站点訪问日志看安全

最新推荐文章于 2022-12-20 11:07:29 发布

weixin_34128534

最新推荐文章于 2022-12-20 11:07:29 发布

阅读量225

点赞数

文章标签： php 运维 javascript ViewUI

我本主开发，因没人，除了让人把几台server运到IDC。其他系统安装、虚拟机安装、系统上线、运维等事就我一手操办了。

幸好大学时对server的倒腾及毕业后在广东移动OCS维护经验，尽管不专业，可是能一步一个脚印地实施。

常常查看日志。偶尔会发现一些不怀好意的訪问，当然也可能是某些人或者机构来检查站点的安全性吧。

通过日志看看别人是怎么扫描的，採取对应的措施。添加运维安全经验。

有时候公司老是提安全不记心。还不如亲身体验一下风险，那会后怕。

1. 通过直接获取站点根文件夹的文件。

防治办法就是不要放置与站点无关的文件。

以下是一些訪问记录，看看都有些什么：

2014/07/06 17:17:38 [/radminpass.php][WARN]  radminpass.php 
2014/07/06 17:17:38 [/dg][WARN]  dg 
2014/07/06 17:17:38 [/ radminpass.php][WARN]   radminpass.php 
2014/07/06 17:17:38 [/d][WARN]  d 
2014/07/06 17:17:39 [/admin][WARN]  admin 
2014/07/06 17:17:39 [/dede][WARN]  dede 
2014/07/06 17:17:39 [/rc.php][WARN]  rc.php 
2014/07/06 17:17:39 [/admin_login.asp][WARN]  admin_login.asp 
2014/07/06 17:17:39 [/admin_login.php][WARN]  admin_login.php 
2014/07/06 17:17:39 [/install.php][WARN]  install.php 
2014/07/06 17:17:39 [/admi][WARN]  admi 
2014/07/06 17:17:39 [/manage][WARN]  manage 
2014/07/06 17:17:39 [/ded][WARN]  ded 
2014/07/06 17:17:39 [/ rc.php][WARN]   rc.php 
2014/07/06 17:17:39 [/ admin_login.asp][WARN]   admin_login.asp 
2014/07/06 17:17:39 [/ install.php][WARN]   install.php 
2014/07/06 17:17:39 [/ admin_login.php][WARN]   admin_login.php 
2014/07/06 17:17:39 [/manag][WARN]  manag 
2014/07/06 17:17:39 [/ftp.txt][WARN]  ftp.txt 
2014/07/06 17:17:39 [/使用说明.txt][WARN]  使用说明.txt 
2014/07/06 17:17:39 [/www.zip][WARN]  www.zip 
2014/07/06 17:17:39 [/admin.php][WARN]  admin.php 
2014/07/06 17:17:39 [/robot.txt][WARN]  robot.txt 
2014/07/06 17:17:39 [/wwwroot.rar][WARN]  wwwroot.rar 
2014/07/06 17:17:39 [/www.rar][WARN]  www.rar 
2014/07/06 17:17:39 [/wwwroot.zip][WARN]  wwwroot.zip 
2014/07/06 17:17:39 [/1.asp][WARN]  1.asp 
2014/07/06 17:17:39 [/fuck.asp][WARN]  fuck.asp 
2014/07/06 17:17:39 [/cmd.asp][WARN]  cmd.asp 
2014/07/06 17:17:39 [/1.php][WARN]  1.php 
2014/07/06 17:17:39 [/ok.asp][WARN]  ok.asp 
2014/07/06 17:17:39 [/123.asp][WARN]  123.asp 
2014/07/06 17:17:39 [/aspxspy.aspxx][WARN]  aspxspy.aspxx 
2014/07/06 17:17:39 [/aspxspy.phpx][WARN]  aspxspy.phpx 
2014/07/06 17:17:39 [/1.aspx][WARN]  1.aspx 
2014/07/06 17:17:39 [/ASPXspy2.phpx][WARN]  ASPXspy2.phpx 
2014/07/06 17:17:39 [/a.asp][WARN]  a.asp 
2014/07/06 17:17:39 [/ASPXspy2.aspxx][WARN]  ASPXspy2.aspxx 
2014/07/06 17:17:39 [/ wwwroot.rar][WARN]   wwwroot.rar 
2014/07/06 17:17:39 [/lcx.aspx][WARN]  lcx.aspx 
2014/07/06 17:17:39 [/ ftp.txt][WARN]   ftp.txt 
2014/07/06 17:17:39 [/ 使用说明.txt][WARN]   使用说明.txt 
2014/07/06 17:17:39 [/ www.zip][WARN]   www.zip 
2014/07/06 17:17:39 [/ robot.txt][WARN]   robot.txt 
2014/07/06 17:17:39 [/ www.rar][WARN]   www.rar 
2014/07/06 17:17:39 [/ admin.php][WARN]   admin.php 
2014/07/06 17:17:39 [/ fuck.asp][WARN]   fuck.asp 
