-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathatom.xml
More file actions
204 lines (157 loc) · 18.9 KB
/
atom.xml
File metadata and controls
204 lines (157 loc) · 18.9 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
<?xml version="1.0" encoding="utf-8"?>
<feed xmlns="http://www.w3.org/2005/Atom">
<title>snRNA's blog</title>
<link href="/atom.xml" rel="self"/>
<link href="http://yoursite.com/"/>
<updated>2016-08-27T14:04:39.162Z</updated>
<id>http://yoursite.com/</id>
<author>
<name>snRNA</name>
</author>
<generator uri="http://hexo.io/">Hexo</generator>
<entry>
<title>Web_For_Pentester</title>
<link href="http://yoursite.com/2016/08/27/Web-For-Pentester/"/>
<id>http://yoursite.com/2016/08/27/Web-For-Pentester/</id>
<published>2016-08-27T13:30:11.000Z</published>
<updated>2016-08-27T14:04:39.162Z</updated>
<content type="html"><h2 id="Web-For-Penterser-I"><a href="#Web-For-Penterser-I" class="headerlink" title="Web For Penterser I"></a>Web For Penterser I</h2><hr>
<p>本篇主要用于记录使用pentersterlab的学习历程,缘起大二小学期的密码学课程实践中的ECB附加实验 <a href="https://sec.cuc.edu.cn/huangwei/wiki/teaching_ac_2016_calendar.html#toc_5" target="_blank" rel="external">here</a><br>。之后看到这个网站<a href="https://pentesterlab.com" target="_blank" rel="external">penterlab</a>,遂使用上面的教程学习,本文是关于web方面的基础。 </p>
<p>ps:本篇先讲解使用方法,下载对应课程的ISO镜像(一般为32位的Debian系统),在虚拟机中使用就好(类似于liveCD的形式,各种环境已在ISO中配好),在外部就可以访问(注意http-only要在同一网段,或者虚拟机NAT上网采用端口转发) </p>
<hr>
<p><img src="network.jpg" alt="network_set"> </p>
<p>主机访问localhost即可进入页面: </p>
<p><img src="localhost.png" alt="home_page"> </p>
<hr>
<h3 id="XSS"><a href="#XSS" class="headerlink" title="XSS"></a>XSS</h3><p>三种常见的XSS类型不多赘述,直接进题目 </p>
<h4 id="example1"><a href="#example1" class="headerlink" title="example1"></a>example1</h4><p>无过滤的最简单的形式,传入的参数是name,猜想后端php应该是直接echo了 $_GET[‘name’]。<br><strong>payload:</strong></p>
<blockquote>
<p><code>?name=&lt;scRiPT&gt;alert(1);&lt;/sCRIpt&gt;</code> </p>
</blockquote>
<p>即可实现弹窗显示1的效果。 </p>
<h4 id="example2"><a href="#example2" class="headerlink" title="example2"></a>example2</h4><p>例2对于script这个关键词进行了过滤但是可以使用例如sCRIpt这样的大小写混淆的方式进行XSS绕过,利用对于大小写没有进行过滤且html语言大小写的不敏感实现。<br><strong>payload:</strong> </p>
<blockquote>
<p><code>?name=&lt;scRiPT&gt;alert(1);&lt;/sCRIpt&gt;</code> </p>
</blockquote>
<h4 id="example3"><a href="#example3" class="headerlink" title="example3"></a>example3</h4><p>例三有了新的过滤,尝试例1的payload发现只显示了alert1所以猜想的是对&lt;&gt;进行了过滤,尝试输入pen&lt;script&gt;testerlab,过滤后的效果是penterterlab,就是会进行关键字过滤后对剩余的字段进行拼接,那么就构造的payload是中间有被过滤字符,而前后两端的被过滤字符拼接后仍为所需要的被过滤字符即可,payload如下: </p>
<blockquote>
<p><code>?name=&lt;scri&lt;script&gt;pt&gt;alert(1);&lt;/scri&lt;/script&gt;pt&gt;</code> </p>
</blockquote>
<h4 id="example4"><a href="#example4" class="headerlink" title="example4"></a>example4</h4><p>例四输入例1的payload后回车直接显示error ,这次的服务器端直接匹配script,只要出现script就会导致error的产生,所以这次的payload完全不能出现script字符串然而还要运行javascript脚本。HTML的标签中的事件可以执行js脚本。所以添加个img标签或dir &lt;a等,绑定事件onerror,onmousermove等。测试payload如下: </p>
