千里之行,始于足下
常用工具与靶场与下载链接
工欲其善必先利器
工具 | 链接 | 教程 | 描述 |
---|---|---|---|
github | https://github.com | github | |
dirsearch | https://github.com/maurosoria/dirsearch | 目录扫描 | |
xray | https://download.xray.cool/xray | 漏洞扫描 | |
vulmap | https://github.com/zhzyker/vulmap | 漏洞扫描 | |
sqlmap | https://github.com/sqlmapproject/sqlmap | SQL注入 | |
tplmap | https://github.com/epinna/tplmap | SSTI注入(py2) | |
CaptfEncoder | https://github.com/guyoung/CaptfEncoder/releases | 进制转换 | |
BerylEnigma | https://github.com/ffffffff0x/BerylEnigma/releases | 进制转换 | |
大佬的笔记 | https://github.com/ffffffff0x/1earn | 笔记 | |
f8x | wget -O f8x https://f8x.io/ && mv --force f8x /usr/local/bin/f8x && chmod +x /usr/local/bin/f8x | linux环境部署 | |
小皮面板 | wget -O install.sh https://download.xp.cn/install.sh && sudo bash install.sh | 运维面板 | |
宝塔 | wget -O install.sh http://download.bt.cn/install/install-ubuntu_6.0.sh && sudo bash install.sh | 运维面板 | |
宝塔卸载 | wget http://download.bt.cn/install/bt-uninstall.sh | ||
awd | https://github.com/fyfztms/awd_ctf_platform | ||
蚁剑加载器 | https://github.com/AntSwordProject/AntSword-Loader | ||
蚁剑 | https://github.com/AntSwordProject/antSword | 一句话木马利用工具 | |
工具 | 链接 | wp |
---|---|---|
dvwa(php7) | https://github.com/digininja/DVWA | dvwa_wp |
pikachu | https://github.com/zhuifengshaonianhanlu/pikachu | pikachu_wp |
uploadlabs(php5.2.17) | https://github.com/clriseaa/docker-uploadlabs | uploadlabs_wp |
sqlilabs(php5) | https://github.com/himadriganguly/sqlilabs | sqlilabs_wp |
vulhub(中间件漏洞) | https://github.com/vulhub/vulhub | |
xsslabs | https://xssaq.com/yx/index.php | xsslabs_wp |
xvwa | https://github.com/s4n7h0/xvwa | xvwa_wp |
- 使用基础爬虫爬取并对爬虫爬取的链接进行漏洞扫描:
./xray.exe webscan --basic-crawler http://example.com --html-output xxx.html
- 代理模式
./xray.exe webscan --listen 127.0.0.1:7777 --html-output xray-testphp.html --poc pocs/* --plugin phantasm,baseline,brute-force,cmd-injection,crlf-injection,dirscan,fastjson,jsonp,path-traversal,redirect,shiro,sqldet,ssrf,struts,thinkphp,upload,xss,xxe