2014/07/06 17:17:39 [/hack.asp][WARN]  hack.asp 
2014/07/06 17:17:39 [/ cmd.asp][WARN]   cmd.asp 
2014/07/06 17:17:39 [/ ok.asp][WARN]   ok.asp 
2014/07/06 17:17:39 [/xx.asp][WARN]  xx.asp 
2014/07/06 17:17:39 [/ 123.asp][WARN]   123.asp 
2014/07/06 17:17:39 [/gay.aspx][WARN]  gay.aspx 
2014/07/06 17:17:39 [/ 1.asp][WARN]   1.asp 
2014/07/06 17:17:39 [/ 1.php][WARN]   1.php 
2014/07/06 17:17:39 [/ aspxspy.aspxx][WARN]   aspxspy.aspxx 
2014/07/06 17:17:39 [/ wwwroot.zip][WARN]   wwwroot.zip 
2014/07/06 17:17:39 [/ ASPXspy2.phpx][WARN]   ASPXspy2.phpx 
2014/07/06 17:17:39 [/ a.asp][WARN]   a.asp 
2014/07/06 17:17:39 [/xxoo.asp][WARN]  xxoo.asp 
2014/07/06 17:17:39 [/xm.asp][WARN]  xm.asp 
2014/07/06 17:17:39 [/ 1.aspx][WARN]   1.aspx 
2014/07/06 17:17:39 [/ aspxspy.phpx][WARN]   aspxspy.phpx 
2014/07/06 17:17:39 [/ lcx.aspx][WARN]   lcx.aspx 
2014/07/06 17:17:39 [/diy.asp][WARN]  diy.asp 
2014/07/06 17:17:39 [/说明.txt][WARN]  说明.txt 
2014/07/06 17:17:39 [/安装说明书.txt][WARN]  安装说明书.txt 
2014/07/06 17:17:39 [/ms.asp][WARN]  ms.asp 
2014/07/06 17:17:39 [/新建文本文档.txt][WARN]  新建文本文档.txt 
2014/07/06 17:17:39 [/ xx.asp][WARN]   xx.asp 
2014/07/06 17:17:39 [/ ASPXspy2.aspxx][WARN]   ASPXspy2.aspxx 
2014/07/06 17:17:39 [/备份.rar][WARN]  备份.rar 
2014/07/06 17:17:39 [/安装说明.txt][WARN]  安装说明.txt 
2014/07/06 17:17:39 [/说明书.txt][WARN]  说明书.txt 
2014/07/06 17:17:39 [/ hack.asp][WARN]   hack.asp 
2014/07/06 17:17:39 [/站点备份.rar][WARN]  站点备份.rar 
2014/07/06 17:17:39 [/ftp.txt][WARN]  ftp.txt 
2014/07/06 17:17:39 [/mima.txt][WARN]  mima.txt 
2014/07/06 17:17:39 [/pass.txt][WARN]  pass.txt 
2014/07/06 17:17:39 [/123.txt][WARN]  123.txt 
2014/07/06 17:17:39 [/qq.txt][WARN]  qq.txt 
2014/07/06 17:17:39 [/ xxoo.asp][WARN]   xxoo.asp 
2014/07/06 17:17:39 [/ gay.aspx][WARN]   gay.aspx 
2014/07/06 17:17:39 [/password.txt][WARN]  password.txt 
2014/07/06 17:17:39 [/ xm.asp][WARN]   xm.asp 
2014/07/06 17:17:39 [/ diy.asp][WARN]   diy.asp 
2014/07/06 17:17:39 [/ 说明.txt][WARN]   说明.txt 
2014/07/06 17:17:39 [/ 备份.rar][WARN]   备份.rar 
2014/07/06 17:17:39 [/ 新建文本文档.txt][WARN]   新建文本文档.txt 
2014/07/06 17:17:39 [/ 安装说明书.txt][WARN]   安装说明书.txt 
2014/07/06 17:17:39 [/ ms.asp][WARN]   ms.asp 
2014/07/06 17:17:39 [/ ftp.txt][WARN]   ftp.txt 
2014/07/06 17:17:39 [/ mima.txt][WARN]   mima.txt 
2014/07/06 17:17:39 [/ 站点备份.rar][WARN]   站点备份.rar 
2014/07/06 17:17:39 [/ 说明书.txt][WARN]   说明书.txt 
2014/07/06 17:17:39 [/ 安装说明.txt][WARN]   安装说明.txt 
2014/07/06 17:17:39 [/ pass.txt][WARN]   pass.txt 
2014/07/06 17:17:39 [/ 123.txt][WARN]   123.txt 
2014/07/06 17:17:39 [/ qq.txt][WARN]   qq.txt 
2014/07/06 17:17:39 [/ password.txt][WARN]   password.txt 
2014/07/06 17:17:39 [/index.php/ password.txt][WARN]   password.txt

2. SQL注入、运行脚本代码

网上说的一些案例都会好理解，但实际操作就复杂多了。不是我辈能理解的。可是一定要懂得其原理。

以下是日志：

2014/08/06 08:58:47 [/us/client/site/][WARN]  ?'?

