The Hacker Play book

书籍中提供的示例网站：cyberspacekittens.com

工具：

信息收集：

1. Web 应用程序监控
   HTTPScreenshot 使用masscan和phantomjs捕获网站截屏
   Eyewitness  截取网站的屏幕截图
2. zoomeye.com
3. Shodan.io
4. Censys.io
5. https://haveibeenpwned.com/ 查看公开的数据泄露
6. 子域名扫描工具 SubBruteSublist3r 
   https://github.com/leebaird/discover 结合了kali中所有子域名收集工具
7. S3 存储枚举
   slurp bucket_finder
8. 域名劫持相
   tko-subs HostileSubBruteforcer  autoSubTakeover
9. 邮箱相关
   SimplyEmail 搜寻域名相关邮箱  持续关注email泄露行为
10. osint
    https://github.com/IVMachiavelli/OSINT_Team_Links
    http://osintframework.com/
11.  

公共网站信息泄露：

1. TruffleHog 扫描github机密信息
2.  

后渗透

1. PowerShell Empire
2. dnscat2
3. p0wnedShell
4. pupy shell
5. poshC2
6. merlin
7. Nishang

 

扫描结果差异分析

 #!/bin/bash
mkdir /opt/nmap_diff
d=$(date +%Y-%m-%d)
y=$(date -d yesterday +%Y-%m-%d)
/usr/bin/nmap -T4 -oX /opt/nmap_diff/scan_$d.xml 10.100.100.0/24 > /dev/null 2>&1
if [ -e /opt/nmap_diff/scan_$y.xml ]; then
  /usr/bin/ndiff /opt/nmap_diff/scan_$y.xml /opt/nmap_diff/scan_$d.xml > /opt/nmap_diff/diff.txt
fi