{"id":32488,"date":"2016-12-26T02:00:23","date_gmt":"2016-12-25T17:00:23","guid":{"rendered":"http:\/\/n.pentest.ninja\/?p=32488"},"modified":"2016-12-28T17:33:23","modified_gmt":"2016-12-28T08:33:23","slug":"nmap%e3%82%92%e6%a4%9c%e8%a8%bc%e3%81%97%e3%81%a6%e3%81%bf%e3%81%be%e3%81%97%e3%81%9f%e3%80%90nse%e7%b7%a8%e3%80%91","status":"publish","type":"post","link":"https:\/\/n.pentest.ninja\/?p=32488","title":{"rendered":"Nmap\u3092\u691c\u8a3c\u3057\u3066\u307f\u307e\u3057\u305f\u3010NSE\u7de8\u3011"},"content":{"rendered":"
Tweet<\/a><\/div>
\n


\n\u203b\u672c\u6295\u7a3f\u306b\u8a18\u8f09\u306e\u5185\u5bb9\u3092\u81ea\u8eab\u306e\u7ba1\u7406\u4e0b\u306b\u306a\u3044\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30fb\u30b3\u30f3\u30d4\u30e5\u30fc\u30bf\u306b\u884c\u3063\u305f\u5834\u5408\u306f\u3001\u653b\u6483\u884c\u70ba\u3068\u5224\u65ad\u3055\u308c\u3001\u6700\u60aa\u306e\u5834\u5408\u3001\u6cd5\u7684\u63aa\u7f6e\u3092\u53d6\u3089\u308c\u308b\u53ef\u80fd\u6027\u3082\u3042\u308a\u307e\u3059\u3002\u540c\u5185\u5bb9\u306e\u8abf\u67fb\u3092\u884c\u308f\u308c\u308b\u5834\u5408\u306b\u306f\u3001\u5fc5\u305a\u81ea\u8eab\u306e\u7ba1\u7406\u4e0b\u306b\u3042\u308b\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u3084\u30b5\u30fc\u30d0\u30fc\u306b\u5bfe\u3057\u3066\u306e\u307f\u5b9f\u65bd\u3057\u3066\u304f\u3060\u3055\u3044\u3002
\n<\/strong><\/p>\n

\n

 <\/p>\n

\u3010\u691c\u8a3c\u6982\u8981\u3011
\nNmap\u306e\u6a5f\u80fd\u306e1\u3064\u300cNSE(Nmap Script Engine)\u300d\u306b\u3064\u3044\u3066\u3001\u4ee5\u4e0b2\u70b9\u306b\u30d5\u30a9\u30fc\u30ab\u30b9\u3092\u5408\u305b\u3066\u691c\u8a3c\u3092\u884c\u3044\u307e\u3057\u305f\u3002
\n\u30fb\u65e5\u672c\u8a9e\u8a33\u5316
\n\u30fb\u30b9\u30af\u30ea\u30d7\u30c8\u306e\u52d5\u4f5c\u78ba\u8a8d<\/p>\n

<\/p>\n

\u306a\u304a\u3001NSE\u306e\u516c\u5f0f\u30ea\u30d5\u30a1\u30ec\u30f3\u30b9\u306f\u4ee5\u4e0b\u3092\u3054\u53c2\u7167\u304f\u3060\u3055\u3044\u3002
\nhttps:\/\/nmap.org\/nsedoc\/index.html<\/a><\/p>\n

 <\/p>\n

\u3010\u691c\u8a3c\u74b0\u5883\u3011
\n\u5404\u30db\u30b9\u30c8\u306f\u691c\u8a3c\u958b\u59cb\u65e5(2016\u5e7411\u67086\u65e5)\u6642\u70b9\u3067\u306e\u3001\u4ee5\u4e0bOS\u3001Version\u3092\u4f7f\u7528\u3057\u307e\u3057\u305f\u3002
\n\u30fbNSE\u5b9f\u884c\u30db\u30b9\u30c8:Kali Linux\u3000Rolling (Nmap version 7.25 BETA1)
\n\u30fbNSE\u5b9f\u884c\u5bfe\u8c61\u30db\u30b9\u30c8\uff1a\u5404\u30b9\u30af\u30ea\u30d7\u30c8\u6bce\u306b\u5bfe\u8c61\u3068\u306a\u308b\u30db\u30b9\u30c8\u304c\u7570\u306a\u308b\u305f\u3081\u3001\u300c\u691c\u8a3c\u7d50\u679c\u8a73\u7d30\u300d\u306b\u8a18\u8f09\u3057\u3066\u3044\u307e\u3059\u3002
\n <\/p>\n

\u3010\u7dcf\u8a55\u3011
\nNSE\u306e\u5168541\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u52d5\u4f5c\u78ba\u8a8d\u3057\u305f\u4e0a\u3067\u306e\u3001\u500b\u4eba\u7684\u306a\u6240\u611f\u306f\u4ee5\u4e0b\u306e\u3068\u304a\u308a\u3067\u3059\u3002<\/p>\n

\u30fb\u51fa\u529b\u7d50\u679c\u304c\u4e0d\u89aa\u5207
\n\u4f8b\u3048\u3070\u8106\u5f31\u6027\u3092\u8abf\u67fb\u3059\u308b\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u5b9f\u884c\u3057\u305f\u969b\u3001\u5bfe\u8c61\u306b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u306b\u306f\u3001\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u8a73\u7d30\u306a\u60c5\u5831\u304c\u51fa\u529b\u3057\u307e\u3059\u304c\u3001\u5bfe\u8c61\u306b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3057\u306a\u3044\u5834\u5408\u3001\u5927\u534a\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u4f55\u3082\u8868\u793a\u3057\u307e\u305b\u3093\u3002\u305d\u306e\u305f\u3081\u3001\u5f8c\u8005\u306e\u5834\u5408\u306b\u306f\u672c\u5f53\u306b\u8106\u5f31\u6027\u304c\u306a\u3044\u306e\u304b\u3001\u3082\u3057\u304f\u306f\u5f15\u6570\u306a\u3069\u306e\u6307\u5b9a\u304c\u9593\u9055\u3063\u3066\u3044\u308b\u306e\u304b\u306e\u5224\u65ad\u304c\u3064\u304d\u8f9b\u3044\u30b1\u30fc\u30b9\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n

\u30fb\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u30b9\u30af\u30ea\u30d7\u30c8\u306e\u52d5\u4f5c\u304c\u4e0d\u5b89\u5b9a
\n\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30ab\u30c6\u30b4\u30ea\u306b\u5c5e\u3059\u308b\u30b9\u30af\u30ea\u30d7\u30c8\u306b\u3064\u3044\u3066\u3001\u51e6\u7406\u304c\u7d42\u4e86\u3057\u306a\u304b\u3063\u305f\u308a\u3001\u6709\u52b9\u3067\u306a\u3044\u8a8d\u8a3c\u60c5\u5831\u304c\u6709\u52b9\u3067\u3042\u308b\u3068\u5224\u65ad\u3055\u308c\u305f\u308a\u306a\u3069\u3001\u52d5\u4f5c\u304c\u4e0d\u5b89\u5b9a\u306a\u30b1\u30fc\u30b9\u304c\u6563\u898b\u3057\u307e\u3057\u305f\u3002
\n\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u5b9f\u884c\u306b\u306f\u5bfe\u8c61\u306e\u30d7\u30ed\u30c8\u30b3\u30eb\u304c\u30b5\u30dd\u30fc\u30c8\u3055\u308c\u3066\u3044\u308b\u306e\u3067\u3042\u308c\u3070\u3001Ncrack\u306a\u3069\u4ed6\u30c4\u30fc\u30eb\u3092\u4f7f\u3046\u4e8b\u304c\u671b\u307e\u3057\u3044\u3068\u8003\u3048\u307e\u3059\u3002<\/p>\n

\u30fb\u7c21\u6613\u8106\u5f31\u6027\u8abf\u67fb\u3001\u30b5\u30fc\u30d3\u30b9\u306e\u8a73\u7d30\u60c5\u5831\u53d6\u5f97\u30c4\u30fc\u30eb\u3068\u3057\u3066\u306f\u975e\u5e38\u306b\u512a\u79c0
\n\u624b\u8efd\u304b\u3064\u7c21\u5358\u306b\u5b9f\u884c\u3067\u304d\u308b\u305f\u3081\u3001\u30d4\u30f3\u30dd\u30a4\u30f3\u30c8\u306a\u8106\u5f31\u6027\u3092\u8abf\u67fb\u3059\u308b\u306b\u306f\u3001\u975e\u5e38\u306b\u512a\u308c\u305f\u30c4\u30fc\u30eb\u3067\u3042\u308b\u3068\u8003\u3048\u307e\u3059\u3002\u307e\u305f\u3001Nmap\u306e\u901a\u5e38\u30aa\u30d7\u30b7\u30e7\u30f3\u4ee5\u4e0a\u306e\u60c5\u5831\u3092\u53d6\u5f97\u3059\u308b\u3053\u3068\u304c\u53ef\u80fd\u306a\u305f\u3081\u3001Nmap\u5b9f\u884c\u5f8c\u3001\u3055\u3089\u306a\u308b\u60c5\u5831\u53ce\u96c6\u3092\u8a66\u307f\u308b\u969b\u306b\u3082\u6709\u52b9\u3067\u3059\u3002
\n <\/p>\n

\u3010\u691c\u8a3c\u7d50\u679c\u8a73\u7d30\u3011
\n\u4ee5\u4e0b\u306b\u5404\u30b9\u30af\u30ea\u30d7\u30c8\u540d\u3001\u30b9\u30af\u30ea\u30d7\u30c8\u306e\u8aac\u660e\u3001\u304a\u3088\u3073\u30b9\u30af\u30ea\u30d7\u30c8\u5b9f\u884c\u30b3\u30de\u30f3\u30c9\u3092\u8a18\u8f09\u3057\u307e\u3059\u3002
\n\u306a\u304a\u3001\u5b9f\u884c\u30b3\u30de\u30f3\u30c9\u306b\u3064\u3044\u3066\u4ee5\u4e0b\u30b3\u30e1\u30f3\u30c8\u3092\u3054\u78ba\u8a8d\u304f\u3060\u3055\u3044\u3002<\/p>\n

\u30fb\u300c\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f\u300d\u306e\u30b3\u30de\u30f3\u30c9\u306b\u3064\u3044\u3066
\n\u3000\u51fa\u529b\u7d50\u679c\u306b\u3064\u3044\u3066\u3001\u516c\u5f0f\u30ea\u30d5\u30a1\u30ec\u30f3\u30b9\u306e\u300cScript Output\u300d\u306b\u985e\u4f3c\u3059\u308b\u7d50\u679c\u304c\u8fd4\u3055\u308c\u305f\u30b1\u30fc\u30b9\u3092\u6307\u3057\u307e\u3059\u3002<\/p>\n

\u30fb\u300c\u5b9f\u884c\u78ba\u8a8d\u307e\u3067\u300d\u30b3\u30de\u30f3\u30c9\u306b\u3064\u3044\u3066
\n\u3000\u30b3\u30de\u30f3\u30c9\u5b9f\u884c\u6642\u3001\u30a8\u30e9\u30fc\u51fa\u529b\u304c\u306a\u3044\u3068\u3053\u308d\u307e\u3067\u3092\u78ba\u8a8d\u3057\u305f\u30b1\u30fc\u30b9\u3092\u6307\u3057\u307e\u3059\u3002<\/p>\n

\u30fb\u300c\\(\u30d0\u30c3\u30af\u30b9\u30e9\u30c3\u30b7\u30e5)\u300d
\n\u3000\u672c\u30d6\u30ed\u30b0\u306e\u6539\u884c\u306b\u5408\u308f\u305b\u3066\u633f\u5165\u3057\u3066\u3044\u307e\u3059\u3002
\n\u3000\u672c\u6295\u7a3f\u8a18\u8f09\u306e\u5b9f\u884c\u30b3\u30de\u30f3\u30c9\u306b\u57fa\u3065\u3044\u3066\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u5b9f\u884c\u3055\u308c\u308b\u969b\u306f\u3001\u6539\u884c\u30b3\u30fc\u30c9\u304a\u3088\u3073\u540c\u8a18\u53f7\u3092\u53d6\u308a\u9664\u3044\u305f\u4e0a\u3067\u5b9f\u884c\u304f\u3060\u3055\u3044\u3002<\/p>\n

\u30fb\u69cb\u6587
\n\u3000\u5b9f\u884c\u30b3\u30de\u30f3\u30c9\u306f\u6982\u306d\u4ee5\u4e0b\u306e\u69cb\u6587\u3067\u8a18\u8f09\u3057\u3066\u3044\u307e\u3059\u3002
\n\u3000\u300cnmap\u300d\u4ee5\u5916\u306e\u30b3\u30de\u30f3\u30c9\u30aa\u30d7\u30b7\u30e7\u30f3\u306f\u9806\u4e0d\u540c\u3067\u3059\u3002<\/p>\n

\u3000nmap [nmap\u30aa\u30d7\u30b7\u30e7\u30f3] [\u30b9\u30af\u30ea\u30d7\u30c8\u540d] [\u30b9\u30af\u30ea\u30d7\u30c8\u5f15\u6570] [\u5bfe\u8c61IP\u30a2\u30c9\u30ec\u30b9] [\u5bfe\u8c61TCP\/UDP\u30dd\u30fc\u30c8]<\/p>\n

\u203b\u5404\u30d5\u30a1\u30a4\u30eb\u306e\u4fdd\u7ba1\u5834\u6240
\n\u3000\u30fb\u30b9\u30af\u30ea\u30d7\u30c8\uff1a\u300c\/usr\/share\/nmap\/scripts\u300d
\n\u3000\u30fb\u30e9\u30a4\u30d6\u30e9\u30ea\uff1a\u300c\/usr\/share\/nmap\/nselib\u300d<\/p>\n

 <\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\u30b9\u30af\u30ea\u30d7\u30c8\u540d<\/td>\n\u30b9\u30af\u30ea\u30d7\u30c8\u306e\u8aac\u660e<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9<\/td>\n<\/tr>\n
acarsd-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

acars\u30c7\u30fc\u30e2\u30f3\u304b\u3089\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002acarsd\u306f\u30ea\u30a2\u30eb\u30bf\u30a4\u30e0\u3067ACARS(Aircraft Communication Addressing and Reporting System, \u822a\u7a7a\u6a5f\u3068\u5730\u4e0a\u5c40\u306e\u9593\u3067\u30c7\u30fc\u30bf\u3092\u3084\u308a\u53d6\u308a\u3059\u308b\u30b7\u30b9\u30c6\u30e0)\u306e\u30c7\u30fc\u30bf\u3092\u5fa9\u53f7\u3059\u308b\u30c7\u30fc\u30e2\u30f3\u3067\u3059\u3002\u306a\u304a\u3001\u3053\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u3067\u53d6\u5f97\u3067\u304d\u308b\u60c5\u5831\u306f\u4ee5\u4e0b\u306e\u901a\u308a\u3067\u3059\u3002
\n\u30fb\u30c7\u30fc\u30e2\u30f3\u306e\u30d0\u30fc\u30b8\u30e7\u30f3
\n\u30fbAPI\u306e\u30d0\u30fc\u30b8\u30e7\u30f3
\n\u30fb\u7ba1\u7406\u8005\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9
\n\u30fb\u53d7\u4fe1\u5468\u6ce2\u6570<\/td>\n		\u5bfe\u8c61
\nWindows7\/acarsd Ver1.6.5
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script acarsd-info \\
\n–script-args \\
\n“acarsd-info.timeout=10, \\
\nacarsd-info.bytes=512” \\
\n192.168.110.1 -p 2202<\/td>\n<\/tr>\n
address-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, safe<\/td>\n

IPv6\u30a2\u30c9\u30ec\u30b9\u306e\u8ffd\u52a0\u60c5\u5831\u3068\u3057\u3066\u3001\u4f7f\u7528\u53ef\u80fd\u306aMAC\u30a2\u30c9\u30ec\u30b9\u307e\u305f\u306fIPv4\u30a2\u30c9\u30ec\u30b9\u8868\u793a\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV -sC 192.168.110.1<\/td>\n<\/tr>\n
afp-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

AFP(Apple Filing Protocol)\u306b\u5bfe\u3057\u3066\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMac OSX 10.9.5
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script afp-brute \\
\n192.168.110.1 -p 548<\/td>\n<\/tr>\n
afp-ls<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

AFP(Apple Filing Protocol)\u30dc\u30ea\u30e5\u30fc\u30e0\u304b\u3089\u30d5\u30a1\u30a4\u30eb\u306b\u95a2\u3059\u308b\u6709\u7528\u306a\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u51fa\u529b\u306f\u3001”ls”\u30b3\u30de\u30f3\u30c9\u306e\u51fa\u529b\u7d50\u679c\u306b\u4f3c\u305f\u5f62\u5f0f\u3067\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMac OSX 10.9.5
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sS -sV –script afp-ls \\
\n–script-args \\
\n“afp.username=’admin’, \\
\nafp.password=’123456′” \\
\n192.168.110.1 -p 548<\/td>\n<\/tr>\n
afp-path-vuln<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, intrusive, vuln<\/td>\n

Mac OS X\u306eAFP\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u306e\u8106\u5f31\u6027\u3001\u300cCVE-2010-0533\u300d\u306e\u6709\u7121\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMac OSX 10.9.5
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV –script afp-path-vuln \\
\n192.168.110.1 -p 548<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

afp-serverinfo<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

AFP\u30b5\u30fc\u30d0\u306e\u4ee5\u4e0b\u60c5\u5831\u3092\u8868\u793a\u3057\u307e\u3059\u3002
\n\u30fb\u30b5\u30fc\u30d0\u306e\u30db\u30b9\u30c8\u540d
\n\u30fbIPv4\u30a2\u30c9\u30ec\u30b9\u304a\u3088\u3073IPv6\u30a2\u30c9\u30ec\u30b9
\n\u30fb\u30cf\u30fc\u30c9\u30a6\u30a7\u30a2\u30bf\u30a4\u30d7
\n(\u4f8b\u3048\u3070\u3001Macmini\u3084MacBookPro\u306a\u3069)<\/td>\n		\u5bfe\u8c61
\nMac OSX 10.9.5
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV -sC 192.168.110.1 -p 548<\/td>\n<\/tr>\n
afp-showmount<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

AFP\u5171\u6709\u3068ACL\u306e\u60c5\u5831\u3092\u8868\u793a\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMac OSX 10.9.5
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV –script afp-showmount \\
\n–script-args “afp.username=’admin’, \\
\nafp.password=’123456′” \\
\n192.168.110.1 -p 548<\/td>\n<\/tr>\n
ajp-auth<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, default, safe<\/td>\n

\u8a8d\u8a3c\u3092\u5fc5\u8981\u3068\u3059\u308bAJP\u30b5\u30fc\u30d3\u30b9(Apache JServ\u30d7\u30ed\u30c8\u30b3\u30eb)\u3088\u308a\u3001\u8a8d\u8a3c\u65b9\u5f0f\u3068\u30ec\u30eb\u30e0\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script ajp-auth \\
\n192.168.110.1 -p 8009<\/td>\n<\/tr>\n
ajp-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

Apache JServ\u30d7\u30ed\u30c8\u30b3\u30eb\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002(Apache JServ\u30d7\u30ed\u30c8\u30b3\u30eb\u306f\u3001\u4e00\u822c\u7684\u306b\u30d0\u30c3\u30af\u30a8\u30f3\u30c9\u306eJava\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u30b5\u30fc\u30d0\u30b3\u30f3\u30c6\u30ca\u3068\u901a\u4fe1\u3059\u308b\u305f\u3081\u306bWeb\u30b5\u30fc\u30d0\u306b\u3066\u4f7f\u7528\u3055\u308c\u307e\u3059\u3002)<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script ajp-brute \\
\n192.168.110.1 -p 8009<\/td>\n<\/tr>\n
ajp-headers<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

HEAD\u3001\u307e\u305f\u306fApacheJServ\u30d7\u30ed\u30c8\u30b3\u30eb\u30b5\u30fc\u30d0\u306e\u30eb\u30fc\u30c8\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u30fb\u4efb\u610f\u306e\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u306b\u5bfe\u3059\u308bGET\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u5b9f\u884c\u3057\u3001\u30b5\u30fc\u30d0\u306e\u30ec\u30b9\u30dd\u30f3\u30b9\u30d8\u30c3\u30c0\u3092\u51fa\u529b\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script ajp-headers \\
\n192.168.110.1 -p 8009<\/td>\n<\/tr>\n
ajp-methods<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, safe<\/td>\n

AJP(Apache Jserv\u30d7\u30ed\u30c8\u30b3\u30eb)\u30b5\u30fc\u30d0\u306bOPTIONS\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u9001\u4fe1\u3059\u308b\u3053\u3068\u306b\u3088\u308a\u3001\u540c\u30b5\u30fc\u30d0\u304c\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u3044\u308b\u30aa\u30d7\u30b7\u30e7\u30f3\u306e\u691c\u51fa\u304a\u3088\u3073\u6f5c\u5728\u7684\u306b\u5371\u967a\u306a\u30e1\u30bd\u30c3\u30c9\u306e\u30ea\u30b9\u30c8\u5316\u3092\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script ajp-methods \\
\n192.168.110.1 -p 8009<\/td>\n<\/tr>\n
ajp-request<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

Apache JServ\u30d7\u30ed\u30c8\u30b3\u30eb\u7d4c\u7531\u3067URI\u3092\u8981\u6c42\u3057\u3001\u7d50\u679c\u3092\u8868\u793a\u307e\u305f\u306f\u30d5\u30a1\u30a4\u30eb\u3078\u51fa\u529b\u3057\u307e\u3059\u3002\u7570\u306a\u308bAJP\u30e1\u30bd\u30c3\u30c9(GET\u3001HEAD\u3001TRACE\u3001PUT\u307e\u305f\u306fDELETE\u306a\u3069)\u3092\u4f7f\u7528\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script ajp-methods \\
\n192.168.110.1 -p 8009<\/td>\n<\/tr>\n
allseeingeye-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe, version<\/td>\n

“All-Seeing Eye”\u30b5\u30fc\u30d3\u30b9\u203b\u3092\u691c\u51fa\u3057\u307e\u3059\u3002\u540c\u30b5\u30fc\u30d3\u30b9\u306f\u30b5\u30fc\u30d0\u306e\u30b9\u30c6\u30fc\u30bf\u30b9\u3092\u7167\u4f1a\u3059\u308b\u305f\u3081\u306b\u3044\u304f\u3064\u304b\u306e\u30b2\u30fc\u30e0\u30b5\u30fc\u30d0\u306b\u3088\u3063\u3066\u63d0\u4f9b\u3055\u308c\u307e\u3059\u3002\u203b\u4e16\u754c\u4e2d\u306b\u3042\u308b\u30aa\u30f3\u30e9\u30a4\u30f3\u5bfe\u6226\u30b2\u30fc\u30e0\u7528\u306e\u30b5\u30fc\u30d0\u3092\u63a2\u3059\u30b5\u30fc\u30d3\u30b9<\/td>\n“All-Seeing Eye”\u30b5\u30fc\u30d3\u30b9\u7d42\u4e86\u306e\u305f\u3081\u5229\u7528\u4e0d\u53ef\u3002<\/td>\n<\/tr>\n
amqp-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe, version<\/td>\n

AMQP(advanced message queuing protocol)\u30b5\u30fc\u30d0\u304b\u3089\u60c5\u5831(\u3059\u3079\u3066\u306e\u30b5\u30fc\u30d0\u306e\u30d7\u30ed\u30d1\u30c6\u30a3\u306e\u30ea\u30b9\u30c8)\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script amqp-info \\
\n192.168.110.1 -p 5672<\/td>\n<\/tr>\n
asn-query<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, external, safe<\/td>\n

IP\u30a2\u30c9\u30ec\u30b9\u3092\u81ea\u5f8b\u30b7\u30b9\u30c6\u30e0(AS)\u756a\u53f7\u306b\u30de\u30c3\u30d4\u30f3\u30b0\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script asn-query 192.168.110.1<\/td>\n<\/tr>\n
auth-owners<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, safe<\/td>\n

\u8a8d\u8a3c\u30c7\u30fc\u30e2\u30f3\u3092\u7167\u4f1a\u3057\u3001\u7a7a\u3044\u3066\u3044\u308bTCP\u30dd\u30fc\u30c8\u306e\u6240\u6709\u8005\u3092\u767a\u898b\u3057\u307e\u3059\u3002\u540c\u8a8d\u8a3c\u30b5\u30fc\u30d3\u30b9(identd)\u306f\u3001\u901a\u5e38TCP113\u30dd\u30fc\u30c8\u3067\u5b9f\u884c\u3055\u308c\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV -sC 192.168.110.1<\/td>\n<\/tr>\n
auth-spoof<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nmalware, safe<\/td>\n

\u8fd4\u4fe1\u5185\u5bb9\u3092\u306a\u308a\u3059\u307e\u3057\u3066\u3001identd(\u8a8d\u8a3c)\u30b5\u30fc\u30d0\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV –script=auth-spoof \\
\n192.168.110.1<\/td>\n<\/tr>\n
backorifice-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

“BackOrifice”\u30b5\u30fc\u30d3\u30b9\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002(\u5f15\u6570\u5fc5\u9808)<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script backorifice-brute \\
\n–script-args \\
\nbackorifice-brute.ports=31337 \\
\n192.168.110.1 -p 31337<\/td>\n<\/tr>\n
backorifice-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

“BackOrifice”\u30b5\u30fc\u30d3\u30b9\u306b\u63a5\u7d9a\u3057\u3001\u30db\u30b9\u30c8\u3068BackOrifice\u30b5\u30fc\u30d3\u30b9\u306e\u60c5\u5831\u3092\u53ce\u96c6\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script backorifice-info \\
\n–script-args \\
\nbackorifice-info.password=password \\ 192.168.110.1<\/td>\n<\/tr>\n
bacnet-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, version<\/td>\n

\u6a19\u6e96\u306e\u8981\u6c42\u306b\u57fa\u3065\u3044\u3066\u30c7\u30d0\u30a4\u30b9\u60c5\u5831\u3092\u53ce\u96c6\u3057\u3001”BACnet”(\u30d3\u30eb\u30c7\u30a3\u30f3\u30b0\u30cd\u30c3\u30c8\u30ef\u30fc\u30af)\u7528\u306e\u30c7\u30d0\u30a4\u30b9\u3092\u691c\u51fa\u3057\u307e\u3059\u3002
\n\u30c7\u30d0\u30a4\u30b9\u304c\u4ed5\u69d8\u306b\u53b3\u5bc6\u306b\u5f93\u308f\u306a\u3044\u304b\u3001\u53e4\u3044\u30d0\u30fc\u30b8\u30e7\u30f3\u306e\u4ed5\u69d8\u306b\u57fa\u3065\u3044\u3066\u3044\u308b\u30b1\u30fc\u30b9\u304c\u3042\u308a\u3001\u3053\u306e\u5834\u5408\u3001BACNET\u30a8\u30e9\u30fc\u5fdc\u7b54\u306b\u3064\u306a\u304c\u308b\u3053\u3068\u304c\u3042\u308a\u307e\u3059\u3002\u540c\u30a8\u30e9\u30fc\u304c\u3042\u308b\u5834\u5408\u3001\u30c7\u30d0\u30a4\u30b9\u304cBACNet\u30c7\u30d0\u30a4\u30b9\u3067\u3042\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u304c\u3001\u51fa\u529b\u306f\u3057\u307e\u305b\u3093\u3002<\/td>\n		\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script bacnet-info \\
\n192.168.110.1 -p 47808<\/td>\n<\/tr>\n
banner<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

\u30d0\u30ca\u30fc\u30b0\u30e9\u30d0\u3002
\nOpen\u3057\u3066\u3044\u308bTCP\u30dd\u30fc\u30c8\u306b\u63a5\u7d9a\u3057\u30015\u79d2\u4ee5\u5185\u306b\u30ea\u30b9\u30cb\u30f3\u30b0\u4e2d\u306e\u30b5\u30fc\u30d3\u30b9\u306b\u3088\u3063\u3066\u9001\u4fe1\u3055\u308c\u305f\u3082\u306e\u3092\u51fa\u529b\u3057\u307e\u3059\u3002<\/td>\n		\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV –script banner 192.168.110.1<\/td>\n<\/tr>\n
bitcoin-getaddr<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

\u30d3\u30c3\u30c8\u30b3\u30a4\u30f3\u30b5\u30fc\u30d0\u306b\u65e2\u77e5\u306e\u30d3\u30c3\u30c8\u30b3\u30a4\u30f3\u30ce\u30fc\u30c9\u306e\u30ea\u30b9\u30c8\u3092\u554f\u3044\u5408\u308f\u305b\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script bitcoin-getaddr \\
\n192.168.110.1 -p 8333<\/td>\n<\/tr>\n
bitcoin-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

\u30d3\u30c3\u30c8\u30b3\u30a4\u30f3\u30b5\u30fc\u30d0\u304b\u3089\u30d0\u30fc\u30b8\u30e7\u30f3\u3068\u30ce\u30fc\u30c9\u60c5\u5831\u3092\u62bd\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script bitcoin-info \\
\n192.168.110.1 -p 8333<\/td>\n<\/tr>\n
bitcoinrpc-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

\u30d3\u30c3\u30c8\u30b3\u30a4\u30f3\u30b5\u30fc\u30d0\u306eJSON-RPC\u30a4\u30f3\u30bf\u30d5\u30a7\u30fc\u30b9\u306b\u3066”getinfo”\u3092\u547c\u3073\u51fa\u3059\u3053\u3068\u306b\u3088\u308a\u3001\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script bitcoinrpc-info \\
\n–script-args \\
\ncreds.global=admin:admin \\
\n192.168.110.1 -p 8332<\/td>\n<\/tr>\n
bittorrent-discovery<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

\u30e6\u30fc\u30b6\u63d0\u4f9b\u306e\u30c8\u30ec\u30f3\u30c8\u30d5\u30a1\u30a4\u30eb\u307e\u305f\u306f\u30de\u30b0\u30cd\u30c3\u30c8\u30ea\u30f3\u30af\u306b\u57fa\u3065\u3044\u3066\u30d5\u30a1\u30a4\u30eb\u3092\u5171\u6709\u3059\u308b\u30d3\u30c3\u30c8\u30c8\u30ec\u30f3\u30c8\u30d4\u30a2\u3092\u691c\u51fa\u3057\u307e\u3059\u3002 \u30d3\u30c3\u30c8\u30c8\u30ec\u30f3\u30c8\u30d4\u30a2\u306f\u30d3\u30c3\u30c8\u30c8\u30ec\u30f3\u30c8\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u5b9f\u88c5\u3057\u3001\u30c8\u30ec\u30f3\u30c8\u3092\u5171\u6709\u3057\u307e\u3059\u304c\u3001\u30ce\u30fc\u30c9(\u5f15\u6570”include-nodes”\u304c\u6307\u5b9a\u3055\u308c\u3066\u3044\u308b\u5834\u5408\u306e\u307f\u8868\u793a)\u306fDHT\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u5b9f\u88c5\u3057\u3001\u30d4\u30a2\u3092\u30c8\u30e9\u30c3\u30ad\u30f3\u30b0\u3059\u308b\u305f\u3081\u306b\u4f7f\u7528\u3055\u308c\u307e\u3059\u3002\u30d4\u30a2\u3068\u30ce\u30fc\u30c9\u306e\u30bb\u30c3\u30c8\u306f\u540c\u3058\u3067\u306f\u3042\u308a\u307e\u305b\u3093\u304c\u3001\u901a\u5e38\u306f\u4ea4\u5dee\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script bittorrent-discovery \\
\n–script-args newtargets, \\
\nbittorrent-discovery.torrent=\\
\nCentOS-6.4-i386-bin-DVD1to2.torrent<\/td>\n<\/tr>\n
bjnp-discover<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

BJNP\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u30b5\u30dd\u30fc\u30c8\u3059\u308b\u30ea\u30e2\u30fc\u30c8\u30c7\u30d0\u30a4\u30b9\u304b\u3089\u306e\u30d7\u30ea\u30f3\u30bf\u3084\u30b9\u30ad\u30e3\u30ca\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u540c\u30d7\u30ed\u30c8\u30b3\u30eb\u306f\u3001\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30d9\u30fc\u30b9\u306eCanon\u30c7\u30d0\u30a4\u30b9\u304c\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script bjnp-discover \\
\n192.168.110.1 -p 8611,8612<\/td>\n<\/tr>\n
broadcast-ataoe-discover<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, safe<\/td>\n

\u30a4\u30fc\u30b5\u30cd\u30c3\u30c8\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u4ecb\u3057\u3066ATA\u3092\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u3044\u308b\u30b5\u30fc\u30d0\u3092\u691c\u51fa\u3057\u307e\u3059\u3002”ATA over Ethernet”\u306f”Brantley Coile”\u793e\u306b\u3088\u3063\u3066\u958b\u767a\u3055\u308c\u305f\u30a4\u30fc\u30b5\u30cd\u30c3\u30c8\u30d7\u30ed\u30c8\u30b3\u30eb\u3067\u3042\u308a\u3001\u30a4\u30fc\u30b5\u30cd\u30c3\u30c8\u4e0a\u3067\u306eSATA\u30c9\u30e9\u30a4\u30d6\u3078\u306e\u7c21\u5358\u3001\u9ad8\u6027\u80fd\u306e\u30a2\u30af\u30bb\u30b9\u3092\u53ef\u80fd\u306b\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nbroadcast-ataoe-discover \\
\n-e eth0<\/td>\n<\/tr>\n
broadcast-avahi-dos<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, dos, intrusive, vuln<\/td>\n

DNS Service Discovery\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u4f7f\u7528\u3057\u3066\u3001\u30ed\u30fc\u30ab\u30eb\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u5185\u306e\u30db\u30b9\u30c8\u3092\u767a\u898b\u3002\u5404\u30db\u30b9\u30c8\u306bNULL UDP\u30d1\u30b1\u30c3\u30c8\u3092\u9001\u4fe1\u3057\u30db\u30b9\u30c8\u306bAvahi\u30c7\u30fc\u30e2\u30f3\u306eNULL UDP\u30d1\u30b1\u30c3\u30c8\u306b\u3088\u308b\u30b5\u30fc\u30d3\u30b9\u62d2\u5426\u306e\u8106\u5f31\u6027(CVE-2011-1002)\u304c\u5b58\u5728\u3059\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script=broadcast-avahi-dos<\/td>\n<\/tr>\n
broadcast-bjnp-discover<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, safe<\/td>\n

“BJNP Discovery”\u8981\u6c42\u3092\u3001\u30d7\u30ed\u30c8\u30b3\u30eb\u306b\u95a2\u9023\u3059\u308b\u30dd\u30fc\u30c8\u306e\u30d6\u30ed\u30fc\u30c9\u30ad\u30e3\u30b9\u30c8\u30a2\u30c9\u30ec\u30b9\u306b\u9001\u4fe1\u3057\u3001BJNP\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u30b5\u30dd\u30fc\u30c8\u3059\u308bCanon\u30c7\u30d0\u30a4\u30b9(\u30d7\u30ea\u30f3\u30bf\/\u30b9\u30ad\u30e3\u30ca)\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script broadcast-bjnp-discover<\/td>\n<\/tr>\n
broadcast-db2-discover<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, safe<\/td>\n

UDP523\u30dd\u30fc\u30c8\u3078\u30d6\u30ed\u30fc\u30c9\u30ad\u30e3\u30b9\u30c8\u3092\u9001\u4fe1\u3057\u3001\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u4e0a\u306eDB2\u30b5\u30fc\u30d0\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script broadcast-db2-discover<\/td>\n<\/tr>\n
broadcast-dhcp6-discover<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, safe<\/td>\n

DHCPv6\u306e\u30de\u30eb\u30c1\u30ad\u30e3\u30b9\u30c8\u30a2\u30c9\u30ec\u30b9\u306bDHCPv6\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u9001\u4fe1\u3057\u3001\u5fdc\u7b54\u3092\u89e3\u6790\u3002\u30b5\u30fc\u30d0\u304b\u3089\u8fd4\u3055\u308c\u305f\u30aa\u30d7\u30b7\u30e7\u30f3\u304a\u3088\u3073\u30a2\u30c9\u30ec\u30b9\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -6 –script \\
\nbroadcast-dhcp6-discover<\/td>\n<\/tr>\n
broadcast-dhcp-discover<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, safe<\/td>\n

\u30d6\u30ed\u30fc\u30c9\u30ad\u30e3\u30b9\u30c8\u30a2\u30c9\u30ec\u30b9(255.255.255.255)\u306bDHCP\u8981\u6c42\u3092\u9001\u4fe1\u3057\u307e\u3059\u3002(\u30b9\u30b3\u30fc\u30d7\u306e\u67af\u6e07\u3092\u9632\u3050\u305f\u3081\u3001MAC\u30a2\u30c9\u30ec\u30b9\u306f\u9759\u7684\u30a2\u30c9\u30ec\u30b9(DE:AD:CO:DE:CA:FE)\u3092\u4f7f\u7528\u3057\u307e\u3059\u3002)<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script broadcast-dhcp-discover<\/td>\n<\/tr>\n
broadcast-dns-service-discovery<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, safe<\/td>\n

“DNS Service Discovery”\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u4f7f\u7528\u3057\u3066\u3001\u30db\u30b9\u30c8\u306e\u30b5\u30fc\u30d3\u30b9\u3092\u767a\u898b\u3057\u307e\u3059\u3002(\u30de\u30eb\u30c1\u30ad\u30e3\u30b9\u30c8”DNS-SD”\u30af\u30a8\u30ea\u3092\u9001\u4fe1\u3057\u3001\u305d\u306e\u5fdc\u7b54\u3092\u53ce\u96c6\u3057\u307e\u3059\u3002)<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nbroadcast-dns-service-discovery<\/td>\n<\/tr>\n
broadcast-dropbox-listener<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, safe<\/td>\n

Dropbox.com\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u304c20\u79d2\u3054\u3068\u306b\u30d6\u30ed\u30fc\u30c9\u30ad\u30e3\u30b9\u30c8\u3059\u308b”LAN sync information broadcasts”\u3092\u53d7\u4fe1\u3057\u3001\u53d6\u5f97\u3057\u305f\u3059\u3079\u3066\u306e\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306eIP\u30a2\u30c9\u30ec\u30b9\u3001\u30dd\u30fc\u30c8\u756a\u53f7\u3001\u30d0\u30fc\u30b8\u30e7\u30f3\u756a\u53f7\u3001\u8868\u793a\u540d\u306a\u3069\u3092\u51fa\u529b\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nbroadcast-dropbox-listener<\/td>\n<\/tr>\n
broadcast-eigrp-discovery<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, discovery, safe<\/td>\n

\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u63a2\u7d22\u3068EIGRP(Cisco\u72ec\u81ea\u306e\u30eb\u30fc\u30c6\u30a3\u30f3\u30b0\u30d7\u30ed\u30c8\u30b3\u30eb)\u3092\u4ecb\u3057\u3066\u3001\u30eb\u30fc\u30c6\u30a3\u30f3\u30b0\u60c5\u5831\u3092\u53ce\u96c6\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nCisco806 Version 12.2(8)
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script \\
\nbroadcast-eigrp-discovery<\/p>\n

\u203bEIGRP\u306edead\u30bf\u30a4\u30de\u304c\u30c7\u30d5\u30a9\u30eb\u30c8\u306e15\u79d2\u306e\u969b\u306f\u60c5\u5831\u53d6\u5f97\u4e0d\u53ef\u3067\u3057\u305f\u3002
\n(\u30b3\u30de\u30f3\u30c9\u5b9f\u884c\u6642\u306fdead\u30bf\u30a4\u30de\u309230\u79d2\u306b\u8a2d\u5b9a\u3002)<\/td>\n<\/tr>\n

broadcast-igmp-discovery<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, discovery, safe<\/td>\n

IGMP\u30de\u30eb\u30c1\u30ad\u30e3\u30b9\u30c8\u30e1\u30f3\u30d0\u30b7\u30c3\u30d7\u3092\u6301\u3064\u30bf\u30fc\u30b2\u30c3\u30c8\u3092\u691c\u51fa\u3057\u3001\u60c5\u5831\u53ce\u96c6\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script \\
\nbroadcast-igmp-discovery<\/td>\n<\/tr>\n
broadcast-listener<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, safe<\/td>\n

\u30d6\u30ed\u30fc\u30c9\u30ad\u30e3\u30b9\u30c8\u901a\u4fe1\u3092\u76d7\u8074\u3057\u3001\u53d7\u4fe1\u3057\u305f\u30d1\u30b1\u30c3\u30c8\u3092\u5fa9\u53f7\u3057\u307e\u3059\u3002\u540c\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001CDP\u3001HSRP\u3001Spotify\u3001DropBox\u3001DHCP\u3001ARP\u306a\u3069\u306e\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u3044\u307e\u3059\u3002\u8a73\u7d30\u306b\u3064\u3044\u3066\u306f\u3001”packetdecoders.lua”\u3092\u53c2\u7167\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script broadcast-listener -e eth0<\/td>\n<\/tr>\n
broadcast-ms-sql-discover<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, safe<\/td>\n

\u540c\u3058\u30d6\u30ed\u30fc\u30c9\u30ad\u30e3\u30b9\u30c8\u30c9\u30e1\u30a4\u30f3\u5185\u306eMicrosoft SQL\u30b5\u30fc\u30d0\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nbroadcast-ms-sql-discover<\/td>\n<\/tr>\n
broadcast-netbios-master-browser<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, safe<\/td>\n

\u30de\u30b9\u30bf\u30d6\u30e9\u30a6\u30b6\u3068\u305d\u306e\u30de\u30b9\u30bf\u304c\u7ba1\u7406\u3059\u308b\u30c9\u30e1\u30a4\u30f3\u3092\u767a\u898b\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nbroadcast-netbios-master-browser<\/td>\n<\/tr>\n
broadcast-networker-discover<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, safe<\/td>\n

\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30d6\u30ed\u30fc\u30c9\u30ad\u30e3\u30b9\u30c8\u30af\u30a8\u30ea\u3092\u9001\u4fe1\u3057\u3001LAN\u4e0a\u306eEMC Networker\u306e\u30d0\u30c3\u30af\u30a2\u30c3\u30d7\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u30b5\u30fc\u30d0\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nbroadcast-networker-discover<\/td>\n<\/tr>\n
broadcast-novell-locate<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, safe<\/td>\n

\u30b5\u30fc\u30d3\u30b9\u30ed\u30b1\u30fc\u30b7\u30e7\u30f3\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u4f7f\u7528\u3057\u3001Novell\u306eNetWare Core Protocol(NCP)\u30b5\u30fc\u30d0\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV –script \\
\nbroadcast-novell-locate 192.168.110.1<\/td>\n<\/tr>\n
broadcast-pc-anywhere<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, safe<\/td>\n

\u7279\u6b8a\u306a\u30d6\u30ed\u30fc\u30c9\u30ad\u30e3\u30b9\u30c8\u3092\u9001\u4fe1\u3057\u3001LAN\u4e0a\u3067PC-Anywhere\u304c\u52d5\u4f5c\u3057\u3066\u3044\u308b\u30db\u30b9\u30c8\u3092\u767a\u898b\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script broadcast-pc-anywhere<\/td>\n<\/tr>\n
broadcast-pc-duo<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, safe<\/td>\n

\u7279\u6b8a\u306aUDP\u306e\u30d6\u30ed\u30fc\u30c9\u30ad\u30e3\u30b9\u30c8\u3092\u9001\u4fe1\u3057\u3001LAN\u4e0a\u3067\u52d5\u4f5c\u3057\u3066\u3044\u308bPC-DUO\u30ea\u30e2\u30fc\u30c8\u30b3\u30f3\u30c8\u30ed\u30fc\u30eb\u30db\u30b9\u30c8\u3068\u30b2\u30fc\u30c8\u30a6\u30a7\u30a4\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script broadcast-pc-duo<\/td>\n<\/tr>\n
broadcast-pim-discovery<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, discovery, safe<\/td>\n

PIM(Protocol Independent Multicast)\u3092\u5b9f\u884c\u3057\u3066\u3044\u308b\u30eb\u30fc\u30bf\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nbroadcast-pim-discovery -e eth0<\/td>\n<\/tr>\n
broadcast-ping<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, discovery, safe<\/td>\n

\u6307\u5b9a\u3057\u305f\u30a4\u30f3\u30bf\u30d5\u30a7\u30fc\u30b9\u306b\u30d6\u30ed\u30fc\u30c9\u30ad\u30e3\u30b9\u30c8Ping\u3092\u5b9f\u884c\u3057\u3001\u5fdc\u7b54\u304c\u3042\u3063\u305f\u30db\u30b9\u30c8\u306eIP\u30a2\u30c9\u30ec\u30b9\u3068MAC\u30a2\u30c9\u30ec\u30b9\u306e\u51fa\u529b\u304a\u3088\u3073\u3001\u30bf\u30fc\u30b2\u30c3\u30c8\u3078\u306e\u8ffd\u52a0\u3092\u884c\u3044\u307e\u3059\u3002Ping\u306braw\u306e\u30a4\u30fc\u30b5\u30cd\u30c3\u30c8\u30d1\u30b1\u30c3\u30c8\u3092\u4f7f\u7528\u3059\u308b\u305f\u3081\u3001\u672c\u30b9\u30af\u30ea\u30d7\u30c8\u5b9f\u884c\u306b\u306fUNIX\u306eroot\u6a29\u9650\u304c\u5fc5\u8981\u3067\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script broadcast-ping -e eth0<\/td>\n<\/tr>\n
broadcast-pppoe-discover<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, safe<\/td>\n

PPPoE(Point-to-Point Protocol over Ethernet)\u30b5\u30fc\u30d0\u3092PPPoE\u30c7\u30a3\u30b9\u30ab\u30d0\u30ea\u30d7\u30ed\u30c8\u30b3\u30eb(PPPoED)\u3092\u4f7f\u7528\u3057\u3066\u691c\u51fa\u3057\u307e\u3059\u3002\u30a4\u30f3\u30bf\u30d5\u30a7\u30fc\u30b9\u304c\u6307\u5b9a\u3055\u308c\u3066\u3044\u306a\u3044\u5834\u5408\u3001\u5229\u7528\u53ef\u80fd\u306a\u3059\u3079\u3066\u306e\u30a4\u30f3\u30bf\u30d5\u30a7\u30fc\u30b9\u3067\u5b9f\u884c\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nbroadcast-pppoe-discover<\/td>\n<\/tr>\n
broadcast-rip-discover<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, safe<\/td>\n

RIPv2\u304c\u52d5\u4f5c\u3057\u3066\u3044\u308bLAN\u4e0a\u306e\u30c7\u30d0\u30a4\u30b9\u304b\u3089\u3001\u30db\u30b9\u30c8\u304a\u3088\u3073\u30eb\u30fc\u30c6\u30a3\u30f3\u30b0\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002(RIPv2\u306e\u8981\u6c42\u30b3\u30de\u30f3\u30c9\u3092\u9001\u4fe1\u3057\u3001\u5fdc\u7b54\u304c\u3042\u3063\u305f\u5168\u3066\u306e\u30c7\u30d0\u30a4\u30b9\u304b\u3089\u306e\u5fdc\u7b54\u5185\u5bb9\u3088\u308a\u53d6\u5f97\u3057\u307e\u3059\u3002)<\/td>\n\u5bfe\u8c61
\nCisco806 Version 12.2(8)
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9
\nnmap –script \\
\nbroadcast-rip-discover -e eth0<\/p>\n

\u203b\u306a\u306b\u3082\u51fa\u529b\u3055\u308c\u305a\u306b\u30b9\u30af\u30ea\u30d7\u30c8\u304c\u7d42\u4e86\u3057\u307e\u3057\u305f\u3002(\u30d1\u30b1\u30c3\u30c8\u306e\u9001\u53d7\u4fe1\u3082\u306a\u3057\u3002)<\/td>\n<\/tr>\n

broadcast-ripng-discover<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, safe<\/td>\n

