安全测试工具链总览
三大方向
| 方向 |
Skill |
核心工具 |
| 逆向工程 |
reverse-engineering |
Ghidra, radare2, Frida, apktool, jadx, angr, pwntools |
| 密码爆破 |
password-cracking |
hashcat, John, Hydra, CeWL, crunch |
| Web安全 |
web-security |
sqlmap, Nmap, Nikto, XSStrike, ffuf, nuclei, Metasploit |
快速选型
我要逆向一个二进制
1. file binary → 识别类型
2. strings binary → 快速搜字符串
3. r2 -A binary → 快速分析
4. ghidra → 深度反编译
5. angr → 符号执行求解
我要破解密码
1. hashid → 识别hash类型
2. hashcat -m <mode> -a 0 hash.txt rockyou.txt → 字典攻击
3. hashcat -m <mode> -a 0 -r rules/best64.rule hash.txt rockyou.txt → 规则
4. hashcat -m <mode> -a 3 hash.txt ?d?d?d?d?d?d → 掩码暴力
我要渗透测试Web应用
1. nmap -sV -sC target → 端口扫描
2. whatweb target → 指纹识别
3. ffuf -u target/FUZZ -w common.txt → 目录扫描
4. nuclei -u target → 漏洞扫描
5. sqlmap -u "target/?id=1" → SQL注入
安装快速参考
# 逆向
sudo apt install binwalk strace ltrace
pip install frida-tools pwntools angr capstone keystone
git clone https://github.com/radareorg/radare2 && cd radare2 && sys/install.sh
# 爆破
sudo apt install hashcat john hydra nmap nikto
pip install hashid name-that-hash
# Web
pip install sqlmap wafw00f
git clone https://github.com/s0md3v/XSStrike.git
git clone https://github.com/commixproject/commix.git
go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
go install github.com/projectdiscovery/ffuf/v2/cmd/ffuf@latest
go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
Skill 列表(16个)
| Skill |
方向 |
核心工具 |
关键更新 |
| reverse-engineering |
逆向 |
Ghidra 12.1.2, radare2 6.1.6, Frida 17.11, binwalk 3.1(Rust) |
JDK21, blutter, ghidra-mcp |
| password-cracking |
爆破 |
hashcat 7.1.2, John, Hydra 9.7 |
KeePass4/SM3模式, BruteSpray |
| web-security |
Web |
sqlmap v1.10, nuclei v3.8.0, ffuf, ZAP v2.17 |
katana, dalfox, Fenjing, dnsReaper |
| network-pentest |
内网 |
CME, Impacket, Chisel, ligolo-ng, BloodHound |
Evil-WinRM, AD CS |
| wireless-security |
无线 |
Aircrack-ng, Wifite2, bettercap, Proxmark3 |
PMKID, BLE, SDR |
| cryptography-attacks |
密码学 |
SageMath, RsaCtfTool, PadBuster |
RSA多攻击, AES Padding Oracle |
| malware-analysis |
恶意软件 |
YARA, Volatility, Cuckoo, PEframe |
脱壳, 反调试绕过 |
| digital-forensics |
取证 |
Autopsy, Volatility 3, plaso, Chainsaw |
内存取证, 云/容器取证 |
| osint |
情报 |
Sherlock, holehe, Shodan, theHarvester |
Google Dorking, 社交媒体 |
| evasion-techniques |
免杀 |
Sliver, Havoc, ScareCrow, Donut |
AMSI绕过, 域前置, DNS隧道 |
| ai-reverse-engineering |
AI逆向 |
ghidra-mcp, ida-pro-mcp, LLM4Decompile, blutter |
Flutter/Godot/Unity RE |
| mobile-security |
移动 |
MobSF, Frida, Objection, Magisk |
SSL pinning绕过, APK重打包 |
| bug-bounty |
漏洞猎人 |
subfinder→httpx→katana→nuclei pipeline |
自动化recon脚本 |
| cloud-security |
云 |
Prowler, Trivy, Pacu, Stratus Red Team |
AWS/Azure/GCP/K8s |
| active-directory |
域渗透 |
BloodHound, Certipy, bloodyAD, DonPAPI |
ESC1-8, DCSync, DPAPI |
| security-toolkit |
总览 |
本文件 |
快速选型指南 |
快速选型
逆向二进制
file → strings → r2 -A → ghidra → angr → pwntools
破解密码
hashid → hashcat -m <mode> -a 0 hash.txt rockyou.txt → hashcat -r rules/best64.rule → hashcat -a 3 ?d?d?d?d?d?d
渗透Web
nmap → whatweb → ffuf → nuclei → sqlmap → XSStrike → Commix
内网渗透
CME枚举 → BloodHound分析 → Responder捕获hash → Pass-the-Hash横向 → DCSync导出域hash
安装快速参考
# 核心工具
sudo apt install nmap nikto hashcat john hydra binwalk strace ltrace
pip install frida-tools pwntools angr capstone impacket crackmapexec
go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
go install github.com/projectdiscovery/ffuf/v2/cmd/ffuf@latest
go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install github.com/projectdiscovery/httpx/cmd/httpx@latest
法律声明
所有工具仅用于授权的安全测试。未经授权的渗透测试是违法的。