" 2014/08/06 08:58:47 [/us/client/site/e''e""][WARN] e''e"" 2014/08/06 08:58:47 [/us/hi/password/activity_android][WARN] activity_android 2014/08/06 08:58:47 [/us/hi/password/1'"][WARN] 1'" 2014/08/06 08:58:47 [/us/hi/password/\][WARN] \ 2014/08/06 08:58:48 [/us/hi/password/@@zhqPp][WARN] @@zhqPp 2014/08/06 08:58:48 [/us/hi/password/JyI=][WARN] JyI= 2014/08/06 08:58:48 [/us/hi/password/][WARN] ?

'?" 2014/08/06 08:58:48 [/us/hi/password/e''e""][WARN] e''e"" 2014/08/06 08:58:48 [/us/client/download/o2a3iWxX][WARN] o2a3iWxX 2014/08/06 08:58:48 [/us/client/download/activity_android' AND 2+1-1-1=0+0+0+1 AND 'Q36n'='Q36n][WARN] activity_android' AND 2+1-1-1=0+0+0+1 AND 'Q36n'='Q36n 2014/08/06 08:58:49 [/us/client/download/activity_android" AND 2+1-1-1=0+0+0+1 AND "ios3"="ios3][WARN] activity_android" AND 2+1-1-1=0+0+0+1 AND "ios3"="ios3 2014/08/06 08:58:49 [/us/client/download/wF9XZogm'; waitfor delay '0:0:9' -- ][WARN] wF9XZogm'; waitfor delay '0:0:9' -- 2014/08/06 08:58:49 [/us/client/download/8hzZ0diT'); waitfor delay '0:0:9' -- ][WARN] 8hzZ0diT'); waitfor delay '0:0:9' -- 2014/08/06 08:58:49 [/us/client/download/P3y3ZpXe')); waitfor delay '0:0:9' -- ][WARN] P3y3ZpXe')); waitfor delay '0:0:9' -- 2014/08/06 08:58:49 [/us/client/download/p5Jv1biQ';select pg_sleep(3); -- ][WARN] p5Jv1biQ';select pg_sleep(3); -- 2014/08/06 08:58:49 [/us/client/download/yy4bfMpu');select pg_sleep(3); -- ][WARN] yy4bfMpu');select pg_sleep(3); -- 2014/08/06 08:58:49 [/us/client/download/1n24zbF7'));select pg_sleep(3); -- ][WARN] 1n24zbF7'));select pg_sleep(3); -- 2014/08/06 08:58:49 [/us/client/site/activity_android][WARN] activity_android 2014/08/06 08:58:49 [/us/client/site/activity_android][WARN] activity_android 2014/08/06 08:58:50 [/us/client/site/bZYCjp9i][WARN] bZYCjp9i 2014/08/06 08:58:50 [/us/client/site/Yp22mRb0'; waitfor delay '0:0:8' -- ][WARN] Yp22mRb0'; waitfor delay '0:0:8' -- 2014/08/06 08:58:50 [/us/client/site/GipCpLwS'); waitfor delay '0:0:12' -- ][WARN] GipCpLwS'); waitfor delay '0:0:12' -- 2014/08/06 08:58:50 [/us/client/site/wpaFt8uZ')); waitfor delay '0:0:12' -- ][WARN] wpaFt8uZ')); waitfor delay '0:0:12' -- 2014/08/06 08:58:50 [/us/client/site/LHmRvr2W';select pg_sleep(4); -- ][WARN] LHmRvr2W';select pg_sleep(4); -- 2014/08/06 08:58:50 [/us/client/site/FpfYyg8i');select pg_sleep(4); -- ][WARN] FpfYyg8i');select pg_sleep(4); -- 2014/08/06 08:58:50 [/us/client/site/bgAKX3yU'));select pg_sleep(8); -- ][WARN] bgAKX3yU'));select pg_sleep(8); -- 2014/08/06 08:58:50 [/us/hi/password/activity_android][WARN] activity_android 2014/08/06 08:58:50 [/us/hi/password/activity_android][WARN] activity_android 2014/08/06 08:58:50 [/us/hi/password/YnYOKKNo][WARN] YnYOKKNo 2014/08/06 08:58:51 [/us/hi/password/lyolpZ8k'; waitfor delay '0:0:15' -- ][WARN] lyolpZ8k'; waitfor delay '0:0:15' -- 2014/08/06 08:58:51 [/us/hi/password/JCezDwnG'); waitfor delay '0:0:5' -- ][WARN] JCezDwnG'); waitfor delay '0:0:5' -- 2014/08/06 08:58:51 [/us/hi/password/Y21nSzkr')); waitfor delay '0:0:5' -- ][WARN] Y21nSzkr')); waitfor delay '0:0:5' -- 2014/08/06 08:58:51 [/us/hi/password/ZX3m329T';select pg_sleep(10); -- ][WARN] ZX3m329T';select pg_sleep(10); -- 2014/08/06 08:58:51 [/us/hi/password/LuzmHK9d');select pg_sleep(10); -- ][WARN] LuzmHK9d');select pg_sleep(10); -- 2014/08/06 08:58:51 [/us/hi/password/LvjtNfZh'));select pg_sleep(10); -- ][WARN] LvjtNfZh'));select pg_sleep(10); --