RIPng\u304c\u52d5\u4f5c\u3057\u3066\u3044\u308bLAN\u4e0a\u306e\u30c7\u30d0\u30a4\u30b9\u304b\u3089\u3001\u30db\u30b9\u30c8\u304a\u3088\u3073\u30eb\u30fc\u30c6\u30a3\u30f3\u30b0\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002(\u30d6\u30ed\u30fc\u30c9\u30ad\u30e3\u30b9\u30c8RIPng\u8981\u6c42\u30b3\u30de\u30f3\u30c9\u3092\u9001\u4fe1\u3057\u3001\u5fdc\u7b54\u5185\u5bb9\u3088\u308a\u53d6\u5f97\u3002)<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script broadcast-ripng-discover<\/td>\n<\/tr>\n
broadcast-sonicwall-discover<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, safe<\/td>\n

\u30e1\u30fc\u30ab\u72ec\u81ea\u306e\u300cSetupTool\u300d\u3068\u540c\u69d8\u306e\u65b9\u6cd5\u3092\u7528\u3044\u3066SonicWALL\u30d5\u30a1\u30a4\u30a2\u30a6\u30a9\u30fc\u30eb\u3092\u691c\u51fa\u3057\u307e\u3059\u3002(\u30eb\u30fc\u30c6\u30a3\u30f3\u30b0\u3055\u308c\u306a\u3044\u30c7\u30d0\u30a4\u30b9\u306b\u9650\u5b9a\u3002)\u672c\u30b9\u30af\u30ea\u30d7\u30c8\u5b9f\u884c\u306b\u306f\u3001UDP\u30d1\u30b1\u30c3\u30c8\u3092\u30d6\u30ed\u30fc\u30c9\u30ad\u30e3\u30b9\u30c8\u3059\u308b\u3088\u3046\u306b\u30a4\u30f3\u30bf\u30d5\u30a7\u30fc\u30b9\u3092\u8a2d\u5b9a\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nbroadcast-sonicwall-discover -e eth0<\/td>\n<\/tr>\n
broadcast-sybase-asa-discover<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, safe<\/td>\n

\u30d6\u30ed\u30fc\u30c9\u30ad\u30e3\u30b9\u30c8\u30c7\u30a3\u30b9\u30ab\u30d0\u30ea\u30fc\u30e1\u30c3\u30bb\u30fc\u30b8\u3092\u9001\u4fe1\u3057\u3001LAN\u4e0a\u306e”Sybase Anywhere servers”\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nbroadcast-sybase-asa-discover<\/td>\n<\/tr>\n
broadcast-tellstick-discover<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, safe<\/td>\n

LAN\u4e0a\u306e”Telldus Technologies TellStickNet”\u30c7\u30d0\u30a4\u30b9\u3092\u691c\u51fa\u3057\u307e\u3059\u3002”Telldus TellStick”\u306f\u30ef\u30a4\u30e4\u30ec\u30b9\u3067\u30e9\u30a4\u30c8\u3084\u3001\u8abf\u5149\u5668\u3001\u96fb\u6c17\u30b3\u30f3\u30bb\u30f3\u30c8\u306a\u3069\u306e\u96fb\u6c17\u6a5f\u5668\u3092\u5236\u5fa1\u3059\u308b\u305f\u3081\u306b\u4f7f\u7528\u3055\u308c\u307e\u3059\u3002
\n\u8a73\u7d30\u60c5\u5831\uff1ahttp:\/\/www.telldus.com\/<\/td>\n		\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nbroadcast-tellstick-discover<\/td>\n<\/tr>\n
broadcast-upnp-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, safe<\/td>\n

\u30de\u30eb\u30c1\u30ad\u30e3\u30b9\u30c8\u30af\u30a8\u30ea\u3092\u9001\u4fe1\u3057\u3001\u305d\u306e\u5fdc\u7b54\u3092\u53ce\u96c6\u3001\u89e3\u6790\u3001\u304a\u3088\u3073\u8868\u793a\u3057\u3066\u3001UPnP\u30b5\u30fc\u30d3\u30b9\u304b\u3089\u30b7\u30b9\u30c6\u30e0\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV –script \\
\nbroadcast-upnp-info 192.168.110.1<\/td>\n<\/tr>\n
broadcast-versant-locate<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, safe<\/td>\n

“broadcast srvloc protocol”\u3092\u4f7f\u7528\u3057\u3066”Versant object databases”\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script broadcast-versant-locate<\/td>\n<\/tr>\n
broadcast-wake-on-lan<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, safe<\/td>\n

“Wake-On-Lan”\u30d1\u30b1\u30c3\u30c8\u3092\u9001\u4fe1\u3057\u3001\u30ea\u30e2\u30fc\u30c8\u30b7\u30b9\u30c6\u30e0\u3092\u30b9\u30ea\u30fc\u30d7\u72b6\u614b\u304b\u3089\u5fa9\u5e30\u3055\u305b\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script broadcast-wake-on-lan \\
\n–script-args \\
\nbroadcast-wake-on-lan.MAC=\\
\n‘e0:db:55:c6:5f:29’<\/td>\n<\/tr>\n
broadcast-wpad-discover<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, safe<\/td>\n

WPAD(Web Proxy Autodiscovery Protocol)\u3092\u4f7f\u7528\u3057\u3066LAN\u4e0a\u306b\u3042\u308b\u30d7\u30ed\u30ad\u30b7\u30b5\u30fc\u30d0\u306e\u4e00\u89a7\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u540c\u30d7\u30ed\u30c8\u30b3\u30eb\u306fDHCP\u3068DNS\u306e\u4e21\u65b9\u306e\u65b9\u6cd5\u3092\u5b9f\u88c5\u3057\u3066\u304a\u308a\u3001\u307e\u305aDHCP\u306b\u3066\u30a2\u30c9\u30ec\u30b9\u3092\u53d6\u5f97\u3059\u308b\u3053\u3068\u304b\u3089\u59cb\u307e\u308a\u307e\u3059\u3002 DHCP\u306e\u30a2\u30c9\u30ec\u30b9\u53d6\u5f97\u6642\u306b\u306f\u3001nmap\u304c\u7279\u6a29\u30e2\u30fc\u30c9\u3067\u5b9f\u884c\u3055\u308c\u3066\u3044\u308b\u5fc5\u8981\u304c\u3042\u308a\u3001\u7279\u6a29\u30e2\u30fc\u30c9\u3067\u5b9f\u884c\u3055\u308c\u3066\u3044\u306a\u3044\u5834\u5408\u306f\u30b9\u30ad\u30c3\u30d7\u3055\u308c\u307e\u3059\u3002 DNS\u306e\u691c\u51fa\u3067\u306f\u3001\u5f15\u6570\u3092\u4f7f\u7528\u3059\u308b\u304b\u3001\u30ed\u30fc\u30ab\u30ebIP\u3092\u9006\u5f15\u304d\u3059\u308b\u3053\u3068\u306b\u3088\u308a\u3001\u30b9\u30af\u30ea\u30d7\u30c8\u304c\u30ed\u30fc\u30ab\u30eb\u30c9\u30e1\u30a4\u30f3\u3092\u89e3\u6c7a\u3067\u304d\u308b\u304b\u3069\u3046\u304b\u306b\u4f9d\u5b58\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script broadcast-wpad-discover<\/td>\n<\/tr>\n
broadcast-wsdd-discover<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, safe<\/td>\n

\u30de\u30eb\u30c1\u30ad\u30e3\u30b9\u30c8\u30af\u30a8\u30ea\u3092\u4f7f\u7528\u3057\u3001Web Services Dynamic Discovery (WS-Discovery)\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u30b5\u30dd\u30fc\u30c8\u3059\u308b\u30c7\u30d0\u30a4\u30b9\u3092\u691c\u51fa\u3057\u307e\u3059\u3002
\n\u307e\u305f\u3001\u4efb\u610f\u306e\u516c\u958b\u3055\u308c\u305fWindows Communication Framework (WCF) web services(.NET 4.0\u4ee5\u964d)\u306e\u691c\u51fa\u3082\u884c\u3044\u307e\u3059\u3002<\/td>\n		\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script broadcast-wsdd-discover<\/td>\n<\/tr>\n
broadcast-xdmcp-discover<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, safe<\/td>\n

XDMCP\u30d6\u30ed\u30fc\u30c9\u30ad\u30e3\u30b9\u30c8\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u9001\u4fe1\u3059\u308b\u3053\u3068\u306b\u3088\u3063\u3066\u3001LAN\u4e0a\u306eX Display Manager Control Protocol(XDMCP)\u3092\u5b9f\u884c\u3057\u3066\u3044\u308b\u30b5\u30fc\u30d0\u3092\u691c\u51fa\u3057\u307e\u3059\u3002\u30a2\u30af\u30bb\u30b9\u3092\u8a31\u53ef\u3059\u308b\u30c7\u30a3\u30b9\u30d7\u30ec\u30a4\u30de\u30cd\u30fc\u30b8\u30e3\u306f\u51fa\u529b\u7d50\u679c\u306b\u3066\u30de\u30fc\u30af\u3055\u308c\u3066\u51fa\u529b\u3055\u308c\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nbroadcast-xdmcp-discover<\/td>\n<\/tr>\n
cassandra-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

“Cassandra database”\u306b\u5bfe\u3057\u3066\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script cassandra-brute \\
\n192.168.110.1 -p 9160<\/td>\n<\/tr>\n
cassandra-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

“Cassandra database”\u304b\u3089\u3001\u57fa\u672c\u7684\u306a\u60c5\u5831\u3068\u30b5\u30fc\u30d0\u30b9\u30c6\u30fc\u30bf\u30b9\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script cassandra-info \\
\n192.168.110.1 -p 9160<\/td>\n<\/tr>\n
cccam-version<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nversion<\/td>\n

CCcam\u30b5\u30fc\u30d3\u30b9(\u8907\u6570\u306e\u53d7\u4fe1\u6a5f\u9593\u3067\u306e\u30b5\u30d6\u30b9\u30af\u30ea\u30d7\u30b7\u30e7\u30f3\u30c6\u30ec\u30d3\u3092\u5171\u6709\u3059\u308b\u305f\u3081\u306e\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2)\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV 192.168.110.1<\/td>\n<\/tr>\n
citrix-brute-xml<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

Citrix\u306ePN Web\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8\u306eXML\u30b5\u30fc\u30d3\u30b9\u306b\u5bfe\u3057\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306b\u3088\u308b\u8a8d\u8a3c\u60c5\u5831\u306e\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002XML\u30b5\u30fc\u30d3\u30b9\u306f\u3001\u30ed\u30fc\u30ab\u30eb\u306eWindows\u30b5\u30fc\u30d0\u307e\u305f\u306fActive Directory\u306b\u5bfe\u3057\u3066\u8a8d\u8a3c\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script citrix-brute-xml? \\
\n–script-args ntdomain=local \\
\n192.168.110.1 -p 80,443,8080<\/td>\n<\/tr>\n
citrix-enum-apps<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

ICA Browser\u30b5\u30fc\u30d3\u30b9\u304b\u3089\u516c\u958b\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u30ea\u30b9\u30c8\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script citrix-enum-apps \\
\n192.168.110.1 -p 1604<\/td>\n<\/tr>\n
citrix-enum-apps-xml<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

Citrix XML\u30b5\u30fc\u30d3\u30b9\u304b\u3089\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3001ACL\u3001\u304a\u3088\u3073\u8a2d\u5b9a\u306e\u30ea\u30b9\u30c8\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script citrix-enum-apps-xml \\
\n192.168.110.1 -p 80,443,8080<\/td>\n<\/tr>\n
citrix-enum-servers<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

ICA\u30d6\u30e9\u30a6\u30b6\u30b5\u30fc\u30d3\u30b9\u304b\u3089Citrix\u30b5\u30fc\u30d0\u306e\u30ea\u30b9\u30c8\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script citrix-enum-servers \\
\n192.168.110.1 -p 1604<\/td>\n<\/tr>\n
citrix-enum-servers-xml<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

Citrix XML\u30b5\u30fc\u30d3\u30b9\u304b\u3089\u30b5\u30fc\u30d0\u30d5\u30a1\u30fc\u30e0\u3068\u30e1\u30f3\u30d0\u30b5\u30fc\u30d0\u306e\u540d\u524d\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script citrix-enum-servers-xml \\
\n192.168.110.1 -p 80,443,8080<\/td>\n<\/tr>\n
clamav-exec<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, vuln<\/td>\n

ClamAV\u306e\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3001\u8a8d\u8a3c\u3055\u308c\u3066\u3044\u306a\u3044clamav\u306e\u30b3\u30de\u30f3\u30c9\u304c\u5b9f\u884c\u53ef\u80fd\u306a\u8106\u5f31\u6027\u3092\u3064\u3044\u305f\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV –script clamav-exec \\
\n192.168.110.1<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

clock-skew<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, safe<\/td>\n

\u30b9\u30ad\u30e3\u30ca\u3068\u30bf\u30a4\u30e0\u30b9\u30bf\u30f3\u30d7\u3092\u5831\u544a\u3059\u308b\u69d8\u3005\u306a\u30b5\u30fc\u30d3\u30b9\u9593\u306e\u30af\u30ed\u30c3\u30af\u30b9\u30ad\u30e5\u30fc\u3092\u89e3\u6790\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV -sC 192.168.110.1<\/td>\n<\/tr>\n
coap-resources<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

CoAP\u30a8\u30f3\u30c9\u30dd\u30a4\u30f3\u30c8\u304b\u3089\u5229\u7528\u53ef\u80fd\u306a\u30ea\u30bd\u30fc\u30b9\u306e\u30ea\u30b9\u30c8\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script coap-resources \\
\n192.168.110.1 -p U:5683<\/p>\n

\u203b\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u306f\u30b9\u30af\u30ea\u30d7\u30c8\u30d5\u30a1\u30a4\u30eb\u304a\u3088\u3073lua\u30d5\u30a1\u30a4\u30eb\u304c\u306a\u3044\u305f\u3081\u3001\u516c\u5f0f\u30da\u30fc\u30b8\u304b\u3089\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/td>\n<\/tr>\n

couchdb-databases<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

“CouchDB”\u306e\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u304b\u3089\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u30c6\u30fc\u30d6\u30eb\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script couchdb-databases.nse \\
\n192.168.110.1 -p 5984<\/td>\n<\/tr>\n
couchdb-stats<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

“CouchDB”\u306e\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u304b\u3089\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u306e\u7d71\u8a08\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script couchdb-stats.nse \\
\n192.168.110.1 -p 5984<\/td>\n<\/tr>\n
creds-summary<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, default, safe<\/td>\n

\u30b9\u30ad\u30e3\u30f3\u306e\u7d42\u4e86\u6642\u306b\u3001\u767a\u898b\u3055\u308c\u305f\u3059\u3079\u3066\u306e\u8a8d\u8a3c\u60c5\u5831(\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u3084\u30c7\u30d5\u30a9\u30eb\u30c8\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u30c1\u30a7\u30c3\u30af\u3059\u308b\u30b9\u30af\u30ea\u30d7\u30c8\u306a\u3069\u306b\u3066\u767a\u898b)\u3092\u4e00\u89a7\u8868\u793a\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV -sC –script creds-summary \\
\n192.168.110.1<\/td>\n<\/tr>\n
cups-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

CUPS\u5370\u5237\u30b5\u30fc\u30d3\u30b9\u306b\u3088\u3063\u3066\u7ba1\u7406\u3055\u308c\u3066\u3044\u308b\u30d7\u30ea\u30f3\u30bf\u306e\u4e00\u89a7\u3092\u8868\u793a\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script cups-info 192.168.110.1 \\
\n-p 631<\/td>\n<\/tr>\n
cups-queue-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

\u30d7\u30ea\u30f3\u30bf\u6bce\u306b\u30b0\u30eb\u30fc\u30d7\u5316\u3055\u308c\u305fCUPS\u30b5\u30fc\u30d3\u30b9\u304b\u3089\u3001\u73fe\u5728\u30ad\u30e5\u30fc\u306b\u5165\u3063\u3066\u3044\u308b\u30b8\u30e7\u30d6\u3092\u8868\u793a\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script cups-queue-info \\
\n192.168.110.1 -p 631<\/td>\n<\/tr>\n
cvs-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

CVS\u306ePSERVER\u8a8d\u8a3c\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script cvs-brute 192.168.110.1 \\
\n-p 2401<\/td>\n<\/tr>\n
cvs-brute-repository<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

\u5bfe\u8c61\u30b5\u30fc\u30d0\u306eCVS\u30ea\u30dd\u30b8\u30c8\u30ea\u306e\u540d\u524d\u3092\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306b\u3066\u30af\u30e9\u30c3\u30af\u3057\u307e\u3059\u3002\u6b63\u3057\u3044\u30ea\u30dd\u30b8\u30c8\u30ea\u540d\u3092\u77e5\u3063\u3066\u3044\u308c\u3070\u3001\u30e6\u30fc\u30b6\u540d\u3068\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u63a8\u6e2c\u3067\u304d\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap? –script cvs-brute-repository \\
\n192.168.110.1 -p 2401<\/td>\n<\/tr>\n
daap-get-library<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

DAAP\u30b5\u30fc\u30d0\u304b\u3089\u97f3\u697d\u306e\u30ea\u30b9\u30c8\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u30ea\u30b9\u30c8\u306f\u3001\u30a2\u30fc\u30c6\u30a3\u30b9\u30c8\u540d\u3001\u30a2\u30eb\u30d0\u30e0\u3084\u66f2\u306e\u30bf\u30a4\u30c8\u30eb\u3092\u542b\u307f\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV –script=daap-get-library \\
\n192.168.110.1<\/td>\n<\/tr>\n
daytime<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

“Daytime”\u30b5\u30fc\u30d3\u30b9\u304b\u3089\u66dc\u65e5\u3068\u6642\u523b\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nCentOS7
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV –script daytime 192.168.110.1 \\
\n-p 13<\/td>\n<\/tr>\n
db2-das-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe, version<\/td>\n

IBM DB2\u7ba1\u7406\u30b5\u30fc\u30d0(DAS)\u306bTCP\/UDP523\u30dd\u30fc\u30c8\u3067\u63a5\u7d9a\u3057\u3001\u30b5\u30fc\u30d0\u30d7\u30ed\u30d5\u30a1\u30a4\u30eb\u3092\u30a8\u30af\u30b9\u30dd\u30fc\u30c8\u3057\u307e\u3059\u3002(\u8a8d\u8a3c\u60c5\u5831\u4e0d\u8981)<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV 192.168.110.1<\/td>\n<\/tr>\n
dhcp-discover<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

“DHCPINFORM”\u3092UDP67\u30dd\u30fc\u30c8\u3067\u9001\u4fe1\u3057\u3001\u65b0\u3057\u3044\u30a2\u30c9\u30ec\u30b9\u3092\u5272\u308a\u5f53\u3066\u3089\u308c\u308b\u3053\u3068\u306a\u304f\u3001\u3059\u3079\u3066\u306e\u30ed\u30fc\u30ab\u30eb\u69cb\u6210\u30d1\u30e9\u30e1\u30fc\u30bf\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script dhcp-discover \\
\n192.168.110.2 -p 67<\/td>\n<\/tr>\n
dict-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

DICT\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u4f7f\u7528\u3057\u3066\u3001\u30c7\u30a3\u30af\u30b7\u30e7\u30ca\u30ea\u30b5\u30fc\u30d0\u306b\u63a5\u7d9a\u3002”SHOW SERVER”\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3057\u3001\u7d50\u679c\u3092\u8868\u793a\u3057\u307e\u3059\u3002 DICT\u30d7\u30ed\u30c8\u30b3\u30eb\u306fRFC 2229\u3067\u5b9a\u7fa9\u3055\u308c\u3001\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u304c\u81ea\u7136\u8a00\u8a9e\u8f9e\u66f8\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u306e\u30bb\u30c3\u30c8\u304b\u3089\u5b9a\u7fa9\u7528\u306e\u8f9e\u66f8\u30b5\u30fc\u30d0\u3078\u306e\u554f\u3044\u5408\u308f\u305b\u3092\u53ef\u80fd\u306b\u3059\u308b\u30d7\u30ed\u30c8\u30b3\u30eb\u3067\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script dict-info 192.168.110.1 \\
\n-p 2628<\/td>\n<\/tr>\n
distcc-cve2004-2687<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, intrusive, vuln<\/td>\n

\u5206\u6563\u578b\u306e\u30b3\u30f3\u30d1\u30a4\u30e9\u30c7\u30fc\u30e2\u30f3\u306e”distcc”\u306b\u5bfe\u3057\u3001\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u53ef\u80fd\u306a\u8106\u5f31\u6027\u3092\u3064\u3044\u305f\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002\u3053\u306e\u8106\u5f31\u6027\u306f\u30012002\u5e74\u306b\u958b\u793a\u3055\u308c\u3066\u3044\u307e\u3059\u304c\u3001\u30b5\u30fc\u30d3\u30b9\u306e\u69cb\u6210\u306b\u3088\u308a\u3001\u73fe\u5728\u3082\u307e\u3060\u5b58\u5728\u3059\u308b\u8106\u5f31\u6027\u3067\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script distcc-cve2004-2687 \\
\n192.168.110.1 -p 3632<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

dns-blacklist<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexternal, safe<\/td>\n

\u5bfe\u8c61\u306eIP\u30a2\u30c9\u30ec\u30b9\u3092\u8907\u6570\u306eDNS\u30a2\u30f3\u30c1\u30b9\u30d1\u30e0\u304a\u3088\u3073\u30aa\u30fc\u30d7\u30f3\u30d7\u30ed\u30ad\u30b7\u306e\u30d6\u30e9\u30c3\u30af\u30ea\u30b9\u30c8\u3067\u78ba\u8a8d\u3057\u3001IP\u30a2\u30c9\u30ec\u30b9\u306b\u4e00\u81f4\u3057\u305f\u30b5\u30fc\u30d3\u30b9\u30ea\u30b9\u30c8\u3092\u8868\u793a\u3057\u307e\u3059\u3002\u78ba\u8a8d\u306f\u3001\u30b5\u30fc\u30d3\u30b9\u30ab\u30c6\u30b4\u30ea(SPAM\u3001PROXY\u306a\u3069)\u307e\u305f\u306f\u7279\u5b9a\u306e\u30b5\u30fc\u30d3\u30b9\u540d\u306b\u3088\u3063\u3066\u5236\u9650\u3055\u308c\u308b\u5834\u5408\u304c\u3042\u308a\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sn –script dns-blacklist \\
\n192.168.110.1<\/td>\n<\/tr>\n
dns-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

\u3088\u304f\u4f7f\u7528\u3055\u308c\u308b\u30b5\u30d6\u30c9\u30e1\u30a4\u30f3\u306b\u5bfe\u3059\u308b\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u30a2\u30bf\u30c3\u30af\u306b\u3088\u308aDNS\u30db\u30b9\u30c8\u540d\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002”DNS-brute.srv”\u306e\u5f15\u6570\u3092\u6307\u5b9a\u3059\u308b\u3068\u3001\u3088\u304f\u4f7f\u7528\u3055\u308c\u308b”DNS SRV”\u30ec\u30b3\u30fc\u30c9\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows2008R2\/DNS\u30b5\u30fc\u30d3\u30b9
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script dns-brute –script-args \\
\ndns-brute.domain=sample.co.jp<\/td>\n<\/tr>\n
dns-cache-snoop<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

DNS\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3066DNS\u30ad\u30e3\u30c3\u30b7\u30e5\u3092\u30b9\u30cc\u30fc\u30d4\u30f3\u30b0\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sU –script \\
\ndns-cache-snoop.nse \\
\n–script-args \\
\n‘dns-cache-snoop.mode=timed’ \\
\n192.168.110.2 -p 53<\/td>\n<\/tr>\n
dns-check-zone<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, external, safe<\/td>\n

DNS\u30be\u30fc\u30f3\u306e\u8a2d\u5b9a\u3092RFC 1912\u3092\u542b\u3080\u30d9\u30b9\u30c8\u30fb\u30d7\u30e9\u30af\u30c6\u30a3\u30b9\u306b\u57fa\u3065\u3044\u3066\u78ba\u8a8d\u3057\u307e\u3059\u3002\u69cb\u6210\u78ba\u8a8d\u306f\u3001\u30ab\u30c6\u30b4\u30ea\u306b\u5206\u985e\u3055\u308c\u3001\u305d\u308c\u305e\u308c\u7570\u306a\u308b\u30c6\u30b9\u30c8\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows2008R2\/DNS\u30b5\u30fc\u30d3\u30b9
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sn -Pn –script dns-check-zone \\
\n–script-args \\
\ndns-check-zone.domain=’sample.co.jp’ \\
\n192.168.110.1<\/td>\n<\/tr>\n
dns-client-subnet-scan<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

“edns-client-subnet”\u30aa\u30d7\u30b7\u30e7\u30f3\u3092\u4f7f\u7528\u3057\u3066\u30c9\u30e1\u30a4\u30f3\u30eb\u30c3\u30af\u30a2\u30c3\u30d7\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002\u3053\u306e\u30aa\u30d7\u30b7\u30e7\u30f3\u3092\u4f7f\u7528\u3059\u308b\u3068\u3001\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u304c\u30af\u30a8\u30ea\u306e\u767a\u4fe1\u5143\u3068\u306a\u308b\u30b5\u30d6\u30cd\u30c3\u30c8\u3092\u6307\u5b9a\u3067\u304d\u307e\u3059\u3002\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001\u540c\u30aa\u30d7\u30b7\u30e7\u30f3\u3092\u4f7f\u7528\u3057\u3066\u3001\u3067\u304d\u308b\u3060\u3051\u591a\u304f\u306e\u7570\u306a\u308b\u30a2\u30c9\u30ec\u30b9\u30ec\u30b3\u30fc\u30c9\u3092\u53d6\u5f97\u3059\u308b\u305f\u3081\u306b\u3001\u5730\u7406\u7684\u306b\u96e2\u308c\u305f\u8907\u6570\u306e\u5834\u6240\u3092\u6307\u5b9a\u3057\u307e\u3059\u3002\u307e\u305f\u3001\u3053\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001\u6307\u5b9a\u3057\u305f\u30b5\u30d6\u30cd\u30c3\u30c8\u3092\u4f7f\u7528\u3059\u308b\u3053\u3068\u3082\u53ef\u80fd\u3067\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script \\
\ndns-client-subnet-scan \\
\n–script-args \\
\ndns-client-subnet-scan.domain=\\
\nwww.example.com, \\
\ndns-client-subnet-scan.address=\\
\n192.168.0.1 -p 53<\/td>\n<\/tr>\n
dns-fuzz<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nfuzzer, intrusive<\/td>\n

DNS\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3066DNS\u30d5\u30a1\u30b8\u30f3\u30b0\u653b\u6483\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script dns-fuzz \\
\n–script-args timelimit=2h 192.168.110.1<\/td>\n<\/tr>\n
dns-ip6-arpa-scan<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

\u5927\u898f\u6a21\u306a\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002(DNS\u30b5\u30fc\u30d0\u306e\u5fdc\u7b54\u30b3\u30fc\u30c9\u3092\u5206\u6790\u3059\u308b\u6280\u8853\u3092\u4f7f\u7528\u3057\u3066\u3001IPv6\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u306e\u30af\u30a4\u30c3\u30af\u9006\u5f15\u304dDNS\u691c\u7d22\u3092\u5b9f\u884c\u3059\u308b\u3053\u3068\u306b\u3088\u308a\u3001\u30af\u30a8\u30ea\u306e\u6570\u3092\u5287\u7684\u306b\u6e1b\u3089\u3057\u3066\u3044\u307e\u3059\u3002)<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script dns-ip6-arpa-scan \\
\n–script-args=’prefix=2001:0DB8::\/48′<\/td>\n<\/tr>\n
dns-nsec3-enum<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

“DNSSEC NSEC3″\u30ec\u30b3\u30fc\u30c9\u3092\u30b5\u30dd\u30fc\u30c8\u3059\u308bDNS\u30b5\u30fc\u30d0\u304b\u3089\u30c9\u30e1\u30a4\u30f3\u540d\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows2008R2\/DNS\u30b5\u30fc\u30d3\u30b9
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nmap? -sU –script dns-nsec3-enum \\
\n–script-args \\
\ndns-nsec3-enum.domains=\\
\nsample.com \\
\n192.168.110.1 -p 53<\/td>\n<\/tr>\n
dns-nsec-enum<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

“DNSSEC NSEC-walking “\u3092\u4f7f\u7528\u3057\u3066DNS\u540d\u3092\u5217\u6319\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows2008R2\/DNS\u30b5\u30fc\u30d3\u30b9
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sSU –script dns-nsec-enum \\
\n–script-args \\
\ndns-nsec-enum.domains=sample.co.jp \\ 192.168.110.1 -p 53<\/td>\n<\/tr>\n
dns-nsid<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery<\/td>\n

DNS\u30cd\u30fc\u30e0\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3001nameserver ID (nsid)\u3092\u8981\u6c42\u3002”id.server”\u3068”version.bind”\u306e\u5024\u3092\u6c42\u3081\u308b\u3053\u3068\u306b\u3088\u308a\u3001\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows2008R2\/DNS\u30b5\u30fc\u30d3\u30b9
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sSU –script dns-nsid \\
\n192.168.110.1 -p 53<\/td>\n<\/tr>\n
dns-random-srcport<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexternal, intrusive<\/td>\n

DNS\u30b5\u30fc\u30d0\u304c\u4e88\u6e2c\u53ef\u80fd\u306a\u9001\u4fe1\u5143\u30dd\u30fc\u30c8\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002\u4e88\u6e2c\u53ef\u80fd\u306a\u9001\u4fe1\u5143\u30dd\u30fc\u30c8\u306e\u4f7f\u7528\u306f\u30ad\u30e3\u30c3\u30b7\u30e5\u30dd\u30a4\u30ba\u30cb\u30f3\u30b0\u653b\u6483(\u53c2\u8003\uff1aCVE-2008-1447)\u306b\u5bfe\u3057\u3066\u8106\u5f31\u306b\u306a\u308a\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script dns-random-srcport \\
\n192.168.110.1 -p 53<\/td>\n<\/tr>\n
dns-random-txid<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexternal, intrusive<\/td>\n

DNS\u30b5\u30fc\u30d0\u304c\u4e88\u6e2c\u53ef\u80fd\u306aTXID\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002\u4e88\u6e2c\u53ef\u80fd\u306aTXID\u306e\u4f7f\u7528\u306f\u30ad\u30e3\u30c3\u30b7\u30e5\u30dd\u30a4\u30ba\u30cb\u30f3\u30b0\u653b\u6483(\u53c2\u8003\uff1aCVE-2008-1447)\u306b\u5bfe\u3057\u3066\u8106\u5f31\u306b\u306a\u308a\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script dns-random-txid \\
\n192.168.110.1 -p 53<\/td>\n<\/tr>\n
dns-recursion<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, safe<\/td>\n

DNS\u30b5\u30fc\u30d0\u304c\u3001\u30b5\u30fc\u30c9\u30d1\u30fc\u30c6\u30a3\u306e\u540d\u524d\u306e\u30af\u30a8\u30ea\u3092\u8a31\u53ef\u3059\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002\u30af\u30a8\u30ea\u3092\u8a31\u53ef\u3057\u3066\u3044\u308b\u5834\u5408\u3001\u540cDNS\u30b5\u30fc\u30d0\u3067\u518d\u5e30\u554f\u3044\u5408\u308f\u305b\u304c\u6709\u52b9\u306b\u306a\u3063\u3066\u3044\u308b\u3053\u3068\u3092\u793a\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nCenOS7\/bind9.9.4
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sU –script dns-recursion \\
\n192.168.110.1 -p 53<\/td>\n<\/tr>\n
dns-service-discovery<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

“DNS Service Discovery”\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u4f7f\u7528\u3057\u3066\u3001\u5bfe\u8c61\u30db\u30b9\u30c8\u306e\u30b5\u30fc\u30d3\u30b9\u767a\u898b\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script=dns-service-discovery \\
\n192.168.110.1 -p 5353<\/td>\n<\/tr>\n
dns-srv-enum<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

\u7279\u5b9a\u306e\u30c9\u30e1\u30a4\u30f3\u540d\u306b\u5bfe\u3059\u308b\u3055\u307e\u3056\u307e\u306a\u5171\u901a\u30b5\u30fc\u30d3\u30b9(SRV)\u30ec\u30b3\u30fc\u30c9\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u30b5\u30fc\u30d3\u30b9\u30ec\u30b3\u30fc\u30c9\u306b\u306f\u3001\u7279\u5b9a\u30b5\u30fc\u30d3\u30b9\u306e\u30b5\u30fc\u30d0\u306e\u30db\u30b9\u30c8\u540d\u3001\u30dd\u30fc\u30c8\u3001\u304a\u3088\u3073\u512a\u5148\u9806\u4f4d\u304c\u542b\u307e\u308c\u307e\u3059\u3002
\n\u540c\u30b9\u30af\u30ea\u30d7\u30c8\u3067\u306f\u3001\u6b21\u306e\u30b5\u30fc\u30d3\u30b9\u306e\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002
\n\u30fbActive Directory\u30b0\u30ed\u30fc\u30d0\u30eb\u30ab\u30bf\u30ed\u30b0
\n\u30fbExchange Autodiscovery
\n\u30fbKerberos KDC\u30b5\u30fc\u30d3\u30b9
\n\u30fbKerberos Passwd\u5909\u66f4\u30b5\u30fc\u30d3\u30b9
\n\u30fbLDAP\u30b5\u30fc\u30d0
\n\u30fbSIP\u30b5\u30fc\u30d0
\n\u30fbXMPP S2S
\n\u30fbXMPP C2S<\/td>\n		\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script dns-srv-enum \\
\n–script-args \\
\ndns-srv-enum.domain=’example.com’ \\
\n192.168.110.1<\/td>\n<\/tr>\n
dns-update<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nintrusive, vuln<\/td>\n

\u30c0\u30a4\u30ca\u30df\u30c3\u30afDNS\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u8a8d\u8a3c\u306a\u3057\u3067\u5b9f\u884c\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows2008R2\/DNS\u30b5\u30fc\u30d3\u30b9(\u52d5\u7684\u66f4\u65b0:\u975e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4fdd\u8b77\u304a\u3088\u3073\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4fdd\u8b77)
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sU –script dns-update \\
\n–script-args \\
\ndns-update.hostname=\\
\nfoo.sample.com, \\
\ndns-update.ip=192.168.110.1 \\
\n192.168.110.1 -p 53<\/td>\n<\/tr>\n
dns-zeustracker<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, external, malware, safe<\/td>\n

\u5bfe\u8c61\u306eIP\u30a2\u30c9\u30ec\u30b9\u30ec\u30f3\u30b8\u304cZeus botnet\u306e\u4e00\u90e8\u304b\u3092\u3001
\n“ZTDNS @ abuse.ch”\u306b\u7167\u4f1a\u3057\u3001\u78ba\u8a8d\u3057\u307e\u3059\u3002
\n\u30b9\u30ad\u30e3\u30f3\u3092\u958b\u59cb\u3059\u308b\u524d\u306b\u3001\u672c\u60c5\u5831<\/a>\u3092\u78ba\u8a8d\u3057\u3066\u304f\u3060\u3055\u3044\u3002
\n “<\/td>\n		\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sn -PN –script=dns-zeustracker \\
\n192.168.110.1<\/td>\n<\/tr>\n
dns-zone-transfer<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

DNS\u30b5\u30fc\u30d0\u304b\u3089\u30be\u30fc\u30f3\u8ee2\u9001(AXFR)\u3092\u8981\u6c42\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows2008R2\/DNS\u30b5\u30fc\u30d3\u30b9(\u30be\u30fc\u30f3\u8ee2\u9001\u3092\u8a31\u53ef\u3059\u308b\u30b5\u30fc\u30d0\u30fc\uff1a\u3059\u3079\u3066\u306e\u30b5\u30fc\u30d0\u30fc)
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script dns-zone-transfer.nse \\
\n–script-args \\
\ndns-zone-transfer.domain=\\
\n“sample.co.jp” \\
\n192.168.110.1<\/td>\n<\/tr>\n
docker-version<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nversion<\/td>\n

“Docker”\u30b5\u30fc\u30d3\u30b9\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u60c5\u5831\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV 192.168.110.1<\/td>\n<\/tr>\n
domcon-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

“Lotus Domino”\u30b3\u30f3\u30bd\u30fc\u30eb\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script domcon-brute \\
\n192.168.110.1 -p 2050<\/td>\n<\/tr>\n
domcon-cmd<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, intrusive<\/td>\n

\u6307\u5b9a\u3057\u305f\u8a8d\u8a3c\u60c5\u5831\u3092\u4f7f\u7528\u3057\u3066\u3001”Lotus Domino”\u30b3\u30f3\u30bd\u30fc\u30eb\u306e\u30b3\u30f3\u30bd\u30fc\u30eb\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002(“domcon-brute”\u53c2\u7167)<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script domcon-cmd \\
\n–script-args \\
\ndomcon-cmd.cmd=”show server”, \\
\ndomcon-cmd.user=”root”, \\
\ndomcon-cmd.pass=”root” \\
\n192.168.110.1 -p 2050<\/td>\n<\/tr>\n
domino-enum-users<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, intrusive<\/td>\n

\u6709\u52b9\u306aIBM “Lotus Domino”\u306e\u30e6\u30fc\u30b6\u3092\u767a\u898b\u3057\u3001”CVE-2006-5835″\u306e\u8106\u5f31\u6027\u3092\u5229\u7528\u3057\u3066\u3001\u540c\u30e6\u30fc\u30b6\u306eID\u30d5\u30a1\u30a4\u30eb\u306e\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script domino-enum-users \\
\n192.168.110.1 -p 1352<\/td>\n<\/tr>\n
dpap-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

iPhoto\u30e9\u30a4\u30d6\u30e9\u30ea\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script dpap-brute \\
\n192.168.110.1 -p 8770<\/td>\n<\/tr>\n
drda-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

Informix\u3001DB2\u304a\u3088\u3073Derby\u306a\u3069\u306eIBM DB2\u306e\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u30b5\u30dd\u30fc\u30c8\u3059\u308b\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script drda-brute \\
\n192.168.110.1 -p 50000<\/td>\n<\/tr>\n
drda-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe, version<\/td>\n

DRDA\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u3044\u308b\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u30b5\u30fc\u30d0\u304b\u3089\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u672c\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001DRDA EXCSAT(exchange server attributes)\u30b3\u30de\u30f3\u30c9\u306e\u30d1\u30b1\u30c3\u30c8\u3092\u9001\u4fe1\u3057\u3001\u305d\u306e\u5fdc\u7b54\u3092\u89e3\u6790\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV 192.168.110.1<\/td>\n<\/tr>\n
duplicates<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nsafe<\/td>\n

\u4ed6\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u306b\u3088\u3063\u3066\u53ce\u96c6\u3055\u308c\u305f\u60c5\u5831\u3092\u5206\u6790\u3001\u6bd4\u8f03\u3057\u3001\u30de\u30eb\u30c1\u30db\u30fc\u30e0\u30b7\u30b9\u30c6\u30e0\u3092\u691c\u51fa\u3057\u307e\u3059\u3002\u5206\u6790\u5bfe\u8c61\u306e\u60c5\u5831\u3068\u3057\u3066\u3001SSL\u8a3c\u660e\u66f8\u3001SSH\u30db\u30b9\u30c8\u30ad\u30fc\u3001MAC\u30a2\u30c9\u30ec\u30b9\u3001\u304a\u3088\u3073NetBIOS\u30b5\u30fc\u30d0\u540d\u306a\u3069\u304c\u6319\u3052\u3089\u308c\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -PN –script \\
\nduplicates,nbstat,ssl-cert \\
\n192.168.110.1 -p 445,443<\/td>\n<\/tr>\n
eap-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, safe<\/td>\n

\u6307\u5b9a\u3055\u308c\u305fID\u307e\u305f\u533f\u540dID\u306b\u304a\u3051\u308b\u3001EAP(Extensible Authentication Protocol)\u8a8d\u8a3c\u306e\u8a8d\u8a3c\u65b9\u6cd5\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script eap-info \\
\n192.168.110.1 -e eth0<\/td>\n<\/tr>\n
enip-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, version<\/td>\n

TCP44818\u30dd\u30fc\u30c8\u304c\u958b\u653e\u3055\u308c\u3066\u3044\u308b\u5bfe\u8c61\u3078\u3001\u30a4\u30fc\u30b5\u30cd\u30c3\u30c8\/IP\u30d1\u30b1\u30c3\u30c8\u3092\u9001\u4fe1\u3057\u307e\u3059\u3002”Request Identity”\u30d1\u30b1\u30c3\u30c8\u3092\u9001\u4fe1\u3057\u3001\u5bfe\u8c61\u304b\u3089\u5fdc\u7b54\u304c\u3042\u308c\u3070\u3001\u540c\u5fdc\u7b54\u30d1\u30b1\u30c3\u30c8\u304c\u9069\u5207\u306a\u5fdc\u7b54\u3067\u3042\u308b\u3053\u3068\u3092\u691c\u8a3c\u3057\u3001\u5fdc\u7b54\u5185\u5bb9\u3092\u89e3\u6790\u3057\u307e\u3059\u3002\u89e3\u6790\u3059\u308b\u60c5\u5831\u306f\u3001\u30d9\u30f3\u30c0ID\u3001\u30c7\u30d0\u30a4\u30b9\u30bf\u30a4\u30d7\u3001\u88fd\u54c1\u540d\u3001\u30b7\u30ea\u30a2\u30eb\u756a\u53f7\u3001\u88fd\u54c1\u30b3\u30fc\u30c9\u3001\u30ea\u30d3\u30b8\u30e7\u30f3\u756a\u53f7\u304a\u3088\u3073\u5bfe\u8c61\u306eIP\u30a2\u30c9\u30ec\u30b9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script enip-info \\
\n192.168.110.1 -p 44818<\/td>\n<\/tr>\n
epmd-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

Erlang Port Mapper Daemon (epmd) \u306b\u63a5\u7d9a\u3057\u3001\u305d\u308c\u305e\u308c\u306e\u30dd\u30fc\u30c8\u756a\u53f7\u3092\u6301\u3064\u30ce\u30fc\u30c9\u306e\u30ea\u30b9\u30c8\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script epmd-info \\
\n192.168.110.1 -p 4369<\/td>\n<\/tr>\n
eppc-enum-processes<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

Apple Remote Event\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u4ecb\u3057\u3066\u30d7\u30ed\u30bb\u30b9\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002Apple Remote Event\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u4ecb\u3057\u3066\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306b\u30a2\u30af\u30bb\u30b9\u3059\u308b\u3068\u3001\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306eUID\u3068PID\u3092\u542b\u3081\u3066\u5fdc\u7b54\u3057\u307e\u3059\u3002(\u8a8d\u8a3c\u8981\u6c42\u524d\u306b\u52d5\u4f5c\u3057\u307e\u3059\u3002)<\/td>\n\u5bfe\u8c61
\nMac OSX (\u30ea\u30e2\u30fc\u30c8\u30a2\u30c3\u30d7\u30eb\u30a4\u30d9\u30f3\u30c8:on)
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sn -Pn –script fcrdns \\
\n192.168.110.1<\/p>\n

\u203b\u4e0b\u8a18\u306e\u3068\u304a\u308a\u3001UID,PID\u3068\u3082\u306b\u306a\u306b\u3082\u51fa\u529b\u3055\u308c\u307e\u305b\u3093\u3067\u3057\u305f\u3002
\nPORT???? STATE SERVICE
\n3031\/tcp open? eppc
\n| eppc-enum-processes:
\n|_application? uid? pid<\/td>\n<\/tr>\n

fcrdns<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

“Forward-confirmed Reverse DNS lookup”\u3092\u5b9f\u884c\u3057\u3001\u7570\u5e38\u306a\u7d50\u679c\u3092\u51fa\u529b\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sn -Pn –script fcrdns \\
\n192.168.110.1<\/td>\n<\/tr>\n
finger<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

“finger”\u30b5\u30fc\u30d3\u30b9\u3092\u4f7f\u7528\u3057\u3066\u3001\u30e6\u30fc\u30b6\u540d\u306e\u30ea\u30b9\u30c8\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nCentOS7
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV -sC 192.168.110.1 -p 79<\/td>\n<\/tr>\n
firewalk<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

“firewalking”\u3068\u547c\u3070\u308c\u308bIP TTL expiration\u306e\u6280\u8853\u3092\u7528\u3044\u3001\u30d5\u30a1\u30a4\u30a2\u30a6\u30a9\u30fc\u30eb\u306e\u30eb\u30fc\u30eb\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script firewalk –traceroute \\
\n192.168.110.1<\/td>\n<\/tr>\n
firewall-bypass<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nintrusive, vuln<\/td>\n

netfilter\u304a\u3088\u3073\u305d\u306e\u4ed6\u306e\u30d5\u30a1\u30a4\u30a2\u30a6\u30a9\u30fc\u30eb\u306b\u5bfe\u3057\u3001FTP\u3084SIP\u306a\u3069\u306e\u30d7\u30ed\u30c8\u30b3\u30eb\u306e\u305f\u3081\u306b\u52d5\u7684\u306b\u958b\u3044\u3066\u3044\u308b\u30dd\u30fc\u30c8\u3092”helpers”\u3092\u4f7f\u7528\u3057\u3066\u8106\u5f31\u6027\u306e\u6709\u7121\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script firewall-bypass \\
\n192.168.110.1<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

flume-master-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

“Flume master”\u304c\u7a3c\u50cd\u3057\u3066\u3044\u308bHTTP\u30da\u30fc\u30b8\u304b\u3089\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script flume-master-info \\
\n192.168.110.1 -p 35871<\/td>\n<\/tr>\n
fox-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, version<\/td>\n

“Tridium Niagara Fox”(\u30d3\u30eb\u30aa\u30fc\u30c8\u30e1\u30fc\u30b7\u30e7\u30f3\u30b7\u30b9\u30c6\u30e0\u5185\u3067\u4f7f\u7528\u3055\u308c\u308b\u30d7\u30ed\u30c8\u30b3\u30eb)\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u30b7\u30b9\u30c6\u30e0\u304b\u3089\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script fox-info.nse \\
\n192.168.110.1 -p 1911<\/p>\n

\u203b\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u306f\u30b9\u30af\u30ea\u30d7\u30c8\u30d5\u30a1\u30a4\u30eb\u304a\u3088\u3073lua\u30d5\u30a1\u30a4\u30eb\u304c\u306a\u3044\u305f\u3081\u3001\u516c\u5f0f\u30da\u30fc\u30b8\u304b\u3089\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/td>\n<\/tr>\n

freelancer-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe, version<\/td>\n

UDP\u306e\u30b9\u30c6\u30fc\u30bf\u30b9\u30af\u30a8\u30ea\u3092\u9001\u4fe1\u3059\u308b\u3053\u3068\u306b\u3088\u308a\u3001\u30d5\u30ea\u30fc\u30e9\u30f3\u30b5\u30b2\u30fc\u30e0\u30b5\u30fc\u30d0(FLServer.exe)\u30b5\u30fc\u30d3\u30b9\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script freelancer-info \\
\n192.168.110.1 -p 2302<\/td>\n<\/tr>\n
ftp-anon<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, default, safe<\/td>\n

