<?xml version="1.0" encoding="utf-8" ?><rss version="2.0"><channel><title><![CDATA[3hex的博客]]></title><description><![CDATA[]]></description><link>https://blog.youkuaiyun.com/qq_40929683</link><language>zh-cn</language><generator>https://blog.youkuaiyun.com/</generator><copyright><![CDATA[Copyright &copy; qq_40929683]]></copyright><item><title><![CDATA[PU轴承数据集分析]]></title><link>https://blog.youkuaiyun.com/qq_40929683/article/details/143971895</link><guid>https://blog.youkuaiyun.com/qq_40929683/article/details/143971895</guid><author>qq_40929683</author><pubDate>Fri, 22 Nov 2024 13:48:02 +0800</pubDate><description><![CDATA[提取码: 1111。]]></description><category></category></item><item><title><![CDATA[[VSCode插件] 轻量级静态博客 - MDBlog]]></title><link>https://blog.youkuaiyun.com/qq_40929683/article/details/136419175</link><guid>https://blog.youkuaiyun.com/qq_40929683/article/details/136419175</guid><author>qq_40929683</author><pubDate>Sat, 02 Mar 2024 17:31:09 +0800</pubDate><description><![CDATA[VSCode插件，基于Markdown的轻量级静态博客系统，同时支持导出为可以部署的静态博客。]]></description><category></category></item><item><title><![CDATA[[抓包] 微信小程序（PC版）如何抓包]]></title><link>https://blog.youkuaiyun.com/qq_40929683/article/details/130778105</link><guid>https://blog.youkuaiyun.com/qq_40929683/article/details/130778105</guid><author>qq_40929683</author><pubDate>Sat, 20 May 2023 10:55:48 +0800</pubDate><description><![CDATA[PC版微信小程序抓包]]></description><category></category></item><item><title><![CDATA[ThinkAdminV6 CVE-2020-25540 目录遍历文件读取漏洞]]></title><link>https://blog.youkuaiyun.com/qq_40929683/article/details/121486899</link><guid>https://blog.youkuaiyun.com/qq_40929683/article/details/121486899</guid><author>qq_40929683</author><pubDate>Tue, 23 Nov 2021 10:50:58 +0800</pubDate><description><![CDATA[POC:https://github.com/Schira4396/CVE-2020-25540/blob/main/poc.pyhttps://github.com/Schira4396/CVE-2020-25540/blob/main/poc.py

影响版本：

ThinkAdmin版本 ≤ 2020.08.03.01

漏洞详解：

https://github.com/zoujingli/ThinkAdmin/issues/244https://github.com/zoujingli/Think]]></description><category></category></item><item><title><![CDATA[[靶场] SQLi-Labs Less62-Less69]]></title><link>https://blog.youkuaiyun.com/qq_40929683/article/details/120622496</link><guid>https://blog.youkuaiyun.com/qq_40929683/article/details/120622496</guid><author>qq_40929683</author><pubDate>Thu, 28 Oct 2021 14:59:24 +0800</pubDate><description><![CDATA[66.Less62

请求方式
			注入方式
			备注
		GET
			盲注
			130次语句以内完成
		
http://127.0.0.1:8003/Less-62/?id=1

http://127.0.0.1:8003/Less-62/?id=-1')  or 1  --+

http://127.0.0.1:8003/Less-62/?id=-1')  or (select 1)&lt;0  --+



67.Less63

请求方式
			注入方式
			备注
		GET
			盲注
]]></description><category></category></item><item><title><![CDATA[[工具]sqlmap初步了解（二）]]></title><link>https://blog.youkuaiyun.com/qq_40929683/article/details/120699727</link><guid>https://blog.youkuaiyun.com/qq_40929683/article/details/120699727</guid><author>qq_40929683</author><pubDate>Mon, 11 Oct 2021 12:06:58 +0800</pubDate><description><![CDATA[靶场：SqliLabs

sqlmap1.4.7


二、sqlmap的优化（Optimization）、注入（Injection）和检测（Detection）



// 优化

// 这些选项有助于优化sqlmap的性能

Optimization:

