Recon-ng被动信息收集框架入门

[recon-ng][default] > marketplace install all

[recon-ng][default]  marketplace refresh
[*] Marketplace index refreshed.
[recon-ng][default]

[recon-ng][sina]  marketplace search hackertarget
[*] Searching module index for 'hackertarget'...


  
  |Path| Version |   Status  |  Updated   | D | K |


  | recon/domains-hosts/hackertarget | 1.0     
  | installed | 2019-06-24 |   


  D = Has dependencies. See info for details.
  K = Requires keys. See info for details.


[recon-ng][sina]

[recon-ng][default]  marketplace install recon/domains-hosts/hackertarget
[*] Module installed: recon/domains-hosts/hackertarget
[*] Reloading modules...
[recon-ng][default]

[recon-ng][default] modules load recon/domains-hosts/hackertarget
[recon-ng][default][hackertarget]

[recon-ng][default][hackertarget]  info


      Name: HackerTarget Lookup
    Author: Michael Henriksen (@michenriksen)
   Version: 1.0


Description:
  Uses the HackerTarget.com API to find host names. Updates the 'hosts' table with the results.


Options:
  Name    Current Value  Required  Description
  ------  -------------  --------  -----------
  SOURCE  default        yes       source of input (see 'show info' for details)


Source Options:
  default        SELECT DISTINCT domain FROM domains WHERE domain IS NOT NULL
  <string       string representing a single input
  <path         path to a file containing a list of inputs
  query <sql    database query returning one column of inputs


[recon-ng][sina][hackertarget]

[recon-ng][default][hackertarget]  options set SOURCE rapid7.com
SOURCE = rapid7.com
[recon-ng][default][hackertarget]  run


----------
RAPID7.COM
----------
[*] [host] rapid7.com (13.249.47.238)
[*] [host] scanner1.labs.rapid7.com (71.6.233.2)
[*] [host] scanner2.labs.rapid7.com (71.6.233.129)
[*] [host] scanner3.labs.rapid7.com (31.24.231.211)
[*] [host] scanner4.labs.rapid7.com (31.24.231.223)
[*] [host] sonar.labs.rapid7.com (34.236.82.205)
...

[recon-ng][default]  show hosts
  | rowid |                     host                     |    ip_address   | region | country | latitude | longitude |    module    |
  +---------------------------------------------------------------------------------------------------------------------------------+
  | 1     | rapid7.com                                   | 99.84.219.205   |        |         |          |           | hackertarget |
  | 2     | hostedconsole-pso-01.rapid7.com              | 
  ..........................................................
  | 137   | community.rapid7.com                         | 34.210.186.136  |        |         |          |           | hackertarget |




[*] 137 rows returned
[recon-ng][default]

cache_snoop – DNS缓存录制
interesting_files – 敏感文件探测
command_injector – 远程命令注入shell接口
xpath_bruter – Xpath注入爆破
csv_file – 高级csv文件导入
list – List文件导入
point_usage – Jigsaw – 统计信息提取用法
purchase_contact – Jigsaw – 简单的联系查询
search_contacts – Jigsaw联系枚举
jigsaw_auth – Jigsaw认证联系枚举
linkedin_auth – LinkedIn认证联系枚举
github_miner – Github资源挖掘
whois_miner – Whois数据挖掘
bing_linkedin – Bing Linkedin信息采集
email_validator – SalesMaple邮箱验证
mailtester – MailTester邮箱验证
mangle – 联系分离
unmangle –联系反分离
hibp_breach –Breach搜索
hibp_paste – Paste搜索
pwnedlist – PwnedList验证
migrate_contacts – 域名数据迁移联系
facebook_directory – Facebook目录爬行
fullcontact – FullContact联系枚举
adobe – Adobe Hash破解
bozocrack – PyBozoCrack Hash 查询
hashes_org – Hashes.org Hash查询
leakdb – leakdb Hash查询
metacrawler – 元数据提取
pgp_search – PGP Key Owner查询
salesmaple – SalesMaple联系获取
whois_pocs – Whois POC获取
account_creds – PwnedList – 账户认证信息获取
api_usage – PwnedList – API使用信息
domain_creds – PwnedList – Pwned域名认证获取
domain_ispwned – PwnedList – Pwned域名统计获取
leak_lookup – PwnedList – 泄露信息查询
leaks_dump – PwnedList –泄露信息获取
brute_suffix – DNS公共后缀爆破
baidu_site – Baidu主机名枚举
bing_domain_api – Bing API主机名枚举
bing_domain_web – Bing主机名枚举
brute_hosts – DNS主机名爆破
builtwith – BuiltWith枚举
google_site_api – Google CSE主机名枚举
google_site_web – Google主机名枚举
netcraft – Netcraft主机名枚举
shodan_hostname – Shodan主机名枚举
ssl_san – SSL SAN查询
vpnhunter – VPNHunter查询
yahoo_domain – Yahoo主机名枚举
zone_transfer – DNS域文件收集
ghdb – Google Hacking数据库
punkspider – PunkSPIDER漏洞探测
xssed – XSSed域名查询
xssposed – XSSposed域名查询
migrate_hosts – 域名数据迁移host
bing_ip – Bing API旁站查询
freegeoip –FreeGeoIP ip定位查询
ip_neighbor – My-IP-Neighbors.com查询
ipinfodb – IPInfoDB GeoIP查询
resolve – 主机名解析器
reverse_resolve – 反解析
ssltools – SSLTools.com主机名查询
geocode – 地理位置编码
reverse_geocode – 反地理位置编码
flickr – Flickr地理位置查询
instagram – Instagram地理位置查询
picasa – Picasa地理位置查询
shodan – Shodan地理位置查询
twitter – Twitter地理位置查询
whois_orgs – Whois公司信息收集
reverse_resolve – 反解析
shodan_net – Shodan网络枚举
census_2012 – Internet Census 2012 查询
sonar_cio – Project Sonar查询
migrate_ports – 主机端口数据迁移
dev_diver – Dev Diver Repository检查
linkedin – Linkedin联系获取
linkedin_crawl – Linkedin信息抓取
namechk – NameChk.com用户名验证
profiler – OSINT HUMINT信息收集
twitter – Twitter操作
github_repos – Github代码枚举
gists_search – Github Gist搜索
github_dorks – Github Dork分析
csv – CSV文件生成
html – HTML报告生成
json – JSON报告生成
list – List生成
pushpin – PushPin报告生成
xlsx – XLSX文件创建
xml – XML报告生成

常用模块

Domin-Hosts

# 通过domin获取更多的子域名
recon/domains-hosts/hackertarget
recon/domains-hosts/brute_hosts
recon/domains-hosts/findsubdomains
recon/domains-hosts/google_site_web

Hosts-Hosts

# 通过子域名获取真实的ip地址及地理位置
recon/hosts-hosts/resolve
recon/hosts-hosts/ipinfodb

Hosts-Ports

# 通过ip地址被动获取开启端口信息，需要shodan的api key
recon/hosts-ports/shodan_ip

Report

# 导出模块,支持多种格式
reporting/html
reporting/list
reporting/xlsx
reporting/csv

Import

# 导入模块
import/nmap # 需要oX导出格式
import/list
import/masscan
import/csv_file