FTP\u30b5\u30fc\u30d0\u304c\u533f\u540d\u30ed\u30b0\u30a4\u30f3\u3092\u8a31\u53ef\u3057\u3066\u3044\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002
\n\u533f\u540d\u30ed\u30b0\u30a4\u30f3\u304c\u8a31\u53ef\u3055\u308c\u3066\u3044\u308b\u5834\u5408\u306f\u3001\u30eb\u30fc\u30c8\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u306e\u30ea\u30b9\u30c8\u3092\u53d6\u5f97\u3057\u3001\u66f8\u304d\u8fbc\u307f\u53ef\u80fd\u306a\u30d5\u30a1\u30a4\u30eb\u3092\u5f37\u8abf\u8868\u793a\u3057\u307e\u3059\u3002<\/td>\n		\u5bfe\u8c61
\nWindows7\/3CDaemon
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV -sC 192.168.110.1<\/td>\n<\/tr>\n
ftp-bounce<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, safe<\/td>\n

FTP\u30b5\u30fc\u30d0\u304cFTP\u30d0\u30a6\u30f3\u30b9\u30e1\u30bd\u30c3\u30c9\u3092\u4f7f\u7528\u3057\u3066\u30dd\u30fc\u30c8\u30b9\u30ad\u30e3\u30f3\u3092\u8a31\u53ef\u3057\u3066\u3044\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002(\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u306f\u300canonymous\u300d\u30e6\u30fc\u30b6\u3092\u4f7f\u7528\u3057\u307e\u3059\u3002)<\/td>\n\u5bfe\u8c61
\nWindows7\/3CDaemon
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV -sC 192.168.110.1<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cbounce working!\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

ftp-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

FTP\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7\/3CDaemon
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script ftp-brute \\
\n–script-args brute.firstonly=true \\
\n192.168.110.1 -p 21<\/td>\n<\/tr>\n
ftp-libopie<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nintrusive, vuln<\/td>\n

FTPd\u306b”CVE-2010-1938″(OPIE off-by-one stack overflow\u203b)\u306e\u8106\u5f31\u6027\u304c\u3042\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002
\n\u203b Maksymilian Arciemowicz and Adam “pi3” Zabrocki\u306b\u3088\u3063\u3066\u767a\u898b\u3055\u308c\u305f\u8106\u5f31\u6027\u3002 https:\/\/nmap.org\/r\/fbsd-sa-opie\u306e\u30a2\u30c9\u30d0\u30a4\u30b6\u30ea\u3092\u53c2\u7167\u3057\u3066\u304f\u3060\u3055\u3044\u3002\u540c\u8106\u5f31\u6027\u3092\u6301\u3064\u30db\u30b9\u30c8\u306b\u5bfe\u3057\u3066\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u5b9f\u884c\u3057\u305f\u5834\u5408\u3001FTPd\u304c\u30af\u30e9\u30c3\u30b7\u30e5\u3057\u307e\u3059\u306e\u3067\u3054\u6ce8\u610f\u304f\u3060\u3055\u3044\u3002\n<\/td>\n		\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV –script ftp-libopie \\
\n192.168.110.1<\/td>\n<\/tr>\n
ftp-proftpd-backdoor<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, intrusive, malware, vuln<\/td>\n

“OSVDB-ID 69562″\u3068\u3057\u3066\u5831\u544a\u3055\u308c\u305f\u8106\u5f31\u6027\u3001”ProFTPD 1.3.3c backdoor”\u306e\u6709\u7121\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u306f\u7121\u5bb3\u306aid\u30b3\u30de\u30f3\u30c9\u3092\u4f7f\u7528\u3057\u3066\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u5b9f\u884c\u3057\u307e\u3059\u304c\u3001”ftp-proftpd-backdoor.cmd”\u306e\u5f15\u6570\u3092\u6307\u5b9a\u3059\u308b\u3053\u3068\u3067\u5185\u5bb9\u3092\u5909\u66f4\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script ftp-proftpd-backdoor \\
\n192.168.110.1 -p 21<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cThis installation has been backdoored\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

ftp-vsftpd-backdoor<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, intrusive, malware, vuln<\/td>\n

“CVE-2011-2523″\u203b\u306e\u6709\u7121\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u306f\u7121\u5bb3\u306aid\u30b3\u30de\u30f3\u30c9\u3092\u4f7f\u7528\u3057\u3066\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u5b9f\u884c\u3057\u307e\u3059\u304c\u3001”exploit.cmd”\u3082\u3057\u304f\u306f”ftp-vsftpd-backdoor.cmd”\u306e\u5f15\u6570\u3092\u6307\u5b9a\u3059\u308b\u3053\u3068\u3067\u5185\u5bb9\u3092\u5909\u66f4\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002
\n\u203bvsFTPd 2.3.4 backdoor\u30012011\/07\/04\u306b\u5831\u544a<\/td>\n		\u5bfe\u8c61
\nMetasploitable\/vsftpd
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script ftp-vsftpd-backdoor \\
\n192.168.110.1 -p 21<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

ftp-vuln-cve2010-4221<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nintrusive, vuln<\/td>\n

ProFTPD\u30b5\u30fc\u30d0\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u300c1.3.2rc3\uff5e1.3.3b\u300d\u306b\u304a\u3051\u308b\u3001\u30b9\u30bf\u30c3\u30af\u30d9\u30fc\u30b9\u306e\u30d0\u30c3\u30d5\u30a1\u30aa\u30fc\u30d0\u30fc\u30d5\u30ed\u30fc(CVE-2010-4221)\u306e\u6709\u7121\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002\u540c\u8106\u5f31\u6027\u306f\u3001\u653b\u6483\u8005\u304c\u5927\u91cf\u306eTELNET_IAC\u30a8\u30b9\u30b1\u30fc\u30d7\u30b7\u30fc\u30b1\u30f3\u30b9\u3092\u9001\u4fe1\u3059\u308b\u3053\u3068\u306b\u3088\u308a\u3001ProFTPD\u30d7\u30ed\u30bb\u30b9\u3092\u30d0\u30c3\u30d5\u30a1\u9577\u3092\u8aa4\u3063\u3066\u8a08\u7b97\u3055\u305b\u3001\u30b9\u30bf\u30c3\u30af\u7834\u640d\u3092\u8a98\u767a\u3002ProFTPD\u30d7\u30ed\u30bb\u30b9\u306e\u30b3\u30f3\u30c6\u30ad\u30b9\u30c8\u5185\u3067\u4efb\u610f\u306e\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3059\u308b\u3053\u3068\u304c\u53ef\u80fd\u306b\u306a\u308b\u3082\u306e\u3067\u3059\u3002(\u8a8d\u8a3c\u4e0d\u8981)<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script ftp-vuln-cve2010-4221 \\
\n192.168.110.1 -p 21<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

ganglia-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

“Ganglia Monitoring”\u30c7\u30fc\u30e2\u30f3\u307e\u305f\u306f\u3001”Ganglia Meta”\u30e1\u30bf\u30c7\u30fc\u30e2\u30f3\u3092\u30ea\u30b9\u30cb\u30f3\u30b0\u3057\u3001\u30b7\u30b9\u30c6\u30e0\u60c5\u5831(OS\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u3001\u4f7f\u7528\u53ef\u80fd\u306a\u30e1\u30e2\u30ea\u306a\u3069)\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script ganglia-info \\
\n–script-args ganglia-info.timeout=60, \\
\nganglia-info.bytes=1000000 \\
\n192.168.110.1 -p 8649<\/td>\n<\/tr>\n
giop-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

“CORBA”\u30cd\u30fc\u30df\u30f3\u30b0\u30b5\u30fc\u30d0\u306b\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e\u30ea\u30b9\u30c8\u3092\u554f\u3044\u5408\u308f\u305b\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV -sC 192.168.110.1<\/td>\n<\/tr>\n
gkrellm-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

“GKRellM”\u30b5\u30fc\u30d3\u30b9\u203b\u3092\u7167\u4f1a\u3057\u307e\u3059\u3002\u7167\u4f1a\u6642\u306b\u306f\u60c5\u5831\u306e\u30b9\u30ca\u30c3\u30d7\u30b7\u30e7\u30c3\u30c8\u304c\u8868\u793a\u3055\u308c\u307e\u3059\u3002
\n\u203b\u30b5\u30fc\u30d0\u306e\u30b9\u30c6\u30fc\u30bf\u30b9\u3092\u76e3\u8996\u3059\u308b\u30b5\u30fc\u30d3\u30b9<\/td>\n		\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script gkrellm-info \\
\n192.168.110.1 -p 19150<\/td>\n<\/tr>\n
gopher-ls<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

“gopher”\u30b5\u30fc\u30d3\u30b9\u306e\u30eb\u30fc\u30c8\u306b\u3042\u308b\u30d5\u30a1\u30a4\u30eb\u3068\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u3092\u4e00\u89a7\u8868\u793a\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script gopher-ls \\
\n–script-args gopher-ls.maxfiles=100 \\
\n192.168.110.1 -p 70<\/td>\n<\/tr>\n
gpsd-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

“GPSD”\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30c7\u30fc\u30e2\u30f3\u304b\u3089GPS\u6642\u523b\u3001\u5ea7\u6a19\u3068\u901f\u5ea6\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script gpsd-info \\
\n192.168.110.1 -p 2947<\/td>\n<\/tr>\n
hadoop-datanode-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

“Apache Hadoop”\u30c7\u30fc\u30bf\u30ce\u30fc\u30c9\u306eHTTP\u30b9\u30c6\u30fc\u30bf\u30b9\u30da\u30fc\u30b8\u304b\u3089\u3001\u30ed\u30b0\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u306a\u3069\u306e\u60c5\u5831\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nhadoop-datanode-info.nse \\
\n192.168.111.12 -p 50075<\/td>\n<\/tr>\n
hadoop-jobtracker-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

“Apache Hadoop”JobTracker\u306eHTTP\u30b9\u30c6\u30fc\u30bf\u30b9\u30da\u30fc\u30b8\u304b\u3089\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nCentOS7\/hadoop1.2.1-1
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script hadoop-jobtracker-info \\
\n192.168.111.12 -p 50030<\/td>\n<\/tr>\n
hadoop-namenode-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

“Apache Hadoop”\u30cd\u30fc\u30e0\u30ce\u30fc\u30c9\u306eHTTP\u30b9\u30c6\u30fc\u30bf\u30b9\u30da\u30fc\u30b8\u304b\u3089\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script hadoop-namenode-info \\
\n192.168.111.12 -p 50070<\/td>\n<\/tr>\n
hadoop-secondary-namenode-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

“Apache Hadoop”\u30bb\u30ab\u30f3\u30c0\u30ea\u30cd\u30fc\u30e0\u30ce\u30fc\u30c9\u306eHTTP\u30b9\u30c6\u30fc\u30bf\u30b9\u30da\u30fc\u30b8\u304b\u3089\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script? \\
\nhadoop-secondary-namenode-info \\
\n192.168.111.12 -p 50090<\/td>\n<\/tr>\n
hadoop-tasktracker-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

“Apache Hadoop”TaskTracker\u306eHTTP\u30b9\u30c6\u30fc\u30bf\u30b9\u30da\u30fc\u30b8\u304b\u3089\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script hadoop-tasktracker-info \\
\n192.168.111.12 -p 50060<\/td>\n<\/tr>\n
hbase-master-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

“Apache Hbase (Hadoop\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9)”\u30de\u30b9\u30bf\u30b5\u30fc\u30d0\u306eHTTP\u30b9\u30c6\u30fc\u30bf\u30b9\u30da\u30fc\u30b8\u304b\u3089\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script hbase-master-info \\
\n192.168.111.12 -p 60010<\/td>\n<\/tr>\n
hbase-region-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

“Apache Hbase (Hadoop\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9)”\u30ea\u30fc\u30b8\u30e7\u30f3\u30b5\u30fc\u30d0\u306eHTTP\u30b9\u30c6\u30fc\u30bf\u30b9\u30da\u30fc\u30b8\u304b\u3089\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script hbase-region-info \\
\n192.168.111.12 -p 60030<\/td>\n<\/tr>\n
hddtemp-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

hddtemp\u30b5\u30fc\u30d3\u30b9\u304b\u3089\u30cf\u30fc\u30c9\u30c7\u30a3\u30b9\u30af\u60c5\u5831(\u30d6\u30e9\u30f3\u30c9\u3001\u30e2\u30c7\u30eb\u3001\u6e29\u5ea6\u306a\u3069)\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV -sC 192.168.110.1 -p 7634<\/td>\n<\/tr>\n
hnap-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

HNAP(Home Network Administration Protocol)\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u30cf\u30fc\u30c9\u30a6\u30a7\u30a2\u306e\u8a73\u7d30\u3084\u8a2d\u5b9a\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u540c\u30d7\u30ed\u30c8\u30b3\u30eb\u306f\u3001\u30ea\u30e2\u30fc\u30c8\u30c8\u30dd\u30ed\u30b8\u30c7\u30a3\u30b9\u30ab\u30d0\u30ea\u3001\u8a2d\u5b9a\u3001\u304a\u3088\u3073\u30eb\u30fc\u30bf\u3001\u30ab\u30e1\u30e9\u3001\u30d1\u30bd\u30b3\u30f3\u3001NAS\u306a\u3069\u306e\u30c7\u30d0\u30a4\u30b9\u306e\u7ba1\u7406\u3092\u53ef\u80fd\u306b\u3059\u308b\u3001HTTP-SOAP(Simple Object Access Protocol)\u30d9\u30fc\u30b9\u306e\u30d7\u30ed\u30c8\u30b3\u30eb\u3067\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script hnap-info \\
\n192.168.110.1 -p80,8080<\/td>\n<\/tr>\n
hostmap-bfk<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, external<\/td>\n

“http:\/\/www.bfk.de\/bfk_dnslogger.html”\u306e\u30aa\u30f3\u30e9\u30a4\u30f3\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u306b\u7167\u4f1a\u3057\u3001\u5bfe\u8c61IP\u30a2\u30c9\u30ec\u30b9\u3088\u308a\u30db\u30b9\u30c8\u540d\u3092\u89e3\u6c7a\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nGoogle Public DNS\u30b5\u30fc\u30d0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script hostmap-bfk \\
\n–script-args \\
\nhostmap-bfk.prefix=hostmap- 8.8.8.8<\/p>\n

\u203b\u30c7\u30d0\u30c3\u30b0\u60c5\u5831\u3088\u308a\u3001\u300chttp:\/\/www.bfk.de\/bfk_dnslogger.html\u300d\u3078\u306e\u554f\u3044\u5408\u308f\u305b\u30a8\u30e9\u30fc\u304c\u767a\u751f\u3057\u3001\u30b9\u30af\u30ea\u30d7\u30c8\u304c\u7d42\u4e86\u3057\u307e\u3057\u305f\u3002<\/td>\n<\/tr>\n

hostmap-ip2hosts<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, external<\/td>\n

“http:\/\/www.ip2hosts.com(Bing\u306e\u691c\u7d22\u7d50\u679c)”\u306e\u30aa\u30f3\u30e9\u30a4\u30f3\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u306b\u7167\u4f1a\u3057\u3001\u5bfe\u8c61IP\u30a2\u30c9\u30ec\u30b9\u3088\u308a\u30db\u30b9\u30c8\u540d\u3092\u89e3\u6c7a\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nGoogle Public DNS\u30b5\u30fc\u30d0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script hostmap-ip2hosts \\
\n–script-args \\
\n‘hostmap-ip2hosts.prefix=hostmap-‘ \\
\n8.8.8.8<\/p>\n

\u203b\u554f\u3044\u5408\u308f\u305b\u304c\u30a8\u30e9\u30fc\u3068\u306a\u308a\u3001\u30b9\u30af\u30ea\u30d7\u30c8\u304c\u7d42\u4e86\u3057\u307e\u3057\u305f\u3002<\/td>\n<\/tr>\n

hostmap-robtex<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, external, safe<\/td>\n

“http:\/\/ip.robtex.com\/(Bing\u306e\u691c\u7d22\u7d50\u679c)”\u306e\u30aa\u30f3\u30e9\u30a4\u30f3Robtex\u30b5\u30fc\u30d3\u30b9\u306b\u7167\u4f1a\u3057\u3001\u5bfe\u8c61IP\u30a2\u30c9\u30ec\u30b9\u3088\u308a\u30db\u30b9\u30c8\u540d\u3092\u89e3\u6c7a\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nGoogle Public DNS\u30b5\u30fc\u30d0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sn -Pn –script hostmap-robtex \\
\n8.8.8.8<\/td>\n<\/tr>\n
http-adobe-coldfusion-apsa1301<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, vuln<\/td>\n

Adobe ColdFusion\u30b5\u30fc\u30d0\u306b\u3066\u3001\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9\u306e\u8106\u5f31\u6027\u3092\u3064\u3044\u305f\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u5b9f\u884c\u3057\u3001\u6709\u52b9\u306a\u7ba1\u7406\u8005\u306e\u30bb\u30c3\u30b7\u30e7\u30f3\u30af\u30c3\u30ad\u30fc\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV –script \\
\nhttp-adobe-coldfusion-apsa1301 \\
\n192.168.110.1<\/td>\n<\/tr>\n
http-affiliate-id<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

\u30a6\u30a7\u30d6\u30da\u30fc\u30b8\u304b\u3089\u30a2\u30d5\u30a3\u30ea\u30a8\u30a4\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30afID(Google AdSense\u3084Analytics\u3001Amazon Associates\u306a\u3069)\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u540cID\u306f\u3001\u540c\u3058\u6240\u6709\u8005\u306e\u30da\u30fc\u30b8\u3092\u8b58\u5225\u3059\u308b\u305f\u3081\u306b\u4f7f\u7528\u3067\u304d\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script=http-affiliate-id.nse \\
\n–script-args \\
\nhttp-affiliate-id.url-path=\/ 192.168.110.1<\/td>\n<\/tr>\n
http-apache-negotiation<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

\u5bfe\u8c61\u306ehttp\u30b5\u30fc\u30d0\u3067”mod_negotiation”\u304c\u6709\u52b9\u306b\u306a\u3063\u3066\u3044\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002\u540c\u6a5f\u80fd\u306f\u3001\u96a0\u3055\u308c\u305f\u30ea\u30bd\u30fc\u30b9\u3092\u691c\u7d22\u3057\u3001\u5c11\u306a\u3044\u30ea\u30af\u30a8\u30b9\u30c8\u3067Web\u30b9\u30d1\u30a4\u30c0\u30fc\u3059\u308b\u305f\u3081\u306b\u5229\u7528\u3055\u308c\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable\/Apache
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script http-apache-negotiation \\
\n192.168.110.1<\/td>\n<\/tr>\n
http-apache-server-status<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

“mod_status”\u304c\u6709\u52b9\u306b\u306a\u3063\u3066\u3044\u308bApache Web\u30b5\u30fc\u30d0\u306e\u30b5\u30fc\u30d0\u30b9\u30c6\u30fc\u30bf\u30b9\u30da\u30fc\u30b8\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u30b5\u30fc\u30d0\u30b9\u30c6\u30fc\u30bf\u30b9\u30da\u30fc\u30b8\u304c\u5b58\u5728\u3057\u3001”mod_status”\u304c\u6709\u52b9\u306a\u5834\u5408\u3001\u30b7\u30b9\u30c6\u30e0\u306e\u7a3c\u50cd\u6642\u9593\u3001Apache\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u3001\u304a\u3088\u3073\u6700\u65b0\u306eHTTP\u8981\u6c42\u306a\u3069\u306e\u60c5\u5831\u3092\u89e3\u6790\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nhttp-apache-server-status?\\
\n192.168.110.1 -p 80<\/td>\n<\/tr>\n
http-aspnet-debug<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, vuln<\/td>\n

“ASP.NET”\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u304c\u3001”HTTP DEBUG”\u8981\u6c42\u3067\u30c7\u30d0\u30c3\u30b0\u304c\u6709\u52b9\u306b\u306a\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-aspnet-debug \\
\n192.168.110.1<\/td>\n<\/tr>\n
http-auth<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, default, safe<\/td>\n

\u8a8d\u8a3c\u3092\u5fc5\u8981\u3068\u3059\u308bWeb\u30b5\u30fc\u30d3\u30b9\u306e\u8a8d\u8a3c\u65b9\u5f0f\u3068\u30ec\u30eb\u30e0\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-auth –script-args \\
\nhttp-auth.path=\/phpMyAdmin \\
\n192.168.110.1 -p 80<\/td>\n<\/tr>\n
http-auth-finder<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

Web\u30b9\u30d1\u30a4\u30c0\u30fc\u3092\u884c\u3044\u3001\u30d5\u30a9\u30fc\u30e0\u30d9\u30fc\u30b9\u307e\u305f\u306fHTTP\u30d9\u30fc\u30b9\u306e\u8a8d\u8a3c\u304c\u5fc5\u8981\u306aWeb\u30da\u30fc\u30b8\u3092\u691c\u7d22\u3057\u307e\u3059\u3002\u7d50\u679c\u306f\u5404URL\u3068\u8a8d\u8a3c\u65b9\u6cd5\u306e\u30c6\u30fc\u30d6\u30eb\u3067\u51fa\u529b\u3055\u308c\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script http-auth-finder \\
\n192.168.110.1 -p 80<\/td>\n<\/tr>\n
http-avaya-ipoffice-users<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, vuln<\/td>\n

Avaya\u306eIP Office System7.x\u306e\u30e6\u30fc\u30b6\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nhttp-avaya-ipoffice-users \\
\n192.168.110.1 -p 80<\/td>\n<\/tr>\n
http-awstatstotals-exec<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, intrusive, vuln<\/td>\n

“AWStats Totals”\u306e1.0-1.14\u304a\u3088\u3073\u305d\u306e\u4ed6\u88fd\u54c1\u306b\u304a\u3051\u308b\u3001\u30ea\u30e2\u30fc\u30c8\u3067\u30b3\u30fc\u30c9\u304c\u5b9f\u884c\u3055\u308c\u308b\u8106\u5f31\u6027(CVE: 2008-3922)\u3092\u3064\u304f\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV –script \\
\nhttp-awstatstotals-exec.nse 192.168.110.1<\/td>\n<\/tr>\n
http-axis2-dir-traversal<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, intrusive, vuln<\/td>\n

Apache Axis2\u306e\u30d0\u30fc\u30b8\u30e7\u30f31.4.1\u306b\u5bfe\u3057\u3001\u30d1\u30e9\u30e1\u30fc\u30bfxsd(OSVDB-59001)\u306b\u3001\u7279\u5225\u306a\u7d30\u5de5\u3092\u3057\u305f\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u9001\u4fe1\u3057\u3066\u3001\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u306e\u8106\u5f31\u6027\u3092\u3064\u304f\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u306f\u3001\u7ba1\u7406\u8005\u30a2\u30ab\u30a6\u30f3\u30c8\u306e\u30e6\u30fc\u30b6\u540d\u3068\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u5f97\u308b\u305f\u3081\u306b\u3001”\/axis2\/services\/”\u306e\u30d1\u30b9\u3092\u4f7f\u7528\u3057\u3066Axis2\u306e\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb”\/conf\/axis2.xml”\u306e\u53d6\u5f97\u3092\u8a66\u307f\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-axis2-dir-traversal \\
\n192.168.110.12 -p80<\/td>\n<\/tr>\n
http-backup-finder<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

Web\u30b9\u30d1\u30a4\u30c0\u30fc\u3092\u884c\u3044\u3001\u767a\u898b\u3057\u305f\u30d5\u30a1\u30a4\u30eb\u306e\u30d0\u30c3\u30af\u30a2\u30c3\u30d7\u30b3\u30d4\u30fc\u3092\u63a2\u3057\u307e\u3059\u3002(\u4f8b\u3048\u3070\u3001index.html\u306e\u5834\u5408\u3001index.bak\u3001index.html~\u3001copy of index.html\u306a\u3069)<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-backup-finder \\
\n192.168.110.1<\/td>\n<\/tr>\n
http-barracuda-dir-traversal<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, exploit, intrusive<\/td>\n

“Barracuda Networks Spam & Virus Firewal”\u30c7\u30d0\u30a4\u30b9\u306e\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u306e\u8106\u5f31\u6027\u3092\u3064\u3044\u3066\u69cb\u6210\u8a2d\u5b9a\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002
\n\u8106\u5f31\u6027\u60c5\u5831\u306b\u3064\u3044\u3066\u306f\u4e0b\u8a18\u3092\u53c2\u7167\u304f\u3060\u3055\u3044\u3002
\nhttp:\/\/seclists.org\/fulldisclosure\/2010\/Oct\/119<\/td>\n		\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nhttp-barracuda-dir-traversal \\
\n–script-args \\
\nhttp-max-cache-size=5000000 \\
\n192.168.110.1<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u69cb\u6210\u60c5\u5831\u304c\u51fa\u529b\u3055\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

HTTP\u30d9\u30fc\u30b7\u30c3\u30af\u3001\u30c0\u30a4\u30b8\u30a7\u30b9\u30c8\u304a\u3088\u3073NTLM\u8a8d\u8a3c\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-brute –script-args \\
\nhttp-brute.path=\/phpMyAdmin \\
\n192.168.110.1 -p 80<\/td>\n<\/tr>\n
http-cakephp-version<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nsafe, discovery<\/td>\n

“CakePHP”\u306e\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u5185\u306b\u3042\u308b”fingerprinting”\u306e\u30c7\u30d5\u30a9\u30eb\u30c8\u30d5\u30a1\u30a4\u30eb\u306b\u3088\u308a\u3001”CakePHP”\u306e\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u3067\u69cb\u7bc9\u3055\u308c\u305fWeb\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e”CakePHP”\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-cakephp-version \\
\n192.168.110.1 -p80,443<\/td>\n<\/tr>\n
http-chrono<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

\u30a6\u30a7\u30d6\u30b5\u30a4\u30c8\u304c\u30a6\u30a7\u30d6\u30da\u30fc\u30b8\u3092\u914d\u4fe1\u3059\u308b\u306e\u306b\u304b\u304b\u308b\u6642\u9593\u3092\u6e2c\u5b9a\u3057\u3001\u30da\u30fc\u30b8\u3092\u53d6\u5f97\u3059\u308b\u306e\u306b\u8981\u3057\u305f\u6700\u5927\u3001\u6700\u5c0f\u3001\u304a\u3088\u3073\u5e73\u5747\u6642\u9593\u3092\u8fd4\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script http-chrono 192.168.110.1<\/td>\n<\/tr>\n
http-cisco-anyconnect<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

Cisco AnyConnect\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u3092\u4f7f\u7528\u3057\u3066SSLVPN\u3092\u63a5\u7d9a\u3057\u3001\u30d0\u30fc\u30b8\u30e7\u30f3\u3068\u30c8\u30f3\u30cd\u30eb\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-cisco-anyconnect \\
\n192.168.110.1 -p 443<\/td>\n<\/tr>\n
http-coldfusion-subzero<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit<\/td>\n

ColdFusion9\u304a\u3088\u307310\u306b\u5b58\u5728\u3059\u308b\u8106\u5f31\u6027\u3092\u3064\u3044\u3066\u3001\u30d0\u30fc\u30b8\u30e7\u30f3\u60c5\u5831\u3001\u7ba1\u7406\u30d1\u30cd\u30eb\u306e\u7d76\u5bfe\u30d1\u30b9\u3001\u304a\u3088\u3073”password.properties”\u30d5\u30a1\u30a4\u30eb\u306e\u53d6\u5f97\u3092\u8a66\u307f\u307e\u3059\u3002
\n\u203b\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8”ColdSub-Zero.pyFusion v2″\u306b\u57fa\u3065\u3044\u3066\u3044\u307e\u3059\u3002<\/td>\n		\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV –script \\
\nhttp-coldfusion-subzero \\
\n192.168.110.1<\/td>\n<\/tr>\n
http-comments-displayer<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

HTTP\u5fdc\u7b54\u304b\u3089HTML\u304a\u3088\u3073JavaScript\u306e\u30b3\u30e1\u30f3\u30c8\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script \\
\nhttp-comments-displayer.nse \\
\n192.168.110.1 -p 80<\/td>\n<\/tr>\n
http-config-backup<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, intrusive<\/td>\n

\u4e00\u822c\u7684\u306a\u30b3\u30f3\u30c6\u30f3\u30c4\u7ba1\u7406\u30b7\u30b9\u30c6\u30e0\u3068Web\u30b5\u30fc\u30d0\u69cb\u6210\u30d5\u30a1\u30a4\u30eb\u306e\u30d0\u30c3\u30af\u30a2\u30c3\u30d7\u3068\u30b9\u30ef\u30c3\u30d7\u30d5\u30a1\u30a4\u30eb\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script=http-config-backup \\
\n192.168.110.1<\/td>\n<\/tr>\n
http-cors<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

\u30af\u30ed\u30b9\u30fb\u30aa\u30ea\u30b8\u30f3\u30fb\u30ea\u30bd\u30fc\u30b9\u5171\u6709\u203b(CORS)\u7528\u306ehttp\u30b5\u30fc\u30d0\u3092\u30c6\u30b9\u30c8\u3057\u307e\u3059\u3002
\n\u203b\u7279\u5b9a\u306e\u30e1\u30bd\u30c3\u30c9\u304c\u4ed6\u306e\u30c9\u30e1\u30a4\u30f3\u306b\u3088\u3063\u3066\u547c\u3073\u51fa\u3055\u308c\u305f\u3053\u3068\u3092\u30c9\u30e1\u30a4\u30f3\u304c\u660e\u793a\u7684\u306b\u30aa\u30d7\u30c8\u30a4\u30f3\u3059\u308b\u65b9\u6cd5<\/td>\n		\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-cors \\
\n192.168.110.1 -p 80<\/td>\n<\/tr>\n
http-cross-domain-policy<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexternal, safe, vuln<\/td>\n

Web\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u304a\u3088\u3073\u4fe1\u983c\u3055\u308c\u305f\u30c9\u30e1\u30a4\u30f3\u306e\u3001\u30af\u30ed\u30b9\u30c9\u30e1\u30a4\u30f3\u30dd\u30ea\u30b7\u30fc\u30d5\u30a1\u30a4\u30eb(\/crossdomain.xml)\u304a\u3088\u3073\u3001\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30a2\u30af\u30bb\u30b9\u30dd\u30ea\u30b7\u30fc\u30d5\u30a1\u30a4\u30eb(\/clientaccesspolicy.xml)\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002\u3086\u308b\u3044\u30dd\u30ea\u30b7\u30fc\u304c\u8a2d\u5b9a\u3055\u308c\u3066\u3044\u308b\u5834\u5408\u3001\u30af\u30ed\u30b9\u30b5\u30a4\u30c8\u30ea\u30af\u30a8\u30b9\u30c8\u30d5\u30a9\u30fc\u30b8\u30a7\u30ea\u653b\u6483\u3092\u53ef\u80fd\u306b\u3057\u3001\u653b\u6483\u8005\u304c\u6a5f\u5bc6\u30c7\u30fc\u30bf\u306b\u30a2\u30af\u30bb\u30b9\u53ef\u80fd\u306b\u306a\u308a\u307e\u3059\u3002\u3053\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001\u8a31\u5bb9\u69cb\u6210\u3084\u8cfc\u5165\u53ef\u80fd\u306a\u53ef\u80fd\u306a\u30c9\u30e1\u30a4\u30f3\u540d\u3092\u691c\u51fa\u3059\u308b\u306e\u306b\u6709\u7528\u3067\u3059\u3002<\/td>\n\u5bfe\u8c61
\nOWASP Broken Web Apps 1.2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script \\
\nhttp-cross-domain-policy \\
\n192.168.110.12<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-csrf<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, intrusive, vuln<\/td>\n

\u30af\u30ed\u30b9\u30b5\u30a4\u30c8\u30ea\u30af\u30a8\u30b9\u30c8\u30d5\u30a9\u30fc\u30b8\u30a7\u30ea(CSRF)\u306e\u8106\u5f31\u6027\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nBadStore
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script http-csrf.nse \\
\n192.168.110.11 -p 80<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u8106\u5f31\u6027\u306e\u3042\u308b\u30d1\u30b9\u304a\u3088\u3073\u30d5\u30a9\u30fc\u30e0\u304c\u51fa\u529b\u3055\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-date<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

HTTP(\u3082\u3057\u304f\u306fHTTP\u306b\u4f3c\u305f)\u30b5\u30fc\u30d3\u30b9\u304b\u3089\u65e5\u4ed8\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u307e\u305f\u3001\u53d6\u5f97\u3057\u305f\u65e5\u4ed8\u3068\u30ed\u30fc\u30ab\u30eb\u6642\u9593\u306e\u5dee\u7570\u3092\u51fa\u529b\u3057\u307e\u3059\u3002\u30ed\u30fc\u30ab\u30eb\u6642\u9593\u306f\u3001HTTP\u30ea\u30af\u30a8\u30b9\u30c8\u304c\u9001\u4fe1\u3055\u308c\u305f\u6642\u523b\u3068\u306a\u308b\u306e\u3067\u3001\u6642\u9593\u306e\u5dee\u7570\u306b\u306fRTT\u3092\u542b\u307f\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nBadStore
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV –script http-date \\
\n192.168.110.11 -p 80<\/td>\n<\/tr>\n
http-default-accounts<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, intrusive, discovery<\/td>\n

Web\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u304a\u3088\u3073\u3055\u307e\u3056\u307e\u306a\u30c7\u30d0\u30a4\u30b9\u3067\u4f7f\u7528\u3055\u308c\u3066\u3044\u308b\u30c7\u30d5\u30a9\u30eb\u30c8\u306e\u8cc7\u683c\u60c5\u5831\u3092\u5229\u7528\u3057\u3066\u30a2\u30af\u30bb\u30b9\u30c6\u30b9\u30c8\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-default-accounts \\
\n192.168.110.1 -p 80<\/td>\n<\/tr>\n
http-devframework<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

\u5bfe\u8c61\u30a6\u30a7\u30d6\u30b5\u30a4\u30c8\u306e\u30d0\u30c3\u30af\u30a8\u30f3\u30c9\u306b\u3042\u308b\u6280\u8853\u3092\u898b\u3064\u3051\u307e\u3059\u3002\u540c\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001\u5171\u901a\u30d8\u30c3\u30c0\u3084URL\u3001HTML\u30b3\u30f3\u30c6\u30f3\u30c4\u306a\u3069\u3001\u5909\u66f4\u3055\u308c\u3066\u3044\u306a\u3044\u53ef\u80fd\u6027\u306e\u3042\u308b\u65e2\u5b9a\u5024\u3092\u30c1\u30a7\u30c3\u30af\u3057\u307e\u3059\u3002\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3044\u304f\u3064\u304b\u306e\u63a8\u6e2c\u3092\u884c\u3044\u307e\u3059\u304c\u3001\u5168\u4f53\u7684\u306b\u7279\u5b9a\u306e\u30b5\u30a4\u30c8\u304c\u3069\u306e\u6280\u8853\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u304b\u3092\u5224\u65ad\u3059\u308b\u65b9\u6cd5\u306f\u306a\u3044\u3053\u3068\u306b\u6ce8\u610f\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/td>\n\u5bfe\u8c61
\nOWASP Broken Web Apps 1.2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script http-devframework.nse \\
\n192.168.110.12 -p 80<\/td>\n<\/tr>\n
http-dlink-backdoor<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, vuln<\/td>\n

D-Link\u30eb\u30fc\u30bf\u306e\u30d5\u30a1\u30fc\u30e0\u30a6\u30a7\u30a2\u306b\u3042\u308b\u30d0\u30c3\u30af\u30c9\u30a2\u3092\u691c\u51fa\u3057\u307e\u3059\u3002\u306a\u304a\u3001\u540c\u30d0\u30c3\u30af\u30c9\u30a2\u306f\u30e6\u30fc\u30b6\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8\u306e\u5024\u3092”secret”\u306b\u5909\u66f4\u3059\u308b\u3053\u3068\u306b\u3088\u308a\u3001\u8a8d\u8a3c\u3092\u30d0\u30a4\u30d1\u30b9\u3057\u3001\u30eb\u30fc\u30bf\u3078\u306e\u7ba1\u7406\u30a2\u30af\u30bb\u30b9\u3092\u8a31\u53ef\u3059\u308b\u3082\u306e\u3067\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV –script http-dlink-backdoor \\
\n192.168.110.1<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-dombased-xss<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, intrusive, vuln<\/td>\n

DOM\u5185\u306e\u653b\u6483\u8005\u304c\u5236\u5fa1\u3059\u308b\u60c5\u5831\u3092\u4f7f\u7528\u3057\u3066JavaScript\u306e\u5b9f\u884c\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u308b\u53ef\u80fd\u6027\u306e\u3042\u308b\u5834\u6240\u3092\u7279\u5b9a\u3057\u307e\u3059\u3002
\n\u653b\u6483\u5185\u5bb9\u306f\u3053\u3061\u3089<\/a>\u3067\u8aac\u660e\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/td>\n		\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -p80 –script \\
\nhttp-dombased-xss.nse 192.168.110.1<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u8106\u5f31\u6027\u306e\u3042\u308b\u30d1\u30b9\u304c\u51fa\u529b\u3055\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-domino-enum-passwords<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, intrusive<\/td>\n

\u8a8d\u8a3c\u3055\u308c\u305f\u3059\u3079\u3066\u306e\u30e6\u30fc\u30b6\u304c\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u30a2\u30af\u30bb\u30b9\u53ef\u80fd\u306a\u30cf\u30c3\u30b7\u30e5\u3055\u308c\u305fDomino\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u540c\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001\u30e6\u30fc\u30b6\u6587\u66f8\u306b\u6dfb\u4ed8\u3055\u308c\u3066\u3044\u308b\u3059\u3079\u3066\u306eDomino ID\u30d5\u30a1\u30a4\u30eb\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3059\u308b\u3053\u3068\u3082\u3067\u304d\u307e\u3059\u3002\u30d1\u30b9\u30ef\u30fc\u30c9\u306fJohn the Ripper\u306e\u5b9f\u884c\u306b\u9069\u3057\u305f\u5f62\u5f0f\u3067\u8868\u793a\u3055\u308c\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nhttp-domino-enum-passwords \\
\n–script-args \\
\ndomino-enum-passwords.\\
\nusername=’root’,\\
\ndomino-enum-passwords.\\
\npassword=’root’ \\
\n192.168.110.1 -p 80<\/td>\n<\/tr>\n
http-drupal-enum<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

\u65e2\u77e5\u306e\u30e2\u30b8\u30e5\u30fc\u30eb\u3084\u30c6\u30fc\u30de\u306e\u30ea\u30b9\u30c8\u3092\u4f7f\u7528\u3057\u3066\u3001\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3055\u308c\u3066\u3044\u308bDrupal\u306e\u30e2\u30b8\u30e5\u30fc\u30eb\u304a\u3088\u3073\u30c6\u30fc\u30de\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-drupal-enum \\
\n192.168.110.1 -p 80<\/td>\n<\/tr>\n
http-drupal-enum-users<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

Views(Drupal\u3067\u6700\u3082\u3088\u304f\u4f7f\u308f\u308c\u308b\u30e2\u30b8\u30e5\u30fc\u30eb)\u306e\u60c5\u5831\u6f0f\u3048\u3044\u306e\u8106\u5f31\u6027\u3092\u3064\u304f\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u5b9f\u884c\u3057\u3001Drupal\u306e\u30e6\u30fc\u30b6\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-drupal-enum-users \\
\n–script-args \\
\nhttp-drupal-enum-users.root=’\/’ \\
\n192.168.110.1<\/td>\n<\/tr>\n
http-enum<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive, vuln<\/td>\n

\u4e00\u822c\u7684\u306aWeb\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u304a\u3088\u3073\u30b5\u30fc\u30d0\u3067\u4f7f\u7528\u3055\u308c\u308b\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nBadStore
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV –script http-enum \\
\n192.168.110.11 -p 80<\/td>\n<\/tr>\n
http-errors<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

Web\u30b5\u30a4\u30c8\u3092\u5de1\u308a\u3001\u4efb\u610f\u306e\u30a8\u30e9\u30fc\u30da\u30fc\u30b8\u3092\u8fd4\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nBadStore
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script http-errors.nse \\
\n192.168.110.11 -p 80<\/td>\n<\/tr>\n
http-exif-spider<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nintrusive<\/td>\n

Web\u30b5\u30a4\u30c8\u3092\u5de1\u308a\u3001jpg\u30d5\u30a1\u30a4\u30eb\u306eEXIF\u30c7\u30fc\u30bf\u53d6\u5f97\u3057\u3001\u30ab\u30e1\u30e9\u306e\u30e2\u30c7\u30eb\u3001\u5199\u771f\u304c\u64ae\u5f71\u3055\u308c\u305f\u65e5\u4ed8\u3001\u30b8\u30aa\u30bf\u30b0\u60c5\u5831\u3092\u8868\u793a\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-exif-spider \\
\n192.168.110.1 -p 80<\/td>\n<\/tr>\n
http-favicon<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

Web\u30da\u30fc\u30b8\u304b\u3089favicon(\u304a\u6c17\u306b\u5165\u308a\u30a2\u30a4\u30b3\u30f3)\u3092\u53d6\u5f97\u3057\u3001\u6709\u540d\u306aWeb\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u30a2\u30a4\u30b3\u30f3\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u3067\u7167\u5408\u3057\u307e\u3059\u3002\u4e00\u81f4\u3057\u305f\u5834\u5408\u3001\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u540d\u524d\u3092\u8868\u793a\u3057\u307e\u3059\u3002\u4e00\u81f4\u3057\u306a\u3044\u5834\u5408\u306b\u306f\u3001\u30a2\u30a4\u30b3\u30f3\u30c7\u30fc\u30bf\u306eMD5\u30cf\u30c3\u30b7\u30e5\u3092\u8868\u793a\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nOWASP Broken Web Apps 1.2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script http-favicon.nse \\
\n192.168.110.12 -p 80<\/td>\n<\/tr>\n
http-feed<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

Web\u30b5\u30a4\u30c8\u3092\u5de1\u308a\u3001RSS\u307e\u305f\u306fAtom\u30d5\u30a3\u30fc\u30c9\u3092\u898b\u3064\u3051\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nOWASP Broken Web Apps 1.2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script http-feed.nse \\
\n192.168.110.12 -p 80<\/td>\n<\/tr>\n
http-fetch<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nsafe<\/td>\n

HTTP\u30b5\u30fc\u30d0\u304b\u3089\u30d5\u30a1\u30a4\u30eb\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nOWASP Broken Web Apps 1.2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script http-fetch \\
\n–script-args “paths={\/favicon.ico}, \\
\nhttp-fetch.destination=’\/tmp\/mirror'” \\
\n192.168.110.12 -p 80<\/td>\n<\/tr>\n
http-fileupload-exploiter<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, intrusive, vuln<\/td>\n

Content-Type\u30d8\u30c3\u30c0\u306e\u5909\u66f4\u3084\u3001\u30b3\u30e1\u30f3\u30c8\u5185\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u542b\u3080\u6709\u52b9\u306a\u30a4\u30e1\u30fc\u30b8\u30d5\u30a1\u30a4\u30eb\u306e\u4f5c\u6210\u306a\u3069\u3001\u3055\u307e\u3056\u307e\u306a\u624b\u6cd5\u3092\u4f7f\u7528\u3057\u3066\u3001Web\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u5185\u306e\u4e0d\u5b89\u5b9a\u306a\u30d5\u30a1\u30a4\u30eb\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u30d5\u30a9\u30fc\u30e0\u306b\u5bfe\u3057\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nhttp-fileupload-exploiter.nse \\
\n192.168.110.12 -p80<\/td>\n<\/tr>\n
http-form-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

HTTP\u30d5\u30a9\u30fc\u30e0\u30d9\u30fc\u30b9\u8a8d\u8a3c\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-form-brute \\
\n–script-args \\
\nhttp-form-brute.path=\/phpMyAdmin\/ \\
\n192.168.110.1 -p 80<\/td>\n<\/tr>\n
http-form-fuzzer<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nfuzzer, intrusive<\/td>\n

\u30a6\u30a7\u30d6\u30b5\u30a4\u30c8\u4e0a\u3067\u898b\u3064\u304b\u3063\u305f\u30d5\u30a9\u30fc\u30e0\u306b\u5bfe\u3057\u3066\u7c21\u5358\u306a\u30d5\u30a9\u30fc\u30e0\u306e\u30d5\u30a1\u30b8\u30f3\u30b0\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002(\u6587\u5b57\u5217\u3068\u6570\u5024\u306e\u6587\u5b57\u6570\u3092\u5897\u52a0\u3055\u305b\u3001\u30d5\u30a1\u30b8\u30f3\u30b0\u304c\u6210\u529f\u3057\u305f\u304b\u3069\u3046\u304b\u3092\u5224\u65ad\u3057\u3088\u3046\u3068\u3057\u307e\u3059\u3002)<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-form-fuzzer \\
\n–script-args \\
\n‘http-form-fuzzer.targets=\\
\n{1={path=\/phpMyAdmin\/}}’ \\
\n192.168.110.1 -p 80<\/td>\n<\/tr>\n
http-frontpage-login<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nsafe, vuln<\/td>\n

\u5bfe\u8c61\u304c\u533f\u540d\u306e”FrontPage”\u30ed\u30b0\u30a4\u30f3\u306b\u8106\u5f31\u3067\u3042\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-frontpage-login \\
\n192.168.110.1 -p 80<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-generator<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

“generator”\u306emeta\u30bf\u30b0\u304c\u3042\u308c\u3070\u3001\u305d\u306e\u5185\u5bb9\u3092\u8868\u793a\u3057\u307e\u3059\u3002(\u30c7\u30d5\u30a9\u30eb\u30c8\u306e\u30d1\u30b9\u306f”\/”\u3067\u3059\u3002)<\/td>\n\u5bfe\u8c61
\nOWASP Broken Web Apps 1.2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script http-generator\\
\n –script-args \\
\nhttp-generator.path=\/wordpress \\
\n192.168.110.12 -p 80<\/td>\n<\/tr>\n
http-git<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, safe, vuln<\/td>\n

\u30a6\u30a7\u30d6\u30b5\u30a4\u30c8\u306e\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u30eb\u30fc\u30c8(\/.git\/xxxx)\u306b\u3042\u308bGit\u30ea\u30dd\u30b8\u30c8\u30ea\u3092\u78ba\u8a8d\u3057\u3001\u8a00\u8a9e\/\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u3001\u30ea\u30e2\u30fc\u30c8\u3001\u6700\u5f8c\u306e\u30b3\u30df\u30c3\u30c8\u30e1\u30c3\u30bb\u30fc\u30b8\u3001\u30ea\u30dd\u30b8\u30c8\u30ea\u306e\u8aac\u660e\u306a\u3069\u3001\u3067\u304d\u308b\u3060\u3051\u591a\u304f\u306e\u30ea\u30dd\u30b8\u30c8\u30ea\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV -sC 192.168.110.1<\/td>\n<\/tr>\n
http-gitweb-projects-enum<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

git\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u3001\u6240\u6709\u8005\u3001\u304a\u3088\u3073\u8aac\u660e\u306e\u30ea\u30b9\u30c8\u3092gitweb\uff08Git\u30ea\u30d3\u30b8\u30e7\u30f3\u7ba1\u7406\u30b7\u30b9\u30c6\u30e0\u306eWeb\u30a4\u30f3\u30bf\u30fc\u30d5\u30a7\u30a4\u30b9\uff09\u304b\u3089\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap www.example.com \\
\n–script http-gitweb-projects-enum -p80<\/td>\n<\/tr>\n
http-google-malware<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, external, malware, safe<\/td>\n

\u30db\u30b9\u30c8\u304cGoogle\u306e\u30d6\u30e9\u30c3\u30af\u30ea\u30b9\u30c8(\u30de\u30eb\u30a6\u30a7\u30a2\u3084\u30d5\u30a3\u30c3\u30b7\u30f3\u30b0\u306e\u30b5\u30fc\u30d0\u306e\u30ea\u30b9\u30c8)\u306b\u8f09\u3063\u3066\u3044\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002\u540c\u30ea\u30b9\u30c8\u306fGoogle\u306e\u30bb\u30fc\u30d5\u30d6\u30e9\u30a6\u30b8\u30f3\u30b0\u30b5\u30fc\u30d3\u30b9\u306e\u4e00\u90e8\u3067\u3001\u5e38\u306b\u66f4\u65b0\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-google-malware \\
\nxx.xx.xx.xx -p 80<\/td>\n<\/tr>\n
http-grep<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

