tham txog cov cuab yeej muaj txiaj ntsig rau pentesters. Hauv tsab xov xwm tshiab peb yuav saib cov cuab yeej rau kev txheeb xyuas kev ruaj ntseg ntawm cov ntawv thov web.
Peb cov npoj yaig Kuv twb ua tej yam zoo li no lawm txog xya xyoo dhau los. Nws yog qhov nthuav kom pom cov cuab yeej twg tau khaws thiab ntxiv dag zog rau lawv txoj haujlwm, thiab cov twg tau ploj mus rau hauv keeb kwm yav dhau thiab tam sim no tsis tshua siv.
Nco ntsoov tias qhov no kuj suav nrog Burp Suite, tab sis yuav muaj kev tshaj tawm cais txog nws thiab nws cov plugins muaj txiaj ntsig.
Txheem:
amass
- Cov cuab yeej Go rau kev tshawb nrhiav thiab suav DNS subdomains thiab kos npe rau sab nraud network. Amass yog OWASP qhov project tsim los qhia cov koom haum hauv Is Taws Nem zoo li cas rau cov neeg sab nraud. Amass tau txais cov npe subdomain hauv ntau txoj hauv kev; lub cuab yeej siv ob qho tib si recursive enumeration ntawm subdomains thiab qhib qhov kev tshawb nrhiav.
Txhawm rau nrhiav pom cov ntu sib txuas sib txuas thiab cov lej tswj hwm tus kheej, Amass siv IP chaw nyob tau txais thaum lub sijhawm ua haujlwm. Tag nrho cov ntaub ntawv pom yog siv los tsim ib daim ntawv qhia network.
Tshaj:
- Cov txheej txheem sau cov ntaub ntawv muaj xws li:
* DNS - phau ntawv txhais lus tshawb nrhiav ntawm subdomains, bruteforce subdomains, kev tshawb nrhiav ntse siv kev hloov pauv raws li pom cov subdomains, thim rov qab cov lus nug DNS thiab tshawb rau DNS servers qhov twg nws tuaj yeem ua qhov kev thov hloov chaw (AXFR);* Qhib qhov kev tshawb nrhiav - Nug, Baidu, Bing, CommonCrawl, DNSDB, DNSDumpster, DNSTable, Dogpile, Exalead, FindSubdomains, Google, IPv4Info, Netcraft, PTRArchive, Riddler, SiteDossier, ThreatCrowd, VirusTotal, Yahoo;
* Tshawb nrhiav TLS daim ntawv pov thawj databases - Censys, CertDB, CertSpotter, Crtsh, Entrust;
* Siv lub cav tshawb nrhiav APIs - BinaryEdge, BufferOver, CIRCL, HackerTarget, PassiveTotal, Robtex, SecurityTrails, Shodan, Twitter, Umbrella, URLScan;
* Tshawb nrhiav Internet web archives: ArchiveIt, ArchiveToday, Arquivo, LoCARchive, OpenUKArchive, UKGovArchive, Wayback;
- Kev koom ua ke nrog Maltego;
- Muab cov kev pabcuam ua tiav tshaj plaws ntawm txoj haujlwm tshawb nrhiav DNS subdomains.
Txais:
- Ceev faj nrog amass.netdomains - nws yuav sim hu rau txhua tus IP chaw nyob hauv cov txheej txheem txheeb xyuas thiab tau txais cov npe sau los ntawm rov qab DNS lookups thiab TLS daim ntawv pov thawj. Qhov no yog cov txheej txheem "high-profile", nws tuaj yeem qhia koj cov haujlwm txawj ntse hauv lub koomhaum hauv kev tshawb nrhiav.
- Kev siv lub cim xeeb siab, tuaj yeem haus txog li 2 GB ntawm RAM hauv cov chaw sib txawv, uas yuav tsis tso cai rau koj khiav cov cuab yeej no hauv huab ntawm pheej yig VDS.
