Recon-ng被动信息收集框架入门

在web渗透测试中，信息侦察与收集相当重要，每个经验丰富的黑客都有自己独特的信息收集妙招，信息搜集是渗透的第一步，也是至关重要的一步，信息的多少决定攻击的范围有多少。Recon-ng是用Python编写的功能齐全的Web侦察框架。具有独立模块，数据库交互功能和内置的便捷功能，最主要的recon-ng是一个被动信息搜集框架，主要利用第三方API进行信息收集。

信息收集分为三步：侦察Reconnaissance、发现Discovery与汇报reporting。这也对应了该工具的三个模块，现在就记录一下Recon-ng 这款较新的信息侦察收集工具的使用。具体详细可参阅官方文档[1]，针对自定义编写recon-ng模块可前往Github项目[2]查看

模块安装

Recon-ng 5 最大的改变是没有模块，需要下载。且命令变化很大。刚启动的时候，会提示“No modules enabled/installed.（未启用/未安装任何模块。）

官方给出的答案是，此框架本身默认不包含任何模块。必须从 marketplace 模块市场中安装模块。

可以用命令来安装所有的模块：

[recon-ng][default] > marketplace install all

下面再介绍下载特定模块,以hackertarget为例，

1.输入 marketplace refresh 更新模块列表

[recon-ng][default]  marketplace refresh
[*] Marketplace index refreshed.
[recon-ng][default]

2.输入 marketplace search hackertarget 搜索模块索引

[recon-ng][sina]  marketplace search hackertarget
[*] Searching module index for 'hackertarget'...

  
  |Path| Version |   Status  |  Updated   | D | K |

  | recon/domains-hosts/hackertarget | 1.0     
  | installed | 2019-06-24 |   

  D = Has dependencies. See info for details.
  K = Requires keys. See info for details.

[recon-ng][sina]

3.输入 marketplace install recon/domains-hosts/hackertarget ，安装hackertarget模块

[recon-ng][default]  marketplace install recon/domains-hosts/hackertarget
[*] Module installed: recon/domains-hosts/hackertarget
[*] Reloading modules...
[recon-ng][default]

快速上手

以hackertarget模块为例子

第一步加载模块

[recon-ng][default] modules load recon/domains-hosts/hackertarget
[recon-ng][default][hackertarget]

第二步查看参数信息

[recon-ng][default][hackertarget]  info

      Name: HackerTarget Lookup
    Author: Michael Henriksen (@michenriksen)
   Version: 1.0

Description:
  Uses the HackerTarget.com API to find host names. Updates the 'hosts' table with the results.

Options:
  Name    Current Value  Required  Description
  ------  -------------  --------  -----------
  SOURCE  default        yes       source of input (see 'show info' for details)

Source Options:
  default        SELECT DISTINCT domain FROM domains WHERE domain IS NOT NULL
  <string       string representing a single input
  <path         path to a file containing a list of inputs
  query <sql    database query returning one column of inputs

[recon-ng][sina][hackertarget]

第三步设置目标参数并运行

[recon-ng][default][hackertarget]  options set SOURCE rapid7.com
SOURCE = rapid7.com
[recon-ng][default][hackertarget]  run

----------
RAPID7.COM
----------
[*] [host] rapid7.com (13.249.47.238)
[*] [host] scanner1.labs.rapid7.com (71.6.233.2)
[*] [host] scanner2.labs.rapid7.com (71.6.233.129)
[*] [host] scanner3.labs.rapid7.com (31.24.231.211)
[*] [host] scanner4.labs.rapid7.com (31.24.231.223)
[*] [host] sonar.labs.rapid7.com (34.236.82.205)
...

第四步查看结果列表

[recon-ng][default]  show hosts
  | rowid |                     host                     |    ip_address   | region | country | latitude | longitude |    module    |
  +---------------------------------------------------------------------------------------------------------------------------------+
  | 1     | rapid7.com                                   | 99.84.219.205   |        |         |          |           | hackertarget |
  | 2     | hostedconsole-pso-01.rapid7.com              | 
  ..........................................................
  | 137   | community.rapid7.com                         | 34.210.186.136  |        |         |          |           | hackertarget |


[*] 137 rows returned
[recon-ng][default]