Web\u30b5\u30a4\u30c8\u3092\u5de1\u308a\u3001\u6307\u5b9a\u3057\u305f\u6587\u5b57\u5217\u306b\u5408\u81f4\u3059\u308b\u3059\u3079\u3066\u306e\u30da\u30fc\u30b8\u3068URL\u3092\u30ab\u30a6\u30f3\u30c8\u3057\u307e\u3059\u3002\u7d50\u679c\u306fURL\u3054\u3068\u306b\u30b0\u30eb\u30fc\u30d7\u5316\u3055\u308c\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nOWASP Broken Web Apps 1.2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script http-grep –script-args \\
\n‘match=”[A-Za-z0-9%.%%%+%-]+\\
\n@[A-Za-z0-9%.%%%+%-]+\\
\n%.%w%w%w?%w?”,\\
\nbreakonmatch’ \\
\n192.168.110.12 -p 80<\/td>\n<\/tr>\n
http-headers<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

Web\u30b5\u30fc\u30d0\u306e\u30eb\u30fc\u30c8\u30d5\u30a9\u30eb\u30c0( “\/”)\u306b\u5bfe\u3057\u3066HEAD\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u5b9f\u884c\u3057\u3001HTTP\u30d8\u30c3\u30c0\u306e\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nOWASP Broken Web Apps 1.2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV –script http-headers \\
\n192.168.110.12 -p 80<\/td>\n<\/tr>\n
http-huawei-hg5xx-vuln<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, vuln<\/td>\n

Huawei\u793e\u30e2\u30c7\u30e0HG530x\u3001HG520x\u3001HG510x\u306a\u3069\u306b\u3064\u3044\u3066\u3001\u30ea\u30e2\u30fc\u30c8\u8cc7\u683c\u60c5\u5831\u3068\u60c5\u5831\u6f0f\u3048\u3044\u306e\u8106\u5f31\u6027\u306e\u6709\u7121\u3092\u691c\u51fa\u3057\u307e\u3059\u3002\u307e\u305f\u3001PPPoE\u306e\u8cc7\u683c\u60c5\u5831\u3084\u305d\u306e\u4ed6\u8a2d\u5b9a\u5024\u306e\u53d6\u5f97\u3082\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-huawei-hg5xx-vuln \\
\n192.168.110.1 -p80<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-icloud-findmyiphone<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, external, safe<\/td>\n

“MobileMe”\u306eWeb\u30b5\u30fc\u30d3\u30b9\u3092\u7167\u4f1a\u3057\u3001”Find my iPhone””\u304c\u6709\u52b9\u306aiOS\u30c7\u30d0\u30a4\u30b9\u306e\u4f4d\u7f6e\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002(\u8a8d\u8a3c\u304c\u5fc5\u8981\u3067\u3059\u3002)<\/td>\nMobileMe\u30b5\u30fc\u30d3\u30b9\u7d42\u4e86(fmipmobile.icloud.com)\u306e\u305f\u3081\u5b9f\u884c\u4e0d\u53ef<\/p>\n

\u5b9f\u884c\u30b3\u30de\u30f3\u30c9
\nnmap -sn -Pn \\
\n–script http-icloud-findmyiphone \\
\n–script-args \\
\n‘username=test,password=test’<\/td>\n<\/tr>\n

http-icloud-sendmsg<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexternal, safe, discovery<\/td>\n

“MobileMe”\u306eWeb\u30b5\u30fc\u30d3\u30b9\u3092\u4f7f\u7528\u3057\u3001iOS\u30c7\u30d0\u30a4\u30b9\u306b\u30e1\u30c3\u30bb\u30fc\u30b8\u3092\u9001\u4fe1\u3057\u307e\u3059\u3002iOS\u30c7\u30d0\u30a4\u30b9\u306fAppleID\u3092\u4f7f\u7528\u3057\u3001”Find my iPhone” \u306b\u767b\u9332\u3057\u3066\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/td>\nMobileMe\u30b5\u30fc\u30d3\u30b9\u7d42\u4e86(fmipmobile.icloud.com)\u306e\u305f\u3081\u5b9f\u884c\u4e0d\u53ef<\/p>\n

\u5b9f\u884c\u30b3\u30de\u30f3\u30c9
\nnmap -sn -Pn \\
\n–script http-icloud-sendmsg \\
\n–script-args \\
\n“username=test,password=test, \\
\nhttp-icloud-sendmsg.listdevices”<\/td>\n<\/tr>\n

http-iis-short-name-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

\u8106\u5f31\u306aIIS\u30b5\u30fc\u30d0\u306e\u30eb\u30fc\u30c8\u30d5\u30a9\u30eb\u30c0\u5185\u306b\u3042\u308b\u30d5\u30a1\u30a4\u30eb\u3084\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u306e8.3\u5f62\u5f0f\u306e\u30d5\u30a1\u30a4\u30eb\u540d(\u77ed\u3044\u540d\u524d\u306e\u30d5\u30a1\u30a4\u30eb\u540d)\u3092\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u3057\u307e\u3059\u3002\u3053\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001PoC”iis shortname scanner”\u306e\u5b9f\u88c5\u3067\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nhttp-iis-short-name-brute \\
\n192.168.110.1 -p 80<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-iis-webdav-vuln<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nintrusive, vuln<\/td>\n

IIS 5.1 \/ 6.0\u306b\u5bfe\u3057\u3001\u4efb\u610f\u306e\u30e6\u30fc\u30b6\u304c\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3067\u4fdd\u8b77\u3055\u308c\u305fWebDAV\u30d5\u30a9\u30eb\u30c0\u306b\u30a2\u30af\u30bb\u30b9\u3059\u308b\u3053\u3068\u3092\u53ef\u80fd\u306b\u3059\u308b\u8106\u5f31\u6027(MS09-020)\u306e\u6709\u7121\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002(\u30d1\u30b9\u30ef\u30fc\u30c9\u3067\u4fdd\u8b77\u3055\u308c\u305f\u30d5\u30a9\u30eb\u30c0\u3092\u691c\u7d22\u3057\u3001\u305d\u308c\u3092\u30a2\u30af\u30bb\u30b9\u3057\u3088\u3046\u3068\u3059\u308b\u3053\u3068\u306b\u3088\u308a\u53ef\u80fd\u3068\u306a\u308a\u307e\u3059\u3002)\u3053\u306e\u8106\u5f31\u6027\u306f\u3001\u30de\u30a4\u30af\u30ed\u30bd\u30d5\u30c8\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u60c5\u5831\u306b\u3066\u30d1\u30c3\u30c1\u304c\u30ea\u30ea\u30fc\u30b9\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-iis-webdav-vuln \\
\n192.168.110.1 -p 80,8080<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-internal-ip-disclosure<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe, vuln<\/td>\n

Host\u30d8\u30c3\u30c0\u306e\u306a\u3044HTTP \/ 1.0\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u9001\u4fe1\u3057\u305f\u969b\u306b\u3001\u5bfe\u8c61Web\u30b5\u30fc\u30d0\u304c\u81ea\u8eab\u306e\u5185\u90e8IP\u30a2\u30c9\u30ec\u30b9\u3092\u30ea\u30fc\u30af\u3059\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nOWASP Broken Web Apps 1.2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script \\
\nhttp-internal-ip-disclosure \\
\n192.168.110.11 -p 80<\/td>\n<\/tr>\n
http-joomla-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

Joomla\u306eWebCMS\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nOWASP Broken Web Apps 1.2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV –script http-joomla-brute \\
\n–script-args \\
\nhttp-joomla-brute.uri=\\
\n\/joomla\/administrator\/index.php, \\
\nbrute.firstonly=true 192.168.110.12 -p 80<\/p>\n

\u203b\u6709\u52b9\u3067\u306a\u3044\u30e6\u30fc\u30b6\u540d\uff0f\u30d1\u30b9\u30ef\u30fc\u30c9\u306e\u7d44\u307f\u5408\u308f\u305b\u3082\u6709\u52b9\u3067\u3042\u308b\u3068\u8868\u793a\u3055\u308c\u307e\u3057\u305f\u3002<\/td>\n<\/tr>\n

http-litespeed-sourcecode-download<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, intrusive, vuln<\/td>\n

Litespeed Web Servers\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u300c 4.0.x(\uff5e4.0.15)\u300d\u306b\u5bfe\u3057\u3001null-byte poisoning\u306e\u8106\u5f31\u6027(CVE-2010-2333)\u3092\u3064\u304f\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002(.txt \u30d5\u30a1\u30a4\u30eb\u306e\u62e1\u5f35\u5b50\u304c\u7d9a\u304fNULL\u30d0\u30a4\u30c8\u306eHTTP\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u9001\u4fe1\u3059\u308b\u3053\u3068\u306b\u3088\u308a\u5bfe\u8c61\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u306e\u30bd\u30fc\u30b9\u30b3\u30fc\u30c9\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002)<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nhttp-litespeed-sourcecode-download \\
\n192.168.110.1 -p80<\/td>\n<\/tr>\n
http-ls<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

?”index” \u306eWeb\u30da\u30fc\u30b8\u306e\u5185\u5bb9\u3092\u8868\u793a\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-ls 192.168.110.1 -p 80<\/td>\n<\/tr>\n
http-majordomo2-dir-traversal<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, intrusive, vuln<\/td>\n

\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u306e\u8106\u5f31\u6027\u3092\u3064\u3044\u305f\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u5b9f\u884c\u3057\u3001”Majordomo2″\u306e\u30ea\u30e2\u30fc\u30c8\u30d5\u30a1\u30a4\u30eb\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002 (CVE-2011-0049)\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nhttp-majordomo2-dir-traversal \\
\n192.168.110.1 -p80<\/td>\n<\/tr>\n
http-malware-host<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nmalware, safe<\/td>\n

\u65e2\u77e5\u306e\u30b5\u30fc\u30d0\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4fb5\u5bb3\u306e\u30b7\u30b0\u30cb\u30c1\u30e3\u3092\u691c\u7d22\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV –script http-malware-host \\
\n192.168.110.1<\/td>\n<\/tr>\n
http-mcmp<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

Web\u30b5\u30fc\u30d0\u304c”mod_cluster management”\u30d7\u30ed\u30c8\u30b3\u30eb(MCMP)\u30e1\u30bd\u30c3\u30c9\u3092\u8a31\u53ef\u3057\u3066\u3044\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV –script http-mcmp \\
\n192.168.110.1 -p 80<\/td>\n<\/tr>\n
http-methods<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, safe<\/td>\n

OPTIONS\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u9001\u4fe1\u3059\u308b\u3053\u3068\u306b\u3088\u3063\u3066\u3001HTTP\u30b5\u30fc\u30d0\u304c\u30b5\u30dd\u30fc\u30c8\u3059\u308b\u30aa\u30d7\u30b7\u30e7\u30f3\u3092\u78ba\u8a8d\u3057\u3001\u6f5c\u5728\u7684\u306b\u5371\u967a\u306a\u30e1\u30bd\u30c3\u30c9\u3092\u8868\u793a\u3057\u307e\u3059\u3002 \u540c\u30b9\u30af\u30ea\u30d7\u30c8\u306fOPTIONS\u30d8\u30c3\u30c0\u306b\u500b\u5225\u306b\u8a18\u8f09\u3055\u308c\u3066\u3044\u306a\u3044\u30e1\u30bd\u30c3\u30c9\u3092\u30c6\u30b9\u30c8\u3057\u3001\u5b9f\u88c5\u3055\u308c\u3066\u3044\u308b\u304b\u3069\u3046\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002501\/405\u4ee5\u5916\u306e\u51fa\u529b\u306f\u3001\u30e1\u30bd\u30c3\u30c9\u304c400\u304b\u3089600\u306e\u7bc4\u56f2\u306b\u306a\u3044\u5834\u5408\u306b\u30e1\u30bd\u30c3\u30c9\u304c\u5b58\u5728\u3059\u308b\u3053\u3068\u3092\u793a\u5506\u3057\u3066\u3044\u307e\u3059\u3002\u30ec\u30b9\u30dd\u30f3\u30b9\u304c400\u304b\u3089600\u306e\u7bc4\u56f2\u306b\u3042\u308b\u5834\u5408\u306f\u3001\u30e9\u30f3\u30c0\u30e0\u306b\u751f\u6210\u3055\u308c\u305f\u30e1\u30bd\u30c3\u30c9\u304b\u3089\u306e\u30ec\u30b9\u30dd\u30f3\u30b9\u3068\u6bd4\u8f03\u3055\u308c\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nBadStore
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script http-methods \\
\n192.168.110.11 -p 80<\/td>\n<\/tr>\n
http-method-tamper<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, vuln<\/td>\n

“HTTP verb tampering”\u3092\u5b9f\u884c\u3057\u3066\u3001\u30d1\u30b9\u30ef\u30fc\u30c9\u3067\u4fdd\u8b77\u3055\u308c\u305f\u30ea\u30bd\u30fc\u30b9\uff08HTTP 401\u30b9\u30c6\u30fc\u30bf\u30b9\uff09\u3092\u30d0\u30a4\u30d1\u30b9\u3057\u307e\u3059\u3002\u78ba\u8a8d\u3059\u308b\u30d1\u30b9\u306e\u914d\u5217\u304c\u8a2d\u5b9a\u3055\u308c\u3066\u3044\u306a\u3044\u5834\u5408\u306f\u3001Web\u30b5\u30fc\u30d0\u3092\u5de1\u308a\u3001\u898b\u3064\u304b\u3063\u305f\u30d1\u30b9\u30ef\u30fc\u30c9\u3067\u4fdd\u8b77\u3055\u308c\u305f\u30ea\u30bd\u30fc\u30b9\u306b\u5bfe\u3057\u3066\u78ba\u8a8d\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV –script http-method-tamper \\
\n192.168.110.1 -p 80<\/td>\n<\/tr>\n
http-mobileversion-checker<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

\u30e2\u30d0\u30a4\u30eb\u30d0\u30fc\u30b8\u30e7\u30f3\u306eWeb\u30da\u30fc\u30b8\u304c\u3042\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nBadStore
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script \\
\nhttp-mobileversion-checker.nse \\
\n192.168.110.1 -p80<\/td>\n<\/tr>\n
http-ntlm-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

NTLM\u8a8d\u8a3c\u304c\u6709\u52b9\u306b\u306a\u3063\u3066\u3044\u308bHTTP\u30b5\u30fc\u30d3\u30b9\u304b\u3089\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-ntlm-info \\
\n–script-args http-ntlm-info.root=\/root\/ \\
\n192.168.110.1 -p 80<\/td>\n<\/tr>\n
http-open-proxy<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, external, safe<\/td>\n

HTTP\u30d7\u30ed\u30ad\u30b7\u304cOPEN\u3057\u3066\u3044\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-open-proxy.nse \\
\n–script-args \\
\nproxy.url=<url>,\\
\nproxy.pattern=<pattern> \\
\n192.168.110.1<\/td>\n<\/tr>\n
http-open-redirect<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

Web\u30b9\u30d1\u30a4\u30c0\u30fc\u3092\u884c\u3044\u3001\u958b\u3044\u3066\u3044\u308b\u30ea\u30c0\u30a4\u30ec\u30af\u30c8\u3092\u7279\u5b9a\u3057\u307e\u3059\u3002\u30aa\u30fc\u30d7\u30f3\u30ea\u30c0\u30a4\u30ec\u30af\u30c8\u306f\u3001\u4e00\u822c\u306b\u30d1\u30e9\u30e1\u30fc\u30bf\u3068\u3057\u3066URL\u3092\u53d6\u5f97\u3057\u3001\u30bf\u30fc\u30b2\u30c3\u30c8\u306bhttp\u30ea\u30c0\u30a4\u30ec\u30af\u30c8\uff083XX\uff09\u3067\u5fdc\u7b54\u3059\u308b\u30cf\u30f3\u30c9\u30e9\u3067\u3059\u3002\u30aa\u30fc\u30d7\u30f3\u30ea\u30c0\u30a4\u30ec\u30af\u30c8\u306e\u30ea\u30b9\u30af\u306b\u3064\u3044\u3066\u306f\u3053\u3061\u3089<\/a>\u3092\u53c2\u7167\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-open-redirect \\
\n192.168.110.12<\/td>\n<\/tr>\n
http-passwd<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nintrusive, vuln<\/td>\n

Web\u30b5\u30fc\u30d0\u306b\u5bfe\u3057”\/etc\/passwd”\u307e\u305f\u306f”\/boot.ini”\u306e\u53d6\u5f97\u3092\u8a66\u307f\u3001\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u306e\u8106\u5f31\u6027\u304c\u3042\u308b\u304b\u3069\u3046\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-passwd \\
\n192.168.110.1? -p 80<\/td>\n<\/tr>\n
http-phpmyadmin-dir-traversal<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, vuln<\/td>\n

phpMyAdmin\u306e\u30d0\u30fc\u30b8\u30e7\u30f32.6.4-pl1(\u305d\u306e\u4ed6\u30d0\u30fc\u30b8\u30e7\u30f3\u3082\u53ef\u80fd\u6027\u3042\u308a)\u306b\u304a\u3051\u308b\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u306e\u8106\u5f31\u6027\u3092\u3064\u304f\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u5b9f\u884c\u3057\u3001Web\u30b5\u30fc\u30d0\u4e0a\u306e\u30ea\u30e2\u30fc\u30c8\u30d5\u30a1\u30a4\u30eb\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script \\
\nhttp-phpmyadmin-dir-traversal \\
\n–script-args \\
\nhttp-phpmyadmin-dir-traversal.dir=\\
\n\/phpMyAdmin\/ 192.168.110.1 -p 80<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-phpself-xss<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nfuzzer, intrusive, vuln<\/td>\n

Web\u30b5\u30fc\u30d0\u3092\u691c\u7d22\u3057\u3001\u5909\u6570”$ _SERVER [ “PHP_SELF”]”\u3092\u7d4c\u7531\u3057\u3066\u53cd\u5c04\u578b\u30af\u30ed\u30b9\u30b5\u30a4\u30c8\u30b9\u30af\u30ea\u30d7\u30c6\u30a3\u30f3\u30b0\u306e\u8106\u5f31\u6027\u3092\u6301\u3064PHP\u30d5\u30a1\u30a4\u30eb\u3092\u691c\u7d22\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-phpself-xss \\
\n192.168.110.1 -p 80<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-php-version<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

Web\u30b5\u30fc\u30d0\u304b\u3089PHP\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002 PHP\u306b\u306f\u3001PHP\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u306b\u3088\u3063\u3066\u7570\u306a\u308b\u753b\u50cf\u3084\u30c6\u30ad\u30b9\u30c8\u3092\u8fd4\u3059\u3088\u3046\u306a\u6570\u591a\u304f\u306e\u30af\u30a8\u30ea\u304c\u3042\u308a\u3001\u540c\u30b9\u30af\u30ea\u30d7\u30c8\u3067\u306f\u4ee5\u4e0b\u306e\u30af\u30a8\u30ea\u3092\u4f7f\u7528\u3057\u307e\u3059\u3002
\n\/\uff1f= PHPE9568F36-D428-11d2-A769-00AA001ACF42
\n\uff1aApril Fool’s Day\u306b\u5909\u66f4\u3055\u308c\u308bGIF\u30ed\u30b4\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002
\n\/\uff1f= PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000
\n\uff1aHTML\u30af\u30ec\u30b8\u30c3\u30c8\u30da\u30fc\u30b8\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\n<\/td>\n		\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV –script http-php-version \\
\n192.168.110.1 -p 80<\/td>\n<\/tr>\n
http-proxy-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, external, intrusive<\/td>\n

HTTP\u30d7\u30ed\u30ad\u30b7\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3066\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-proxy-brute \\
\n192.168.110.12 -p 8080<\/td>\n<\/tr>\n
http-put<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

HTTP PUT\u30e1\u30bd\u30c3\u30c9\u3092\u4f7f\u7528\u3057\u3066\u3001Web\u30b5\u30fc\u30d0\u306b\u30ed\u30fc\u30ab\u30eb\u30d5\u30a1\u30a4\u30eb\u3092\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u3057\u307e\u3059\u3002(URL\u30d1\u30b9\u3001\u30d5\u30a1\u30a4\u30eb\u3092\u6307\u5b9a\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002)<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-put –script-args \\
\nhttp-put.url=’\/uploads\/rootme.php’, \\
\nhttp-put.file=’\/tmp\/rootme.php’ \\
\n192.168.110.1 -p 80<\/td>\n<\/tr>\n
http-qnap-nas-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

QNAP(\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u63a5\u7d9a\u30b9\u30c8\u30ec\u30fc\u30b8(NAS))\u304b\u3089\u30e2\u30c7\u30eb\u3001\u30d5\u30a1\u30fc\u30e0\u30a6\u30a7\u30a2\u30d0\u30fc\u30b8\u30e7\u30f3\u304a\u3088\u3073\u3001\u6709\u52b9\u306b\u306a\u3063\u3066\u3044\u308b\u30b5\u30fc\u30d3\u30b9\u306e\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nQNAP TS-X31
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script http-qnap-nas-info \\
\n192.168.0.1<\/td>\n<\/tr>\n
http-referer-checker<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nsafe, discovery<\/td>\n

\u30b9\u30af\u30ea\u30d7\u30c8\u306e\u30af\u30ed\u30b9\u30c9\u30e1\u30a4\u30f3\u30a4\u30f3\u30af\u30eb\u30fc\u30c9\u306b\u3064\u3044\u3066\u306e\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u5916\u90e8\u306ejavascript\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u542b\u3080Web\u30b5\u30a4\u30c8\u306f\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306e\u4e00\u90e8\u3092\u7b2c\u4e09\u8005\u30a8\u30f3\u30c6\u30a3\u30c6\u30a3\u306b\u59d4\u4efb\u3057\u3066\u3044\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script http-referer-checker.nse \\
\n192.168.110.1 -p80<\/td>\n<\/tr>\n
http-rfi-spider<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nintrusive<\/td>\n

Web\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3001RFI(remote file inclusion)\u306e\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u304b\u3092\u691c\u7d22\u3057\u307e\u3059\u3002\u540c\u8106\u5f31\u6027\u304c\u898b\u3064\u304b\u3063\u305f\u3059\u3079\u3066\u306e\u30d5\u30a9\u30fc\u30e0\u30d5\u30a3\u30fc\u30eb\u30c9\u3084\u30af\u30a8\u30ea\u3092\u542b\u3080URL\u306e\u3059\u3079\u3066\u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u3092\u30c6\u30b9\u30c8\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script http-rfi-spider \\
\n192.168.110.1 -p 80<\/td>\n<\/tr>\n
http-robots.txt<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

Web\u30b5\u30fc\u30d0\u306b\u3066\u3001”\/robots.txt”\u3067\u8a31\u53ef\u3055\u308c\u3066\u3044\u306a\u3044\u30a8\u30f3\u30c8\u30ea\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV -sC 192.168.110.1<\/td>\n<\/tr>\n
http-robtex-reverse-ip<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, external, safe<\/td>\n

Robtex\u30b5\u30fc\u30d3\u30b9(http:\/\/www.robtex.com\/ip\/)\u3092\u7167\u4f1a\u3057\u3001\u5bfe\u8c61IP\u30a2\u30c9\u30ec\u30b9\u306e\u305f\u3081\u306e\u30d5\u30a9\u30ef\u30fc\u30c0DNS\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002(\u6700\u5927100)<\/td>\n\u5bfe\u8c61
\nGoogle Public DNS\u30b5\u30fc\u30d0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script http-robtex-reverse-ip \\
\n–script-args \\
\nhttp-robtex-reverse-ip.host=’8.8.8.8′<\/td>\n<\/tr>\n
http-robtex-shared-ns<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, external, safe<\/td>\n

Robtex\u30b5\u30fc\u30d3\u30b9(http:\/\/www.robtex.com\/dns\/)\u3092\u7167\u4f1a\u3057\u3001\u5bfe\u8c61\u3068\u540c\u3058\u30cd\u30fc\u30e0\u30b5\u30fc\u30d0\u3092\u4f7f\u7528\u3059\u308b100\u307e\u3067\u306e\u30c9\u30e1\u30a4\u30f3\u540d\u3092\u691c\u7d22\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9
\nnmap –script http-robtex-shared-ns \\
\ngoogle.com<\/p>\n

\u203b\u9014\u4e2d\u3067\u30b9\u30af\u30ea\u30d7\u30c8\u304c\u6b62\u307e\u308a\u3001\u5b9f\u65bd\u4e0d\u53ef\u3067\u3057\u305f\u3002<\/td>\n<\/tr>\n

http-server-header<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nversion<\/td>\n

\u30d0\u30fc\u30b8\u30e7\u30f3\u60c5\u5831\u304c\u6b20\u843d\u3057\u3066\u3044\u308bHTTP\u30b5\u30fc\u30d0\u30d8\u30c3\u30c0\u3092\u4f7f\u7528\u3057\u307e\u3059\u3002\u73fe\u5728\u3001\u975eHTTP\u30b5\u30fc\u30d3\u30b9\u3092\u6b63\u3057\u304f\u7167\u5408\u3059\u308b\u5fc5\u8981\u304c\u3042\u308b\u305f\u3081\u3001\u30d0\u30fc\u30b8\u30e7\u30f3\u30d7\u30ed\u30fc\u30d6\u3067\u306f\u5b9f\u884c\u4e0d\u53ef\u80fd\u3067\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV 192.168.110.1 -p 80<\/td>\n<\/tr>\n
http-shellshock<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, intrusive, vuln<\/td>\n

Web\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3067”shellshock”\u306e\u8106\u5f31\u6027(CVE-2014-6271\u304a\u3088\u3073CVE-2014-7169)\u3092\u7a81\u3044\u305f\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV –script http-shellshock \\
\n192.168.110.1 -p 80<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-sitemap-generator<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

Web\u30b5\u30fc\u30d0\u3092\u5de1\u308a\u3001\u5404\u30d5\u30a9\u30eb\u30c0\u6bce\u306b\u30d5\u30a1\u30a4\u30eb\u306e\u7a2e\u985e\/\u6570\u3092\u53d6\u5f97\u3057\u3001\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u69cb\u9020\u3092\u8868\u793a\u3057\u307e\u3059\u3002
\n\u203b\u300cOther\u300d\u3068\u8a18\u8f09\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u306f\u62e1\u5f35\u5b50\u304c\u306a\u3044\u304b\u3001\u30eb\u30fc\u30c8\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u3067\u3042\u308b\u3053\u3068\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/td>\n		\u5bfe\u8c61
\nbadstore
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script http-sitemap-generator \\
\n192.168.110.11 -p 80<\/td>\n<\/tr>\n
http-slowloris<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndos, intrusive<\/td>\n

Web\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3001Slowloris DoS\u653b\u6483\u3092\u5b9f\u884c\u3057\u3001\u540c\u653b\u6483\u306b\u5bfe\u3057\u3066\u8106\u5f31\u304b\u3069\u3046\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script http-slowloris \\
\n–max-parallelism 400 \\
\n–script-args http-slowloris.timelimit=3 \\
\n192.168.110.1<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-slowloris-check<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nsafe, vuln<\/td>\n

Web\u30b5\u30fc\u30d0\u304c\u3001”Slowloris DoS”\u653b\u6483\u306b\u3064\u3044\u3066\u8106\u5f31\u304b\u3069\u3046\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002(DoS\u653b\u6483\u306f\u884c\u3044\u307e\u305b\u3093\u3002)<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-slowloris-check \\
\n192.168.110.1 -p 80<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-sql-injection<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nintrusive, vuln<\/td>\n

HTTP\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3001SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u653b\u6483\u306b\u5bfe\u3057\u3066\u8106\u5f31\u306aURL\u3092\u63a2\u3057\u3066\u3044\u307e\u3059\u3002\u307e\u305f\u3001\u898b\u3064\u304b\u3063\u305fWeb\u30b5\u30a4\u30c8\u304b\u3089\u30d5\u30a9\u30fc\u30e0\u3092\u62bd\u51fa\u3057\u3001\u8106\u5f31\u306a\u30d5\u30a3\u30fc\u30eb\u30c9\u3092\u8b58\u5225\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nOWASP Broken Web Apps 1.2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV –script http-sql-injection \\
\n192.168.110.12 -p 80<\/p>\n

\u203bSQLi\u306e\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u30d1\u30b9\u304a\u3088\u3073\u30d5\u30a9\u30fc\u30e0\u3092\u51fa\u529b\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-stored-xss<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, intrusive, vuln<\/td>\n

\u6f5c\u5728\u7684\u306aXSS\u306e\u8106\u5f31\u6027\u3068\u306a\u308a\u3046\u308b\u3001\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3055\u308c\u3066\u3044\u306a\u3044 ‘>'(\u5927\u306a\u308a\u8a18\u53f7)\u306e\u6709\u7121\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-stored-xss.nse \\
\n192.168.110.1 -p 80<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-svn-enum<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

\u6700\u65b0\u306e\u30b3\u30df\u30c3\u30c8\u306e\u30ed\u30b0\u3092\u8abf\u3079\u308b\u3053\u3068\u306b\u3088\u308a\u3001”Subversion”\u30ea\u30dd\u30b8\u30c8\u30ea\u306e\u30e6\u30fc\u30b6\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-svn-enum \\
\n192.168.110.1 -p 80<\/td>\n<\/tr>\n
http-svn-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

“Subversion”\u30ea\u30dd\u30b8\u30c8\u30ea\u306e\u60c5\u5831\u3092\u30ea\u30af\u30a8\u30b9\u30c8\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-svn-info \\
\n192.168.110.1 -p 443<\/td>\n<\/tr>\n
http-title<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

Web\u30b5\u30fc\u30d0\u306e\u30c7\u30d5\u30a9\u30eb\u30c8\u30da\u30fc\u30b8\u306e\u30bf\u30a4\u30c8\u30eb\u3092\u8868\u793a\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nOWASP Broken Web Apps 1.2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV -sC 192.168.110.12 -p 80<\/td>\n<\/tr>\n
http-tplink-dir-traversal<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, vuln<\/td>\n

TP-Link\u306e\u7121\u7dda\u30eb\u30fc\u30bf\u306b\u5bfe\u3057\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u306e\u8106\u5f31\u6027\u3092\u7a81\u3044\u305f\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002\u306a\u304a\u3001\u540c\u8106\u5f31\u6027\u306f\u3001\u8a2d\u5b9a\u60c5\u5831\u3068\u30d1\u30b9\u30ef\u30fc\u30c9\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u8a8d\u8a3c\u306a\u3057\u3067\u653b\u6483\u8005\u306b\u53d6\u5f97\u3055\u308c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u3082\u306e\u3067\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nhttp-tplink-dir-traversal.nse \\
\n192.168.110.1 -p 80<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-trace<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe, vuln<\/td>\n

“HTTP TRACE”\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u9001\u4fe1\u3057\u3001”TRACE”\u30e1\u30bd\u30c3\u30c9\u304c\u6709\u52b9\u306b\u306a\u3063\u3066\u3044\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002\u6709\u52b9\u306b\u306a\u3063\u3066\u3044\u308b\u5834\u5408\u3001\u5909\u66f4\u3055\u308c\u305f\u30d8\u30c3\u30c0\u30d5\u30a3\u30fc\u30eb\u30c9\u3092\u542b\u3081\u305f\u5fdc\u7b54\u3092\u8fd4\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nOWASP Broken Web Apps 1.2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script http-trace \\
\n192.168.110.12 -p 80<\/td>\n<\/tr>\n
http-traceroute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

\u30ea\u30d0\u30fc\u30b9\u30d7\u30ed\u30ad\u30b7\u306e\u5b58\u5728\u3092\u691c\u51fa\u3059\u308b\u305f\u3081\u3001”Max-Forwards HTTP header”\u306e\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-traceroute \\
\n192.168.110.1 -p 80<\/td>\n<\/tr>\n
http-unsafe-output-escaping<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

Web\u30b9\u30d1\u30a4\u30c0\u30fc\u3092\u884c\u3044\u3001\u51fa\u529b\u30a8\u30b9\u30b1\u30fc\u30d7\u306b\u554f\u984c\u304c\u3042\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002\u672c\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001\u3059\u3079\u3066\u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u3001\u300c?x=foo&y=bar\u300d\u3092\u691c\u7d22\u3057\u3001\u305d\u306e\u5024\u304c\u30da\u30fc\u30b8\u306b\u53cd\u6620\u3055\u308c\u3066\u3044\u308b\u304b\u3069\u3046\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002\u4e0a\u8a18\u304c\u53cd\u6620\u3055\u308c\u3066\u3044\u308b\u5834\u5408\u3001\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u300cghz> hzx “zxc’xcv\u300d\u3092\u633f\u5165\u3057\u3001\u9069\u5207\u306ahtml\u30a8\u30b9\u30b1\u30fc\u30d7\u3092\u305b\u305a\u306b\u30da\u30fc\u30b8\u306b\u53cd\u6620\u3055\u308c\u305f\u6587\u5b57\u304c\u3042\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002(\u6f5c\u5728\u7684\u306aXSS\u8106\u5f31\u6027\u306e\u78ba\u8a8d\u3092\u884c\u3046\u30b9\u30af\u30ea\u30d7\u30c8\u3067\u3059\u3002)<\/td>\n\u5bfe\u8c61
\nOWASP Broken Web Apps 1.2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script \\
\nhttp-unsafe-output-escaping \\
\n192.168.110.12 -p 80<\/td>\n<\/tr>\n
http-useragent-tester<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nsafe, discovery<\/td>\n

\u3055\u307e\u3056\u307e\u306a\u30af\u30ed\u30fc\u30eb\u30e6\u30fc\u30c6\u30a3\u30ea\u30c6\u30a3\u304c\u5bfe\u8c61\u306b\u3066\u8a31\u53ef\u3055\u308c\u3066\u3044\u308b\u304b\u3069\u3046\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nOWASP Broken Web Apps 1.2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script \\
\nhttp-useragent-tester.nse \\
\n192.168.110.12 -p80<\/td>\n<\/tr>\n
http-userdir-enum<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, intrusive<\/td>\n

“mod_userdir”\u30e2\u30b8\u30e5\u30fc\u30eb\u307e\u305f\u306f\u305d\u308c\u306b\u985e\u3059\u308b\u30e2\u30b8\u30e5\u30fc\u30eb\u3092\u5b9f\u884c\u3057\u3066\u3044\u308bWeb\u30b5\u30fc\u30d0\u306b\u3066\u3001\u6709\u52b9\u306a\u30e6\u30fc\u30b6\u540d\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV –script http-userdir-enum \\
\n192.168.110.1 -p 80<\/td>\n<\/tr>\n
http-vhosts<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

\u4e00\u822c\u7684\u306a\u30db\u30b9\u30c8\u540d\u3092\u4f7f\u7528\u3057\u3066HTTP\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3066\u591a\u6570\u306eHEAD\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u9001\u4fe1\u3059\u308b\u3053\u3068\u306b\u3088\u308a\u3001Web\u4eee\u60f3\u30db\u30b9\u30c8\u540d\u3092\u691c\u7d22\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nOWASP Broken Web Apps 1.2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script http-vhosts \\
\n192.168.110.12 -p 80<\/td>\n<\/tr>\n
http-virustotal<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexternal, malware, safe<\/td>\n

\u30d5\u30a1\u30a4\u30eb\u304c”Virustotal”\u203b\u306b\u3088\u3063\u3066\u30de\u30eb\u30a6\u30a7\u30a2\u3068\u5224\u5b9a\u3055\u308c\u305f\u304b\u3069\u3046\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002\u540c\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u6709\u52b9\u306aAPI\u30ad\u30fc\u3092\u5fc5\u8981\u3068\u3059\u308b\u516c\u958bAPI\u3092\u4f7f\u7528\u3057\u3066\u3044\u307e\u3059\u3002(\u6bce\u52064\u30af\u30a8\u30ea\u307e\u3067\u306e\u5236\u9650\u3042\u308a)API\u30ad\u30fc\u306fvirustotal\u306eWeb\u30da\u30fc\u30b8\u3067\u30e6\u30fc\u30b6\u767b\u9332\u3059\u308b\u3053\u3068\u306b\u3088\u308a\u53d6\u5f97\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002
\n\u203b\u30d5\u30a1\u30a4\u30eb\u3084\u30c1\u30a7\u30c3\u30af\u30b5\u30e0\u3092\u4e3b\u8981\u306a\u30a6\u30a4\u30eb\u30b9\u5bfe\u7b56\u30d9\u30f3\u30c0\u3067\u30b9\u30ad\u30e3\u30f3\u3059\u308b\u6a5f\u80fd\u3092\u63d0\u4f9b\u3059\u308b\u30b5\u30fc\u30d3\u30b9\u3067\u3059\u3002http:\/\/www.virustotal.com<\/td>\n		\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-virustotal \\
\n–script-args \\
\n‘http-virustotal.apikey=”<key>”, \\
\nhttp-virustotal.checksum=\\
\n“275a021bbfb6489e54d471899f7db9d\\
\n1663fc695ec2fe2a2c4538aabf651fd0f”‘<\/p>\n

\u203bVirusTotal\u3067\u30e6\u30fc\u30b6\u767b\u9332\u3057\u3001API\u30ad\u30fc\u3092\u53d6\u5f97\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-vlcstreamer-ls<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

VLC Streamer\u306e\u30d8\u30eb\u30d1\u30fc\u30b5\u30fc\u30d3\u30b9\u306b\u63a5\u7d9a\u3057\u3066\u3001\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u306e\u5185\u5bb9\u3092\u4e00\u89a7\u8868\u793a\u3057\u307e\u3059\u3002 VLC Streamer\u306e\u30d8\u30eb\u30d1\u30fc\u30b5\u30fc\u30d3\u30b9\u306f\u3001iOS VLC Streamer\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306b\u3088\u3063\u3066\u4f7f\u7528\u3055\u308c\u3001\u30ea\u30e2\u30fc\u30c8\u30b5\u30fc\u30d0\u304b\u3089\u30c7\u30d0\u30a4\u30b9\u3078\u306e\u30de\u30eb\u30c1\u30e1\u30c7\u30a3\u30a2\u30b3\u30f3\u30c6\u30f3\u30c4\u306e\u30b9\u30c8\u30ea\u30fc\u30df\u30f3\u30b0\u3092\u53ef\u80fd\u306b\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-vlcstreamer-ls \\
\n192.168.110.1 -p 54340<\/td>\n<\/tr>\n
http-vmware-path-vuln<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nsafe, vuln<\/td>\n

VMWare\u306eESX\u3001ESXi\u3001\u304a\u3088\u3073\u30b5\u30fc\u30d0\u3067\u30d1\u30b9\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u306e\u8106\u5f31\u6027(CVE-2009-3733)\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-vmware-path-vuln \\
\n192.168.110.1 -p 80,443,8222,8333<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-vuln-cve2006-3392<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, intrusive, vuln<\/td>\n

Webmin\u306b\u5bfe\u3057\u3066\u3001\u30d5\u30a1\u30a4\u30eb\u6f0f\u3048\u3044\u306e\u8106\u5f31\u6027(CVE-2006-3392)\u3092\u7a81\u304f\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nwebmin ver 1.280
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV –script \\
\nhttp-vuln-cve2006-3392 \\
\n192.168.110.1 -p 10000<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-vuln-cve2009-3960<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, intrusive<\/td>\n

Adobe XML External Entity Injection(CVE-2009-3960)\u306e\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-vuln-cve2009-3960 \\
\n192.168.110.1<\/td>\n<\/tr>\n
http-vuln-cve2010-0738<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, safe, vuln<\/td>\n

\u5bfe\u8c61\u306eJboss\u306b\u5bfe\u3057\u3001JMX\u30b3\u30f3\u30bd\u30fc\u30eb\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9(CVE-2010-0738)\u306e\u8106\u5f31\u6027\u304c\u3042\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002
\nhttp:\/\/jvndb.jvn.jp\/ja\/contents\/2010\/JVNDB-2010-001121.html<\/td>\n		\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-vuln-cve2010-0738 \\
\n192.168.110.128<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cAuthentication bypass\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-vuln-cve2010-2861<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nintrusive, vuln<\/td>\n

ColdFusion\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3001\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u3092\u5b9f\u884c\u3057\u3001\u7ba1\u7406\u8005\u30e6\u30fc\u30b6\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30cf\u30c3\u30b7\u30e5\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u6b21\u306b\u3001\u30bd\u30eb\u30c8(Web\u30da\u30fc\u30b8\u3067\u975e\u8868\u793a)\u3092\u4f7f\u7528\u3057\u3066\u3001Web\u30b5\u30fc\u30d0\u304c\u7ba1\u7406\u8005\u3068\u3057\u3066\u8a8d\u8a3c\u306b\u5fc5\u8981\u306aSHA1 HMAC\u30cf\u30c3\u30b7\u30e5\u3092\u4f5c\u6210\u3002\u30d1\u30b9\u30ef\u30fc\u30c9\u30cf\u30c3\u30b7\u30e5\u3092\u89e3\u8aad\u3059\u308b\u3053\u3068\u306a\u304f\u3001\u540c\u5024\u3092\u7ba1\u7406\u8005\u3068\u3057\u3066ColdFusion\u30b5\u30fc\u30d0\u306b\u6e21\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-vuln-cve2010-2861 \\
\n192.168.110.128<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-vuln-cve2011-3192<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nsafe, vuln<\/td>\n

Apache Web\u30b5\u30fc\u30d0\u304c\u30da\u30fc\u30b8\u306e\u8907\u6570\u306e\u91cd\u8907\/\u5358\u7d14\u7bc4\u56f2\u306e\u8981\u6c42\u3092\u51e6\u7406\u3059\u308b\u65b9\u6cd5\u306b\u304a\u3051\u308b\u30b5\u30fc\u30d3\u30b9\u62d2\u5426\u306e\u8106\u5f31\u6027\u3092\u691c\u51fa\u3057\u307e\u3059<\/td>\n\u5bfe\u8c61
\nOWASP Broken Web Apps 1.2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script \\
\nhttp-vuln-cve2011-3192.nse \\
\n192.168.110.12 -pT:80<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-vuln-cve2011-3368<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nintrusive, vuln<\/td>\n

Apache HTTP\u30b5\u30fc\u30d0\u306e\u30ea\u30d0\u30fc\u30b9\u30d7\u30ed\u30ad\u30b7\u30e2\u30fc\u30c9\u306b\u304a\u3051\u308b\u8106\u5f31\u6027(CVE-2011-3368(\u30ea\u30d0\u30fc\u30b9\u30d7\u30ed\u30ad\u30b7\u30d0\u30a4\u30d1\u30b9))\u306e\u30c6\u30b9\u30c8\u3092\u884c\u3044\u307e\u3059\u3002\u540c\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u4ee5\u4e0b3\u3064\u306e\u30c6\u30b9\u30c8\u3092\u5b9f\u884c\u3057\u307e\u3059
\n\u30fb\u7570\u306a\u308b\u66f8\u304d\u63db\u3048\u30eb\u30fc\u30eb\u3092\u51e6\u7406\u3059\u308b3\u3064\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u6301\u3064\u30eb\u30fc\u30d7\u30d0\u30c3\u30af\u30c6\u30b9\u30c8
\n\u30fb\u5185\u90e8\u30db\u30b9\u30c8\u30c6\u30b9\u30c8\u3002”Contextis”\u306b\u3088\u308b\u3068\u3001\u30b5\u30fc\u30d0\u30a8\u30e9\u30fc\u304c\u767a\u751f\u3059\u308b\u524d\u306b\u9045\u5ef6\u304c\u4e88\u60f3\u3055\u308c\u307e\u3059\u3002
\n\u30fb\u5916\u90e8\u30a6\u30a7\u30d6\u30b5\u30a4\u30c8\u30c6\u30b9\u30c8\u3002LAN\u306eIP\u306b\u5230\u9054\u3067\u304d\u308b\u3053\u3068\u3092\u610f\u5473\u3059\u308b\u3082\u306e\u3067\u306f\u3042\u308a\u307e\u305b\u3093\u304c\u3001\u95a2\u9023\u3059\u308b\u554f\u984c\u3067\u3059\u3002<\/td>\n		\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-vuln-cve2011-3368 \\
\n192.168.110.1 -p 80<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-vuln-cve2012-1823<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, intrusive, vuln<\/td>\n

“PHP-CGI installations”\u306b\u5bfe\u3057\u3066\u3001\u653b\u6483\u8005\u304c\u30bd\u30fc\u30b9\u30b3\u30fc\u30c9\u3092\u53d6\u5f97\u3057\u3001\u30ea\u30e2\u30fc\u30c8\u3067\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u308b\u8106\u5f31\u6027(CVE-2012-1823)\u304c\u5b58\u5728\u3059\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV –script \\
\nhttp-vuln-cve2012-1823 \\
\n192.168.110.1 -p 80<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-vuln-cve2013-0156<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, vuln<\/td>\n

Ruby\u3092\u5b9f\u884c\u3057\u3066\u3044\u308bRails\u306e\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3001\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u3001\u30ea\u30e2\u30fc\u30c8\u30b3\u30de\u30f3\u30c9\u5b9f\u884c\u304a\u3088\u3073\u3001\u30b5\u30fc\u30d3\u30b9\u62d2\u5426\u653b\u6483\u306e\u8106\u5f31\u6027(CVE-2013-0156)\u306e\u6709\u7121\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV –script \\
\nhttp-vuln-cve2013-0156 \\
\n192.168.110.1 -p 80<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-vuln-cve2013-6786<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, vuln<\/td>\n

“Allegro RomPager”Web\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3001URL\u30ea\u30c0\u30a4\u30ec\u30af\u30c8\u3068\u53cd\u5c04\u578bXSS\u306e\u8106\u5f31\u6027(CVE-2013-6786)\u306e\u6709\u7121\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap–script http-vuln-cve2013-6786 \\
\n192.168.110.1 -p 80<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-vuln-cve2013-7091<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, intrusive, vuln<\/td>\n

\u672c\u8106\u5f31\u6027\u306f2013\u5e7412\u67086\u65e5\u306brubina119\u306b\u3088\u3063\u3066\u30ea\u30ea\u30fc\u30b9\u3055\u308c\u3001Zimbra 7.2.6\u306e\u30d1\u30c3\u30c1\u304c\u9069\u7528\u3055\u308c\u307e\u3057\u305f\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV –script \\
\nhttp-vuln-cve2013-7091 \\
\n192.168.110.1<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-vuln-cve2014-2126<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nsafe, vuln<\/td>\n

Cisco ASA\u306e\u30a2\u30d7\u30e9\u30a4\u30a2\u30f3\u30b9\u306b\u3066\u3001Cisco ASA ASDM\u6a29\u9650\u6607\u683c\u306e\u8106\u5f31\u6027(CVE-2014-2126)\u306e\u6709\u7121\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-vuln-cve2014-2126 \\
\n192.168.110.1 -p 443<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-vuln-cve2014-2127<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nsafe, vuln<\/td>\n

Cisco ASA\u306e\u30a2\u30d7\u30e9\u30a4\u30a2\u30f3\u30b9\u306b\u3066\u3001Cisco ASA SSL VPN\u6a29\u9650\u6607\u683c\u306e\u8106\u5f31\u6027(CVE-2014-2127)\u306e\u6709\u7121\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -p 443 –script \\
\nhttp-vuln-cve2014-2127 \\
\n192.168.110.12<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-vuln-cve2014-2128<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nsafe, vuln<\/td>\n

Cisco ASA\u306e\u30a2\u30d7\u30e9\u30a4\u30a2\u30f3\u30b9\u306b\u3066\u3001Cisco ASA SSL VPN\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9\u306e\u8106\u5f31\u6027(CVE-2014-2128)\u306e\u6709\u7121\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-vuln-cve2014-2128 \\
\n192.168.110.12 -p 443<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-vuln-cve2014-2129<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nsafe, vuln<\/td>\n