Altdns
- Cov cuab yeej Python rau sau cov phau ntawv txhais lus rau suav DNS subdomains. Tso cai rau koj los tsim ntau yam sib txawv ntawm subdomains siv kev hloov pauv thiab kev hloov pauv. Rau qhov no, cov lus uas feem ntau pom nyob rau hauv subdomains yog siv (piv txwv li: test, dev, staging), tag nrho cov kev hloov thiab permutations raug siv rau cov subdomains twb paub lawm, uas tuaj yeem xa mus rau Altdns input. Cov zis yog ib daim ntawv teev cov variations ntawm subdomains uas muaj nyob, thiab daim ntawv no yuav tom qab ntawd siv rau DNS brute quab yuam.
Tshaj:
- Ua haujlwm zoo nrog cov ntaub ntawv loj.
dej hiav txwv
- yav dhau los paub zoo tias yog lwm lub cuab yeej rau kev tshawb nrhiav subdomains, tab sis tus sau nws tus kheej tso tseg qhov no hauv kev pom zoo ntawm Amass tau hais tseg. Tam sim no aquatone tau rov sau dua hauv Go thiab tau npaj ntau dua rau kev soj ntsuam ua ntej ntawm cov vev xaib. Txhawm rau ua qhov no, aquatone mus dhau ntawm cov npe teev tseg thiab tshawb xyuas cov vev xaib ntawm cov chaw nres nkoj sib txawv, tom qab ntawd nws sau tag nrho cov ntaub ntawv hais txog lub xaib thiab siv lub screenshot. Yooj yim rau kev tshawb nrhiav ua ntej sai ntawm cov vev xaib, tom qab ntawd koj tuaj yeem xaiv lub hom phiaj tseem ceeb rau kev tawm tsam.
Tshaj:
- Cov zis tsim ib pab pawg ntawm cov ntaub ntawv thiab cov folders uas yooj yim siv thaum ua haujlwm ntxiv nrog lwm yam cuab yeej:
* HTML daim ntawv qhia nrog sau screenshots thiab cov lus teb cov npe pab pawg los ntawm qhov zoo sib xws;* Cov ntaub ntawv nrog txhua qhov URLs qhov chaw pom cov vev xaib;
* Cov ntaub ntawv nrog txheeb cais thiab nplooj ntawv cov ntaub ntawv;
* Ib daim nplaub tshev nrog cov ntaub ntawv muaj cov lus teb headers los ntawm pom lub hom phiaj;
* Ib daim nplaub tshev nrog cov ntaub ntawv uas muaj lub cev ntawm cov lus teb los ntawm cov hom phiaj pom;
* Cov duab thaij duab ntawm cov vev xaib pom;
- Txhawb kev ua haujlwm nrog XML cov ntaub ntawv los ntawm Nmap thiab Masscan;
- Siv lub taub hau tsis muaj Chrome / Chromium los ua cov screenshots.
Txais:
- Nws tuaj yeem nyiam cov xim ntawm cov cuab yeej nrhiav kom pom, yog li nws yuav tsum tau teeb tsa.
Lub screenshot raug coj mus rau ib qho ntawm cov qub versions ntawm aquatone (v0.5.0), uas DNS subdomain nrhiav tau siv. Cov ntawv qub tuaj yeem pom ntawm .
MassDNS NWS
yog lwm lub cuab yeej los nrhiav DNS subdomains. Nws qhov sib txawv tseem ceeb yog tias nws ua rau cov lus nug DNS ncaj qha rau ntau qhov sib txawv DNS daws teeb meem thiab ua li ntawd ntawm kev ceev ceev.
Tshaj:
- Ceev ceev - muaj peev xwm daws tau ntau dua 350 txhiab lub npe ib ob.
Txais:
- MassDNS tuaj yeem ua rau muaj teeb meem loj ntawm DNS daws teeb meem hauv kev siv, uas tuaj yeem ua rau txwv tsis pub cov servers lossis kev tsis txaus siab rau koj ISP. Tsis tas li ntawd, nws yuav tso cov khoom loj ntawm lub tuam txhab DNS servers, yog tias lawv muaj lawv thiab yog tias lawv muaj lub luag haujlwm rau cov npe koj tab tom sim daws.
- Cov npe ntawm cov neeg daws teeb meem tam sim no tsis tu ncua, tab sis yog tias koj xaiv cov kev daws teeb meem DNS tawg thiab ntxiv cov neeg paub tshiab, txhua yam yuav zoo.
Screenshot ntawm aquatone v0.5.0
nsq 3 map
yog lub cuab yeej Python kom tau txais cov npe tag nrho ntawm DNSSEC-tiv thaiv cov thawj.
