├── .gitignore ├── LICENSE ├── README.md ├── SUMMARY.md ├── styles └── ebook.css ├── 信息收集.md ├── 实战篇 WordPress.md ├── 实战篇 余闻同学录.md ├── 实战篇 南方 0day.md ├── 实战篇 捷达系统.md ├── 实战篇 迅雷 CMS.md ├── 工具篇 AWVS.md ├── 工具篇 BruteXSS.md ├── 工具篇 Nmap.md ├── 工具篇 Safe3 WVS.md ├── 漏洞篇 CSRF.md ├── 漏洞篇 SQL注入.md ├── 漏洞篇 SSRF.md ├── 漏洞篇 XSS.md ├── 漏洞篇 中间件.md ├── 漏洞篇 代码执行.md ├── 漏洞篇 弱口令.md ├── 漏洞篇 提权.md ├── 漏洞篇 文件上传.md ├── 漏洞篇 文件包含.md ├── 漏洞篇 第三方风险.md ├── 漏洞篇 越权.md └── 漏洞篇 逻辑漏洞.md /.gitignore: -------------------------------------------------------------------------------- 1 | _book 2 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International Public License (CC BY-NC-SA 4.0) 2 | 3 | Copyright © 2020 ApacheCN(apachecn@163.com) 4 | 5 | By exercising the Licensed Rights (defined below), You accept and agree to be bound by the terms and conditions of this Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International Public License ("Public License"). To the extent this Public License may be interpreted as a contract, You are granted the Licensed Rights in consideration of Your acceptance of these terms and conditions, and the Licensor grants You such rights in consideration of benefits the Licensor receives from making the Licensed Material available under these terms and conditions. 6 | 7 | Section 1 – Definitions. 8 | 9 | a. Adapted Material means material subject to Copyright and Similar Rights that is derived from or based upon the Licensed Material and in which the Licensed Material is translated, altered, arranged, transformed, or otherwise modified in a manner requiring permission under the Copyright and Similar Rights held by the Licensor. For purposes of this Public License, where the Licensed Material is a musical work, performance, or sound recording, Adapted Material is always produced where the Licensed Material is synched in timed relation with a moving image. 10 | b. Adapter's License means the license You apply to Your Copyright and Similar Rights in Your contributions to Adapted Material in accordance with the terms and conditions of this Public License. 11 | c. BY-NC-SA Compatible License means a license listed at creativecommons.org/compatiblelicenses, approved by Creative Commons as essentially the equivalent of this Public License. 12 | d. Copyright and Similar Rights means copyright and/or similar rights closely related to copyright including, without limitation, performance, broadcast, sound recording, and Sui Generis Database Rights, without regard to how the rights are labeled or categorized. For purposes of this Public License, the rights specified in Section 2(b)(1)-(2) are not Copyright and Similar Rights. 13 | e. Effective Technological Measures means those measures that, in the absence of proper authority, may not be circumvented under laws fulfilling obligations under Article 11 of the WIPO Copyright Treaty adopted on December 20, 1996, and/or similar international agreements. 14 | f. Exceptions and Limitations means fair use, fair dealing, and/or any other exception or limitation to Copyright and Similar Rights that applies to Your use of the Licensed Material. 15 | g. License Elements means the license attributes listed in the name of a Creative Commons Public License. The License Elements of this Public License are Attribution, NonCommercial, and ShareAlike. 16 | h. Licensed Material means the artistic or literary work, database, or other material to which the Licensor applied this Public License. 17 | i. Licensed Rights means the rights granted to You subject to the terms and conditions of this Public License, which are limited to all Copyright and Similar Rights that apply to Your use of the Licensed Material and that the Licensor has authority to license. 18 | j. Licensor means the individual(s) or entity(ies) granting rights under this Public License. 19 | k. NonCommercial means not primarily intended for or directed towards commercial advantage or monetary compensation. For purposes of this Public License, the exchange of the Licensed Material for other material subject to Copyright and Similar Rights by digital file-sharing or similar means is NonCommercial provided there is no payment of monetary compensation in connection with the exchange. 20 | l. Share means to provide material to the public by any means or process that requires permission under the Licensed Rights, such as reproduction, public display, public performance, distribution, dissemination, communication, or importation, and to make material available to the public including in ways that members of the public may access the material from a place and at a time individually chosen by them. 21 | m. Sui Generis Database Rights means rights other than copyright resulting from Directive 96/9/EC of the European Parliament and of the Council of 11 March 1996 on the legal protection of databases, as amended and/or succeeded, as well as other essentially equivalent rights anywhere in the world. 22 | n. You means the individual or entity exercising the Licensed Rights under this Public License. Your has a corresponding meaning. 23 | 24 | Section 2 – Scope. 25 | 26 | a. License grant. 27 | 1. Subject to the terms and conditions of this Public License, the Licensor hereby grants You a worldwide, royalty-free, non-sublicensable, non-exclusive, irrevocable license to exercise the Licensed Rights in the Licensed Material to: 28 | A. reproduce and Share the Licensed Material, in whole or in part, for NonCommercial purposes only; and 29 | B. produce, reproduce, and Share Adapted Material for NonCommercial purposes only. 30 | 2. Exceptions and Limitations. For the avoidance of doubt, where Exceptions and Limitations apply to Your use, this Public License does not apply, and You do not need to comply with its terms and conditions. 31 | 3. Term. The term of this Public License is specified in Section 6(a). 32 | 4. Media and formats; technical modifications allowed. The Licensor authorizes You to exercise the Licensed Rights in all media and formats whether now known or hereafter created, and to make technical modifications necessary to do so. The Licensor waives and/or agrees not to assert any right or authority to forbid You from making technical modifications necessary to exercise the Licensed Rights, including technical modifications necessary to circumvent Effective Technological Measures. For purposes of this Public License, simply making modifications authorized by this Section 2(a)(4) never produces Adapted Material. 33 | 5. Downstream recipients. 34 | A. Offer from the Licensor – Licensed Material. Every recipient of the Licensed Material automatically receives an offer from the Licensor to exercise the Licensed Rights under the terms and conditions of this Public License. 35 | B. Additional offer from the Licensor – Adapted Material. Every recipient of Adapted Material from You automatically receives an offer from the Licensor to exercise the Licensed Rights in the Adapted Material under the conditions of the Adapter’s License You apply. 36 | C. No downstream restrictions. You may not offer or impose any additional or different terms or conditions on, or apply any Effective Technological Measures to, the Licensed Material if doing so restricts exercise of the Licensed Rights by any recipient of the Licensed Material. 37 | 6. No endorsement. Nothing in this Public License constitutes or may be construed as permission to assert or imply that You are, or that Your use of the Licensed Material is, connected with, or sponsored, endorsed, or granted official status by, the Licensor or others designated to receive attribution as provided in Section 3(a)(1)(A)(i). 38 | b. Other rights. 39 | 1. Moral rights, such as the right of integrity, are not licensed under this Public License, nor are publicity, privacy, and/or other similar personality rights; however, to the extent possible, the Licensor waives and/or agrees not to assert any such rights held by the Licensor to the limited extent necessary to allow You to exercise the Licensed Rights, but not otherwise. 