Cisco ASA\u306e\u30a2\u30d7\u30e9\u30a4\u30a2\u30f3\u30b9\u306b\u3066\u3001Cisco ASA\u306eSIP DoS\u653b\u6483\u306b\u5bfe\u3059\u308b\u8106\u5f31\u6027(CVE-2014-2129)\u306e\u6709\u7121\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-vuln-cve2014-2127 \\
\n192.168.110.12 -p 443<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-vuln-cve2014-3704<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, intrusive, vuln<\/td>\n

Drupal\u306e\u8106\u5f31\u6027\u3001CVE-2014-3704(Drupageddon)\u3092\u3064\u3044\u305f\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002( Drupal\u306e\u30b3\u30a2\u30d0\u30fc\u30b8\u30e7\u30f3\u304c7.32\u4ee5\u4e0b\u306e\u3082\u306e\u304c\u5f71\u97ff\u3092\u53d7\u3051\u307e\u3059\u3002)<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-vuln-cve2014-3704 \\
\n192.168.110.1 -p 80<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-vuln-cve2014-8877<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, intrusive, vuln<\/td>\n

WordPress\u306eCM\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u30de\u30cd\u30fc\u30b8\u30e3\u30d7\u30e9\u30b0\u30a4\u30f3\u306b\u304a\u3051\u308b\u3001\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027(CVE-2014-8877)\u3092\u3064\u3044\u305f\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002(\u30d0\u30fc\u30b8\u30e7\u30f3\u304c 2.0.0\u4ee5\u4e0b\u306e\u3082\u306e\u304c\u5f71\u97ff\u3092\u53d7\u3051\u307e\u3059\u3002)<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-vuln-cve2014-8877 \\
\n–script-args \\
\nhttp-vuln-cve2014-8877.uri=\\
\n“\/wordpress” \\
\n192.168.110.1 -p 80<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-vuln-cve2015-1427<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nintrusive, vuln<\/td>\n

Elasticsearch\u306b\u304a\u3051\u308bCVE-2015-1427\u306e\u8106\u5f31\u6027\u306e\u6709\u7121\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002\u540c\u8106\u5f31\u6027\u306f\u653b\u6483\u8005\u304c\u8a8d\u8a3c\u3055\u308c\u3066\u3044\u306a\u3044\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u306e\u5b9f\u884c(RCE)\u3059\u308b\u305f\u3081\u306b\u3001API\u306e\u6a5f\u80fd\u3092\u5229\u7528\u3059\u308b\u3053\u3068\u3092\u8a31\u53ef\u3059\u308b\u3082\u306e\u3067\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script=http-vuln-cve2015-1427 \\
\n–script-args command= ‘ls’ \\
\n192.168.110.12<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-vuln-cve2015-1635<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nsafe, vuln<\/td>\n

Microsoft Windows\u30b7\u30b9\u30c6\u30e0\u3067\u3001\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u304c\u5b9f\u884c\u3055\u308c\u308b\u8106\u5f31\u6027(MS15-034)(CVE2015-2015-1635)\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nhttp-vuln-cve2015-1635.nse \\
\n192.168.110.1 -p80<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-vuln-misfortune-cookie<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nintrusive, vuln<\/td>\n

“RomPager 4.07″\u3067”Misfortune Cookie”\u306e\u8106\u5f31\u6027\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nhttp-vuln-misfortune-cookie \\
\n192.168.110.1 -p 7547<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-vuln-wnr1000-creds<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, intrusive, vuln<\/td>\n

WNR 1000\u30b7\u30ea\u30fc\u30ba(NETGEAR\u793e\u88fd\u30eb\u30fc\u30bf)\u306b\u304a\u3044\u3066\u3001\u30eb\u30fc\u30bf\u306e\u30a4\u30f3\u30bf\u30d5\u30a7\u30fc\u30b9\u3088\u308a\u7ba1\u7406\u8005\u6a29\u9650\u3092\u53d6\u5f97\u3059\u308b\u8106\u5f31\u6027\u306e\u6709\u7121\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002(V1.0.2.60_60.0.86(\u6700\u65b0)\uff5eV1.0.2.54_60.0.82NA)<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV –script \\
\nhttp-vuln-wnr1000-creds \\
\n192.168.110.1 -p 80<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

http-waf-detect<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

\u60aa\u610f\u306e\u3042\u308b\u30da\u30a4\u30ed\u30fc\u30c9\u3067Web\u30b5\u30fc\u30d0\u3092\u8abf\u67fb\u3057\u3001\u5fdc\u7b54\u30b3\u30fc\u30c9\u3068\u672c\u6587\u306e\u5909\u66f4\u3092\u691c\u51fa\u3057\u3066\u3001Web\u30b5\u30fc\u30d0\u304cIPS\uff08\u4fb5\u5165\u9632\u5fa1\u30b7\u30b9\u30c6\u30e0\uff09\u3001IDS\uff08\u4fb5\u5165\u691c\u77e5\u30b7\u30b9\u30c6\u30e0\uff09\u307e\u305f\u306fWAF\uff08Web\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u30d5\u30a1\u30a4\u30a2\u30a6\u30a9\u30fc\u30eb\uff09\u306b\u3088\u3063\u3066\u4fdd\u8b77\u3055\u308c\u3066\u3044\u308b\u304b\u3069\u3046\u304b\u3092\u5224\u65ad\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-waf-detect \\
\n192.168.110.1 -p 80<\/td>\n<\/tr>\n
http-waf-fingerprint<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

Web\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u30d5\u30a1\u30a4\u30a2\u30a6\u30a9\u30fc\u30eb\u306e\u6709\u7121\u3001\u304a\u3088\u3073\u305d\u306e\u7a2e\u985e\u3068\u30d0\u30fc\u30b8\u30e7\u30f3\u306e\u5b58\u5728\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-waf-fingerprint \\
\n192.168.110.1 -p 80<\/td>\n<\/tr>\n
http-webdav-scan<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

OPTIONS\u3068PROPFIND\u30e1\u30bd\u30c3\u30c9\u3092\u4f7f\u7528\u3057\u3001WebDAV\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u306e\u6709\u7121\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script http-webdav-scan \\
\n–script-args \\
\nhttp-webdav-scan.path=’\/dav\/’ \\
\n192.168.110.1 -p 80<\/td>\n<\/tr>\n
http-wordpress-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

WordPress\u306eCMS \/\u30d6\u30ed\u30b0\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nOWASP Broken Web Apps 1.2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV –script \\
\nhttp-wordpress-brute \\
\n–script-args \\
\nhttp-wordpress-brute.uri=\\
\n“\/wordpress\/wp-login.php” \\
\n192.168.110.12 -p 80<\/p>\n

\u203b\u30c7\u30d0\u30c3\u30af\u30e2\u30fc\u30c9\u306b\u3066\u3001\u4e0b\u8a18\u30ed\u30b0\u3067\u30eb\u30fc\u30d7\u3057\u30b9\u30af\u30ea\u30d7\u30c8\u304c\u6b62\u307e\u308a\u307e\u3057\u305f\u3002
\nNSE Timing: About 89.74% done; ETC: 01:23 (0:00:04 remaining)<\/td>\n<\/tr>\n

http-wordpress-enum<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

WordPress\u306b\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3055\u308c\u305f\u30c6\u30fc\u30de\u3068\u30d7\u30e9\u30b0\u30a4\u30f3\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u307e\u305f\u3001\u3053\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u306f”api.wordpress.org”\u304b\u3089\u53d6\u5f97\u3057\u305f\u30d0\u30fc\u30b8\u30e7\u30f3\u60c5\u5831\u3092\u6bd4\u8f03\u3059\u308b\u3053\u3068\u306b\u3088\u308a\u3001\u53e4\u3044\u30d7\u30e9\u30b0\u30a4\u30f3\u3092\u691c\u51fa\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nOWASP Broken Apps 1.2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV –script \\
\nhttp-wordpress-enum \\
\n–script-args \\
\nhttp-wordpress-enum.root =\\
\n“\/wordpress” \\
\n192.168.110.12 -p 80<\/td>\n<\/tr>\n
http-wordpress-users<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, intrusive, vuln<\/td>\n

WordPress blog\/CMS\u306e\u30d0\u30fc\u30b8\u30e7\u30f32.6\u30013.1\u30013.1.1\u30013.1.3\u304a\u3088\u30733.2-\u03b22\u4ed6\u306b\u5b58\u5728\u3059\u308b\u60c5\u5831\u6f0f\u3048\u3044\u306e\u8106\u5f31\u6027\u3092\u3064\u3044\u305f\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u5b9f\u884c\u3057\u3001\u30e6\u30fc\u30b6\u540d\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-wordpress-users \\
\n–script-args \\
\nhttp-wordpress-users.basepath=\\
\n“\/wordpress” \\
\n192.168.110.1 -p 80<\/td>\n<\/tr>\n
http-xssed<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, external, safe<\/td>\n

xssed.com\u306e\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u3092\u691c\u7d22\u3057\u3001\u7d50\u679c\u3092\u51fa\u529b\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script http-xssed.nse \\
\n192.168.110.12? -p80<\/td>\n<\/tr>\n
iax2-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

Asterisk IAX2\u30d7\u30ed\u30c8\u30b3\u30eb\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002Maxcallnumber\u306e\u5236\u9650\uff08\u30c7\u30d5\u30a9\u30eb\u30c82048\uff09\u306e\u305f\u3081\u3001\u591a\u6570\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u8a66\u884c\u304c\u884c\u308f\u308c\u305f\u5834\u5408\u3001\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u306f\u5931\u6557\u3057\u307e\u3059\u3002(\u300cERROR: Too many retries, aborted \u2026\u300d\u3068\u3044\u3046\u30e1\u30c3\u30bb\u30fc\u30b8\u304c\u8868\u793a\u3055\u308c\u307e\u3059\u3002)\u3053\u306e\u554f\u984c\u3092\u56de\u907f\u3059\u308b\u306b\u306f\u3001\u4ee5\u4e0b\u3092\u8a66\u3057\u3066\u307f\u3066\u304f\u3060\u3055\u3044\u3002
\n\u30fb\u8f9e\u66f8\u306e\u30b5\u30a4\u30ba\u3092\u6e1b\u3089\u3059
\n\u30fb”brute delay”\u30aa\u30d7\u30b7\u30e7\u30f3\u3092\u4f7f\u3063\u3066\u30d1\u30b9\u30ef\u30fc\u30c9\u8a66\u884c\u306e\u5b9f\u884c\u306b\u9045\u5ef6\u3092\u5c0e\u5165\u3059\u308b
\n\u30fb\u30d1\u30b9\u30ef\u30fc\u30c9\u8a66\u884c\u3092\u5206\u5272\u3057\u3066\u5b9f\u884c\u9593\u9694\u3092\u3042\u3051\u308b<\/td>\n		\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script iax2-brute \\
\n192.168.110.1 -p 4569<\/td>\n<\/tr>\n
iax2-version<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nversion<\/td>\n

UDP IAX2\u30b5\u30fc\u30d3\u30b9\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU -sV 192.168.110.1 -p 4569<\/td>\n<\/tr>\n
icap-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

\u65e2\u77e5\u306eICAP\u30b5\u30fc\u30d3\u30b9\u540d\u306e\u30ea\u30b9\u30c8\u3092\u30c6\u30b9\u30c8\u3057\u3001\u691c\u51fa\u3055\u308c\u305fICAP\u30b5\u30fc\u30d3\u30b9\u540d\u306b\u95a2\u3059\u308b\u60c5\u5831\u3092\u51fa\u529b\u3057\u307e\u3059\u3002( Internet Content Adaptation Protocol (ICAP)\u306f\u900f\u904e\u30d7\u30ed\u30ad\u30b7\u30b5\u30fc\u30d0\u3092\u62e1\u5f35\u3059\u308b\u305f\u3081\u306b\u4f7f\u7528\u3055\u308c\u3001\u4e00\u822c\u7684\u306b\u30b3\u30f3\u30c6\u30f3\u30c4\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3001\u30a2\u30f3\u30c1\u30a6\u30a4\u30eb\u30b9\u30b9\u30ad\u30e3\u30f3\u306e\u305f\u3081\u306b\u4f7f\u7528\u3055\u308c\u307e\u3059\u3002)<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script icap-info \\
\n192.168.110.1 -p 1344<\/td>\n<\/tr>\n
ike-version<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe, version<\/td>\n

\u30db\u30b9\u30c8\u306b4\u30d1\u30b1\u30c3\u30c8\u9001\u4fe1\u3057\u3001IKE\u30b5\u30fc\u30d3\u30b9\u304b\u3089\u30d9\u30f3\u30c0\u304a\u3088\u3073\u4f7f\u7528\u53ef\u80fd\u306a\u30c7\u30d0\u30a4\u30b9\u30bf\u30a4\u30d7\u60c5\u5831\u306a\u3069\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002(\u30e1\u30a4\u30f3\u304a\u3088\u3073\u30a2\u30b0\u30ec\u30c3\u30b7\u30d6\u30e2\u30fc\u30c9\u306e\u4e21\u65b9\u3067\u30c6\u30b9\u30c8\u3057\u3001\u8981\u6c42\u3054\u3068\u306b\u8907\u6570\u306e\u30c8\u30e9\u30f3\u30b9\u30d5\u30a9\u30fc\u30e0\u3092\u9001\u4fe1\u3057\u307e\u3059\u3002)<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script ike-version \\
\n192.168.110.1 -p 500<\/td>\n<\/tr>\n
imap-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

IMAP\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3066\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002(LOGIN\u3001PLAIN\u3001CRAM-MD5\u3001DIGEST-MD5\u307e\u305f\u306fNTLM\u8a8d\u8a3c\u306e\u3044\u305a\u308c\u304b\u3092\u4f7f\u7528)<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script imap-brute \\
\n192.168.110.1 -p 143,993<\/td>\n<\/tr>\n
imap-capabilities<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, safe<\/td>\n

IMAP\u30e1\u30fc\u30eb\u30b5\u30fc\u30d0\u306e\u6a5f\u80fd\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nCentOS7\/dovecot
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV -sC 192.168.110.1<\/td>\n<\/tr>\n
imap-ntlm-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

NTLM\u8a8d\u8a3c\u304c\u6709\u52b9\u306b\u306a\u3063\u3066\u3044\u308bIMAP\u30b5\u30fc\u30d3\u30b9\u304b\u3089\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script imap-ntlm-info \\
\n192.168.110.1? -p 143,99<\/td>\n<\/tr>\n
informix-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

IBM Informix Dynamic\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script informix-brute \\
\n192.168.110.1 -p 9088<\/td>\n<\/tr>\n
informix-query<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, intrusive<\/td>\n

IBM Informix Dynamic\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3066\u3001\u6307\u5b9a\u3055\u308c\u305f\u8cc7\u683c\u60c5\u5831\u3092\u4f7f\u7528\u3057\u3066\u3001\u30af\u30a8\u30ea\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002(informix-brute\u53c2\u7167)<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script informix-query \\
\n–script-args \\
\ninformix-query.username=root, \\
\ninformix-query.password=root \\
\n192.168.110.1 -p 9088<\/td>\n<\/tr>\n
informix-tables<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, intrusive<\/td>\n

Informix\u30b5\u30fc\u30d0\u4e0a\u306e\u5404\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u306e\u30c6\u30fc\u30d6\u30eb\u3068\u5217\u5b9a\u7fa9\u306e\u30ea\u30b9\u30c8\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script informix-tables \\
\n–script-args \\
\ninformix-tables.username=root, \\
\ninformix-tables.password=root \\
\n192.168.110.1 -p 9088<\/td>\n<\/tr>\n
ip-forwarding<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

\u30b9\u30ad\u30e3\u30f3\u3055\u308c\u305f\u30db\u30b9\u30c8\u3092\u30c7\u30d5\u30a9\u30eb\u30c8\u30b2\u30fc\u30c8\u30a6\u30a7\u30a4\u3068\u3057\u3066\u4f7f\u7528\u3057\u3001\u5bfe\u8c61\u306bICMP\u30a8\u30b3\u30fc\u8981\u6c42\u3092\u9001\u4fe1\u3059\u308b\u3053\u3068\u306b\u3088\u308a\u3001\u5bfe\u8c61\u304cIP\u8ee2\u9001\u307e\u305f\u306f\u300c\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u63a5\u7d9a\u306e\u5171\u6709\u300d\u3092\u6709\u52b9\u306b\u3057\u3066\u3044\u308b\u304b\u3069\u3046\u304b\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sn –script ip-forwarding \\
\n–script-args=’target=google.com’ \\
\n192.168.110.2<\/td>\n<\/tr>\n
ip-geolocation-geoplugin<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, external, safe<\/td>\n

Geoplugin\u30b8\u30aa\u30ed\u30b1\u30fc\u30b7\u30e7\u30f3\u30a6\u30a7\u30d6\u30b5\u30fc\u30d3\u30b9(http:\/\/www.geoplugin.com\/)\u3092\u4f7f\u7528\u3057\u3066IP\u30a2\u30c9\u30ec\u30b9\u306e\u7269\u7406\u7684\u306a\u4f4d\u7f6e\u3092\u7279\u5b9a\u3057\u307e\u3059\u3002\u540c\u30b5\u30fc\u30d3\u30b9\u306b\u691c\u7d22\u306e\u5236\u9650\u306f\u3042\u308a\u307e\u305b\u3093\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sn –script \\
\nip-geolocation-geoplugin <GlobalIP><\/td>\n<\/tr>\n
ip-geolocation-ipinfodb<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, external, safe<\/td>\n

IPInfoDB\u30b8\u30aa\u30ed\u30b1\u30fc\u30b7\u30e7\u30f3\u30a6\u30a7\u30d6\u30b5\u30fc\u30d3\u30b9(http:\/\/ipinfodb.com\/ip_location_api.php)\u3092\u4f7f\u7528\u3057\u3066IP\u30a2\u30c9\u30ec\u30b9\u306e\u7269\u7406\u7684\u306a\u4f4d\u7f6e\u3092\u7279\u5b9a\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script ip-geolocation-ipinfodb \\
\n–script-args \\
\nip-geolocation-ipinfodb.apikey=\\
\n<API_key> \\
\n192.168.110.1<\/p>\n

\u203b\u4f7f\u7528\u306b\u306f\u540c\u30b5\u30a4\u30c8\u3078\u767b\u9332\u3057\u3001API\u30ad\u30fc\u3092\u5165\u624b\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/td>\n<\/tr>\n

ip-geolocation-maxmind<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, external, safe<\/td>\n

\u30b8\u30aa\u30ed\u30b1\u30fc\u30b7\u30e7\u30f3Maxmind\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u30d5\u30a1\u30a4\u30eb(http:\/\/www.maxmind.com\/app\/ip-location\u304b\u3089\u5165\u624b\u53ef\u80fd)\u3092\u4f7f\u7528\u3057\u3066IP\u30a2\u30c9\u30ec\u30b9\u306e\u7269\u7406\u7684\u306a\u4f4d\u7f6e\u3092\u7279\u5b9a\u3057\u307e\u3059\u3002\u3053\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001\u5e02\u8ca9\u306e\u3082\u306e\u3082\u542b\u3081\u3066\u3001Maxmind\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u306eAPI\u3067\u30b5\u30dd\u30fc\u30c8\u3055\u308c\u3066\u3044\u308b\u3059\u3079\u3066\u306e\u30af\u30a8\u30ea\u3092\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sn –script ip-geolocation-maxmind \\
\n126.236.32.113<\/td>\n<\/tr>\n
ip-https-discover<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

IP over HTTPS (IP-HTTPS)\u30c8\u30f3\u30cd\u30ea\u30f3\u30b0\u30d7\u30ed\u30c8\u30b3\u30eb\u304c\u30b5\u30dd\u30fc\u30c8\u3055\u308c\u3066\u3044\u308b\u304b\u3069\u3046\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script ip-https-discover \\
\n192.168.110.1<\/td>\n<\/tr>\n
ipidseq<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

\u30db\u30b9\u30c8\u306eIP ID\u30b7\u30fc\u30b1\u30f3\u30b9\u3092\u5206\u985e\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script ipidseq 192.168.110.1<\/td>\n<\/tr>\n
ipmi-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

IPMI RPC\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script ipmi-brute \\
\n192.168.110.1 -p 623<\/p>\n

\u203b\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u306f\u30b9\u30af\u30ea\u30d7\u30c8\u30d5\u30a1\u30a4\u30eb\u304a\u3088\u3073lua\u30d5\u30a1\u30a4\u30eb\u304c\u306a\u3044\u305f\u3081\u3001\u516c\u5f0f\u30da\u30fc\u30b8\u304b\u3089\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/td>\n<\/tr>\n

ipmi-cipher-zero<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nsafe, vuln<\/td>\n

“IPMI 2.0 Cipher Zero”\u306e\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9\u30b9\u30ad\u30e3\u30ca\u3067\u3059\u3002\u3053\u306e\u30e2\u30b8\u30e5\u30fc\u30eb\u306f\u3001”Cipher Zero”\u3092\u4f7f\u7528\u3057\u3066\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9\u8106\u5f31\u6027\u306e\u5f71\u97ff\u3092\u53d7\u3051\u308bIPMI 2.0\u4e92\u63db\u30b7\u30b9\u30c6\u30e0\u3092\u8b58\u5225\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script ipmi-cipher-zero \\
\n192.168.110.1 -p 623<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002
\n\u203b\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u306f\u30b9\u30af\u30ea\u30d7\u30c8\u30d5\u30a1\u30a4\u30eb\u304a\u3088\u3073lua\u30d5\u30a1\u30a4\u30eb\u304c\u306a\u3044\u305f\u3081\u3001\u516c\u5f0f\u30da\u30fc\u30b8\u304b\u3089\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/td>\n<\/tr>\n

ipmi-version<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

“Channel Auth”\u30d7\u30ed\u30fc\u30d6\u3092\u4f7f\u7528\u3057\u3066\u3001IPMI\u306e\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script ipmi-version \\
\n192.168.110.1 -p 623<\/p>\n

\u203b\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u306f\u30b9\u30af\u30ea\u30d7\u30c8\u30d5\u30a1\u30a4\u30eb\u304a\u3088\u3073lua\u30d5\u30a1\u30a4\u30eb\u304c\u306a\u3044\u305f\u3081\u3001\u516c\u5f0f\u30da\u30fc\u30b8\u304b\u3089\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/td>\n<\/tr>\n

ipv6-multicast-mld-list<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, discovery<\/td>\n

\u30de\u30eb\u30c1\u30ad\u30e3\u30b9\u30c8\u30ea\u30b9\u30ca\u63a2\u7d22\u3092\u4f7f\u7528\u3057\u3066\u3001IPv6\u306e\u30de\u30eb\u30c1\u30ad\u30e3\u30b9\u30c8\u53d7\u4fe1\u8005\u306b\u3088\u3063\u3066\u30b5\u30d6\u30b9\u30af\u30e9\u30a4\u30d6\u3055\u308c\u305f\u30de\u30eb\u30c1\u30ad\u30e3\u30b9\u30c8\u30a2\u30c9\u30ec\u30b9\u3092\u30ea\u30f3\u30af\u30ed\u30fc\u30ab\u30eb\u30b9\u30b3\u30fc\u30d7\u3067\u4e00\u89a7\u8868\u793a\u3057\u307e\u3059\u3002” IANA IPv6 Multicast Address Space Registry”\u306e\u30a2\u30c9\u30ec\u30b9\u306b\u306f\u3001\u305d\u306e\u8aac\u660e\u304c\u8a18\u8f09\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script=ipv6-multicast-mld-list<\/td>\n<\/tr>\n
ipv6-node-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

IPv6\u306e\u30ce\u30fc\u30c9\u30a4\u30f3\u30d5\u30a9\u30e1\u30fc\u30b7\u30e7\u30f3\u30af\u30a8\u30ea\u3092\u4ecb\u3057\u3066\u3001\u30db\u30b9\u30c8\u540d\u3001IPv4\u30a2\u30c9\u30ec\u30b9\u304a\u3088\u3073IPv6\u30a2\u30c9\u30ec\u30b9\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -6 2001:db8:1234:1234::3<\/td>\n<\/tr>\n
ipv6-ra-flood<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndos, intrusive<\/td>\n

\u30e9\u30f3\u30c0\u30e0\u306a\u9001\u4fe1\u5143MAC\u30a2\u30c9\u30ec\u30b9\u3068IPv6\u30d7\u30ec\u30d5\u30a3\u30c3\u30af\u30b9\u3092\u6301\u3064\u3001\u30eb\u30fc\u30bf\u30a2\u30c9\u30d0\u30bf\u30a4\u30ba\u30e1\u30f3\u30c8(RA)\u306e\u30d5\u30e9\u30c3\u30c9\u3092\u751f\u6210\u3057\u307e\u3059\u3002
\n\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u30b9\u30c6\u30fc\u30c8\u30ec\u30b9\u81ea\u52d5\u8a2d\u5b9a\u304c\u6709\u52b9\u306b\u306a\u3063\u3066\u3044\u308b\u30b3\u30f3\u30d4\u30e5\u30fc\u30bf\u306f\u3001IPv6\u306e\u30b5\u30d5\u30a3\u30c3\u30af\u30b9\u3092\u8a08\u7b97\u3057\u3001\u305d\u306e\u60c5\u5831\u3092\u57fa\u306b\u30eb\u30fc\u30c6\u30a3\u30f3\u30b0\u30c6\u30fc\u30d6\u30eb\u3092\u66f4\u65b0\u3057\u307e\u3059\u3002\u3053\u308c\u306b\u3088\u308a\u3001Windows\u304a\u3088\u3073\u305d\u306e\u4ed6\u30d7\u30e9\u30c3\u30c8\u30d5\u30a9\u30fc\u30e0\u4e0a\u3067CPU\u4f7f\u7528\u7387\u304c100\uff05\u3068\u306a\u308a\u3001\u4ed6\u306e\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u8981\u6c42\u3092\u963b\u5bb3\u3057\u307e\u3059\u3002<\/td>\n		\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -6 –script ipv6-ra-flood.nse \\
\n–script-args ‘interface=eth0’<\/td>\n<\/tr>\n
irc-botnet-channels<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe, vuln<\/td>\n

IRC\u30b5\u30fc\u30d0\u304c\u60aa\u610f\u306e\u3042\u308b\u30dc\u30c3\u30c8\u30cd\u30c3\u30c8\u3068\u3057\u3066\u4f7f\u7528\u3055\u308c\u3066\u3044\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script irc-botnet-channels \\
\n192.168.110.1 -p 6667<\/td>\n<\/tr>\n
irc-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

IRC(\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u30ea\u30ec\u30fc\u30c1\u30e3\u30c3\u30c8)\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script irc-brute 192.168.110.1 \\
\n-p 6667<\/td>\n<\/tr>\n
irc-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

IRC\u30b5\u30fc\u30d0\u304b\u3089\u60c5\u5831\u3092\u53ce\u96c6\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV -sC 192.168.110.1 -p 6667<\/td>\n<\/tr>\n
irc-sasl-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

SASL\u8a8d\u8a3c\u3092\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u3044\u308bIRC(\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u30ea\u30ec\u30fc\u30c1\u30e3\u30c3\u30c8)\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script irc-sasl-brute \\
\n192.168.110.1 -p 6667<\/td>\n<\/tr>\n
irc-unrealircd-backdoor<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, intrusive, malware, vuln<\/td>\n

time-based command (ping)\u3092\u5b9f\u884c\u3057\u3001\u5fdc\u7b54\u6642\u9593\u3092\u78ba\u8a8d\u3059\u308b\u3053\u3068\u306b\u3088\u308a\u3001IRC\u30b5\u30fc\u30d0\u306b\u30d0\u30c3\u30af\u30c9\u30a2\u304c\u3042\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV –script \\
\nirc-unrealircd-backdoor \\
\n192.168.110.1<\/td>\n<\/tr>\n
iscsi-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

\u5bfe\u8c61\u306eiSCSI\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV –script iscsi-brute \\
\n192.168.110.1<\/td>\n<\/tr>\n
iscsi-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

\u5bfe\u8c61\u3068\u306a\u308biSCSI\u306e\u60c5\u5831\u3092\u53ce\u96c6\u3001\u8868\u793a\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV -sC 192.168.110.1<\/td>\n<\/tr>\n
isns-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

\u30dd\u30fc\u30bf\u30eb\u304a\u3088\u3073Internet Storage Name Service (iSNS)\u306b\u767b\u9332\u3055\u308c\u305fiSCSI\u30ce\u30fc\u30c9\u3092\u51fa\u529b\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script isns-info \\
\n192.168.110.1 -p 3205<\/td>\n<\/tr>\n
jdwp-exec<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, intrusive<\/td>\n

Java\u306e\u30ea\u30e2\u30fc\u30c8\u30c7\u30d0\u30c3\u30b0\u30dd\u30fc\u30c8\u3092\u3064\u3044\u305f\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002\u30ea\u30e2\u30fc\u30c8\u30c7\u30d0\u30c3\u30b0\u30dd\u30fc\u30c8\u304c\u30aa\u30fc\u30d7\u30f3\u306b\u306a\u3063\u3066\u3044\u308b\u3068\u3001Java\u306e\u30d0\u30a4\u30c8\u30b3\u30fc\u30c9\u3092\u633f\u5165\u3057\u3001\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u306e\u5b9f\u884c\u304c\u53ef\u80fd\u3068\u306a\u308a\u307e\u3059\u3002\u540c\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001\u4e0a\u8a18\u3092\u60aa\u7528\u3057\u3066\u3001\u63d0\u4f9b\u3055\u308c\u305f\u30b7\u30a7\u30eb\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3057\u3001\u305d\u306e\u51fa\u529b\u3092\u8fd4\u3059Java\u30af\u30e9\u30b9\u30d5\u30a1\u30a4\u30eb\u3092\u633f\u5165\u3057\u3066\u5b9f\u884c\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sT –script=+jdwp-exec \\
\n–script-args cmd=”date” 192.168.110.1<\/td>\n<\/tr>\n
jdwp-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

Java\u306e\u30ea\u30e2\u30fc\u30c8\u30c7\u30d0\u30c3\u30b0\u30dd\u30fc\u30c8\u306b\u5bfe\u3057\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002\u30ea\u30e2\u30fc\u30c8\u30c7\u30d0\u30c3\u30b0\u30dd\u30fc\u30c8\u304c\u30aa\u30fc\u30d7\u30f3\u306b\u306a\u3063\u3066\u3044\u308b\u3068\u3001Java\u306e\u30d0\u30a4\u30c8\u30b3\u30fc\u30c9\u3092\u633f\u5165\u3057\u3001\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u306e\u5b9f\u884c\u304c\u53ef\u80fd\u3068\u306a\u308a\u307e\u3059\u3002\u3053\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001Java\u30af\u30e9\u30b9\u30d5\u30a1\u30a4\u30eb\u3092\u633f\u5165\u3001\u5b9f\u884c\u3059\u308b\u3053\u3068\u306b\u3088\u308a\u3001\u30ea\u30e2\u30fc\u30c8\u30b7\u30b9\u30c6\u30e0\u306e\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sT –script=+jdwp-info \\
\n192.168.110.1<\/td>\n<\/tr>\n
jdwp-inject<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, intrusive<\/td>\n

Java\u306e\u30ea\u30e2\u30fc\u30c8\u30c7\u30d0\u30c3\u30b0\u30dd\u30fc\u30c8\u306b\u5bfe\u3057\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002\u30ea\u30e2\u30fc\u30c8\u30c7\u30d0\u30c3\u30b0\u30dd\u30fc\u30c8\u304c\u30aa\u30fc\u30d7\u30f3\u306b\u306a\u3063\u3066\u3044\u308b\u3068\u3001Java\u306e\u30d0\u30a4\u30c8\u30b3\u30fc\u30c9\u3092\u633f\u5165\u3057\u3001\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u306e\u5b9f\u884c\u304c\u53ef\u80fd\u3068\u306a\u308a\u307e\u3059\u3002\u3053\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001\u4efb\u610f\u306e\u30af\u30e9\u30b9\u30d5\u30a1\u30a4\u30eb\u306e\u633f\u5165\u3092\u53ef\u80fd\u306b\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sT –script=+jdwp-inject \\
\n–script-args \\
\nfilename=HelloWorld.class \\
\n192.168.110.1<\/td>\n<\/tr>\n
jdwp-version<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nversion<\/td>\n

Java\u306e Debug Wire\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u691c\u51fa\u3057\u307e\u3059\u3002\u3053\u306e\u30d7\u30ed\u30c8\u30b3\u30eb\u306f\u3001\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u3092\u4ecb\u3057\u3066\u30c7\u30d0\u30c3\u30b0\u3059\u308b\u305f\u3081\u306bJava\u30d7\u30ed\u30b0\u30e9\u30e0\u306b\u3088\u3063\u3066\u4f7f\u7528\u3055\u308c\u307e\u3059\u3002\u30c7\u30d0\u30c3\u30b0\u30d7\u30ed\u30bb\u30b9\u306b\u4efb\u610f\u306e\u30d0\u30a4\u30c8\u30b3\u30fc\u30c9\u3092\u57cb\u3081\u8fbc\u3080\u3053\u3068\u304c\u3067\u304d\u308b\u305f\u3081\u3001\u540c\u30d7\u30ed\u30c8\u30b3\u30eb\u306f\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u5411\u3051\u306b\u958b\u653e\u3059\u3079\u304d\u3067\u306f\u3042\u308a\u307e\u305b\u3093\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV 192.168.110.1<\/td>\n<\/tr>\n
knx-gateway-discover<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, discovery, safe<\/td>\n

“KNX Search”\u8981\u6c42(UDP3671\u30dd\u30fc\u30c8)\u3092\u30de\u30eb\u30c1\u30ad\u30e3\u30b9\u30c8\u30a2\u30c9\u30ec\u30b9\u300c224.0.23.12\u300d\u306b\u9001\u4fe1\u3059\u308b\u3053\u3068\u306b\u3088\u308a\u3001KNX\u306e\u30b2\u30fc\u30c8\u30a6\u30a7\u30a4\u3092\u767a\u898b\u3057\u307e\u3059\u3002\u540c\u8981\u6c42\u306b\u5bfe\u3057\u3001KNX\u30b2\u30fc\u30c8\u30a6\u30a7\u30a4\u306fKNX\u30a2\u30c9\u30ec\u30ec\u30b9\u3084\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u3044\u308b\u30b5\u30fc\u30d3\u30b9\u306a\u3069\u306e\u60c5\u5831\u3092\u542b\u3093\u3060KNXSeach\u5fdc\u7b54\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nknx-gateway-discover -e eth0<\/td>\n<\/tr>\n
knx-gateway-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

“KNX Description”\u8981\u6c42\u3092UDP3671\u30dd\u30fc\u30c8\u306b\u9001\u4fe1\u3059\u308b\u3053\u3068\u306b\u3088\u308a\u3001KNX\u30b2\u30fc\u30c8\u30a6\u30a7\u30a4\u3092\u8b58\u5225\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV -sC 192.168.110.1<\/td>\n<\/tr>\n
krb5-enum-users<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, intrusive<\/td>\n

Kerberos\u30b5\u30fc\u30d3\u30b9\u306b\u5bfe\u3057\u3066\u30e6\u30fc\u30b6\u540d\u3092\u7167\u4f1a\u3059\u308b\u3053\u3068\u306b\u3088\u308a\u3001\u6709\u52b9\u306a\u30e6\u30fc\u30b6\u540d\u3092\u691c\u51fa\u3057\u307e\u3059\u3002\u7121\u52b9\u306a\u30e6\u30fc\u30b6\u540d\u304c\u8981\u6c42\u3055\u308c\u308b\u3068\u3001\u30b5\u30fc\u30d0\u306fKerberos\u30a8\u30e9\u30fc\u30b3\u30fc\u30c9”KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN”\u3092\u4f7f\u7528\u3057\u3066\u5fdc\u7b54\u3059\u308b\u305f\u3081\u3001\u30e6\u30fc\u30b6\u540d\u304c\u7121\u52b9\u3067\u3042\u308b\u3068\u5224\u65ad\u3067\u304d\u307e\u3059\u3002\u6709\u52b9\u306a\u30e6\u30fc\u30b6\u540d\u306f\u3001”AS-REP”\u5fdc\u7b54\u306e”TGT”\u307e\u305f\u306f”KRB5KDC_ERR_PREAUTH_REQUIRED”\u30a8\u30e9\u30fc\u306e\u3044\u305a\u308c\u304b\u3092\u4f7f\u7528\u3057\u3066\u3001\u4e8b\u524d\u8a8d\u8a3c\u304c\u5fc5\u8981\u3067\u3042\u308b\u3053\u3068\u3092\u793a\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script krb5-enum-users \\
\n–script-args \\
\nkrb5-enum-users.realm=’test’ \\
\n192.168.110.1 -p 88<\/td>\n<\/tr>\n
ldap-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

LDAP\u8a8d\u8a3c\u306b\u5bfe\u3057\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u306f\u3001\u30d3\u30eb\u30c8\u30a4\u30f3\u3055\u308c\u3066\u3044\u308b\u30e6\u30fc\u30b6\u540d\u3068\u30d1\u30b9\u30ef\u30fc\u30c9\u306e\u30ea\u30b9\u30c8\u3092\u4f7f\u7528\u3057\u307e\u3059\u3002\u72ec\u81ea\u306e\u30ea\u30b9\u30c8\u3092\u4f7f\u7528\u3059\u308b\u305f\u3081\u306b”userdb”\u3068”passdb”\u5f15\u6570\u3092\u4f7f\u7528\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -p 389 –script ldap-brute \\
\n–script-args \\
\nldap.base='”cn=users,dc=cqure,dc=net”‘ \\
\n192.168.110.1<\/td>\n<\/tr>\n
ldap-novell-getpass<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

\u30e6\u30cb\u30d0\u30fc\u30b5\u30eb\u30d1\u30b9\u30ef\u30fc\u30c9\u306f\u3001\u30d1\u30b9\u30ef\u30fc\u30c9\u306e\u62e1\u5f35\u6587\u5b57\u3001eDirectory\u304b\u3089\u4ed6\u306e\u30b7\u30b9\u30c6\u30e0\u3078\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u306e\u540c\u671f\u5316\u3001eDirectory\u3078\u306e\u3059\u3079\u3066\u306e\u30a2\u30af\u30bb\u30b9\u306e\u305f\u3081\u306e\u5358\u4e00\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u542b\u3080\u3001\u9ad8\u5ea6\u306a\u30d1\u30b9\u30ef\u30fc\u30c9\u30dd\u30ea\u30b7\u30fc\u306b\u5bfe\u5fdc\u3057\u3066\u3044\u307e\u3059\u3002\u30d1\u30b9\u30ef\u30fc\u30c9\u30dd\u30ea\u30b7\u30fc\u306b\u3066”Allow admin to retrieve passwords”\u304c\u8a2d\u5b9a\u3055\u308c\u3066\u3044\u308b\u5834\u5408\u3001\u30d1\u30b9\u30ef\u30fc\u30c9\u306e\u53d6\u5f97\u304c\u53ef\u80fd\u3067\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script ldap-novell-getpass \\
\n–script-args \\
\n‘ldap-novell-getpass.username=\\
\n“CN=admin,O=cqure”, \\
\nldap-novell-getpass.password=\\
\npass1234, \\
\nldap-novell-getpass.account=\\
\n“CN=paka,OU=hr,O=cqure”‘ \\
\n192.168.110.1 -p 636<\/td>\n<\/tr>\n
ldap-rootdse<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

LDAP\u306e\u30eb\u30fc\u30c8DSA-specific Entry(DSE)\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script ldap-rootdse \\
\n192.168.110.1 -p 389<\/td>\n<\/tr>\n
ldap-search<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

LDAP\u306e\u691c\u7d22\u3092\u5b9f\u884c\u3057\u3001\u4e00\u81f4\u3057\u305f\u7d50\u679c\u3092\u8fd4\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script ldap-search \\
\n–script-args \\
\n‘ldap.username=”cn=ldaptest, \\
\ncn=users,dc=cqure,dc=net”, \\
\nldap.password=ldaptest, \\
\nldap.qfilter=users, \\
\nldap.attrib=sAMAccountName’ \\
\n192.168.110.1 -p 389<\/td>\n<\/tr>\n
lexmark-config<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

Lexmark S300-S400\u306e\u30d7\u30ea\u30f3\u30bf\u304b\u3089\u69cb\u6210\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script lexmark-config \\
\n192.168.110.1 -p 9100<\/td>\n<\/tr>\n
llmnr-resolve<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, discovery, safe<\/td>\n

LLMNR(\u30ea\u30f3\u30af\u30ed\u30fc\u30ab\u30eb\u30de\u30eb\u30c1\u30ad\u30e3\u30b9\u30c8\u540d\u524d\u89e3\u6c7a)\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u4f7f\u7528\u3057\u3066\u30db\u30b9\u30c8\u540d\u3092\u89e3\u6c7a\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script llmnr-resolve \\
\n–script-args \\
\n‘llmnr-resolve.hostname=kuno-PC’ \\
\n-e eth0<\/td>\n<\/tr>\n
lltd-discovery<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, discovery, safe<\/td>\n

Microsoft\u306eLLTD\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u4f7f\u7528\u3057\u3001\u30ed\u30fc\u30ab\u30eb\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u4e0a\u306e\u30db\u30b9\u30c8\u3092\u767a\u898b\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script lltd-discovery -e eth0<\/td>\n<\/tr>\n
maxdb-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, version<\/td>\n

SAP Max DB\u304b\u3089\u30d0\u30fc\u30b8\u30e7\u30f3\u3084\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u306e\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script maxdb-info \\
\n192.168.110.1 -p 7210<\/td>\n<\/tr>\n
mcafee-epo-agent<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nsafe, version<\/td>\n

ePO\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8\u304c8081\u30dd\u30fc\u30c8(\u3082\u3057\u304f\u306fePO\u306e\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8\u30dd\u30fc\u30c8\u3068\u3057\u3066\u7279\u5b9a\u3055\u308c\u305f\u30dd\u30fc\u30c8)\u3067\u5b9f\u884c\u3055\u308c\u3066\u3044\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV 192.168.110.1<\/td>\n<\/tr>\n
membase-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

Couchbase Membase\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script membase-brute \\
\n192.168.110.1 -p 11211<\/td>\n<\/tr>\n
membase-http-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

Couchbase\u306eWeb\u7ba1\u7406\u30dd\u30fc\u30c8\u304b\u3089\u30db\u30b9\u30c8\u540d\u3001OS\u3001\u7a3c\u50cd\u6642\u9593\u306a\u3069\u306e\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002(\u8cc7\u683c\u60c5\u5831\u4e0d\u8981)<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script membase-http-info \\
\n192.168.110.1 -p 8091<\/td>\n<\/tr>\n
memcached-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

memcached(\u5206\u6563\u30e1\u30e2\u30ea\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u30ad\u30e3\u30c3\u30b7\u30e5\u30b7\u30b9\u30c6\u30e0)\u304b\u3089\u30b7\u30b9\u30c6\u30e0\u30a2\u30fc\u30ad\u30c6\u30af\u30c1\u30e3\u3001\u30d7\u30ed\u30bb\u30b9ID\u3001\u304a\u3088\u3073\u30b5\u30fc\u30d0\u6642\u9593\u306a\u3069\u306e\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script memcached-info \\
\n192.168.110.1 -p 11211<\/td>\n<\/tr>\n
metasploit-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nintrusive, safe<\/td>\n

Metasploit\u306eRPC\u30b5\u30fc\u30d3\u30b9\u304b\u3089\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u540c\u30b9\u30af\u30ea\u30d7\u30c8\u306e\u4f7f\u7528\u306b\u306f\u6709\u52b9\u306a\u30ed\u30b0\u30a4\u30f3\u60c5\u5831\u304c\u5fc5\u8981\u3067\u3059\u3002\u8a8d\u8a3c\u5f8c\u306f\u3001Metasploit\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u78ba\u8a8d\u3001OS\u306e\u7a2e\u985e\u3092\u63a8\u6e2c\u3057\u3001\u65b0\u3057\u3044\u30b3\u30f3\u30bd\u30fc\u30eb\u3092\u4f5c\u6210\u3002\u8ffd\u52a0\u306e\u60c5\u5831\u3092\u53d6\u5f97\u3059\u308b\u305f\u3081\u306b\u3044\u304f\u3064\u304b\u306e\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script=metasploit-info \\
\n–script-args username=root, \\
\npassword=root 192.168.110.1<\/td>\n<\/tr>\n
metasploit-msgrpc-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

Metasploit\u306e”msgrpc”\u30a4\u30f3\u30bf\u30d5\u30a7\u30fc\u30b9\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u3000\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nmetasploit-msgrpc-brute \\
\n192.168.110.1 -p 55553<\/td>\n<\/tr>\n
metasploit-xmlrpc-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

XMLRPC\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u4f7f\u7528\u3057\u3066\u3001Metasploit\u306eRPC\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script metasploit-xmlrpc-brute \\
\n192.168.110.1 -p 55553<\/td>\n<\/tr>\n
mikrotik-routeros-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

Mikrotik RouterOS\u30c7\u30d0\u30a4\u30b9(API\u304c\u6709\u52b9\u306a\u3082\u306e)\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script mikrotik-routeros-brute \\
\n192.168.110.1 -p8728<\/td>\n<\/tr>\n
mmouse-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

“RPA Tech Mobile Mouse”\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script mmouse-brute \\
\n192.168.110.1 -p 51010<\/td>\n<\/tr>\n
mmouse-exec<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nintrusive<\/td>\n

“RPA Tech Mobile Mouse”\u30b5\u30fc\u30d0\u306b\u63a5\u7d9a\u3057\u3001\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092\u8d77\u52d5\u3002\u30ad\u30fc\u30b7\u30fc\u30b1\u30f3\u30b9\u3092\u9001\u4fe1\u3057\u307e\u3059\u3002\u3053\u308c\u306b\u3088\u308a\u3001\u30e6\u30fc\u30b6\u304c\u30a2\u30af\u30bb\u30b9\u3067\u304d\u308b\u4efb\u610f\u306e\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092\u958b\u59cb\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u3001\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u304c\u958b\u59cb\u3055\u308c\u305f\u5f8c\u3001\u30ad\u30fc\u30b7\u30fc\u30b1\u30f3\u30b9\u306f\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306b\u9001\u4fe1\u3055\u308c\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script mmouse-exec \\
\n–script-args \\
\napplication=’\/bin\/sh’, \\
\nkeys=’ping -c 5 127.0.0.1′ \\
\n192.168.110.1 -p 51010<\/td>\n<\/tr>\n
modbus-discover<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

SCADA Modbus slave ids (sids)\u3092\u5217\u6319\u3057\u3001\u30c7\u30d0\u30a4\u30b9\u60c5\u5831\u3092\u53ce\u96c6\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script modbus-discover.nse \\
\n–script-args \\
\n‘modbus-discover.aggressive=true’ \\
\n192.168.110.1 -p 502<\/td>\n<\/tr>\n
mongodb-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

“MongoDB”\u306e\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7\/MongoDB 3.2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script mongodb-brute \\
\n192.168.110.1 -p 27017<\/td>\n<\/tr>\n
mongodb-databases<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

“MongoDB”\u306e\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u304b\u3089\u30c6\u30fc\u30d6\u30eb\u306e\u4e00\u89a7\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7\/MongoDB 3.2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script mongodb-databases \\
\n192.168.110.1 -p 27017<\/td>\n<\/tr>\n
mongodb-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

“MongoDB”\u306e\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u304b\u3089\u30d3\u30eb\u30c9\u60c5\u5831\u304a\u3088\u3073\u30b5\u30fc\u30d0\u306e\u30b9\u30c6\u30fc\u30bf\u30b9\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7\/MongoDB 3.2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script mongodb-info \\
\n192.168.110.1 -p 27017<\/td>\n<\/tr>\n
mqtt-subscribe<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe, version<\/td>\n

MQTT\u30d6\u30ed\u30fc\u30ab\u30fc\u304b\u3089\u306e\u30e1\u30c3\u30bb\u30fc\u30b8\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u30c0\u30f3\u30d7\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script mqtt-subscribe \\
\n192.168.110.1 -p 1883<\/p>\n