<blockquote>
<p><code>?name=&lt;img src=&#39;zzzz&#39; onerror=&#39;alert(1)&#39; /&gt;</code> </p>
</blockquote>
<h4 id="example5"><a href="#example5" class="headerlink" title="example5"></a>example5</h4><p>例5测试发现过滤了关键词alert,可以采用其他的函数达到同样的效果例如confirm<br><strong>payload 1:</strong> </p>
<blockquote>
<p><code>?name=&lt;img src=&#39;zzzz&#39; onerror=&#39;confirm(1)&#39; /&gt;</code> </p>
</blockquote>
<p>此外还可以使用eval()函数与Stirng.fromCharCode函数结合<br><strong>payload 2:</strong> </p>
<blockquote>
<p><code>?name=&lt;img src=&quot;1&quot; onerror=&quot;eval(String.fromCharCode(97,108,101,114,116,40,49,41))&quot;&gt;</code> </p>
</blockquote>
<p>上述数值为alert(1)各字符对应的十进制ascii码。 </p>
<h4 id="example6"><a href="#example6" class="headerlink" title="example6"></a>example6</h4><p>例6,首先打开页面后并没有见到Hello,hacker而是只有hello,查看页面源代码在其中看到有一段js代码name变量的值被利用到了script中。<br><img src="xss_example6.png" alt="xss_example6"><br>所以payload的利用方式就是先闭合引号然后再alert最后将后面的代码注释即可。<br><strong>payload:</strong> </p>
<blockquote>
<p><code>?name=hacker&quot;;alert($a);&lt;/script&gt;//</code> </p>
</blockquote>
<h4 id="example7"><a href="#example7" class="headerlink" title="example7"></a>example7</h4><p>例7,跟上个题目类似,只不过这次对于特定的符号例如双引号,尖括号等进行了html_encode,这次$a后面接的是单引号,单引号默认情况不会被encode所以只需简单修改payload即可。<br><strong>payload:</strong> </p>
<blockquote>
<p><code>?name=hacker&#39;;alert($a);//</code> </p>
</blockquote>
<h4 id="example8"><a href="#example8" class="headerlink" title="example8"></a>example8</h4><p>例8,此题打开的时候存在输入框,有一定可能是存储型XSS,尝试后没有成功,根据官网课程的提示得知form表单中的url可以进行XSS注入,刚进入的初始页面如下:<br><img src="xss_example8_1.png" alt="xss_example8_1"><br>对于form表单中的action进行修改.<br><strong>payload:</strong> </p>
<blockquote>
<p><code>/xss/example8.php/&quot; onsubmit=&quot;alert(1);</code> </p>
</blockquote>
<p>修改之后的页面变为:<br><img src="xss_example8_2.png" alt="xss_example8_2"><br>这样就实现了输入后提交进行弹窗的效果。 </p>
<h4 id="example9"><a href="#example9" class="headerlink" title="example9"></a>example9</h4><p>例9,比较简单,跟例1相同只不过这次是跟在符号#后面输入payload。<br>但是这次的形式是DOM-based XSS,查看页面源代码可以获取到相关信息。<br><strong>payload:</strong> </p>
<blockquote>
<p><code>#&lt;script&gt;alert(1);&lt;/script&gt;</code> </p>
</blockquote>
<h2 id="END"><a href="#END" class="headerlink" title="END"></a>END</h2></content>
<summary type="html">
<h2 id="Web-For-Penterser-I"><a href="#Web-For-Penterser-I" class="headerlink" title="Web For Penterser I"></a>Web For Penterser I</h2><hr>
</summary>
<category term="2016" scheme="http://yoursite.com/tags/2016/"/>
<category term="XSS" scheme="http://yoursite.com/tags/XSS/"/>
<category term="Web" scheme="http://yoursite.com/tags/Web/"/>
</entry>
<entry>
<title>Answer for CS network quizzes</title>
<link href="http://yoursite.com/2016/06/16/Answer-for-CS-network-quizzes/"/>
<id>http://yoursite.com/2016/06/16/Answer-for-CS-network-quizzes/</id>
<published>2016-06-16T03:29:13.000Z</published>
<updated>2016-06-16T03:37:31.978Z</updated>
