SuperAPI AI Directory
Partner中文AI newsFavorites
Skillsvuln-analysis-expert

vuln-analysis-expert

General & other

View repository

Updated 10-16 06:51

About this skill

WooYun Vulnerability Analysis Expert System 
┌─────────────────────────────────────────────────────────────────┐
│  🎯 知识来源: WooYun 88,636 真实漏洞案例 (2010-2016)             │
│  📊 知识库规模: 8大类型 × 50案例深度分析 = 4,973行方法论          │
│  ⚡ 核心价值: 元思考方法论 + 实战测试流程 + 绕过技巧库            │
└─────────────────────────────────────────────────────────────────┘

I. Panorama of Vulnerability Types

Vulnerability Type Case Count Knowledge Base Core Insight
SQL Injection 27,732 sql-injection.md Confusion of code and data boundaries
XSS Cross-Site 7,532 xss.md Trust boundary breach
Command Execution 6,826 command-execution.md Transition from data to instructions
Logic Flaw 8,292 logic-flaws.md Business assumptions and behavioral deviations
File Upload 2,711 file-upload.md Execute attacker code
Unauthorized Access 14,377 unauthorized-access.md Lack of access control
Information Disclosure 7,337 info-disclosure.md Sensitive data exposure
File Traversal 2,854 file-traversal.md Path control breach
SSRF ~3,000 ssrf.md Server-Side Request Forgery
CSRF ~1,200 csrf.md Cross-Site Request Forgery
XXE ~100 xxe.md XML External Entity Injection
Configuration Error ~3,500 misconfig.md Security configuration flaws
RCE ~500 rce.md Remote Code Execution

📦 Complete Case Library: categories/ Directory contains detailed extraction of all 88,636 vulnerabilities (86MB)

II. Meta-Thinking Methodology Framework

2.1 Vulnerability Essence Formula

漏洞 = 预期行为 - 实际行为
    = 开发者假设 ⊕ 攻击者输入 → 意外状态

核心问题链:
1. 数据从哪来? (输入源) → GET/POST/Cookie/Header/文件
2. 数据到哪去? (数据流) → 验证→处理→存储→输出
3. 在哪被信任? (信任边界) → 前端/后端/数据库/系统
4. 如何被处理? (处理逻辑) → 过滤/转义/验证/执行
5. 处理后去哪? (输出点) → HTML/SQL/命令/文件

2.2 Attack Surface Mapping Model

          ┌─────────────────────────────────────────┐
          │            应用攻击面                    │
          └─────────────────────────────────────────┘
                            │
    ┌───────────────────────┼───────────────────────┐
    │                       │                       │
┌───▼───┐              ┌────▼────┐             ┌────▼────┐
│ 输入层 │              │  处理层  │             │  输出层  │
├────────┤              ├─────────┤             ├─────────┤
│GET参数 │              │输入验证  │             │HTML页面 │
│POST数据│     ──►      │业务逻辑  │     ──►     │JSON响应 │
│Cookie  │              │数据库操作│             │文件下载 │
│HTTP头  │              │文件操作  │             │错误信息 │
│文件上传│              │系统调用  │             │日志记录 │
└────────┘              └─────────┘             └─────────┘

2.3 Vulnerability Hunter Cognitive Levels

Level 1: 工具使用者 (10%)
├─ 会用扫描器和自动化工具
├─ 依赖已知漏洞特征
└─ 难以应对定制化场景

Level 2: 模式识别者 (30%)
├─ 识别漏洞代码模式
├─ 理解漏洞触发原理
└─ 能够手工验证

Level 3: 逻辑分析者 (40%)
├─ 理解业务流程
├─ 发现设计缺陷
└─ 组合利用链

Level 4: 创造性思考者 (20%)
├─ 发现新攻击向量
├─ 绕过防护机制
└─ 0day挖掘能力

III. Quick Reference: Vulnerability Type Quick Lookup

3.1 SQL Injection Quick Lookup

注入点识别:
├─ 高危参数: id, sort_id, username, password, search, keyword
├─ 测试向量: ' " ) ') ") -- # /*
└─ 数据库指纹: @@version(MSSQL) version()(MySQL) v$version(Oracle)

