Hola a todos bueno esta post esta hecho especialmente para las personas que empiesan con esta gran herramienta que es el backtrack .. estare dando un a pequeña explicacion de cada una de estas herramientas bueno este es el primer post de explicacion mas adelante estare explicando cada ves mas herramientas … bueno y si tengo algun error en la explicacion seria bueno q me lo hagan saber bueno sin mas empesare con alguna de las mas basicas …
Host
la funcion de Host es mostrar la informacion de la ip del host remoto
Código:
bt ~ # host decs.es decs.es has address 194.23.5.200 decs.es mail is handled by 10 mail.decs.es.
——————————————————————————————
Nslookup
la funcion de nslookup es dar a conocer el DNS del host remoto
Código:
bt ~ # nslookup 194.23.5.200 Server: 190.157.2.140 Address: 190.157.2.140#53 Non-authoritative answer: 200.5.23.94.in-addr.arpa name = ns365791.ovh.net. Authoritative answers can be found from: 5.23.94.in-addr.arpa nameserver = ns12.ovh.net. 5.23.94.in-addr.arpa nameserver = dns12.ovh.net.
——————————————————————————————–
Traceroute
traceroute nodos por donde pasan los paquetes… es lo mismo q Tracert en windows
Código:
bt ~ # traceroute 94.23.5.200 traceroute to 94.23.5.200 (94.23.5.200), 30 hops max, 38 byte packets 1 Dynamic-IP-xxxxxxxxx.cable.net.co (xxxxxxxxxx) 11.544 ms 26.286 ms 10.061 ms 2 xxxxxxxxxxx (xxxxxxxxxx) 19.050 ms 16.296 ms 13.292 ms 3 Static-IP-xxxxxxxxxx.cable.net.co (xxxxxxxxx) 26.455 ms 26.868 ms 26.076 ms 4 * * * 5 bbint-miami-americas-2-pos4-0-0.uninet.net.mx (187.141.106.254) 76.224 ms 78.112 ms 77.235 ms 6 if-6-0.icore1.MLN-Miami.as6453.net (66.110.9.21) 84.462 ms * 98.792 ms 7 if-5-0-0-423.core3.MLN-Miami.as6453.net (66.110.9.10) 81.004 ms if-0-0-0-421.core3.MLN-Miami.as6453.net (66.110.9.2) 78.294 ms 87.517 ms 8 if-0-0-0.mcore4.NJY-Newark.as6453.net (209.58.104.2) 106.554 ms 107.233 ms 105.681 ms 9 if-1-0.mcore3.L78-London.as6453.net (195.219.144.9) 194.912 ms 180.625 ms 186.132 ms 10 if-1-0-0-2.mse1.LVX-London.as6453.net (195.219.144.26) 185.470 ms 184.717 ms 185.390 ms 11 if-13-1-0.mcore3.LDN-London.as6453.net (195.219.195.49) 182.766 ms 184.776 ms 185.196 ms 12 blan62.icore1.LDN-London.as6453.net (195.219.83.1) 202.928 ms 190.038 ms 182.866 ms 13 20g.ldn-1-6k.routers.ovh.net (94.23.122.121) 377.079 ms 20g.ldn-1-6k.routers.ovh.net (94.23.122.74) 225.225 ms 186.239 ms 14 20g.vss-1-6k.routers.chtix.eu (94.23.122.66) 189.381 ms * 223.702 ms 15 ns365791.ovh.net (94.23.5.200) 189.383 ms 187.665 ms 190.412 ms
——————————————————————————————-
Xprobe
El objetivo de esta herramienta para llevar a cabo la toma de huellas dactilares de remoto pilas TCP / IP Xprobe es un programa que nos permite la identificación remota del sistema operativo. Esto es lo que se conoce en inglés como remote active operating system fingerprinting
Código:
