411server\u767c\u9001\u4e00\u500bSYN server\u6536\u5230SYN\u5f8c\u8981\u56de\u5fa9\u4e00\u500bSYN+ACK\u56de\u53bb client\u5c31\u6703\u5728\u767c\u9001\u4e00\u500bACK\u904e\u53bb\u5c31\u8868\u793a\u958b\u59cb\u901a\u4fe1\u50b3\u8f38\u4e86 \u00a0 \u6a94\u6848\u50b3\u8f38\u5b8c\u7562(\u9700\u901a\u77e5\u7d50\u675f) \u9996\u5148client\u5148\u5411server\u7aef\u65b9\u9001\u4e00\u500bFIN server\u6536\u5230\u5f8c\u56de\u8986\u4e00\u500bACK\u904e\u53bb\u8868\u793a\u6536\u5230FIN server\u7acb\u523b\u5728\u56de\u8986\u4e00\u500bFIN\u544a\u8a34client\u6211\u4e5f\u6e96\u5099\u597d\u7d50\u675f\u4e86 client\u518d\u56de\u5fa9\u4e00\u500bACK\u8868\u793a\u6536\u5230 \u9019\u6a23\u5c31\u5b8c\u6210\u96d9\u65b9\u65b7\u7dda\u6d41\u7a0b 0x03- Important ICMP codes 0: Echo Reply Answer to a Type 8 Echo Request 3 Destination Unreachable 5 Redirect Sent when there are two or more gateways available for the sender to use. Followed by these codes: 0 – Redirect datagram for the network 1 – Redirect datagram for the host 8 Echo Request 11 Time Exceeded 0x04- hping — flooding \u760b\u72c2\u767c\u9001\u5c01\u5305(\u6d2a\u6c34\u653b\u64ca) -a \u5047\u4f86\u6e90 -c count -F FIN scan -P PUSH scan -U URG scan --rand-dest random destionation address mode -I <interface> network interface name hping3 -s 192.168.1.1 -a 192.168.1.254 -p 22 --flood -1 Sets ICMP mode -2 Sets UDP mode -8 Sets scan mode. Expects port range without -p flag -9 Listen mode. Expects signature (e.g. HTTP) and interface (-I eth0)\u2013flood Sends packets as fast as possible without showing incoming replies -Q Collects sequence numbers generated by the host -p Sets port number -F Sets the FIN flag -S Sets the SYN flag -R Sets the RST flag -P Sets the PSH flag -A Sets the ACK flag -U Sets the URG flag -X Sets the XMAS scan flags 0x05- nmap 0x05 – A nmap \u6307\u4ee4 -sn \u78ba\u8a8d\u662f\u5426\u5b58\u5728\u8a2d\u5099 -PE ping scan -PR ARP scan -PU UDP Ping Scan -sA ACK scan -sF FIN scan...","og_url":"https:\/\/www.yuyiares.com\/?p=269","og_site_name":"Ares Vlog","article_published_time":"2022-10-03T04:13:25+00:00","article_modified_time":"2022-10-03T04:24:21+00:00","og_image":[{"url":"https:\/\/www.yuyiares.com\/wp-content\/uploads\/2022\/10\/CEH-Proxy-chains.drawio-1024x763.png","type":"","width":"","height":""}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005:":"admin","\u9810\u4f30\u95b1\u8b80\u6642\u9593":"5 \u5206\u9418"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.yuyiares.com\/?p=269#article","isPartOf":{"@id":"https:\/\/www.yuyiares.com\/?p=269"},"author":{"name":"admin","@id":"https:\/\/www.yuyiares.com\/#\/schema\/person\/3d4db07eab24e08cc9eea662ef3053ac"},"headline":"CEH v11 module3 – Scanning Networks","datePublished":"2022-10-03T04:13:25+00:00","dateModified":"2022-10-03T04:24:21+00:00","mainEntityOfPage":{"@id":"https:\/\/www.yuyiares.com\/?p=269"},"wordCount":593,"commentCount":0,"image":{"@id":"https:\/\/www.yuyiares.com\/?p=269#primaryimage"},"thumbnailUrl":"https:\/\/www.yuyiares.com\/wp-content\/uploads\/2022\/10\/CEH-Proxy-chains.drawio-1024x763.png","articleSection":["CEH","Research & Study"],"inLanguage":"zh-TW","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.yuyiares.com\/?p=269#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.yuyiares.com\/?p=269","url":"https:\/\/www.yuyiares.com\/?p=269","name":"CEH v11 module3 - Scanning Networks - Ares Vlog","isPartOf":{"@id":"https:\/\/www.yuyiares.