四层发现
四层发现的目的是扫描出可能存活的IP地址，四层发现虽然涉及端口扫描，但是并不对端口的状态进行精确判断，其本质是利用四层协议的一些通信来识别主机ip是否存在。
四层发现的优点：
1、可路由且结果可靠；
2、不太可能被防火墙过滤，甚至可以发现所有端口都被过滤的主机。[一些比较严格的防火墙还是会过滤掉]
缺点：是基于状态过滤的防火墙可能过滤扫描；全端口(UDP+TCP十几万个端口)扫描的速度慢。一、TCP探测【基于特征】
tcp连接是通过三次握手建立通信过程。
1.未经请求的ACK[直接发一个ACK]，活着的主机会回一个RST包；宕机主机不会回包
2.直接发一个SYN包，活着的主机会回一个SYN/ACK包[则端口打开]，回RST[端口关闭]；
Scapy（返回RST，则在线，否则不在线）
root@kali:~# scapy WARNING: No route found for IPv6 destination :: (no default route?) Welcome to Scapy (2.3.2) >>> >>> i=IP() >>> t=TCP() >>> r=(i/t) >>> >>> r.display() ###[ IP ]### version= 4 ihl= None tos= 0x0 len= None id= 1 flags= frag= 0 ttl= 64 proto= tcp chksum= None src= 127.0.0.1 dst= 127.0.0.1 options ###[ TCP ]### sport= ftp_data dport= http seq= 0 ack= 0 dataofs= None reserved= 0 flags= S window= 8192 chksum= None urgptr= 0 options= {} >>> >>> r[IP].dst="192.168.1.1" >>> r[TCP].flags="A" #构造ARP包 >>> r.display() ###[ IP ]### version= 4 ihl= None tos= 0x0 len= None id= 1 flags= frag= 0 ttl= 64 proto= tcp chksum= None src= 192.168.1.127 dst= 192.168.1.1 options ###[ TCP ]### sport= ftp_data dport= http seq= 0 ack= 0 dataofs= None reserved= 0 flags= A window= 8192 chksum= None urgptr= 0 options= {} >>> a=sr1(r) Begin emission: .Finished to send 1 packets. * Received 2 packets, <span style="color:#ff0000;">got 1 answers</span>, remaining 0 packets<strong> >>> </strong>注：可以指定包中任意参数，构造不同包。例如：伪造IP地址；特殊情况：活着主机，不响应包，可用ping检测
长组合语句>>> a = sr1(IP(dst="1.1.1.1")/TCP(dport=80,flags='A') ,timeout=1) Begin emission: .Finished to send 1 packets. * Received 2 packets, got 1 answers, remaining 0 packets >>> a <IP version=4L ihl=5L tos=0x0 len=40 id=56576 flags= frag=0L ttl=60 proto=tcp chksum=0xdda6 src=1.1.1.1 dst=192.168.1.127 options=[] |<TCP sport=http dport=ftp_data seq=0 ack=0 dataofs=5L reserved=0L flags=R window=0 chksum=0xeb53 urgptr=0 |<Padding load='x00x00x00x00x00x00' |>>> >>> <strong> </strong>scapy脚本（还略有小错）
#!/usr/bin/python import logging import subprocess logging.getLogger("scapy.runtime").setLevel(logging.ERROR) from scapy.all import* if len( sys.argv ) !=2: #minglingcanshubugou2 print "Usage - ./ACK_Ping.py [/24 network address]" print "Example - ./ACK_Ping.py 172.16.36.0" print "Example will perform an ACK ping scan of the 192.168.1.0/24 range" sys.exit() address = str(sys.argv[1]) prefix = address.split(".")[0] + '.' + address.split(".")[1] + '.' + address.split(".")[2] + '.' for addr in range(1,254): response=sr1(IP[dst=prefix+str(addr)]/TCP(dport=80,flags='A') ,timeout=1) try: if imt(response[TCP].<span style="color:#ff0000;">flags)==4:</span> print prefix+str(addr) except: pass
