当前位置：网站首页>Fengshentai old shooting range Kali series

Fengshentai old shooting range Kali series

2022-06-26 12:23:00 【weixin_ forty-three million four hundred and forty-six thousand】

One 、 Information collection ： Subdomain detection
Download this dictionary ：https://hack.zkaq.cn/file/down?id=f80ff6b197c0773b
And then use it layer Scan the subdomain name , The subdomain name obtained is shop.aqlab.cn
Insert picture description here Two 、 Information gathering ： Port scanning
namp Yes shop.aqlab.cn scan , Get the port number as 8001,flag by 8001, According to the previous customs, you can also know that the port number is 8001
3、 ... and 、 Vulnerability scanning - web Scanner
Yes http://shop.aqlab.cn:8001/ Do a directory scan ,flag stay robots.txt Under the table of contents
Insert picture description here
Four 、 Injection test -sqlmap
The injection point is http://shop.aqlab.cn:8001/single.php?id=1, Use sqlmap To detect

python3 sqlmap.py -u http://shop.aqlab.cn:8001/single.php?id=1 --dbs Get the database
python3 sqlmap.py -u http://shop.aqlab.cn:8001/single.php?id=1 -D cake --dump-all Number acquisition cake Contents of database tables , obtain flag
Insert picture description here
5、 ... and 、Sqlmap --os-shell
Use python3 sqlmap.py -u http://shop.aqlab.cn:8001/single.php?id=1 --os-shell

Can't use cmd Command view flag.php file , Choice in http://shop.aqlab.cn:8001/tmpupjua.php Upload the Trojan , obtain flag