第五次课笔记

·前情提要

        ·kali

        ·burp suite

        ·nmap //端口，端口不一定对应某服务

·基础

        ·powershell.exe

·docker //漏洞环境

        ·docker是基础，docker-compose是功能

        

·文件上传漏洞

        ·上传恶意脚本文件xxx.asp

        ·利用漏洞三要点

                ·可上传

                ·可执行 //php、asp、jsp恶意脚本文件

                ·可访问

        ·防御漏洞三要点

                ·对上传文件进行后缀名限制，不可解析

                ·上传目录设置不可执行

                ·通过CGI或文件ID间接访问

        ·基础知识

                ·<?php eval($_POST[1]);?> //post里的值相当于密码，一句木马

                ·<?php eval($_POST[‘password’]);?> //post里的值相当于密码

                ·webshell恶意脚本

                ·getshell 已经获得权限

        ·常见技巧

                ·中间件解析绕过 //可以理解为服务器本身，不是root

                        ·中国蚁剑

                                ·antsword

                                ·github下载

                ·UPLOAD-LABS

                ·JS绕过

                        ·上传webshell

                                ·<?php eval($_POST[‘password’]);?>

                                  Password =phpinfo()

                                ·保存为.php

                        ·怎么判断JS

                                ·点击上传后，弹窗的速度，慢速表示前端不是js，快速大概率是js

                                ·显示网页源代码

                        ·用burp suite把文件名由jpg改成php

                ·MIME绕过 //媒体类型

                        ·用burp suite 把content-type改了

                ·黑名单绕过

                        ·可以换一个后缀上传

                ·htaccess绕过

                ·大小写绕过

                ·linux软连接特性绕过