⛔ Rule 1: No blind manual enumeration
Trigger scenario: Use curl to test paths one by one (such as /upload, /admin/upload, /bank/upload ...)
Rule:
- For the same type of path (such as file upload endpoints), manually curl at most 3 most likely paths
- After 3 404s immediately stop manual enumeration, switch to tools:
# ✅ 用 gobuster/dirsearch 一次扫完 gobuster dir -u http://target -w /usr/share/wordlists/dirb/common.txt -q -t 20 --timeout 10s 2>&1 | head -50 - ⛔ NeverHEAD request 20+ guessed paths one by one — this is a waste of time
⛔ Rule 2: Long-running tools must have a timeout
Trigger scenario: Running scanning tools such as sqlmap, nikto, dirsearch
Rule:
- All scanning tools must be wrapped with
timeout, maximum 8 minutes - Must use
teeto preserve output, check existing results after timeout# ✅ 正确 timeout 480 sqlmap -u 'http://target/page?id=1' --batch --level 2 --risk 2 2>&1 | tee /tmp/sqlmap.log # 超时后 tail -80 /tmp/sqlmap.log - ⛔ Prohibited
sleep N && tailpolling and waiting — wastes round time
⛔ Rule 3: Quickly switch direction when there are no results
Trigger scenario: Multiple consecutive attempts at the same type of vulnerability with no results
Rule:
- Same endpoint + same vulnerability type,switch direction after 5 different payloads with no results
- Before switching, use
evidence_saveto record what has been tested (to avoid repetition in the next round) - Prioritize switching to untested vulnerability types, rather than more variants of the same type
Efficiency priority
| Behavior | Efficiency | Description |
|---|---|---|
| Use tools for batch scanning | ⭐⭐⭐ | gobuster/sqlmap/nikto covers a large number of paths at once |
| Targeted manual testing | ⭐⭐ | Precisely test 3-5 high-probability points based on analysis results |
| Blind manual enumeration | ⛔ | Guessing paths one by one with curl, extremely inefficient |