Walks

网络安全爱好者

网站渗透思路

当你对一个指定网入侵的时候,什么是最重要的呢?毫无疑问,那就是思路。

有了思路,会让你的渗透事半功倍,下面讲给大家介绍一些渗透的思路与方法。

(一)针对网站程序,不考虑服务器。

一、查找注入,注意数据库用户权限和站库是否同服。

二、查找XSS,最近盲打很流行,不管怎样我们的目的是进入后台。

三、查找上传,一些能上传的页面,比如申请友链、会员头像、和一些敏感页面等等,注意查看验证方式是否能绕过,注意结合服务器的解析特性,比如典型的IIS6.0、阿帕奇等。

四、查找编辑器,比较典型的ewebeditor、fckeditor等等。

五、查找phpmyadmin等管理程序,可以尝试弱口令,或者寻找其漏洞。

六、百度、谷歌搜索程序公开漏洞。

七、猜解文件,如知道某文件为admin_login.php,我们可尝试admin_add.php、admin_upload.php文件是否存在,也可以谷歌搜索site:cnseay.com inurl:edit等等,很多时候可以找到一些敏感文件,接着看是否验证权限或能否绕过验证,这像冰风说高级语法。

八、会员注册、修改、删除、评论等一切需要操作数据库的地方记得加单引号之类查看是否存在insert、update等类型注入。

九、会员或低权限管理登陆后可抓包分析,尝试修改超级管理员密码,权限提升。

十、通常有下载功能的站我们可以尝试修改下URL文件名,看能否下载站点敏感文件,如数据库配置文件等,数据库不可外连情况下可以尝试数据库密码登陆后台,也可下载上传、登陆验证等文件进行代码审计。

十一、备份文件和后门,某些主站子目录存在分站,比如www.cnseay.com/seay/,我们可以尝试www.cnseay.com/seay.rar/zip等压缩文件是否存在,可能就是子站的源码。也有一些站类似这样www.cnseay.com/old/,一般都是以前的老站,通常老站会比较容易拿。还有就是数据库备份、前人的后门等,具体这些目录上的东西就要看你的字典了。

十二、0day漏洞,不管是别人给你的,还是自己挖的,总之好使就行。

十三、。。。

(二)针对服务器

一、通常先扫下服务器开放的端口,再考虑对策。

二、比较常见的解析漏洞,比如IIS6.0、阿帕奇、nginx/IIS7.0(php-fpm)解析漏洞等,还有就是cer、asa之类的解析,.htaccess文件解析配置等。

三、弱口令和everyone权限,先扫描服务器开放的端口,比如21对应的FTP、1433对应的MSSQL、3306对应的MYSQL、3389对应的远程桌面、1521对应的Oracle等等,平时可以多搜集下字典,有时候效果也是不错的(通常在cain嗅探的时候,经常能嗅到别人不停的扫…很蛋疼)。

四、溢出,这点要看系统补丁和服务器使用的软件等等,比如FTP等工具,这里不详解。

五、针对一些服务器管理程序,比如tomcat、jboss等等,这种比较常见于大中型的站点服务器。

六、IIS、apache等各种漏洞,这个要平时多关注。

七、目录浏览,服务器配置不当,可直接浏览目录。

八、共享…

九、。。。
(三)针对人,社工

社工在渗透中通常能起到惊人的效果,主要还是利用人的弱点,博大精深,这里不详细讨论,注意平时多看一些社工文章,学习一些思路、技巧。

(四)迂回战术,旁注和C段

一、旁注,针对旁站,我们可以运用到上面说到的方法,这里不多说。

二、C段,基本想到C段就会想到cain,针对C段的站点和服务器,结合上面说的针对目标站、服务器、人、旁站的思路,一个道理,当然如果你的目的仅仅是黑站的话,不妨试试NetFuke之类。

三、…
(五)提权常用手段

一、使用系统溢出提权EXP,这类在提权中最常用,使用的方法大都一致,比如比较常见的巴西烤肉、pr等等,溢出提权通常在Linux上也利用的比较多,注意多收集EXP。

二、第三方软件提权,主要还是利用服务器上安装的第三方软件拥有比较高的权限,或者软件的溢出漏洞,比如典型的mssql、mysql、serv-u等等,还有各种远程控制软件,比如pcanywhere、Radmin这类。

三、劫持提权,说到这个,想必肯定会想到lpk.dll这类工具,有时候在蛋疼怎么都加不上账户的时候,可以试试劫持shift、添加开机启动等等思路。

四、弱口令技巧,我们可以看看有木有什么hack、或者隐藏账户之类的,一般这种用户密码都比较简单,可以尝试下弱口令,还有之前说过的各种数据库、远程控制软件、FTP软件的弱口令,没办法的时候就去扫扫碰碰运气吧。