3. 推測可能的运行文件，或者看是否有已知漏洞的开源软件

像wordpress是最常被检測的开源站点。

除了站点同意请求URL地址，其他无关的地址都应该禁止。

还有小心robots.txt泄露了站点结构可能出现的问题。

以下仅仅是一小部分日志。仅仅有你想不到的。没有别人不会猜的，各种网页脚本后缀包

2014/08/03 04:03:23 [/us/index.php/insert.php][WARN]  insert.php WARN
2014/08/03 04:03:23 [/index.php/she11.php][WARN]  she11.php WARN
2014/08/03 04:03:23 [/us/index.php/r3za.php][WARN]  r3za.php WARN
2014/08/03 04:03:23 [/index.php/footer.php][WARN]  footer.php WARN
2014/08/03 04:03:23 [/us/index.php/hydd.php][WARN]  hydd.php WARN
2014/08/03 04:03:23 [/index.php/newfile.php][WARN]  newfile.php WARN
2014/08/03 04:03:23 [/us/index.php/Judge.php][WARN]  Judge.php WARN
2014/08/03 04:03:23 [/index.php/caoc.php][WARN]  caoc.php WARN
2014/08/03 04:03:23 [/us/index.php/she11.php][WARN]  she11.php WARN
2014/08/03 04:03:23 [/us/index.php/footer.php][WARN]  footer.php WARN
2014/08/03 04:03:23 [/index.php/ceshi.php][WARN]  ceshi.php WARN
2014/08/03 04:03:23 [/us/index.php/newfile.php][WARN]  newfile.php WARN
2014/08/03 04:03:23 [/index.php/jiance.php][WARN]  jiance.php WARN
2014/08/03 04:03:23 [/us/index.php/caoc.php][WARN]  caoc.php WARN
2014/08/03 04:03:23 [/index.php/aq.php][WARN]  aq.php WARN
2014/08/03 04:03:23 [/us/index.php/ceshi.php][WARN]  ceshi.php WARN
2014/08/03 04:03:23 [/index.php/bmzh.php][WARN]  bmzh.php WARN
2014/08/03 04:03:23 [/index.php/JspSpy.php][WARN]  JspSpy.php WARN
2014/08/03 04:03:23 [/us/index.php/jiance.php][WARN]  jiance.php WARN
2014/08/03 04:03:23 [/us/index.php/aq.php][WARN]  aq.php WARN
2014/08/03 04:03:23 [/index.php/jspSpy.php][WARN]  jspSpy.php WARN
2014/08/03 04:03:23 [/us/index.php/bmzh.php][WARN]  bmzh.php WARN
2014/08/03 04:03:23 [/index.php/jspspy.php][WARN]  jspspy.php WARN
2014/08/03 04:03:23 [/us/index.php/JspSpy.php][WARN]  JspSpy.php WARN
2014/08/03 04:03:23 [/index.php/ASPXspy.php][WARN]  ASPXspy.php WARN
2014/08/03 04:03:23 [/us/index.php/jspSpy.php][WARN]  jspSpy.php WARN
2014/08/03 04:03:23 [/index.php/aspxspy.php][WARN]  aspxspy.php WARN
2014/08/03 04:03:23 [/index.php/PHPspy.php][WARN]  PHPspy.php WARN
2014/08/03 04:03:23 [/us/index.php/jspspy.php][WARN]  jspspy.php WARN
2014/08/03 04:03:23 [/index.php/phpspy.php][WARN]  phpspy.php WARN
2014/08/03 04:03:23 [/us/index.php/ASPXspy.php][WARN]  ASPXspy.php WARN
2014/08/03 04:03:23 [/index.php/xx.php][WARN]  xx.php WARN
2014/08/03 04:03:23 [/us/index.php/aspxspy.php][WARN]  aspxspy.php WARN
2014/08/03 04:03:23 [/us/index.php/PHPspy.php][WARN]  PHPspy.php WARN
2014/08/03 04:03:23 [/index.php/1.php][WARN]  1.php WARN
2014/08/03 04:03:23 [/us/index.php/phpspy.php][WARN]  phpspy.php WARN
2014/08/03 04:03:23 [/index.php/2.php][WARN]  2.php WARN
2014/08/03 04:03:23 [/us/index.php/xx.php][WARN]  xx.php WARN
2014/08/03 04:03:23 [/us/index.php/1.php][WARN]  1.php WARN
2014/08/03 04:03:23 [/index.php/3.php][WARN]  3.php WARN
2014/08/03 04:03:23 [/us/index.php/2.php][WARN]  2.php WARN
2014/08/03 04:03:23 [/index.php/4.php][WARN]  4.php WARN
2014/08/03 04:03:23 [/us/index.php/3.php][WARN]  3.php WARN
2014/08/03 04:03:23 [/us/index.php/9.php][WARN]  9.php WARN
2014/08/03 04:03:24 [/index.php/w.php][WARN]  w.php WARN
2014/08/03 04:03:24 [/us/index.php/q.php][WARN]  q.php WARN
2014/08/03 04:03:24 [/index.php/e.php][WARN]  e.php WARN
2014/08/03 04:03:24 [/us/index.php/w.php][WARN]  w.php WARN
2014/08/03 04:03:24 [/index.php/r.php][WARN]  r.php WARN
2014/08/03 04:03:24 [/us/index.php/e.php][WARN]  e.php WARN
2014/08/03 04:03:24 [/us/index.php/r.php][WARN]  r.php WARN
2014/08/03 04:03:24 [/index.php/m.php][WARN]  m.php WARN
2014/08/03 04:03:24 [/us/index.php/n.php][WARN]  n.php WARN
2014/08/03 04:03:24 [/index.php/shell.php][WARN]  shell.php WARN
2014/08/03 04:03:24 [/us/index.php/m.php][WARN]  m.php WARN
2014/08/03 04:03:24 [/us/index.php/shell.php][WARN]  shell.php WARN
2014/08/03 04:03:27 [/kdrive/index.php/?shell.php][WARN]  ?