These options can be used to optimize the performance of sqlmap

// 打开所有的性能优化开关

-o         Turn on all opti...]]></description><category></category></item><item><title><![CDATA[[工具]sqlmap初步了解（一）]]></title><link>https://blog.youkuaiyun.com/qq_40929683/article/details/120691788</link><guid>https://blog.youkuaiyun.com/qq_40929683/article/details/120691788</guid><author>qq_40929683</author><pubDate>Mon, 11 Oct 2021 11:22:08 +0800</pubDate><description><![CDATA[靶场：SqliLabs

sqlmap1.4.7


一、



// 用法: 运行python3 sqlmap [参数]，或sqlmap [参数]

Usage: python3 sqlmap [options]

// 参数

Options:

// -h, --help: 打印帮助信息并退出

-h, --help      Show basic help message and exit

// 打印详细的帮助信息并退出

-hh          Show ad...]]></description><category></category></item><item><title><![CDATA[[工具] nmap初步了解（五）]]></title><link>https://blog.youkuaiyun.com/qq_40929683/article/details/120691276</link><guid>https://blog.youkuaiyun.com/qq_40929683/article/details/120691276</guid><author>qq_40929683</author><pubDate>Sun, 10 Oct 2021 20:29:46 +0800</pubDate><description><![CDATA[靶机：Bee-box

Nmap 7.80


五、nmap输出和杂项

官方地址：

Nmap参考指南(Man Page) | https://nmap.org/man/zh/index.html// 输出

OUTPUT:

// 参数

// -oN/-oX/-oS/-oG: 输出为标准输出，XML输出，脚本小子输出，Grep输出

-oN/-oX/-oS/-oG &lt;file&gt;: Output scan in normal, XML, s|&lt;rIpt kIddi3,
  an...]]></description><category></category></item><item><title><![CDATA[[工具] nmap初步了解（四）]]></title><link>https://blog.youkuaiyun.com/qq_40929683/article/details/120690581</link><guid>https://blog.youkuaiyun.com/qq_40929683/article/details/120690581</guid><author>qq_40929683</author><pubDate>Sun, 10 Oct 2021 20:02:47 +0800</pubDate><description><![CDATA[靶机：Bee-box

Nmap 7.80


四、nmap时间和性能、防火墙和IDS绕过

官方地址：

Nmap参考指南(Man Page) | https://nmap.org/man/zh/// 时间和性能

TIMING AND PERFORMANCE:

// 参数

// time的单位可以使用ms,s,m,h表示对应的时间

Options which take &lt;time&gt; are in seconds, or append 'ms' (milliseconds),

's'.]]></description><category></category></item><item><title><![CDATA[[工具] nmap初步了解（三）]]></title><link>https://blog.youkuaiyun.com/qq_40929683/article/details/120684321</link><guid>https://blog.youkuaiyun.com/qq_40929683/article/details/120684321</guid><author>qq_40929683</author><pubDate>Sun, 10 Oct 2021 13:09:28 +0800</pubDate><description><![CDATA[靶机：Bee-box

Nmap 7.80


二、nmap服务识别和版本探测、脚本扫描、OS识别

官方地址：

Nmap参考指南(Man Page) | https://nmap.org/man/zh///服务识别和版本探测

SERVICE/VERSION DETECTION:

//参数

// -sV: 打开端口的服务版本探测

-sV: Probe open ports to determine service/version info

// nmap -F- vA192.168.1...]]></description><category></category></item><item><title><![CDATA[[工具] nmap初步了解（二）]]></title><link>https://blog.youkuaiyun.com/qq_40929683/article/details/120683218</link><guid>https://blog.youkuaiyun.com/qq_40929683/article/details/120683218</guid><author>qq_40929683</author><pubDate>Sun, 10 Oct 2021 11:26:07 +0800</pubDate><description><![CDATA[靶机：Bee-box

