并写入附加到 Pod 的 /web-content 卷内的 ip.txt 文件。 名为 create-html 的第二个 Init 容器从 /web-content/ip.txt 文件中读取 Pod IP,该文件包含第一个 Init 容器创建的 Pod IP,并将其写入 /web-content Your Pod IP is: ' > /web-content/index.html; cat /web-content/ip.txt >> /web-content/index.html; echo 'Created index.html with the Pod IP'"] volumeMounts: - name: web-content mountPath: /web-content : /usr/share/nginx/html volumes: - name: web-content emptyDir: {}我们来部署这个 pod。
gobuster dir -u http://192.168.30.61/ -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase wfuzz --hh 275 -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt - ffuf -fs 278 -u "http://192.168.30.61/~secret/.FUZZ" -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase
使用命令gobuster dir -u http://172.16.33.69/ -w 字典,使用字典/usr/share/seclists/Discovery/Web-Content/directory-list-lowercase -2.3-small.txt和/usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt扫描网站的目录和文件 HTTP服务使用字典/usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt,或者SSH服务使用字典/usr/share 2.3、80端口/HTTP服务 字典/usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt有22万条内容,其中肯定有之前
gobuster dir -u http://192.168.30.65/ -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase ffuf -u http://192.168.30.65/xampp/FUZZ -w /usr/share/seclists/Discovery/Web-Content/quickhits.txt -c
# File to access from anywhere files: raft_ext : [E:\tools\wordlists\SecLists\Discovery\Web-Content \raft-large-extensions.txt] raft_dir : [E:\tools\wordlists\SecLists\Discovery\Web-Content\raft-large-directories.txt ] raft_files : [E:\tools\wordlists\SecLists\Discovery\Web-Content\raft-large-files.txt] robot _1000 : [E:\tools\wordlists\SecLists\Discovery\Web-Content\RobotsDisallowed-Top1000.txt] # Create
openwall.net-all.txt ssh://target 目录爆破 使用Discovery目录下的字典进行Web目录枚举: gobuster dir -u http://target -w SecLists/Discovery/Web-Content /common.txt API测试 使用CMS目录下的字典进行API端点枚举: ffuf -u http://target/FUZZ -w SecLists/Discovery/Web-Content/
使用命令wfuzz -c -z /usr/share/seclists/Discovery/Web-Content/common.txt –hc 404 http://10.58.81.112/~FUZZ 3.3、使用命令wfuzz -c -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt -z list,". 使用命令wfuzz -c -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt -z list,".txt"
gobuster dir -u http://192.168.31.14/ -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase gobuster dir -u http://redrocks.win -w /usr/share/seclists/Discovery/Web-Content/CommonBackdoors-PHP.fuzz.txt
gobuster dir -u http://192.168.30.56/ -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase
gobuster dir -u http://192.168.30.52//library -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase
dirsearch -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-small.txt -u http
gobuster dir -u 192.168.217.216 -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase
dirsearch -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-small.txt -u http
dirsearch -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-small.txt -u http
dirsearch -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-small.txt -u http
也没什么特别的,突破口在robots.txtgobuster dir -u http://192.168.31.145 -w /usr/share/seclists/Discovery/Web-Content
此时的渗透工作似乎进入了瓶颈期,想到了可以对evil.php下的文件的get 变量进行 fuzz 测试,于是使用ffuf工具对其进行测试 ffuf -w /usr/share/SecLists/Discovery/Web-Content
dirsearch -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-small.txt -u http
/etc/passwd -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt --hh 361爆破一下参数
使用wfuzz工具对该网站进行敏感文件扫描,字典是seclists/Discovery/Web-Content/commom.txt ?