0x00 Google Hack

以example.com为例

目录遍历

site:example.com intitle:index.of

配置文件

site:example.com  ext:xml | ext:conf | ext:cnf | ext:reg | ext:inf | ext:rdp | ext:cfg | ext:txt | ext:ora | ext:ini

数据库文件

site:example.com  ext:sql | ext:dbf | ext:mdb

日志文件

site:example.com  ext:log

备份和历史文件

site:example.com ext:bkf | ext:bkp | ext:bak | ext:old | ext:backup

错误SQL

site:example.com  intext:”sql syntax near” | intext:”syntax error has occurred” | intext:”incorrect syntax near” | intext:”unexpected end of SQL command” | intext:”Warning: mysql_connect()” | intext:”Warning: mysql_query()” | intext:”Warning: pg_connect()”

下载文件信息

site:example.com ext:doc | ext:docx | ext:odt | ext:pdf | ext:rtf | ext:sxw | ext:psw | ext:ppt | ext:pptx | ext:pps | ext:csv
8  phpinfo()  site:example.com ext:php intitle:phpinfo “published by the PHP Group”

0x01 CMS识别

如果直接可以从URI或返回中看出找对应POC,或者直接丢到云熟资产,如下URL

http://www.yunsee.cn/
https://x.threatbook.cn/domain/example.com
http://whatweb.bugscaner.com/look/

0x02 主机漏洞

使用masscan或者nmap扫描端口

masscan ip -p 0-65535 --rate=20000
nmap ip -sS --ports 0-65535

使用nmap扫描常见漏洞

nmap ip --script=vuln

使用nessus扫描主机漏洞

0x03 waf探测

使用whatwaf进行识别

https://github.com/Ekultek/WhatWaf

使用nmap waf识别

nmap -p80,443 --script=http-waf-detect example.com
nmap -p80,443 --script=http-waf-fingerprint example.com

使用WAFW00F

wafw00f -a example.com

0x04 web应用

敏感目录探测

常见敏感信息主要包括如下几个方面

Git

hg/Mercurial

svn/Subversion

bzr/Bazaar

Cvs

备份/配置/WEB-INF文件泄露

常见扫描路径如下:

/.svn
/.git
/.git/config
/.htaccess
/wwwroot.rar
/wwwroot.zip
/新建文件夹.rar
/新建文件夹.zip
/www.rar
/www.zip
/web.rar
/web.zip

也安利几款工具进行扫描(大网站一般被ban)

御剑

AWVS

wwwscan

BBscan:https://github.com/lijiejie/

GSIL:https://github.com/FeeiCN/GSIL

常见漏洞检测包括SQLi、XSS、CSRF、SSRF、RCE等

0x05 子域名搜集

VirusTotal

https://www.virustotal.com/#/home/search 

DNSdumpster

https://dnsdumpster.com/ 

Baidu

http://ce.baidu.com/index/getRelatedSites?site_address=example.com

subDomainsBrute

https://github.com/ibey0nd/subDomainsBrute.git

Acamar

https://github.com/si9int/Acamar.git

当然还有一些layer子域名挖掘机、K8、orangescan、DNSRecon等等,顺手的最好用

To Be Continue

1,573 对 “Think In Intrusion”的想法;

  1. I generic viagra online dispensary an elliptic formatting in damaging to wasps and had the sitter to area my pony at the Power Salmi Blockades All Oahu Enrollment’s Schoolyard and the DPS Ally UN miscellaneous levitra 10 mg
    http://tuscancountrystore.com/index.php?option=com_k2&view=itemlist&task=user&id=1547019
    http://centrosubmurena.com/?option=com_k2&view=itemlist&task=user&id=1619097
    http://munarq.minculturas.gob.bo/?option=com_k2&view=itemlist&task=user&id=169622
    http://conservationanswers.net/forums/users/Elroyceeaa

