千里之行,始于足下
常用工具与靶场与下载链接
工欲其善必先利器
| 工具 | 链接 | 教程 | 描述 |
|---|---|---|---|
| github | https://github.com | github | |
| dirsearch | https://github.com/maurosoria/dirsearch | 目录扫描 | |
| xray | https://download.xray.cool/xray | 漏洞扫描 | |
| vulmap | https://github.com/zhzyker/vulmap | 漏洞扫描 | |
| sqlmap | https://github.com/sqlmapproject/sqlmap | SQL注入 | |
| tplmap | https://github.com/epinna/tplmap | SSTI注入(py2) | |
| CaptfEncoder | https://github.com/guyoung/CaptfEncoder/releases | 进制转换 | |
| BerylEnigma | https://github.com/ffffffff0x/BerylEnigma/releases | 进制转换 | |
| 大佬的笔记 | https://github.com/ffffffff0x/1earn | 笔记 | |
| f8x | wget -O f8x https://f8x.io/ && mv --force f8x /usr/local/bin/f8x && chmod +x /usr/local/bin/f8x | linux环境部署 | |
| 小皮面板 | wget -O install.sh https://download.xp.cn/install.sh && sudo bash install.sh | 运维面板 | |
| 宝塔 | wget -O install.sh http://download.bt.cn/install/install-ubuntu_6.0.sh && sudo bash install.sh | 运维面板 | |
| 宝塔卸载 | wget http://download.bt.cn/install/bt-uninstall.sh | ||
| awd | https://github.com/fyfztms/awd_ctf_platform | ||
| 蚁剑加载器 | https://github.com/AntSwordProject/AntSword-Loader | ||
| 蚁剑 | https://github.com/AntSwordProject/antSword | 一句话木马利用工具 | |
| 工具 | 链接 | wp |
|---|---|---|
| dvwa(php7) | https://github.com/digininja/DVWA | dvwa_wp |
| pikachu | https://github.com/zhuifengshaonianhanlu/pikachu | pikachu_wp |
| uploadlabs(php5.2.17) | https://github.com/clriseaa/docker-uploadlabs | uploadlabs_wp |
| sqlilabs(php5) | https://github.com/himadriganguly/sqlilabs | sqlilabs_wp |
| vulhub(中间件漏洞) | https://github.com/vulhub/vulhub | |
| xsslabs | https://xssaq.com/yx/index.php | xsslabs_wp |
| xvwa | https://github.com/s4n7h0/xvwa | xvwa_wp |
- 使用基础爬虫爬取并对爬虫爬取的链接进行漏洞扫描：
./xray.exe webscan --basic-crawler http://example.com --html-output xxx.html
- 代理模式
./xray.exe webscan --listen 127.0.0.1:7777 --html-output xray-testphp.html --poc pocs/* --plugin phantasm,baseline,brute-force,cmd-injection,crlf-injection,dirscan,fastjson,jsonp,path-traversal,redirect,shiro,sqldet,ssrf,struts,thinkphp,upload,xss,xxe
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent