네트워크 열거 스크립팅

# Run default safe scripts
nmap -sC 192.168.1.100

# List all scripts
ls /usr/share/nmap/scripts/ | grep http

# Run specific script
nmap --script=http-title 192.168.1.100

nmap --script=smb-enum-shares -p 445 192.168.1.100
nmap --script=ftp-anon -p 21 192.168.1.100
nmap --script=dns-brute --script-args dns-brute.domain=target.com 192.168.1.1

sudo nmap --script=vuln 192.168.1.100

# Specific vuln checks:
nmap --script=ms17-010 -p 445 192.168.1.100  # EternalBlue
nmap --script=http-shellshock 192.168.1.100

# Install
pip install python-libnmap

# Parse results
from libnmap.parser import NmapParser
report = NmapParser.parse_fromfile("scan.xml")
for host in report.hosts:
    for svc in host.services:
        if svc.state == "open":
            print(f"{host.address}:{svc.port} {svc.service}")

import socket
from concurrent.futures import ThreadPoolExecutor

def scan_port(host, port):
    try:
        s = socket.socket()
        s.settimeout(0.5)
        s.connect((host, port))
        print(f"Open: {port}")
        s.close()
    except: pass

with ThreadPoolExecutor(100) as ex:
    for p in range(1, 1025):
        ex.submit(scan_port, "192.168.1.100", p)

# Check if port is open (bash built-in)
timeout 1 bash -c "echo >/dev/tcp/192.168.1.100/80" && echo open

# Loop over hosts
for i in $(seq 1 254); do
  ping -c1 -W1 192.168.1.$i &>/dev/null && echo "192.168.1.$i up"
done

dnsrecon -d target.com -t std
amass enum -d target.com

# Manual zone transfer attempt
dig axfr target.com @ns1.target.com

enum4linux -a 192.168.1.100

# -a = all enumeration
# Shows: shares, users, groups,
#        password policy, OS version

# Query with default community string
snmpwalk -c public -v2c 192.168.1.100

# Get system info only
snmpget -c public -v2c 192.168.1.100 1.3.6.1.2.1.1.1.0

# Brute force community strings
onesixtyone -c community.txt 192.168.1.100