一、被动信息收集
二、域名系统DNS被动信息收集指的是通过公开渠道可获得的信息，与目标系统不产生直接交互，尽量避免留下一切痕迹的信息探测。被动探测技术收集的信息可以大致分为两类, 即配置信息和状态信息。
关于开源智能信息收集文章：
美国军方：/irp/dodair/army/atp2-22-2.pdf
北大西洋公约组织：http://information-retireval.info/docs/NATO-OSINT.html
域名系统（Domain Name System，DNS）是因特网的一项服务。它作为将域名和IP地址相互映射的一个分布式数据库，能够使人更方便地访问互联网。DNS使用TCP和UDP端口53。当前，对于每一级域名长度的限制是63个字符，域名总长度则不能超过253个字符。三、DNS-nslookupDNS与FQNDFQDN：(Fully Qualified Domain Name)完全合格域名/全称域名，是指主机名加上全路径，全路径中列出了序列中所有域成员。全域名可以从逻辑上准确地表示出主机在什么地方，也可以说全域名是主机名的一种完全表示形式。（例如：DNS：；FQND:）
主机名到IP地址的映射有两种方式：
1）静态映射，每台设备上都配置主机到IP地址的映射，各设备独立维护自己的映射表，而且只供本设备使用； 2）动态映射，建立一套域名解析系统（DNS），只在专门的DNS服务器上配置主机到IP地址的映射，网络上需要使用主机名通信的设备，首先需要到DNS服务器查询主机所对应的IP地址。
域名结构通常 Internet 主机域名的一般结构为：主机名.三级域名.二级域名.顶级域名。 Internet 的顶级域名由 Internet网络协会域名注册查询负责网络地址分配的委员会进行登记和管理，它还为 Internet的每一台主机分配唯一的 IP 地址。全世界现有三个大的网络信息中心： 位于美国的 Inter-NIC，负责美国及其他地区； 位于荷兰的RIPE-NIC，负责欧洲地区；位于日本的APNIC ，负责亚太地区。
记录类型1.主机记录（A记录）：A记录是用于名称解析的重要记录，它将特定的主机名映射到对应主机的IP地址上。 2.别名记录（CNAME记录）: CNAME记录用于将某个别名指向到某个A记录上，这样就不需要再为某个新名字另外创建一条新的A记录。 3.IPv6主机记录（AAAA记录）: 与A记录对应，用于将特定的主机名映射到一个主机的 IPv6 地址。 4.邮件交换记录（MX记录）：用于将以该域名为结尾的电子邮件指向对应的邮件服务器以进行处理 5.域名服务器记录（NS记录 ）：用来表明由哪台服务器对该域名进行解析。可以查询某一子域名的DNS记录 6.PTR记录，是电子邮件记录中的邮件交换记录的一种，被用于电子邮件发送过程中的反向地址解析 7.服务位置记录（SRV记录）: 用于定义提供特定服务的服务器的位置，如主机（hostname），端口（port number）等。 8.NAPTR记录：它提供了 正则表达式 方式去映射一个域名。NAPTR记录非常著名的一个应用是用于 ENUM 查询。
域名解析DNS查询有两种方式：递归和迭代。DNS客户端设置使用的DNS服务器一般都是递归服务器，它负责全权处理客户端的DNS查询请求，直到返回最终结果。而DNS服务器之间一般采用迭代查询方式。
Nslookup 是一个监测网络中DNS服务器是否能正确实现域名解析的命令行工具。用于查询DNS的记录，查看域名解析是否正常，在网络故障的时候用来诊断网络问题它在 Windows NT/2000/XP(在之后的windows系统也都可以用的，比如win7,win8等) 中均可使用。
操作手册查询：man nslookup
<span style="font-size:18px;">NSLOOKUP(1)BIND9NSLOOKUP(1)NAMEnslookup - query Internet name servers interactivelySYNOPSISnslookup [-option] [name | -] [server]DESCRIPTIONNslookup is a program to query Internet domain name servers. Nslookuphas two modes: interactive and non-interactive. Interactive modeallows the user to query name servers for information about varioushosts and domains or to print a list of hosts in a domain.Non-interactive mode is used to print just the name and requestedinformation for a host or domain.ARGUMENTSInteractive mode is entered in the following cases:1. when no arguments are given (the default name server will be used)2. when the first argument is a hyphen (-) and the second argument is the host name or Internet address of a name server.Non-interactive mode is used when the name or Internet address of the host tobe looked up is given as the first argument. The optional second argumentspecifies the host name or address of a name server.Options can also be specified on the command line if they precede thearguments and are prefixed with a hyphen. For example, to change the defaultquery type to host information, and the initial timeout to 10 seconds, type:nslookup -query=hinfo -timeout=10#-查询=hinfo 超时=10INTERACTIVE COMMANDS #交互式命令host [server]Look up information for host using the current default server orusing server, if specified. If host is an Internet address and thequery type is A or PTR, the name of the host is returned. If hostis a name and does not have a trailing period, the search list isused to qualify the name.To look up a host not in the current domain, append a period tothe name.server domainlserver domainChange the default server to domain; lserver uses the initialserver to look up information about domain, while server uses thecurrent default server. If an authoritative answer can't be found,the names of servers that might have the answer are returned.rootnot implementedfingernot implementedlsnot implementedviewnot implementedhelpnot implemented?not implementedexitExits the program.set keyword[=value]This command is used to change state information that affects thelookups. Valid keywords are:allPrints the current values of the frequently used optionsto set. Information about the current default server andhost is also printed.class=valueChange the query class to one of:INthe Internet classCHthe Chaos classHSthe Hesiod classANY wildcardThe class specifies the protocol group of theinformation.