Tshaj:
- Ceev nrooj pom cov tswv hauv DNS thaj chaw nrog tsawg kawg ntawm cov lus nug yog tias kev txhawb nqa DNSSEC tau qhib rau hauv cheeb tsam;
- suav nrog lub plugin rau John the Ripper uas tuaj yeem siv los tawg qhov tshwm sim NSEC3 hashes.
Txais:
- Ntau qhov yuam kev DNS tsis raug kho kom raug;
- Tsis muaj kev sib piv tsis siv neeg ntawm kev ua NSEC cov ntaub ntawv - koj yuav tsum faib cov npe ntawm tus kheej;
- Kev siv lub cim xeeb siab.
Acunetix
- lub web vulnerability scanner uas automates cov txheej txheem ntawm kev tshuaj xyuas kev ruaj ntseg ntawm web applications. Kev ntsuam xyuas daim ntawv thov rau SQL txhaj tshuaj, XSS, XXE, SSRF thiab ntau lwm qhov tsis zoo hauv lub vev xaib. Txawm li cas los xij, zoo li lwm lub tshuab luam ntawv, ntau lub vev xaib tsis muaj qhov tsis zoo tsis hloov lub pentester, vim nws tsis tuaj yeem nrhiav txoj hauv kev nyuaj ntawm qhov tsis zoo lossis qhov tsis zoo hauv cov laj thawj. Tab sis nws npog ntau qhov sib txawv ntawm qhov tsis zoo, suav nrog ntau yam CVEs, uas tus pentester yuav tsis nco qab txog, yog li nws yooj yim heev rau kev tso koj ntawm kev kuaj xyuas niaj hnub.
Tshaj:
- Qib qis ntawm qhov tsis zoo;
- Cov txiaj ntsig tuaj yeem raug xa tawm raws li cov lus ceeb toom;
- Ua ntau qhov kev kuaj xyuas rau ntau yam tsis zoo;
- Parallel scanning ntawm ntau tus tswv.
Txais:
- Tsis muaj cov txheej txheem deduplication (Acunetix yuav xav txog cov nplooj ntawv uas zoo ib yam hauv kev ua haujlwm sib txawv, vim lawv ua rau cov URL sib txawv), tab sis cov neeg tsim khoom ua haujlwm rau nws;
- Yuav tsum muaj kev teeb tsa ntawm lub vev xaib sib cais, uas cuam tshuam rau kev sim cov neeg siv khoom nrog kev sib txuas VPN thiab siv lub scanner hauv ib ntu cais ntawm cov neeg siv khoom hauv zos;
- Cov kev pabcuam hauv kev kawm yuav ua suab nrov, piv txwv li, los ntawm kev xa ntau qhov kev tawm tsam vectors mus rau daim ntawv tiv toj ntawm qhov chaw, yog li ua rau cov txheej txheem lag luam nyuaj heev;
- Nws yog tus tswv thiab, raws li, tsis yog kev daws teeb meem dawb.
Dirsearch
- Python cov cuab yeej rau brute-forcing cov npe thiab cov ntaub ntawv ntawm cov vev xaib.
Tshaj:
- Muaj peev xwm paub qhov tseeb "200 OK" nplooj ntawv los ntawm "200 OK" nplooj ntawv, tab sis nrog cov ntawv "nplooj tsis pom";
- Los nrog phau ntawv txhais lus siv tau uas muaj qhov sib npaug zoo ntawm qhov loj me thiab kev tshawb nrhiav kev ua haujlwm zoo. Muaj cov qauv txheej txheem rau ntau CMS thiab cov txheej txheem thev naus laus zis;
- Nws tus kheej hom ntawv txhais lus, uas tso cai rau koj kom ua tiav cov txiaj ntsig zoo thiab hloov pauv hauv kev suav cov ntaub ntawv thiab cov npe;
- Cov zis yooj yim - cov ntawv nyeem, JSON;
- Nws tuaj yeem ua throttling - ncua ntawm kev thov, uas yog qhov tseem ceeb rau txhua qhov kev pabcuam tsis muaj zog.