40 | 2. Patent and trademark rights are not licensed under this Public License. 41 | 3. To the extent possible, the Licensor waives any right to collect royalties from You for the exercise of the Licensed Rights, whether directly or through a collecting society under any voluntary or waivable statutory or compulsory licensing scheme. In all other cases the Licensor expressly reserves any right to collect such royalties, including when the Licensed Material is used other than for NonCommercial purposes. 42 | 43 | Section 3 – License Conditions. 44 | 45 | Your exercise of the Licensed Rights is expressly made subject to the following conditions. 46 | 47 | a. Attribution. 48 | 1. If You Share the Licensed Material (including in modified form), You must: 49 | A. retain the following if it is supplied by the Licensor with the Licensed Material: 50 | i. identification of the creator(s) of the Licensed Material and any others designated to receive attribution, in any reasonable manner requested by the Licensor (including by pseudonym if designated); 51 | ii. a copyright notice; 52 | iii. a notice that refers to this Public License; 53 | iv. a notice that refers to the disclaimer of warranties; 54 | v. a URI or hyperlink to the Licensed Material to the extent reasonably practicable; 55 | B. indicate if You modified the Licensed Material and retain an indication of any previous modifications; and 56 | C. indicate the Licensed Material is licensed under this Public License, and include the text of, or the URI or hyperlink to, this Public License. 57 | 2. You may satisfy the conditions in Section 3(a)(1) in any reasonable manner based on the medium, means, and context in which You Share the Licensed Material. For example, it may be reasonable to satisfy the conditions by providing a URI or hyperlink to a resource that includes the required information. 58 | 3. If requested by the Licensor, You must remove any of the information required by Section 3(a)(1)(A) to the extent reasonably practicable. 59 | b. ShareAlike. 60 | In addition to the conditions in Section 3(a), if You Share Adapted Material You produce, the following conditions also apply. 61 | 1. The Adapter’s License You apply must be a Creative Commons license with the same License Elements, this version or later, or a BY-NC-SA Compatible License. 62 | 2. You must include the text of, or the URI or hyperlink to, the Adapter's License You apply. You may satisfy this condition in any reasonable manner based on the medium, means, and context in which You Share Adapted Material. 63 | 3. You may not offer or impose any additional or different terms or conditions on, or apply any Effective Technological Measures to, Adapted Material that restrict exercise of the rights granted under the Adapter's License You apply. 64 | 65 | Section 4 – Sui Generis Database Rights. 66 | 67 | Where the Licensed Rights include Sui Generis Database Rights that apply to Your use of the Licensed Material: 68 | 69 | a. for the avoidance of doubt, Section 2(a)(1) grants You the right to extract, reuse, reproduce, and Share all or a substantial portion of the contents of the database for NonCommercial purposes only; 70 | b. if You include all or a substantial portion of the database contents in a database in which You have Sui Generis Database Rights, then the database in which You have Sui Generis Database Rights (but not its individual contents) is Adapted Material, including for purposes of Section 3(b); and 71 | c. You must comply with the conditions in Section 3(a) if You Share all or a substantial portion of the contents of the database. 72 | 73 | For the avoidance of doubt, this Section 4 supplements and does not replace Your obligations under this Public License where the Licensed Rights include other Copyright and Similar Rights. 74 | 75 | Section 5 – Disclaimer of Warranties and Limitation of Liability. 76 | 77 | a. Unless otherwise separately undertaken by the Licensor, to the extent possible, the Licensor offers the Licensed Material as-is and as-available, and makes no representations or warranties of any kind concerning the Licensed Material, whether express, implied, statutory, or other. This includes, without limitation, warranties of title, merchantability, fitness for a particular purpose, non-infringement, absence of latent or other defects, accuracy, or the presence or absence of errors, whether or not known or discoverable. Where disclaimers of warranties are not allowed in full or in part, this disclaimer may not apply to You. 78 | b. To the extent possible, in no event will the Licensor be liable to You on any legal theory (including, without limitation, negligence) or otherwise for any direct, special, indirect, incidental, consequential, punitive, exemplary, or other losses, costs, expenses, or damages arising out of this Public License or use of the Licensed Material, even if the Licensor has been advised of the possibility of such losses, costs, expenses, or damages. Where a limitation of liability is not allowed in full or in part, this limitation may not apply to You. 79 | c. The disclaimer of warranties and limitation of liability provided above shall be interpreted in a manner that, to the extent possible, most closely approximates an absolute disclaimer and waiver of all liability. 80 | 81 | Section 6 – Term and Termination. 82 | 83 | a. This Public License applies for the term of the Copyright and Similar Rights licensed here. However, if You fail to comply with this Public License, then Your rights under this Public License terminate automatically. 84 | b. Where Your right to use the Licensed Material has terminated under Section 6(a), it reinstates: 85 | 1. automatically as of the date the violation is cured, provided it is cured within 30 days of Your discovery of the violation; or 86 | 2. upon express reinstatement by the Licensor. 87 | For the avoidance of doubt, this Section 6(b) does not affect any right the Licensor may have to seek remedies for Your violations of this Public License. 88 | c. For the avoidance of doubt, the Licensor may also offer the Licensed Material under separate terms or conditions or stop distributing the Licensed Material at any time; however, doing so will not terminate this Public License. 89 | d. Sections 1, 5, 6, 7, and 8 survive termination of this Public License. 90 | 91 | Section 7 – Other Terms and Conditions. 92 | 93 | a. The Licensor shall not be bound by any additional or different terms or conditions communicated by You unless expressly agreed. 94 | b. Any arrangements, understandings, or agreements regarding the Licensed Material not stated herein are separate from and independent of the terms and conditions of this Public License. 95 | 96 | Section 8 – Interpretation. 97 | 98 | a. For the avoidance of doubt, this Public License does not, and shall not be interpreted to, reduce, limit, restrict, or impose conditions on any use of the Licensed Material that could lawfully be made without permission under this Public License. 99 | b. To the extent possible, if any provision of this Public License is deemed unenforceable, it shall be automatically reformed to the minimum extent necessary to make it enforceable. If the provision cannot be reformed, it shall be severed from this Public License without affecting the enforceability of the remaining terms and conditions. 100 | c. No term or condition of this Public License will be waived and no failure to comply consented to unless expressly agreed to by the Licensor. 