bt ~ # xprobe2 -v 94.23.5.200 Xprobe2 v.0.3 Copyright (c) 2002-2005 fyodor@o0o.nu, ofir@sys-security.com, meder@o0o.nu [+] Target is 94.23.5.200 [+] Loading modules. [+] Following modules are loaded: [x] [1] ping:icmp_ping - ICMP echo discovery module [x] [2] ping:tcp_ping - TCP-based ping discovery module [x] [3] ping:udp_ping - UDP-based ping discovery module [x] [4] infogather:ttl_calc - TCP and UDP based TTL distance calculation [x] [5] infogather:portscan - TCP and UDP PortScanner [x] [6] fingerprint:icmp_echo - ICMP Echo request fingerprinting module [x] [7] fingerprint:icmp_tstamp - ICMP Timestamp request fingerprinting module [x] [8] fingerprint:icmp_amask - ICMP Address mask request fingerprinting module [x] [9] fingerprint:icmp_port_unreach - ICMP port unreachable fingerprinting module [x] [10] fingerprint:tcp_hshake - TCP Handshake fingerprinting module [x] [11] fingerprint:tcp_rst - TCP RST fingerprinting module [x] [12] fingerprint:smb - SMB fingerprinting module [x] [13] fingerprint:snmp - SNMPv2c fingerprinting module [+] 13 modules registered [+] Initializing scan engine [+] Running scan engine [-] ping:tcp_ping module: no closed/open TCP ports known on 94.23.5.200. Module test failed [-] ping:udp_ping module: no closed/open UDP ports known on 94.23.5.200. Module test failed [-] No distance calculation. 94.23.5.200 appears to be dead or no ports known [+] Host: 94.23.5.200 is up (Guess probability: 50%) [+] Target: 94.23.5.200 is alive. Round-Trip Time: 0.18929 sec [+] Selected safe Round-Trip Time value is: 0.37858 sec [-] fingerprint:tcp_hshake Module execution aborted (no open TCP ports known) [-] fingerprint:smb need either TCP port 139 or 445 to run [-] fingerprint:snmp: need UDP port 161 open [+] Primary guess: [+] Host 94.23.5.200 Running OS: "Linux Kernel 2.4.19" (Guess probability: 100%) [+] Other guesses: [+] Host 94.23.5.200 Running OS: "Linux Kernel 2.4.20" (Guess probability: 100%) [+] Host 94.23.5.200 Running OS: "Linux Kernel 2.4.21" (Guess probability: 100%) [+] Host 94.23.5.200 Running OS: "Linux Kernel 2.4.22" (Guess probability: 100%) [+] Host 94.23.5.200 Running OS: "Linux Kernel 2.4.23" (Guess probability: 100%) [+] Host 94.23.5.200 Running OS: "Linux Kernel 2.4.24" (Guess probability: 100%) [+] Host 94.23.5.200 Running OS: "Linux Kernel 2.4.25" (Guess probability: 100%) [+] Host 94.23.5.200 Running OS: "Linux Kernel 2.4.26" (Guess probability: 100%) [+] Host 94.23.5.200 Running OS: "Linux Kernel 2.4.27" (Guess probability: 100%) [+] Host 94.23.5.200 Running OS: "Linux Kernel 2.4.28" (Guess probability: 100%) [+] Cleaning up scan engine [+] Modules deinitialized [+] Execution completed.
——————————————————————————————–
DNSmap
DNSmap es una herramienta basada en fuerza bruta , loque se haces es obtener los subdominios de un host
Código:
dnsmap - DNS Network Mapper by pagvac dnsmap - DNS Red por mapper pagvac (http://ikwt.com, http://foro.elhacker.net) (http://ikwt.com, http://foro.elhacker.net) Searching subhosts on domain victimluser.com Subhosts en la búsqueda de dominio victimluser.com forum.victimluser.com forum.victimluser.com IP Address #1:192.168.1.1 Dirección IP # 1:192.168.1.1 mail.victimluser.com mail.victimluser.com IP Address #1:192.168.1.2 Dirección IP # 1:192.168.1.2 ftp.victimluser.com ftp.victimluser.com IP Address #1:192.168.1.3 Dirección IP # 1:192.168.1.3 pop.victimluser.org pop.victimluser.org IP Address #1:192.168.1.4 Dirección IP # 1:192.168.1.4
————————————————————————————————
DNStracer
DNStracer dnstracer determina que un determinado servidor de nombres de dominio (DNS) obtiene su información de, y sigue la cadena de los servidores DNS de nuevo a los servidores que saber los datos.