五、信息收集,注意翻下硬盘各种文档,说不定各种密码就在里面。在内网渗透时,信息收集是非常重要的,记得拿下服务器了GET一下明文密码,德国那个mimikatz不错,还有就是域、ARP。。。貌似扯多跑题了。

六、社工…不多说。

暂时总结到这里,渗透博大精深,不是这么几段字就能说清楚的,具体还是要看具体情形,随机应变。一定要养成在渗透过程中信息收集的好习惯,特别是针对大中型站点,注意收集子站域名、目录、密码等等敏感信息,这对于我们后面的渗透非常有用,内网经常弱口令,同密码比较多。很多时候,或许一个主站就死在子站的一个小漏洞上。

以上非本人总结,来自于自己笔记上一篇计较好的文章。

点赞
  1. nike air max说道:

    I precisely needed to appreciate you again. I am not sure the things I could possibly have worked on in the absence of the entire points provided by you concerning this question. Certainly was a troublesome matter in my opinion, nevertheless finding out this well-written strategy you processed the issue took me to cry with fulfillment. I am just happy for the help and as well , hope that you really know what a great job that you're providing instructing many people all through your web site. I am sure you haven't encountered any of us.

  2. goyard handbags说道:

    I precisely had to thank you very much once again. I'm not certain what I would've tried without the creative concepts provided by you directly on such theme. This has been the frightening circumstance for me, but understanding the specialised way you treated the issue took me to cry for fulfillment. I'm just happier for this information and thus have high hopes you comprehend what an amazing job you have been carrying out educating many others all through your site. I am sure you have never got to know all of us.

  3. jordan 11说道:

    I'm also writing to make you know what a cool experience my wife's daughter enjoyed browsing yuor web blog. She came to understand plenty of things, most notably how it is like to possess an ideal helping mindset to make other people clearly learn specific specialized subject areas. You actually exceeded readers' desires. Thanks for presenting those valuable, trusted, explanatory not to mention cool tips on your topic to Mary.

  4. vans outlet说道:

    I precisely needed to say thanks once more. I do not know the things I could possibly have done without those tricks shown by you over such situation. It had been an absolute terrifying situation in my view, nevertheless finding out the very specialised avenue you resolved the issue made me to jump over joy. Now i'm happier for this help and in addition trust you recognize what an amazing job that you are carrying out educating other individuals through your blog post. I am sure you have never come across any of us.

  5. adidas yeezy说道:

    Thanks a lot for giving everyone remarkably superb opportunity to read critical reviews from here. It is usually so brilliant and also full of amusement for me and my office friends to visit your site at the least three times in one week to learn the new guidance you will have. Of course, I'm actually pleased concerning the special techniques you give. Selected 1 tips on this page are definitely the most efficient I have had.

  6. I needed to put you this little observation so as to thank you so much again for the stunning techniques you have discussed here. It's really tremendously open-handed with you in giving without restraint exactly what numerous people would've supplied for an electronic book to help with making some profit on their own, mostly considering that you could have done it if you desired. The secrets as well acted to provide a easy way to comprehend most people have similar dreams the same as my own to learn more and more with respect to this matter. I'm sure there are some more pleasant situations ahead for people who read your site.

  7. fila说道:

    Thanks so much for giving everyone an extraordinarily marvellous opportunity to discover important secrets from this site. It's usually so cool plus full of a great time for me and my office colleagues to visit the blog particularly three times weekly to learn the latest items you have. And lastly, I'm just certainly pleased with the incredible knowledge you give. Some 4 points in this post are unequivocally the most impressive I have had.

  8. nfl store说道:

    My wife and i were absolutely more than happy that Edward could do his reports via the ideas he got when using the web page. It's not at all simplistic to simply find yourself giving out tricks some others could have been making money from. We realize we have got the writer to be grateful to for that. All of the illustrations you have made, the straightforward web site navigation, the friendships you can give support to instill - it's got mostly impressive, and it's making our son in addition to us believe that the subject is satisfying, which is incredibly serious. Many thanks for the whole lot!

  9. yeezy说道:

    I precisely needed to say thanks once again. I'm not certain the things that I would have achieved without the type of advice contributed by you concerning this subject matter. It actually was an absolute frustrating crisis in my circumstances, nevertheless finding out a new skilled fashion you solved it forced me to leap over contentment. Now i am happier for your help and thus have high hopes you are aware of a great job you are providing instructing the others thru your webblog. I am sure you have never encountered any of us.

  10. goyard说道:

    A lot of thanks for every one of your work on this web page. Gloria really likes making time for investigation and it's simple to grasp why. Most of us notice all regarding the lively tactic you present great guidance via the web site and as well attract response from others about this area of interest so my princess is now learning a lot of things. Take pleasure in the rest of the new year. You have been conducting a first class job.