101 | d. Nothing in this Public License constitutes or may be interpreted as a limitation upon, or waiver of, any privileges and immunities that apply to the Licensor or You, including from the legal processes of any jurisdiction or authority. -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # 米斯特白帽培训讲义 2 | 3 | > 讲师：[gh0stkey](https://www.zhihu.com/people/gh0stkey/answers) 4 | 5 | > 整理：[飞龙](https://github.com/) 6 | 7 | > 协议：[CC BY-NC-SA 4.0](http://creativecommons.org/licenses/by-nc-sa/4.0/) 8 | 9 | + [在线阅读](https://www.gitbook.com/book/wizardforcel/mst-sec-lecture-notes/details) 10 | + [PDF格式](https://www.gitbook.com/download/pdf/book/wizardforcel/mst-sec-lecture-notes) 11 | + [EPUB格式](https://www.gitbook.com/download/epub/book/wizardforcel/mst-sec-lecture-notes) 12 | + [MOBI格式](https://www.gitbook.com/download/mobi/book/wizardforcel/mst-sec-lecture-notes) 13 | + [代码仓库](https://github.com/wizardforcel/mst-sec-lecture-notes) 14 | 15 | ## 更新历史 16 | 17 | | 版本 | 日期 | 内容 | 18 | | --- | --- | --- | 19 | | v1.6 | 2017.3.14 | 米斯特第二期视频实战篇内容 | 20 | | v1.5 | 2017.3.9 | 米斯特第二期视频基础篇内容 | 21 | | v1.1 | 2017.1.3 | 增加参考链接 | 22 | | v1.0 | 2016.12.27 | 米斯特第一期视频全部内容 | -------------------------------------------------------------------------------- /SUMMARY.md: -------------------------------------------------------------------------------- 1 | + [信息收集](信息收集.md) 2 | + [漏洞篇 CSRF](漏洞篇 CSRF.md) 3 | + [漏洞篇 SQL注入](漏洞篇 SQL注入.md) 4 | + [漏洞篇 SSRF](漏洞篇 SSRF.md) 5 | + [漏洞篇 XSS](漏洞篇 XSS.md) 6 | + [漏洞篇 代码执行](漏洞篇 代码执行.md) 7 | + [漏洞篇 第三方风险](漏洞篇 第三方风险.md) 8 | + [漏洞篇 弱口令、爆破、遍历](漏洞篇 弱口令.md) 9 | + [漏洞篇 提权](漏洞篇 提权.md) 10 | + [漏洞篇 文件上传](漏洞篇 文件上传.md) 11 | + [漏洞篇 文件包含](漏洞篇 文件包含.md) 12 | + [漏洞篇 越权](漏洞篇 越权.md) 13 | + [漏洞篇 中间件](漏洞篇 中间件.md) 14 | + [漏洞篇 逻辑漏洞](漏洞篇 逻辑漏洞.md) 15 | + [工具篇 Safe3 WVS](工具篇 Safe3 WVS.md) 16 | + [工具篇 Nmap](工具篇 Nmap.md) 17 | + [工具篇 BruteXSS](工具篇 BruteXSS.md) 18 | + [工具篇 AWVS](工具篇 AWVS.md) 19 | + [实战篇 WordPress](实战篇 WordPress.md) 20 | + [实战篇 南方 0day](实战篇 南方 0day.md) 21 | + [实战篇 余闻同学录](实战篇 余闻同学录.md) 22 | + [实战篇 迅雷 CMS](实战篇 迅雷 CMS.md) 23 | + [实战篇 捷达系统](实战篇 捷达系统.md) 24 | -------------------------------------------------------------------------------- /styles/ebook.css: -------------------------------------------------------------------------------- 1 | /* GitHub stylesheet for MarkdownPad (http://markdownpad.com) */ 2 | /* Author: Nicolas Hery - http://nicolashery.com */ 3 | /* Version: b13fe65ca28d2e568c6ed5d7f06581183df8f2ff */ 4 | /* Source: https://github.com/nicolahery/markdownpad-github */ 5 | 6 | /* RESET 7 | =============================================================================*/ 8 | 9 | html, body, div, span, applet, object, iframe, h1, h2, h3, h4, h5, h6, p, blockquote, pre, a, abbr, acronym, address, big, cite, code, del, dfn, em, img, ins, kbd, q, s, samp, small, strike, strong, sub, sup, tt, var, b, u, i, center, dl, dt, dd, ol, ul, li, fieldset, form, label, legend, table, caption, tbody, tfoot, thead, tr, th, td, article, aside, canvas, details, embed, figure, figcaption, footer, header, hgroup, menu, nav, output, ruby, section, summary, time, mark, audio, video { 10 | margin: 0; 11 | padding: 0; 12 | border: 0; 13 | } 14 | 15 | /* BODY 16 | =============================================================================*/ 17 | 18 | body { 19 | font-family: Helvetica, arial, freesans, clean, sans-serif; 20 | font-size: 14px; 21 | line-height: 1.6; 22 | color: #333; 23 | background-color: #fff; 24 | padding: 20px; 25 | max-width: 960px; 26 | margin: 0 auto; 27 | } 28 | 29 | body>*:first-child { 30 | margin-top: 0 !important; 31 | } 32 | 33 | body>*:last-child { 34 | margin-bottom: 0 !important; 35 | } 36 | 37 | /* BLOCKS 38 | =============================================================================*/ 39 | 40 | p, blockquote, ul, ol, dl, table, pre { 41 | margin: 15px 0; 42 | } 43 | 44 | /* HEADERS 45 | =============================================================================*/ 46 | 47 | h1, h2, h3, h4, h5, h6 { 48 | margin: 20px 0 10px; 49 | padding: 0; 50 | font-weight: bold; 51 | -webkit-font-smoothing: antialiased; 52 | } 53 | 54 | h1 tt, h1 code, h2 tt, h2 code, h3 tt, h3 code, h4 tt, h4 code, h5 tt, h5 code, h6 tt, h6 code { 55 | font-size: inherit; 56 | } 57 | 58 | h1 { 59 | font-size: 24px; 60 | border-bottom: 1px solid #ccc; 61 | color: #000; 62 | } 63 | 64 | h2 { 65 | font-size: 18px; 66 | color: #000; 67 | } 68 | 69 | h3 { 70 | font-size: 14px; 71 | } 72 | 73 | h4 { 74 | font-size: 14px; 75 | } 76 | 77 | h5 { 78 | font-size: 14px; 79 | } 80 | 81 | h6 { 82 | color: #777; 83 | font-size: 14px; 84 | } 85 | 86 | body>h2:first-child, body>h1:first-child, body>h1:first-child+h2, body>h3:first-child, body>h4:first-child, body>h5:first-child, body>h6:first-child { 87 | margin-top: 0; 88 | padding-top: 0; 89 | } 90 | 91 | a:first-child h1, a:first-child h2, a:first-child h3, a:first-child h4, a:first-child h5, a:first-child h6 { 92 | margin-top: 0; 93 | padding-top: 0; 94 | } 95 | 96 | h1+p, h2+p, h3+p, h4+p, h5+p, h6+p { 97 | margin-top: 10px; 98 | } 99 | 100 | /* LINKS 101 | =============================================================================*/ 102 | 103 | a { 104 | color: #4183C4; 105 | text-decoration: none; 106 | } 107 | 108 | a:hover { 109 | text-decoration: underline; 110 | } 111 | 112 | /* LISTS 113 | =============================================================================*/ 114 | 115 | ul, ol { 116 | padding-left: 30px; 117 | } 118 | 119 | ul li > :first-child, 120 | ol li > :first-child, 121 | ul li ul:first-of-type, 122 | ol li ol:first-of-type, 123 | ul li ol:first-of-type, 124 | ol li ul:first-of-type { 125 | margin-top: 0px; 126 | } 127 | 128 | ul ul, ul ol, ol ol, ol ul { 129 | margin-bottom: 0; 130 | } 131 | 132 | dl { 133 | padding: 0; 134 | } 135 | 136 | dl dt { 137 | font-size: 14px; 138 | font-weight: bold; 139 | font-style: italic; 140 | padding: 0; 141 | margin: 15px 0 5px; 142 | } 143 | 144 | dl dt:first-child { 145 | padding: 0; 146 | } 147 | 148 | dl dt>:first-child { 149 | margin-top: 0px; 150 | } 151 | 152 | dl dt>:last-child { 153 | margin-bottom: 0px; 154 | } 155 | 156 | dl dd { 157 | margin: 0 0 15px; 158 | padding: 0 15px; 159 | } 160 | 161 | dl dd>:first-child { 162 | margin-top: 0px; 163 | } 164 | 165 | dl dd>:last-child { 166 | margin-bottom: 0px; 167 | } 168 | 169 | /* CODE 170 | =============================================================================*/ 171 | 172 | pre, code, tt { 173 | font-size: 12px; 174 | font-family: Consolas, "Liberation Mono", Courier, monospace; 175 | } 176 | 177 | code, tt { 178 | margin: 0 0px; 179 | padding: 0px 0px; 180 | white-space: nowrap; 181 | border: 1px solid #eaeaea; 182 | background-color: #f8f8f8; 183 | border-radius: 3px; 184 | } 185 | 186 | pre>code { 187 | margin: 0; 188 | padding: 0; 189 | white-space: pre; 190 | border: none; 191 | background: transparent; 192 | } 193 | 194 | pre { 195 | background-color: #f8f8f8; 196 | border: 1px solid #ccc; 197 | font-size: 13px; 198 | line-height: 19px; 199 | overflow: auto; 200 | padding: 6px 10px; 201 | border-radius: 3px; 202 | } 203 | 204 | pre code, pre tt { 205 | background-color: transparent; 206 | border: none; 207 | } 208 | 209 | kbd { 210 | -moz-border-bottom-colors: none; 211 | -moz-border-left-colors: none; 212 | -moz-border-right-colors: none; 213 | -moz-border-top-colors: none; 214 | background-color: #DDDDDD; 215 | background-image: linear-gradient(#F1F1F1, #DDDDDD); 216 | background-repeat: repeat-x; 217 | border-color: #DDDDDD #CCCCCC #CCCCCC #DDDDDD; 218 | border-image: none; 219 | border-radius: 2px 2px 2px 2px; 220 | border-style: solid; 221 | border-width: 1px; 222 | font-family: "Helvetica Neue",Helvetica,Arial,sans-serif; 223 | line-height: 10px; 224 | padding: 1px 4px; 225 | } 226 | 227 | /* QUOTES 228 | =============================================================================*/ 229 | 230 | blockquote { 231 | border-left: 4px solid #DDD; 232 | padding: 0 15px; 233 | color: #777; 234 | } 235 | 236 | blockquote>:first-child { 237 | margin-top: 0px; 238 | } 239 | 240 | blockquote>:last-child { 241 | margin-bottom: 0px; 242 | } 243 | 244 | /* HORIZONTAL RULES 245 | =============================================================================*/ 246 | 247 | hr { 248 | clear: both; 249 | margin: 15px 0; 250 | height: 0px; 251 | overflow: hidden; 252 | border: none; 253 | background: transparent; 254 | border-bottom: 4px solid #ddd; 255 | padding: 0; 256 | } 257 | 258 | /* TABLES 259 | =============================================================================*/ 260 | 261 | table th { 262 | font-weight: bold; 263 | } 264 | 265 | table th, table td { 266 | border: 1px solid #ccc; 267 | padding: 6px 13px; 268 | } 269 | 270 | table tr { 271 | border-top: 1px solid #ccc; 272 | background-color: #fff; 273 | } 274 | 275 | table tr:nth-child(2n) { 276 | background-color: #f8f8f8; 277 | } 278 | 279 | /* IMAGES 280 | =============================================================================*/ 281 | 282 | img { 283 | max-width: 100% 284 | } -------------------------------------------------------------------------------- /信息收集.md: -------------------------------------------------------------------------------- 1 | # 米斯特白帽培训讲义 信息收集 2 | 3 | > 讲师：[gh0stkey](https://www.zhihu.com/people/gh0stkey/answers) 4 | 5 | > 整理：[飞龙](https://github.com/) 6 | 7 | > 协议：[CC BY-NC-SA 4.0](http://creativecommons.org/licenses/by-nc-sa/4.0/) 8 | 9 | ## 收集什么？ 