Nmap 7.80


二、nmap端口扫描技术和规格顺序

官方地址：

Nmap参考指南(Man Page) | https://nmap.org/man/zh/// 端口扫描技术

SCAN TECHNIQUES:

// -sS/sT/sA/sW/sM: 利用

-sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans

-sU: UDP Scan

-sN/sF/sX: TCP Null, FIN, and Xm.]]></description><category></category></item><item><title><![CDATA[[工具] nmap初步了解（一）]]></title><link>https://blog.youkuaiyun.com/qq_40929683/article/details/120671463</link><guid>https://blog.youkuaiyun.com/qq_40929683/article/details/120671463</guid><author>qq_40929683</author><pubDate>Sat, 09 Oct 2021 23:43:57 +0800</pubDate><description><![CDATA[靶机：Bee-box

Nmap 7.80


一、nmap参数解析

官方地址：Nmap参考指南(Man Page) | https://nmap.org/man/zh/

// namp版本介绍

Nmap 7.80 ( https://nmap.org )

// 命令用法介绍，命令格式： nmap [扫描类型] [可选项] {目标：符合目标规范的目标} ，[]为可选项

Usage: nmap [Scan Type(s)] [Options] {target specification}

/...]]></description><category></category></item><item><title><![CDATA[常见靶场汇总]]></title><link>https://blog.youkuaiyun.com/qq_40929683/article/details/120663548</link><guid>https://blog.youkuaiyun.com/qq_40929683/article/details/120663548</guid><author>qq_40929683</author><pubDate>Sat, 09 Oct 2021 08:29:20 +0800</pubDate><description><![CDATA[部分靶场是线上，部分是需要搭建本地环境。


1. 综合性靶场

DVWA - Damn Vulnerable Web ApplicationDamn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a le.]]></description><category></category></item><item><title><![CDATA[[靶场] SQLi-Labs Less54-Less61]]></title><link>https://blog.youkuaiyun.com/qq_40929683/article/details/120566058</link><guid>https://blog.youkuaiyun.com/qq_40929683/article/details/120566058</guid><author>qq_40929683</author><pubDate>Thu, 30 Sep 2021 16:30:50 +0800</pubDate><description><![CDATA[从Less54之后为Challenges，在n次之内从challenges数据库中取出相应的数据。

58.Less54

请求方式
			注入方式
			备注
		GET
			Union内联注入
			10次语句以内完成
		
http://127.0.0.1:8003/Less-54/?id=1

http://127.0.0.1:8003/Less-54/?id=1' and 0 --+

http://127.0.0.1:8003/Less-54/?id=1' order by 1 --+
htt]]></description><category></category></item><item><title><![CDATA[[靶场] SQLi-Labs Less46-Less53]]></title><link>https://blog.youkuaiyun.com/qq_40929683/article/details/120559577</link><guid>https://blog.youkuaiyun.com/qq_40929683/article/details/120559577</guid><author>qq_40929683</author><pubDate>Thu, 30 Sep 2021 10:17:24 +0800</pubDate><description><![CDATA[提供主要的语句，略去探测数据库名，表名，字段名的步骤。

50.Less46

请求方式
			注入方式
			类型
			备注
		GET
			报错注入
			整型
			注入点在order by处
		1. 正常提交


http://127.0.0.1:8003/Less-46/?sort=1

2. 语句报错


http://127.0.0.1:8003/Less-46/?sort=1 1'2"3
http://127.0.0.1:8003/Less-46/?sort=1 1'
http://.]]></description><category></category></item><item><title><![CDATA[[靶场] SQLi-Labs Less37-Less45]]></title><link>https://blog.youkuaiyun.com/qq_40929683/article/details/120542587</link><guid>https://blog.youkuaiyun.com/qq_40929683/article/details/120542587</guid><author>qq_40929683</author><pubDate>Wed, 29 Sep 2021 11:56:55 +0800</pubDate><description><![CDATA[提供主要的语句，略去探测数据库名，表名，字段名的步骤。