shell.php WARN 2014/08/03 04:03:27 [/kdrive/index.php/ASPWebPack.php][WARN] ASPWebPack.php WARN 2014/08/03 04:03:27 [/kdrive/index.php/121.php][WARN] 121.php WARN 2014/08/03 04:03:27 [/kdrive/index.php/dana.php][WARN] dana.php WARN 2014/08/03 04:03:27 [/kdrive/index.php/dark.php][WARN] dark.php WARN 2014/08/03 04:03:27 [/kdrive/index.php/dd.php][WARN] dd.php WARN 2014/08/03 04:03:27 [/kdrive/index.php/foots.php][WARN] foots.php WARN 2014/08/03 04:03:27 [/kdrive/index.php/kqx.php][WARN] kqx.php WARN 2014/08/03 04:03:27 [/kdrive/index.php/pic.php][WARN] pic.php WARN 2014/08/03 04:03:27 [/kdrive/index.php/wrsky.php][WARN] wrsky.php WARN 2014/08/03 04:03:27 [/kdrive/index.php/wuge.php][WARN] wuge.php WARN 2014/08/03 04:03:27 [/kdrive/index.php/免杀.php][WARN] 免杀.php WARN 2014/08/03 04:03:27 [/kdrive/index.php/小鱼免杀.php][WARN] 小鱼免杀.php WARN 2014/08/03 04:03:27 [/kdrive/index.php/风韵.php][WARN] 风韵.php WARN 2014/08/03 04:03:27 [/kdrive/index.php/DarkBlade.php][WARN] DarkBlade.php WARN 2014/08/03 04:03:27 [/kdrive/index.php/cmd.php][WARN] cmd.php WARN 2014/08/03 04:03:27 [/kdrive/index.php/diy.php][WARN] diy.php WARN 2014/08/03 04:03:27 [/kdrive/index.php/upfile4k2.php][WARN] upfile4k2.php WARN 2014/08/03 04:03:27 [/kdrive/index.php/xiao.php][WARN] xiao.php WARN 2014/08/03 04:03:27 [/kdrive/index.php/dic.php][WARN] dic.php WARN 2014/08/03 04:03:27 [/kdrive/index.php/wt.php][WARN] wt.php WARN 2014/08/03 04:03:27 [/kdrive/index.php/80sec.php][WARN] 80sec.php WARN 2014/08/03 04:03:27 [/kdrive/index.php/dabao.php][WARN] dabao.php WARN 2014/08/03 04:03:27 [/kdrive/index.php/T0p.php][WARN] T0p.php WARN 2014/08/03 04:03:28 [/kdrive/index.php/fuck.php][WARN] fuck.php WARN 2014/08/03 04:03:28 [/kdrive/index.php/dm.php][WARN] dm.php WARN 2014/08/03 04:03:28 [/kdrive/index.php/xm.php][WARN] xm.php WARN 2014/08/03 04:03:28 [/kdrive/index.php/dama.php][WARN] dama.php WARN 2014/08/03 04:03:28 [/kdrive/index.php/xiaoma.php][WARN] xiaoma.php WARN 2014/08/03 04:03:28 [/kdrive/index.php/asp.php][WARN] asp.php WARN 2014/08/03 04:03:28 [/kdrive/index.php/jsp.php][WARN] jsp.php WARN 2014/08/03 04:03:28 [/kdrive/index.php/php.php][WARN] php.php WARN 2014/08/03 04:03:28 [/kdrive/index.php/aspx.php][WARN] aspx.php WARN 2014/08/03 04:03:28 [/kdrive/index.php/mima.php][WARN] mima.php WARN 2014/08/03 04:03:28 [/kdrive/index.php/kill.php][WARN] kill.php WARN 2014/08/03 04:03:28 [/kdrive/index.php/ko.php][WARN] ko.php WARN 2014/08/03 04:03:28 [/kdrive/index.php/rootnull.php][WARN] rootnull.php WARN 2014/08/03 04:03:28 [/kdrive/index.php/root.php][WARN] root.php WARN 2014/08/03 04:03:28 [/kdrive/index.php/r00t.php][WARN] r00t.php WARN 2014/08/03 04:03:28 [/kdrive/index.php/sh0w.php][WARN] sh0w.php WARN 2014/08/03 04:03:28 [/kdrive/index.php/safer.php][WARN] safer.php WARN 2014/08/03 04:03:28 [/kdrive/index.php/houmen.php][WARN] houmen.php WARN 2014/08/03 04:03:28 [/kdrive/index.php/h0umen.php][WARN] h0umen.php WARN 2014/08/03 04:03:28 [/kdrive/index.php/ceshi.php][WARN] ceshi.php WARN 2014/08/03 04:03:28 [/kdrive/index.php/jiance.php][WARN] jiance.php WARN 2014/08/03 04:03:28 [/kdrive/index.php/aq.php][WARN] aq.php WARN 2014/08/03 04:03:28 [/kdrive/index.php/bmzh.php][WARN] bmzh.php WARN 2014/08/03 04:03:28 [/kdrive/index.php/JspSpy.php][WARN] JspSpy.php WARN 2014/08/03 04:03:28 [/kdrive/index.php/jspSpy.php][WARN] jspSpy.php WARN 2014/08/03 04:03:29 [/kdrive/index.php/jspspy.php][WARN] jspspy.php WARN 2014/08/03 04:03:29 [/kdrive/index.php/ASPXspy.php][WARN] ASPXspy.php WARN 2014/08/03 04:03:29 [/kdrive/index.php/aspxspy.php][WARN] aspxspy.php