<html class="no-js" lang="en">

<head>

<meta charset="utf-8" />

<meta name="viewport" content="width=device-width, initial-scale=1.0" />

<title>

Checklist - lonelyorのblog

</title>

<link href="atom.xml" rel="alternate" title="lonelyorのblog" type="application/atom+xml">

<link rel="stylesheet" href="asset/css/foundation.min.css" />

<link rel="stylesheet" href="asset/css/docs.css" />

<script src="asset/js/vendor/modernizr.js"></script>

<script src="asset/js/vendor/jquery.js"></script>

<script src="asset/highlightjs/highlight.pack.js"></script>

<link href="asset/highlightjs/styles/github.css" media="screen, projection" rel="stylesheet" type="text/css">

<script>hljs.initHighlightingOnLoad();</script>

<script type="text/javascript">

function before_search(){

var searchVal = 'site:www.lonelyor.org/lonelyorNotes ' + document.getElementById('search_input').value;

document.getElementById('search_q').value = searchVal;

return true;

}

</head>

<body class="antialiased hide-extras">

<div class="marketing off-canvas-wrap" data-offcanvas>

<div class="inner-wrap">

<nav class="top-bar docs-bar hide-for-small" data-topbar>

<section class="top-bar-section">

<div class="row">

<div style="position: relative;width:100%;"><div style="position: absolute; width:100%;">

<ul id="main-menu" class="left">

<li id=""><a target="_self" href="index.html">主页</a></li>

<li id=""><a target="_self" href="archives.html">归档</a></li>

<li id=""><a target="_self" href="lost.html">失乐园</a></li>

<li id=""><a target="_self" href="about.html">关于</a></li>

</ul>

<ul class="right" id="search-wrap">

<li>

<form target="_blank" onsubmit="return before_search();" action="https://google.com/search" method="get">

<input type="hidden" id="search_q" name="q" value="" />

<input tabindex="1" type="search" id="search_input" placeholder="Search"/>

</ul>

</div></div>

</div>

</section>

<nav class="tab-bar show-for-small">

<a href="javascript:void(0)" class="left-off-canvas-toggle menu-icon">

<span> &nbsp; lonelyorのblog</span>

</a>

<aside class="left-off-canvas-menu">

<ul class="off-canvas-list">

<li><a target="_self" href="index.html">主页</a></li>

<li><a target="_self" href="archives.html">归档</a></li>

<li><a target="_self" href="lost.html">失乐园</a></li>

<li><a target="_self" href="about.html">关于</a></li>

<li><label>Categories</label></li>

<li><a href="Web%E6%94%BB%E9%98%B2.html">Web攻防</a></li>

<li><a href="%E6%93%8D%E4%BD%9C%E7%B3%BB%E7%BB%9F.html">操作系统</a></li>

<li><a href="%E8%99%9A%E6%8B%9F%E5%AE%9E%E9%AA%8C%E5%AE%A4.html">虚拟实验室</a></li>

<li><a href="CTF.html">CTF</a></li>

<li><a href="%E5%BC%80%E5%8F%91.html">开发</a></li>

<li><a href="%E6%B5%8F%E8%A7%88%E5%99%A8.html">浏览器</a></li>

<li><a href="%E5%A5%87%E6%B7%AB%E5%B7%A7%E6%8A%80.html">奇淫巧技</a></li>

</ul>

</aside>

<a class="exit-off-canvas" href="#"></a>

<section id="main-content" role="main" class="scroll-container">

<script type="text/javascript">

$(function(){

$('#menu_item_index').addClass('is_active');

});