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.yuyiares.com\/?p=269#primaryimage"},"image":{"@id":"https:\/\/www.yuyiares.com\/?p=269#primaryimage"},"thumbnailUrl":"https:\/\/www.yuyiares.com\/wp-content\/uploads\/2022\/10\/CEH-Proxy-chains.drawio-1024x763.png","datePublished":"2022-10-03T04:13:25+00:00","dateModified":"2022-10-03T04:24:21+00:00","author":{"@id":"https:\/\/www.yuyiares.com\/#\/schema\/person\/3d4db07eab24e08cc9eea662ef3053ac"},"breadcrumb":{"@id":"https:\/\/www.yuyiares.com\/?p=269#breadcrumb"},"inLanguage":"zh-TW","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.yuyiares.com\/?p=269"]}]},{"@type":"ImageObject","inLanguage":"zh-TW","@id":"https:\/\/www.yuyiares.com\/?p=269#primaryimage","url":"https:\/\/www.yuyiares.com\/wp-content\/uploads\/2022\/10\/CEH-Proxy-chains.drawio.png","contentUrl":"https:\/\/www.yuyiares.com\/wp-content\/uploads\/2022\/10\/CEH-Proxy-chains.drawio.png","width":2428,"height":1808},{"@type":"BreadcrumbList","@id":"https:\/\/www.yuyiares.com\/?p=269#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.yuyiares.com\/"},{"@type":"ListItem","position":2,"name":"CEH v11 module3 – Scanning Networks"}]},{"@type":"WebSite","@id":"https:\/\/www.yuyiares.com\/#website","url":"https:\/\/www.yuyiares.com\/","name":"Ares Vlog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.yuyiares.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"zh-TW"},{"@type":"Person","@id":"https:\/\/www.yuyiares.com\/#\/schema\/person\/3d4db07eab24e08cc9eea662ef3053ac","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-TW","@id":"https:\/\/secure.gravatar.com\/avatar\/7a48eb75ce0e81d088764746bc78b3a75ae3f2fbe40d6f69bbc7cfd2fa004a03?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/7a48eb75ce0e81d088764746bc78b3a75ae3f2fbe40d6f69bbc7cfd2fa004a03?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/7a48eb75ce0e81d088764746bc78b3a75ae3f2fbe40d6f69bbc7cfd2fa004a03?s=96&d=mm&r=g","caption":"admin"},"sameAs":["https:\/\/www.yuyiares.com"],"url":"https:\/\/www.yuyiares.com\/?author=1"}]}},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.yuyiares.com\/index.php?rest_route=\/wp\/v2\/posts\/269","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.yuyiares.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.yuyiares.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.yuyiares.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.yuyiares.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=269"}],"version-history":[{"count":4,"href":"https:\/\/www.yuyiares.com\/index.php?rest_route=\/wp\/v2\/posts\/269\/revisions"}],"predecessor-version":[{"id":275,"href":"https:\/\/www.yuyiares.com\/index.php?rest_route=\/wp\/v2\/posts\/269\/revisions\/275"}],"wp:attachment":[{"href":"https:\/\/www.yuyiares.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=269"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.yuyiares.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=269"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.yuyiares.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=269"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}