<content type="html"><h1 id="Answer-for-CS-network-quizzes"><a href="#Answer-for-CS-network-quizzes" class="headerlink" title="Answer for CS network quizzes"></a>Answer for CS network quizzes</h1><p>Quiz 1 </p>
<ol>
<li>B 2. C 3. A 4. A 5. A 6. D 7. A 8. D 9. D 10. D<br><a href="https://quizlet.com/106378313/cse-4344-quiz4-flash-cards/" target="_blank" rel="external">部分参考来源</a> </li>
</ol>
<p>Quiz 2 </p>
<ol>
<li>D 2. B. 3. D 4. A 5. C 6. D 7. A 8. BC 9. D 10. C</li>
</ol>
<p>Quiz 3 </p>
<ol>
<li>D 2. D 3. C 4. B 5. D 6. A 7. D 8. B 9. A 10. C</li>
</ol>
<p>Quiz 4<br>1~5: FFFTT<br>6~10: FTFTF</p>
<p>Quiz 5<br>1~5: TTFFF<br>6~10: FTTTT</p>
<p><a href="http://studymooc.nbu.edu.cn/nodedetailcontroller/visitnodedetail?knowledgeId=647739" target="_blank" rel="external">部分参考来源</a></p>
<p>Quiz 6<br>1~5: FFFFT<br>6~10: TFFTT</p>
<h2 id="后面的题目答案缺失"><a href="#后面的题目答案缺失" class="headerlink" title="后面的题目答案缺失"></a>后面的题目答案缺失</h2><p><strong>有错的麻烦指出</strong><br><del>~我不管哟</del>~</p>
</content>
<summary type="html">
<h1 id="Answer-for-CS-network-quizzes"><a href="#Answer-for-CS-network-quizzes" class="headerlink" title="Answer for CS network quizzes"></a
</summary>
<category term="2016" scheme="http://yoursite.com/tags/2016/"/>
<category term="computer_network" scheme="http://yoursite.com/tags/computer-network/"/>
</entry>
<entry>
<title>why it start?</title>
<link href="http://yoursite.com/2016/04/02/why-it-start/"/>
<id>http://yoursite.com/2016/04/02/why-it-start/</id>
<published>2016-04-02T13:03:17.000Z</published>
<updated>2016-04-02T13:30:40.266Z</updated>
<content type="html"><h2 id="0x01-Write-Something"><a href="#0x01-Write-Something" class="headerlink" title="#0x01 Write Something"></a>#0x01 Write Something</h2><p>好不容易把blog搭的差不多了(其实都有教程…),写这篇主要是练练markdown语法的。嗯。感觉现在自己身边个人公众号的氛围还是蛮热烈的,但讲道理来说 as a coder 最好还是能有一个自己的技术博客吧…</p>
<h2 id="0x02"><a href="#0x02" class="headerlink" title="#0x02"></a>#0x02</h2><p>markdown的语法 我主要还是就会个#号键,慢慢来吧..这个是用github+hexo进行搭建的,主题是Next,等过几日有钱有一定几率去买个域名折腾个服务器blablah….</p>
<h2 id="0x03"><a href="#0x03" class="headerlink" title="#0x03"></a>#0x03</h2><p>说是技术博客但是还是会有一定几率出现其他的内容的,技术的话,日常学习遇到的坑,很好的东西的收藏以及碎片化知识分类的整理都会include.</p>
<h2 id="0x04"><a href="#0x04" class="headerlink" title="#0x04"></a>#0x04</h2><p>暂时想不到了。。先这些吧</p>
<h3 id="2016-04-12"><a href="#2016-04-12" class="headerlink" title="2016-04-12"></a>2016-04-12</h3><p>TODO:<br><br>1.postman测试接口<br><br>2.blog评论功能开通</p>
</content>
<summary type="html">
<h2 id="0x01-Write-Something"><a href="#0x01-Write-Something" class="headerlink" title="#0x01 Write Something"></a>#0x01 Write Something</h2
</summary>
</entry>
<entry>
<title>First snRNA's article</title>
<link href="http://yoursite.com/2016/04/02/First-snRNA-s-article/"/>
<id>http://yoursite.com/2016/04/02/First-snRNA-s-article/</id>
<published>2016-04-02T03:02:02.000Z</published>
<updated>2016-04-02T03:04:41.435Z</updated>