10 | 11 | + Whois信息 12 | + 注册人名字、邮箱等 13 | + IP信息（服务器的IP） 14 | + 判断是否为CDN节点，查询同IP网站，端口扫描 15 | + 目录信息 16 | + 判断WEB应用，获取网站后台目录，获取其他 17 | + 服务信息 18 | + 判断服务，例如：IIS、Apache 19 | + 脚本信息 20 | + ASP、PHP、`aspx`（asp.net） 21 | + 框架信息 22 | + ThinkPHP、Struts等 23 | + 应用信息 24 | + 应用，dedecms、phpcms等 25 | + 子域名信息 26 | + `xxx.xx.com` `xxx.xxx.xx.com` 27 | 28 | ## WHOIS 29 | 30 | 查询工具：。 31 | 32 | ![](http://upload-images.jianshu.io/upload_images/118142-1c7b586d8712b0c3.jpg) 33 | 34 | ## IP 信息 35 | 36 | 我们可以`ping`某个 URL： 37 | 38 | ``` 39 | C:\Users\asus> ping www.hi-ourlife.com 40 | 41 | 正在 Ping www.hi-ourlife.com.cname.yunjiasu-cdn.net [162.159.209.78] 具有 32 字节的数据: 42 | 来自 162.159.209.78 的回复: 字节=32 时间=215ms TTL=52 43 | 来自 162.159.209.78 的回复: 字节=32 时间=217ms TTL=52 44 | 来自 162.159.209.78 的回复: 字节=32 时间=218ms TTL=52 45 | 来自 162.159.209.78 的回复: 字节=32 时间=222ms TTL=52 46 | 47 | 162.159.209.78 的 Ping 统计信息: 48 | 数据包: 已发送 = 4，已接收 = 4，丢失 = 0 (0% 丢失)， 49 | 往返行程的估计时间(以毫秒为单位): 50 | 最短 = 215ms，最长 = 222ms，平均 = 218ms 51 | ``` 52 | 53 | 但显然，这里的 IP 是 CDN 的 IP。 54 | 55 | 我们可以使用[多地`ping`工具](http://ping.chinaz.com/)来判断： 56 | 57 | ![](http://upload-images.jianshu.io/upload_images/118142-b7fd315deb05b0d1.jpg) 58 | 59 | 一般来说，使用了 CDN 的网站在不同地点的`ping`结果是不一样的。不过这里它直接写出了百度云加速节点。 60 | 61 | 那么如何找出源站 IP 呢？ 62 | 63 | 1. 查询子域：许多情况下只有主站使用了 CDN，二级站点并没有，所以我们就可以直接查询分站的 IP。分站的搜索方法见下文。 64 | 65 | 2. 国内部分 CDN 服务只针对国内，对国外的访问几乎不使用 CDN。所以我们可以通过国外冷门 DNS 查询域名。比如，`nslookup xxx.com 199.89.126.10`。 66 | 67 | ``` 68 | C:\Users\asus\Desktop> nslookup hi-ourlife.com 199.89.126.10 69 | 服务器: UnKnown 70 | Address: 199.89.126.10 71 | 72 | 非权威应答： 73 | 名称： hi-ourlife.com 74 | Address: 45.64.65.85 75 | ``` 76 | 77 | 3. 历史解析记录：CDN 的 IP 地址之前所用的 IP 就是真实 IP。 78 | 79 | 80 | 81 | 4. 查询邮件：很多服务器自带邮件发送功能，可以利用它来获取真实 IP。让站点主动发送邮件，然后右键查询源代码，就能获得真实 IP。 82 | 83 | ![](http://upload-images.jianshu.io/upload_images/118142-b996296eb07396c1.jpg) 84 | 85 | ![](http://upload-images.jianshu.io/upload_images/118142-c3aab1ecd7b22f58.jpg) 86 | 87 | 这个工具可以检测旁站：。 88 | 89 | 端口扫描可以使用 Nmap 进行，请见“工具篇 Nmap”一节。 90 | 91 | ## 目录信息 92 | 93 | 1. 主动式扫描：爬虫、暴力破解 94 | 95 | + AVWS：根据站点的链接（见“工具篇 AVWS”一节） 96 | + [御剑](http://www.jb51.net/softs/43405.html)：根据固定的字典 97 | 98 | ![](http://upload-images.jianshu.io/upload_images/118142-47f1a9b882580ca9.jpg) 99 | 100 | 2. 被动式扫描：Burp Spider 101 | 102 | 3. Google Hack 103 | 104 | + `intitle`：搜索网页标题中包含有特定字符的网页 105 | + `inurl`：搜索包含有特定字符的 URL 106 | + `intext`：搜索网页正文内容中的指定字符 107 | + `filetype`：搜索指定类型的文件 108 | + `site`：搜索与指定网站有联系的 URL 109 | 110 | 4. `robots.txt`（补充） 111 | 112 | 重点看`Disallow`的部分。 113 | 114 | ![](http://upload-images.jianshu.io/upload_images/118142-fc60c300fddf9f27.jpg) 115 | 116 | 5. 联网设备搜索 117 | 118 | + 钟馗之眼`www.zoomeye.com`。 119 | + 傻蛋`www.oshadan.com`。 120 | 121 | 联网设备搜索引擎可以检索到许多搜索引擎不收录的页面，通常是后台等页面。 122 | 123 | 构造检索关键词时： 124 | 125 | + 系统/后台类，可以搜索“xxx系统/平台/管理”。 126 | + 企业类，可以搜索“xxx企业/公司/平台”。 127 | 128 | 比如我们要挖电信的系统，可以搜索“电信系统/平台/管理”。 129 | 130 | 这里使用傻蛋这个平台演示一下，它不仅仅能监控系统，还能搜索到一些内网的系统。比如我们要挖一些电信系统，这里点击全网搜索，可以看到很多外网看不到的内部系统。 131 | 132 | ![](http://ww3.sinaimg.cn/large/841aea59jw1fasglfymq5j217w0jlta8.jpg) 133 | 134 | ![](http://ww3.sinaimg.cn/large/841aea59jw1fasglm7pp2j217y0ke766.jpg) 135 | 136 | 我们点击其中一个“汕尾用电监控系统”，可以看到详细的用电情况，这个就属于一种越权或者绕过。 137 | 138 | ![](http://ww1.sinaimg.cn/large/841aea59jw1fasgo1c3s0j21d80gzwgb.jpg) 139 | 140 | ## 服务信息 141 | 142 | 查看返回的数据包的`Server`头，获取`Server`信息。如`Server:Microsoft-IIS/6.0`。 143 | 144 | ``` 145 | GET / HTTP/1.1 146 | Host: www.hi-ourlife.com 147 | User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0 148 | Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 149 | Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3 150 | Accept-Encoding: gzip, deflate 151 | Cookie: __cfduid=d85643dc07ab45d17ec48c37dde7145d11480308480; PHPSESSID=qfg2unrqvc1adhvcpn8ejhguqulakcd2; CNZZDATA1258769653=1514150716-1480308628-%7C1480308628; timezone=8 152 | X-Forwarded-For: 127.0.0.1 153 | Connection: keep-alive 154 | Upgrade-Insecure-Requests: 1 155 | 156 | HTTP/1.1 200 OK 157 | Date: Mon, 28 Nov 2016 05:43:11 GMT 158 | Content-Type: text/html; charset=utf-8 159 | Transfer-Encoding: chunked 160 | Connection: keep-alive 161 | Product: Z-BlogPHP 1.5 Zero 162 | Expires: Thu, 19 Nov 1981 08:52:00 GMT 163 | Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 164 | Pragma: no-cache 165 | Vary: Accept-Encoding 166 | Server: yunjiasu-nginx 167 | CF-RAY: 308b8035114c226a-LAX 168 | Content-Encoding: gzip 169 | ``` 170 | 171 | 这个封包告诉我们服务器是 Nginx。 172 | 173 | ## 脚本信息 174 | 175 | 1. 查看返回的数据包中的`X-Powered-By`的值 176 | 177 | 2. 查看cookie中的信息 178 | 179 | ``` 180 | PHPSESSID 181 | ASPSESSID 182 | ``` 183 | 184 | 比如上面的封包中出现了`PHPSESSID`，说明站点很可能使用 PHP 编写。 185 | 186 | ## 框架信息 187 | 188 | 通过报错信息或是URL结构获取网站使用的框架信息。如ThinkPHP，Struts等。 189 | 190 | ## 应用信息 191 | 192 | 目录特征、文件特征、指纹扫描工具、网站特征等。 193 | 194 | 比如存在`wp-login.php`就可能是 WordPress。 195 | 196 | ## 子域名信息 197 | 198 | + [子域名挖掘机](http://www.cnseay.com/3590/comment-page-1/) 199 | 200 | ![](http://www.cnseay.com/wp-content/uploads/2013/12/20131222225752_14855.jpg) 201 | 202 | + 搜素引擎：`site:*.xxx.com` 203 | 204 | ## 个人信息 205 | 206 | [社会工程学](http://baike.baidu.com/item/%E7%A4%BE%E4%BC%9A%E5%B7%A5%E7%A8%8B%E5%AD%A6)：使人们顺从你的意愿、满足你的欲望的一门艺术与学问。 207 | 208 | QQ 空间人肉方法的思维导图： 209 | 210 | ![](http://upload-images.jianshu.io/upload_images/118142-e8476231a7994b74.png) 211 | 212 | ![](http://upload-images.jianshu.io/upload_images/118142-dc6d04e58a39a844.png?) 213 | 214 | ## 附录 215 | 216 | + [信息安全泄露只在一念之间(一)企鹅扣扣](https://zhuanlan.zhihu.com/p/23635061) 217 | 218 | + [社工研究组文集](https://pan.baidu.com/share/link?shareid=2318908755&uk=1947372036&fid=74383462672650) 219 | 220 | + [Kali Linux 秘籍 第四章 信息收集](http://www.jianshu.com/p/366e00c32d2b) 221 | 222 | + [Kali Linux Web 渗透测试秘籍 第二章 侦查](http://www.jianshu.com/p/ad77b3af8651) 223 | -------------------------------------------------------------------------------- /实战篇 WordPress.md: -------------------------------------------------------------------------------- 1 | # 米斯特白帽培训讲义 实战篇 WordPress 2 | 3 | > 讲师：[gh0stkey](https://www.zhihu.com/people/gh0stkey/answers) 4 | 5 | > 整理：[飞龙](https://github.com/) 6 | 7 | > 协议：[CC BY-NC-SA 4.0](http://creativecommons.org/licenses/by-nc-sa/4.0/) 8 | 9 | 目标是`http://hzwer.com`。 10 | 11 | 首先有学员社到了他的个人信息和老密码： 12 | 13 | ![](http://ww2.sinaimg.cn/large/841aea59jw1fb49qrkkcoj20wo09eq3o.jpg) 14 | 15 | 然后我们利用`www.caimima.net`这个网站来生成字典。 16 | 17 | 我们在“姓名简拼”中输入“hzw”，“英文名”中输入“hzwer”，姓名全拼中输入“huangzhewen”，“QQ 号”中输入“598460606”，“历史密码”中输入“286300346”。 18 | 19 | ![](http://ww2.sinaimg.cn/large/841aea59jw1fb49qun93bj20w90e9q3i.jpg) 20 | 21 | 然后点击提交： 22 | 23 | ![](http://ww3.sinaimg.cn/large/841aea59jw1fb49qx5wroj20wn0dy3zf.jpg) 24 | 25 | 然后点击查看更多： 26 | 27 | ![](http://ww2.sinaimg.cn/large/841aea59jw1fb49qzxycqj20iw0rtjso.jpg) 28 | 29 | 把这个东西保存为`hzwer.txt`。 30 | 31 | 然后他的网站是 WordPress 程序，登录页面是`wp-login.php`，直接访问它。我们尝试为用户名输入`admin`，密码随便输入然后提交： 32 | 33 | ![](http://ww1.sinaimg.cn/large/841aea59jw1fb49r2guyrj20h40jddg7.jpg) 34 | 35 | 显示“为用户名`admin`指定的密码不正确”，说明用户名`admin`是存在的。 36 | 37 | 38 | 接下来要爆破密码，打开 Burp 抓包： 39 | 40 | ![](http://ww2.sinaimg.cn/large/841aea59jw1fb49r5zewhj20yr0l2ad8.jpg) 41 | 42 | 发送到 Intruder，进行爆破。选择之前保存的字典： 43 | 44 | http://ww2.sinaimg.cn/large/841aea59jw1fb49r8kmxnj20ye0r576g.jpg 45 | 46 | 爆破成功之后，登录后台，鼠标移动到左侧的“插件”，然后点击“安装插件”： 47 | 48 | ![](http://ww4.sinaimg.cn/large/841aea59jw1fb49rbmoebj20f90ridh3.jpg) 49 | 50 | 在之后的页面中点击“上传插件”。 