  11. I want to show some thanks to you for rescuing me from this type of dilemma. After searching throughout the online world and coming across advice which are not helpful, I believed my life was over. Existing devoid of the strategies to the problems you have fixed through your post is a critical case, and those which could have in a negative way affected my entire career if I hadn't come across your web site. That knowledge and kindness in controlling a lot of things was helpful. I don't know what I would've done if I had not discovered such a thing like this. I can also at this point relish my future. Thanks very much for this expert and results-oriented help. I will not be reluctant to suggest your web site to anybody who needs and wants recommendations about this area.

  12. I wanted to develop a brief comment to be able to thank you for these fantastic tricks you are placing at this site. My rather long internet research has at the end been paid with brilliant insight to exchange with my pals. I would assume that we visitors actually are very fortunate to dwell in a good community with so many brilliant individuals with insightful solutions. I feel very much grateful to have come across your entire website and look forward to some more fun moments reading here. Thanks a lot once again for all the details.

  13. I would like to express some appreciation to the writer just for bailing me out of this difficulty. Because of exploring throughout the the web and coming across notions which are not helpful, I believed my entire life was over. Being alive without the strategies to the difficulties you have solved by means of the short post is a crucial case, and ones which may have in a negative way affected my entire career if I hadn't come across your web blog. Your own competence and kindness in playing with all the pieces was very useful. I don't know what I would have done if I hadn't encountered such a step like this. It's possible to now relish my future. Thanks so much for this specialized and amazing guide. I will not be reluctant to refer your web blog to anyone who would like guidance about this matter.

  14. Thank you a lot for giving everyone a very terrific possiblity to discover important secrets from this site. It is often so awesome plus packed with a good time for me personally and my office peers to search your website at minimum 3 times every week to see the newest issues you will have. Not to mention, we're certainly motivated considering the mind-blowing secrets you serve. Certain two ideas on this page are particularly the most suitable I have ever had.

  15. hermes belt说道:

    I simply wished to appreciate you all over again. I'm not certain what I could possibly have created without the type of solutions provided by you relating to such a problem. It was a very fearsome issue for me personally, but observing a expert manner you solved that took me to weep over happiness. Now i am happy for this guidance and thus have high hopes you find out what a powerful job that you are undertaking instructing the rest via your website. I know that you haven't got to know any of us.

  16. lebron shoes说道:

    I needed to compose you one bit of observation just to thank you very much yet again over the exceptional ideas you've contributed on this site. It was so strangely generous of people like you to supply extensively what most people could possibly have marketed for an electronic book to end up making some dough on their own, particularly seeing that you could possibly have done it in the event you considered necessary. Those points also acted as the easy way to fully grasp someone else have similar keenness really like mine to see somewhat more in respect of this condition. I think there are thousands of more pleasurable opportunities in the future for people who read carefully your blog.

  17. pandora bracelet说道:

    I must show my love for your kindness for persons that should have help with this particular content. Your personal dedication to getting the solution along had been really practical and have really empowered those just like me to reach their endeavors. Your entire warm and helpful recommendations entails a lot a person like me and extremely more to my office workers. Thanks a lot; from all of us.

  18. adidas yeezy说道:

    I wanted to send you that tiny remark so as to thank you very much yet again regarding the magnificent information you've discussed in this article. It is certainly pretty generous with people like you to provide without restraint precisely what a number of people would have offered for sale as an electronic book to end up making some bucks for themselves, even more so since you could possibly have done it if you ever wanted. The smart ideas additionally acted to be a easy way to be aware that other individuals have similar dream the same as my personal own to find out very much more when it comes to this condition. I am sure there are thousands of more pleasurable instances ahead for individuals that look into your blog post.

  19. I definitely wanted to construct a note to say thanks to you for all of the precious ideas you are writing on this website. My extended internet investigation has now been honored with reliable facts to talk about with my classmates and friends. I would assume that we visitors actually are really endowed to exist in a fabulous site with many special people with useful things. I feel pretty blessed to have come across your website page and look forward to so many more cool times reading here. Thanks once more for a lot of things.

  20. air jordan 13说道:

    I am just commenting to let you be aware of of the fantastic encounter my friend's princess experienced browsing the blog. She realized numerous pieces, which include what it's like to possess a wonderful helping heart to make folks just know precisely certain problematic subject areas. You undoubtedly did more than our expectations. I appreciate you for offering the interesting, trusted, explanatory not to mention easy tips about your topic to Janet.

  21. adidas yeezy说道:

    I want to convey my admiration for your generosity in support of those people who absolutely need guidance on this important area of interest. Your real commitment to passing the solution all around appeared to be pretty advantageous and have in every case empowered most people like me to arrive at their endeavors. Your entire informative suggestions implies much to me and even further to my fellow workers. Thanks a lot; from everyone of us.

发表评论

电子邮件地址不会被公开。 必填项已用*标注