安全研究与工程实践

BlueCMS代码审计小结

0x00 基础快捷键 Sublime 下一个词组：Ctrl+D 书签：Ctrl+F2、F2 展示函数：Ctrl+E 选中本行：Ctrl+L 匹配的括号：Ctrl+M 0x01 可重复安装正常安装完成后，存在可重复安装的问题，因为install.lock未能生成. ...

NexusPHP代码审计小结

NexusPHP是用于P2P下载的资源分享类CMS，源码下载链接是https://github.com/ZJUT/NexusPHP 前置分析 [ ](https://github.com/ZJUT/NexusPHP) 这套cms，存在全局过滤sql注入的函数sqlesc() nexusphp/include/globalfunctions.php #75 **全局过滤之防止SQL注入1。**用mysql防注入函数转义，并且用单引号包裹住语句，导致无法注入引号，也无法引入变量（单引号中的$不会被识别成变量） ...

vulnhub-GoldenEye笔记

信息收集 # 25/tcp open smtp | fingerprint-strings: | Hello: | 220 ubuntu GoldentEye SMTP Electronic-Mail agent |_ Syntax: EHLO hostname |_smtp-commands: ubuntu, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, # 80/tcp open http Apache httpd 2.4.7 ((Ubuntu)) | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-server-header: Apache/2.4.7 (Ubuntu) |_http-title: GoldenEye Primary Admin Server # 55006/tcp open ssl/pop3 Dovecot pop3d |_pop3-capabilities: RESP-CODES TOP CAPA AUTH-RESP-CODE SASL(PLAIN) USER PIPELINING UIDL | ssl-cert: Subject: commonName=localhost/organizationName=Dovecot mail server | Issuer: commonName=localhost/organizationName=Dovecot mail server | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2018-04-24T03:23:52 | Not valid after: 2028-04-23T03:23:52 | MD5: d039 2e71 c76a 2cb3 e694 ec40 7228 ec63 |_SHA-1: 9d6a 92eb 5f9f e9ba 6cbd dc93 55fa 5754 219b 0b77 |_ssl-date: TLS randomness does not represent time # 55007/tcp open pop3 Dovecot pop3d |_pop3-capabilities: RESP-CODES SASL(PLAIN) TOP PIPELINING STLS CAPA AUTH-RESP-CODE USER UIDL | ssl-cert: Subject: commonName=localhost/organizationName=Dovecot mail server | Issuer: commonName=localhost/organizationName=Dovecot mail server | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2018-04-24T03:23:52 | Not valid after: 2028-04-23T03:23:52 | MD5: d039 2e71 c76a 2cb3 e694 ec40 7228 ec63 |_SHA-1: 9d6a 92eb 5f9f e9ba 6cbd dc93 55fa 5754 219b 0b77 |_ssl-date: TLS randomness does not represent time 扫出两个端口，25端口尝试用smtp登录了下，失败 ...