📌  相关文章
📜  Kali Linux信息收集工具

📅  最后修改于: 2021-01-05 04:56:45             🧑  作者: Mango

信息收集工具

”信息收集工具”

Tools Description
ace-voip ACE (Automated Corporate Enumerator) is a powerful tool that mimics the behavior of IP phones to download the name and extension entries. It is developed to automate VoIP attacks that can be targeted against names in an enterprise directory.
Amap It is a tool that identifies applications even if they are running on a different port and also identifies non-ASCII based applications.
APT2 It is the acronym for “Automated Penetration Testing”. It is a tool that performs an NMap or imports the results of a scan from Nexpose, Nessus, or NMap.
arp-scan It is also called as ARP sweep or MAC Scanner. It is a very fast ARP packet scanner that shows every active IPv4 device on your Subnet even if they have firewalls. ARP is non-routable, so it only works on the Local LAN.
Automater It is a URL or Domain, IP Address, and Md5 Hash OSINT analysis tool that eases the analysis process for intrusion Analyst.
bing-ip2hosts It enumerates hostnames for an IP using bing.com. It comes with a feature to search for websites hosted on a specific IP address.
braa It is a mass SNMP scanner able to query dozens or hundreds of hosts simultaneously and in a single process. It is very fast as it consumes few system resources.
CaseFile CaseFile is a limited form of Maltego. It has the same graphic application as Maltego but not has the ability to run the transformation.
CDPSnarf It is a network sniffing tool exclusively written to extract information from CDP (Cisco Discovery Protocol) packets. It also provides the information a “show cdp neighbors detail” command would return on a Cisco router.
cisco-torch It is a Cisco device scanner that extensively uses forking to launch multiple scanning processes on the background for maximum scanning efficiency.
copy-router-config It copies configuration files from Cisco devices running SNMP (Simple Network Management Protocol).
Dmitry It stands for Deepmagic Information Gathering Tool. It is a UNIX/ (GNU) Linux Command Line Application coded in C language. It is able to gather as many details as possible about a host.
Dnmap It is a framework to distribute nmap scans among n number of clients. It always reads an already created file with nmap commands and sends those commands to each client connected to it.
Dnsmap It is used by pen-testers during the information gathering/enumeration phase of infrastructure security assessments to find the target company’s IP netblocks, domain names, phone numbers, etc…
DNSRecon It is a powerful DNS enumeration script that provides the ability to perform- check all NS records for zone transfer, General DNS Record and SRV Record Enumeration, checks Wildcard Resolution, PTR record lookup, etc.
Dnstracer It traces DNS queries to the source and determines whether a given Domain Name Server gets its information from a given hostname.
Dnswalk It is a DNS debugger that performs zone transfers of specified domains and checks the database in many ways for internal consistency and accuracy.
DotDotPwn It is a fuzzer to discover traversal directory vulnerabilities in software such as HTTP/FTP/TFTP servers and Web platforms such as CMSs, ERPs, Blogs, etc.
Enum4Linux It is a tool to enumerate information from Windows and Samba systems.
enumIAX It is an Inter Asterisk Exchange protocol username brute-force enumerator. It operates in two distinct modes- Sequential Username Guessing and Dictionary Attack.
EyeWitness It is a tool to take screenshots of websites, RDP (Remote Desktop) services, and open VNC (Virtual Network Computing) servers. It also provides some server header info and identifies default credentials if possible.
Faraday It introduces IPE (Integrated Penetration-Test Environment), which is a multiuser Penetration test IDE that is designed for distribution, indexing and analysis of the data generated during a security audit. The main purpose if this tool is to re-use the available tools.
Fierce It is a survey tool that is used to locate likely targets both inside and outside a corporate network.
Firewalk It is a network security survey tool that is used to determine what will be passed by the layer 4 protocol (a given IP forwarding device). It works by sending out TCP or UDP packets with a TTL one greater than the targeted gateway.
fragroute It provides a simple rule set language to delay, duplicate, drop, fragment, overlap, print, reorder, segment, source-route, or otherwise hop with all outbound packets destined for a target host with minimal support for random behaviour.
fragrouter It is a network intrusion detection toolkit. It is a one-way fragmenting router, i.e. IP packets get sent from the attackers to the fragrouter, which changes them into a fragmented data stream to forward to the victim.
Ghost Phisher It is a GUI suit for phishing and penetration attacks. Or a wireless and Ethernet security auditing and attack software program to emulate and deploy access points.
GoLismero It is an open source framework for security testing. It is currently used for web security but can be easily expanded to other kinds of the scan.
goofile This tool is used to search a specific file type in a given domain.
hping3 It is an Active Network Smashing Tool used as a security tool to perform Firewall testing, advance port scanning, network testing, manual path MTU discovery, remote OS fingerprinting, TCP/IP stacks auditing, etc….
ident-user-enum It is used to determine the owner of the TCP network process listening on each TCP port of a target system. It can help to prioritise target service during a pen-test.