\u203b\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u306f\u30b9\u30af\u30ea\u30d7\u30c8\u30d5\u30a1\u30a4\u30eb\u304c\u306a\u3044\u305f\u3081\u3001\u516c\u5f0f\u30da\u30fc\u30b8\u304b\u3089\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/td>\n<\/tr>\n

mrinfo<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, discovery, safe<\/td>\n

\u30de\u30eb\u30c1\u30ad\u30e3\u30b9\u30c8\u30eb\u30fc\u30c6\u30a3\u30f3\u30b0\u60c5\u5831\u3092\u7167\u4f1a\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script mrinfo -e eth0<\/td>\n<\/tr>\n
msrpc-enum<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

MSRPC\u30a8\u30f3\u30c9\u30dd\u30a4\u30f3\u30c8\u30de\u30c3\u30d1\u30fc\u306b\u30de\u30c3\u30d4\u30f3\u30b0\u3055\u308c\u305f\u30b5\u30fc\u30d3\u30b9\u3092\u7167\u4f1a\u3057\u3001\u53d6\u5f97\u3057\u305f\u60c5\u5831\u3092\u8868\u793a\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nCentOS7
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script msrpc-enum 192.168.110.1<\/td>\n<\/tr>\n
ms-sql-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

Microsoft SQL Server\u306e(MS-SQL)\u306b\u5bfe\u3057\u3066\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002”broadcast-ms-sql-discover”\u30b9\u30af\u30ea\u30d7\u30c8\u3068\u5171\u306b\u5b9f\u884c\u3059\u308b\u3053\u3068\u304c\u63a8\u5968\u3055\u308c\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script ms-sql-brute 192.168.110.1 -p 1433<\/td>\n<\/tr>\n
ms-sql-config<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

Microsoft SQL Server\u306e(MS-SQL)\u30a4\u30f3\u30b9\u30bf\u30f3\u30b9\u306b\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u3001\u30ea\u30f3\u30af\u30b5\u30fc\u30d0\u3001\u304a\u3088\u3073\u69cb\u6210\u8a2d\u5b9a\u3092\u554f\u3044\u5408\u308f\u305b\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script ms-sql-config \\
\n–script-args \\
\nmssql.username=sa, \\
\nmssql.password=sa \\
\n192.168.110.1 -p 1433<\/td>\n<\/tr>\n
ms-sql-dac<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

\u7279\u5b9a\u306e(\u307e\u305f\u306f\u3059\u3079\u3066\u306e)SQL Server\u30a4\u30f3\u30b9\u30bf\u30f3\u30b9\u306eDAC(Dedicated Admin Connection)\u30dd\u30fc\u30c8\u306eMicrosoft SQL Browser\u30b5\u30fc\u30d3\u30b9\u3092\u7167\u4f1a\u3057\u307e\u3059\u3002 DAC\u30dd\u30fc\u30c8\u306f\u3001\u305f\u3068\u3048\u3070\u3001\u30b5\u30fc\u30d0\u304c\u30cf\u30f3\u30b0\u30a2\u30c3\u30d7\u3057\u305f\u308a\u3001\u30e1\u30e2\u30ea\u4e0d\u8db3\u307e\u305f\u306f\u305d\u306e\u4ed6\u306e\u4e0d\u826f\u72b6\u614b\u306b\u306a\u308a\u3001\u30b5\u30fc\u30d0\u306b\u63a5\u7d9a\u304c\u3067\u304d\u306a\u304b\u3063\u305f\u3068\u304d\u306b\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u30a4\u30f3\u30b9\u30bf\u30f3\u30b9\u306b\u63a5\u7d9a\u3059\u308b\u305f\u3081\u306b\u4f7f\u7528\u3055\u308c\u307e\u3059\u3002\u307e\u305f\u3001DAC\u30dd\u30fc\u30c8\u306f\u3001\u901a\u5e38\u306e\u63a5\u7d9a\u3067\u306f\u30a2\u30af\u30bb\u30b9\u3067\u304d\u306a\u3044\u30b7\u30b9\u30c6\u30e0\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3078\u306e\u30a2\u30af\u30bb\u30b9\u3092\u7ba1\u7406\u8005\u306b\u63d0\u4f9b\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script ms-sql-dac \\
\n192.168.110.1 -p 1434<\/td>\n<\/tr>\n
ms-sql-dump-hashes<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, discovery, safe<\/td>\n

MS-SQL\u30b5\u30fc\u30d0\u304b\u3089\u30d1\u30b9\u30ef\u30fc\u30c9\u30cf\u30c3\u30b7\u30e5\u3092John-the-ripper\u306a\u3069\u306e\u30c4\u30fc\u30eb\u3067\u30af\u30e9\u30c3\u30af\u53ef\u80fd\u306a\u5f62\u5f0f\u3067\u30c0\u30f3\u30d7\u3057\u307e\u3059\u3002(\u30b9\u30af\u30ea\u30d7\u30c8\u5b9f\u884c\u306b\u306f\u9069\u5207\u306aDB\u6a29\u9650\u304c\u5fc5\u8981\u3067\u3059\u3002)<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script ms-sql-dump-hashes \\
\n192.168.110.1 -p 1433<\/td>\n<\/tr>\n
ms-sql-empty-password<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, intrusive<\/td>\n

Microsoft SQL Server\u306b\u5bfe\u3057\u3001sysadmin (sa)\u304c\u7a7a\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u3067\u8a8d\u8a3c\u53ef\u80fd\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7\/Microsoft SQLServer2008
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script ms-sql-empty-password \\
\n192.168.110.1 -p 1433<\/td>\n<\/tr>\n
ms-sql-hasdbaccess<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, discovery, safe<\/td>\n

Microsoft SQL Server\u306e(MS-SQL)\u30a4\u30f3\u30b9\u30bf\u30f3\u30b9\u306b\u5bfe\u3057\u3001\u30e6\u30fc\u30b6\u304c\u30a2\u30af\u30bb\u30b9\u6a29\u3092\u6301\u3064\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u306e\u30ea\u30b9\u30c8\u3092\u7167\u4f1a\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script ms-sql-hasdbaccess \\
\n–script-args \\
\nmssql.username=sa, \\
\nmssql.password=sa \\
\n192.168.110.1 -p 1433<\/td>\n<\/tr>\n
ms-sql-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

Microsoft SQL Server\u30a4\u30f3\u30b9\u30bf\u30f3\u30b9\u306e\u69cb\u6210\u3068\u30d0\u30fc\u30b8\u30e7\u30f3\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script ms-sql-info \\
\n–script-args mssql.instance-port=1433 \\
\n192.168.110.1 -p 1433<\/td>\n<\/tr>\n
ms-sql-ntlm-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

NTLM\u8a8d\u8a3c\u304c\u6709\u52b9\u306b\u306a\u3063\u3066\u3044\u308bMicrosoft SQL\u30b5\u30fc\u30d3\u30b9\u304b\u3089\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script ms-sql-ntlm-info \\
\n192.168.110.1 -p 1433<\/td>\n<\/tr>\n
ms-sql-query<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

Microsoft SQL Server(ms-sql)\u306b\u5bfe\u3057\u3066\u30af\u30a8\u30ea\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script ms-sql-query \\
\n–script-args \\
\nmssql.username=sa, \\
\nmssql.password=sa, \\
\nms-sql-query.query=\\
\n“SELECT * FROM master..syslogins” \\
\n192.168.110.1 -p 1433<\/td>\n<\/tr>\n
ms-sql-tables<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

Microsoft SQL Server(ms-sql)\u306b\u5bfe\u3057\u3066\u3001\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u3054\u3068\u306e\u30c6\u30fc\u30d6\u30eb\u306e\u30ea\u30b9\u30c8\u3092\u7167\u4f1a\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script ms-sql-tables \\
\n–script-args \\
\nmssql.username=sa, \\
\nmssql.password=sa \\
\n192.168.110.1 -p 1433<\/td>\n<\/tr>\n
ms-sql-xp-cmdshell<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nintrusive<\/td>\n

Microsoft SQL Server(ms-sql)\u306e\u30b3\u30de\u30f3\u30c9\u30b7\u30a7\u30eb\u3092\u4f7f\u7528\u3057\u3066\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script ms-sql-xp-cmdshell \\
\n–script-args \\
\nmssql.username=sa, \\
\nmssql.password=sa, \\
\nms-sql-xp-cmdshell.cmd=\\
\n“net user test test \/add” \\
\n192.168.110.1 -p 1433<\/td>\n<\/tr>\n
mtrace<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, discovery, safe<\/td>\n

\u9001\u4fe1\u5143\u304b\u3089\u5b9b\u5148\u30db\u30b9\u30c8\u3078\u306e\u30de\u30eb\u30c1\u30ad\u30e3\u30b9\u30c8\u30d1\u30b9\u3092\u7167\u4f1a\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script mtrace –script-args \\
\nmtrace.fromip=’192.168.110.19′<\/td>\n<\/tr>\n
murmur-version<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nversion<\/td>\n

\u30d0\u30fc\u30b8\u30e7\u30f31.2.x\u306e”Murmur”\u30b5\u30fc\u30d3\u30b9(Mumble voice communication client\u7528\u306e\u30b5\u30fc\u30d0)\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV 192.168.110.1<\/td>\n<\/tr>\n
mysql-audit<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

CIS\u306eMySQL v1.0.2\u30d9\u30f3\u30c1\u30de\u30fc\u30af\u306b\u3066\u3001\u5bfe\u8c61MySQL\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u30b5\u30fc\u30d0\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8a2d\u5b9a\u3092\u76e3\u67fb\u3057\u307e\u3059\u3002(\u9069\u5207\u306a\u76e3\u67fb\u30d5\u30a1\u30a4\u30eb\u3092\u4f5c\u6210\u3059\u308b\u3053\u3068\u306b\u3088\u308a\u3001MySQL\u30b5\u30fc\u30d0\u306e\u4ed6\u306e\u76e3\u67fb\u306b\u4f7f\u7528\u3059\u308b\u3053\u3068\u3082\u3067\u304d\u307e\u3059\u3002)<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script mysql-audit \\
\n–script-args \\
\n“mysql-audit.username=’root’, \\
\nmysql-audit.password=’root’, \\
\nmysqlaudit.filename=\\
\n‘\/usr\/share\/nmap\/nselib\/data\/mysql-\\
\ncis.audit'” 192.168.110.1 -p 3306<\/td>\n<\/tr>\n
mysql-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

MySQL\u306b\u5bfe\u3057\u3066\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script mysql-brute -d \\
\n192.168.110.1 -p 3306<\/p>\n

\u203b\u30e6\u30fc\u30b6\u540d\u30fb\u30d1\u30b9\u30ef\u30fc\u30c9\u30ea\u30b9\u30c8\u306e\u6307\u5b9a\u3082\u53ef\u80fd\u3067\u3059\u3002<\/td>\n<\/tr>\n

mysql-databases<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

MySQL\u30b5\u30fc\u30d0\u4e0a\u306e\u3059\u3079\u3066\u306e\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u3092\u4e00\u89a7\u8868\u793a\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV –script mysql-databases \\
\n–script-args “mysqluser=’root’, \\
\nmysqlpass=’msfadmin'” \\
\n192.168.110.1 -p3306<\/td>\n<\/tr>\n
mysql-dump-hashes<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, discovery, safe<\/td>\n

MySQL\u30b5\u30fc\u30d0\u304b\u3089\u30d1\u30b9\u30ef\u30fc\u30c9\u30cf\u30c3\u30b7\u30e5\u3092John-the-ripper\u306a\u3069\u306e\u30c4\u30fc\u30eb\u3067\u30af\u30e9\u30c3\u30af\u53ef\u80fd\u306a\u5f62\u5f0f\u3067\u30c0\u30f3\u30d7\u3057\u307e\u3059\u3002
\n(\u5b9f\u884c\u306b\u306f\u9069\u5207\u306aDB\u306e\u7279\u6a29(root)\u304c\u5fc5\u8981\u3067\u3059\u3002)<\/td>\n		\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script mysql-dump-hashes \\
\n–script-args=’username=root, \\
\npassword=msfadmin’ \\
\n192.168.110.1 -p 3306<\/td>\n<\/tr>\n
mysql-empty-password<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, intrusive<\/td>\n

MySQL\u30b5\u30fc\u30d0\u306eroot\u307e\u305f\u306f\u533f\u540d\u30e6\u30fc\u30b6\u306b\u5bfe\u3057\u3001\u7a7a\u30d1\u30b9\u30ef\u30fc\u30c9\u304c\u4f7f\u7528\u53ef\u80fd\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV –script \\
\nmysql-empty-password \\
\n192.168.110.1 -p 3306<\/td>\n<\/tr>\n
mysql-enum<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

MySQL\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3066\u3001Kingcope<\/a>\u306b\u3088\u3063\u3066\u767a\u898b\u3001\u516c\u958b\u3055\u308c\u305f\u30d0\u30b0\u3092\u4f7f\u7528\u3057\u3066\u3001\u6709\u52b9\u306a\u30e6\u30fc\u30b6\u60c5\u5831\u306e\u53d6\u5f97\u3092\u8a66\u307f\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script mysql-enum \\
\n192.168.110.1 -p 3306<\/td>\n<\/tr>\n
mysql-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

MySQL\u30b5\u30fc\u30d0\u306b\u63a5\u7d9a\u3057\u3001\u30d7\u30ed\u30c8\u30b3\u30eb\u3001\u30d0\u30fc\u30b8\u30e7\u30f3\u3001\u30b9\u30ec\u30c3\u30c9ID\u3001\u30b9\u30c6\u30fc\u30bf\u30b9\u3001\u6a5f\u80fd\u3001\u304a\u3088\u3073\u30d1\u30b9\u30ef\u30fc\u30c9\u30bd\u30eb\u30c8\u306a\u3069\u306e\u60c5\u5831\u3092\u51fa\u529b\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV -sC 192.168.110.1 -p3306<\/td>\n<\/tr>\n
mysql-query<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, discovery, safe<\/td>\n

MySQL\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u306b\u5bfe\u3057\u3066\u30af\u30a8\u30ea\u3092\u5b9f\u884c\u3057\u3001\u7d50\u679c\u3092\u30c6\u30fc\u30d6\u30eb\u3067\u8fd4\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script mysql-query \\
\n–script-args \\
\n‘query=”SELECT host,\\
\nuser FROM mysql.user”, \\
\nusername=”root”, password=”msfadmin”‘ \\
\n192.168.110.1 -p 3306<\/td>\n<\/tr>\n
mysql-users<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, intrusive<\/td>\n

MySQL\u30b5\u30fc\u30d0\u4e0a\u306e\u3059\u3079\u3066\u306e\u30e6\u30fc\u30b6\u3092\u4e00\u89a7\u8868\u793a\u3057\u307e\u3059\u3002(\u5b9f\u884c\u306b\u306f\u9069\u5207\u306aDB\u306e\u7279\u6a29(root)\u304c\u5fc5\u8981\u3067\u3059\u3002)<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV –script mysql-users \\
\n–script-args “mysqluser=’root’, \\
\nmysqlpass=’msfadmin'” \\
\n192.168.110.1 -p3306<\/td>\n<\/tr>\n
mysql-variables<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

MySQL\u30b5\u30fc\u30d0\u4e0a\u306e\u3059\u3079\u3066\u306e\u5909\u6570\u3092\u8868\u793a\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV –script mysql-variables \\
\n–script-args “mysqluser=’anonymous’, \\
\nmysqlpass=’pass'” \\
\n192.168.110.1 -p 3306<\/td>\n<\/tr>\n
mysql-vuln-cve2012-2122<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive, vuln<\/td>\n

MySQL\u3068MariaDB\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3001CVE2012-2122\u306e\u8106\u5f31\u6027\u3092\u3064\u304f\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u5b9f\u884c\u3057\u3001\u8a8d\u8a3c\u306e\u30d0\u30a4\u30d1\u30b9\u3092\u8a66\u307f\u307e\u3059\u3002\u540c\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001MySQL\u306e\u30e6\u30fc\u30b6\u540d\u3068\u30d1\u30b9\u30ef\u30fc\u30c9\u30cf\u30c3\u30b7\u30e5\u3092\u30c0\u30f3\u30d7\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script mysql-vuln-cve2012-2122 \\
\n–script-args \\
\n“mysql-vuln-cve2012-2122.pass=\\
\n‘msfadmin'” 192.168.110.1 -p 3306<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

nat-pmp-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

NAT\u30dd\u30fc\u30c8\u30de\u30c3\u30d4\u30f3\u30b0\u30d7\u30ed\u30c8\u30b3\u30eb(NAT-PMP)\u3092\u4f7f\u7528\u3057\u3066\u30eb\u30fc\u30bf\u306eWANIP\u30a2\u30c9\u30ec\u30b9\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002NAT-PMP\u30d7\u30ed\u30c8\u30b3\u30eb\u306f\u3001\u4ee5\u4e0b\u30eb\u30fc\u30bf\u3067\u30b5\u30dd\u30fc\u30c8\u3055\u308c\u3066\u3044\u307e\u3059\uff1a
\n\u30fbApple AirPort Express
\n\u30fbApple AirPort Extreme
\n\u30fbApple Time Capsule
\n\u30fbDD-WRT
\n\u30fbOpenWrt v8.09 or higher, with MiniUPnP daemon
\n\u30fbpfSense v2.0
\n\u30fbTarifa (firmware) (Linksys WRT54G\/GL\/GS)
\n\u30fbTomato Firmware v1.24 or higher. (Linksys WRT54G\/GL\/GS and many more)
\n\u30fbPeplink Balance<\/td>\n		\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script=nat-pmp-info \\
\n192.168.110.2 -p 5351<\/td>\n<\/tr>\n
nat-pmp-mapport<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

NAT\u30dd\u30fc\u30c8\u30de\u30c3\u30d4\u30f3\u30b0\u30d7\u30ed\u30c8\u30b3\u30eb\uff08NAT-PMP\uff09\u3092\u4f7f\u7528\u3057\u3066\u3001\u30eb\u30fc\u30bf\u306eWAN\u30dd\u30fc\u30c8\u3092\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u4e0a\u306e\u30ed\u30fc\u30ab\u30eb\u30dd\u30fc\u30c8\u306b\u30de\u30c3\u30d4\u30f3\u30b0\u3057\u307e\u3059\u3002
\n\u306a\u304a\u3001\u540c\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u4ee5\u4e0b\u306e\u64cd\u4f5c\u304c\u53ef\u80fd\u3067\u3059\u3002
\n\u30fbmap: \u30eb\u30fc\u30bf\u4e0a\u306e\u65b0\u3057\u3044\u5916\u90e8\u30dd\u30fc\u30c8\u3092\u6307\u5b9aIP\u306e\u5185\u90e8\u30dd\u30fc\u30c8\u306b\u30de\u30c3\u30d4\u30f3\u30b0\u3059\u308b
\n\u30fbunmap: \u6307\u5b9aIP\u7528\u306b\u4ee5\u524d\u306b\u30de\u30c3\u30d4\u30f3\u30b0\u3057\u305f\u30dd\u30fc\u30c8\u306e\u30de\u30c3\u30d4\u30f3\u30b0\u3092\u89e3\u9664\u3059\u308b
\n\u30fbunmapall: \u6307\u5b9aIP\u7528\u306b\u4ee5\u524d\u306b\u30de\u30c3\u30d4\u30f3\u30b0\u3057\u3059\u3079\u3066\u306e\u30dd\u30fc\u30c8\u3092\u30de\u30c3\u30d4\u30f3\u30b0\u89e3\u9664\u3059\u308b<\/td>\n		\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script nat-pmp-mapport \\
\n–script-args=’op=map,pubport=8080, \\
\nprivport=8080,protocol=tcp’ \\
\n192.168.110.2 -p 5351<\/td>\n<\/tr>\n
nbstat<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

\u5bfe\u8c61\u306eNetBIOS\u540d\u3068MAC\u30a2\u30c9\u30ec\u30b9\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sU –script nbstat.nse \\
\n192.168.110.1 -p137<\/td>\n<\/tr>\n
ncp-enum-users<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, safe<\/td>\n

Novell\u306eNetWare Core\u30d7\u30ed\u30c8\u30b3\u30eb(NCP)\u30b5\u30fc\u30d3\u30b9\u304b\u3089\u3001\u5168eDirectory\u30e6\u30fc\u30b6\u306e\u30ea\u30b9\u30c8\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV –script ncp-enum-users \\
\n192.168.110.1<\/td>\n<\/tr>\n
ncp-serverinfo<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

Novell\u306eNetWare Core\u30d7\u30ed\u30c8\u30b3\u30eb(NCP)\u30b5\u30fc\u30d3\u30b9\u304b\u3089\u3001eDirectory\u30b5\u30fc\u30d0\u60c5\u5831(OS\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u3001\u30b5\u30fc\u30d0\u540d\u3001\u30de\u30a6\u30f3\u30c8\u60c5\u5831\u306a\u3069)\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV -sC 192.168.110.1<\/td>\n<\/tr>\n
ndmp-fs-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

NDMP(Network Data Management Protocol)\u3092\u4f7f\u7528\u3057\u3066\u5bfe\u8c61\u306e\u30d5\u30a1\u30a4\u30eb\u30b7\u30b9\u30c6\u30e0\u3092\u4e00\u89a7\u8868\u793a\u3057\u307e\u3059\u3002NDMP\u306f\u3001NAS\u3068\u30d0\u30c3\u30af\u30a2\u30c3\u30d7\u88c5\u7f6e\u3068\u306e\u9593\u3067\u30c7\u30fc\u30bf\u3092\u8ee2\u9001\u3059\u308b\u3053\u3068\u3092\u76ee\u7684\u3068\u3057\u305f\u30d7\u30ed\u30c8\u30b3\u30eb\u3067\u3001\u30c7\u30fc\u30bf\u306f\u30d0\u30c3\u30af\u30a2\u30c3\u30d7\u30b5\u30fc\u30d0\u3092\u901a\u904e\u3057\u307e\u305b\u3093\u3002
\n\u4ee5\u4e0b\u306e\u88fd\u54c1\u3067NDMP\u3092\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u3044\u307e\u3059\u3002
\n\u30fbAmanda
\n\u30fbBacula
\n\u30fbCA Arcserve
\n\u30fbCommVault Simpana
\n\u30fbEMC Networker
\n\u30fbHitachi Data Systems
\n\u30fbIBM Tivoli
\n\u30fbQuest Software Netvault Backup
\n\u30fbSymantec Netbackup
\n\u30fbSymantec Backup Exec<\/td>\n		\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script ndmp-fs-info \\
\n192.168.110.1 -p 10000<\/td>\n<\/tr>\n
ndmp-version<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nversion<\/td>\n

NDMP(Network Data Management Protocol)\u30b5\u30fc\u30d3\u30b9\u304b\u3089\u30d0\u30fc\u30b8\u30e7\u30f3\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002NDMP\u306f\u3001NAS\u3068\u30d0\u30c3\u30af\u30a2\u30c3\u30d7\u88c5\u7f6e\u3068\u306e\u9593\u3067\u30c7\u30fc\u30bf\u3092\u8ee2\u9001\u3059\u308b\u3053\u3068\u3092\u76ee\u7684\u3068\u3057\u305f\u30d7\u30ed\u30c8\u30b3\u30eb\u3067\u3001\u30c7\u30fc\u30bf\u306f\u30d0\u30c3\u30af\u30a2\u30c3\u30d7\u30b5\u30fc\u30d0\u3092\u901a\u904e\u3057\u307e\u305b\u3093\u3002
\n\u4ee5\u4e0b\u306e\u88fd\u54c1\u3067NDMP\u3092\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u3044\u307e\u3059\u3002
\n\u30fbAmanda
\n\u30fbBacula
\n\u30fbCA Arcserve
\n\u30fbCommVault Simpana
\n\u30fbEMC Networker
\n\u30fbHitachi Data Systems
\n\u30fbIBM Tivoli
\n\u30fbQuest Software Netvault Backup
\n\u30fbSymantec Netbackup
\n\u30fbSymantec Backup Exec<\/td>\n		\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV 192.168.110.1<\/td>\n<\/tr>\n
nessus-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

NTP 1.2\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u4f7f\u7528\u3057\u3066\u3001Nessus\u306e\u30b9\u30ad\u30e3\u30f3\u30c7\u30fc\u30e2\u30f3\u306b\u5b58\u5728\u3059\u308b\u8106\u5f31\u6027\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script nessus-brute \\
\n192.168.110.1 -p 1241<\/td>\n<\/tr>\n
nessus-xmlrpc-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

XMLRPC\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u4f7f\u7528\u3057\u3066\u3001Nessus\u306e\u30b9\u30ad\u30e3\u30f3\u30c7\u30fc\u30e2\u30f3\u306b\u5b58\u5728\u3059\u308b\u8106\u5f31\u6027\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV –script \\
\nnessus-xmlrpc-brute \\
\n192.168.110.1<\/td>\n<\/tr>\n
netbus-auth-bypass<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, safe, vuln<\/td>\n

NetBus\u30b5\u30fc\u30d0\u306b\u3001\u30d1\u30b9\u30ef\u30fc\u30c9\u306a\u3057\u3067\u30d5\u30eb\u30a2\u30af\u30bb\u30b9\u3092\u8a31\u53ef\u3059\u308b\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9\u306e\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script netbus-auth-bypass \\
\n192.168.110.1 -p 12345<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

netbus-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

Netbus\u30d0\u30c3\u30af\u30c9\u30a2(\u30ea\u30e2\u30fc\u30c8\u7ba1\u7406)\u30b5\u30fc\u30d3\u30b9\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script netbus-brute \\
\n192.168.110.1 -p 12345<\/td>\n<\/tr>\n
netbus-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

NetBus\u30b5\u30fc\u30d0\u3078\u306e\u63a5\u7d9a\u3092\u78ba\u7acb\u3057\u3001\u30db\u30b9\u30c8\u3068NetBus\u30b5\u30fc\u30d3\u30b9\u306b\u3064\u3044\u3066\u306e\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script netbus-info \\
\n–script-args \\
\nnetbus-info.password=’root’ \\
\n192.168.110.1 -p 12345<\/td>\n<\/tr>\n
netbus-version<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nversion<\/td>\n

NetBus\u306e\u3088\u3046\u306b\u3075\u308b\u307e\u3046\u30cf\u30cb\u30fc\u30dd\u30c3\u30c8\u3001NetBuster\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u691c\u51fa\u3092\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV –script netbus-version \\
\n192.168.110.1 -p 12345<\/td>\n<\/tr>\n
nexpose-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

API 1.1\u3092\u4f7f\u7528\u3057\u3066\u8106\u5f31\u6027\u30b9\u30ad\u30e3\u30caNexpose\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script nexpose-brute \\
\n192.168.110.1 -p 3780<\/td>\n<\/tr>\n
nfs-ls<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

NFS\u306e\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb”exports”\u304b\u3089\u3001\u30d5\u30a1\u30a4\u30eb\u306b\u95a2\u3059\u308b\u6709\u7528\u306a\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u51fa\u529b\u306f\u3001”ls”\u30b3\u30de\u30f3\u30c9\u306e\u51fa\u529b\u5f62\u5f0f\u3068\u4f3c\u305f\u5f62\u5f0f\u3067\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV –script nfs-ls 192.168.110.1<\/td>\n<\/tr>\n
nfs-showmount<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

NFS\u306e\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb”exports”\u3092”showmount -e”\u30b3\u30de\u30f3\u30c9\u306e\u51fa\u529b\u5f62\u5f0f\u3068\u4f3c\u305f\u5f62\u5f0f\u3067\u8868\u793a\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV –script nfs-showmount \\
\n192.168.110.1<\/td>\n<\/tr>\n
nfs-statfs<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

\u30c7\u30a3\u30b9\u30af\u30b9\u30da\u30fc\u30b9\u306e\u7d71\u8a08\u3068\u60c5\u5831\u3092NFS\u5171\u6709\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u51fa\u529b\u306f\u3001”df”\u30b3\u30de\u30f3\u30c9\u306e\u51fa\u529b\u5f62\u5f0f\u3068\u4f3c\u305f\u5f62\u5f0f\u3067\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script=nfs-statfs \\
\n192.168.110.1 -p 111<\/td>\n<\/tr>\n
nje-node-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

z\/OS JES Network Job Entry (NJE) \u306e\u30ce\u30fc\u30c9\u540d\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV –script nje-node-brute \\
\n192.168.110.1<\/td>\n<\/tr>\n
nntp-ntlm-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

NTLM\u8a8d\u8a3c\u304c\u6709\u52b9\u306b\u306a\u3063\u3066\u3044\u308bNNTP\u30b5\u30fc\u30d3\u30b9(News\u30b5\u30fc\u30d3\u30b9)\u304b\u3089\u306e\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script nntp-ntlm-info \\
\n192.168.110.1 -p 119,433,563<\/td>\n<\/tr>\n
nping-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

Nping\u30a8\u30b3\u30fc\u30b5\u30fc\u30d3\u30b9\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script nping-brute \\
\n192.168.110.1 -p 9929<\/td>\n<\/tr>\n
nrpe-enum<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

Nagios Remote Plugin Executor(NRPE)\u30c7\u30fc\u30e2\u30f3\u306b\u554f\u3044\u5408\u308f\u305b\u3092\u884c\u3044\u3001\u5e73\u5747\u8ca0\u8377\u3001\u30d7\u30ed\u30bb\u30b9\u6570\u3001\u30ed\u30b0\u30a4\u30f3\u3057\u3066\u3044\u308b\u30e6\u30fc\u30b6\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script nrpe-enum \\
\n192.168.110.1 -p 5666<\/td>\n<\/tr>\n
ntp-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

\u4ee5\u4e0b\u306e\u554f\u3044\u5408\u308f\u305b\u3092\u884c\u3044\u3001NTP\u30b5\u30fc\u30d0\u304b\u3089\u6642\u523b\u3068\u8a2d\u5b9a\u5909\u6570\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002
\n\u30fbtime request
\n\u30fb”read variables” (opcode 2) control message
\n“-v”\u30aa\u30d7\u30b7\u30e7\u30f3\u3092\u6307\u5b9a\u3057\u306a\u3044\u3068\u3001\u6642\u9593\u3001\u30d0\u30fc\u30b8\u30e7\u30f3\u60c5\u5831\u3001\u30d7\u30ed\u30bb\u30c3\u30b5\u3001\u30b7\u30b9\u30c6\u30e0\u3001REFID\u3001\u304a\u3088\u3073\u30b9\u30c8\u30e9\u30bf\u30e0\u5909\u6570\u306e\u5024\u3092\u8868\u793a\u3057\u307e\u3059\u3002”-v”\u30aa\u30d7\u30b7\u30e7\u30f3\u3092\u6307\u5b9a\u3059\u308b\u3068\u3001\u3059\u3079\u3066\u306e\u5909\u6570\u3092\u8868\u793a\u3057\u307e\u3059\u3002<\/td>\n		\u5bfe\u8c61
\nWindows2008R2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sU –script ntp-info \\
\n192.168.110.1 -p 123<\/td>\n<\/tr>\n
ntp-monlist<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

NTP\u30b5\u30fc\u30d0\u306e\u30e2\u30cb\u30bf\u30c7\u30fc\u30bf\u3092\u51fa\u529b\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU -Pn -n –script ntp-monlist \\
\n192.168.110.1 -pU:123<\/td>\n<\/tr>\n
omp2-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

“OMPv2″\u3092\u4f7f\u7528\u3057\u3066”OpenVAS Manager”\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script omp2-brute \\
\n192.168.110.1 -p 9390<\/td>\n<\/tr>\n
omp2-enum-targets<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

“OpenVAS Manager”\u30b5\u30fc\u30d0\u304b\u3089\u5bfe\u8c61\u30b7\u30b9\u30c6\u30e0\u3068\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u306e\u30ea\u30b9\u30c8\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nomp2-brute,omp2-enum-targets \\
\n192.168.110.1 -p 9390<\/td>\n<\/tr>\n
omron-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, version<\/td>\n

\u672c\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001FINS\u30d1\u30b1\u30c3\u30c8\u3092\u5bfe\u8c61\u30c7\u30d0\u30a4\u30b9\u306b\u9001\u4fe1\u3059\u308b\u305f\u3081\u306b\u4f7f\u7528\u3055\u308c\u307e\u3059\u3002\u540c\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u30b3\u30f3\u30c8\u30ed\u30fc\u30e9\u30c7\u30fc\u30bf\u8aad\u307f\u53d6\u308a\u30b3\u30de\u30f3\u30c9\u3092\u9001\u4fe1\u3057\u3001\u5fdc\u7b54\u304c\u53d7\u4fe1\u3055\u308c\u308b\u3068\u3001\u9001\u4fe1\u3055\u308c\u305f\u30b3\u30de\u30f3\u30c9\u306b\u5bfe\u3059\u308b\u9069\u5207\u306a\u5fdc\u7b54\u3067\u3042\u308b\u3053\u3068\u3092\u691c\u8a3c\u3057\u3001\u30c7\u30fc\u30bf\u3092\u89e3\u6790\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script omron-info \\
\n192.168.110.1 -p 9600<\/td>\n<\/tr>\n
openlookup-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe, version<\/td>\n

OpenLookup(network key-value store)\u30b5\u30fc\u30d0\u306e\u30d0\u30ca\u30fc\u60c5\u5831\u3092\u8868\u793a\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script openlookup-info \\
\n192.168.110.1 -p 5850<\/td>\n<\/tr>\n
openvas-otp-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive+C381<\/td>\n

“OTP 1.0″\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u4f7f\u7528\u3057\u3066\u8106\u5f31\u6027\u30b9\u30ad\u30e3\u30ca\u30c7\u30fc\u30e2\u30f3”OpenVAS”\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV –script openvas-otp-brute \\
\n192.168.110.1<\/td>\n<\/tr>\n
oracle-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

Oracle\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script oracle-brute \\
\n–script-args oracle-brute.sid=ORCL \\
\n192.168.110.1 -p 1521<\/td>\n<\/tr>\n
oracle-brute-stealth<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

Oracle\u306eO5LOGIN\u8a8d\u8a3c\u30b9\u30ad\u30fc\u30e0\u306e\u8106\u5f31\u6027\u3001”CVE-2012-3137″\u306b\u5bfe\u3059\u308b\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002\u3053\u306e\u8106\u5f31\u6027\u306fOracle 11g R1 \/ R2\u306b\u5b58\u5728\u3057\u3001\u30bb\u30c3\u30b7\u30e7\u30f3\u30ad\u30fc\u3092\u30d1\u30b9\u30ef\u30fc\u30c9\u30cf\u30c3\u30b7\u30e5\u306b\u30ea\u30f3\u30af\u3059\u308b\u3053\u3068\u3092\u53ef\u80fd\u306b\u3057\u307e\u3059\u3002\u6709\u52b9\u306a\u30e6\u30fc\u30b6\u3067\u8a8d\u8a3c\u3092\u8a66\u307f\u308b\u3068\u3001\u30b5\u30fc\u30d0\u306f\u30bb\u30c3\u30b7\u30e7\u30f3\u30ad\u30fc\u3068\u30bd\u30eb\u30c8\u3067\u5fdc\u7b54\u3057\u307e\u3059\u3002\u5fdc\u7b54\u3092\u53d7\u3051\u53d6\u3063\u305f\u540c\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u30ed\u30b0\u30a4\u30f3\u8a66\u884c\u3092\u8a18\u9332\u3055\u305b\u306a\u3044\u3088\u3046\u3001\u63a5\u7d9a\u3092\u5207\u65ad\u3057\u307e\u3059\u3002\u30bb\u30c3\u30b7\u30e7\u30f3\u30ad\u30fc\u3068\u30bd\u30eb\u30c8\u3092\u4f7f\u7528\u3059\u308b\u3068\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u304c\u53ef\u80fd\u3068\u306a\u308a\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script oracle-brute-stealth \\
\n–script-args \\
\noracle-brute-stealth.sid=ORCL \\
\n192.168.110.1 -p 1521<\/td>\n<\/tr>\n
oracle-enum-users<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, intrusive<\/td>\n

\u30d1\u30c3\u30c1\u304c\u9069\u7528\u3055\u308c\u3066\u3044\u306a\u3044Oracle 11g\u306e\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3066\u6709\u52b9\u306aOracle\u30e6\u30fc\u30b6\u540d\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002(\u3053\u306e\u30d0\u30b0\u306f\u3001\u30aa\u30e9\u30af\u30eb\u306e2009\u5e7410\u6708\u306eCritical Patch\u306e\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3067\u4fee\u6b63\u3055\u308c\u307e\u3057\u305f\u3002)<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script oracle-enum-users \\
\n–script-args \\
\noracle-enum-users.sid=ORCL \\
\n192.168.110.1 -p 1521-1560<\/td>\n<\/tr>\n
oracle-sid-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

Oracle\u306eTNS-listener\u306b\u5bfe\u3057\u3066Oracle\u30a4\u30f3\u30b9\u30bf\u30f3\u30b9\/ SID\u540d\u3092\u63a8\u6e2c\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script oracle-sid-brute \\
\n192.168.110.1 -p 1521-1560<\/td>\n<\/tr>\n
oracle-tns-version<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nsafe, version<\/td>\n

Oracle\u306eTNS-listener\u304b\u3089VSNNUM\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u756a\u53f7\u3092\u30c7\u30b3\u30fc\u30c9\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV 192.168.110.1<\/td>\n<\/tr>\n
ovs-agent-version<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nversion<\/td>\n

HTTP GET\u8981\u6c42\u3068XML-RPC\u306e\u30e1\u30bd\u30c3\u30c9\u547c\u3073\u51fa\u3057\u306b\u5bfe\u3059\u308b\u5fdc\u7b54\u306e\u30d5\u30a3\u30f3\u30ac\u30fc\u30d7\u30ea\u30f3\u30c8\u3088\u308a\u3001Oracle Virtual Server\u306e\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV 192.168.110.1<\/td>\n<\/tr>\n
p2p-conficker<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, safe<\/td>\n

Conficker\u306eP2P\u901a\u4fe1\u306b\u57fa\u3065\u3044\u3066\u3001\u30db\u30b9\u30c8\u304cConficker.C(\u3082\u3057\u304f\u306fC\u4ee5\u4e0a)\u306b\u611f\u67d3\u3057\u3066\u3044\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploit2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script \\
\np2p-conficker,smb-os-discovery \\
\n–script-args checkconficker=1,safe=1 \\
\n-T4 192.168.110.1 -p139,445 -vv<\/td>\n<\/tr>\n
path-mtu<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

\u5bfe\u8c61\u306b\u5bfe\u3057”Path MTU Discovery”\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script path-mtu 192.168.0.14<\/td>\n<\/tr>\n
pcanywhere-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

pcAnywhere\u306e\u30ea\u30e2\u30fc\u30c8\u30a2\u30af\u30bb\u30b9\u30d7\u30ed\u30c8\u30b3\u30eb\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script pcanywhere-brute \\
\n192.168.110.1<\/td>\n<\/tr>\n
pcworx-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery<\/td>\n

\u672c\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001pcworx\u30d7\u30ed\u30c8\u30b3\u30eb\u203b\u3092\u5bfe\u8c61\u306ePLC\u306b\u7167\u4f1a\u3057\u3066\u89e3\u6790\u3057\u307e\u3059\u3002\u540c\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u6700\u521d\u306e\u8981\u6c42\u30d1\u30b1\u30c3\u30c8\u3092\u9001\u4fe1\u3057\u3001\u5fdc\u7b54\u3092\u53d7\u3051\u53d6\u308b\u3068\u3001\u9001\u4fe1\u3055\u308c\u305f\u30b3\u30de\u30f3\u30c9\u306b\u5bfe\u3059\u308b\u9069\u5207\u306a\u5fdc\u7b54\u3067\u3042\u308b\u3053\u3068\u3092\u691c\u8a3c\u3057\u3001\u30c7\u30fc\u30bf\u3092\u89e3\u6790\u3057\u307e\u3059\u3002\u203bpcworx\u306fPhoenix Contact\u306e\u30d7\u30ed\u30c8\u30b3\u30eb\u3068\u30d7\u30ed\u30b0\u30e9\u30e0\u3067\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script pcworx-info -p 1962 \\
\n192.168.110.1<\/p>\n

\u203b\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u306f\u30b9\u30af\u30ea\u30d7\u30c8\u30d5\u30a1\u30a4\u30eb\u304c\u306a\u3044\u305f\u3081\u3001\u516c\u5f0f\u30da\u30fc\u30b8\u304b\u3089\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/td>\n<\/tr>\n

pgsql-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

PostgreSQL\u306e\u306b\u5bfe\u3057\u3066\u30d1\u30b9\u30ef\u30fc\u30c9\u306e\u63a8\u6e2c\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script pgsql-brute \\
\n192.168.110.1 -p 5432<\/td>\n<\/tr>\n
pjl-ready-message<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nintrusive<\/td>\n

PJL(Printer Job Language)\u3092\u30b5\u30dd\u30fc\u30c8\u3059\u308b\u30d7\u30ea\u30f3\u30bf\u3067\u6e96\u5099\u5b8c\u4e86\u30e1\u30c3\u30bb\u30fc\u30b8\u3092\u53d6\u5f97\u307e\u305f\u306f\u8a2d\u5b9a\u3057\u307e\u3059\u3002\u5bfe\u8c61\u306e\u30d7\u30ea\u30f3\u30bf\u306b\u306fTCP9100\u30dd\u30fc\u30c8\u3067\u5f85\u3061\u53d7\u3051\u308b\u3001\u307b\u3068\u3093\u3069\u306ePostScript\u30d7\u30ea\u30f3\u30bf\u304c\u542b\u307e\u308c\u307e\u3059\u3002\u5f15\u6570\u3092\u6307\u5b9a\u3057\u306a\u3044\u5834\u5408\u3001\u73fe\u5728\u306e\u6e96\u5099\u5b8c\u4e86\u30e1\u30c3\u30bb\u30fc\u30b8\u304c\u8868\u793a\u3055\u308c\u307e\u3059\u3002 \u5f15\u6570”pjl_ready_message”\u3092\u6307\u5b9a\u3059\u308b\u3068\u3001\u53e4\u3044\u6e96\u5099\u5b8c\u4e86\u30e1\u30c3\u30bb\u30fc\u30b8\u304c\u8868\u793a\u3055\u308c\u3001\u6307\u5b9a\u3055\u308c\u305f\u30e1\u30c3\u30bb\u30fc\u30b8\u306b\u5909\u66f4\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script pjl-ready-message.nse \\
\n–script-args \\
\npjl_ready_message=\\
\n“your message here”<\/td>\n<\/tr>\n
pop3-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

\u30e6\u30fc\u30b6\u540d\u3068\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u63a8\u6e2c\u3057\u3066\u3001POP3\u30a2\u30ab\u30a6\u30f3\u30c8\u3078\u306e\u30ed\u30b0\u30a4\u30f3\u3092\u8a66\u307f\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7\/Black Jumbo Dog6.1.9
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV –script=pop3-brute \\
\n192.168.110.1 -p 110<\/td>\n<\/tr>\n
pop3-capabilities<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

POP3\u30b5\u30fc\u30d0\u306e\u6a5f\u80fd\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nCentOS7\/Dovecot
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV -sC 192.168.110.1 -p 110<\/td>\n<\/tr>\n
pop3-ntlm-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

NTLM\u8a8d\u8a3c\u304c\u6709\u52b9\u306b\u306a\u3063\u3066\u3044\u308bPOP3\u30b5\u30fc\u30d3\u30b9\u304b\u3089\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script pop3-ntlm-info \\
\n192.168.110.12 -p 110,995<\/td>\n<\/tr>\n
pptp-version<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nversion<\/td>\n

point-to-point tunneling protocol(PPTP)\u30b5\u30fc\u30d3\u30b9\u304b\u3089\u30b7\u30b9\u30c6\u30e0\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV 192.168.110.1<\/td>\n<\/tr>\n
qconn-exec<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, intrusive, vuln<\/td>\n

\u5f85\u6a5f\u4e2d\u306eQNX QCONN\u30c7\u30fc\u30e2\u30f3\u306b\u5bfe\u3057\u3001\u8a8d\u8a3c\u3055\u308c\u3066\u3044\u306a\u3044\u30e6\u30fc\u30b6\u304c\u4efb\u610f\u306e\u30aa\u30da\u30ec\u30fc\u30c6\u30a3\u30f3\u30b0\u30b7\u30b9\u30c6\u30e0\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3067\u304d\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script qconn-exec \\
\n–script-args qconn-exec.timeout=60, \\
\nqconn-exec.bytes=1024, \\
\nqconn-exec.cmd=”uname -a” \\
\n192.168.110.1 -p 8000<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

qscan<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

\u5404\u30dd\u30fc\u30c8\u306e\u4e00\u9023\u306e\u30e9\u30a6\u30f3\u30c9\u30c8\u30ea\u30c3\u30d7\u6642\u9593\u3092\u53d6\u5f97\u3059\u308b\u305f\u3081\u306b\u3001\u30db\u30b9\u30c8\u4e0a\u306e\u30aa\u30fc\u30d7\u30f3\u307e\u305f\u306f\u30af\u30ed\u30fc\u30ba\u30c9\u30dd\u30fc\u30c8\u306b\u5bfe\u3057\u7e70\u308a\u8fd4\u3057\u30d7\u30ed\u30fc\u30d6\u3092\u9001\u4fe1\u3057\u307e\u3059\u3002\u4e0a\u8a18\u30e9\u30a6\u30f3\u30c9\u30c8\u30ea\u30c3\u30d7\u6642\u9593\u306f\u3001\u4ed6\u306e\u30b0\u30eb\u30fc\u30d7\u3068\u7d71\u8a08\u7684\u306b\u7570\u306a\u308b\u30dd\u30fc\u30c8\u306e\u96c6\u5408\u3092\u30b0\u30eb\u30fc\u30d7\u5316\u3059\u308b\u305f\u3081\u306b\u4f7f\u7528\u3055\u308c\u307e\u3059\u3002\u7570\u306a\u308b\u30b0\u30eb\u30fc\u30d7(\u307e\u305f\u306f\u30d5\u30a1\u30df\u30ea)\u306b\u3042\u308b\u30dd\u30fc\u30c8\u306f\u3001NAT\u306e\u30d0\u30c3\u30af\u30a8\u30f3\u30c9\u306b\u3042\u308b\u30de\u30b7\u30f3\u3078\u306e\u30dd\u30fc\u30c8\u8ee2\u9001\u306a\u3069\u306e\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30e1\u30ab\u30cb\u30ba\u30e0\u304c\u539f\u56e0\u3067\u3042\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script qscan \\
\n–script-args qscan.confidence=0.95, \\
\nqscan.delay=200ms, \\
\nqscan.numtrips=10 \\
\n192.168.110.1<\/td>\n<\/tr>\n
quake1-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe, version<\/td>\n

Quake\u304a\u3088\u3073\u305d\u306e\u4ed6Quake\u3068\u540c\u3058\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u30b2\u30fc\u30e0\u30b5\u30fc\u30d0\u304b\u3089\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -n -sU -Pn –script quake1-info \\
\n192.168.110.1 -pU:26000-26004 —<\/td>\n<\/tr>\n
quake3-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe, version<\/td>\n

Quake3\u304a\u3088\u3073\u305d\u306e\u4ed6Quake3\u3068\u540c\u3058\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u30b2\u30fc\u30e0\u30b5\u30fc\u30d0\u304b\u3089\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU -sV -Pn –script \\
\nquake3-info.nse \\
\n192.168.110.1 -p 27960<\/td>\n<\/tr>\n
quake3-master-getservers<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

Quake3\u30b9\u30bf\u30a4\u30eb(Quake3\u3068\u540c\u3058\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u30b2\u30fc\u30e0)\u306e\u30de\u30b9\u30bf\u30fc\u30b5\u30fc\u30d0\u3092\u7167\u4f1a\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script \\
\nquake3-master-getservers \\
\n192.168.110.1 -p 27950<\/td>\n<\/tr>\n
rdp-enum-encryption<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

