浅谈Web渗透测试的信息收集  

Discussion on information gathering of Web penetration test

作　　者：郎智哲 封筱宇 董齐芬[1] Lang Zhizhe Feng Xiaoyu Dong Qifen(Zhejiang Police College, Hangzhou, Zhejiang 310053, China)

机构地区：[1]浙江警察学院,浙江杭州310053

出　　处：《计算机时代》2017年第8期13-16,共4页Computer Era

摘　　要：Web渗透测试是当前比较主流的网站安全测试方法,其中,信息收集工作是Web渗透测试的第一步,直接关系到整个渗透测试的质量。文章首先介绍了信息收集,然后结合实验详细阐述了信息收集中的两个主要方面,一是外部的信息收集,包括whois查询、IP地址信息查询和利用搜索引擎进行信息收集;二是利用扫描工具进行深入信息收集,包括ping工具、nmap工具和其他漏洞扫描器。该研究能为Web渗透测试的信息收集工作提供有价值的参考。Web penetration test is the most popular method of website security testing. The information gathering is the first step of Web penetration test, and it is directly related to the quality of the entire penetration test. This paper summarizes the information gathering, and then elaborates on the two main aspects of the information gathering according to the experiment. One is the external information gathering, including the whois query, IP address information query and gathering information with the search engines; the other is the deep-going information gathering by using the scanning tools, including Ping tools, nmap tools and other vulnerability scanners. This research can provide valuable reference for information gathering of Web penetration test.

关 键 词：网络安全 Web渗透测试 信息收集 扫描工具 

分 类 号：TN915.08[电子电信—通信与信息系统]