Txais:
- Extensions yuav tsum tau dhau los ua txoj hlua, uas tsis yooj yim yog tias koj xav tau kom dhau ntau qhov txuas ntxiv ib zaug;
- Txhawm rau siv koj phau ntawv txhais lus, nws yuav tsum tau hloov kho me ntsis rau Dirsearch phau ntawv txhais lus hom kom ua tau zoo tshaj plaws.
wfuzz ua
- Python web thov fuzzer. Tej zaum yog ib lub vev xaib nto moo tshaj plaws. Lub hauv paus ntsiab lus yog qhov yooj yim: wfuzz tso cai rau koj mus rau theem txhua qhov chaw hauv HTTP thov, uas ua rau nws muaj peev xwm mus rau theem GET / POST tsis, HTTP headers, suav nrog Cookie thiab lwm yam ntawv pov thawj. Nyob rau tib lub sij hawm, nws kuj yog ib qho yooj yim rau brute quab yuam ntawm cov npe thiab cov ntaub ntawv yooj yim, uas koj xav tau phau ntawv txhais lus zoo. Nws kuj muaj qhov hloov pauv hloov pauv, uas koj tuaj yeem lim cov lus teb los ntawm lub vev xaib raws li qhov sib txawv, uas tso cai rau koj ua tiav cov txiaj ntsig zoo.
Tshaj:
- Multifunctional - modular qauv, sib dhos yuav siv sij hawm ob peb feeb;
- Yooj yim lim thiab fuzzing mechanism;
- Koj tuaj yeem theem HTTP txheej txheem, nrog rau txhua qhov chaw hauv HTTP thov.
Txais:
- Hauv kev txhim kho.
ffuf ua
- lub vev xaib fuzzer hauv Go, tsim nyob rau hauv "duab thiab zoo li" ntawm wfuzz, tso cai rau koj los brute cov ntaub ntawv, phau ntawv qhia, URL txoj hauv kev, npe thiab qhov tseem ceeb ntawm GET / POST tsis, HTTP headers, suav nrog Tus Thawj Tswj header rau brute force ntawm virtual hosts. wfuzz txawv ntawm nws cov kwv tij hauv kev nrawm dua thiab qee qhov tshiab, piv txwv li, nws txhawb nqa Dirsearch hom phau ntawv txhais lus.
Tshaj:
- Cov lim dej zoo ib yam li wfuzz lim, lawv tso cai rau koj los hloov kho lub zog brute;
- Tso cai rau koj fuzz HTTP header qhov tseem ceeb, POST thov cov ntaub ntawv thiab ntau qhov chaw ntawm URL, suav nrog cov npe thiab qhov tseem ceeb ntawm GET tsis;
- Koj tuaj yeem hais qhia txhua txoj hauv kev HTTP.
Txais:
- Hauv kev txhim kho.
gobuster
- Cov cuab yeej Go rau kev tshawb nrhiav, muaj ob hom kev ua haujlwm. Thawj yog siv los brute quab yuam cov ntaub ntawv thiab cov npe ntawm lub vev xaib, qhov thib ob yog siv los brute yuam DNS subdomains. Cov cuab yeej tsis tau pib txhawb kev sau npe ntawm cov ntaub ntawv thiab cov npe, uas, ntawm chav kawm, txuag lub sijhawm, tab sis ntawm qhov tod tes, brute quab yuam ntawm txhua qhov kawg ntawm lub vev xaib yuav tsum tau pib sib cais.
Tshaj:
- Kev kub ceev ntawm kev ua haujlwm ob qho tib si rau brute quab yuam tshawb nrhiav ntawm DNS subdomains thiab rau brute quab yuam ntawm cov ntaub ntawv thiab cov npe.
Txais:
- Cov version tam sim no tsis txhawb kev teeb tsa HTTP headers;
- Los ntawm lub neej ntawd, tsuas yog qee qhov HTTP txheej xwm cov lej (200,204,301,302,307) suav tias siv tau.