二、UDP探测【基于特征】
一种非连接的不可靠传输协议，会尽力转发包
如果目标主机不在线，不回包；如果目标端口开启，也可能不回包[若有DNS查询指令内容会响应，除非构造完整的UDP数据包，但不可行]；当主机在线，发包到其没开放的端口，会回应ICMP端口不可达，则表明其主机在线
<span style="font-size:18px;">root@kali:~# scapy WARNING: No route found for IPv6 destination :: (no default route?) Welcome to Scapy (2.3.2) >>> i=IP() >>> u=UDP() >>> >>> r=(i/u) >>> >>> r.display() ###[ IP ]### version= 4 ihl= None tos= 0x0 len= None id= 1 flags= frag= 0 ttl= 64 proto= udp chksum= None src= 127.0.0.1 dst= 127.0.0.1 options ###[ UDP ]### sport= domain dport= domain len= None chksum= None >>> r[IP].dst="192.168.1.1" >>> r[UDP].dport=7345 >>> r.display() ###[ IP ]### version= 4 ihl= None tos= 0x0 len= None id= 1 flags= frag= 0 ttl= 64 proto= udp chksum= None src= 192.168.1.127 dst= 192.168.1.1 options ###[ UDP ]### sport= domain dport= 7345 len= None chksum= None >>> a=sr1(r) Begin emission: .Finished to send 1 packets. * Received 2 packets, <span style="color:#ff0000;">got 1 answers</span>, remaining 0 packets >>> a.display() ###[ IP ]### version= 4L ihl= 5L tos= 0xc0 len= 56 id= 61178 flags= frag= 0L ttl= 64 proto= icmp chksum= 0x73a src= 192.168.1.1 dst= 192.168.1.127 options ###[ ICMP ]### type= dest-unreach code= port-unreachable chksum= 0x80e7 reserved= 0 length= 0 nexthopmtu= 0 ###[ IP in ICMP ]### version= 4L ihl= 5L tos= 0x0 len= 28 id= 1 flags= frag= 0L ttl= 64 proto= udp chksum= 0xf6ff src= 192.168.1.127 dst= 192.168.1.1 options ###[ UDP in ICMP ]### sport= domain dport= 7345 len= 8 chksum= 0x5f27 >>> </span>UDP脚本
nmap（速度快，但受少部分情况限制，总而言之，适合大多数）
在三四层扫描，处于无敌状态
UDP扫描：nmap 1.1.1.1-254 -PU53 -sn #-P U:UDP端口
ACK扫描：nmap 1.1.1.1-254 -PA80 -sn #ACK
指定地址列表：nmap -iL iplist.txt -PA80 -sn
-PE/PP/PM/PO……
Hping3（默认情况下为TCP ping）
UDP探测
<span style="font-size:18px;">root@kali:~# hping3 --udp 192.168.1.1 -c 1 HPING 192.168.1.1 (eth0 192.168.1.1): udp mode set, 28 headers + 0 data bytes ICMP Port Unreachable from ip=192.168.1.1 name=DD-WRT status=0 port=1788 seq=0 --- 192.168.1.1 hping statistic --- 1 packets transmitted, 1 packets received, 0% packet loss round-trip min/avg/max = 68.2/68.2/68.2 ms</span>UDPhing脚本for addr in $(seq 1 254); do hping3 –udp 1.1.1.$addr -c 1 >> r.txt; done
grep Unreachable r.txt | cut -d " " -f 5 | cut -d "=" -f 2
TCP探测
root@kali:~# hping3 196.168.1.1 -c 1 HPING 196.168.1.1 (eth0 196.168.1.1): NO FLAGS are set, 40 headers + 0 data bytes --- 196.168.1.1 hping statistic --- 1 packets transmitted, 0 packets received, 100% packet loss round-trip min/avg/max = 0.0/0.0/0.0 ms
小白日记，未完待续……