<?xml version="1.0" encoding="utf-8" ?><rss version="2.0"><channel><title><![CDATA[dbabs的博客]]></title><description><![CDATA[]]></description><link>https://blog.youkuaiyun.com/dbabs</link><language>zh-cn</language><generator>https://blog.youkuaiyun.com/</generator><copyright><![CDATA[Copyright &copy; dbabs]]></copyright><item><title><![CDATA[【SRC挖掘实录】反序列化漏洞篇]]></title><link>https://blog.youkuaiyun.com/dbabs/article/details/130901917</link><guid>https://blog.youkuaiyun.com/dbabs/article/details/130901917</guid><author>dbabs</author><pubDate>Sat, 27 May 2023 16:38:18 +0800</pubDate><description><![CDATA[在身份验证，文件读写，数据传输等功能处，在未对反序列化接口做访问控制，未对序列化数据做加密和签名，加密密钥使用硬编码（如Shiro 1.2.4），使用不安全的反序列化框架库（如Fastjson 1.2.24）或函数的情况下，由于序列化数据可被用户控制，攻击者可以精心构造恶意的序列化数据（执行特定代码或命令的数据）传递给应用程序，在应用程序反序列化对象时执行攻击者构造的恶意代码，达到攻击者的目的。]]></description><category></category></item><item><title><![CDATA[【SRC挖掘实录】逻辑漏洞篇]]></title><link>https://blog.youkuaiyun.com/dbabs/article/details/130840092</link><guid>https://blog.youkuaiyun.com/dbabs/article/details/130840092</guid><author>dbabs</author><pubDate>Wed, 24 May 2023 11:29:45 +0800</pubDate><description><![CDATA[常见的OWASP漏洞，通过漏洞扫描工具，大多支持自动化或者半自动化扫描出来，并且传统的安全设备或者防护措施收效甚微。但逻辑漏洞是和系统自身功能和逻辑有关系的漏洞，每一家的漏洞出现可能存在一定的独特性，很难复制或者通过规则脚本和漏扫工具扫描出来，因此逻辑漏洞大多需要配合代码审计和手段测试才可以发现相关漏洞，也是工具无法代替人工的漏洞。这三个漏洞通常都出现在用户登录界面，是由于开发者未对用户进行严格的身份鉴权和验证导致的漏洞。]]></description><category></category></item><item><title><![CDATA[php文件包含漏洞复现]]></title><link>https://blog.youkuaiyun.com/dbabs/article/details/129364618</link><guid>https://blog.youkuaiyun.com/dbabs/article/details/129364618</guid><author>dbabs</author><pubDate>Mon, 06 Mar 2023 16:04:28 +0800</pubDate><description><![CDATA[访问http://192.168.74.136:8080/lfi.php?file=/etc/passwd，确定存在文件包含漏洞。这时就可以利用文件包含漏洞进行任意命令执行。使用python脚本实现文件包含漏洞利用。]]></description><category></category></item><item><title><![CDATA[Apache SSI 远程命令执行漏洞复现]]></title><link>https://blog.youkuaiyun.com/dbabs/article/details/129118480</link><guid>https://blog.youkuaiyun.com/dbabs/article/details/129118480</guid><author>dbabs</author><pubDate>Mon, 20 Feb 2023 09:41:47 +0800</pubDate><description><![CDATA[Apache SSI 远程命令执行漏洞复现]]></description><category></category></item><item><title><![CDATA[一次scr挖掘实录]]></title><link>https://blog.youkuaiyun.com/dbabs/article/details/129082053</link><guid>https://blog.youkuaiyun.com/dbabs/article/details/129082053</guid><author>dbabs</author><pubDate>Fri, 17 Feb 2023 11:37:09 +0800</pubDate><description><![CDATA[一次src挖掘实录]]></description><category></category></item><item><title><![CDATA[tomcat远程代码执行漏洞(cve-2017-12615)复现]]></title><link>https://blog.youkuaiyun.com/dbabs/article/details/128995110</link><guid>https://blog.youkuaiyun.com/dbabs/article/details/128995110</guid><author>dbabs</author><pubDate>Sun, 12 Feb 2023 15:01:49 +0800</pubDate><description><![CDATA[cve-2017-12615]]></description><category></category></item><item><title><![CDATA[SSTI(模块注入)的简单学习]]></title><link>https://blog.youkuaiyun.com/dbabs/article/details/128888331</link><guid>https://blog.youkuaiyun.com/dbabs/article/details/128888331</guid><author>dbabs</author><pubDate>Sun, 05 Feb 2023 11:14:51 +0800</pubDate><description><![CDATA[SSTI即服务端模版注入攻击。由于程序员代码编写不当，导致用户输入可以修改服务端模版的执行逻辑，从而造成XSS,任意文件读取，代码执行等一系列问题。]]></description><category></category></item><item><title><![CDATA[利用sqlmap和蚁剑进行简单的渗透测试和挂小马操作]]></title><link>https://blog.youkuaiyun.com/dbabs/article/details/128755736</link><guid>https://blog.youkuaiyun.com/dbabs/article/details/128755736</guid><author>dbabs</author><pubDate>Tue, 24 Jan 2023 11:41:10 +0800</pubDate><description><![CDATA[利用sqlmap进行文件上传和简单的渗透测试]]></description><category></category></item><item><title><![CDATA[永恒之蓝学习记录]]></title><link>https://blog.youkuaiyun.com/dbabs/article/details/128634539</link><guid>https://blog.youkuaiyun.com/dbabs/article/details/128634539</guid><author>dbabs</author><pubDate>Tue, 10 Jan 2023 18:52:16 +0800</pubDate><description><![CDATA[复现永恒之蓝漏洞]]></description><category></category></item><item><title><![CDATA[史上最全的win7虚拟机安装vmtools的报错指南]]></title><link>https://blog.youkuaiyun.com/dbabs/article/details/128620370</link><guid>https://blog.youkuaiyun.com/dbabs/article/details/128620370</guid><author>dbabs</author><pubDate>Mon, 09 Jan 2023 20:12:38 +0800</pubDate><description><![CDATA[涵盖了两种常见的win7镜像安装vmtools会遇见的错误]]></description><category></category></item></channel></rss>