【安全牛学习笔记】w3af-截断代理
来源:互联网 发布:扫描网络摄像头ip 编辑:程序博客网 时间:2024/06/08 00:06
W3af-----身份认证
截断代理
HTTP header file(另类的身份认证方法—)
Accept - language: en-US,en;q=0.5
Accept - encoding: gzip, deflate
Connection:keep-alive
Accept: text/html,application/xhtml+xml,application/xml;q=0.9*/*;q=0.8
User - agent: MOT - V177/0.1 75 UP.Brower/6.2.3.9.c.12 (GUI) MMP/2.0 UP.Link/6.3.1.13.0
Host: 192.168.20.7
Refere: http://192.168.20.7/dvwa/vulnerabilities/sqli/
Cookie: secrurity=low; PHPSESSID=f8c40e05267bfbb04a6053e9ec86093
Contenr-type: application/x-www-form-urlencoded
W3af-----截断代理
W3af不支持客户端技术(Javascirpt,Flash,Java applet等)
截断代理手动爬网
spider_man
output.exeport_requests
http://127.7.7.7/spider_man?terminate #终止spider_man
crwal.import_results
base64
root@kali:~# cd /usr/share/wfuzz/wordlist/fuzzdb
attack-paloads regex/ wordlists-user-passwd/
Discovery/ web-backdoors/
docs/ wordlists-misc/
root@kali:~# cd /usr/share/wfuzz/wordlist/fuzzdb/Discovery
FilenameBruteforce/ PredictableRes/
root@kali:~# cd /usr/share/wfuzz/wordlist/fuzzdb/Discovery/FilenameBruteforce/ PredictableRes/
root@kali:/usr/share/wfuzz/wordlist/fuzzdb/Discovery/FilenameBruteforce/ PredictableRes/# ls
3CharExBrute.fuzz.txt Extensions.Compressed.fuzz.txt
copy_of.fuzz.txt Extensions.Mostcommon.fuzz.txt
Extensions.Backup.fuzz.txt Extensions.Skipfish.fuzz.txt
Extensions.Common.fuzz.txt wordlistSkopfish.fuzz.txt
W3af-----其他特性
exploit
Fuzzy Requests
Numbers from 0 to 4: $rang(5)$
Frist ten letters: $string.lowercase[:10]$
The words spam and eggs: $['span','eggs']$
The content of a file: $[1.strip() for 1 in file('input.txt')]$
Cluster responses
sqlmap@db> help
sqlmap@db> Available commands:
help Display this information
lsp List payloads
payload <payload> Execute "payload" and get the result
read <file> Read the remote server <file> and echo to this console
download <remote> <local> Download <remote> file to <local> file system location
dbs List DBMS databases
table List DBMS tables for the current database
users List DBMS users
dump Dump table information
slqmap Run a sqlmap command. For example, the "dbs" command
is an alias for "sqlmap --dbs".
exit Exit this shell session
sqlmap@db> read /etc/passwd
sqlmap@db> dbs
sqlmap@db> lsp
sqlmap@db> payload users
- 【安全牛学习笔记】w3af-截断代理
- 【安全牛学习笔记】w3af-截断代理
- 【安全牛学习笔记】w3af
- 【安全牛学习笔记】w3af-身份认证
- 【安全牛学习笔记】 w3af
- 【安全牛学习笔记】W3AF在2017版本的安装
- 【安全牛学习笔记】Burpsuite-repeater,Sequencer,编码,代理截断工具
- w3af笔记
- w3af
- 安全学习: 反向代理
- 【安全牛学习笔记】WPA安全系统
- 【安全牛学习笔记】python学习笔记
- 【安全牛学习笔记】搜索引擎
- 【安全牛学习笔记】端口扫描
- 【安全牛学习笔记】TOR
- 【安全牛学习笔记】SHODAN
- 【安全牛学习笔记】 端口扫描
- 【安全牛学习笔记】NEXPOSE
- 构建乘积数组
- cocos2dx3.1.15.1打android包出现闪退
- 快速排序
- 51Nod-1615-跳跃的杰克
- MV3D -- 3D 点云表示
- 【安全牛学习笔记】w3af-截断代理
- D3力导向图及树状布局变换
- DB2 V9.7.4 下使用LISTAGG时报错,SQL0440N,SQLSTATE=42884解决办法
- On Date/Timestamp Value in A Distributed System
- VNC配置
- IDEA添加toString方法的模板
- CSS(六)— 样式设置
- 架构师需要了解的Paxos原理、历程及实战
- 4,selenium 模拟鼠标操作 (悬浮和左键点击)