企业官网建设流程全解析

1.目录和文件模糊测试
爆破目录

ffuf-w/usr/share/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt-uhttp://154.57.164.72:30163/webfuzzing_hidden_path/FUZZ

ffuf-w./common.txt-uhttp://154.57.164.72:30163/webfuzzing_hidden_path/flag/FUZZ-e.php,.html,.txt,.bak,.js-v

2.递归模糊测试

feroxbuster-w/usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt-uhttp://154.57.164.67:30345/recursive_fuzz-xhtml,php-t200-C400,401,404--depth4

3.参数和值模糊测试

ffuf-w/usr/share/seclists/Discovery/Web-Content/common.txt-u"http://154.57.164.82:30364/get.php?x=FUZZ"

ffuf-uhttp://154.57.164.82:30364/post.php-XPOST-H"Content-Type: application/x-www-form-urlencoded"-d"y=FUZZ"-w/usr/share/seclists/Discovery/Web-Content/common.txt

4.虚拟主机和子域名模糊测试

sudosh-c'echo "154.57.164.82 inlanefreight.htb" > /etc/hosts'

gobuster vhost-uhttp://inlanefreight.htb:31971-w/usr/share/seclists/Discovery/Web-Content/common.txt --append-domain

gobuster dns-dinlanefreight.com-w/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

5.过滤模糊测试输出


6.验证发现

feroxbuster-w/usr/share/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt-uhttp://154.57.164.82:30211/-xhtml,php-t200-C400,401,404--depth5

7.API 模糊测试

python3 api_fuzzer.py http://154.57.164.82:31350

8.技能评估
<1>发现panel.php，需要accessID参数

feroxbuster-w/usr/share/seclists/Discovery/Web-Content/common.txt-uhttp://154.57.164.82:31213/-xhtml,php-t200

curl-vhttp://154.57.164.82:31213/admin/panel.php

<2>爆破参数后访问得知需要爆破Vhost

ffuf-w/usr/share/seclists/Discovery/Web-Content/common.txt-uhttp://154.57.164.82:31213/admin/panel.php?accessID=FUZZ-fs58

curlhttp://154.57.164.82:31213/admin/panel.php?accessID=getaccess

<3>爆破得到Vhost继续爆破目录得到Flag

sudosh-c'echo " 154.57.164.82 fuzzing_fun.htb" > /etc/hosts'

gobuster vhost-uhttp://fuzzing_fun.htb:31213-w/usr/share/seclists/Discovery/Web-Content/common.txt --append-domain|grep"Status: 200"

feroxbuster-uhttp://hidden.fuzzing_fun.htb:31213/godeep/-w/usr/share/seclists/Discovery/Web-Content/common.txt-xhtml,php-t200