Código:
bt ~ # dnstracer dec.es Tracing to dec.es via 190.157.2.140, timeout 15 seconds 190.157.2.140 (190.157.2.140) |___ SUN.REDIRIS.es [es] (130.206.1.2) | |___ sn0.publicinet.net [dec.es] (69.56.171.170) Got authoritative answer | ___ sn1.publicinet.net [dec.es] (67.19.24.106) Got authoritative answer |___ NS1.CRN.NIC.es [es] (195.81.201.11) | |___ sn0.publicinet.net [dec.es] (69.56.171.170) (cached) | ___ sn1.publicinet.net [dec.es] (67.19.24.106) (cached) |___ NS1.CESCA.es [es] (84.88.0.3) | |___ sn1.publicinet.net [dec.es] (67.19.24.106) (cached) | ___ sn0.publicinet.net [dec.es] (69.56.171.170) (cached) |___ NS-EXT.NIC.CL [es] (200.1.123.14) | |___ sn1.publicinet.net [dec.es] (67.19.24.106) (cached) | ___ sn0.publicinet.net [dec.es] (69.56.171.170) (cached) |___ NS1.NIC.es [es] (194.69.254.1) | |___ sn1.publicinet.net [dec.es] (67.19.24.106) (cached) | ___ sn0.publicinet.net [dec.es] (69.56.171.170) (cached) |___ NS3.NIC.FR [es] (192.134.0.49) | |___ sn0.publicinet.net [dec.es] (69.56.171.170) (cached) | ___ sn1.publicinet.net [dec.es] (67.19.24.106) (cached) ___ SNS-PB.ISC.ORG [es] (192.5.4.1) |___ sn1.publicinet.net [dec.es] (67.19.24.106) (cached) ___ sn0.publicinet.net [dec.es] (69.56.171.170) (cached)
———————————————————————————————-
Dig
es un instrumento flexible para interrogar a los servidores de nombres DNS. Realiza búsquedas de DNS y muestra las respuestas que se devuelve desde el servidor de nombres (s) que se preguntó.La mayoría de los administradores de DNS uso excavar
Código:
bt ~ # dig ; <<>> DiG 9.4.1 <<>> ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12331 ;; flags: qr rd ra; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 13 ;; QUESTION SECTION: ;. IN NS ;; ANSWER SECTION: . 463603 IN NS B.ROOT-SERVERS.NET. . 463603 IN NS G.ROOT-SERVERS.NET. . 463603 IN NS J.ROOT-SERVERS.NET. . 463603 IN NS M.ROOT-SERVERS.NET. . 463603 IN NS A.ROOT-SERVERS.NET. . 463603 IN NS F.ROOT-SERVERS.NET. . 463603 IN NS E.ROOT-SERVERS.NET. . 463603 IN NS K.ROOT-SERVERS.NET. . 463603 IN NS L.ROOT-SERVERS.NET. . 463603 IN NS D.ROOT-SERVERS.NET. . 463603 IN NS H.ROOT-SERVERS.NET. . 463603 IN NS C.ROOT-SERVERS.NET. . 463603 IN NS I.ROOT-SERVERS.NET. ;; ADDITIONAL SECTION: A.ROOT-SERVERS.NET. 118037 IN A 198.41.0.4 B.ROOT-SERVERS.NET. 602369 IN A 192.228.79.201 C.ROOT-SERVERS.NET. 596594 IN A 192.33.4.12 E.ROOT-SERVERS.NET. 600198 IN A 192.203.230.10 F.ROOT-SERVERS.NET. 604371 IN A 192.5.5.241 G.ROOT-SERVERS.NET. 600198 IN A 192.112.36.4 H.ROOT-SERVERS.NET. 601397 IN A 128.63.2.53 I.ROOT-SERVERS.NET. 582297 IN A 192.36.148.17 J.ROOT-SERVERS.NET. 603971 IN A 192.58.128.30 J.ROOT-SERVERS.NET. 118037 IN AAAA 2001:503:c27::2:30 K.ROOT-SERVERS.NET. 595717 IN A 193.0.14.129 K.ROOT-SERVERS.NET. 600476 IN AAAA 2001:7fd::1 M.ROOT-SERVERS.NET. 586159 IN A 202.12.27.33 ;; Query time: 41 msec ;; SERVER: 190.157.2.140#53(190.157.2.140) ;; WHEN: Sat Aug 15 16:26:31 2009 ;; MSG SIZE rcvd: 460 bt ~ # dig ; <<>> DiG 9.4.1 <<>> ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12331 ;; flags: qr rd ra; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 13 ;; QUESTION SECTION: ;. IN NS ;; ANSWER SECTION: . 463603 IN NS B.ROOT-SERVERS.NET. . 463603 IN NS G.ROOT-SERVERS.NET. . 463603 IN NS J.ROOT-SERVERS.NET. . 463603 IN NS M.ROOT-SERVERS.NET. . 463603 IN NS A.ROOT-SERVERS.NET. . 463603 IN NS F.ROOT-SERVERS.NET. . 463603 IN NS E.ROOT-SERVERS.NET. . 463603 IN NS K.ROOT-SERVERS.NET. . 463603 IN NS L.ROOT-SERVERS.NET. . 463603 IN NS D.ROOT-SERVERS.NET. . 