基于Kali Linux的渗透测试及防范研究  

The Research on Penetration Testing and Prevention Based on Kali Linux

作　　者：乔明秋[1] 高松[1] QIAO Mingqiu;GAO Song(Information Media College,Beijing College of Politics and Law,Beijing 102628,China)

机构地区：[1]北京政法职业学院信息媒体学院,北京102628

出　　处：《信息与电脑》2023年第3期227-230,共4页Information & Computer

基　　金：北京政法职业学院科研项目“网络安全漏洞复现及防范措施研究”(项目编号:KY202209)。

摘　　要：渗透测试是通过模拟恶意黑客的攻击方法,评估计算机网络系统安全的一种评估方法。文章基于Kali Linux系统探究了MS17-010漏洞,利用虚拟化平台搭建渗透测试环境,并模拟实际攻击环境。先使用Nessus、Nmap、MSF等工具收集信息,再利用MS17-010漏洞进行渗透,获取了靶机的shell控制权,渗透效果明显,完成了对目标主机的渗透。基于MS17-010漏洞的攻击原理,提出了相应的防范方法,结果表明防范方法具有通用性,对其他漏洞的防范具有借鉴作用。Penetration test is an evaluation method to evaluate the security of computer network system by simulating the attack method of malicious hackers.This paper explores the MS17-010 vulnerability based on the Kali Linux system,uses the virtualization platform to build a penetration test environment,and simulates the actual attack environment.First,Nessus,Nmap,MSF and other tools are used to collect information,and then MS17-010 vulnerability is used for penetration to obtain the shell control of the target.The penetration effect is obvious,and the penetration of the target host is completed.Based on the attack principle of MS17-010 vulnerability,the corresponding prevention methods are proposed,which are universal and can be used for reference for the prevention of other vulnerabilities.

关 键 词：Kali Linux 渗透测试 NESSUS MSF 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]