51 | 52 | ![](http://ww2.sinaimg.cn/large/841aea59jw1fb49rg2wspj20ih0ff74y.jpg) 53 | 54 | 我们把一句话写入`a.php`，将它压缩为`b.zip`。然后在上传页面处选择该文件后，点击“现在安装”： 55 | 56 | ![](http://ww2.sinaimg.cn/large/841aea59jw1fb49rj6sygj21190arglr.jpg) 57 | 58 | WebShell 上传到了`/wp-content/upgrade/b/a.php`。拿菜刀连接便可成功拿到 Shell。 59 | 60 | ![](http://ww4.sinaimg.cn/large/841aea59jw1fb49rp21r6j20zc0j5abc.jpg) 61 | -------------------------------------------------------------------------------- /实战篇 余闻同学录.md: -------------------------------------------------------------------------------- 1 | # 米斯特白帽培训讲义 实战篇 余闻同学录 2 | 3 | > 讲师：[gh0stkey](https://www.zhihu.com/people/gh0stkey/answers) 4 | 5 | > 整理：[飞龙](https://github.com/) 6 | 7 | > 协议：[CC BY-NC-SA 4.0](http://creativecommons.org/licenses/by-nc-sa/4.0/) 8 | 9 | ## 站点搜索 10 | 11 | 百度关键词搜索： 12 | 13 | ![](http://upload-images.jianshu.io/upload_images/118142-7c8da316b22ae82a.jpg) 14 | 15 | ## 源码下载 16 | 17 | http://download.csdn.net/download/u012513463/9701150 18 | 19 | 目录结构是这样的： 20 | 21 | ![](http://upload-images.jianshu.io/upload_images/118142-a1511817c790f5a7.png) 22 | 23 | ## 弱密码 24 | 25 | 安装之后会弹出以下界面： 26 | 27 | ![](http://upload-images.jianshu.io/upload_images/118142-b79d2bf33839d4f1.png) 28 | 29 | 得知弱密码为`admin:123456`。 30 | 31 | ## 信息泄露 32 | 33 | 我们在目录中搜索 SQL： 34 | 35 | ![](http://upload-images.jianshu.io/upload_images/118142-4cc200674b00b8ca.jpg) 36 | 37 | 看到了`/install/install/sql`文件。我们随便找个站点试验一下： 38 | 39 | ![](http://upload-images.jianshu.io/upload_images/118142-6a1a7271600f2a49.jpg) 40 | 41 | 是可以访问的。 42 | 43 | ## 文件上传 44 | 45 | 进入后台，有两个上传点：界面管理和相册管理： 46 | 47 | ![](http://upload-images.jianshu.io/upload_images/118142-a8dc09c6a4133280.jpg) 48 | 49 | 我们挑选相册管理来演示。首先随便上传一个 PHP 文件： 50 | 51 | ![](http://upload-images.jianshu.io/upload_images/118142-4abb65eeea78e59c.jpg) 52 | 53 | 显示“文件类型不符”，然后显示了文件的类型。我们的猜测程序根据类型来判断，而前面说过类型是可以随便修改的（见“文件上传”一章）。我们用 Burp 抓取这个请求，把类型改为`image/jpg`，然后放行。 54 | 55 | ![](http://upload-images.jianshu.io/upload_images/118142-b32b866dfd91c7b3.jpg) 56 | 57 | 我们可以看到上传成功： 58 | 59 | ![](http://upload-images.jianshu.io/upload_images/118142-dfe997c3632c8682.jpg) 60 | 61 | 然后我们用菜刀连接一下，注意文件名称前面有两个点，表示上级目录，所以真实路径是`/photos/1480440169.php`： 62 | 63 | ![](http://upload-images.jianshu.io/upload_images/118142-ac13c9bed828ee08.jpg) 64 | 65 | ![](http://upload-images.jianshu.io/upload_images/118142-238bd3116cded2e8.jpg) 66 | 67 | 我们下面来看看源码，`/home/xcgl.php`第 47 行： 68 | 69 | ```php 70 | //上传文件类型列表 71 | $uptypes=array( 72 | 'image/jpg', 73 | 'image/jpeg', 74 | 'image/png', 75 | 'image/pjpeg', 76 | 'image/gif', 77 | 'image/bmp', 78 | 'image/x-png' 79 | ); 80 | ``` 81 | 82 | 发现这是类型列表，再往下看，221 行： 83 | 84 | 85 | ```php 86 | if(!in_array($file["type"], $uptypes)) 87 | //检查文件类型 88 | { 89 | echo "文件类型不符!".file["type"]; 90 | exit; 91 | } 92 | ``` 93 | 94 | 它对文件类型进行了校验，但除此之外没有别的校验了，所以这里存在文件上传漏洞。 95 | -------------------------------------------------------------------------------- /实战篇 南方 0day.md: -------------------------------------------------------------------------------- 1 | # 米斯特白帽培训讲义 实战篇 南方 0day 2 | 3 | > 讲师：[gh0stkey](https://www.zhihu.com/people/gh0stkey/answers) 4 | 5 | > 整理：[飞龙](https://github.com/) 6 | 7 | > 协议：[CC BY-NC-SA 4.0](http://creativecommons.org/licenses/by-nc-sa/4.0/) 8 | 9 | ## 搜索 10 | 11 | 关键词：`inurl:"HomeMarket.asp"`。 12 | 13 | ## 下载与部署 14 | 15 | http://www.jb51.net/article/5336.htm 16 | 17 | ## SQL 注入 18 | 19 | 我们打算检测其中的 SQL 注入漏洞，由于 ASP 代码基本没有什么好的过滤，一般一查一个准。为了搜索 SQL 注入漏洞，我们可以使用`sql`、`conn`这类名称、或者`execute`这类函数来定位到数据库查询低吗位置。 20 | 21 | 比如在`NewsType.asp`的 14 ~ 32 行，我们发现了： 22 | 23 | ```asp 24 | 25 | <% 26 | ' ... 27 | BigClass=request("BigClass") 28 | SmallClass=request("SmallClass") 29 | ' ... 30 | %> 31 | <% 32 | if BigClass<>"" and SmallClass<>"" then 33 | sql="select * from News where BigClassName='"& BigClass &"' and SmallClassName='"& SmallClass &"' order by AddDate desc" 34 | set rs=conn.execute(sql) 35 | do while not rs.eof 36 | %> 37 | ``` 38 | 39 | 我们看到这是文本型的参数，也就是说我们注入的时候要想办法闭合单引号。而且它用的是 Access 数据库，我们没办法像 MySQL 和 SQLServer 那样使用`--`来注释。 40 | 41 | 我们照旧为`SmallClass`输入`' and '1'='1`，构造的 URL 为`NewsType.asp?SmallClass=%27%20and%20%271%27=%271`，发现正常。 42 | 43 | ![](http://ww3.sinaimg.cn/large/841aea59jw1fb46h33bq8j20vm07qwfu.jpg) 44 | 45 | 输入`' and '1'='2`，构造的 URL 为`NewsType.asp?SmallClass=%27%20and%20%271%27=%272`，发现错误。 46 | 47 | ![](http://ww1.sinaimg.cn/large/841aea59jw1fb46jsnmdmj20vp066q39.jpg) 48 | 49 | 接下来我们查看源码目录下的`Databases/0791idc.mdb`，知道了`News`表一共有十个字段。 50 | 51 | 之后输入`' and 1=2 union select 1,2,3,4,5,6,7,8,9,0 from admin where '1'='1`，发现显示 2 和 9： 52 | 53 | ![](http://ww3.sinaimg.cn/large/841aea59jw1fb46jvpacxj20vo059dgj.jpg) 54 | 55 | 之后就很简单了，我们先看看`admin`表里面的用户名和密码都叫做啥。我们把 2 替换为`username`，9 替换为`password`。 56 | 57 | ![](http://ww1.sinaimg.cn/large/841aea59jw1fb46jzq1evj20w205l3za.jpg) 58 | 59 | 然后把`f3a976c77dc7264c`送到 pmd5 解密，结果为`060618`。 60 | 61 | 之后可以从`/admin`访问后台，登录并继续拿 WebShell。 62 | 63 | ## XSS 64 | 65 | 我们点击网站右上角的“联系我们”，可以发现这个页面的 URL 中出现了这四个字，页面中也出现了这四个字。 66 | 67 | ![](http://ww2.sinaimg.cn/large/841aea59jw1fb46k305u5j20v70gcdhm.jpg) 68 | 69 | 然后我们把 URL 中的`Title`参数改成`1`： 70 | 71 | ![](http://ww3.sinaimg.cn/large/841aea59jw1fb46k5xrwij20v90cidh9.jpg) 72 | 73 | 这就提示我们这里面可能会出现 XSS，我们改成``： 74 | 75 | ![](http://ww2.sinaimg.cn/large/841aea59jw1fb46k8imfgj20hc08mq3b.jpg) 76 | 77 | 我们看到源代码中出现了这个东西。 78 | 79 | ## 附录 80 | 81 | + [黑帽百科：2.2 常见 0day](http://www.xiaoshuwu.net/black-hat-seo/) 82 | -------------------------------------------------------------------------------- /实战篇 捷达系统.md: -------------------------------------------------------------------------------- 1 | # 米斯特白帽培训讲义 实战篇 捷达系统 2 | 3 | > 讲师：[gh0stkey](https://www.zhihu.com/people/gh0stkey/answers) 4 | 5 | > 整理：[飞龙](https://github.com/) 6 | 7 | > 协议：[CC BY-NC-SA 4.0](http://creativecommons.org/licenses/by-nc-sa/4.0/) 8 | 9 | ## 概述 10 | 11 | 官网：http://www.jeedaa.com/ 12 | 13 | 主要产品有： 14 | 15 | + 捷达ERP 16 | + 捷达OA 17 | + 捷达eHR 18 | + 捷达CRM 19 | + 捷达eFax 20 | + 捷达仓库管理 21 | + 捷达进销存.Net 22 | + 捷达协同办公.Net 23 | 24 | 均存在能够 GetShell 的漏洞。 25 | 26 | 这个东西仍旧是闭源的，我们使用它的演示站点，`http://demoerp.jeedaa.com`来进行演示。 27 | 28 | ## 文件上传 29 | 30 | 我们用御剑扫一扫。 31 | 32 | ![](http://upload-images.jianshu.io/upload_images/118142-d8fcd807922e4128.jpg) 33 | 34 | 出现了 FCKEditer。我们访问`/fckeditor`，发现是 403 的。 35 | 36 | ![](http://upload-images.jianshu.io/upload_images/118142-5919fdb9bf38ea9f.jpg) 37 | 38 | 但是我们扫描`/fckeditor/fckeditor`： 39 | 40 | ![](http://upload-images.jianshu.io/upload_images/118142-c2310e91858835b6.jpg) 41 | 42 | 发现有三个 200。我们访问`/fckeditor/fckeditor/editor/filemanager/upload/test.html`： 43 | 44 | ![](http://upload-images.jianshu.io/upload_images/118142-9a9f51512969e688.jpg) 45 | 46 | 我们在查看元素里面添加一个 ASPX，然后随便上传一个 ASP 文件上去。获得了该文件的链接。 47 | 48 | ![](http://upload-images.jianshu.io/upload_images/118142-c126182c7b98a75e.jpg) 49 | 50 | ![](http://upload-images.jianshu.io/upload_images/118142-ceaba8d857552e53.jpg) 51 | 52 | 部分案例（均为捷达的演示站点）： 53 | 54 | + `http://erp2008v4.jeedaa.com/fckeditor/FCKeditor/editor/filemanager/upload/test.html` 55 | + `http://erp.jeedaa.com/fckeditor/FCKeditor/editor/filemanager/upload/test.html` 56 | + `http://qd.jeedaa.net//fckeditor/FCKeditor/editor/filemanager/upload/test.html` 57 | + `http://oa.jeedaa.com/fckeditor/FCKeditor/editor/filemanager/upload/test.html` 58 | + `http://demoerp.jeedaa.com/fckeditor/FCKeditor/editor/filemanager/upload/test.html` 59 | + `http://crm.jeedaa.com/fckeditor/FCKeditor/editor/filemanager/upload/test.html` 60 | + `http://shijia.jeedaa.com/fckeditor/FCKeditor/editor/filemanager/upload/test.html` 61 | + `http://lg.jeedaa.com/fckeditor/FCKeditor/editor/filemanager/upload/test.html` 62 | + `http://hj.jeedaa.com/fckeditor/FCKeditor/editor/filemanager/upload/test.html` 63 | 64 | ## 目录遍历 65 | 66 | 访问`/fckeditor/FCKeditor/editor/filemanager/browser/default/connectors/aspx/connector.aspx?Command=GetFoldersAndFiles&Type=E:/&CurrentFolder=%2F` 67 | 68 | ![](http://upload-images.jianshu.io/upload_images/118142-eb7ab441926ff035.jpg) 69 | 70 | 可以改动`CurrentFolder`参数来进入子目录，也可以改动`Type`参数来切换盘符。 