绕过技巧:
├─ 空格: /**/  %09  %0a  ()
├─ 关键字: SeLeCt  sel%00ect  /*!select*/
├─ 等号: LIKE  REGEXP  BETWEEN  IN
└─ 引号: 0x十六进制  char()  concat()

详见: knowledge/sql-injection.md (731行)

3.2 XSS Quick Lookup

输出点识别:
├─ 用户内容: 昵称、签名、评论、留言
├─ 搜索回显: 搜索框、历史记录
├─ 文件属性: 文件名、描述、alt属性
└─ 邮件内容: 标题、正文、附件名

绕过技巧:
├─ 标签变形: <ScRiPt>  <script/x>  <script\n>
├─ 事件触发: onerror  onload  onmouseover  onfocus
├─ 编码绕过: HTML实体  JS Unicode  URL编码
└─ 协议利用: javascript:  data:  vbscript:

详见: knowledge/xss.md (745行)

3.3 Command Execution Quick Lookup

入口点识别:
├─ 系统命令: ping、traceroute、nslookup功能
├─ 文件操作: 压缩、解压、图片处理
├─ 代码执行: eval、assert、preg_replace(/e)
└─ 框架漏洞: Struts2、WebLogic、JBoss

命令拼接:
├─ Linux: ;  |  ||  &&  `  $()
└─ Windows: &  |  ||  &&

绕过技巧:
├─ 空格: ${IFS}  $IFS$9  %09  <  <>
├─ 关键字: ca\t  ca''t  c$@at  /???/??t
└─ 编码: $(printf "\x63\x61\x74")  `echo Y2F0|base64 -d`

详见: knowledge/command-execution.md (714行)

3.4 Logic Flaw Quick Lookup

漏洞模式:
├─ 密码重置: 验证码回显、步骤跳过、凭证可控
├─ 越权访问: 水平越权(ID遍历)、垂直越权(角色提权)
├─ 支付逻辑: 金额篡改、数量篡改、优惠叠加
└─ 验证码: 不刷新、可重用、可爆破、客户端验证

测试思路:
├─ 理解业务流程 → 画状态转换图
├─ 识别关键校验 → 哪些参数决定结果
├─ 尝试绕过 → 修改参数/跳过步骤/重放/并发
└─ 验证影响 → 证明危害范围

详见: knowledge/logic-flaws.md (508行)

3.5 File Upload Quick Lookup

绕过检测:
├─ 前端验证: 修改JS/直接发包
├─ Content-Type: image/gif + PHP代码
├─ 扩展名: .php5 .phtml .pht .php. .php::$DATA
├─ 内容检测: GIF89a + <?php  或图片马
└─ 解析漏洞: /upload/1.asp;.jpg (IIS6)

解析漏洞:
├─ IIS 6.0: /test.asp/1.jpg  test.asp;.jpg
├─ Apache: .php.xxx (未知扩展名)
├─ Nginx: /1.jpg/1.php (cgi.fix_pathinfo)
└─ Tomcat: test.jsp%00.jpg

详见: knowledge/file-upload.md (471行)

3.6 Unauthorized Access Quick Lookup

访问类型:
├─ 后台未授权: 直接访问/admin /manager /console
├─ API未授权: 接口无鉴权、Token可预测
├─ 服务未授权: Redis/MongoDB/ES/Memcached
└─ IDOR: 水平越权访问他人数据

常见未授权服务:
├─ Redis: 6379 (写SSH公钥/Webshell)
├─ MongoDB: 27017 (数据库直接访问)
├─ Elasticsearch: 9200 (数据泄露/RCE)
├─ Memcached: 11211 (数据泄露)
└─ Docker: 2375 (容器逃逸)