Arjun
- lub cuab yeej rau brute quab yuam ntawm zais HTTP tsis nyob hauv GET / POST tsis, nrog rau hauv JSON. Phau ntawv txhais lus built-in muaj 25 lo lus, uas Ajrun tshawb xyuas yuav luag 980 vib nas this. Qhov ua kom yuam kev yog tias Ajrun tsis kuaj txhua qhov sib cais, tab sis kuaj xyuas ~ 30 tsis nyob rau ib zaug thiab pom tias cov lus teb tau hloov pauv. Yog tias cov lus teb tau hloov pauv, nws faib qhov 1000 qhov ntsuas no ua ob ntu thiab xyuas seb qhov twg ntawm cov khoom no cuam tshuam rau cov lus teb. Yog li, siv kev tshawb nrhiav binary yooj yim, ib qho kev ntsuas lossis ob peb qhov zais tsis tau pom tias cuam tshuam cov lus teb thiab, yog li ntawd, yuav muaj nyob.
Tshaj:
- Kev kub ceev vim kev tshawb nrhiav binary;
- Kev them nyiaj yug rau GET/POST tsis, nrog rau cov tsis nyob rau hauv daim ntawv ntawm JSON;
Lub plugin rau Burp Suite ua haujlwm ntawm lub hauv paus ntsiab lus zoo sib xws - , uas kuj zoo heev ntawm kev nrhiav zais HTTP tsis. Peb yuav qhia koj ntxiv txog nws hauv tsab xov xwm yav tom ntej txog Burp thiab nws cov plugins.
LinkFinder
- Python tsab ntawv rau kev tshawb nrhiav cov txuas hauv JavaScript cov ntaub ntawv. Muaj txiaj ntsig rau kev nrhiav qhov zais lossis tsis nco qab qhov kawg / URLs hauv daim ntawv thov web.
Tshaj:
- Ceev ceev;
- Muaj qhov tshwj xeeb plugin rau Chrome raws li LinkFinder.
.
Txais:
- Cov lus xaus tsis yooj yim;
- Tsis soj ntsuam JavaScript dhau sijhawm;
- Ib qho yooj yim logic rau kev tshawb nrhiav cov kev sib txuas - yog tias JavaScript yog obfuscated, los yog cov kev sib txuas tau pib ploj lawm thiab tsim tawm dynamically, ces nws yuav nrhiav tsis tau dab tsi.
JSParser
yog Python tsab ntawv uas siv ΠΈ txhawm rau txheeb xyuas URLs txheeb ze los ntawm JavaScript cov ntaub ntawv. Muaj txiaj ntsig zoo rau kev tshawb nrhiav AJAX thov thiab sau cov npe ntawm API txoj hauv kev uas daim ntawv thov cuam tshuam nrog. Ua haujlwm zoo ua ke nrog LinkFinder.
Tshaj:
- Ceev parsing ntawm JavaScript cov ntaub ntawv.
sqlmap
Tej zaum yog ib qho ntawm cov cuab yeej nto moo tshaj plaws rau kev txheeb xyuas cov ntawv thov web. Sqlmap automates kev tshawb nrhiav thiab kev ua haujlwm ntawm SQL txhaj tshuaj, ua haujlwm nrog ntau lub SQL dialects, thiab muaj ntau ntau hom kev sib txawv hauv nws cov arsenal, xws li los ntawm cov lus ncaj nraim mus rau cov vectors nyuaj rau lub sij hawm raws li SQL txhaj. Tsis tas li ntawd, nws muaj ntau cov tswv yim rau kev siv ntxiv rau ntau yam DBMSs, yog li nws muaj txiaj ntsig tsis yog lub tshuab luam ntawv rau SQL txhaj tshuaj, tab sis kuj yog lub cuab yeej muaj zog rau kev siv SQL txhaj tshuaj.
Tshaj:
- Muaj ntau ntau hom kev sib txawv thiab vectors;
- Tsawg tus lej ntawm qhov tsis zoo;
- Muaj ntau txoj kev xaiv zoo, ntau yam txuj ci, lub hom phiaj database, tamper scripts rau bypassing WAF;
- Muaj peev xwm tsim cov khoom pov tseg;
- Ntau lub peev xwm ua haujlwm sib txawv, piv txwv li, rau qee qhov chaw khaws ntaub ntawv - tsis siv neeg thauj khoom / tshem tawm cov ntaub ntawv, tau txais lub peev xwm los ua cov lus txib (RCE) thiab lwm yam;
- Kev them nyiaj yug ncaj qha rau cov ntaub ntawv siv cov ntaub ntawv tau txais thaum muaj kev tawm tsam;
- Koj tuaj yeem xa cov ntawv sau nrog cov txiaj ntsig ntawm Burp raws li cov tswv yim - tsis tas yuav manually sau tag nrho cov kab lus hais kom ua.