71 | 72 | ## 文件下载 73 | 74 | 访问`/WebApp/PassportService/download.aspx?p=/AccreditAdmin/Web.config`下载数据库文件： 75 | 76 | ![](http://upload-images.jianshu.io/upload_images/118142-d9e4cd2e61c475cf.png) 77 | 78 | 部分案例： 79 | 80 | + `http://221.136.81.169/WebApp/PassportService/download.aspx?p=web.config` 81 | + `http://61.164.170.82:88/WebApp/PassportService/download.aspx?p=web.config` 82 | + `http://www.nbjyly.com/WebApp/PassportService/download.aspx?p=web.config` 83 | + `http://oa.jobgroup.cn:2013/WebApp/PassportService/download.aspx?p=web.config` 84 | + `http://erp2008v4.jeedaa.com/WebApp/PassportService/download.aspx?p=web.config` 85 | + `http://erp.jeedaa.com/WebApp/PassportService/download.aspx?p=web.config` 86 | + `http://qd.jeedaa.net//WebApp/PassportService/download.aspx?p=web.config` 87 | + `http://61.130.104.162:8080/WebApp/PassportService/download.aspx?p=web.config` 88 | + `http://oa.jeedaa.com/WebApp/PassportService/download.aspx?p=web.config` 89 | + `http://demoerp.jeedaa.com/WebApp/PassportService/download.aspx?p=web.config` 90 | + `http://crm.jeedaa.com/WebApp/PassportService/download.aspx?p=web.config` 91 | + `http://shijia.jeedaa.com/WebApp/PassportService/download.aspx?p=web.config` 92 | + `http://lg.jeedaa.com/WebApp/PassportService/download.aspx?p=web.config` 93 | + `http://hj.jeedaa.com/WebApp/PassportService/download.aspx?p=web.config` 94 | + `http://oa.nbself.com/WebApp/PassportService/download.aspx?p=web.config` 95 | + `http://61.164.170.82:88/WebApp/PassportService/download.aspx?p=web.config` 96 | -------------------------------------------------------------------------------- /实战篇 迅雷 CMS.md: -------------------------------------------------------------------------------- 1 | # 米斯特白帽培训讲义 实战篇 迅雷 CMS 2 | 3 | > 讲师：[gh0stkey](https://www.zhihu.com/people/gh0stkey/answers) 4 | 5 | > 整理：[飞龙](https://github.com/) 6 | 7 | > 协议：[CC BY-NC-SA 4.0](http://creativecommons.org/licenses/by-nc-sa/4.0/) 8 | 9 | ## 站点搜索 10 | 11 | 关键词：`intext:"技术支持:银川迅雷网络公司"` 12 | 13 | 另外这个 CMS 是闭源的，没有找到源码。 14 | 15 | ## Cookie 伪造 16 | 17 | 起因是这样，我们随便找了一个网站，访问后台登录页面（`/admin/login.asp`），然后使用弱密码`admin:admin`进了后台（`/admin/index.asp`），发现 Cookie 有这样一个东西： 18 | 19 | ![](http://upload-images.jianshu.io/upload_images/118142-67074c50fcd99f01.jpg) 20 | 21 | 我们可以看到，用户名称和 ID 是明文保存的。我们猜测，程序根据 Cookie 中的值来判断当前登录用户。于是我们把其中一个删掉，结果退出登录。再次访问后台时返回到了登录页面。 22 | 23 | ![](http://upload-images.jianshu.io/upload_images/118142-a3bcb670d607ed58.jpg) 24 | 25 | 这就说明它的确使用 Cookie 中的值来判断。我们再进行试验，将 Cookie 的两个值重新设置，之后直接访问`/admin/index.asp`： 26 | 27 | ![](http://upload-images.jianshu.io/upload_images/118142-626d398d4a65e851.jpg) 28 | 29 | 成功进入后台。 30 | 31 | -------------------------------------------------------------------------------- /工具篇 AWVS.md: -------------------------------------------------------------------------------- 1 | # 米斯特白帽培训讲义 工具篇 AWVS 2 | 3 | > 讲师：[gh0stkey](https://www.zhihu.com/people/gh0stkey/answers) 4 | 5 | > 整理：[飞龙](https://github.com/) 6 | 7 | > 协议：[CC BY-NC-SA 4.0](http://creativecommons.org/licenses/by-nc-sa/4.0/) 8 | 9 | ## 功能 10 | 11 | AWVS 即 Acunetix Web Vulnerability Scanner 是一个网站及服务器漏洞扫描软件。 12 | 13 | ![](http://ww1.sinaimg.cn/large/841aea59jw1faynwuq2u2j20s10j7q54.jpg) 14 | 15 | + 自动的客户端脚本分析器，允许对 Ajax 和 Web 2.0 应用程序进行安全性测试。 16 | + 业内最先进且深入的 SQL 注入和跨站脚本测试 17 | + 高级渗透测试工具，例如 HTTP Editor 和 HTTP Fuzzer 18 | + 可视化宏记录器帮助您轻松测试 web 表格和受密码保护的区域 19 | + 支持含有 CAPTHCA 的页面，单个开始指令和 Two Factor（双因素）验证机制 20 | + 丰富的报告功能，包括 VISA PCI 依从性报告 21 | + 高速的多线程扫描器轻松检索成千上万个页面 22 | + 智能爬行程序检测 web 服务器类型和应用程序语言 23 | + Acunetix 检索并分析网站，包括 flash 内容、SOAP 和 AJAX 24 | + 端口扫描 web 服务器并对在服务器上运行的网络服务执行安全检查 25 | 26 | ## 下载和安装 27 | 28 | 演示中使用的是 AWVS 10 版本，请在[这里](http://www.freebuf.com/sectool/71091.html)下载。 29 | 30 | 安装部分主要分为两个步骤：安装主程序和打破解补丁。这款工具是由吾爱破解亲自操刀来破解的。 31 | 32 | ![](http://ww4.sinaimg.cn/large/841aea59jw1faynwylc7xj20pw066q34.jpg) 33 | 34 | 我们打开安装文件之后，依次点击“下一步”就可以了。 35 | 36 | ![](http://ww1.sinaimg.cn/large/841aea59jw1faynx2518zj20rt0kttaj.jpg) 37 | 38 | 安装完毕之后，打开破解补丁，破解补丁是全自动的，等到出现这个界面，就说明破解完成了。 39 | 40 | ![](http://ww4.sinaimg.cn/large/841aea59jw1faynx59z0tj20j10e5mxr.jpg) 41 | 42 | ## 基本使用 43 | 44 | ![](http://ww2.sinaimg.cn/large/841aea59jw1faynx91hk7j20os0clmxn.jpg) 45 | 46 | 首先，打开程序主界面： 47 | 48 | ![](http://ww3.sinaimg.cn/large/841aea59jw1faynxby5l2j20sv0jsacl.jpg) 49 | 50 | 点击左上角的`Scan`按钮，会弹出一个窗口，我们将其中的`Website URL`改为百度的 URL。这里我们拿百度主页来演示。 51 | 52 | ![](http://ww3.sinaimg.cn/large/841aea59jw1faynxfl2oaj20st0jq0us.jpg) 53 | 54 | 之后我们只需要连续点击下一步，跳过`Option`界面。我们可以看到`Target`界面为我们提供了一些信息，比如服务器版本。我们也可以按需选择服务器所使用的环境。 55 | 56 | ![](http://ww1.sinaimg.cn/large/841aea59jw1faynxis9oaj20o10irmyl.jpg) 57 | 58 | 点击下一步之后，我们来到了`Login`界面，这里我们可以设置登录所需的凭证。我们这里先保留默认。 59 | 60 | ![](http://ww1.sinaimg.cn/large/841aea59jw1faynxneoa8j20nx0ivabo.jpg) 61 | 62 | 再点击下一步，等待一下，然后就开始了。扫描完成之后，我们再来看主界面。 63 | 64 | ![](http://ww3.sinaimg.cn/large/841aea59jw1faynxva2gkj21c40qptci.jpg) 65 | 66 | `Web Alerts`中会提示存在的漏洞。`Site Structure`中会显示站点结构。我们随便选择一个漏洞看一下。它提示了站点中有一个 CSRF 漏洞。 67 | 68 | ![](http://ww4.sinaimg.cn/large/841aea59jw1faynxyf2zoj216x0letbi.jpg) 69 | 70 | 这里就有可能是个误报，虽然 AWVS 很强大，但是误报也是很常见的。大家以后碰到的时候无视它就好了。 71 | 72 | ## 登录后的扫描 73 | 74 | ![](http://ww1.sinaimg.cn/large/841aea59jw1fayny2a5qwj20lt0ex0tf.jpg) 75 | 76 | 就是在`Login`界面的`Form Authentication`分组框中输入所需的Cookie。我们点击旁边的“新建”按钮（一张纸的图标），在弹出来的窗口中登录网站，来创建登录凭证。 77 | 78 | ![](http://ww4.sinaimg.cn/large/841aea59jw1faynype4uqj20zn0pnwg0.jpg) 79 | 80 | 登录完毕之后点击右下角的`Finish`，然后会弹出来一个文件选择框，保存文件即可。 81 | 82 | ![](http://ww4.sinaimg.cn/large/841aea59jw1faynyvhgyjj217h0qqn00.jpg) 83 | 84 | 之后我们点击旁边的“打开”按钮（文件夹的图标），选择刚刚保存的文件，并点击`Next`。这样我们就能执行登录状态下的扫描了。 85 | 86 | ## 批量扫描 87 | 88 | 思路来自：。 89 | 90 | 利用 AWVS 会采集目标站点的外链的特点，达到批量扫描的效果。 91 | 92 | ![](http://ww1.sinaimg.cn/large/841aea59jw1faynz1ggxyj21220g0q5a.jpg) 93 | 94 | 比如，我们可以创建一个 HTML 文件，里面包含要扫描的全部链接，比如我们要扫描谷歌、百度、优酷以及其他网站，我们就可以新建一个`4.html`，内容为： 95 | 96 | ```html 97 | test 98 | test 99 | test 100 | ... 101 | ``` 102 | 103 | 然后将这个页面在本地部署，假设，我们可以通过`http://localhost/subject/4.html`访问。然后将其填写到`Website URL`中。 104 | 105 | ![](http://ww4.sinaimg.cn/large/841aea59jw1faynz5lar8j20nw0ip75t.jpg) 106 | 107 | 一直点击“下一步”，直到`Finish`界面，我们可以看到，我们指定的站点全部出现在下方的列表框中，我们把他们全部勾选。之后点击`Finish`按钮开始批量扫描。 108 | 109 | ![](http://ww4.sinaimg.cn/large/841aea59jw1faynzdo6m5j20o20ivabr.jpg) 110 | -------------------------------------------------------------------------------- /工具篇 BruteXSS.md: -------------------------------------------------------------------------------- 1 | # 米斯特白帽培训讲义 工具篇 BruteXSS 2 | 3 | > 讲师：[gh0stkey](https://www.zhihu.com/people/gh0stkey/answers) 4 | 5 | > 整理：[飞龙](https://github.com/) 6 | 7 | > 协议：[CC BY-NC-SA 4.0](http://creativecommons.org/licenses/by-nc-sa/4.0/) 8 | 9 | ## 介绍 10 | 11 | BruteXSS 是一个非常强大和快速的跨站点脚本检测工具，可用于暴力注入参数。BruteXSS 从指定的词库加载多种有效载荷进行注入，并且使用指定的载荷和扫描检查这些存在 XSS 漏洞的参数。得益于非常强大的扫描功能，在执行任务时，BruteXSS 非常准确而且极少误报。 BruteXSS 支持 POST 和 GET 请求，并适应现代 Web 应用程序。 12 | 13 | 特性： 14 | 15 | + XSS 爆破 16 | + XSS 扫描 17 | + GET/POST 请求 18 | + 可包含自定义单词 19 | + 人性化的 UI 20 | 21 | ## 安装 22 | 23 | 首先安装 Python 2.7。 24 | 25 | 依赖是`Colorama`和`Mechanize`两个库。但我看到源码中包含了这两个库，所以一般不用自己安装。如果运行失败，那么执行这两条命令手动安装一下。 26 | 27 | ``` 28 | pip install colorama 29 | pip install Mechanize 30 | ``` 31 | 32 | 之后从`https://github.com/shawarkhanethicalhacker/BruteXSS/zipball/master`下载所有文件，解压。 33 | 34 | 还需要单词列表，原版的`wordlist.txt`有 20 条语句，只能执行基本的 XSS 检查。 35 | 36 | `https://github.com/ym2011/penetration/blob/master/BruteXSS/wordlist-small.txt`这个文件有 100 条语句，可以执行相对全面的 XSS 检查。 37 | 38 | `https://github.com/ym2011/penetration/blob/master/BruteXSS/wordlist-medium.txt`这个文件有 200 条语句，可以执行绕过 WAF 的 XSS 检查。 39 | 40 | `https://github.com/ym2011/penetration/blob/master/BruteXSS/wordlist-huge.txt`这个文件有 5000 条语句，可以非常全面并且执行绕过 WAF 的 XSS 检查。 41 | 42 | 然后为了模拟被测页面，我们还要部署一个页面： 43 | 44 | ```php 45 | \\XSS反射演示 46 |
47 | 48 | 49 |