1---2name: security-toolkit3description: 安全测试总览 — 逆向工程、密码爆破、Web安全三大方向工具链4license: MIT5---67# 安全测试工具链总览89## 三大方向1011| 方向 | Skill | 核心工具 |12|------|-------|---------|13| 逆向工程 | `reverse-engineering` | Ghidra, radare2, Frida, apktool, jadx, angr, pwntools |14| 密码爆破 | `password-cracking` | hashcat, John, Hydra, CeWL, crunch |15| Web安全 | `web-security` | sqlmap, Nmap, Nikto, XSStrike, ffuf, nuclei, Metasploit |1617## 快速选型1819### 我要逆向一个二进制20```211. file binary → 识别类型222. strings binary → 快速搜字符串233. r2 -A binary → 快速分析244. ghidra → 深度反编译255. angr → 符号执行求解26```2728### 我要破解密码29```301. hashid → 识别hash类型312. hashcat -m <mode> -a 0 hash.txt rockyou.txt → 字典攻击323. hashcat -m <mode> -a 0 -r rules/best64.rule hash.txt rockyou.txt → 规则334. hashcat -m <mode> -a 3 hash.txt ?d?d?d?d?d?d → 掩码暴力34```3536### 我要渗透测试Web应用37```381. nmap -sV -sC target → 端口扫描392. whatweb target → 指纹识别403. ffuf -u target/FUZZ -w common.txt → 目录扫描414. nuclei -u target → 漏洞扫描425. sqlmap -u "target/?id=1" → SQL注入43```4445## 安装快速参考4647```bash48# 逆向49sudo apt install binwalk strace ltrace50pip install frida-tools pwntools angr capstone keystone51git clone https://github.com/radareorg/radare2 && cd radare2 && sys/install.sh5253# 爆破54sudo apt install hashcat john hydra nmap nikto55pip install hashid name-that-hash5657# Web58pip install sqlmap wafw00f59git clone https://github.com/s0md3v/XSStrike.git60git clone https://github.com/commixproject/commix.git61go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest62go install github.com/projectdiscovery/ffuf/v2/cmd/ffuf@latest63go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest64```6566## Skill 列表(16个)6768| Skill | 方向 | 核心工具 | 关键更新 |69|-------|------|---------|---------|70| reverse-engineering | 逆向 | Ghidra 12.1.2, radare2 6.1.6, Frida 17.11, binwalk 3.1(Rust) | JDK21, blutter, ghidra-mcp |71| password-cracking | 爆破 | hashcat 7.1.2, John, Hydra 9.7 | KeePass4/SM3模式, BruteSpray |72| web-security | Web | sqlmap v1.10, nuclei v3.8.0, ffuf, ZAP v2.17 | katana, dalfox, Fenjing, dnsReaper |73| network-pentest | 内网 | CME, Impacket, Chisel, ligolo-ng, BloodHound | Evil-WinRM, AD CS |74| wireless-security | 无线 | Aircrack-ng, Wifite2, bettercap, Proxmark3 | PMKID, BLE, SDR |75| cryptography-attacks | 密码学 | SageMath, RsaCtfTool, PadBuster | RSA多攻击, AES Padding Oracle |76| malware-analysis | 恶意软件 | YARA, Volatility, Cuckoo, PEframe | 脱壳, 反调试绕过 |77| digital-forensics | 取证 | Autopsy, Volatility 3, plaso, Chainsaw | 内存取证, 云/容器取证 |78| osint | 情报 | Sherlock, holehe, Shodan, theHarvester | Google Dorking, 社交媒体 |79| evasion-techniques | 免杀 | Sliver, Havoc, ScareCrow, Donut | AMSI绕过, 域前置, DNS隧道 |80| ai-reverse-engineering | AI逆向 | ghidra-mcp, ida-pro-mcp, LLM4Decompile, blutter | Flutter/Godot/Unity RE |81| mobile-security | 移动 | MobSF, Frida, Objection, Magisk | SSL pinning绕过, APK重打包 |82| bug-bounty | 漏洞猎人 | subfinder→httpx→katana→nuclei pipeline | 自动化recon脚本 |83| cloud-security | 云 | Prowler, Trivy, Pacu, Stratus Red Team | AWS/Azure/GCP/K8s |84| active-directory | 域渗透 | BloodHound, Certipy, bloodyAD, DonPAPI | ESC1-8, DCSync, DPAPI |85| security-toolkit | 总览 | 本文件 | 快速选型指南 |8687## 快速选型8889### 逆向二进制90`file` → `strings` → `r2 -A` → `ghidra` → `angr` → `pwntools`9192### 破解密码93`hashid` → `hashcat -m <mode> -a 0 hash.txt rockyou.txt` → `hashcat -r rules/best64.rule` → `hashcat -a 3 ?d?d?d?d?d?d`9495### 渗透Web96`nmap` → `whatweb` → `ffuf` → `nuclei` → `sqlmap` → `XSStrike` → `Commix`9798### 内网渗透99`CME枚举` → `BloodHound分析` → `Responder捕获hash` → `Pass-the-Hash横向` → `DCSync导出域hash`100101### 安装快速参考102```bash103# 核心工具104sudo apt install nmap nikto hashcat john hydra binwalk strace ltrace105pip install frida-tools pwntools angr capstone impacket crackmapexec106go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest107go install github.com/projectdiscovery/ffuf/v2/cmd/ffuf@latest108go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest109go install github.com/projectdiscovery/httpx/cmd/httpx@latest110```111112## 法律声明113114所有工具仅用于授权的安全测试。未经授权的渗透测试是违法的。
aivos-xie