463603 IN NS H.ROOT-SERVERS.NET. . 463603 IN NS C.ROOT-SERVERS.NET. . 463603 IN NS I.ROOT-SERVERS.NET. ;; ADDITIONAL SECTION: A.ROOT-SERVERS.NET. 118037 IN A 198.41.0.4 B.ROOT-SERVERS.NET. 602369 IN A 192.228.79.201 C.ROOT-SERVERS.NET. 596594 IN A 192.33.4.12 E.ROOT-SERVERS.NET. 600198 IN A 192.203.230.10 F.ROOT-SERVERS.NET. 604371 IN A 192.5.5.241 G.ROOT-SERVERS.NET. 600198 IN A 192.112.36.4 H.ROOT-SERVERS.NET. 601397 IN A 128.63.2.53 I.ROOT-SERVERS.NET. 582297 IN A 192.36.148.17 J.ROOT-SERVERS.NET. 603971 IN A 192.58.128.30 J.ROOT-SERVERS.NET. 118037 IN AAAA 2001:503:c27::2:30 K.ROOT-SERVERS.NET. 595717 IN A 193.0.14.129 K.ROOT-SERVERS.NET. 600476 IN AAAA 2001:7fd::1 M.ROOT-SERVERS.NET. 586159 IN A 202.12.27.33 ;; Query time: 41 msec ;; SERVER: 190.157.2.140#53(190.157.2.140) ;; WHEN: Sat Aug 15 16:26:31 2009 ;; MSG SIZE rcvd: 460
———————————————————————————————————————————-
fierce
De dominio Fierce exploración nació de la frustración personal después de realizar una auditoría de seguridad en aplicaciones web. Es tradicionalmente muy difícil de descubrir grandes franjas de una red corporativa que no es contigua. Es terriblemente fácil de ejecutar un escáner en contra de un rango de direcciones IP, pero si los rangos de IP están muy lejos uno del otro que se puede perder grandes trozos de redes.
Código:
bt fierce # perl fierce.pl -dns dec.es DNS Servers for dec.es: sn0.publicinet.net sn1.publicinet.net Trying zone transfer first... Testing sn0.publicinet.net Request timed out or transfer not allowed. Testing sn1.publicinet.net Request timed out or transfer not allowed. Unsuccessful in zone transfer (it was worth a shot) Okay, trying the good old fashioned way... brute force Checking for wildcard DNS... Nope. Good. Now performing 1895 test(s)... 67.19.24.106 ftp.dec.es 127.0.0.1 localhost.dec.es 67.19.24.106 mail.dec.es 67.19.24.106 www.dec.es Subnets found (may want to probe here using nmap or unicornscan): 127.0.0.0-255 : 1 hostnames found. 67.19.24.0-255 : 3 hostnames found. Done with Fierce scan: http://ha.ckers.org/fierce/ Found 4 entries. Have a nice day.
—————————————————————————————————————————————-
TCPTracer
Código:
bt ~ # tcptraceroute 94.23.5.200 Selected device eth0, address 186.82.43.125, port 57546 for outgoing packets Tracing the path to 94.23.5.200 on TCP port 80 (http), 30 hops max 1 Dynamic-IP-xxxxxxxxx.cable.net.co (xxxxxxxx) 9.912 ms 12.177 ms 19.300 ms 2 xxxxxxxxxxxxxxx 11.631 ms 14.402 ms 11.508 ms 3 Static-IP-xxxxxxxxxxcable.net.co (xxxxxxxxxxx) 26.259 ms 26.580 ms 25.277 ms 4 * * * 5 bbint-miami-americas-2-pos4-0-0.uninet.net.mx (187.141.106.254) 76.444 ms 75.241 ms 76.762 ms 6 if-6-0.icore1.MLN-Miami.as6453.net (66.110.9.21) 90.716 ms 91.147 ms * 7 if-0-0-0-421.core3.MLN-Miami.as6453.net (66.110.9.2) 78.234 ms 77.222 ms 76.263 ms 8 if-0-0-0.mcore4.NJY-Newark.as6453.net (209.58.104.2) 130.242 ms 267.547 ms 170.154 ms 9 if-1-0.mcore3.L78-London.as6453.net (195.219.144.9) 180.382 ms 180.806 ms 179.638 ms 10 if-1-0-0-2.mse1.LVX-London.as6453.net (195.219.144.26) 186.137 ms 185.663 ms 194.932 ms 11 if-13-1-0.mcore3.LDN-London.as6453.net (195.219.195.49) 198.470 ms 204.828 ms 182.617 ms 12 blan62.icore1.LDN-London.as6453.net (195.219.83.1) 192.421 ms 194.849 ms 181.499 ms 13 20g.ldn-1-6k.routers.ovh.net (94.23.122.74) 188.192 ms 196.628 ms 187.976 ms 14 20g.vss-1-6k.routers.chtix.eu (94.23.122.66) 189.848 ms 186.503 ms 186.275 ms 15 ns365791.ovh.net (94.23.5.200) [open] 197.355 ms 183.518 ms 189.771 ms
By Progresive Death