50 | http://localhost/xss.php?xss= 92 | [+] 检测 localhost 是可用的... 93 | [+] localhost is available! Good! 94 | [?] 输入字典的位置 (按Enter键使用默认 wordlist.txt) 95 | [?] > wordlist.txt 96 | ``` 97 | 98 | 之后程序会显示结果，告知我们该页面存在 XSS 漏洞。 99 | 100 | ``` 101 | [+] 从指定字典加载载荷..... 102 | [+] 25 攻击载荷加载... 103 | [+] Bruteforce开始: 104 | [+] 测试 'xss' 参数... 105 | [+] 0 / 25 攻击载荷注入... 106 | [!] Xss漏洞发现 107 | [!] 参数: xss 108 | [!] Payload: "> 109 | [+] Bruteforce完成。 110 | [+] 1 参数是 容坠セ鞯? xss. 111 | [+] 扫描结果 localhost: 112 | +----+------------+----------------+ 113 | | Id | Parameters | Status | 114 | +----+------------+----------------+ 115 | | 0 | xss | Vulnerable | 116 | +----+------------+----------------+ 117 | 118 | [?] [E]结束进程\[A]程序初始化 119 | ``` 120 | 121 | 之后它会让我们选择，结束进程的意思就是退出，初始化的意思就是重新开始。如果不需要扫描其他东西，我们输入`E`。 122 | 123 | 如果是 POST 扫描，我们为 URL 输入`http://localhost/xss.php`，为数据输入`xss=`就可以了。 124 | 125 | 由于一些 XSS 比如储存型 XSS 不便于自动化扫描，这个工具的作用仍然很有限，遇到扫不出来的漏洞很正常。 126 | -------------------------------------------------------------------------------- /工具篇 Nmap.md: -------------------------------------------------------------------------------- 1 | # 米斯特白帽培训讲义 工具篇 Nmap 2 | 3 | > 讲师：[gh0stkey](https://www.zhihu.com/people/gh0stkey/answers) 4 | 5 | > 整理：[飞龙](https://github.com/) 6 | 7 | > 协议：[CC BY-NC-SA 4.0](http://creativecommons.org/licenses/by-nc-sa/4.0) 8 | 9 | ## 介绍 10 | 11 | Nmap（网络映射器）是由 Gordon Lyon 涉及，用来探测计算机网络上的主机和服务的一种安全扫描器。为了绘制网络拓补图，Nmap 发送特制的数据包到目标主机，然后对返回数据包进行分析。Nmap 是一款枚举和测试网络的强大工具。 12 | 13 | Nmap 有两种界面：可视化界面和命令行界面。 14 | 15 | ## 下载 16 | 17 | https://nmap.org/download.html 18 | 19 | ## 使用 20 | 21 | 典型用途： 22 | 23 | + 通过对设备或者防火墙的探测来审计其安全性。 24 | + 探测目标主机的开放端口。 25 | + 网络存储、网络映射、维护和资产管理。（这个有待深入） 26 | + 通过识别新的服务器审计网络的安全性。 27 | + 探测网络上的主机。 28 | 29 | ### 简单扫描 30 | 31 | Nmap 默认使用 ICMP ping 和 TCP 全连接（`-PB`）进行主机发现，以及使用 TCP 全连接（`-sT`） 执行主机扫描。默认扫描端口是 1 ~ 1024，以及其列表中的常用端口。 32 | 33 | 语法： 34 | 35 | ``` 36 | nmap <目标 IP> 37 | ``` 38 | 39 | 例子： 40 | 41 | ``` 42 | C:\Users\asus> nmap 192.168.1.1 43 | 44 | Starting Nmap 7.01 ( https://nmap.org ) at 2016-12-22 10:37 ?D1ú±ê×?ê±?? 45 | Nmap scan report for localhost (192.168.1.1) 46 | Host is up (0.0062s latency). 47 | Not shown: 993 closed ports 48 | PORT STATE SERVICE 49 | 21/tcp filtered ftp 50 | 22/tcp filtered ssh 51 | 23/tcp filtered telnet 52 | 53/tcp open domain 53 | 80/tcp open http 54 | 49152/tcp open unknown 55 | 49153/tcp open unknown 56 | MAC Address: 68:89:C1:74:84:43 (Huawei Technologies) 57 | 58 | Nmap done: 1 IP address (1 host up) scanned in 3.40 seconds 59 | ``` 60 | 61 | 多个 IP 可以以逗号分隔：`192.168.1.1,2,3,4,5`，也可以使用短横线来表示范围：`192.168.1.1-255`，也可以使用 CIDR 记法：`192.168.1.0/24`。 62 | 63 | ### 显示详细结果 64 | 65 | ``` 66 | nmap -vv <目标 IP> 67 | ``` 68 | 69 | ``` 70 | C:\Users\asus> nmap -vv 192.168.1.1 71 | 72 | Starting Nmap 7.01 ( https://nmap.org ) at 2016-12-22 10:47 ?D1ú±ê×?ê±?? 73 | Initiating ARP Ping Scan at 10:47 74 | Scanning 192.168.1.1 [1 port] 75 | Completed ARP Ping Scan at 10:47, 0.15s elapsed (1 total hosts) 76 | Initiating Parallel DNS resolution of 1 host. at 10:47 77 | Completed Parallel DNS resolution of 1 host. at 10:47, 0.01s elapsed 78 | Initiating SYN Stealth Scan at 10:47 79 | Scanning localhost (192.168.1.1) [1000 ports] 80 | Discovered open port 80/tcp on 192.168.1.1 81 | Discovered open port 53/tcp on 192.168.1.1 82 | Discovered open port 49153/tcp on 192.168.1.1 83 | Discovered open port 49152/tcp on 192.168.1.1 84 | Completed SYN Stealth Scan at 10:47, 2.27s elapsed (1000 total ports) 85 | Nmap scan report for localhost (192.168.1.1) 86 | Host is up, received arp-response (0.0052s latency). 87 | Scanned at 2016-12-22 10:47:09 ?D1ú±ê×?ê±?? for 3s 88 | Not shown: 993 closed ports 89 | Reason: 993 resets 90 | PORT STATE SERVICE REASON 91 | 21/tcp filtered ftp no-response 92 | 22/tcp filtered ssh no-response 93 | 23/tcp filtered telnet no-response 94 | 53/tcp open domain syn-ack ttl 64 95 | 80/tcp open http syn-ack ttl 64 96 | 49152/tcp open unknown syn-ack ttl 64 97 | 49153/tcp open unknown syn-ack ttl 64 98 | MAC Address: 68:89:C1:74:84:43 (Huawei Technologies) 99 | 100 | Read data files from: C:\Program Files (x86)\Nmap 101 | Nmap done: 1 IP address (1 host up) scanned in 2.92 seconds 102 | Raw packets sent: 1004 (44.160KB) | Rcvd: 998 (39.924KB) 103 | ``` 104 | 105 | ### 自定义端口 106 | 107 | ``` 108 | nmap <目标 IP> -p <端口> 109 | ``` 110 | 111 | ``` 112 | C:\Users\asus> nmap 192.168.1.1 -p 1-500 113 | 114 | Starting Nmap 7.01 ( https://nmap.org ) at 2016-12-22 10:59 ?D1ú±ê×?ê±?? 115 | mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers 116 | Nmap scan report for 192.168.1.1 117 | Host is up (0.0061s latency). 118 | Not shown: 495 closed ports 119 | PORT STATE SERVICE 120 | 21/tcp filtered ftp 121 | 22/tcp filtered ssh 122 | 23/tcp filtered telnet 123 | 53/tcp open domain 124 | 80/tcp open http 125 | MAC Address: 68:89:C1:74:84:43 (Huawei Technologies) 126 | 127 | Nmap done: 1 IP address (1 host up) scanned in 2.08 seconds 128 | ``` 129 | 130 | 端口可以是单个，也可以是多个，多个端口可以以逗号分隔，比如`21,22,23,53,80`，也可以使用短横线指定范围，比如`1-1024`。 131 | 132 | 133 | ### Ping 扫描 134 | 135 | ``` 136 | nmap -sP <目标 IP> 137 | ``` 138 | 139 | Ping 扫描其实就是只执行主机发现，不扫描具体端口。大家可以看到结果中没有端口的信息，只告诉你主机通不通，所以也很快。 140 | 141 | ``` 142 | C:\Users\asus> nmap 192.168.1.1 -sP 143 | 144 | Starting Nmap 7.01 ( https://nmap.org ) at 2016-12-22 10:52 ?D1ú±ê×?ê±?? 145 | mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers 146 | Nmap scan report for 192.168.1.1 147 | Host is up (0.0030s latency). 148 | MAC Address: 68:89:C1:74:84:43 (Huawei Technologies) 149 | Nmap done: 1 IP address (1 host up) scanned in 0.59 seconds 150 | ``` 151 | 152 | 与之相反，有一个选项是只执行端口扫描，不执行主机发现的，是`-PN`（或`-P0`）。 153 | 154 | ``` 155 | C:\Users\asus> nmap 192.168.1.1 -PN 156 | 157 | Starting Nmap 7.01 ( https://nmap.org ) at 2016-12-22 10:54 ?D1ú±ê×?ê±?? 158 | mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers 159 | Nmap scan report for 192.168.1.1 160 | Host is up (0.0062s latency). 161 | Not shown: 993 closed ports 162 | PORT STATE SERVICE 163 | 21/tcp filtered ftp 164 | 22/tcp filtered ssh 165 | 23/tcp filtered telnet 166 | 53/tcp open domain 167 | 80/tcp open http 168 | 49152/tcp open unknown 169 | 49153/tcp open unknown 170 | MAC Address: 68:89:C1:74:84:43 (Huawei Technologies) 171 | 172 | Nmap done: 1 IP address (1 host up) scanned in 2.47 seconds 173 | ``` 174 | 175 | ### 操作系统类型检测 176 | 177 | 178 | ``` 179 | nmap -O <目标 IP> 180 | ``` 181 | 182 | ``` 183 | C:\Users\asus> nmap www.baidu.com -O 184 | 185 | Starting Nmap 7.01 ( https://nmap.org ) at 2016-12-22 11:03 ?D1ú±ê×?ê±?? 186 | mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers 187 | Nmap scan report for www.baidu.com (61.135.169.125) 188 | Host is up (0.0038s latency). 189 | Other addresses for www.baidu.com (not scanned): 61.135.169.121 190 | Not shown: 998 filtered ports 191 | PORT STATE SERVICE 192 | 80/tcp open http 193 | 443/tcp open https 194 | Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port 195 | Device type: switch 196 | Running (JUST GUESSING): HP embedded (86%) 197 | OS CPE: cpe:/h:hp:procurve_switch_4000m 198 | Aggressive OS guesses: HP 4000M ProCurve switch (J4121A) (86%) 199 | No exact OS matches for host (test conditions non-ideal). 200 | 201 | OS detection performed. Please report any incorrect results at https://nmap.org/submit/ . 202 | Nmap done: 1 IP address (1 host up) scanned in 9.35 seconds 203 | ``` 204 | 205 | 206 | ### 组合扫描 207 | 208 | 比如我们要扫描1 ~ 1024 端口，详细输出，并且探测操作系统。 209 | 210 | ``` 211 | C:\Users\asus> nmap 192.168.1.1 -p 1-1024 -vv -O 212 | 213 | Starting Nmap 7.01 ( https://nmap.org ) at 2016-12-22 11:06 ?D1ú±ê×?ê±?? 214 | Initiating ARP Ping Scan at 11:06 215 | Scanning 192.168.1.1 [1 port] 216 | Completed ARP Ping Scan at 11:06, 0.14s elapsed (1 total hosts) 217 | mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers 218 | Initiating SYN Stealth Scan at 11:06 219 | Scanning 192.168.1.1 [1024 ports] 220 | Discovered open port 53/tcp on 192.168.1.1 221 | Discovered open port 80/tcp on 192.168.1.1 222 | Completed SYN Stealth Scan at 11:06, 2.03s elapsed (1024 total ports) 223 | Initiating OS detection (try #1) against 192.168.1.1 224 | Retrying OS detection (try #2) against 192.168.1.1 225 | Retrying OS detection (try #3) against 192.168.1.1 226 | Retrying OS detection (try #4) against 192.168.1.1 227 | Retrying OS detection (try #5) against 192.168.1.1 228 | Nmap scan report for 192.168.1.1 229 | Host is up, received arp-response (0.0014s latency). 