  2. The complying with mild side results are feasible: back pain, hassle, indigestion, nasal stuffiness, flushing, discomfort in legs or arms, lightheadedness, eyesight modifications, and muscle discomfort. An additional crucial thing for you to know is how you are going to make certain your online looking for Tadalafil is equally secure, efficient and dependable as you anticipated it to do. Tadalafil (Cialis) is typically suggested for guys incapable to obtain and keep a construction for a period of time called for to successfully finish a sexual relations. This drug is a PDE5 inhibitor – it works by having an effect on a specific enzyme in the physical body that is essential for the procedure of blood inflow to the cells of the penis in addition to its outflow. Side effects or Tadalafil consist of lightheadedness, lightheadedness, fainting or sleepiness. It’s crucial that you visit your medical professional to get a prescription for this medication, as just a certified speTadalafilt could decide to prescribe Tadalafil Canada 20mg based upon a comprehensive analysis of your health and wellness.

  3. Tadalafil supplies you regarding up to 36 hrs of efficiency and need to be taken about a hr before making love. Generic drugs offered online could offer the exact same high quality for a price that anybody can pay for, and it’s the excellent thing regarding them. buy tadalafil pills (Cialis) is a famously suggested PDE5 prevention that works by providing you regarding up to 36 hours of performance, enabling you to make love anytime within this amount of time. We chose the most effective spots for you to buy Tadalafil, and we make certain you are going to like buying there each time you visit. Tadalafil (Cialis) is prescribed for people that have impotence and have problem getting an enough erection that would permit them to have sex.

  4. Much less severe side effects are usual, especially at the beginning of your treatment. Taking Tadalafil in some instances can be connected regarding a number of side effects – they can be mild and more significant. You require to recognize some moderate adverse effects possible when using tadalafil 5mg canada, such as diarrhea, acid indigestion, heartburn, discomfort in the tummy, muscular tissue pain, cough, headache, and flushing.

  5. A lot of clinical disorders could influence the effectiveness of this drug, featuring heart illness or heart rhythm troubles, past of a cardiac arrest, breast discomfort, stomach abscess, hemorrhaging ailment, reduced or higher blood pressure, history of a stroke or congestive heart renal system, failing or liver disease, red blood cell disorder, and physical deformity of the penis. tadalafil over the counter uk (Cialis) provides you back the ability to have sex by allowing more blood flow in to the cells of the penis aiding to obtain a steady construction. The following ones can threaten your procedure with Tadalafil: a history of heart attack, heart rhythm troubles, heart problem, angina, hemophilia, physical deformity of the penis, higher blood tension, numerous myeloma, leukemia, a current record of a heart attack, a past of a stroke, low blood pressure, sickle cell anemia, Peyronie’s condition, breast pain, or any sort of pre-existing eye troubles.

  6. An increasing number of guys determine to choose Tadalafil as their means of repairing the issue, and many of them prosper, getting their regular constructions back and paying much less cash. You likewise have to notify your physician about having any type of health and wellness conditions that can make your procedure less reliable. In that situation ensure you attempt emergency health care aid and tell the medical professional that you have actually taken Tadalafil. This term is used to describe the inability of some men to obtain a construction and hold it for long sufficient to have sex. You should consult your medical professional before taking tadalafil 20 mg best price to understand feasible medicine interactions and readjust your dosage. Your construction will certainly vanish as normal after the sexual act is finished. , if any of your symptoms get worse with time call your physician for professional assistance.

  7. Additionally inform your medical provider if you have fibrosis/scarring, blood system cancers, eye issues, energetic tummy lesions, recent movement, coronary canal illness, bleeding ailments, liver disease, penis angulation, history of painful/prolonged construction, Peyronie’s disease, kidney illness, or sickle cell anemia, as these medical problems could influence the amount your doctor will suggest. tadalafil gel negative effects are not many and often vanish soon on their very own. Priapism is a prolonged (over 4 hrs) and unpleasant construction that may take place in a little portion of patients taking impotence drugs. Your physician has to learn about any sort of medications you are taking right now, such as rifampin, troleandomycin, aprepitant, carbamazepine, dexamethasone, phenobarbital, metronidazole, other impotence therapies, fluvoxamine, rifabutin, higher blood tension, erythromycin, HIV protease preventions, cimetidine, amiodarone, clarithromycin, alpha blockers, fluoxetine, danazol, certain antifungals, isoniazid, ritonavir, sertraline, efavirenz, and saquinavir.