摘要
Web渗透测试是当前比较主流的网站安全测试方法,其中,信息收集工作是Web渗透测试的第一步,直接关系到整个渗透测试的质量。文章首先介绍了信息收集,然后结合实验详细阐述了信息收集中的两个主要方面,一是外部的信息收集,包括whois查询、IP地址信息查询和利用搜索引擎进行信息收集;二是利用扫描工具进行深入信息收集,包括ping工具、nmap工具和其他漏洞扫描器。该研究能为Web渗透测试的信息收集工作提供有价值的参考。
Web penetration test is the most popular method of website security testing. The information gathering is the first step of Web penetration test, and it is directly related to the quality of the entire penetration test. This paper summarizes the information gathering, and then elaborates on the two main aspects of the information gathering according to the experiment. One is the external information gathering, including the whois query, IP address information query and gathering information with the search engines; the other is the deep-going information gathering by using the scanning tools, including Ping tools, nmap tools and other vulnerability scanners. This research can provide valuable reference for information gathering of Web penetration test.
作者
郎智哲
封筱宇
董齐芬
Lang Zhizhe Feng Xiaoyu Dong Qifen(Zhejiang Police College, Hangzhou, Zhejiang 310053, China)
出处
《计算机时代》
2017年第8期13-16,共4页
Computer Era
关键词
网络安全
Web渗透测试
信息收集
扫描工具
network security
Web penetration test
information gathering
scanning tool