230 | Scanned at 2016-12-22 11:06:44 ?D1ú±ê×?ê±?? for 15s 231 | Not shown: 1019 closed ports 232 | Reason: 1019 resets 233 | PORT STATE SERVICE REASON 234 | 21/tcp filtered ftp no-response 235 | 22/tcp filtered ssh no-response 236 | 23/tcp filtered telnet no-response 237 | 53/tcp open domain syn-ack ttl 64 238 | 80/tcp open http syn-ack ttl 64 239 | MAC Address: 68:89:C1:74:84:43 (Huawei Technologies) 240 | No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ). 241 | TCP/IP fingerprint: 242 | OS:SCAN(V=7.01%E=4%D=12/22%OT=53%CT=1%CU=37502%PV=Y%DS=1%DC=D%G=Y%M=6889C1% 243 | OS:TM=585B4353%P=i686-pc-windows-windows)SEQ(SP=106%GCD=1%ISR=104%TI=Z%CI=Z 244 | OS:%II=I%TS=U)SEQ(CI=Z%II=I%TS=U)SEQ(CI=Z%II=I)OPS(O1=M5B4NNSNW2%O2=M5B4NNS 245 | OS:NW2%O3=M5B4NW2%O4=M5B4NNSNW2%O5=M5B4NNSNW2%O6=M5B4NNS)WIN(W1=16D0%W2=16D 246 | OS:0%W3=16D0%W4=16D0%W5=16D0%W6=16D0)ECN(R=Y%DF=Y%T=40%W=16D0%O=M5B4NNSNW2% 247 | OS:CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y 248 | OS:%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%R 249 | OS:D=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=N)U1(R=Y%DF=N%T= 250 | OS:40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S 251 | OS:) 252 | 253 | Network Distance: 1 hop 254 | TCP Sequence Prediction: Difficulty=262 (Good luck!) 255 | IP ID Sequence Generation: All zeros 256 | 257 | Read data files from: C:\Program Files (x86)\Nmap 258 | OS detection performed. Please report any incorrect results at https://nmap.org/submit/ . 259 | Nmap done: 1 IP address (1 host up) scanned in 15.21 seconds 260 | Raw packets sent: 1152 (54.954KB) | Rcvd: 1110 (48.462KB) 261 | ``` 262 | 263 | 可以看出来没探测到什么东西，因为是路由器，大家这种情况认为是 Linux 就好了。 264 | 265 | ### 脚本（补充） 266 | 267 | Nmap 有个叫做 NSE 的脚本引擎，也自带了一些脚本，更多脚本可以去官网下载。 268 | 269 | 脚本的类型有： 270 | 271 | ``` 272 | auth: 负责处理鉴权证书（绕开鉴权）的脚本 273 | broadcast: 在局域网内探查更多服务开启状况，如dhcp/dns/sqlserver等服务 274 | brute: 提供暴力破解方式，针对常见的应用如http/snmp等 275 | default: 使用-sC或-A选项扫描时候默认的脚本，提供基本脚本扫描能力 276 | discovery: 对网络进行更多的信息，如SMB枚举、SNMP查询等 277 | dos: 用于进行拒绝服务攻击 278 | exploit: 利用已知的漏洞入侵系统 279 | external: 利用第三方的数据库或资源，例如进行whois解析 280 | fuzzer: 模糊测试的脚本，发送异常的包到目标机，探测出潜在漏洞 intrusive: 入侵性的脚本，此类脚本可能引发对方的IDS/IPS的记录或屏蔽 281 | malware: 探测目标机是否感染了病毒、开启了后门等信息 282 | safe: 此类与intrusive相反，属于安全性脚本 283 | version: 负责增强服务与版本扫描（Version Detection）功能的脚本 284 | vuln: 负责检查目标机是否有常见的漏洞（Vulnerability），如是否有MS08_067 285 | ``` 286 | 287 | 向命令行添加`--script=<类型>`来使用脚本。 288 | 289 | 下面演示了使用`default`脚本来探测主机上的服务。 290 | 291 | ``` 292 | C:\Users\asus> nmap --script=default 192.168.1.1 293 | 294 | Starting Nmap 7.01 ( https://nmap.org ) at 2016-12-22 11:10 ?D1ú±ê×?ê±?? 295 | mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers 296 | Nmap scan report for 192.168.1.1 297 | Host is up (0.0051s latency). 298 | Not shown: 993 closed ports 299 | PORT STATE SERVICE 300 | 21/tcp filtered ftp 301 | 22/tcp filtered ssh 302 | 23/tcp filtered telnet 303 | 53/tcp open domain 304 | | dns-nsid: 305 | |_ bind.version: dnsmasq-2.49 306 | 80/tcp open http 307 | |_http-title: Site doesn't have a title (text/html). 308 | 49152/tcp open unknown 309 | 49153/tcp open unknown 310 | MAC Address: 68:89:C1:74:84:43 (Huawei Technologies) 311 | 312 | Nmap done: 1 IP address (1 host up) scanned in 13.48 seconds 313 | ``` 314 | 315 | ## 参考 316 | 317 | + [Nmap 脚本使用总结](http://www.2cto.com/article/201406/307959.html) 318 | 319 | + [Nmap 参考指南](https://www.gitbook.com/book/wizardforcel/nmap-man-page/details) 320 | 321 | + [Kali Linux 网络扫描秘籍 第三章 端口扫描（一）](http://www.jianshu.com/p/093b7386e1e8) 322 | 323 | + [Kali Linux 网络扫描秘籍 第三章 端口扫描（二）](http://www.jianshu.com/p/c484258dbc34) 324 | 325 | + [Kali Linux 网络扫描秘籍 第三章 端口扫描（三）](http://www.jianshu.com/p/29d97054217c) 326 | -------------------------------------------------------------------------------- /工具篇 Safe3 WVS.md: -------------------------------------------------------------------------------- 1 | # 米斯特白帽培训讲义 工具篇 Safe3 WVS 2 | 3 | > 讲师：[gh0stkey](https://www.zhihu.com/people/gh0stkey/answers) 4 | 5 | > 整理：[飞龙](https://github.com/) 6 | 7 | > 协议：[CC BY-NC-SA 4.0](http://creativecommons.org/licenses/by-nc-sa/4.0/) 8 | 9 | ## 介绍 10 | 11 | Safe3 WVS 是一款使用较为领先的智能化爬虫技术及 SQL 注入状态检测技术的工具，相比国内外同类产品智能化程度更高，速度更快，结果更准确。 12 | 13 | 所以我们一般用它检测 SQL 注入漏洞。不过目前也可以利用这款工具进行反射 XSS 的挖掘，因为他可以通过自动化的载荷来测试并判断网页源码，从而判断是否存在反射型 XSS 漏洞。 14 | 15 | ![](http://ww1.sinaimg.cn/large/841aea59jw1fazfro1a21j20qy0ly0ty.jpg) 16 | 17 | ## 下载 18 | 19 | 首先需要下载并安装 .net 2.0 框架，XP 之前可以需要单独安装，Win7 之后都自带了。 20 | 21 | 然后在[吾爱云盘](http://down.52pojie.cn/LCG/Safe3WVS_10.1_Crack_By_Lkou[LCG].rar)下载 Safe3。 22 | 23 | 下载之后无需安装，直接打开使用即可。 24 | 25 | ## 注入漏洞的扫描 26 | 27 | ![](http://ww2.sinaimg.cn/large/841aea59jw1fazfrrmosmj20ra070aa9.jpg) 28 | 29 | 打开程序主界面后，我们在上方的输入框中输入 URL。在漏洞设置分组框中选择“sql注入”和“xss”。然后如果需要设置 cookie 的话，在扫描设置分组框中输入 cookie，cookie 可以通过浏览器来获取，不同浏览器的获取方法不同。 30 | 31 | ![](http://ww4.sinaimg.cn/large/841aea59jw1fazfrva08xj20qe0kwwft.jpg) 32 | 33 | 填写完毕之后点击“开始”按钮，扫描结束之后我们会在下方的列表框中看到漏洞信息。 34 | 35 | ![](http://ww3.sinaimg.cn/large/841aea59jw1fazfrydyboj20qc0lg0vw.jpg) 36 | 37 | 我们可以在列表框中点击右键，然后选择导出报表。 38 | 39 | ![](http://ww3.sinaimg.cn/large/841aea59jw1fazfs31t62j20qg0l6ad2.jpg) 40 | 41 | ![](http://ww1.sinaimg.cn/large/841aea59jw1fazfs7f39bj20vf0te0u1.jpg) 42 | 43 | 在 Safe3 的目录下，我们会看到一个`spider.log`，这个文件以纯文本的形式保存了漏洞信息。我们打开它： 44 | 45 | ![](http://ww4.sinaimg.cn/large/841aea59jw1fazfsanwj3j20ur0r4q8d.jpg) 46 | 47 | 我们可以编写一个`python`文件来提取其中的 SQL 注入 URL： 48 | 49 | ```py 50 | # coding: utf-8 51 | 52 | fi = open('spider.log', 'r') 53 | fo = open('spider_sql.log', 'w') 54 | 55 | for line in fi.readlines(): 56 | line = line.strip('\n') 57 | if 'sql注入' in line: 58 | url = line.split(' ')[0] 59 | print url 60 | fo.write(url) 61 | fo.write('\n') 62 | 63 | fi.close() 64 | fo.close() 65 | ``` 66 | 67 | ## 附录 68 | 69 | Web 安全扫描器天梯： 70 | 71 | ![](http://ww1.sinaimg.cn/large/841aea59jw1fbdomw5ofsj20go0je0vk.jpg) 72 | -------------------------------------------------------------------------------- /漏洞篇 CSRF.md: -------------------------------------------------------------------------------- 1 | # 米斯特白帽培训讲义 漏洞篇 CSRF 2 | 3 | > 讲师：[gh0stkey](https://www.zhihu.com/people/gh0stkey/answers) 4 | 5 | > 整理：[飞龙](https://github.com/) 6 | 7 | > 协议：[CC BY-NC-SA 4.0](http://creativecommons.org/licenses/by-nc-sa/4.0/) 8 | 9 | CSRF（Cross-site request forgery跨站请求伪造，也被称为“One Click Attack”或者Session Riding，通常缩写为CSRF或者XSRF，是一种对网站的恶意利用。尽管听起来像跨站脚本（XSS），但它与XSS非常不同，并且攻击方式几乎相左。XSS利用站点内的信任用户，而CSRF则通过伪装来自受信任用户的请求来利用受信任的网站。与XSS攻击相比，CSRF攻击往往不大流行（因此对其进行防范的资源也相当稀少）和难以防范，所以被认为比XSS更具危险性。 10 | 11 | CSRF 攻击的原理就是攻击者创建一个链接，受害者点击它之后就可以完成攻击者想要的操作，这些操作一般是删除文章，创建用户之类。比如某网站的删除文章链接是`http://www.xxx.com/post//delete`，那么攻击者可以直接构造出来发给有权限的人，它点击之后就可以将文章删除。当然，攻击者也可以使用当下流行的短网址服务来伪造 URL，避免受到怀疑。 12 | 13 | 与传统的认知相反， POST 方式并不能防止 CSRF，这是因为浏览器中的 JS 拥有发送 POST 请求的能力。比如攻击者可以编写一个带表单的页面，包含目标 URL 和所有所需字段，然后再用 JS 代码提交表单。之后把这个表单放到网络上可以访问的地方，再把这个链接发给受害者，诱导他点击。 14 | 15 | 所以这个东西也叫作“One Click”，意思就是说，整个攻击只通过一次点击来完成。换个角度，通过两次相关步骤来完成的操作就不会有这个问题。 16 | 17 | ## 利用 18 | 19 | 我们可以使用 OWASP 的 CSRF-Tester 来半自动利用 CSRF 漏洞，还可以生成用于利用的 exp 页面。 20 | 21 | 要注意的是，它不会为你判断是否存在 CSRF 漏洞，想想也知道，一个网站上的一次完成的操作简直太多了，那所有这些操作都存在 CSRF 漏洞吗？并不是，只有重要的，不可挽回的操作才能算 CSRF 操作，而这个是机器判断不了的。所以你首先要知道哪里有 CSRF 漏洞，才能使用工具。 22 | 23 | 我们用它来利用 yzcms，这是一款开源的 CMS。我们首先访问后台： 24 | 25 | ![](http://ww3.sinaimg.cn/large/841aea59jw1fb40lekxl5j213s0nt413.jpg) 26 | 27 | 我们点击右上方的添加管理员： 28 | 29 | ![](http://ww2.sinaimg.cn/large/841aea59jw1fb40liam0fj2093091t8p.jpg) 30 | 31 | 当我们创建的时候，浏览器会向服务器发请求。我们就可以伪造这个请求，构造出 exp 页面，然后让已经登录的管理员去访问这个页面，就能成功创建管理员。 32 | 33 | 我们打开工具，我们看到工具一打开，就监听了本机的 8008 端口： 34 | 35 | ![](http://ww4.sinaimg.cn/large/841aea59jw1fb40lp01zej20yk0jnaby.jpg) 36 | 37 | 我们需要将浏览器的代理配置为`127.0.0.1:8008`。然后点击`Start Recording`，它会开始抓取请求。 38 | 39 | ![](http://ww3.sinaimg.cn/large/841aea59jw1fb40luqzojj20km0g7t9m.jpg) 40 | 41 | 这时我们返回 CMS 页面，模拟创建一个管理员： 42 | 43 | ![](http://ww2.sinaimg.cn/large/841aea59jw1fb40lrx03pj209009b74d.jpg) 44 | 45 | 我们可以看到它捕获到了若干请求，POST 的那个就是创建管理员的请求。我们点击这个请求那一行，观察下方的`Form Parameters`，没有任何的 Token 验证。 46 | 47 | ![](http://ww2.sinaimg.cn/large/841aea59jw1fb40m8khmhj20km0ga3zw.jpg) 48 | 49 | 参数的值可以任意修改。我们看一看底下的`Report Type`，这个就是构造方式，可以选择使用`
`、`