<div class="row">

<div class="large-8 medium-8 columns">

<div class="markdown-body home-categories">

<div class="article">

<a class="clearlink" href="15428591301433.html">

<h1>Web安全检测checklist</h1>

<div class="a-content">

<div class="a-content-text">

<h2 id="toc_0">x01 爆破</h2>

<h3 id="toc_1">弱口令</h3>

<p>HTTP登录<br/>

SSH<br/>

MySQL<br/>

Telnet</p>

<h3 id="toc_2">遍历</h3>

<p>网站敏感文件<br/>

源码<br/>

配置文件<br/>

备份文件<br/>

探针类文件<br/>

网站敏感目录<br/>

物理路径<br/>

网站管理后台<br/>

上传目录<br/>

数据库Web管理入口<br/>

现成的Webshell<br/>

端口扫描<br/>

0day扫描<br/>

子域名</p>

<h2 id="toc_3">x02 不安全配置</h2>

<h3 id="toc_4">Web服务器</h3>

<p>Nginx<br/>

Apache<br/>

IIS</p>

<h3 id="toc_5">Web应用服务器</h3>

<p>Tomcat<br/>

JBoss<br/>

Weblogic</p>

<h3 id="toc_6">HTTP安全特性</h3>

<p>HTTP Headers<br/>

HTTP Options<br/>

rebots.txt<br/>

flash跨域策略</p>

<h2 id="toc_7">x03 敏感信息泄露</h2>

<h3 id="toc_8">用户敏感信息</h3>

<p>手机号<br/>

身份证号<br/>

社保<br/>

银行卡号<br/>

家庭住址</p>

<h3 id="toc_9">应用敏感信息</h3>

<p>debug信息<br/>

堆栈报错</p>

<h3 id="toc_10">站点敏感信息</h3>

<p>测试页面<br/>

备份文件</p>

<h3 id="toc_11">本地敏感信息</h3>

<p>前端保存用户密码<br/>

前端保存验证码</p>

<h2 id="toc_12">x04 xss跨站脚本</h2>

<p>反射型xss<br/>

存储型xss<br/>

DOM型xss</p>

<h2 id="toc_13">x05 请求伪造</h2>

<p>csrf跨站请求伪造<br/>

ssrf服务器请求伪造</p>

<h2 id="toc_14">x06 注入</h2>

<p>LDAP注入<br/>

ORM注入<br/>

XML注入<br/>

XPath注入<br/>

IMAP/SMTP注入<br/>

SQL注入<br/>

代码注入<br/>

客户端模板注入（CSTI）<br/>

服务端模板注入（SSTI）<br/>

服务器端包含注入（SSI）</p>

<h2 id="toc_15">x07 已知漏洞组件</h2>

<p>库文件（某些库会导致远程命令执行）<br/>

框架（如wordpress、thinkphp、django等）<br/>

模块（python的某些模块会导致代码注入）</p>

<h2 id="toc_16">x08 文件类漏洞</h2>

<p>文件包含漏洞<br/>

任意文件创建<br/>

任意文件读取<br/>

任意文件上传<br/>

任意文件下载<br/>

任意文件删除</p>

<h2 id="toc_17">x09 解析漏洞</h2>

<p>IIS解析漏洞<br/>

Nginx解析漏洞<br/>

Apache解析漏洞<br/>

PHP CGI解析漏洞</p>

<h2 id="toc_18">x10 劫持类漏洞</h2>

<p>点击劫持<br/>

Jsonp劫持<br/>

WebSocket劫持<br/>

DNS劫持<br/>

二维码劫持<br/>

子域名劫持</p>

<h2 id="toc_19">x11 业务逻辑漏洞</h2>

<h3 id="toc_20">认证</h3>

<p>使用默认凭证<br/>

冻结账户策略不当<br/>

弱用户名和密码<br/>

“记住我”功能<br/>

自动登录<br/>

单点登录<br/>

弱口令<br/>

弱安全问题/答案<br/>

第三方登录风险<br/>

Oauth2.0安全<br/>

JWT安全<br/>

注册覆盖<br/>

未验证的重定向和转发<br/>

双因素认证不当</p>

<h3 id="toc_21">授权</h3>

<p>测试角色定义<br/>

权限管理缺失<br/>

匿名访问（备用接口——常见于兼容老的不安全的接口时产生）<br/>

水平越权<br/>

垂直越权<br/>

超级账户<br/>

实名认证不严格</p>

<h3 id="toc_22">会话管理</h3>

<p>cookie安全属性<br/>

cookie可猜解<br/>

cookie溢出<br/>

会话固定<br/>

用户凭证不安全传输（弱加密或明文传输）<br/>

用户凭证未一次失效<br/>

用户凭证可猜解<br/>

注销与会话超时<br/>

敏感数据不安全传输</p>

<h3 id="toc_23">流程绕过</h3>

<p>找回密码流程绕过</p>

<h2 id="toc_24">x12 API安全</h2>

<p>整理中</p>

</div>

</div>

</a>

<div class="read-more clearfix">

<div class="more-left left">

<span class="date">2018/11/22 11:58 上午</span>

<span>posted in&nbsp;</span>

<span class="posted-in"><a href='Checklist.html'>Checklist</a></span>

</div>

<div class="more-right right">

<span class="comments">

</span>

</div>

</div>

</div><!-- article -->

<div class="row">

<div class="large-6 columns">

<p class="text-left" style="padding-top:25px;">

<a href="Checklist.html">&laquo; Prev Page</a>

</p>

</div>

<div class="large-6 columns">

<p class="text-right" style="padding-top:25px;">

</p>

</div>

</div>

</div>

</div><!-- large 8 -->

<div class="large-4 medium-4 columns">

<div class="hide-for-small">

<div id="sidebar" class="sidebar">

<div id="site-info" class="site-info">

<div class="site-a-logo"><img src="http://images.lonelyor.org/lonelyornotesico.jpeg" /></div>

