97 lines
4.8 KiB
Markdown
97 lines
4.8 KiB
Markdown
# 项目经验索引
|
||
|
||
> 本文件用于在新任务开始前快速检索历史经验。
|
||
> 带 `[种子]` 标记的条目是预置参考案例，不计入真实完成项目。
|
||
> 真实项目使用日期文件名（例如 `2026-05-16_*`），种子案例使用 `seed-*`。
|
||
|
||
## 统计
|
||
|
||
- 真实项目数：17
|
||
- 种子参考数：17
|
||
- 总条目数：34
|
||
|
||
## 按场景分类
|
||
|
||
### APK / Android 逆向
|
||
|
||
- [2026-05-15-cellular-pro-mumu-ksad-fragment-fix](./2026-05-15-cellular-pro-mumu-ksad-fragment-fix.md)
|
||
- [[种子] seed-008_apk-okhttp-ssl-pin-bypass](./seed-008_apk-okhttp-ssl-pin-bypass.md)
|
||
|
||
### 二进制 / 固件 / CTF
|
||
|
||
- [2026-08-06_cortex-m-msc-firmware-self-keyed-rotate-xor](./2026-08-06_cortex-m-msc-firmware-self-keyed-rotate-xor.md)
|
||
- [2026-07-22 Electron Bytenode 特权更新链分析](./2026-07-22_electron-bytenode-privileged-update-chain.md)
|
||
- [2026-07-14_android-arm64-self-extract-source-recovery](./2026-07-14_android-arm64-self-extract-source-recovery.md)
|
||
- [2026-05-15_lumine-go-reverse](./2026-05-15_lumine-go-reverse.md)
|
||
- [[种子] seed-001_elf-packed-loader](./seed-001_elf-packed-loader.md)
|
||
- [[种子] seed-002_go-malware-stripped](./seed-002_go-malware-stripped.md)
|
||
- [[种子] seed-010_ctf-pwn-rop-x64](./seed-010_ctf-pwn-rop-x64.md)
|
||
- [[种子] seed-011_pcap-protocol-reverse](./seed-011_pcap-protocol-reverse.md)
|
||
- [[种子] seed-014_unity-il2cpp-reverse](./seed-014_unity-il2cpp-reverse.md)
|
||
- [[种子] seed-015_iot-firmware-uart](./seed-015_iot-firmware-uart.md)
|
||
|
||
### Web / API / 渗透测试
|
||
|
||
- [2026-08-01 Next.js CDK 契约保真本地重建](./2026-08-01_nextjs-cdk-contract-faithful-local-reconstruction.md)
|
||
- [2026-08-01_pentest-encryption-oracle-public-template-sql-admin-takeover: .NET CMS 通用加密 oracle、公开密文模板消费者、完整 STL/模板解析、原始 SQL `UPDATE RETURNING`、官方管理员验证器新旧口令差分与隔离 PostgreSQL 清理闭环](./2026-08-01_pentest-encryption-oracle-public-template-sql-admin-takeover.md)
|
||
|
||
- [2026-07-18_gin-juice-client-friction](./2026-07-18_gin-juice-client-friction.md)
|
||
- [2026-07-05_dsl-vm-captcha-reverse](./2026-07-05_dsl-vm-captcha-reverse.md)
|
||
- [2026-06-29_burp-mcp-full-test-and-fix](./2026-06-29_burp-mcp-full-test-and-fix.md)
|
||
- [2026-05-26_pentest-newapi-rate-limit-bypass](./2026-05-26_pentest-newapi-rate-limit-bypass.md)
|
||
- [2026-05-25_pentest-cf-access-sibling-subdomain-cookie-poisoning](./2026-05-25_pentest-cf-access-sibling-subdomain-cookie-poisoning.md)
|
||
- [2026-05-17_pentest-vue-spa-actuator-leak](./2026-05-17_pentest-vue-spa-actuator-leak.md)
|
||
- [2026-05-16_pentest-personalblog-fun-mass-assignment](./2026-05-16_pentest-personalblog-fun-mass-assignment.md)
|
||
- [[种子] seed-003_web-api-auth-bypass](./seed-003_web-api-auth-bypass.md)
|
||
- [[种子] seed-004_js-sign-webpack](./seed-004_js-sign-webpack.md)
|
||
- [[种子] seed-006_ssrf-cloud-metadata](./seed-006_ssrf-cloud-metadata.md)
|
||
- [[种子] seed-017_xxe-oob-exfil](./seed-017_xxe-oob-exfil.md)
|
||
|
||
### 企业内网 / 云安全
|
||
|
||
- [[种子] seed-005_ad-certipy-esc1](./seed-005_ad-certipy-esc1.md)
|
||
- [[种子] seed-007_ntlm-relay-coercer](./seed-007_ntlm-relay-coercer.md)
|
||
- [[种子] seed-013_kerberoasting-spn](./seed-013_kerberoasting-spn.md)
|
||
- [[种子] seed-016_k8s-container-escape](./seed-016_k8s-container-escape.md)
|
||
|
||
### iOS 逆向
|
||
|
||
- [[种子] seed-009_ios-jailbreak-detect-bypass](./seed-009_ios-jailbr%65ak-detect-bypass.md)
|
||
|
||
### 工具链与环境
|
||
|
||
- [2026-08-08 平台无关结构化路由 PR 集成](./2026-08-08_client-neutral-structured-routing-pr-integration.md)
|
||
- [2026-07-20_reverse-toolchain-windows-bootstrap](./2026-07-20_reverse-toolchain-windows-bootstrap.md)
|
||
|
||
### 其他
|
||
|
||
- [2026-08-08 开放 PR 价值分级与安全集成](./2026-08-08_pr-value-triage-and-safe-integration.md)
|
||
- [[种子] seed-012_log4shell-jndi-rce](./seed-012_log4shell-jndi-rce.md)
|
||
|
||
## 高频成功模式（按技术）
|
||
|
||
### 平台无关路由与供应链门禁
|
||
|
||
- [单一 routing.json、多入口 parity、实际安装命令 pin](./2026-08-08_client-neutral-structured-routing-pr-integration.md)
|
||
|
||
### 固件自定义封装
|
||
|
||
- [1 KiB 自带掩码 ROR/XOR、Cortex-M 向量 crib、跨固件验证](./2026-08-06_cortex-m-msc-firmware-self-keyed-rotate-xor.md)
|
||
|
||
## 实体倒排（按目标特征）
|
||
|
||
### 多宿主安全技能路由包
|
||
|
||
- [核心/适配器边界与大 PR 选择性集成](./2026-08-08_client-neutral-structured-routing-pr-integration.md)
|
||
|
||
### Cortex-M USB MSC 升级器
|
||
|
||
- [应用/驻留 bootloader 边界与虚拟磁盘写入链路](./2026-08-06_cortex-m-msc-firmware-self-keyed-rotate-xor.md)
|
||
|
||
## 使用说明
|
||
|
||
1. 新任务开始前，先按场景分类查找是否有相似记录。
|
||
2. 命中真实项目时，优先复用已验证的流程和踩坑记录。
|
||
3. 命中种子案例时，只作为方法参考，不视为真实成功记录。
|
||
4. 新增经验后，请按 PR 流程更新本索引，避免直接改动共享主线。
|