(Default = IN; abbreviation = cl)[no]debugTurn on or off the display of the full response packet andany intermediate response packets when searching.(Default = nodebug; abbreviation = [no]deb)[no]d2Turn debugging mode on or off. This displays more aboutwhat nslookup is doing.(Default = nod2)domain=nameSets the search list to name.[no]searchIf the lookup request contains at least one period butdoesn't end with a trailing period, append the domainnames in the domain search list to the request until ananswer is received.(Default = search)port=valueChange the default TCP/UDP name server port to value.(Default = 53; abbreviation = po)querytype=valuetype=valueChange the type of the information query.(Default = A; abbreviations = q, ty)[no]recurseTell the name server to query other servers if it does nothave the information.(Default = recurse; abbreviation = [no]rec)ndots=numberSet the number of dots (label separators) in a domain thatwill disable searching. Absolute names always stopsearching.retry=numberSet the number of retries to number.timeout=numberChange the initial timeout interval for waiting for areply to number seconds.[no]vcAlways use a virtual circuit when sending requests to theserver.(Default = novc)[no]failTry the next nameserver if a nameserver responds withSERVFAIL or a referral (nofail) or terminate query (fail)on such a response.(Default = nofail)FILES/etc/resolv.confSEE ALSOdig(1), host(1), named(8).AUTHORAndrew CherensonCOPYRIGHTCopyright © -, , , Internet Systems Consortium,Inc. ("ISC")BIND9 Jun 30, 2000 NSLOOKUP(1)</span>查询范例
<span style="font-size:18px;">root@kali:~# nslookup #进入nslookup模式> server#查询本机DNS服务器Default server: 192.168.1.1Address: 192.168.1.1#53> Server:192.168.1.1Address:192.168.1.1#53Non-authoritative answer:Name:Address: 66.102.251.33> set type=a #指定类型为A> Server:192.168.1.1Address:192.168.1.1#53Non-authoritative answer:Name:Address: 66.102.251.33> set type=MX #指定类型为MX> #注：不能输入等主机域名Server:192.168.1.1Address:192.168.1.1#53Non-authoritative answer: #优先级mail exchanger = 10 freemx3..mail exchanger = 5 freemx1..mail exchanger = 10 freemx2..Authoritative answers can be found from:comnameserver = k.gtld-nameserver = f.gtld-nameserver = g.gtld-nameserver = m.gtld-nameserver = h.gtld-nameserver = l.gtld-nameserver = a.gtld-nameserver = d.gtld-nameserver = j.gtld-nameserver = i.gtld-nameserver = b.gtld-nameserver = e.gtld-nameserver = c.gtld-.g.gtld-internet address = 192.42.93.30j.gtld-internet address = 192.48.79.30i.gtld-internet address = 192.43.172.30e.gtld-internet address = 192.12.94.30a.gtld-internet address = 192.5.6.30a.gtld-has AAAA address 2001:503:a83e::2:30h.gtld-internet address = 192.54.112.30f.gtld-internet address = 192.35.51.30b.gtld-internet address = 192.33.14.30</span>指定域名解析服务器
<span style="font-size:18px;">root@kali:~# nslookup> server 156.154.70.22#指定域名解析服务器Default server: 156.154.70.22Address: 156.154.70.22#53> Server:156.154.70.22Address:156.154.70.22#53Non-authoritative answer:Name:Address: 66.102.251.33> </span>长指令
<span style="font-size:18px;">root@kali:~# nslookup -q=ns 156.154.70.22 #-q是type简写，156..为指定DNS服务器Server:156.154.70.22Address:156.154.70.22#53Non-authoritative answer:nameserver = .nameserver = .nameserver = .nameserver = .nameserver = .nameserver = .nameserver = .nameserver = .Authoritative answers can be found from:internet address = 114.134.80.internet address = 114.134.80.internet address = 61.172.201.internet address = 123.125.29.99</span>