WARN 2014/08/03 04:03:29 [/kdrive/index.php/PHPspy.php][WARN] PHPspy.php WARN 2014/08/03 04:03:29 [/kdrive/index.php/phpspy.php][WARN] phpspy.php WARN 2014/08/03 04:03:29 [/kdrive/index.php/xx.php][WARN] xx.php WARN 2014/08/03 04:03:29 [/kdrive/index.php/1.php][WARN] 1.php WARN 2014/08/03 04:03:29 [/kdrive/index.php/2.php][WARN] 2.php WARN 2014/08/03 04:03:29 [/kdrive/index.php/q.php][WARN] q.php WARN 2014/08/03 04:03:29 [/kdrive/index.php/w.php][WARN] w.php WARN 2014/08/03 04:03:29 [/kdrive/index.php/e.php][WARN] e.php WARN 2014/08/03 04:03:29 [/kdrive/index.php/r.php][WARN] r.php WARN 2014/08/03 04:03:29 [/kdrive/index.php/t.php][WARN] t.php WARN 2014/08/03 04:03:29 [/kdrive/index.php/y.php][WARN] y.php WARN 2014/08/03 04:03:29 [/kdrive/index.php/u.php][WARN] u.php WARN 2014/08/03 04:03:29 [/kdrive/index.php/i.php][WARN] i.php WARN 2014/08/03 04:03:29 [/kdrive/index.php/o.php][WARN] o.php WARN 2014/08/03 04:03:30 [/kdrive/index.php/shell.php][WARN] shell.php WARN 2014/08/03 04:03:33 [/index.php/nulllllllllll.html][WARN] nulllllllllll.html WARN 2014/08/03 04:03:35 [/index.php/bbcode.js][WARN] bbcode.js WARN 2014/08/03 04:03:35 [/us/index.php/robots.txt][WARN] robots.txt WARN 2014/08/03 04:03:35 [/index.php/newsfader.js][WARN] newsfader.js WARN 2014/08/03 04:03:35 [/us/index.php/bbcode.js][WARN] bbcode.js WARN 2014/08/03 04:03:35 [/index.php/templates.cdb][WARN] templates.cdb WARN 2014/08/03 04:03:35 [/us/index.php/newsfader.js][WARN] newsfader.js WARN 2014/08/03 04:03:35 [/index.php/u2upopup.js][WARN] u2upopup.js WARN 2014/08/03 04:03:35 [/us/index.php/templates.cdb][WARN] templates.cdb WARN 2014/08/03 04:03:35 [/us/index.php/u2upopup.js][WARN] u2upopup.js WARN 2014/08/03 04:03:36 [/index.php/bbcode.js][WARN] bbcode.js WARN 2014/08/03 04:03:36 [/index.php/newsfader.js][WARN] newsfader.js WARN 2014/08/03 04:03:36 [/us/index.php/bbcode.js][WARN] bbcode.js WARN 2014/08/03 04:03:36 [/index.php/templates.cdb][WARN] templates.cdb WARN 2014/08/03 04:03:36 [/us/index.php/newsfader.js][WARN] newsfader.js WARN 2014/08/03 04:03:36 [/index.php/u2upopup.js][WARN] u2upopup.js WARN 2014/08/03 04:03:36 [/us/index.php/templates.cdb][WARN] templates.cdb WARN 2014/08/03 04:03:36 [/us/index.php/u2upopup.js][WARN] u2upopup.js WARN 2014/08/03 04:03:36 [/kdrive/index.php/robots.txt][WARN] robots.txt WARN 2014/08/03 04:03:36 [/kdrive/index.php/bbcode.js][WARN] bbcode.js WARN 2014/08/03 04:03:36 [/kdrive/index.php/newsfader.js][WARN] newsfader.js WARN 2014/08/03 04:03:36 [/kdrive/index.php/templates.cdb][WARN] templates.cdb WARN 2014/08/03 04:03:36 [/kdrive/index.php/u2upopup.js][WARN] u2upopup.js WARN 2014/08/03 04:03:36 [/kdrive/index.php/bbcode.js][WARN] bbcode.js WARN 2014/08/03 04:03:36 [/kdrive/index.php/newsfader.js][WARN] newsfader.js WARN 2014/08/03 04:03:36 [/kdrive/index.php/templates.cdb][WARN] templates.cdb WARN 2014/08/03 04:03:36 [/kdrive/index.php/u2upopup.js][WARN] u2upopup.js WARN 2014/08/03 04:03:37 [/index.php/alipay.html][WARN] alipay.html WARN 2014/08/03 04:03:37 [/us/index.php/alipay.html][WARN] alipay.html WARN 2014/08/03 04:03:38 [/kdrive/index.php/alipay.html][WARN] alipay.html WARN 2014/08/03 04:03:38 [/index.php/wlwmanifest.xml][WARN] wlwmanifest.xml WARN 2014/08/03 04:03:38 [/us/index.php/robots.txt][WARN] robots.txt WARN 2014/08/03 04:03:38 [/us/index.php/wlwmanifest.xml][WARN] wlwmanifest.xml WARN 2014/08/03 04:03:39 [/kdrive/index.php/robots.txt][WARN] robots.txt WARN 2014/08/03 04:03:39 [/kdrive/index.php/wlwmanifest.xml][WARN] wlwmanifest.xml WARN 2014/08/03 