InSpy It is a LinkedIn enumeration tool with two functionalities i.e., TechSpy and EmpSpy. TechSpy takes LinkedIn job listings for technologies used by the target company. InSpy is used to identify technologies by matching job descriptions to the keyword from a newline-delimited file.
InTrace It enables users to enumerate IP hops, which are exploiting existing TCP connections from the local network as well as from remote hosts. It can be used for network survey and firewall bypassing.
iSMTP It tests for the SMTP user enumeration (RCPT TO and VRFY), internal spoofing, and relay.
lbd It stands for Load Balancing Detector. It is used if a given domain uses DNS or HTTP Load-Balancing.
Maltego Teeth It can be used for the information gathering phase of all security related work. It helps you in your thinking process by visually demonstrating interconnected links between searched items. It gives you access to hidden information.
Masscan It is the fastest internet port scanner that scans the entire internet under 6 minutes, transmitting 10 million packets per second.
Metagoofil It is an information gathering tool designed for extracting metadata of a public document that belongs to a target company.
Miranda It is a Plug-N-Play client application designed to discover, query, and interact with UPNP devices, Internet Gateway Devices.
nbtscan-unixwiz It is a command-line tool that scans for open NETBIOS name servers on a local or remote TCP/IP network.
Nikto It is an open source web server scanner used to run the comprehensive test against web servers for multiple items that includes huge number of potentially dangerous files, run checks for outdated version over thousands of servers and also version specific problems
Nmap This utility is used for network discovery and security auditing. It uses raw IP packets in simple ways to determine what hosts are available on the network.
ntop It shows the network uses and can be used in both interactive or web mode. It uses libcap, a system-independent interface for user-level packet capture.
OSRFramework It is a set of libraries that checks for a user profile in up to 290 different platforms. It provides a way of making these queries graphically.
p0f This tool utilizes an array of sophisticated, purely passive traffic fingerprinting mechanisms to identify the processes behind any TCP/IP communication without interfering in any way.
Parsero It is used to read the Robots.txt files of a web server and look at the banned entries. These entries tell the search engines what directories or files hosted on a web server mustn’t be indexed.
Recon-ng It is a fully loaded web survey framework in which open-source web-based reconnaissance can be conducted quickly and thoroughly.
SET SET stands for Social Engineer Toolkit. It is an open-source penetration testing framework that is designed for Social-Engineering. It contains a number of custom attack vectors that allow you to make a believable attack in a fraction of the time.
SMBMap It allows the user to enumerate samba share drives across an entire domain. It contains the list of share drives, drives permissions, shares contents, upload/download functionality, etc.? It is designed to simplify searching for potentially sensitive data across large networks.
smtp-user-enum It is a username guessing tool primarily for the SMTP service. It is used to enumerate OS level user accounts on Solaris via the SMTP (Simple Mail Transfer Protocol) service.
snmp-check It allows you to enumerate the SNMP devices and places the output in a readable format. It is useful for penetration testing or system monitoring.
SPARTA It is a network infrastructure penetration testing tool that aids the penetration tester in the scanning and enumeration phase. It eases access to the toolkits and displays output in a convenient way.
sslcaudit It can be used against the MIMT attacks and useful for testing thick clients and anything communicating over SSL/TLS over TCP.
SSLsplit It is a tool for man-in-the-middle-attack against SSL/TLS encrypted network connections. It is very useful for network forensics and penetration testing.
sslstrip It is used to transparently hijack HTTP traffic on a network, watch for HTTPS links and redirects to it. It maps those links into similar HTTP links or homographs.
SSLyze It analyses the SSL configuration of a server by connecting to it. It is very fast and comprehensive, and help the tester to identify mis-configuration that are affecting their SSL servers.
Sublist3r It is a fast subdomain enumeration tool for penetration testers. It iterates subdomains using many search engines such as Google Yahoo, Bing, and Ask, etc
THC-IPV6 It is a tool to attack the inherited weakness of IPV6 and ICMP6 protocol. It converts a MAC or IPv4 address to an IPv6 address.
theharvester It is used to gather e-mail accounts and subdomain names from public sources.
TLSSLed It is used to evaluate the security of a target SSL/TLS (HTTPS) web servers’ implementation.
twofi It stands for Twitter Words of Interest. It will take multiple search terms and return a word list sorted by most common first.
Unicornscan It is an information gathering and correlation engine that is scalable, accurate, flexible, and efficient. It measures the response from a TCP/IP enabled device or network.
URLCrazy It is a Domain typo generator that detects and performs typo squatting, URL hijacking, phishing, and corporate espionage.
Wireshark It is a network protocol/traffic analyser. It allows us to monitor our network at a microscopic level.
WOL-E A complete suite of tools for the Wake on LAN feature of network attached computers.
Xplico It is a Network Forensic Analysis Tool (NFAT), which is used to extract the application data from internet traffic.