模块枚举

Recon-ng约有80个recon模块，2个发现模块，2个exp利用模块，7个报告模块和2个导入模块

cache_snoop – DNS缓存录制
interesting_files – 敏感文件探测
command_injector – 远程命令注入shell接口
xpath_bruter – Xpath注入爆破
csv_file – 高级csv文件导入
list – List文件导入
point_usage – Jigsaw – 统计信息提取用法
purchase_contact – Jigsaw – 简单的联系查询
search_contacts – Jigsaw联系枚举
jigsaw_auth – Jigsaw认证联系枚举
linkedin_auth – LinkedIn认证联系枚举
github_miner – Github资源挖掘
whois_miner – Whois数据挖掘
bing_linkedin – Bing Linkedin信息采集
email_validator – SalesMaple邮箱验证
mailtester – MailTester邮箱验证
mangle – 联系分离
unmangle –联系反分离
hibp_breach –Breach搜索
hibp_paste – Paste搜索
pwnedlist – PwnedList验证
migrate_contacts – 域名数据迁移联系
facebook_directory – Facebook目录爬行
fullcontact – FullContact联系枚举
adobe – Adobe Hash破解
bozocrack – PyBozoCrack Hash 查询
hashes_org – Hashes.org Hash查询
leakdb – leakdb Hash查询
metacrawler – 元数据提取
pgp_search – PGP Key Owner查询
salesmaple – SalesMaple联系获取
whois_pocs – Whois POC获取
account_creds – PwnedList – 账户认证信息获取
api_usage – PwnedList – API使用信息
domain_creds – PwnedList – Pwned域名认证获取
domain_ispwned – PwnedList – Pwned域名统计获取
leak_lookup – PwnedList – 泄露信息查询
leaks_dump – PwnedList –泄露信息获取
brute_suffix – DNS公共后缀爆破
baidu_site – Baidu主机名枚举
bing_domain_api – Bing API主机名枚举
bing_domain_web – Bing主机名枚举
brute_hosts – DNS主机名爆破
builtwith – BuiltWith枚举
google_site_api – Google CSE主机名枚举
google_site_web – Google主机名枚举
netcraft – Netcraft主机名枚举
shodan_hostname – Shodan主机名枚举
ssl_san – SSL SAN查询
vpnhunter – VPNHunter查询
yahoo_domain – Yahoo主机名枚举
zone_transfer – DNS域文件收集
ghdb – Google Hacking数据库
punkspider – PunkSPIDER漏洞探测
xssed – XSSed域名查询
xssposed – XSSposed域名查询
migrate_hosts – 域名数据迁移host
bing_ip – Bing API旁站查询
freegeoip –FreeGeoIP ip定位查询
ip_neighbor – My-IP-Neighbors.com查询
ipinfodb – IPInfoDB GeoIP查询
resolve – 主机名解析器
reverse_resolve – 反解析
ssltools – SSLTools.com主机名查询
geocode – 地理位置编码
reverse_geocode – 反地理位置编码
flickr – Flickr地理位置查询
instagram – Instagram地理位置查询
picasa – Picasa地理位置查询
shodan – Shodan地理位置查询
twitter – Twitter地理位置查询
whois_orgs – Whois公司信息收集
reverse_resolve – 反解析
shodan_net – Shodan网络枚举
census_2012 – Internet Census 2012 查询
sonar_cio – Project Sonar查询
migrate_ports – 主机端口数据迁移
dev_diver – Dev Diver Repository检查
linkedin – Linkedin联系获取
linkedin_crawl – Linkedin信息抓取
namechk – NameChk.com用户名验证
profiler – OSINT HUMINT信息收集
twitter – Twitter操作
github_repos – Github代码枚举
gists_search – Github Gist搜索
github_dorks – Github Dork分析
csv – CSV文件生成
html – HTML报告生成
json – JSON报告生成
list – List生成
pushpin – PushPin报告生成
xlsx – XLSX文件创建
xml – XML报告生成

常用模块

Domin-Hosts

# 通过domin获取更多的子域名
recon/domains-hosts/hackertarget
recon/domains-hosts/brute_hosts
recon/domains-hosts/findsubdomains
recon/domains-hosts/google_site_web

Hosts-Hosts

# 通过子域名获取真实的ip地址及地理位置
recon/hosts-hosts/resolve
recon/hosts-hosts/ipinfodb

Hosts-Ports

# 通过ip地址被动获取开启端口信息，需要shodan的api key
recon/hosts-ports/shodan_ip

Report

# 导出模块,支持多种格式
reporting/html
reporting/list
reporting/xlsx
reporting/csv

Import

# 导入模块
import/nmap # 需要oX导出格式
import/list
import/masscan
import/csv_file

参考资料

[1]

官方文档: https://bitbucket.org/LaNMaSteR53/recon-ng

[2]

模块编写: https://github.com/scumsec/Recon-ng-modules