Yliken

平台: VMware 系统镜像: ubuntu:18.04 server IP: master node1 node2 192.168.222.141/24 192.168.222.142/24 192.168.222.143/24

这篇文章是我边做pwnedlabs这个靶场边学习aws云安全的一个记录 Identify the AWS Account ID from a Public S3 BucketScenario The ability to expose and leverage even the smallest oversights is a coveted skill. A global Logistics Company has reached out to our cybersecurity company for assistance and have provided the IP address of their website. Your objective? Start the engagement and use this IP address to identify their AWS account ID via a public S3 bucket so we can commence the process of enumeration. 靶机开启之后给了一个ip地址和A ...

靶机地址 信息收集主机发现 123456789101112┌──(root㉿kali)-[/home/kali]└─# arp-scan -I eth1 192.168.56.0/24 Interface: eth1, type: EN10MB, MAC: 00:0c:29:34:da:f5, IPv4: 192.168.56.103WARNING: Cannot open MAC/Vendor file ieee-oui.txt: Permission deniedWARNING: Cannot open MAC/Vendor file mac-vendor.txt: Permission deniedStarting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)192.168.56.1 0a:00:27:00:00:0e (Unknown: locally a ...

信息收集主机发现 123456789101112┌──(root㉿kali)-[/home/kali]└─# arp-scan -I eth1 192.168.56.0/24Interface: eth1, type: EN10MB, MAC: 00:0c:29:34:da:f5, IPv4: 192.168.56.103WARNING: Cannot open MAC/Vendor file ieee-oui.txt: Permission deniedWARNING: Cannot open MAC/Vendor file mac-vendor.txt: Permission deniedStarting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)192.168.56.1 0a:00:27:00:00:0e (Unknown: locally administered)192.168.56.100 08:00:27:92:d2:b1 (Unknown)19 ...

CI/CDCI: 即 持续集成 ，是代码开发人员在将代码提交到代码存储库中。自动进行频繁的自动构建和测试阶段，频繁的将开发者的代码合并到主干，减少代码的质量问题:smile: 在多人协作的项目中，各开发人员负责各自的开发模块。每当完成一项需求后，开发人员需将代码提交至代码仓库。若每次提交后都人工进行构建和测试，工作量繁重且效率低下。而若等到一段时间后再统一测试，一旦发现问题，由于距离编写代码已过去一段时间，开发人员可能遗忘细节，导致修复困难重重。:face_with_head_bandage:为此，引入 Jenkins 等工具，在每次代码提交后自动执行构建和测试。若测试通过，代码自动合并至主分支；若不通过，则立即通知开发者修复。这种方式显著提升了开发效率，降低了问题排查和修复的成本。 关键组件 版本控制系统（VCS） 如 Git、SVN 等，用于管理代码的版本和多人协作，确保代码提交的追踪和管理。 构建工具 如 Maven、Gradle、Ant 等，负责将源代码编译成可执行文件或可部署的软件包。 自动化测试框架 如 JUnit、Selenium、Pytest 等，用于 ...

AliYyun给出的AKSK的作用 在阿里云，用户可以使用AccessKey（简称AK）构造一个API请求（或者使用云服务SDK）来操作资源。AccessKey包括AccessKey ID和AccessKey Secret。其中AccessKey ID用于标识用户，AccessKey Secret是用来验证用户身份合法性的密钥。AccessKey Secret必须保密。 AK/SK泄露的攻击面1.AK/SK接管存储桶 当泄露的AK/SK有对存储桶有操作权限的时候，可以在aliyun Cli配置AK/SK来接管存储桶 使用aliyun oss ls来列出桶 使用aliyun oss ls <桶的名称>列出桶里面的内容 2.AK/SK执行云服务器命令 当泄露的AK/SK对ECS有操作权限的时候 可以使用aliyun ecs DescribeInstances列出ECS资源 使用 aliyun ecs RunCommand --CommandContent "<命令内容>" --Type ...

信息收集123456789101112┌──(root㉿kali)-[/home/kali]└─# arp-scan -I eth1 192.168.56.0/24Interface: eth1, type: EN10MB, MAC: 00:0c:29:34:da:f5, IPv4: 192.168.56.103WARNING: Cannot open MAC/Vendor file ieee-oui.txt: Permission deniedWARNING: Cannot open MAC/Vendor file mac-vendor.txt: Permission deniedStarting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)192.168.56.1 0a:00:27:00:00:10 (Unknown: locally administered)192.168.56.100 08:00:27:eb:ec:71 (Unknown)192.168 ...

信息收集12345678910┌──(root㉿kali)-[/home/kali/Desktop/hackmyvm]└─# arp-scan -I eth1 192.168.56.0/24Interface: eth1, type: EN10MB, MAC: 00:0c:29:34:da:f5, IPv4: 192.168.56.103Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)192.168.56.1 0a:00:27:00:00:0e (Unknown: locally administered)192.168.56.100 08:00:27:43:9b:54 PCS Systemtechnik GmbH192.168.56.108 08:00:27:b9:ee:14 PCS Systemtechnik GmbH3 packets received by filter, 0 packets dropped by kernel ...

题目地址 信息收集主机发现 123456789101112┌──(root㉿kali)-[/home/kali]└─# arp-scan -I eth1 192.168.56.0/24Interface: eth1, type: EN10MB, MAC: 00:0c:29:34:da:f5, IPv4: 192.168.56.103WARNING: Cannot open MAC/Vendor file ieee-oui.txt: Permission deniedWARNING: Cannot open MAC/Vendor file mac-vendor.txt: Permission deniedStarting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)192.168.56.1 0a:00:27:00:00:0e (Unknown: locally administered)192.168.56.100 08:00:27:b0:9b:6b (Unkno ...

WEBSafe_Proxy刚开始比赛看到题目名字里面有Proxy 就先来做这个了(在最近的比赛中见到的proxy题比较多) 题目进入之后给了源码 源码 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106from flask import Flask, request, render_template_stringimport socketimport threadingimport htmlapp = Flask(__name__)@app.route(&#x27;/&#x27;, methods=[&quot;GET&quot;])def source(): with open(_ ...