<content type="html"><h1 id="My-First-article"><a href="#My-First-article" class="headerlink" title="My First article"></a>My First article</h1><p>This is my personal blog using hexo and github. I am still praticing it. So it may be not beautiful. Please look forward to the update.</p>
<p>##张乐是狗</p>
</content>
<summary type="html">
<h1 id="My-First-article"><a href="#My-First-article" class="headerlink" title="My First article"></a>My First article</h1><p>This is my per
</summary>
</entry>
<entry>
<title>Hello World</title>
<link href="http://yoursite.com/2016/04/02/hello-world/"/>
<id>http://yoursite.com/2016/04/02/hello-world/</id>
<published>2016-04-02T02:30:52.715Z</published>
<updated>2016-04-02T02:30:52.715Z</updated>
<content type="html"><p>Welcome to <a href="https://hexo.io/" target="_blank" rel="external">Hexo</a>! This is your very first post. Check <a href="https://hexo.io/docs/" target="_blank" rel="external">documentation</a> for more info. If you get any problems when using Hexo, you can find the answer in <a href="https://hexo.io/docs/troubleshooting.html" target="_blank" rel="external">troubleshooting</a> or you can ask me on <a href="https://github.com/hexojs/hexo/issues" target="_blank" rel="external">GitHub</a>.</p>
<h2 id="Quick-Start"><a href="#Quick-Start" class="headerlink" title="Quick Start"></a>Quick Start</h2><h3 id="Create-a-new-post"><a href="#Create-a-new-post" class="headerlink" title="Create a new post"></a>Create a new post</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">$ hexo new <span class="string">"My New Post"</span></span><br></pre></td></tr></table></figure>
<p>More info: <a href="https://hexo.io/docs/writing.html" target="_blank" rel="external">Writing</a></p>
<h3 id="Run-server"><a href="#Run-server" class="headerlink" title="Run server"></a>Run server</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">$ hexo server</span><br></pre></td></tr></table></figure>
<p>More info: <a href="https://hexo.io/docs/server.html" target="_blank" rel="external">Server</a></p>
<h3 id="Generate-static-files"><a href="#Generate-static-files" class="headerlink" title="Generate static files"></a>Generate static files</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">$ hexo generate</span><br></pre></td></tr></table></figure>
<p>More info: <a href="https://hexo.io/docs/generating.html" target="_blank" rel="external">Generating</a></p>
<h3 id="Deploy-to-remote-sites"><a href="#Deploy-to-remote-sites" class="headerlink" title="Deploy to remote sites"></a>Deploy to remote sites</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">$ hexo deploy</span><br></pre></td></tr></table></figure>
<p>More info: <a href="https://hexo.io/docs/deployment.html" target="_blank" rel="external">Deployment</a></p>
</content>
<summary type="html">
<p>Welcome to <a href="https://hexo.io/" target="_blank" rel="external">Hexo</a>! This is your very first post. Check <a href="https://hexo.
</summary>
</entry>
</feed>