Txais:
- Nws yog ib qho nyuaj rau customize, piv txwv li, sau qee yam ntawm koj tus kheej cov tshev vim cov ntaub ntawv tsis txaus rau qhov no;
- Yog tsis muaj qhov tsim nyog, nws ua ib qho kev kuaj xyuas tsis tiav, uas tuaj yeem ua yuam kev.
NoSQLMap
- Python cov cuab yeej rau automating kev tshawb nrhiav thiab kev siv ntawm NoSQL txhaj. Nws yooj yim siv tsis yog hauv NoSQL databases nkaus xwb, tab sis kuj ncaj qha thaum tshawb xyuas lub vev xaib uas siv NoSQL.
Tshaj:
- Zoo li sqlmap, nws tsis tsuas pom muaj qhov tsis zoo, tab sis kuj tshawb xyuas qhov ua tau ntawm nws txoj kev siv rau MongoDB thiab CouchDB.
Txais:
- Tsis txhawb NoSQL rau Redis, Cassandra, kev txhim kho tab tom ua hauv cov lus qhia no.
oxml_xx ib
- ib lub cuab tam rau embedding XXE XML exploits rau hauv ntau hom ntaub ntawv uas siv cov XML hom nyob rau hauv ib co daim ntawv.
Tshaj:
- Txhawb ntau hom ntawv xws li DOCX, ODT, SVG, XML.
Txais:
- Kev them nyiaj yug rau PDF, JPEG, GIF tsis ua tiav;
- Tsim ib daim ntawv xwb. Txhawm rau daws qhov teeb meem no koj tuaj yeem siv lub cuab yeej , uas tuaj yeem tsim ntau cov ntaub ntawv payload nyob rau ntau qhov chaw.
Cov khoom siv saum toj no ua haujlwm zoo ntawm kev sim XXE thaum thauj cov ntaub ntawv uas muaj XML. Tab sis kuj tseem nco ntsoov tias cov neeg tuav ntaub ntawv XML tuaj yeem pom nyob rau hauv ntau qhov xwm txheej, piv txwv li, XML tuaj yeem siv los ua cov ntaub ntawv hom tsis yog JSON.
Yog li ntawd, peb xav kom koj ua tib zoo mloog rau cov chaw khaws cia hauv qab no, uas muaj ntau qhov sib txawv ntawm cov khoom thauj: .
tplm ua
- lub cuab yeej Python rau kev txheeb xyuas thiab siv Server-Side Template Injection vulnerabilities; nws muaj kev teeb tsa thiab chij zoo ib yam li sqlmap. Siv ntau hom kev sib txawv thiab vectors, suav nrog kev txhaj tshuaj tsis pom kev, thiab tseem muaj cov txheej txheem rau kev ua tiav cov lej thiab thauj khoom / xa tawm cov ntaub ntawv tsis txaus ntseeg. Tsis tas li ntawd, nws muaj nyob rau hauv nws cov txheej txheem arsenal rau ntau lub tshuab qauv sib txawv thiab qee cov tswv yim rau kev tshawb nrhiav eval()-zoo li code txhaj hauv Python, Ruby, PHP, JavaScript. Yog tias ua tiav, nws qhib qhov kev sib tham sib console.
Tshaj:
- Muaj ntau ntau hom kev sib txawv thiab vectors;
- Txhawb ntau template rendering cav;
- Muaj ntau txoj kev ua haujlwm.
CeWL
- lub tshuab hluav taws xob phau ntawv txhais lus hauv Ruby, tsim los rho tawm cov lus tshwj xeeb los ntawm lub vev xaib uas tau teev tseg, ua raws cov kev sib txuas ntawm lub xaib mus rau qhov tob uas tau teev tseg. Cov phau ntawv txhais lus muab tso ua ke ntawm cov lus tshwj xeeb tom qab tuaj yeem siv los brute yuam passwords ntawm cov kev pabcuam lossis brute force cov ntaub ntawv thiab cov npe ntawm tib lub vev xaib, lossis tawm tsam qhov tshwm sim uas siv hashcat lossis John the Ripper. Muaj txiaj ntsig thaum sau cov npe "lub hom phiaj" ntawm cov passwords muaj peev xwm.
