黑客攻防大全（黑客攻防讲的是什么?）

前言

最近整理了一些奇安信&华为&深信服大佬的课件资料+大厂面试课题，想要的可以私信自取，无偿赠送给粉丝朋友~

基础研究，参考各种文章，使用频率前 25 位的。这些参数可用于工具或手动使用的参数。

包含以下漏洞的常见参数：

XSS跨站脚本攻击 SSRF服务端请求伪造 LFI本地文件包含 SQL注入 RCE远程代码执行 URL重定向

XSS跨站脚本攻击

?q={payload} ?s={payload} ?search={payload} ?id={payload} ?lang={payload} ?keyword={payload} ?query={payload} ?page={payload} ?keywords={payload} ?year={payload} ?view={payload} ?email={payload} ?type={payload} ?name={payload} ?p={payload} ?month={payload} ?image={payload} ?list_type={payload} ?url={payload} ?terms={payload} ?categoryid={payload} ?key={payload} ?login={payload} ?begindate={payload} ?enddate={payload}

SSRF服务端请求伪造

?dest={target} ?redirect={target} ?uri={target} ?path={target} ?continue={target} ?url={target} ?window={target} ?next={target} ?data={target} ?reference={target} ?site={target} ?html={target} ?val={target} ?validate={target} ?domain={target} ?callback={target} ?return={target} ?page={target} ?feed={target} ?host={target} ?port={target} ?to={target} ?out={target} ?view={target} ?dir={target}

LFI本地文件包含

?cat={payload} ?dir={payload} ?action={payload} ?board={payload} ?date={payload} ?detail={payload} ?file={payload} ?download={payload} ?path={payload} ?folder={payload} ?prefix={payload} ?include={payload} ?page={payload} ?inc={payload} ?locate={payload} ?show={payload} ?doc={payload} ?site={payload} ?type={payload} ?view={payload} ?content={payload} ?document={payload} ?layout={payload} ?mod={payload} ?conf={payload}

SQL注入

?id= ?page= ?dir= ?search= ?category= ?file= ?class= ?url= ?news= ?item= ?menu= ?lang= ?name= ?ref= ?title= ?view= ?topic= ?thread= ?type= ?date= ?form= ?join= ?main= ?nav= ?region=

RCE远程代码

?cmd= ?exec= ?command= ?execute= ?ping= ?query= ?jump= ?code= ?reg= ?do= ?func= ?arg= ?option= ?load= ?process= ?step= ?read= ?function= ?req= ?feature= ?exe= ?module= ?payload= ?run= ?print=

执行URL重定向

?next={payload} ?url={payload} ?target={payload} ?rurl={payload} ?dest={payload} ?destination={payload} ?redir={payload} ?redirect_uri={payload} ?redirect_url={payload} ?redirect={payload} /redirect/{payload} /cgi-bin/redirect.cgi?{payload} /out/{payload} /out?{payload} ?view={payload} /login?to={payload} ?image_url={payload} ?go={payload} ?return={payload} ?returnTo={payload} ?return_to={payload} ?checkout_url={payload} ?continue={payload} ?return_path={payload}

文章来源：Khan安全攻防实验室