Discovery/arp sweep
De www.metasploit-es.com.ar
Cuando tus sistemas objetivo se encuentran en la misma red que tu maquina atacante, puedes enumerar sistemas realizando un escaneo ARP. Naturalmente, Metasploit tiene un modulo que te puede ayudar.
msf > use auxiliary/scanner/discovery/arp_sweep msf auxiliary(arp_sweep) > show options Module options: Name Current Setting Required Description ---- --------------- -------- ----------- INTERFACE no The name of the interface PCAPFILE no The name of the PCAP capture file to process RHOSTS yes The target address range or CIDR identifier SHOST yes Source IP Address SMAC yes Source MAC Address THREADS 1 yes The number of concurrent threads TIMEOUT 500 yes The number of seconds to wait for new data
Debido a la forma en que se realiza el escaneo ARP, necesitas pasar tu direccion MAC y direccion IP origen al escaneador para que funcione correctamente.
msf auxiliary(arp_sweep) > set RHOSTS 192.168.1.200-254 RHOSTS => 192.168.1.200-254 msf auxiliary(arp_sweep) > set SHOST 192.168.1.101 SHOST => 192.168.1.101 msf auxiliary(arp_sweep) > set SMAC d6:46:a7:38:15:65 SMAC => d6:46:a7:38:15:65 msf auxiliary(arp_sweep) > set THREADS 55 THREADS => 55 msf auxiliary(arp_sweep) > run [*] 192.168.1.201 appears to be up. [*] 192.168.1.203 appears to be up. [*] 192.168.1.205 appears to be up. [*] 192.168.1.206 appears to be up. [*] 192.168.1.250 appears to be up. [*] Scanned 55 of 55 hosts (100% complete) [*] Auxiliary module execution completed msf auxiliary(arp_sweep) >
Como veras al ejecutar este modulo, el escaneo ARP es muy rapido.
© Offensive Security 2009
Original de www.offensive-security.com Traducido por cbk999