Tshaj:
- Yooj yim rau siv.
Txais:
- Koj yuav tsum tau ceev faj nrog kev tshawb nrhiav qhov tob kom tsis txhob ntes tus sau ntxiv.
Weakpass
- ib qho kev pabcuam uas muaj ntau phau ntawv txhais lus nrog tus password tshwj xeeb. Muaj txiaj ntsig zoo rau ntau yam dej num ntsig txog tus password tawg, xws li los ntawm kev yooj yim online brute quab yuam ntawm cov nyiaj ntawm cov phiaj xwm kev pabcuam, mus rau off-line brute quab yuam ntawm tau txais hashes siv los yog . Nws muaj txog 8 billion tus passwords txij li 4 txog 25 tus cim ntev.
Tshaj:
- Muaj ob phau ntawv txhais lus tshwj xeeb thiab phau ntawv txhais lus nrog cov passwords feem ntau - koj tuaj yeem xaiv cov phau ntawv txhais lus tshwj xeeb rau koj tus kheej xav tau;
- Cov phau ntawv txhais lus tau hloov kho thiab ntxiv nrog cov password tshiab;
- Cov phau ntawv txhais lus yog txheeb los ntawm kev ua haujlwm zoo. Koj tuaj yeem xaiv qhov kev xaiv rau ob qho tib si ceev hauv online brute quab yuam thiab cov ncauj lus kom ntxaws xaiv cov passwords los ntawm phau ntawv txhais lus voluminous nrog cov xau tshiab kawg;
- Nws muaj lub tshuab xam zauv uas qhia lub sij hawm nws yuav siv sij hawm rau brute passwords ntawm koj cov cuab yeej.
Peb xav suav nrog cov cuab yeej rau CMS cov tshev hauv ib pab pawg: WPScan, JoomScan thiab AEM hacker.
AEM_hacker
yog lub cuab yeej los txheeb xyuas qhov tsis zoo hauv Adobe Experience Manager (AEM) daim ntawv thov.
Tshaj:
- Yuav txheeb xyuas AEM daim ntawv thov los ntawm cov npe ntawm URLs xa mus rau nws cov tswv yim;
- Muaj cov ntawv sau kom tau txais RCE los ntawm kev thauj khoom JSP plhaub lossis siv SSRF.
JoomScan
- Perl lub cuab yeej rau automating kev tshawb pom ntawm qhov tsis zoo thaum siv Joomla CMS.
Tshaj:
- Muaj peev xwm nrhiav configuration flaws thiab teeb meem nrog kev tswj xyuas;
- Sau cov Joomla versions thiab cov kev cuam tshuam cuam tshuam, zoo ib yam rau cov khoom ntiag tug;
- Muaj ntau tshaj 1000 exploits rau Joomla Cheebtsam;
- Tso tawm cov ntaub ntawv kawg hauv cov ntawv nyeem thiab HTML hom.
WPScan
- ib lub cuab yeej rau scanning WordPress qhov chaw, nws muaj qhov tsis zoo hauv nws cov arsenal ob qho tib si rau lub cav WordPress nws tus kheej thiab rau qee qhov plugins.
Tshaj:
- Muaj peev xwm sau npe tsis tsuas yog tsis zoo WordPress plugins thiab cov ntsiab lus, tab sis kuj tau txais cov npe ntawm cov neeg siv thiab TimThumb cov ntaub ntawv;
- Muaj peev xwm ua brute quab yuam tawm tsam ntawm WordPress qhov chaw.
Txais:
- Yog tsis muaj qhov tsim nyog, nws ua ib qho kev kuaj xyuas tsis tiav, uas tuaj yeem ua yuam kev.
Feem ntau, cov neeg sib txawv nyiam cov cuab yeej sib txawv rau kev ua haujlwm: lawv txhua tus zoo hauv lawv tus kheej, thiab qhov uas ib tus neeg nyiam yuav tsis haum rau lwm tus. Yog tias koj xav tias peb tau ua tsis ncaj ncees tsis quav ntsej qee qhov txiaj ntsig zoo, sau txog nws hauv cov lus!
Tau qhov twg los: www.hab.com