</br>

<h1>lonelyorのblog</h1>

<div class="site-des">一个用来记录学习笔记的网站</div>

<div class="social">

<a target="_blank" class="github" target="_blank" href="https://github.com/AlShelley/lonelyorNotes" title="GitHub">GitHub</a>

<a target="_blank" class="email" href="mailto:lonelyor.org@gmail.com" title="Email">Email</a>

<a target="_blank" class="rss" href="atom.xml" title="RSS">RSS</a>

</div>

</div>

<div id="site-categories" class="side-item ">

<div class="side-header">

<h2>分类</h2>

</div>

<div class="side-content">

<p class="cat-list">

<a href="Web%E6%94%BB%E9%98%B2.html"><strong>Web攻防</strong></a>

<a href="%E6%93%8D%E4%BD%9C%E7%B3%BB%E7%BB%9F.html"><strong>操作系统</strong></a>

<a href="%E8%99%9A%E6%8B%9F%E5%AE%9E%E9%AA%8C%E5%AE%A4.html"><strong>虚拟实验室</strong></a>

<a href="CTF.html"><strong>CTF</strong></a>

<a href="%E5%BC%80%E5%8F%91.html"><strong>开发</strong></a>

<a href="%E6%B5%8F%E8%A7%88%E5%99%A8.html"><strong>浏览器</strong></a>

<a href="%E5%A5%87%E6%B7%AB%E5%B7%A7%E6%8A%80.html"><strong>奇淫巧技</strong></a>

</p>

</div>

</div>

<div id="site-categories" class="side-item">

<div class="side-header">

<h2>最新文章</h2>

</div>

<div class="side-content">

<ul class="posts-list">

<li class="post">

<a href="15453720146052.html">Pycharm编程遇到的技巧</a>

</li>

<li class="post">

<a href="15453717965995.html">npm Cannot find module 'semver' --解决方案</a>

</li>

<li class="post">

<a href="15453716917526.html">mongodb安装配置（arch）</a>

</li>

<li class="post">

<a href="15453714645346.html">linux安装配置aria2及其Web图形界面（debian为例）</a>

</li>

<li class="post">

<a href="15453713553710.html">linux下搜狗输入法不能用的解决办法</a>

</li>

</ul>

</div>

</div>

</div><!-- sidebar -->

</div><!-- hide for small -->

<div class="page-bottom clearfix">

<div class="row">

<p class="copyright">Copyright &copy; 2018

Powered by <a target="_blank" href="http://www.mweb.im">MWeb</a>,&nbsp;

Theme used <a target="_blank" href="http://github.com">GitHub CSS</a>,&nbsp;

Author is <a target="_blank" href="http://lonelyor.org">lonelyor</a>

</div>

</section>

</div>

</div>

<script src="asset/js/foundation.min.js"></script>

<script>

$(document).foundation();

function fixSidebarHeight(){

var w1 = $('.markdown-body').height();

var w2 = $('#sidebar').height();

if (w1 > w2) { $('#sidebar').height(w1); };

}

$(function(){

fixSidebarHeight();

})

$(window).load(function(){

fixSidebarHeight();

});

</script>

<div class="bdsharebuttonbox"><a href="#" class="bds_more" data-cmd="more">分享到：</a><a href="#" class="bds_qzone" data-cmd="qzone" title="分享到QQ空间">QQ空间</a><a href="#" class="bds_weixin" data-cmd="weixin" title="分享到微信">微信</a><a href="#" class="bds_tsina" data-cmd="tsina" title="分享到新浪微博">新浪微博</a><a href="#" class="bds_tqq" data-cmd="tqq" title="分享到腾讯微博">腾讯微博</a><a href="#" class="bds_fbook" data-cmd="fbook" title="分享到Facebook">Facebook</a></div>

<script>window._bd_share_config={"common":{"bdSnsKey":{},"bdText":"来自：http://www.lonelyor.org/","bdMini":"1","bdMiniList":["sqq","weixin","fbook","twi","qzone","tsina","tqq","tieba","douban","tsohu","linkedin","mshare","copy"],"bdPic":"http://images.lonelyor.org/lonelyornotesico.jpeg","bdStyle":"1","bdSize":"16"},"share":{"bdSize":16},"image":{"viewList":["qzone","weixin","tsina","tqq","fbook"],"viewText":"分享到：","viewSize":"24"},"selectShare":{"bdContainerClass":null,"bdSelectMiniList":["qzone","weixin","tsina","tqq","fbook"]}};with(document)0[(getElementsByTagName('head')[0]||body).appendChild(createElement('script')).src='http://bdimg.share.baidu.com/static/api/js/share.js?v=89860593.js?cdnversion='+~(-new Date()/36e5)];</script>

</body>