详见: knowledge/unauthorized-access.md (605行)

IV. General Penetration Testing Process

4.1 Information Gathering Phase

# 子域名枚举
subfinder -d target.com -o subs.txt
amass enum -d target.com

# 端口扫描
nmap -sV -sC -p- target.com

# 目录枚举
dirsearch -u https://target.com -w wordlist.txt
ffuf -u https://target.com/FUZZ -w wordlist.txt

# JS分析
cat urls.txt | grep "\.js$" | xargs -I{} curl -s {} | grep -E "(api|endpoint|secret)"

# 历史数据
waybackurls target.com | grep "="

4.2 Vulnerability Detection Priorities

1. 高危快速检测 (立即验证)
   ├─ SQL注入 (sqlmap --risk=1 --level=1)
   ├─ 命令执行 (ping外带/时间延迟)
   └─ 文件上传 (直接上传PHP)

2. 中危系统检测 (逐一验证)
   ├─ XSS (手工+自动化)
   ├─ 未授权访问 (目录扫描)
   └─ 逻辑漏洞 (业务流程分析)

3. 低危完整覆盖 (补充验证)
   ├─ 信息泄露 (.git/.svn/备份文件)
   ├─ 配置错误 (默认口令/未授权服务)
   └─ 敏感信息 (错误页面/注释)

V. Defense Perspective: Common Remediation Solutions

Vulnerability Type Core Defense Specific Measures
SQL Injection Parameterized queries PreparedStatement/ORM
XSS Output encoding HTML entity encoding/CSP
Command Execution Avoid concatenation execFile instead of exec/whitelist
File Upload Strict validation Whitelist extensions/rename/isolate
Unauthorized Access control Authentication + authorization + session management
Logic Flaw Server-side validation Backend validation of critical logic

VI. Tool Recommendations

6.1 Automated Scanning

# SQL注入
sqlmap -u "URL" --batch --random-agent

# XSS
dalfox url "URL" --silence
xsstrike -u "URL"

# 目录扫描
dirsearch -u URL -e php,asp,aspx,jsp
ffuf -u URL/FUZZ -w wordlist.txt -mc 200,301,302

# 漏洞扫描
nuclei -u URL -t cves/

6.2 Manual Testing

# Burp Suite - 代理拦截+重放
# HackBar - 浏览器插件编码解码
# curl - 命令行HTTP请求
# sqlmap --proxy - 配合Burp使用

VII. Detailed Knowledge Base Index

File Line Count Content Summary
sql-injection.md 731 Injection point identification, database fingerprinting, bypass techniques, Payload library
xss.md 745 Output point classification, context analysis, bypass methods, DOM XSS
command-execution.md 714 Entry points, concatenation characters, bypass techniques, blind detection
logic-flaws.md 508 Password reset, privilege escalation, payment, verification code bypass
file-upload.md 471 Detection bypass, parsing vulnerabilities, high-risk CMS
unauthorized-access.md 605 Unauthorized access to admin/API/services, IDOR
info-disclosure.md 602 Leak types, sensitive paths, exploit chains
file-traversal.md 597 Parameter names, payload encoding, sensitive files

★ 核心洞察 ───────────────────────────────────── The essence of vulnerability discovery is finding the deviation between "developer assumptions" and "attacker input"

Key insights distilled from 88,636 real-world cases:

  1. Boundary thinking: All vulnerabilities occur on trust boundaries
  2. Data flow tracing: Trace the complete path of data from input to output
  3. Assumption challenging: Question every "taken-for-granted" validation
  4. Combination exploitation: A single low-risk vulnerability can be combined into a high-risk attack chain

What a true vulnerability hunter thinks about is "why is there a vulnerability here", not just "is there a vulnerability here". ─────────────────────────────────────────────────