一、被动信息收集
被动信息收集指的是通过公开渠道可获得的信息，与目标系统不产生直接交互，尽量避免留下一切痕迹的信息探测。被动探测技术收集的信息可以大致分为两类, 即配置信息和状态信息。
被动探测可收集的信息 特征 被动技术 IP地址或地址段 探测是否存活 MAC地址 内部嗅探ARP，DHCP 域名信息和主机名 外部嗅探DNS，内部嗅探NetBIOS，ARP，DHCP 操作系统和版本 指纹信息 运行的应用软件 用户名和密码 设备类型（服务器、客户机） 端口和协议使用，ICMP 运行的服务 端口和协议的使用 设备运行状态 活动水平和ICMP 应用状态 在应用端口上设备的对外活动水平 链路运行状态 活动水平和ICMP 链路利用 活动水平 设备逻辑位置 基于TTL的距离跳数 邮件地址，公司地址，公司组织架构，联系电话/传真号码，人员姓名/职务 为社会工程学做准备 文档图片数据 公开商业信息 关于开源智能信息收集文章：
美国军方：http://www.fas.org/irp/dodair/army/atp2-22-2.pdf
北大西洋公约组织：http://information-retireval.info/docs/NATO-OSINT.html
二、域名系统DNS
域名系统（Domain Name System，DNS）是因特网的一项服务。它作为将域名和IP地址相互映射的一个分布式数据库，能够使人更方便地访问互联网。DNS使用TCP和UDP端口53。当前，对于每一级域名长度的限制是63个字符，域名总长度则不能超过253个字符。DNS与FQNDFQDN：(Fully Qualified Domain Name)完全合格域名/全称域名，是指主机名加上全路径，全路径中列出了序列中所有域成员。全域名可以从逻辑上准确地表示出主机在什么地方，也可以说全域名是主机名的一种完全表示形式。（例如：DNS：sina.com；FQND:www.sina.com）主机名到IP地址的映射有两种方式：1）静态映射，每台设备上都配置主机到IP地址的映射，各设备独立维护自己的映射表，而且只供本设备使用；2）动态映射，建立一套域名解析系统（DNS），只在专门的DNS服务器上配置主机到IP地址的映射，网络上需要使用主机名通信的设备，首先需要到DNS服务器查询主机所对应的IP地址。域名结构
通常 Internet 主机域名的一般结构为：主机名.三级域名.二级域名.*域名。 Internet 的*域名由 Internet网络协会域名注册查询负责网络地址分配的委员会进行登记和管理，它还为 Internet的每一台主机分配唯一的 IP 地址。全世界现有三个大的网络信息中心： 位于美国的 Inter-NIC，负责美国及其他地区； 位于荷兰的RIPE-NIC，负责欧洲地区；位于日本的APNIC ，负责亚太地区。记录类型1.主机记录（A记录）：A记录是用于名称解析的重要记录，它将特定的主机名映射到对应主机的IP地址上。2.别名记录（CNAME记录）: CNAME记录用于将某个别名指向到某个A记录上，这样就不需要再为某个新名字另外创建一条新的A记录。3.IPv6主机记录（AAAA记录）: 与A记录对应，用于将特定的主机名映射到一个主机的IPv6地址。4.邮件交换记录（MX记录）：用于将以该域名为结尾的电子邮件指向对应的邮件服务器以进行处理5.域名服务器记录（NS记录 ）：用来表明由哪台服务器对该域名进行解析。可以查询某一子域名的DNS记录6.PTR记录，是电子邮件记录中的邮件交换记录的一种，被用于电子邮件发送过程中的反向地址解析7.服务位置记录（SRV记录）: 用于定义提供特定服务的服务器的位置，如主机（hostname），端口（port number）等。域名解析DNS查询有两种方式：递归和迭代。DNS客户端设置使用的DNS服务器一般都是递归服务器，它负责全权处理客户端的DNS查询请求，直到返回最终结果。而DNS服务器之间一般采用迭代查询方式。
三、DNS-nslookup
Nslookup 是一个监测网络中DNS服务器是否能正确实现域名解析的命令行工具。用于查询DNS的记录，查看域名解析是否正常，在网络故障的时候用来诊断网络问题它在 Windows NT/2000/XP(在之后的windows系统也都可以用的，比如win7,win8等) 中均可使用。
操作手册查询：man nslookup
<span style="font-size:18px;">NSLOOKUP(1) BIND9 NSLOOKUP(1) NAME
nslookup - query Internet name servers interactively SYNOPSIS
nslookup [-option] [name | -] [server] DESCRIPTION
Nslookup is a program to query Internet domain name servers. Nslookup
has two modes: interactive and non-interactive. Interactive mode
allows the user to query name servers for information about various
hosts and domains or to print a list of hosts in a domain.
Non-interactive mode is used to print just the name and requested
information for a host or domain. ARGUMENTS
Interactive mode is entered in the following cases: 1. when no arguments are given (the default name server will be used) 2. when the first argument is a hyphen (-) and the second argument is the host name or Internet address of a name server. Non-interactive mode is used when the name or Internet address of the host to
be looked up is given as the first argument. The optional second argument
specifies the host name or address of a name server. Options can also be specified on the command line if they precede the
arguments and are prefixed with a hyphen. For example, to change the default
query type to host information, and the initial timeout to 10 seconds, type: nslookup -query=hinfo -timeout=10 #-查询=hinfo 超时=10 INTERACTIVE COMMANDS #交互式命令
host [server]
Look up information for host using the current default server or
using server, if specified. If host is an Internet address and the
query type is A or PTR, the name of the host is returned. If host
is a name and does not have a trailing period, the search list is
used to qualify the name. To look up a host not in the current domain, append a period to
the name.