RDP\u30b5\u30fc\u30d3\u30b9\u306b\u3088\u3063\u3066\u30b5\u30dd\u30fc\u30c8\u3055\u308c\u3066\u3044\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ec\u30a4\u30e4\u304a\u3088\u3073\u6697\u53f7\u5316\u30ec\u30d9\u30eb\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002(\u3059\u3079\u3066\u306e\u65e2\u5b58\u306e\u30d7\u30ed\u30c8\u30b3\u30eb\u304a\u3088\u3073\u6697\u53f7\u5316\u65b9\u5f0f\u306b\u3064\u3044\u3066\u78ba\u8a8d\u3057\u307e\u3059\u3002)\u30c7\u30d0\u30c3\u30b0\u30e2\u30fc\u30c9\u3067\u5b9f\u884c\u3059\u308b\u3068\u3001\u30d7\u30ed\u30c8\u30b3\u30eb\u3084\u6697\u53f7\u5316\u65b9\u5f0f\u306e\u30a8\u30e9\u30fc\u60c5\u5831\u3082\u8868\u793a\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sU –script ntp-info \\
\n192.168.110.1 -p 123<\/td>\n<\/tr>\n
rdp-vuln-ms12-020<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nintrusive, vuln+<\/td>\n

\u5bfe\u8c61\u306bMS12-020(RDP\u306e\u8106\u5f31\u6027)\u304c\u5b58\u5728\u3059\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV –script rdp-vuln-ms12-020 \\
\n192.168.110.1 -p 3389<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

realvnc-auth-bypass<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, default, safe<\/td>\n

VNC\u30b5\u30fc\u30d0\u306bRealVNC\u306e\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9(CVE-2006-2369)\u306e\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV -sC 192.168.110.1 -p 5902<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

redis-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

“Redis key-value store”\u306b\u5bfe\u3057\u3066\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script redis-brute \\
\n192.168.110.1 -p 6379<\/td>\n<\/tr>\n
redis-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

“Redis key-value store”\u304b\u3089\u30d0\u30fc\u30b8\u30e7\u30f3\u756a\u53f7\u3084\u30a2\u30fc\u30ad\u30c6\u30af\u30c1\u30e3\u306a\u3069\u306e\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script redis-info \\
\n192.168.110.1 -p 6379<\/td>\n<\/tr>\n
resolveall<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

\u30db\u30b9\u30c8\u540d\u3092\u89e3\u6c7a\u3057\u3001\u3059\u3079\u3066\u306e\u30a2\u30c9\u30ec\u30b9(Nmap\u306e\u30e2\u30fc\u30c9\u306b\u5fdc\u3058\u3066IPv4\u307e\u305f\u306fIPv6)\u3092Nmap\u306e\u30bf\u30fc\u30b2\u30c3\u30c8\u30ea\u30b9\u30c8\u306b\u8ffd\u52a0\u3057\u307e\u3059\u3002\u306a\u304a\u3001\u30db\u30b9\u30c8\u89e3\u6c7a\u306fNmap\u306e\u901a\u5e38\u306e\u30d7\u30ed\u30bb\u30b9\u3068\u7570\u306a\u308a\u3001\u5404\u30db\u30b9\u30c8\u540d\u306b\u5bfe\u3057\u3066\u8fd4\u3055\u308c\u308b\u6700\u521d\u306e\u30a2\u30c9\u30ec\u30b9\uff08A\u307e\u305f\u306fAAAA\u30ec\u30b3\u30fc\u30c9\uff09\u306e\u307f\u3092\u30b9\u30ad\u30e3\u30f3\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script resolveall \\
\n–script-args newtargets,\\
\nresolveall.hosts=google.com<\/td>\n<\/tr>\n
reverse-index<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nsafe<\/td>\n

\u7279\u5b9a\u306e\u30b5\u30fc\u30d3\u30b9\u3092\u5b9f\u884c\u3057\u3066\u3044\u308b\u30db\u30b9\u30c8\u3092\u793a\u3059\u30b9\u30ad\u30e3\u30f3\u51fa\u529b\u7d50\u679c\u306e\u6700\u5f8c\u306b\u9006\u7d22\u5f15\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002(Nmap\u306e\u901a\u5e38\u306e\u51fa\u529b\u306b\u52a0\u3048\u3066\u3001\u5404\u30db\u30b9\u30c8\u4e0a\u306e\u30b5\u30fc\u30d3\u30b9\u3092\u30ea\u30b9\u30c8\u5316)<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script reverse-index 192.168.110.1<\/td>\n<\/tr>\n
rexec-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

UNIX\u306erexec\u306e(remote exec)\u30b5\u30fc\u30d3\u30b9\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nCentOS7
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script rexec-brute \\
\n192.168.110.1 -p 512<\/td>\n<\/tr>\n
rfc868-time<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe, version<\/td>\n

\u30bf\u30a4\u30e0\u30b5\u30fc\u30d3\u30b9\u304b\u3089\u66dc\u65e5\u3068\u6642\u523b\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nNICT\u30bf\u30a4\u30e0\u30b5\u30fc\u30d0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV \\
\ntime-c.timefreq.bldrdoc.gov -p 37<\/td>\n<\/tr>\n
riak-http-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

HTTP\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u4f7f\u7528\u3057\u3066\u3001”Basho Riak distributed database”\u304b\u3089\u30ce\u30fc\u30c9\u540d\u3084\u30a2\u30fc\u30ad\u30c6\u30af\u30c1\u30e3\u306a\u3069\u306e\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script riak-http-info \\
\n192.168.110.1 -p 8098<\/td>\n<\/tr>\n
rlogin-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

UNIX\u306erlogin(\u30ea\u30e2\u30fc\u30c8\u30ed\u30b0\u30a4\u30f3)\u30b5\u30fc\u30d3\u30b9\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002\u3053\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u306fUNIX\u4e0a\u3067\u7279\u6a29\u30e2\u30fc\u30c9\u3067\u5b9f\u884c\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002(\u5c0f\u3055\u3044\u756a\u53f7\u306e\u9001\u4fe1\u5143\u30dd\u30fc\u30c8\u3092\u4f7f\u7528\u3059\u308b\u305f\u3081\u3002)<\/td>\n\u5bfe\u8c61
\nCentOS7
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script rlogin-brute \\
\n192.168.110.1 -p 513<\/td>\n<\/tr>\n
rmi-dumpregistry<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

RMI\u30ec\u30b8\u30b9\u30c8\u30ea\u306b\u63a5\u7d9a\u3057\u3001\u3059\u3079\u3066\u306e\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u30c0\u30f3\u30d7\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script rmi-dumpregistry.nse \\
\n192.168.110.1 -p 1098<\/td>\n<\/tr>\n
rmi-vuln-classloader<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nintrusive, vuln<\/td>\n

“Java rmiregistry”\u304c\u30af\u30e9\u30b9\u306e\u30ed\u30fc\u30c9\u3092\u8a31\u53ef\u3059\u308b\u304b\u3069\u3046\u304b\u3092\u30c6\u30b9\u30c8\u3057\u307e\u3059\u3002 “rmiregistry”\u306e\u30c7\u30d5\u30a9\u30eb\u30c8\u8a2d\u5b9a\u3067\u306f\u3001\u30ea\u30e2\u30fc\u30c8URL\u304b\u3089\u306e\u30af\u30e9\u30b9\u306e\u30ed\u30fc\u30c9\u304c\u53ef\u80fd\u3067\u3059\u3002\u30af\u30e9\u30b9\u306e\u30ed\u30fc\u30c9\u304c\u53ef\u80fd\u306a\u5834\u5408\u3001\u30ea\u30e2\u30fc\u30c8\u3067\u30b3\u30fc\u30c9\u304c\u5b9f\u884c\u3055\u308c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\u30d9\u30f3\u30c0\u30fc\uff08Oracle \/ Sun\uff09\u306f\u3053\u308c\u3092\u8a2d\u8a08\u6a5f\u80fd\u3068\u3057\u3066\u5206\u985e\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script rmi-vuln-classloader \\
\n192.168.110.1 -p 1099<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

rpcap-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

WinPcap\u306eRemote Capture Daemon(RPCAP)\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script rpcap-brute \\
\n192.168.110.1 -p 2002<\/td>\n<\/tr>\n
rpcap-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

rpcap\u30b5\u30fc\u30d3\u30b9(WinPcap\u7d4c\u7531\u3067\u30ea\u30e2\u30fc\u30c8\u30b9\u30cb\u30c3\u30d5\u30a3\u30f3\u30b0\u6a5f\u80fd\u3092\u63d0\u4f9b\u3059\u308b\u30b5\u30fc\u30d3\u30b9)\u306b\u63a5\u7d9a\u3057\u3001\u30a4\u30f3\u30bf\u30fc\u30d5\u30a7\u30fc\u30b9\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u540c\u30b5\u30fc\u30d3\u30b9\u306f\u3001\u8a8d\u8a3c\u3092\u6709\u52b9\u306b\u3059\u308b\u3053\u3068\u3082\u3001IP\u3067\u5236\u9650\u3092\u304b\u3051\u308b\u3053\u3068\u3082\u53ef\u80fd\u3067\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script rpcap-info \\
\n192.168.110.1 -p 2002<\/td>\n<\/tr>\n
rpc-grind<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nversion<\/td>\n

\u5bfe\u8c61\u306eRPC\u30dd\u30fc\u30c8\u304b\u3089\u3001\u30b5\u30fc\u30d3\u30b9\u3001RPC\u756a\u53f7\u3068\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script rpc-grind 192.168.110.1<\/td>\n<\/tr>\n
rpcinfo<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe, version<\/td>\n

\u30dd\u30fc\u30c8\u30de\u30c3\u30d1\u30fc\u306b\u63a5\u7d9a\u3057\u3001\u767b\u9332\u3055\u308c\u305f\u3059\u3079\u3066\u306e\u30d7\u30ed\u30b0\u30e9\u30e0\u306e\u30ea\u30b9\u30c8\u3092\u53d6\u5f97\u3002\u5404\u30d7\u30ed\u30b0\u30e9\u30e0\u306b\u3064\u3044\u3066\u3001RPC\u30d7\u30ed\u30b0\u30e9\u30e0\u756a\u53f7\u3001\u30b5\u30dd\u30fc\u30c8\u3055\u308c\u3066\u3044\u308b\u30d0\u30fc\u30b8\u30e7\u30f3\u756a\u53f7\u3001\u30dd\u30fc\u30c8\u756a\u53f7\u3001\u30d7\u30ed\u30c8\u30b3\u30eb\u3001\u304a\u3088\u3073\u30d7\u30ed\u30b0\u30e9\u30e0\u540d\u3092\u542b\u3080\u30c6\u30fc\u30d6\u30eb\u3092\u51fa\u529b\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nCentOS7
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV -sC 192.168.110.1 -p 111<\/td>\n<\/tr>\n
rsync-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

rsync\u306e\u30ea\u30e2\u30fc\u30c8\u30d5\u30a1\u30a4\u30eb\u540c\u671f\u30d7\u30ed\u30c8\u30b3\u30eb\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script rsync-brute \\
\n–script-args \\
\nrsync-brute.module=www \\
\n192.168.110.1 -p 873<\/td>\n<\/tr>\n
rsync-list-modules<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

rsync(remote file sync)\u540c\u671f\u306e\u5229\u7528\u53ef\u80fd\u306a\u30e2\u30b8\u30e5\u30fc\u30eb\u3092\u8868\u793a\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script rsync-list-modules \\
\n192.168.110.1 -p 873<\/td>\n<\/tr>\n
rtsp-methods<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, safe<\/td>\n

RTSP(real time streaming protocol)\u30b5\u30fc\u30d0\u306b\u3066\u30b5\u30dd\u30fc\u30c8\u3055\u308c\u3066\u3044\u308b\u30e1\u30bd\u30c3\u30c9\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script rtsp-methods \\
\n192.168.110.1 -p 554<\/td>\n<\/tr>\n
rtsp-url-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

IP\u76e3\u8996\u30ab\u30e1\u30e9\u306a\u3069\u306e\u30c7\u30d0\u30a4\u30b9\u306b\u5171\u901a\u306e\u30d1\u30b9\u3092\u30c6\u30b9\u30c8\u3059\u308b\u3053\u3068\u306b\u3088\u308a\u3001RTSP\u30e1\u30c7\u30a3\u30a2\u306eURL\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script rtsp-url-brute \\
\n192.168.110.1 -p 554<\/td>\n<\/tr>\n
rusers<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

“rusersd RPC”\u30b5\u30fc\u30d3\u30b9\u306b\u63a5\u7d9a\u3057\u3001\u30ed\u30b0\u30a4\u30f3\u3057\u3066\u3044\u308b\u30e6\u30fc\u30b6\u306e\u4e00\u89a7\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV –script rusers 192.168.110.1<\/td>\n<\/tr>\n
s7-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, version<\/td>\n

Siemens S7 PLC\u30c7\u30d0\u30a4\u30b9\u306b\u3064\u3044\u3066\u3001\u30c7\u30d0\u30a4\u30b9\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u540c\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001Positive Research\u3068Scadastrangelove<\/a>\u306b\u3088\u3063\u3066\u958b\u767a\u3055\u308c\u305fPLCScan\u306b\u57fa\u3065\u3044\u3066\u3044\u307e\u3059\u3002\u307e\u305f\u3001\u540c\u30b9\u30af\u30ea\u30d7\u30c8\u306fNmap\u306ePLCScan\u3068\u540c\u3058\u6a5f\u80fd\u3092\u63d0\u4f9b\u3059\u308b\u305f\u3081\u306e\u3082\u306e\u3067\u3059\u3002 PLCScan\u306b\u3088\u3063\u3066\u53ce\u96c6\u3055\u308c\u308b\u60c5\u5831(\u53d7\u4fe1\u30d1\u30b1\u30c3\u30c8\u304b\u3089\u89e3\u6790)\u306e\u4e00\u90e8\u306f\u79fb\u690d\u3055\u308c\u307e\u305b\u3093\u3067\u3057\u305f\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script s7-info.nse \\
\n192.168.110.1 -p 102<\/td>\n<\/tr>\n
samba-vuln-cve-2012-1182<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nintrusive, vuln<\/td>\n

\u5bfe\u8c61\u306eSamba\u306b\u30d2\u30fc\u30d7\u30aa\u30fc\u30d0\u30fc\u30d5\u30ed\u30fc\u306e\u8106\u5f31\u6027(CVE-2012-1182)\u304c\u5b58\u5728\u3059\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nsamba-vuln-cve-2012-1182 \\
\n192.168.110.1 -p 139<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

servicetags<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

“Sun Service Tags service agent”(UDP:6481)\u304b\u3089\u30b7\u30b9\u30c6\u30e0\u60c5\u5831(OS\u3001\u30cf\u30fc\u30c9\u30a6\u30a7\u30a2\u3001\u306a\u3069)\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script servicetags \\
\n192.168.110.1 -p 6481<\/td>\n<\/tr>\n
shodan-api<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, external, safe<\/td>\n

\u5bfe\u8c61\u306e”Shodan API”\u3092\u7167\u4f1a\u3057\u3001Nmap\u306e”-sV”\u30aa\u30d7\u30b7\u30e7\u30f3\u3067\u306e\u30b9\u30ad\u30e3\u30f3\u3068\u540c\u69d8\u306e\u51fa\u529b\u3092\u884c\u3044\u307e\u3059\u3002 “Shodan API”\u306e\u30ad\u30fc\u306f\u3001\u5f15\u6570”apikey”\u3067\u8a2d\u5b9a\u3059\u308b\u3053\u3068\u3082\u3001.nse\u30d5\u30a1\u30a4\u30eb\u81ea\u4f53\u306b\u30cf\u30fc\u30c9\u30b3\u30fc\u30c9\u3059\u308b\u3053\u3068\u3082\u3067\u304d\u307e\u3059\u3002 https:\/\/developer.shodan.io\u304b\u3089\u7121\u6599\u306eAPI\u30ad\u30fc\u3092\u5165\u624b\u3067\u304d\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script shodan-api \\
\n–script-args \\
\n‘shodan-api.target=x.y.z.a, \\
\nshodan-api.apikey=<SHODANAPIKEY>’<\/td>\n<\/tr>\n
sip-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

Session Initiation Protocol(SIP)\u30a2\u30ab\u30a6\u30f3\u30c8\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002(SIP\u306fVoIP\u306e\u30bb\u30c3\u30b7\u30e7\u30f3\u306b\u95a2\u9023\u4ed8\u3051\u3089\u308c\u3066\u3044\u307e\u3059\u3002)<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script sip-brute \\
\n192.168.110.1 -p 5060<\/td>\n<\/tr>\n
sip-call-spoof<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

SIP\u30d5\u30a9\u30f3\u306b\u507d\u88c5\u30b3\u30fc\u30eb\u3092\u884c\u3044\u3001\u5bfe\u8c61\u306e\u30a2\u30af\u30b7\u30e7\u30f3(\u30d3\u30b8\u30fc\u3001\u62d2\u5426\u3001\u30cf\u30f3\u30b0\u30a2\u30c3\u30d7\u306a\u3069)\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script sip-call-spoof \\
\n192.168.110.1 -p 5060<\/td>\n<\/tr>\n
sip-enum-users<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, intrusive<\/td>\n

SIP\u30b5\u30fc\u30d0\u306e\u6709\u52b9\u306a\u62e1\u5f35\u6a5f\u80fd(\u30e6\u30fc\u30b6)\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script=sip-enum-users \\
\n192.168.110.1 -p 5060<\/td>\n<\/tr>\n
sip-methods<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

SIP\u30b5\u30fc\u30d0\u3067\u8a31\u53ef\u3055\u308c\u3066\u3044\u308b\u30e1\u30bd\u30c3\u30c9(SUBSCRIBE\u3001OPTIONS\u3001INVITE\u306a\u3069)\u3092\u53d6\u5f97\u3057\u307e\u3059<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script=sip-methods \\
\n192.168.110.1 -p 5060<\/td>\n<\/tr>\n
skypev2-version<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nversion<\/td>\n

Skype\u306e\u30d0\u30fc\u30b8\u30e7\u30f32\u30b5\u30fc\u30d3\u30b9\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV 192.168.110.1<\/td>\n<\/tr>\n
smb-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

SMB\u3092\u7d4c\u7531\u3057\u3066\u30e6\u30fc\u30b6\u540d\u3068\u30d1\u30b9\u30ef\u30fc\u30c9\u306e\u7d44\u307f\u5408\u308f\u305b\u3092\u63a8\u6e2c\u3057\u3001\u4ed6\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u3067\u3082\u4f7f\u7528\u3067\u304d\u308b\u3088\u3046\u3001\u691c\u51fa\u3057\u305f\u7d44\u307f\u5408\u308f\u305b\u3092\u4fdd\u5b58\u3057\u307e\u3059\u3002\u6709\u52b9\u306a\u30e6\u30fc\u30b6\u30ea\u30b9\u30c8\u3092\u53d6\u5f97\u3057\u3001\u5b9f\u969b\u306b\u4f7f\u7528\u3059\u308b\u524d\u306b\u5404\u30e6\u30fc\u30b6\u540d\u3092\u78ba\u8a8d\u3057\u3088\u3046\u3068\u8a66\u307f\u307e\u3059\u3002\u30e6\u30fc\u30b6\u540d\u304c\u691c\u51fa\u3055\u308c\u308b\u3068\u3001\u7d50\u679c\u3068\u3057\u3066\u51fa\u529b\u3055\u308c\u308b\u3060\u3051\u3067\u306a\u304f\u3001Nmap\u30ec\u30b8\u30b9\u30c8\u30ea\u306b\u3082\u4fdd\u5b58\u3055\u308c\u3001\u4ed6\u306eNmap\u30b9\u30af\u30ea\u30d7\u30c8\u3067\u3082\u4f7f\u7528\u3067\u304d\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002\u3064\u307e\u308a\u3001smb-brute.nse\u3092\u5b9f\u884c\u3059\u308b\u5834\u5408\u3001\u5b9f\u884c\u3057\u305f\u3044\u4ed6\u306esmb\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u4f75\u305b\u3066\u5b9f\u884c\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002\u540c\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001Vista\u4ee5\u524d\u306eWindows\u3067\u306f\u3001\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u5927\u6587\u5b57\u5c0f\u6587\u5b57\u533a\u5225\u3057\u306a\u3044\u65b9\u6cd5\u3067\u30c1\u30a7\u30c3\u30af\u3057\u3001\u30d1\u30b9\u30ef\u30fc\u30c9\u304c\u898b\u3064\u304b\u3063\u305f\u5f8c\u306b\u5927\u6587\u5b57\u5c0f\u6587\u5b57\u3092\u5224\u5225\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script smb-brute.nse \\
\n192.168.110.1 -p 445<\/td>\n<\/tr>\n
smb-enum-domains<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

\u30dd\u30ea\u30b7\u30fc\u3092\u4f7f\u7528\u3057\u3066\u3001\u30b7\u30b9\u30c6\u30e0\u306e\u30c9\u30e1\u30a4\u30f3\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u4e00\u822c\u7684\u306bWindows 2000\u4ee5\u5916\u306eOS\u3067\u306f\u8cc7\u683c\u60c5\u5831\u304c\u5fc5\u8981\u3068\u306a\u308a\u307e\u3059\u3002\u307e\u305f\u3001\u5b9f\u969b\u306e\u30c9\u30e1\u30a4\u30f3\u306b\u52a0\u3048\u3066\u3001”Builtin”\u30c9\u30e1\u30a4\u30f3\u304c\u8868\u793a\u3055\u308c\u307e\u3059\u3002 Windows\u306f\u3053\u308c\u3092\u30c9\u30e1\u30a4\u30f3\u306e\u30ea\u30b9\u30c8\u306b\u8fd4\u3057\u307e\u3059\u304c\u3001\u305d\u306e\u30dd\u30ea\u30b7\u30fc\u306f\u3069\u3053\u306b\u3082\u4f7f\u7528\u3055\u308c\u3066\u3044\u307e\u305b\u3093\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script smb-enum-domains.nse \\
\n192.168.110.1 -p 445<\/td>\n<\/tr>\n
smb-enum-groups<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

Windows\u30b7\u30b9\u30c6\u30e0\u304b\u3089\u306e\u30b0\u30eb\u30fc\u30d7\u306e\u30ea\u30b9\u30c8\u304a\u3088\u3073\u30b0\u30eb\u30fc\u30d7\u306e\u30e6\u30fc\u30b6\u30ea\u30b9\u30c8\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002(“enum.exe”\u306e”\/g”\u3068\u540c\u69d8\u306e\u52d5\u4f5c\u3092\u3057\u307e\u3059\u3002)<\/td>\n\u5bfe\u8c61
\nWindows7
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script mysql-audit \\
\n–script-args \\
\n“mysql-audit.username=’root’, \\
\nmysql-audit.password=’root’, \\
\nmysql-audit.filename=\\
\n‘\/usr\/share\/nmap\/nselib\/data\/\\
\nmysql-cis.audit'”
\n\\192.168.110.1 -p 3306<\/td>\n<\/tr>\n
smb-enum-processes<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

SMB\u7d4c\u7531\u3067\u5bfe\u8c61\u306e\u30d7\u30ed\u30bb\u30b9\u30ea\u30b9\u30c8(\u3059\u3079\u3066\u306e\u5b9f\u884c\u4e2d\u306e\u30d7\u30ed\u30bb\u30b9\u3001\u305d\u306e\u30d7\u30ed\u30bb\u30b9ID\u3001\u304a\u3088\u3073\u305d\u308c\u3089\u306e\u89aa\u30d7\u30ed\u30bb\u30b9)\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002
\n\u672c\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u30ea\u30e2\u30fc\u30c8\u30ec\u30b8\u30b9\u30c8\u30ea\u30b5\u30fc\u30d3\u30b9\u3092\u7167\u4f1a\u3059\u308b\u3053\u3068\u306b\u3088\u3063\u3066\u884c\u308f\u308c\u307e\u3059\u3002(Vista=\u30c7\u30d5\u30a9\u30eb\u30c8\u7121\u52b9\u3001\u305d\u306e\u4ed6Windows=\u7ba1\u7406\u8005\u6a29\u9650\u304c\u5fc5\u8981\u3002)<\/td>\n		\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nsmb-enum-processes.nse \\
\n–script-args “smbusername=’root’, \\
\nsmbpassword=’root'” \\
\n192.168.110.1 -p 445<\/td>\n<\/tr>\n
smb-enum-sessions<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

\u30ed\u30fc\u30ab\u30eb\u307e\u305f\u306fSMB\u5171\u6709\u3092\u4ecb\u3057\u3066\u30b7\u30b9\u30c6\u30e0\u306b\u30ed\u30b0\u30a4\u30f3\u3057\u3066\u3044\u308b\u30e6\u30fc\u30b6\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u5404\u30e6\u30fc\u30b6\u306e\u5b9a\u7fa9\u306f\u4ee5\u4e0b\u3092\u53c2\u7167\u304f\u3060\u3055\u3044\u3002
\n\u30fb\u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6
\n\u7269\u7406\u7684\u3082\u3057\u304f\u30bf\u30fc\u30df\u30ca\u30eb\u30b5\u30fc\u30d3\u30b9\u30bb\u30c3\u30b7\u30e7\u30f3\u3067\u30de\u30b7\u30f3\u306b\u30ed\u30b0\u30aa\u30f3\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u308b\u30e6\u30fc\u30b6\u3002
\n\u30fbSMB\u5171\u6709\u3092\u4ecb\u3057\u3066\u30b7\u30b9\u30c6\u30e0\u306b\u30ed\u30b0\u30a4\u30f3\u3057\u3066\u3044\u308b\u30e6\u30fc\u30b6
\n\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u3084RPC\u547c\u3073\u51fa\u3057\u3092\u884c\u3046\u3053\u3068\u304c\u3067\u304d\u308b\u30e6\u30fc\u30b6\u3002<\/td>\n		\u5bfe\u8c61
\nWindows7
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script smb-enum-sessions.nse \\
\n–script-args “smbusername=’root’, \\
\nsmbpassword=’root'” \\
\n192.168.110.1 -p 445<\/td>\n<\/tr>\n
smb-enum-shares<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

“srvsvc.NetShareEnumAll MSRPC”\u3092\u4f7f\u7528\u3057\u3066\u5171\u6709\u60c5\u5831\u3092\u53d6\u5f97\u3057\u3001\u307e\u305f\u3001”srvsvc.NetShareGetInfo”\u3092\u4f7f\u7528\u3057\u3066\u3001\u3055\u3089\u306b\u8a73\u7d30\u306a\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u540c\u6a5f\u80fd\u3078\u306e\u30a2\u30af\u30bb\u30b9\u304c\u62d2\u5426\u3055\u308c\u305f\u5834\u5408\u306b\u306f\u3001\u5171\u901a\u306e\u5171\u6709\u540d\u306e\u30ea\u30b9\u30c8\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script smb-enum-shares.nse \\
\n–script-args “smbusername=’root’, \\
\nsmbpassword=’root'” \\
\n192.168.110.1 -p445<\/td>\n<\/tr>\n
smb-enum-users<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, intrusive<\/td>\n

\u5bfe\u8c61\u306eWindows\u30b7\u30b9\u30c6\u30e0\u4e0a\u306e\u30e6\u30fc\u30b6\u60c5\u5831\u30922\u3064\u306e\u7570\u306a\u308b\u30c6\u30af\u30cb\u30c3\u30af\u3092\u4f7f\u7528\u3057\u53d6\u5f97\u3057\u307e\u3059\u3002(\u30dd\u30fc\u30c8445\u307e\u305f\u306f139\u3092\u4f7f\u7528\u3059\u308bover MSRPC\u3092\u4f7f\u7528\u3002\u8a73\u7d30\u306fsmb.lua\u53c2\u7167)\u3053\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u306e\u76ee\u7684\u306f\u3001\u5bfe\u8c61\u306b\u5b58\u5728\u3059\u308b\u3059\u3079\u3066\u306e\u30e6\u30fc\u30b6\u30a2\u30ab\u30a6\u30f3\u30c8\u3092\u767a\u898b\u3059\u308b\u3053\u3068\u3067\u3059\u3002(\u30b5\u30fc\u30d0\u306e\u30a2\u30ab\u30a6\u30f3\u30c8\u7ba1\u7406\u3082\u3057\u304f\u306f\u3001\u4fb5\u5165\u30c6\u30b9\u30c8\u3084\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30d5\u30c3\u30c8\u30d7\u30ea\u30f3\u30c8\u3092\u5b9f\u65bd\u3059\u308b\u969b\u306b\u6709\u7528\u3067\u3059\u3002)<\/td>\n\u5bfe\u8c61
\nWindows7
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script smb-enum-users.nse \\
\n–script-args “smbusername=’root’, \\
\nsmbpassword=’root'” \\
\n192.168.110.1 -p445<\/td>\n<\/tr>\n
smb-flood<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndos, intrusive<\/td>\n

SMB\u30b5\u30fc\u30d0\u3078\u3067\u304d\u308b\u9650\u308a\u591a\u304f\u306e\u63a5\u7d9a\u3092\u884c\u3046\u3053\u3068\u306b\u63a5\u7d9a\u306e\u4e0a\u9650\u6570\u306b\u9054\u3055\u305b\u307e\u3059\u3002\u591a\u304f\u306eSMB\u306e\u5b9f\u88c5\u3067\u306f\u3001\u30e6\u30fc\u30b6\u30a2\u30ab\u30a6\u30f3\u30c8\u306f11\u63a5\u7d9a\u3001\u533f\u540d\u306f10\u63a5\u7d9a\u3068\u30b0\u30ed\u30fc\u30d0\u30eb\u306b\u5236\u9650\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u306a\u304a\u3001\u4e0a\u9650\u306b\u9054\u3059\u308b\u3068\u305d\u308c\u4ee5\u4e0a\u306e\u63a5\u7d9a\u306f\u62d2\u5426\u3055\u308c\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script smb-flood.nse \\
\n–script-args “smbusername=’root’, \\
\nsmbpassword=’root'” \\
\n192.168.110.1 -p445<\/td>\n<\/tr>\n
smb-ls<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

SMB\u30dc\u30ea\u30e5\u30fc\u30e0\u4e0a\u306e\u5171\u6709\u30d5\u30a1\u30a4\u30eb\u306b\u95a2\u3059\u308b\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u51fa\u529b\u306f\u3001UNIX\u306e”ls”\u30b3\u30de\u30f3\u30c9\u306e\u51fa\u529b\u5f62\u5f0f\u3068\u540c\u69d8\u306e\u5f62\u5f0f\u3067\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nsmb-enum-shares,smb-ls \\
\n192.168.110.1 -p 445<\/td>\n<\/tr>\n
smb-mbenum<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

Windows\u306e\u30de\u30b9\u30bf\u30d6\u30e9\u30a6\u30b6\u306b\u3088\u3063\u3066\u7ba1\u7406\u3055\u308c\u3066\u3044\u308b\u60c5\u5831\u3092\u7167\u4f1a\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script smb-mbenum \\
\n192.168.110.1 -p 445<\/td>\n<\/tr>\n
smb-os-discovery<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

SMB\u30d7\u30ed\u30c8\u30b3\u30eb(\u30dd\u30fc\u30c8445\u307e\u305f\u306f139)\u3092\u7d4c\u7531\u3057\u3066\u3001\u30aa\u30da\u30ec\u30fc\u30c6\u30a3\u30f3\u30b0\u30b7\u30b9\u30c6\u30e0\u3001\u30b3\u30f3\u30d4\u30e5\u30fc\u30bf\u540d\u3001\u30c9\u30e1\u30a4\u30f3\u3001\u30ef\u30fc\u30af\u30b0\u30eb\u30fc\u30d7\u3001\u304a\u3088\u3073\u73fe\u5728\u306e\u6642\u523b\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002 (\u533f\u540d\u30a2\u30ab\u30a6\u30f3\u30c8\u3067\u5b9f\u65bd\u3002\u9069\u5207\u306a\u30e6\u30fc\u30b6\u30a2\u30ab\u30a6\u30f3\u30c8\u3092\u4f7f\u7528\u3057\u305f\u5834\u5408\u3067\u3082\u7d50\u679c\u306b\u9055\u3044\u306f\u3042\u308a\u307e\u305b\u3093\u3002)\u306a\u304a\u3001\u53d6\u5f97\u3059\u308b\u60c5\u5831\u306f\u30bb\u30c3\u30b7\u30e7\u30f3\u958b\u59cb\u6642\u306e\u30b5\u30fc\u30d0\u306e\u5fdc\u7b54\u30d1\u30b1\u30c3\u30c8\u5185\u306b\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script smb-os-discovery.nse \\
\n192.168.110.1 -p 445<\/td>\n<\/tr>\n
smb-print-text<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nintrusive<\/td>\n

“Print Spooler”\u30b5\u30fc\u30d3\u30b9\u306eRPC\u95a2\u6570\u3092\u547c\u3073\u51fa\u3059\u3053\u3068\u306b\u3088\u308a\u3001\u5171\u6709\u30d7\u30ea\u30f3\u30bf\u306b\u30c6\u30ad\u30b9\u30c8\u3092\u5370\u5237\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script smb-print-text \\
\n–script-args “text=0wn3d” \\
\n192.168.110.1 -p 445<\/td>\n<\/tr>\n
smb-psexec<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nintrusive<\/td>\n

“Sysinternals”\u306e”psexec”\u30c4\u30fc\u30eb\u3068\u540c\u69d8\u306e\u30ea\u30e2\u30fc\u30c8\u30d7\u30ed\u30bb\u30b9\u5b9f\u884c\u3092\u5b9f\u88c5\u3057\u3001\u30e6\u30fc\u30b6\u304c\u5bfe\u8c61\u30de\u30b7\u30f3\u4e0a\u3067\u4e00\u9023\u306e\u30d7\u30ed\u30b0\u30e9\u30e0\u3092\u5b9f\u884c\u3057\u3066\u51fa\u529b\u3092\u8aad\u307f\u53d6\u308b\u3053\u3068\u3092\u53ef\u80fd\u306b\u3057\u307e\u3059\u3002\u540c\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u30b5\u30fc\u30d0\u306b\u95a2\u3059\u308b\u60c5\u5831\u3092\u53ce\u96c6\u3057\u305f\u308a\u3001\u30b7\u30b9\u30c6\u30e0\u306e\u7bc4\u56f2\u3067\u540c\u3058\u30c4\u30fc\u30eb\u3092\u5b9f\u884c\u3057\u305f\u308a\u3001\u30d0\u30c3\u30af\u30c9\u30a2\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u305f\u308a\u3059\u308b\u306e\u306b\u6709\u7528\u3067\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script smb-psexec.nse \\
\n–script-args smbuser=root, \\
\nsmbpass=root \\
\n192.168.110.1 -p445<\/td>\n<\/tr>\n
smb-security-mode<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

SMB\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ec\u30d9\u30eb\u306b\u95a2\u3059\u308b\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script smb-security-mode.nse \\
\n192.168.110.1 -p 445<\/td>\n<\/tr>\n
smb-server-stats<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

TCP445\u30dd\u30fc\u30c8\u307e\u305f\u306fTCP139\u30dd\u30fc\u30c8\u3092\u4f7f\u7528\u3057\u3066\u3001SMB\u304a\u3088\u3073MSRPC\u306e\u30b5\u30fc\u30d0\u7d71\u8a08\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script smb-server-stats.nse \\
\n192.168.110.1 -p 445<\/td>\n<\/tr>\n
smb-system-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

\u30ec\u30b8\u30b9\u30c8\u30ea\u304b\u3089\u5bfe\u8c61\u306e\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002
\n\u5168\u3066\u306e\u60c5\u5831\u3092\u53d6\u5f97\u3059\u308b\u306b\u306f\u7ba1\u7406\u8005\u30a2\u30ab\u30a6\u30f3\u30c8\u304c\u5fc5\u8981\u306b\u306a\u308a\u307e\u3059\u3002\u307e\u305f\u3001\u30e6\u30fc\u30b6\u30a2\u30ab\u30a6\u30f3\u30c8\u3067\u3082\u304b\u306a\u308a\u306e\u91cf\u306e\u60c5\u5831\u3092\u53d6\u5f97\u3067\u304d\u307e\u3059\u304c\u3001\u30b2\u30b9\u30c8\u30a2\u30ab\u30a6\u30f3\u30c8\u3067\u306f\u4f55\u3082\u53d6\u5f97\u3067\u304d\u307e\u305b\u3093\u3002\u672c\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001Windows 2000\u3092\u542b\u3080\u3059\u3079\u3066\u306e\u30aa\u30da\u30ec\u30fc\u30c6\u30a3\u30f3\u30b0\u30b7\u30b9\u30c6\u30e0\u306b\u5bfe\u3057\u3066\u52d5\u4f5c\u3057\u307e\u3059\u3002<\/td>\n		\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script smb-system-info.nse \\
\n–script-args “smbusername=’root’, \\
\nsmbpassword=’root'” \\
\n192.168.110.1 -p 445<\/td>\n<\/tr>\n
smbv2-enabled<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, safe<\/td>\n

\u30b5\u30fc\u30d0\u304cSMBv2\u306e\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u5b9f\u884c\u3057\u3066\u3044\u308b\u304b\u3069\u3046\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script smbv2-enabled.nse \\
\n192.168.110.1 -p 445<\/td>\n<\/tr>\n
smb-vuln-conficker<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndos, exploit, intrusive, vuln<\/td>\n

Conficker\u30ef\u30fc\u30e0\u306b\u611f\u67d3\u3057\u305fMicrosoft Windows\u30b7\u30b9\u30c6\u30e0\u3092\u691c\u51fa\u3057\u307e\u3059\u3002\u5bfe\u8c61\u3092\u30af\u30e9\u30c3\u30b7\u30e5\u3055\u305b\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u305f\u3081\u3001\u6ce8\u610f\u304c\u5fc5\u8981\u3067\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script smb-vuln-conficker.nse \\
\n192.168.110.1 -p 445<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

smb-vuln-cve2009-3103<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndos, exploit, intrusive, vuln<\/td>\n

Microsoft Windows\u30b7\u30b9\u30c6\u30e0\u306b\u30b5\u30fc\u30d3\u30b9\u62d2\u5426\u306e\u8106\u5f31\u6027(CVE-2009-3103)\u304c\u5b58\u5728\u3059\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u5bfe\u8c61\u3092\u30af\u30e9\u30c3\u30b7\u30e5\u3055\u305b\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u305f\u3081\u3001\u6ce8\u610f\u304c\u5fc5\u8981\u3067\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script \\
\nsmb-vuln-cve2009-3103.nse \\
\n192.168.110.1 -p445<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

smb-vuln-ms06-025<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndos, exploit, intrusive, vuln<\/td>\n

Microsoft Windows\u30b7\u30b9\u30c6\u30e0\u306b”Ras RPC”\u30b5\u30fc\u30d3\u30b9\u306e\u8106\u5f31\u6027(MS06-025)\u304c\u5b58\u5728\u3059\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script smb-vuln-ms06-025.nse \\
\n192.168.110.1 -p 445<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

smb-vuln-ms07-029<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndos, exploit, intrusive, vuln<\/td>\n

Microsoft Windows\u30b7\u30b9\u30c6\u30e0\u306bWindows DNS\u306eRPC\u30a4\u30f3\u30bf\u30fc\u30d5\u30a7\u30a4\u30b9\u306e\u8106\u5f31\u6027(MS07-029)\u304c\u5b58\u5728\u3059\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script smb-vuln-ms07-029.nse \\
\n192.168.110.1 -p 445<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

smb-vuln-ms08-067<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndos, exploit, intrusive, vuln<\/td>\n

Microsoft Windows\u30b7\u30b9\u30c6\u30e0\u306b\u30ea\u30e2\u30fc\u30c8\u3067\u30b3\u30fc\u30c9\u304c\u5b9f\u884c\u3055\u308c\u308b\u8106\u5f31\u6027(MS08-067)\u304c\u5b58\u5728\u3059\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002\u5bfe\u8c61\u3092\u30af\u30e9\u30c3\u30b7\u30e5\u3055\u305b\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u305f\u3081\u3001\u6ce8\u610f\u304c\u5fc5\u8981\u3067\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script smb-vuln-ms08-067.nse \\
\n192.168.110.1 -p 445<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

smb-vuln-ms10-054<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndos, intrusive, vuln<\/td>\n

\u5bfe\u8c61\u306bSMB\u30ea\u30e2\u30fc\u30c8\u30e1\u30e2\u30ea\u7834\u640d\u306e\u8106\u5f31\u6027(MS10-054)\u304c\u5b58\u5728\u3059\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script smb-vuln-ms10-054 \\
\n–script-args unsafe 192.168.110.1 -p 445<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

smb-vuln-ms10-061<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nintrusive, vuln<\/td>\n

\u5bfe\u8c61\u306b\u30d7\u30ea\u30f3\u30bf\u30b9\u30d7\u30fc\u30e9\u507d\u88c5\u306e\u8106\u5f31\u6027(MS10-061)\u304c\u5b58\u5728\u3059\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script=smb-vuln-ms10-061 \\
\n192.168.110.1 -p 445<\/td>\n<\/tr>\n
url-snarf<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nsafe<\/td>\n

Microsoft Windows 2000\u30b7\u30b9\u30c6\u30e0\u306bNULL\u30dd\u30a4\u30f3\u30bf\u53c2\u7167\u306b\u3088\u3063\u3066\u5f15\u304d\u8d77\u3053\u3055\u308c\u308b\u3001”regsvc”\u30af\u30e9\u30c3\u30b7\u30e5\u306e\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002\u672c\u30b9\u30af\u30ea\u30d7\u30c8\u4f7f\u7528\u306b\u306f\u30b2\u30b9\u30c8\u30a2\u30ab\u30a6\u30f3\u30c8\u4ee5\u4e0a\u306e\u6a29\u9650\u304c\u5fc5\u8981\u3067\u3059\u3002\u307e\u305f\u3001\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u5bfe\u8c61\u30b5\u30fc\u30d3\u30b9\u3092\u30af\u30e9\u30c3\u30b7\u30e5\u3055\u305b\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u305f\u3081\u3001\u6ce8\u610f\u304c\u5fc5\u8981\u3067\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script \\
\nsmb-vuln-regsvc-dos.nse \\
\n192.168.110.1 -p 445<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

smtp-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

SMTP\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3066\u3001LOGIN\u3001PLAIN\u3001CRAM-MD5\u3001DIGEST-MD5\u304a\u3088\u3073NTLM\u8a8d\u8a3c\u3092\u4f7f\u7528\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script smtp-brute \\
\n192.168.110.1 -p 25<\/td>\n<\/tr>\n
smtp-commands<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

SMTP\u30b5\u30fc\u30d0\u306b\u3066\u3001EHLO\u3068HELP\u3092\u4f7f\u7528\u3057\u3066\u3001\u30b5\u30dd\u30fc\u30c8\u3055\u308c\u3066\u3044\u308b\u62e1\u5f35\u30b3\u30de\u30f3\u30c9\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script smtp-commands.nse \\
\n192.168.110.1 -pT:25,465,587<\/td>\n<\/tr>\n
smtp-enum-users<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, external, intrusive<\/td>\n

SMTP\u30b5\u30fc\u30d0\u306b\u3066\u3001VRFY\u3001EXPN\u307e\u305f\u306fRCPT\u30b3\u30de\u30f3\u30c9\u3092\u767a\u884c\u3057\u3001\u540c\u30b5\u30fc\u30d0\u306e\u30e6\u30fc\u30b6\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u3053\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u306e\u76ee\u7684\u306f\u3001\u5bfe\u8c61\u306b\u5b58\u5728\u3059\u308b\u3059\u3079\u3066\u306e\u30e6\u30fc\u30b6\u30a2\u30ab\u30a6\u30f3\u30c8\u3092\u767a\u898b\u3059\u308b\u3053\u3068\u3067\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7\/Black Jumbo Dog6.1.9
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script smtp-enum-users.nse \\
\n192.168.110.1 -p 25,465,587<\/td>\n<\/tr>\n
smtp-ntlm-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

NTLM\u8a8d\u8a3c\u304c\u6709\u52b9\u306b\u306a\u3063\u3066\u3044\u308bSMTP\u30b5\u30fc\u30d3\u30b9\u304b\u3089\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script smtp-ntlm-info \\
\n192.168.110.1 -p 25,465,587<\/td>\n<\/tr>\n
smtp-open-relay<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, external, intrusive<\/td>\n

SMTP\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3001\u5b9a\u7fa9\u6e08\u307f\u306eSMTP\u30b3\u30de\u30f3\u30c9\u3092\u767a\u884c\u3057\u3001\u30e1\u30fc\u30eb\u4e2d\u7d99\u3092\u8a66\u307f\u3001SMTP\u30b5\u30fc\u30d0\u304c\u30e1\u30fc\u30eb\u30ea\u30ec\u30fc\u306b\u5bfe\u3057\u3066\u8106\u5f31\u3067\u3042\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7\/Black Jumbo Dog6.1.9
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script smtp-open-relay.nse \\
\n192.168.110.1 -p 25,465,587<\/td>\n<\/tr>\n
smtp-strangeport<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nmalware, safe<\/td>\n

SMTP\u30b5\u30fc\u30d0\u304c\u975e\u6a19\u6e96\u306e\u30dd\u30fc\u30c8\u3067\u5b9f\u884c\u3055\u308c\u3066\u3044\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7\/Black Jumbo Dog6.1.9
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV –script smtp-strangeport \\
\n192.168.110.1<\/td>\n<\/tr>\n
smtp-vuln-cve2010-4344<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, intrusive, vuln<\/td>\n

Exim\u30b5\u30fc\u30d0(SMTP\u30b5\u30fc\u30d0)\u306b\u5bfe\u3057\u3001Ver4.69\u4ee5\u524d\u304c\u5f71\u97ff\u3092\u53d7\u3051\u308b\u30d2\u30fc\u30d7\u30aa\u30fc\u30d0\u30fc\u30d5\u30ed\u30fc\u306e\u8106\u5f31\u6027(CVE-2010-4344)\u304a\u3088\u3073\u3001Ver4.72\u4ee5\u524d\u304c\u5f71\u97ff\u3092\u53d7\u3051\u308b\u6a29\u9650\u6607\u683c\u306e\u8106\u5f31\u6027(CVE-2010-4345)\u304c\u5b58\u5728\u3059\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script \\
\nsmtp-vuln-cve2010-4344 \\
\n–script-args “exploit.cmd=’uname -a'” \\
\n192.168.110.1 -pT:25,465,587<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

smtp-vuln-cve2011-1720<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nintrusive, vuln<\/td>\n

Postfix SMTP\u30b5\u30fc\u30d0\u306b\u3066\u3001\u30e1\u30e2\u30ea\u7834\u640d\u306e\u8106\u5f31\u6027(CVE-2011-1720\u3001”Cyrus SASL”\u30e9\u30a4\u30d6\u30e9\u30ea\u306e\u8a8d\u8a3c\u30e1\u30ab\u30cb\u30ba\u30e0\u306b\u3088\u308b\u3082\u306e)\u306e\u6709\u7121\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002\u3053\u306e\u8106\u5f31\u6027\u306f\u30b5\u30fc\u30d3\u30b9\u62d2\u5426\u304a\u3088\u3073\u30ea\u30e2\u30fc\u30c8\u3067\u30b3\u30fc\u30c9\u304c\u5b9f\u884c\u3092\u53ef\u80fd\u306b\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script smtp-vuln-cve2011-1720 \\
\n192.168.110.1 -pT:25,465,587<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

smtp-vuln-cve2011-1764<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nintrusive, vuln<\/td>\n

