针对单个网站的渗透思路（精）
一、简介
创新互联专注于企业成都全网营销推广、网站重做改版、福安网站定制设计、自适应品牌网站建设、H5网站设计、商城网站制作、集团公司官网建设、成都外贸网站建设、高端网站制作、响应式网页设计等建站业务，价格优惠性价比高，为福安等各大城市提供网站开发制作服务。
渗透测试是一种安全性测试，旨在发现和利用被测对象的安全漏洞。本文将针对单个网站进行渗透，并以此来了解如何找出和利用目标中存在的安全问题。二、前期准备工作
1. 目标信息采集
（1）IP地址/子网/DNS名字
（2）Web应用版本号
（3）开发语言/数据库/Web服务器
2. 搜集相关信息
（1）Google Hacking Database (GHDB)
（2）Nmap扫描
3. 建立目录树图
4. 进行风险评估
5. 配置工作区域
6. 加固web应用或者OS内核(optional)
三、正式进行测试 1. 端口扫描与服务扫描 Nmap是一个常用的端口扫描工具,能够快速侦测出目标上开启的TCP / UDP端口,并尝试判断使用什么软件或者協議。 2. Web应用审计 Web应用审计是一个重要郵務,從考察代理機制時間,調整HTTP Header ,Cookie ,URL Parameter ,Form Data ,Hidden Field 的方法來尋找SQL Injection XSS Cross Site Request Forgery CSRF File Inclusion Directory Traversal Local File Include LFI Remote File Include RFI Backdoor Command Execution CMDEXE . 3. 暴力破壞與帳戶暴力破壞 暴力破壞是尝试不斷使⽤不同的⽤戶名與密⿊去達到“Brute Force” ⽅張去達到帳戶保障之愿愐。 4. 本地文件搜尋與命令泄露 本地文件搜尋包含了configuration file log files backup files source code etc.,考察特徵字省略特徵字然後再去grep search find command line tool to locate the sensitive information from the target system or web application server . 5《命令泄露》Command injection is a technique used by attackers to execute arbitrary commands on the host operating system via a vulnerable application . 6《XML 外郭緩衝區〃XML External Entity attack is an attack against an application that parses XML input and it can be used to perform Server Side Request Forgery SSRF XXE attacks are used to probe internal networks extract confidential data and even perform remote code execution 7《LDAP 波務泄露 LDAP injection is an attack used to exploit web based applications that construct LDAP statements based on user input 8 SQL Injection SQL injection is one of the most common web hacking techniques which allows attackers to send malicious SQL queries directly to backend databases 9 Cross-Site Scripting XSS Cross-site scripting also known as XSS is a type of computer security vulnerability typically found in web applications 10 Buffer Overflow A buffer overflow occurs when more data than expected has been sent into memory resulting in corruption or overwriting of existing data 11 Path Traversal Path traversal also known as directory traversal is an attack technique used for exploiting insufficient security validation and sanitization checks 12 Denial Of Service DoS A denial-of-service DOS attack occurs when legitimate users are unable to access network services due
标题名称：针对单个网站的渗透思路（精）
文章来源：http://www.csdahua.cn/qtweb/news32/303782.html
网站建设、网络推广公司-快上网，是专注品牌与效果的网站制作，网络营销seo公司；服务项目有等
声明：本网站发布的内容（图片、视频和文字）以用户投稿、用户转载内容为主，如果涉及侵权请尽快告知，我们将会在第一时间删除。文章观点不代表本网站立场，如需处理请联系客服。电话：028-86922220；邮箱：631063699@qq.com。内容未经允许不得转载，或转载时需注明来源： 快上网