04:03:39 [/us/index.php/robots.txt][WARN] robots.txt WARN 2014/08/03 04:03:40 [/kdrive/index.php/robots.txt][WARN] robots.txt WARN 2014/08/03 04:03:41 [/index.php/license.txt][WARN] license.txt WARN 2014/08/03 04:03:41 [/us/index.php/license.txt][WARN] license.txt WARN 2014/08/03 04:03:41 [/kdrive/index.php/license.txt][WARN] license.txt WARN 2014/08/03 04:03:42 [/us/index.php/robots.txt][WARN] robots.txt WARN 2014/08/03 04:03:42 [/kdrive/index.php/robots.txt][WARN] robots.txt WARN 2014/08/03 04:03:43 [/index.php/htaccess.txt][WARN] htaccess.txt WARN 2014/08/03 04:03:43 [/index.php/CONTRIBUTING.md][WARN] CONTRIBUTING.md WARN 2014/08/03 04:03:43 [/us/index.php/htaccess.txt][WARN] htaccess.txt WARN 2014/08/03 04:03:43 [/index.php/phpunit.xml.dist][WARN] phpunit.xml.dist WARN 2014/08/03 04:03:43 [/us/index.php/CONTRIBUTING.md][WARN] CONTRIBUTING.md WARN 2014/08/03 04:03:43 [/index.php/joomla.xml][WARN] joomla.xml WARN 2014/08/03 04:03:43 [/us/index.php/phpunit.xml.dist][WARN] phpunit.xml.dist WARN 2014/08/03 04:03:43 [/index.php/README.txt][WARN] README.txt WARN 2014/08/03 04:03:43 [/us/index.php/robots.txt][WARN] robots.txt WARN 2014/08/03 04:03:43 [/index.php/robots.txt.dist][WARN] robots.txt.dist WARN 2014/08/03 04:03:43 [/us/index.php/joomla.xml][WARN] joomla.xml WARN 2014/08/03 04:03:43 [/index.php/web.config.txt][WARN] web.config.txt WARN 2014/08/03 04:03:43 [/us/index.php/README.txt][WARN] README.txt WARN 2014/08/03 04:03:43 [/us/index.php/robots.txt.dist][WARN] robots.txt.dist WARN 2014/08/03 04:03:43 [/us/index.php/web.config.txt][WARN] web.config.txt WARN 2014/08/03 04:03:44 [/kdrive/index.php/htaccess.txt][WARN] htaccess.txt WARN 2014/08/03 04:03:44 [/kdrive/index.php/CONTRIBUTING.md][WARN] CONTRIBUTING.md WARN 2014/08/03 04:03:44 [/kdrive/index.php/phpunit.xml.dist][WARN] phpunit.xml.dist WARN 2014/08/03 04:03:44 [/kdrive/index.php/robots.txt][WARN] robots.txt WARN 2014/08/03 04:03:44 [/kdrive/index.php/joomla.xml][WARN] joomla.xml WARN 2014/08/03 04:03:44 [/kdrive/index.php/README.txt][WARN] README.txt WARN 2014/08/03 04:03:44 [/kdrive/index.php/robots.txt.dist][WARN] robots.txt.dist WARN 2014/08/03 04:03:44 [/kdrive/index.php/web.config.txt][WARN] web.config.txt WARN 2014/08/03 04:03:45 [/index.php/readme.txt][WARN] readme.txt WARN 2014/08/03 04:03:45 [/us/index.php/readme.txt][WARN] readme.txt WARN 2014/08/03 04:03:45 [/kdrive/index.php/readme.txt][WARN] readme.txt WARN 2014/08/03 04:03:46 [/us/index.php/robots.txt][WARN] robots.txt WARN 2014/08/03 04:03:47 [/kdrive/index.php/robots.txt][WARN] robots.txt WARN 2014/08/03 04:03:48 [/index.php/licence.txt][WARN] licence.txt WARN 2014/08/03 04:03:48 [/index.php/recommend.html][WARN] recommend.html WARN 2014/08/03 04:03:48 [/index.php/wind.sql][WARN] wind.sql WARN 2014/08/03 04:03:48 [/us/index.php/licence.txt][WARN] licence.txt WARN 2014/08/06 08:57:48 [/us/client/download/Li4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAucG5n][DEBUG] Li4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAucG5n 2014/08/06 08:57:49 [/us/client/download/WEB-INF\web.xml][DEBUG] WEB-INF\web.xml 2014/08/06 08:57:49 [/us/client/download/../../../../../../../../windows/win.ini][DEBUG] ../../../../../../../../windows/win.ini 2014/08/06 08:57:49 [/us/client/download/................windowswin.ini][DEBUG] ................windowswin.ini 2014/08/06 08:57:49 [/us/client/download/..\..\..\..\..\..\..\..\windows\win.ini][DEBUG] ..\..\..\..\..\..\..\..\windows\win.ini 2014/08/06 08:57:49 [/us/client/download/WEB-INF\web.xml][DEBUG] WEB-INF\web.xml

