关于漏洞

个人将漏洞分为两种,系统安全漏洞、业务逻辑漏洞两大类。发现系统漏洞的人我可是相当崇拜的,这类人可是忍得住寂寞的。而我发现的漏洞就只是属于业务逻辑相关的漏洞。

系统漏洞

系统漏洞主要是指使用的操作系统的漏洞、第三方开源软件的漏洞,不是由业务本身造成的,比如 MS08067、MS07010、DirtyCow等。黑产牛可以批量扫描存在漏洞的网站/服务器,获取控制权限。如果这类漏洞不是自己发现的,而是使用工具(Script kids)。现在黑掉一个小型网站是太容易不过的事情,甚至可以教小学生非法渗透。

业务逻辑漏洞

业务逻辑漏洞可以分为很多种,更改交易金额、任意重置密码、XSS、SQL注入、CSRF、任意用户登录等等。如何防止业务逻辑的漏洞出现,需要根据实际的业务类型,进行相应的测试。记得一个大牛和我说过,任何由用户传入的参数都是不可靠的,都需要进行校验。

挖掘漏洞

工具扫、手工测。

因为我不是黑产牛,所以这里我一般都是手工测试,对于一些看着就很关键的参数进行测试。挖掘业务逻辑漏洞其实很无聊。黑盒和白盒两种方法,白盒读别人的代码,如果项目较大看着也很枯燥的。一般的情况我们是拿不到源码的,发现大漏洞的大牛们都是通过堆栈调用过程是挖掘系统漏洞,Web漏洞就是可以通过白盒审计去挖掘。

之前也看了某云和Freebuf上的漏洞报告,漏洞本身的利用其实很简单,但是你能在茫茫海中发现这个漏洞也是不容易的事情,进行10000次尝试可能只有1次成功,那就足够了。多尝试,你就发现很多意外的惊喜。

604 对 “关于漏洞”的想法;

  1. Are you ready for the biggest carnival of cricket IPL 2023? The 16th edition of IPL is going to start soon and fans start looking for the best ways to watch IPL live for free in USA. Match tied Watch IPL Live Match Free on a Mobile or TV Online And Injoy This IPL 2023. If you have a smartphone just download the Hotstar App, then you are able to watch IPL Live Matches for free, and you won’t have to pay any license fees, if you have an open Hotstar browser on your laptop or PC, then you could not enjoy IPL Live Matches for free. Answer: ThopTV is a free Android application that allows users to watch Live Cricket, Live News, Movies, and other content without cost. It was on July 14, 2022 that the deal was made official as the BCCI fetched a gobsmacking amount worth ₹48,390 crore through IPL media rights. While Disney Star retained the TV rights by paying ₹23,575 with a per game value of ₹57.5 crore, Viacom18 acquired the digital deal for ₹20,500 crore. Viacom18 also won the non-exclusive Package C, paying more almost ₹3000 crore extra.
    https://socialclubfm.com/story5014669/brentford-fc-result
    Brighton then wasted chance after chance and looked to be heading for defeat until Aaron Hickey was found to have handled the ball after a lengthy VAR review, and Argentina international MacAllister smashed the resulting spot kick into the net. However, manager Brendan Rodgers remained hopeful for the future in his statement after the match, via the EPL Twitter account: In the 2015–16 season, the top four was breached by a non-Big Six side for the first time since Everton in 2005. Leicester City were the surprise winners of the league, qualifying for the Champions League as a result. © DIARIO AS, S.L. – Valentín Beato, 44 – 28037 Madrid – Tel. 91 375 25 00 No account? Sign up! EPL: He’s a world-class player – Glen Johnson names transfer sale Chelsea will regret The Etihad side were limited to one goal for the first time this season in a match Man City dominated but were met by a more resolute opponent.

发表回复

您的电子邮箱地址不会被公开。