server domain lserver domain
Change the default server to domain; lserver uses the initial
server to look up information about domain, while server uses the
current default server. If an authoritative answer can't be found,
the names of servers that might have the answer are returned. root
not implemented finger
not implemented ls
not implemented view
not implemented help
not implemented ?
not implemented exit
Exits the program. set keyword[=value]
This command is used to change state information that affects the
lookups. Valid keywords are: all
Prints the current values of the frequently used options
to set. Information about the current default server and
host is also printed. class="value"
Change the query class to one of: IN
the Internet class CH
the Chaos class HS
the Hesiod class ANY
wildcard The class specifies the protocol group of the
information. (Default = IN; abbreviation = cl) [no]debug
Turn on or off the display of the full response packet and
any intermediate response packets when searching. (Default = nodebug; abbreviation = [no]deb) [no]d2
Turn debugging mode on or off. This displays more about
what nslookup is doing.
(Default = nod2) domain=name
Sets the search list to name. [no]search
If the lookup request contains at least one period but
doesn't end with a trailing period, append the domain
names in the domain search list to the request until an
answer is received. (Default = search) port=value
Change the default TCP/UDP name server port to value. (Default = 53; abbreviation = po) querytype=value type=value
Change the type of the information query. (Default = A; abbreviations = q, ty) [no]recurse
Tell the name server to query other servers if it does not
have the information. (Default = recurse; abbreviation = [no]rec) ndots=number
Set the number of dots (label separators) in a domain that
will disable searching. Absolute names always stop
searching. retry=number
Set the number of retries to number. timeout=number
Change the initial timeout interval for waiting for a
reply to number seconds. [no]vc
Always use a virtual circuit when sending requests to the
server. (Default = novc) [no]fail
Try the next nameserver if a nameserver responds with
SERVFAIL or a referral (nofail) or terminate query (fail)
on such a response. (Default = nofail) FILES
/etc/resolv.conf SEE ALSO
dig(1), host(1), named(8). AUTHOR
Andrew Cherenson COPYRIGHT
Copyright © 2004-2007, 2010, 2013, 2014 Internet Systems Consortium,
Inc. ("ISC") BIND9 Jun 30, 2000 NSLOOKUP(1)
</span>查询范例
<span style="font-size:18px;">root@kali:~# nslookup #进入nslookup模式
> server #查询本机DNS服务器
Default server: 192.168.1.1
Address: 192.168.1.1#53
> sina.com
Server: 192.168.1.1
Address: 192.168.1.1#53 Non-authoritative answer:
Name: sina.com
Address: 66.102.251.33
> set type=a #指定类型为A
> sina.com
Server: 192.168.1.1
Address: 192.168.1.1#53 Non-authoritative answer:
Name: sina.com
Address: 66.102.251.33
> set type=MX #指定类型为MX
> sina.com #注：不能输入www.sina.com等主机域名
Server: 192.168.1.1
Address: 192.168.1.1#53 Non-authoritative answer: #优先级
sina.com mail exchanger = 10 freemx3.sinamail.sina.com.cn.
sina.com mail exchanger = 5 freemx1.sinamail.sina.com.cn.
sina.com mail exchanger = 10 freemx2.sinamail.sina.com.cn. Authoritative answers can be found from:
com nameserver = k.gtld-servers.net.
com nameserver = f.gtld-servers.net.
com nameserver = g.gtld-servers.net.
com nameserver = m.gtld-servers.net.
com nameserver = h.gtld-servers.net.
com nameserver = l.gtld-servers.net.
com nameserver = a.gtld-servers.net.
com nameserver = d.gtld-servers.net.
com nameserver = j.gtld-servers.net.
com nameserver = i.gtld-servers.net.
com nameserver = b.gtld-servers.net.
com nameserver = e.gtld-servers.net.
com nameserver = c.gtld-servers.net.
g.gtld-servers.net internet address = 192.42.93.30
j.gtld-servers.net internet address = 192.48.79.30
i.gtld-servers.net internet address = 192.43.172.30
e.gtld-servers.net internet address = 192.12.94.30
a.gtld-servers.net internet address = 192.5.6.30
a.gtld-servers.net has AAAA address 2001:503:a83e::2:30
h.gtld-servers.net internet address = 192.54.112.30
f.gtld-servers.net internet address = 192.35.51.30
b.gtld-servers.net internet address = 192.33.14.30
</span>指定域名解析服务器
<span style="font-size:18px;">root@kali:~# nslookup
> server 156.154.70.22 #指定域名解析服务器
Default server: 156.154.70.22
Address: 156.154.70.22#53
> sina.com
Server: 156.154.70.22
Address: 156.154.70.22#53 Non-authoritative answer:
Name: sina.com
Address: 66.102.251.33
> </span>长指令
<span style="font-size:18px;">root@kali:~# nslookup -q=ns sina.com 156.154.70.22 #-q是type简写，156..为指定DNS服务器
Server: 156.154.70.22
Address: 156.154.70.22#53 Non-authoritative answer:
sina.com nameserver = ns2.sina.com.cn.
sina.com nameserver = ns1.sina.com.
sina.com nameserver = ns1.sina.com.cn.
sina.com nameserver = ns2.sina.com.
sina.com nameserver = ns4.sina.com.cn.
sina.com nameserver = ns4.sina.com.
sina.com nameserver = ns3.sina.com.cn.
sina.com nameserver = ns3.sina.com. Authoritative answers can be found from:
ns1.sina.com internet address = 114.134.80.144
ns2.sina.com internet address = 114.134.80.145
ns3.sina.com internet address = 61.172.201.254
ns4.sina.com internet address = 123.125.29.99
</span>