4. XSS、特殊字符等探測

也非常多。不粘贴出来了。

2014/08/03 03:55:03 [/<IMG SRC="javascript:alert(cross_site_scripting.nasl);">.cgi][WARN] 
2014/08/03 03:55:03 [/<IMG SRC="javascript:alert(cross_site_scripting.nasl);">.exe][WARN] 
2014/08/03 03:55:03 [/<IMG SRC="javascript:alert(cross_site_scripting.nasl);">.cfm][WARN] 
2014/08/03 03:55:03 [/<IMG SRC="javascript:alert(cross_site_scripting.nasl);">.html][WARN] 
2014/08/03 03:55:04 [/<IMG SRC="javascript:alert(cross_site_scripting.nasl);">.jsp][WARN]  
2014/08/03 03:55:04 [/<IMG SRC="javascript:alert(cross_site_scripting.nasl);">.php][WARN] 
2014/08/03 03:55:04 [/<IMG SRC="javascript:alert(cross_site_scripting.nasl);">.php3][WARN]
2014/08/06 08:58:39 [/us/client/site/!(()&&!|*|*|]
2014/08/06 08:58:36 [/us/hi/password/"+response.write(9800452*9475116)+"]
2014/08/06 08:58:33 [/us/hi/password/${99833+100209}][DEBUG]
2014/08/06 08:58:40 [/us/client/download/)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))][WARN]

总结：

还是那句：过滤输入，转义输出

另外：病从口入，站点URL地址就是这个口