41.Less37

请求方式
			注入方式
			类型
			备注
		POST
			Union注入，宽字节绕过
			字符型
			过滤特殊字符
		1. 正常提交


uname=1&amp;passwd=1

2. 语句报错


uname=1 1'2"3 &amp;passwd=1
uname=1 1%a0'2"3 &amp;passwd=1
uname=1 %a0' # &amp;passwd=2

3. 执行注入的SQL


un.]]></description><category></category></item><item><title><![CDATA[[靶场] SQLi-Labs Less28-Less36]]></title><link>https://blog.youkuaiyun.com/qq_40929683/article/details/120483280</link><guid>https://blog.youkuaiyun.com/qq_40929683/article/details/120483280</guid><author>qq_40929683</author><pubDate>Sun, 26 Sep 2021 11:51:28 +0800</pubDate><description><![CDATA[提供主要的语句，略去探测数据库名，表名，字段名的步骤。

31.Less28

请求方式
			注入方式
			类型
			备注
		GET
			基于报错注入(Union内联注入)
			字符型
			过滤关键词select、union以及组合，单引号、括号闭合
		1. 正常提交


http://127.0.0.1:8003/Less-28/?id=1

2. 语句报错


http://127.0.0.1:8003/Less-28/?id=1 1'2"3
http://127.0.0.1:8003.]]></description><category></category></item><item><title><![CDATA[[靶场] SQLi-Labs Less21-Less27a]]></title><link>https://blog.youkuaiyun.com/qq_40929683/article/details/120447161</link><guid>https://blog.youkuaiyun.com/qq_40929683/article/details/120447161</guid><author>qq_40929683</author><pubDate>Sat, 25 Sep 2021 12:08:25 +0800</pubDate><description><![CDATA[提供主要的语句，略去探测数据库名，表名，字段名的步骤。

21.Less21

请求方式
			注入方式
			类型
			备注
		POST
			基于报错注入(updatexml函数)
			字符型
			Base64编码，Cookie注入点，单引号、括号闭合
		已经提前取得一个用户信息，用户名dumb，密码2。

并且之后的操作都是用BurpSuite的重发器测试。

1. 正常提交

首先正常登陆上去。



可以发现Cookie进行了Base64编码，我们后续操作都需要对语句进行Base64编.]]></description><category></category></item><item><title><![CDATA[[靶场] SQLi-Labs Less11-Less20]]></title><link>https://blog.youkuaiyun.com/qq_40929683/article/details/120434532</link><guid>https://blog.youkuaiyun.com/qq_40929683/article/details/120434532</guid><author>qq_40929683</author><pubDate>Thu, 23 Sep 2021 21:19:32 +0800</pubDate><description><![CDATA[提供主要的语句，略去探测数据库名，表名，字段名的步骤。

11.Less11

请求方式
			注入方式
			类型
			备注
		POST
			基于报错注入(Union内联注入)
			字符型
			单引号闭合
		1. 正常提交


uname=1&amp;passwd=2

2. 语句报错


uname=1'&amp;passwd=2
uname=1'3&amp;passwd=2
uname=1'3"&amp;passwd=2

3. 执行注入的SQL


uname=1' or 1 %23&.]]></description><category></category></item><item><title><![CDATA[[靶场] SQLi-Labs Less1-Less10]]></title><link>https://blog.youkuaiyun.com/qq_40929683/article/details/120427171</link><guid>https://blog.youkuaiyun.com/qq_40929683/article/details/120427171</guid><author>qq_40929683</author><pubDate>Thu, 23 Sep 2021 09:30:44 +0800</pubDate><description><![CDATA[提供主要的语句，略去探测数据库名，表名，字段名的步骤。

1.Less1

请求方式
			注入方式
			类型
			备注
		Get
			基于报错注入(updatexml函数)
			字符型
			单引号闭合
		1. 正常提交


http://127.0.0.1:8003/Less-1/?id=1



2. 语句报错


http://127.0.0.1:8003/Less-1/?id=1'

3. 执行注入的SQL


http://127.0.0.1:8003/Less-1/?id=1...]]></description><category></category></item></channel></rss>