Reconnaissance Attacks偵察攻擊

A reconnaissance attack attempts to learn more about the intended victim before attempting a more intrusive attack. Attackers can use standard networking tools such as dig, nslookup, and whois to gather public information about a target network from DNS registries. All three are command-line tools. The nslookup and whois tools are available on Windows, UNIX, and Linux platforms, and dig is available on UNIX and Linux systems.

偵察攻擊會嘗試在發動更具侵入性的攻擊之前，先進一步了解預定的受害對象。攻擊者可以使用 dig、nslookup、whois 等標準網路工具，從 DNS 註冊機構蒐集目標網路的公開資訊。這三者都是命令列工具，其中 nslookup 與 whois 可在 Windows、UNIX 與 Linux 平台上使用，而 dig 則可在 UNIX 與 Linux 系統上使用。

The next example shows a partial output of a dig query:

接下來的範例顯示 dig 查詢的部分輸出結果：

This example shows a partial output of a nslookup query:

此範例顯示 nslookup 查詢的部分輸出結果：

The DNS queries can reveal such information as who owns a particular domain and addresses assigned to that domain. Ping sweeps of the addresses revealed by the DNS queries can present a picture of the live hosts in a particular environment. After a list of live hosts is generated, the attacker can probe further by running port scans on the live hosts. Port scanning tools can cycle through all well-known ports to provide a complete list of all services running on the hosts. The attacker can use this information to determine the easiest way to exploit a vulnerability.

DNS 查詢可以揭露某個網域的所有者，以及指派給該網域的位址等資訊。對 DNS 查詢所揭露的位址進行 ping 掃描，可以描繪出特定環境中存活主機的概況。產生存活主機清單後，攻擊者便能進一步對這些存活主機執行連接埠掃描以深入探測。連接埠掃描工具可以循環掃描所有公認連接埠，提供這些主機上所執行所有服務的完整清單。攻擊者可以利用這項資訊，找出利用某個弱點最容易的方式。

An authorized security administrator can use vulnerability scanners such as Nessus and OpenVAS to locate vulnerabilities in their own networks and patch them before being exploited. Of course, attackers can also use these tools to locate vulnerabilities before an organization even knows that they exist.

獲授權的安全管理員可以使用 Nessus 與 OpenVAS 等弱點掃描工具，在弱點被利用之前找出自身網路中的弱點並加以修補。當然，攻擊者也可以使用這些工具，在組織甚至還不知道弱點存在之前就先找出它們。