“DomainKeys Identified Mail”(DKIM)\u30b5\u30dd\u30fc\u30c8(CVE-2011-1764)\u3092\u4f7f\u7528\u3057\u3066\u3001Exim SMTP\u30b5\u30fc\u30d0(Ver4.70?4.75)\u306b”format string”\u306e\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002DKIM\u30ed\u30ae\u30f3\u30b0\u30e1\u30ab\u30cb\u30ba\u30e0\u306f\u3001DKIM-Signature\u30d8\u30c3\u30c0\u30d5\u30a3\u30fc\u30eb\u30c9\u306e\u4e00\u90e8\u3092\u30ed\u30ae\u30f3\u30b0\u3059\u308b\u3068\u304d\u306b”format string specifiers”\u3092\u4f7f\u7528\u305b\u305a\u3001E\u30e1\u30fc\u30eb\u3092\u9001\u4fe1\u3067\u304d\u308b\u653b\u6483\u8005\u306f\u3001\u3053\u306e\u8106\u5f31\u6027\u3092\u60aa\u7528\u3057\u3001Exim\u30c7\u30fc\u30e2\u30f3\u306e\u6a29\u9650\u3067\u4efb\u610f\u306e\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script smtp-vuln-cve2011-1764 \\
\n192.168.110.1 -pT:25,465,587<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

sniffer-detect<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

\u30ed\u30fc\u30ab\u30eb\u30fb\u30a4\u30fc\u30b5\u30cd\u30c3\u30c8\u4e0a\u3067\u5bfe\u8c61\u306e\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30ab\u30fc\u30c9\u304c\u30d7\u30ed\u30df\u30b9\u30ad\u30e3\u30b9\u30e2\u30fc\u30c9\u3067\u52d5\u4f5c\u3057\u3066\u3044\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV –script sniffer-detect \\
\n192.168.110.1<\/td>\n<\/tr>\n
snmp-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306b\u3088\u308a\u3001SNMP\u30b3\u30df\u30e5\u30cb\u30c6\u30a3\u30b9\u30c8\u540d\u306e\u767a\u898b\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows2008R2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sU –script snmp-brute \\
\n192.168.110.1 -p 161<\/td>\n<\/tr>\n
snmp-hh3c-logins<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

Huawei\/ HP\/ H3C\u306e\u6a5f\u5668\u306b\u5bfe\u3057\u3001”hh3c-user.mib”OID\u3092\u4f7f\u7528\u3057\u3066\u3001\u30ed\u30fc\u30ab\u30eb\u306b\u5b9a\u7fa9\u3055\u308c\u305f\u30e6\u30fc\u30b6\u60c5\u5831\u306e\u53d6\u5f97\u3092\u8a66\u307f\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nH3C S5120-52C-EI Commware ver5.20
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sU –script snmp-hh3c-logins \\
\n–script-args snmpcommunity=public \\
\n192.168.110.30 -p 161<\/td>\n<\/tr>\n
snmp-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, safe, version<\/td>\n

SNMPv3\u306eGET\u30ea\u30af\u30a8\u30b9\u30c8\u304b\u3089\u57fa\u672c\u7684\u306a\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u540c\u30d7\u30ed\u30fc\u30d6\u306f\u3001\u30b5\u30fc\u30d3\u30b9\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u691c\u51fa\u30b9\u30ad\u30e3\u30f3\u3067\u3082\u4f7f\u7528\u3055\u308c\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nH3C S5120-52C-EI Commware ver5.20
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV -sU 192.168.110.30 -p 161<\/td>\n<\/tr>\n
snmp-interfaces<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

SNMP\u3092\u4ecb\u3057\u3066\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30a4\u30f3\u30bf\u30d5\u30a7\u30fc\u30b9\u306e\u53d6\u5f97\u3092\u8a66\u307f\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows2008R2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sU –script snmp-brute \\
\n192.168.110.1 -p 161<\/td>\n<\/tr>\n
snmp-ios-config<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nintrusive<\/td>\n

SNMP RW(V1)\u3092\u4f7f\u7528\u3057\u3066Cisco\u30eb\u30fc\u30bf\u306eIOS\u30b3\u30f3\u30d5\u30a3\u30ae\u30e5\u30ec\u30fc\u30b7\u30e7\u30f3\u30d5\u30a1\u30a4\u30eb\u3092\u8868\u793a\u3082\u3057\u304f\u306f\u4fdd\u5b58\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nCisco 881 IOS Version 12.4
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sU –script snmp-ios-config \\
\n–script-args snmpcommunity=”public” \\
\n192.168.110.30 -p 161<\/td>\n<\/tr>\n
snmp-netstat<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

SNMP\u306b\u3066”netstat”\u306b\u4f3c\u305f\u5185\u5bb9\u306e\u554f\u3044\u5408\u308f\u305b\u3092\u884c\u3044\u307e\u3059\u3002\u5f15\u6570”newtargets”\u3092\u6307\u5b9a\u3059\u308b\u3068\u3001\u65b0\u3057\u3044\u30bf\u30fc\u30b2\u30c3\u30c8\u3092\u30b9\u30ad\u30e3\u30f3\u5bfe\u8c61\u3068\u3057\u3066\u81ea\u52d5\u7684\u306b\u8ffd\u52a0\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows2008R2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sU –script snmp-netstat \\
\n192.168.110.1 -p 161<\/td>\n<\/tr>\n
snmp-processes<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

SNMP\u3092\u4ecb\u3057\u3066\u3001\u5b9f\u884c\u4e2d\u306e\u30d7\u30ed\u30bb\u30b9\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows2008R2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sU –script snmp-processes \\
\n192.168.110.1 -p 161<\/td>\n<\/tr>\n
snmp-sysdescr<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

SNMPV1\u3092\u4ecb\u3057\u3066\u30b7\u30b9\u30c6\u30e0\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows2008R2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sU –script snmp-netstat \\
\n192.168.110.1 -p 161<\/td>\n<\/tr>\n
snmp-win32-services<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

SNMP\u3092\u4ecb\u3057\u3066Windows\u30b5\u30fc\u30d3\u30b9\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows2008R2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sU –script \\
\nsnmp-win32-services \\
\n192.168.110.1 -p 161<\/td>\n<\/tr>\n
snmp-win32-shares<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

SNMP\u3092\u4ecb\u3057\u3066Windows\u5171\u6709\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script snmp-win32-shares \\
\n192.168.110.1 -p 161<\/td>\n<\/tr>\n
snmp-win32-software<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

SNMP\u3092\u4ecb\u3057\u3066\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u305f\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script \\
\nsnmp-win32-software \\
\n192.168.110.1 -p 161<\/td>\n<\/tr>\n
snmp-win32-users<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, default, safe<\/td>\n

SNMP\u3092\u4ecb\u3057\u3066Windows\u30e6\u30fc\u30b6\u30a2\u30ab\u30a6\u30f3\u30c8\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows2008R2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sU –script snmp-win32-users \\
\n192.168.110.1 -p 161<\/td>\n<\/tr>\n
socks-auth-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

“SOCKS”\u30d7\u30ed\u30ad\u30b7\u30b5\u30fc\u30d0\u306b\u3066\u30b5\u30dd\u30fc\u30c8\u3055\u308c\u3066\u3044\u308b\u8a8d\u8a3c\u30e1\u30ab\u30cb\u30ba\u30e0\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002 “SOCKS”\u30d0\u30fc\u30b8\u30e7\u30f35\u304b\u3089\u306e”SOCKS”\u30b5\u30fc\u30d0\u306f\u8a8d\u8a3c\u3092\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u3044\u307e\u3059\u3002\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u6b21\u306e\u8a8d\u8a3c\u30bf\u30a4\u30d7\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002
\n0: \u8a8d\u8a3c\u306a\u3057
\n1: GSSAPI
\n2: \u30e6\u30fc\u30b6\u540d\u3068\u30d1\u30b9\u30ef\u30fc\u30c9<\/td>\n		\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script socks-auth-info \\
\n192.168.110.1 -p 1080<\/td>\n<\/tr>\n
socks-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

“SOCKS 5″\u30d7\u30ed\u30ad\u30b7\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script socks-brute \\
\n192.168.110.1 -p 1080<\/td>\n<\/tr>\n
socks-open-proxy<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, external, safe<\/td>\n

\u5bfe\u8c61\u3067\u30aa\u30fc\u30d7\u30f3\u306a”socks”\u30d7\u30ed\u30ad\u30b7\u304c\u5b9f\u884c\u3055\u308c\u3066\u3044\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script socks-open-proxy \\
\n192.168.110.1<\/td>\n<\/tr>\n
ssh2-enum-algos<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

\u5bfe\u8c61\u306eSSH2\u30b5\u30fc\u30d0\u304c\u63d0\u4f9b\u3059\u308b\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u306e\u6570(\u6697\u53f7\u5316\u3001\u5727\u7e2e\u306a\u3069)\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002”-v”\u30aa\u30d7\u30b7\u30e7\u30f3\u304c\u8a2d\u5b9a\u3055\u308c\u3066\u3044\u308b\u5834\u5408\u306f\u3001\u63d0\u4f9b\u3059\u308b\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u3092\u5404\u30bf\u30a4\u30d7\u5225\u306b\u4e00\u89a7\u8868\u793a\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script ssh2-enum-algos \\
\n192.168.110.1<\/td>\n<\/tr>\n
ssh-hostkey<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

SSH\u306ehostkeys\u3092\u8868\u793a\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script ssh-hostkey \\
\n–script-args ssh_hostkey=full \\
\n192.168.110.1<\/td>\n<\/tr>\n
sshv1<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, safe<\/td>\n

SSH\u30b5\u30fc\u30d0\u304c\u3001\u5b89\u5168\u6027\u306e\u4f4e\u3044SSH\u30d7\u30ed\u30c8\u30b3\u30eb\u30d0\u30fc\u30b8\u30e7\u30f31\u3092\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u3044\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nCisco806 Version 12.2(8)
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV -sC 192.168.110.30 -p 22<\/td>\n<\/tr>\n
ssl-ccs-injection<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nsafe, vuln<\/td>\n

\u5bfe\u8c61\u306bSSL\/TLS CCS\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027(CVE-2014-0224)\u304c\u5b58\u5728\u3059\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002\u3053\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001Ramon de C Valle\u8457\u306e”ccsinjection.c code<\/a>“\u306b\u57fa\u3065\u3044\u3066\u3044\u307e\u3059<\/td>\n\u5bfe\u8c61
\nOWASP Broken Web Apps 1.2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script ssl-ccs-injection \\
\n192.168.110.12 -p 443<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

ssl-cert<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

\u30b5\u30fc\u30d0\u306eSSL\u8a3c\u660e\u66f8\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u8a3c\u660e\u66f8\u306b\u3064\u3044\u3066\u60c5\u5831\u91cf\u306f\u3001\u5197\u9577\u30ec\u30d9\u30eb\u306b\u3088\u3063\u3066\u7570\u306a\u308a\u307e\u3059\u3002\u30c7\u30d5\u30a9\u30eb\u30c8\u306e\u5197\u9577\u30ec\u30d9\u30eb\u3067\u4ee5\u4e0b\u306e\u60c5\u5831\u304c\u51fa\u529b\u3055\u308c\u307e\u3059\u3002
\n\u30fb\u6709\u52b9\u671f\u9593
\n\u30fbcommonName
\n\u30fborganizationName
\n\u30fbstateOrProvinceName
\n\u30fbCOUNTRYNAME<\/td>\n		\u5bfe\u8c61
\nOWASP Broken Web Apps 1.2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV -sC 192.168.110.12 -p 443 -vv<\/td>\n<\/tr>\n
ssl-date<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

TLS ServerHello\u5fdc\u7b54\u304b\u3089\u30bf\u30fc\u30b2\u30c3\u30c8\u30db\u30b9\u30c8\u306e\u6642\u523b\u3068\u65e5\u4ed8\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nOWASP Broken Web Apps 1.2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script ssl-date 192.168.110.12<\/td>\n<\/tr>\n
ssl-dh-params<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nsafe, vuln<\/td>\n

SSL\/TLS\u30b5\u30fc\u30d3\u30b9\u306eDiffie-Hellman\u30d1\u30e9\u30e1\u30fc\u30bf\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nOWASP Broken Web Apps 1.2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script ssl-dh-params 192.168.110.1<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

ssl-enum-ciphers<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscove+C491ry, intrusive<\/td>\n

SSLv3\/TLS\u3067\u306e\u63a5\u7d9a\u3092\u6697\u53f7\u65b9\u5f0f\u3084\u5727\u7e2e\u65b9\u5f0f\u3092\u5909\u3048\u306a\u304c\u3089\u7e70\u308a\u8fd4\u3057\u5b9f\u65bd\u3057\u3001\u5bfe\u8c61\u304c\u53d7\u3051\u5165\u308c\u308b\u304b\u3001\u62d2\u5426\u3059\u308b\u304b\u3092\u78ba\u8a8d\u3057\u3001\u5bfe\u8c61\u304c\u53d7\u3051\u5165\u308c\u308b\u3059\u3079\u3066\u306e\u6697\u53f7\u30b9\u30a4\u30fc\u30c8\u3084\u5727\u7e2e\u65b9\u5f0f\u306e\u30ea\u30b9\u30c8\u3092\u30ea\u30b9\u30c8\u5316\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nOWASP Broken Web Apps 1.2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script ssl-enum-ciphers \\
\n192.168.110.12 -p 443<\/td>\n<\/tr>\n
ssl-google-cert-catalog<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, external, safe<\/td>\n

\u30bf\u30fc\u30b2\u30c3\u30c8\u30db\u30b9\u30c8\u304b\u3089\u53d6\u5f97\u3057\u305fSSL\u8a3c\u660e\u66f8\u3092Google\u306e\u8a3c\u660e\u66f8\u306e\u30ab\u30bf\u30ed\u30b0\u3067\u7167\u4f1a\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nOWASP Broken Web Apps 1.2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script ssl-enum-ciphers \\
\n192.168.110.12 -p 443<\/td>\n<\/tr>\n
ssl-heartbleed<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nsafe, vuln<\/td>\n

OpenSSL Heartbleed\u306e\u8106\u5f31\u6027(CVE-2014-0160)\u304c\u5b58\u5728\u3059\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002\u30b3\u30fc\u30c9\u306fJared Stafford\u304c\u4f5c\u6210\u3057\u305fPython\u30b9\u30af\u30ea\u30d7\u30c8”ssltest.py”\u306b\u57fa\u3065\u3044\u3066\u3044\u307e\u3059\u3002(jspenguin@jspenguin.org)<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script ssl-heartbleed \\
\n192.168.110.1 -p 443<\/td>\n<\/tr>\n
ssl-known-key<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe, vuln<\/td>\n

\u30db\u30b9\u30c8\u304c\u4f7f\u7528\u3059\u308bSSL\u8a3c\u660e\u66f8\u306b\u3064\u3044\u3066\u3001\u554f\u984c\u306e\u3042\u308b\u30ad\u30fc\u306e\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u306b\u4e00\u81f4\u3059\u308bfingerprint\u3092\u6301\u3063\u3066\u3044\u308b\u304b\u3069\u3046\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script ssl-known-key \\
\n192.168.111.121 -p 443<\/td>\n<\/tr>\n
ssl-poodle<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nsafe, vuln<\/td>\n

SSLv3\u306eCBC\u6697\u53f7(POODLE)\u304c\u8a31\u53ef\u3055\u308c\u3066\u3044\u308b\u304b\u3069\u3046\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nOWASP Broken Web Apps 1.2
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV –version-light \\
\n–script ssl-poodle \\
\n192.168.110.12 -p 443<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

sslv2<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, safe<\/td>\n

\u30b5\u30fc\u30d0\u304c\u5b89\u5168\u6027\u306e\u4f4e\u3044\u306eSSLv2\u3092\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u3044\u308b\u304b\u3069\u3046\u304b\u3001\u307e\u305fSSLv2\u304c\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u3044\u308b\u6697\u53f7\u65b9\u5f0f\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nbadstore
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV -sC 192.168.110.11 -p 443<\/td>\n<\/tr>\n
sslv2-drown<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nintrusive, vuln<\/td>\n

\u30b5\u30fc\u30d0\u304cSSLv2\u3092\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u3044\u308b\u304b\u3069\u3046\u304b\u3001\u307e\u305fSSLv2\u304c\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u3044\u308b\u6697\u53f7\u65b9\u5f0f\u3092\u78ba\u8a8d\u3057\u3001”CVE-2015-3197″\u3001”CVE-2016-0703″\u3001\u304a\u3088\u3073”CVE-2016-0800″(DROWN)\u306e\u30c6\u30b9\u30c8\u3092\u884c\u3044\u307e\u3059<\/td>\n\u5bfe\u8c61
\nbadstore
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV –script sslv2-drown \\
\n192.168.110.11 -p 443<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

sstp-discover<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery<\/td>\n

\u5bfe\u8c61\u304c”Secure Socket Tunneling”\u30d7\u30ed\u30c8\u30b3\u30eb\u304c\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u3044\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002(SSTP\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u4f1d\u9001\u3059\u308b\u305f\u3081\u306b\u4f7f\u7528\u3055\u308c\u308bHTTPS\u5c64\u3092\u78ba\u7acb\u3057\u3088\u3046\u3068\u8a66\u307f\u308b\u3053\u3068\u306b\u3088\u3063\u3066\u78ba\u8a8d\u3057\u307e\u3059\u3002)
\nhttp:\/\/msdn.microsoft.com\/en-us\/library\/cc247364.aspx
\n\u306b\u8aac\u660e\u304c\u8a18\u8f09\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/td>\n		\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV -sC 192.168.110.1<\/td>\n<\/tr>\n
stun-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

STUN\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u4f7f\u7528\u3057\u3066NAT\u3055\u308c\u305f\u30db\u30b9\u30c8\u306e\u5916\u90e8IP\u30a2\u30c9\u30ec\u30b9\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV -PN -sU –script stun-info \\
\n192.168.110.1 -p 3478<\/td>\n<\/tr>\n
stun-version<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nversion<\/td>\n

\u30b5\u30fc\u30d0\u306b\u30d0\u30a4\u30f3\u30c7\u30a3\u30f3\u30b0\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u9001\u4fe1\u3057\u3001\u30b5\u30fc\u30d0\u306e\u5c5e\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u5fdc\u7b54\u304b\u3089\u30d0\u30fc\u30b8\u30e7\u30f3\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU -sV 192.168.110.1 -p 3478<\/td>\n<\/tr>\n
stuxnet-detect<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

\u30db\u30b9\u30c8\u304cStuxnet\u306e\u30ef\u30fc\u30e0\u306b\u611f\u67d3\u3057\u3066\u3044\u308b\u304b\u3069\u3046\u304b\u3092\u691c\u51fa\u3057\u307e\u3059\u3002(http:\/\/en.wikipedia.org\/wiki\/Stuxnet)\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script stuxnet-detect \\
\n192.168.110.1 -p 445<\/td>\n<\/tr>\n
supermicro-ipmi-conf<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexploit, vuln<\/td>\n

\u8106\u5f31\u306aSupermicro\u306e\u30aa\u30f3\u30dc\u30fc\u30c9IPMI\u30b3\u30f3\u30c8\u30ed\u30fc\u30e9\u3088\u308a\u3001\u30d7\u30ec\u30fc\u30f3\u30c6\u30ad\u30b9\u30c8\u306e\u30e6\u30fc\u30b6\u8cc7\u683c\u60c5\u5831\u3092\u542b\u3080\u3001\u4fdd\u8b77\u3055\u308c\u3066\u3044\u306a\u3044\u30b3\u30f3\u30d5\u30a3\u30ae\u30e5\u30ec\u30fc\u30b7\u30e7\u30f3\u30d5\u30a1\u30a4\u30eb\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script supermicro-ipmi-conf \\
\n192.168.110.1 -p 49152<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

url-snarf<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nsafe<\/td>\n

Subversion\u30bd\u30fc\u30b9\u30b3\u30fc\u30c9\u7ba1\u7406\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3066\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script svn-brute \\
\n–script-args svn-brute.repo=\/svn\/ \\
\n192.168.110.1 -p 3690<\/td>\n<\/tr>\n
targets-asn<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, external, safe<\/td>\n

\u6307\u5b9a\u3057\u305f\u30eb\u30fc\u30c6\u30a3\u30f3\u30b0\u306eAS\u756a\u53f7(ASN)\u306eIP\u30d7\u30ec\u30d5\u30a3\u30af\u30b9\u306e\u30ea\u30b9\u30c8\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script targets-asn \\
\n–script-args targets-asn.asn=32<\/td>\n<\/tr>\n
targets-ipv6-map4to6<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery<\/td>\n

\u3053\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001\u30b9\u30ad\u30e3\u30f3\u524d\u306e\u30d5\u30a7\u30fc\u30ba\u3067\u5b9f\u884c\u3055\u308c\u3001IPv4\u30a2\u30c9\u30ec\u30b9\u3092IPv6\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u306b\u30de\u30c3\u30d7\u3057\u3001\u30b9\u30ad\u30e3\u30f3\u30ad\u30e5\u30fc\u306b\u8ffd\u52a0\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -6 –script targets-ipv6-map4to6 \\
\n–script-args newtargets, \\
\ntargets-ipv6-map4to6.IPv4Hosts=\\
\n{192.168.1.0\/24}, \\
\ntargets-ipv6-subnet={2001:db8:c0ca::\/64}<\/td>\n<\/tr>\n
targets-ipv6-multicast-echo<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, discovery<\/td>\n

\u5168\u30ce\u30fc\u30c9\u306e\u30ea\u30f3\u30af\u30ed\u30fc\u30ab\u30eb\u30de\u30eb\u30c1\u30ad\u30e3\u30b9\u30c8\u30a2\u30c9\u30ec\u30b9(ff02 :: 1)\u306bICMPv6\u30a8\u30b3\u30fc\u8981\u6c42\u30d1\u30b1\u30c3\u30c8\u3092\u9001\u4fe1\u3057\u3066\u3001\u5404IPv6\u30a2\u30c9\u30ec\u30b9\u306b\u5bfe\u3057ping\u3092\u884c\u3046\u3053\u3068\u306a\u304fLAN\u4e0a\u306e\u5fdc\u7b54\u30db\u30b9\u30c8\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -6 –script \\
\ntargets-ipv6-multicast-echo.nse \\
\n–script-args \\
\n‘newtargets,interface=eth0’ -sL<\/td>\n<\/tr>\n
targets-ipv6-multicast-invalid-dst<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, discovery<\/td>\n

\u7121\u52b9\u306a\u62e1\u5f35\u30d8\u30c3\u30c0\u3092\u6301\u3064ICMPv6\u30d1\u30b1\u30c3\u30c8\u3092\u3001\u5168\u30ce\u30fc\u30c9\u306e\u30ea\u30f3\u30af\u30ed\u30fc\u30ab\u30eb\u30de\u30eb\u30c1\u30ad\u30e3\u30b9\u30c8\u30a2\u30c9\u30ec\u30b9\uff08ff02 :: 1\uff09\u306b\u9001\u4fe1\u3057\u3066\u3001LAN\u4e0a\u306e\u4f7f\u7528\u53ef\u80fd\u306a\u30db\u30b9\u30c8\u3092\u691c\u51fa\u3057\u307e\u3059\u3002(\u4e00\u90e8\u306e\u30db\u30b9\u30c8\u304cICMPv6\u306e”Parameter Problem”\u306e\u30a8\u30e9\u30fc\u901a\u77e5\u30d1\u30b1\u30c3\u30c8\u3067\u540c\u30d1\u30b1\u30c3\u30c8\u306b\u5fdc\u7b54\u3059\u308b\u3053\u3068\u3092\u5229\u7528\u3057\u305f\u30b9\u30af\u30ea\u30d7\u30c8)<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -6 –script \\
\ntargets-ipv6-multicast-invalid-dst.nse \\
\n–script-args \\
\n‘newtargets,interface=eth0’ -sP<\/td>\n<\/tr>\n
targets-ipv6-multicast-mld<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, discovery<\/td>\n

\u30ea\u30f3\u30af\u30ed\u30fc\u30ab\u30eb\u30de\u30eb\u30c1\u30ad\u30e3\u30b9\u30c8\u30a2\u30c9\u30ec\u30b9(ff02 :: 1)\u306bMLD(\u30de\u30eb\u30c1\u30ad\u30e3\u30b9\u30c8\u30ea\u30b9\u30ca\u63a2\u7d22)\u30af\u30a8\u30ea\u3092\u9001\u4fe1\u3057\u3001\u5fdc\u7b54\u3092\u53d7\u4fe1\u3059\u308b\u3053\u3068\u306b\u3088\u3063\u3066\u3001LAN\u4e0a\u3067\u4f7f\u7528\u53ef\u80fd\u306aIPv6\u30db\u30b9\u30c8\u3092\u691c\u51fa\u3057\u307e\u3059\u3002\u30af\u30a8\u30ea\u306e\u6700\u5927\u5fdc\u7b54\u9045\u5ef6\u30921\u306b\u8a2d\u5b9a\u3059\u308b\u3053\u3068\u306b\u3088\u308a\u3001\u5bfe\u8c61\u30db\u30b9\u30c8\u306f\u30de\u30eb\u30c1\u30ad\u30e3\u30b9\u30c8\u30b0\u30eb\u30fc\u30d7\u304b\u3089\u306e\u4ed6\u306e\u5fdc\u7b54\u3092\u5f85\u3064\u306e\u3067\u306f\u306a\u304f\u3001\u3059\u3050\u306b\u5fdc\u7b54\u3059\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -6 –script \\
\ntargets-ipv6-multicast-mld.nse \\
\n–script-args ‘newtargets,interface=eth0’<\/td>\n<\/tr>\n
targets-ipv6-multicast-slaac<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, discovery<\/td>\n

\u30b9\u30c6\u30fc\u30c8\u30ec\u30b9\u30a2\u30c9\u30ec\u30b9\u81ea\u52d5\u8a2d\u5b9a(SLAAC)\u3092\u30c8\u30ea\u30ac\u3068\u3057\u3066IPv6\u30db\u30b9\u30c8\u306e\u691c\u51fa\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -6 –script \\
\ntargets-ipv6-multicast-slaac \\
\n–script-args \\
\n‘newtargets,interface=eth0’ -sP<\/td>\n<\/tr>\n
targets-ipv6-wordlist<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery<\/td>\n

\u7279\u5b9a\u306e\u30b5\u30d6\u30cd\u30c3\u30c8\u5185\u306e\u30a2\u30c9\u30ec\u30b9\u3092\u69cb\u6210\u3059\u308b16\u9032\u6570\u306e”words”\u306e”wordlist”\u3092\u4f7f\u7528\u3057\u3066\u3001Nmap\u306e\u30b9\u30ad\u30e3\u30f3\u30ad\u30e5\u30fc\u306bIPv6\u30a2\u30c9\u30ec\u30b9\u3092\u8ffd\u52a0\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -6 –script targets-ipv6-wordlist \\
\n–script-args newtargets,\\
\ntargets-ipv6-subnet={2001:db8:c0ca::\/64} \\
\n-p 80<\/td>\n<\/tr>\n
targets-sniffer<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbroadcast, discovery, safe<\/td>\n

\u8a2d\u5b9a\u3057\u305f\u6642\u9593\uff08\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u306f10\u79d2\uff09\u306e\u9593\u3001\u30ed\u30fc\u30ab\u30eb\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u3092\u30b9\u30cb\u30c3\u30d5\u30a3\u30f3\u30b0\u3057\u3001\u691c\u51fa\u3055\u308c\u305f\u30a2\u30c9\u30ec\u30b9\u3092\u51fa\u529b\u3057\u307e\u3059\u3002 \u5f15\u6570”newtargets”\u304c\u8a2d\u5b9a\u3055\u308c\u3066\u3044\u308b\u5834\u5408\u3001\u691c\u51fa\u3055\u308c\u305f\u30a2\u30c9\u30ec\u30b9\u3092Nmap\u306e\u30b9\u30ad\u30e3\u30f3\u30ad\u30e5\u30fc\u306b\u8ffd\u52a0\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sL –script targets-sniffer \\
\n–script-args newtargets, \\
\ntargets-sniffer.timeout=5s, \\
\ntargets-sniffer.iface=eth0<\/td>\n<\/tr>\n
targets-traceroute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

Nmap\u306e\u30b9\u30ad\u30e3\u30f3\u30ad\u30e5\u30fc\u306b\u30c8\u30ec\u30fc\u30b9\u30eb\u30fc\u30c8\u306e\u30db\u30c3\u30d7\u3092\u633f\u5165\u3057\u307e\u3059\u3002 \u672c\u30b9\u30af\u30ea\u30d7\u30c8\u306fNmap\u306e–traceroute\u30aa\u30d7\u30b7\u30e7\u30f3\u304c\u4f7f\u7528\u3055\u308c\u3001\u5f15\u6570”newtargets”\u304c\u6307\u5b9a\u3055\u308c\u3066\u3044\u308b\u5834\u5408\u306b\u306e\u307f\u6a5f\u80fd\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script targets-traceroute \\
\n–script-args newtargets \\
\n–traceroute <GlobalIP><\/td>\n<\/tr>\n
targets-xml<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nsafe<\/td>\n

Nmap\u306eXML\u51fa\u529b\u30d5\u30a1\u30a4\u30eb\u304b\u3089\u30b9\u30ad\u30e3\u30f3\u5bfe\u8c61\u306e\u30a2\u30c9\u30ec\u30b9\u3092\u8aad\u307f\u8fbc\u307f\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script targets-xml \\
\n–script-args newtargets,iX=oldscan.xml<\/td>\n<\/tr>\n
teamspeak2-version<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nversion<\/td>\n

“TeamSpeak 2 voice communication”\u30b5\u30fc\u30d0\u3092\u691c\u51fa\u3057\u3001\u30d0\u30fc\u30b8\u30e7\u30f3\u304a\u3088\u3073\u8a2d\u5b9a\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU -sV 192.168.110.1 -p 8767<\/td>\n<\/tr>\n
telnet-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

telnet\u306e\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3066\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nCisco806 Version 12.2(8)
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script telnet-brute \\
\n–script-args brute.firstonly=true \\
\n192.168.110.30 -p 23<\/td>\n<\/tr>\n
telnet-encryption<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

Telnet\u30b5\u30fc\u30d0\u3067\u6697\u53f7\u5316\u30aa\u30d7\u30b7\u30e7\u30f3\u304c\u30b5\u30dd\u30fc\u30c8\u3055\u308c\u3066\u3044\u308b\u304b\u3069\u3046\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002 \u4e00\u90e8\u306e\u30b7\u30b9\u30c6\u30e0( FreeBSD\u3084krb5\u306a\u3069\u306eLinux\u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3)\u3067\u306f\u3001\u3053\u306e\u30aa\u30d7\u30b7\u30e7\u30f3\u304c\u6b63\u3057\u304f\u5b9f\u88c5\u3055\u308c\u3066\u3044\u306a\u3044\u305f\u3081\u3001\u30eb\u30fc\u30c8\u306e\u8106\u5f31\u6027\u304c\u5b58\u5728\u3057\u307e\u3059\u3002\u3053\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u73fe\u5728\u306e\u3068\u3053\u308d\u3001\u6697\u53f7\u5316\u304c\u30b5\u30dd\u30fc\u30c8\u3055\u308c\u3066\u3044\u308b\u304b\u3069\u3046\u304b\u3060\u3051\u3092\u30c6\u30b9\u30c8\u3057\u3066\u3044\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nMetasploitable2.0.0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script telnet-encryption \\
\n192.168.110.1 -p 23<\/td>\n<\/tr>\n
telnet-ntlm-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

NTLM\u8a8d\u8a3c\u304c\u6709\u52b9\u306b\u306a\u3063\u3066\u3044\u308b\u30ea\u30e2\u30fc\u30c8\u306eMicrosoft Telnet\u30b5\u30fc\u30d3\u30b9\u306e\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7\/Telnet\u30b5\u30fc\u30d3\u30b9
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script telnet-ntlm-info \\
\n192.168.110.1 -p 23<\/td>\n<\/tr>\n
tftp-enum<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

TFTP(\u7c21\u6613\u30d5\u30a1\u30a4\u30eb\u8ee2\u9001\u30d7\u30ed\u30c8\u30b3\u30eb)\u306e\u30d5\u30a1\u30a4\u30eb\u540d\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script tftp-enum.nse \\
\n–script-args \\
\n“tftp-enum.filelist=customlist.txt” \\
\n192.168.110.1 -p 69<\/td>\n<\/tr>\n
tls-nextprotoneg<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

TLS-NPN\u3092\u4f7f\u7528\u3057\u3066\u3001TLS\u30b5\u30fc\u30d0\u304c\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u3044\u308b\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script=tls-nextprotoneg \\
\n192.168.110.1<\/td>\n<\/tr>\n
tor-consensus-checker<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nexternal, safe<\/td>\n

\u65e2\u77e5\u306eTor\u30ce\u30fc\u30c9\u304c\u3042\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nWindows7
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script tor-consensus-checker \\
\n192.168.110.1<\/td>\n<\/tr>\n
traceroute-geolocation<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, external, safe<\/td>\n

\u30c8\u30ec\u30fc\u30b9\u30eb\u30fc\u30c8\u306e\u5404\u30db\u30c3\u30d7\u306e\u5730\u7406\u7684\u306a\u4f4d\u7f6e\u3092\u4e00\u89a7\u8868\u793a\u3057\u3001\u5fc5\u8981\u306b\u5fdc\u3058\u3066KML\u30d5\u30a1\u30a4\u30eb(Google\u30a2\u30fc\u30b9\u304a\u3088\u3073\u30de\u30c3\u30d7\u306b\u30d7\u30ed\u30c3\u30c8\u53ef)\u306b\u7d50\u679c\u3092\u4fdd\u5b58\u3057\u307e\u3059\u3001<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -Pn –traceroute –script \\
\ntraceroute-geolocation 8.8.8.8<\/td>\n<\/tr>\n
unittest<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nsafe<\/td>\n

\u5168NSE\u30e9\u30a4\u30d6\u30e9\u30ea\u306e\u30e6\u30cb\u30c3\u30c8\u30c6\u30b9\u30c8\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nNmap 7.25BETA1
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script unittest \\
\n–script-args unittest.run<\/td>\n<\/tr>\n
unusual-port<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nsafe<\/td>\n

\u5404\u30dd\u30fc\u30c8\u3067\u5b9f\u969b\u306b\u691c\u51fa\u3055\u308c\u305f\u30b5\u30fc\u30d3\u30b9\u3068\u3001\u305d\u306e\u30dd\u30fc\u30c8\u756a\u53f7\u3067\u671f\u5f85\u3055\u308c\u308b\u30b5\u30fc\u30d3\u30b9\uff08\u305f\u3068\u3048\u3070\u3001ssh=22\u3001http=80\uff09\u3092\u6bd4\u8f03\u3057\u3001\u5dee\u7570\u3092\u51fa\u529b\u3057\u307e\u3059\u3002\u3053\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u3067\u306f\u3001\u5404\u30dd\u30fc\u30c8\u3067\u5b9f\u969b\u306b\u5b9f\u884c\u3055\u308c\u3066\u3044\u308b\u30b5\u30fc\u30d3\u30b9\u3092\u691c\u51fa\u3067\u304d\u308b\u3088\u3046\u306b\u3001\u30d0\u30fc\u30b8\u30e7\u30f3\u30b9\u30ad\u30e3\u30f3\u3092\u5b9f\u884c\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nCentOS7
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV –script unusual-port \\
\n192.168.110.1<\/td>\n<\/tr>\n
upnp-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

UPnP\u30b5\u30fc\u30d3\u30b9\u304b\u3089\u30b7\u30b9\u30c6\u30e0\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV –script broadcast-upnp-info \\
\n192.168.110.1<\/td>\n<\/tr>\n
url-snarf<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nsafe<\/td>\n

HTTP\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u76d7\u8074\u3057\u3001\u4efb\u610f\u306eURL\u304a\u3088\u3073\u767a\u4fe1\u5143\u306eIP\u30a2\u30c9\u30ec\u30b9\u3092\u30c0\u30f3\u30d7\u3057\u307e\u3059\u3002 URL\u306f\u6a19\u6e96\u51fa\u529b\u3067\u51fa\u529b\u3055\u308c\u307e\u3059\u3002\u7d50\u679c\u3092\u30d5\u30a1\u30a4\u30eb\u306b\u4fdd\u5b58\u3059\u308b\u30aa\u30d7\u30b7\u30e7\u30f3\u3082\u3042\u308a\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script url-snarf -e eth0<\/td>\n<\/tr>\n
ventrilo-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe, version<\/td>\n

Ventrilo\u97f3\u58f0\u901a\u4fe1\u30b5\u30fc\u30d0\u306e\u30b5\u30fc\u30d3\u30b9\u30d0\u30fc\u30b8\u30e7\u30f32.1.2\u4ee5\u964d\u3092\u691c\u51fa\u3057\u3001\u30d0\u30fc\u30b8\u30e7\u30f3\u304a\u3088\u3073\u8a2d\u5b9a\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u4ee5\u524d\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\uff083.0.0\u3088\u308a\u524d\uff09\u3067\u306f\u3001\u3053\u306e\u30d7\u30ed\u30fc\u30d6\u306b\u5bfe\u5fdc\u3059\u308bUDP\u30b5\u30fc\u30d3\u30b9\u304c\u306a\u3044\u5834\u5408\u304c\u3042\u308a\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV 192.168.110.1 -p 9408<\/td>\n<\/tr>\n
versant-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

“Versant object database”\u304b\u3089\u30d5\u30a1\u30a4\u30eb\u30d1\u30b9\u3001\u30d0\u30fc\u30b8\u30e7\u30f3\u3001\u304a\u3088\u3073\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u540d\u306e\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script versant-info \\
\n192.168.110.1 -p 5019<\/td>\n<\/tr>\n
vmauthd-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

VMWare\u306e\u8a8d\u8a3c\u30c7\u30fc\u30e2\u30f3(vmware-authd)\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script vmauthd-brute \\
\n192.168.110.1 -p 902<\/td>\n<\/tr>\n
vnc-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

VNC\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nCentOS7\/VNC(TCP5902\u3067\u5b9f\u884c)
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script vnc-brute \\
\n192.168.110.1 -p 5902<\/td>\n<\/tr>\n
vnc-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

VNC\u30b5\u30fc\u30d0\u306b\u30d7\u30ed\u30c8\u30b3\u30eb\u30d0\u30fc\u30b8\u30e7\u30f3\u3068\u30b5\u30dd\u30fc\u30c8\u3055\u308c\u3066\u3044\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306e\u7a2e\u985e\u3092\u554f\u3044\u5408\u308f\u305b\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nCentOS7\/VNC(TCP5902\u3067\u5b9f\u884c)
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap -sV -sC 192.168.110.1 -p 5902<\/td>\n<\/tr>\n
vnc-title<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, intrusive<\/td>\n

VNC\u30b5\u30fc\u30d0\u306b\u30ed\u30b0\u30a4\u30f3\u3057\u3001\u30c7\u30b9\u30af\u30c8\u30c3\u30d7\u540d\u306e\u53d6\u5f97\u3092\u8a66\u307f\u307e\u3059\u3002\u30a2\u30ab\u30a6\u30f3\u30c8\u60c5\u5831\u306f\u8a8d\u8a3c\u306a\u3057\u3001\u3082\u3057\u304f\u306f”vnc-brute”\u30b9\u30af\u30ea\u30d7\u30c8\u3067\u767a\u898b\u3057\u305f\u60c5\u5831\u3092\u4f7f\u7528\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV –script vnc-title \\
\n192.168.110.1 -p 5902<\/td>\n<\/tr>\n
voldemort-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

“Voldemort Native”\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u4f7f\u7528\u3057\u3066\u3001”Voldemort”\u5206\u6563\u30ad\u30fc\u30b9\u30c8\u30a2\u304b\u3089\u30af\u30e9\u30b9\u30bf\u304a\u3088\u3073\u30b9\u30c8\u30a2\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script voldemort-info \\
\n192.168.110.1 -p 6666<\/td>\n<\/tr>\n
vuze-dht-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

“Vuze”\u30d5\u30a1\u30a4\u30eb\u5171\u6709\u30ce\u30fc\u30c9\u304b\u3089\u3001\u30d7\u30ed\u30c8\u30b3\u30eb\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u542b\u3080\u57fa\u672c\u7684\u306a\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU -sV –script vuze-dht-info \\
\n192.168.110.1 -p 17555<\/td>\n<\/tr>\n
wdb-version<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, version, vuln<\/td>\n

“VxWorks Wind DeBug agents”\u306e\u8106\u5f31\u6027\u3092\u691c\u51fa\u3057\u3001\u30d0\u30fc\u30b8\u30e7\u30f3\u3084\u30cf\u30fc\u30c9\u30a6\u30a7\u30a2\u306e\u30b5\u30dd\u30fc\u30c8\u306a\u3069\u306e\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script wdb-version \\
\n192.168.110.1 -p 17185<\/p>\n

\u203b\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u51fa\u529b\u7d50\u679c\u306b\u300cVULNERABLE\u300d\u3084\u300cvuln\u300d\u306e\u30ad\u30fc\u30ef\u30fc\u30c9\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n

weblogic-t3-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe, version<\/td>\n

“T3 RMI”\u30d7\u30ed\u30c8\u30b3\u30eb\u304a\u3088\u3073”WebLogic”\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV 192.168.110.1<\/td>\n<\/tr>\n
whois-domain<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, external, safe<\/td>\n

\u5bfe\u8c61\u306e\u30c9\u30e1\u30a4\u30f3\u540d\u306b\u95a2\u3059\u308b\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nGoogle Public DNS\u30b5\u30fc\u30d0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script whois-domain.nse 8.8.8.8<\/td>\n<\/tr>\n
whois-ip<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, external, safe<\/td>\n

\u5730\u57df\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u30ec\u30b8\u30b9\u30c8\u30ea(RIR)\u306eWHOIS\u30b5\u30fc\u30d3\u30b9\u3092\u7167\u4f1a\u3057\u3001\u5bfe\u8c61IP\u30a2\u30c9\u30ec\u30b9\u3092\u542b\u3080IP\u30a2\u30c9\u30ec\u30b9\u5272\u308a\u5f53\u3066\u306b\u95a2\u3059\u308b\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n\u5bfe\u8c61
\nGoogle Public DNS\u30b5\u30fc\u30d0
\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u51fa\u529b\u7d50\u679c\u78ba\u8a8d\u6e08\u307f)
\nnmap –script whois-ip 8.8.8.8<\/td>\n<\/tr>\n
wsdd-discover<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

“Web Services Dynamic Discovery”(WS-Discovery)\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u30b5\u30dd\u30fc\u30c8\u3059\u308b\u30c7\u30d0\u30a4\u30b9\u306e\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u307e\u305f\u516c\u958b\u3055\u308c\u3066\u3044\u308bWCF(Windows Communication Framework)Web\u30b5\u30fc\u30d3\u30b9(.NET 4.0\u4ee5\u964d)\u306e\u691c\u7d22\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script wsdd-discover \\
\n192.168.110.1<\/td>\n<\/tr>\n
x11-access<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nauth, default, safe<\/td>\n

X\u30b5\u30fc\u30d0\u3078\u306e\u63a5\u7d9a\u3092\u8a31\u53ef\u3057\u3066\u3044\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV -sC 192.168.110.1<\/td>\n<\/tr>\n
xdmcp-discover<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndiscovery, safe<\/td>\n

DMCP (X display manager control protocol)\u306e\u30bb\u30c3\u30b7\u30e7\u30f3\u3092\u8981\u6c42\u3057\u3001\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u3044\u308b\u8a8d\u8a3c\u65b9\u6cd5\u3068\u6a29\u9650\u4ed8\u4e0e\u306e\u30e1\u30ab\u30cb\u30ba\u30e0\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sU –script xdmcp-discover \\
\n192.168.110.1 -p 177<\/td>\n<\/tr>\n
xmlrpc-methods<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe<\/td>\n

“system.listMethods”\u30e1\u30bd\u30c3\u30c9\u3092\u4ecb\u3057\u3066”XMLRPC Introspection”\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap xmlrpc-info 192.168.110.1<\/td>\n<\/tr>\n
xmpp-brute<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\nbrute, intrusive<\/td>\n

XMPP(Jabber)\u30a4\u30f3\u30b9\u30bf\u30f3\u30c8\u30e1\u30c3\u30bb\u30fc\u30b8\u30f3\u30b0\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3066\u3001\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30af\u30e9\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap –script xmpp-brute \\
\n192.168.110.1 -p 5222<\/td>\n<\/tr>\n
xmpp-info<\/p>\n

\u30ab\u30c6\u30b4\u30ea
\ndefault, discovery, safe, version<\/td>\n

XMPP\u30b5\u30fc\u30d0(5222\u30dd\u30fc\u30c8)\u306b\u63a5\u7d9a\u3057\u3001\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u3044\u308b\u8a8d\u8a3c\u30e1\u30ab\u30cb\u30ba\u30e0\u3001\u5727\u7e2e\u65b9\u6cd5\u3001TLS\u3092\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u3044\u308b\u304b\u3001\u30b9\u30c8\u30ea\u30fc\u30e0\u7ba1\u7406\u3001\u8a00\u8a9e\u3001\u30a4\u30f3\u30d0\u30f3\u30c9\u767b\u9332\u306e\u30b5\u30dd\u30fc\u30c8\u3001\u30b5\u30fc\u30d0\u6a5f\u80fd\u306a\u3069\u306e\u30b5\u30fc\u30d0\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002(\u53ef\u80fd\u3067\u3042\u308c\u3070\u30b5\u30fc\u30d0\u306e\u30d9\u30f3\u30c0\u30fc\u60c5\u5831\u3082)<\/td>\n\u5b9f\u884c\u30b3\u30de\u30f3\u30c9(\u5b9f\u884c\u78ba\u8a8d\u307e\u3067)
\nnmap -sV 192.168.110.1 -p 5222<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n","protected":false},"excerpt":{"rendered":"
Tweet<\/a><\/div>

Tweet \u203b\u672c\u6295\u7a3f\u306b\u8a18\u8f09\u306e\u5185\u5bb9\u3092\u81ea\u8eab\u306e\u7ba1\u7406\u4e0b\u306b\u306a\u3044\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30fb\u30b3\u30f3\u30d4\u30e5\u30fc\u30bf\u306b\u884c\u3063\u305f\u5834\u5408\u306f\u3001\u653b\u6483\u884c\u70ba\u3068\u5224\u65ad\u3055\u308c\u3001\u6700\u60aa\u306e\u5834\u5408\u3001\u6cd5\u7684\u63aa\u7f6e\u3092\u53d6\u3089\u308c\u308b\u53ef\u80fd\u6027\u3082\u3042\u308a\u307e\u3059\u3002\u540c\u5185\u5bb9\u306e\u8abf\u67fb\u3092\u884c\u308f\u308c\u308b\u5834\u5408\u306b\u306f\u3001\u5fc5\u305a\u81ea\u8eab\u306e\u7ba1\u7406\u4e0b\u306b\u3042\u308b\u30cd\u30c3 […]<\/p>\n","protected":false},"author":21,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[],"views":60988,"_links":{"self":[{"href":"https:\/\/n.pentest.ninja\/index.php?rest_route=\/wp\/v2\/posts\/32488"}],"collection":[{"href":"https:\/\/n.pentest.ninja\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/n.pentest.ninja\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/n.pentest.ninja\/index.php?rest_route=\/wp\/v2\/users\/21"}],"replies":[{"embeddable":true,"href":"https:\/\/n.pentest.ninja\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=32488"}],"version-history":[{"count":28,"href":"https:\/\/n.pentest.ninja\/index.php?rest_route=\/wp\/v2\/posts\/32488\/revisions"}],"predecessor-version":[{"id":32524,"href":"https:\/\/n.pentest.ninja\/index.php?rest_route=\/wp\/v2\/posts\/32488\/revisions\/32524"}],"wp:attachment":[{"href":"https:\/\/n.pentest.ninja\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=32488"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/n.pentest.ninja\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=32488"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/n.pentest.ninja\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=32488"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}