{ "projects": [ { "id": "fc433541-6eb0-4e12-9faa-8b362a48aa74", "content": "不翻墙也能进\nPHP结构", "descTags": "台湾,教育,网站,tw,PHP", "icon": "https://www.boe.ttct.edu.tw/favicon.ico", "name": "台东县政府教育处", "updatedAt": "2021-11-06 11:04:59", "relatedUrls": "https://www.boe.ttct.edu.tw\nhttps://www.boe.ttct.edu.tw/indexw.php\nhttps://www.boe.ttct.edu.tw/index.php" }, { "name": "【HackerOne】BlockFi", "icon": "https://www.boe.ttct.edu.tw/favicon.ico", "relatedUrls": "*.blockfi.com", "assetsLink": "https://www.kdocs.cn/p/110442450968", "createdAt": "2021-04-04 11:43:20", "updatedAt": "2021-04-04 11:43:20", "id": "7aa46a33-6b06-4d2b-add9-5f4c51fc18ce" }, { "name": "Bashed", "icon": "https://www.boe.ttct.edu.tw/favicon.ico", "relatedUrls": "10.10.10.68", "descTags": "Linux", "content": "1.Linux\n2.\n3.\n4.\n5.", "assetsLink": "https://www.kdocs.cn/p/108568711024", "createdAt": "2021-03-20 15:15:06", "updatedAt": "2021-03-20 15:15:06", "id": "683722ad-1278-4d0b-97cf-e9ae0d30f517" }, { "name": "Lane", "icon": "https://www.boe.ttct.edu.tw/favicon.ico", "relatedUrls": "10.10.10.3", "descTags": "Linux", "content": "1.\n2.\n3.", "createdAt": "2021-03-16 18:02:01", "updatedAt": "2021-03-16 22:54:25", "id": "c864e5fc-21e9-431a-aabd-60f1243c5038", "assetsLink": "https://www.kdocs.cn/p/108074056070?from=docs&source=docsWeb" }, { "name": "【HTB靶机】Guard", "icon": "https://www.boe.ttct.edu.tw/favicon.ico", "relatedUrls": "10.10.10.50", "descTags": "Linux", "content": "Linux靶机测验", "createdAt": "2021-03-06 22:39:35", "updatedAt": "2021-03-06 22:40:37", "id": "d898b6de-1536-483d-a731-6791bce7f1f5" }, { "name": "【HTB靶机】Markup", "icon": "https://www.boe.ttct.edu.tw/favicon.ico", "relatedUrls": "10.10.10.49", "descTags": "Windows", "content": "Windows靶机测验", "createdAt": "2021-03-06 15:46:18", "updatedAt": "2021-03-06 15:47:05", "id": "e9bf74a4-83ff-48fc-aba3-18eb874cf30d" }, { "name": "【HTB靶机】Included", "icon": "https://www.boe.ttct.edu.tw/favicon.ico", "relatedUrls": "10.10.10.55", "descTags": "Linux", "content": "Linux靶机测验", "createdAt": "2021-03-04 21:42:12", "updatedAt": "2021-03-04 21:42:12", "id": "d1e36a8c-309c-41ac-9bed-08d9ee3911f0" }, { "name": "【HTB靶机】Pathfinder", "icon": "https://www.boe.ttct.edu.tw/favicon.ico", "relatedUrls": "10.10.10.30", "descTags": "Linux", "content": "Linux靶机测验", "createdAt": "2021-03-03 17:57:29", "updatedAt": "2021-03-03 17:57:29", "id": "63b4d248-8ecc-4771-9e17-cdf9228990cb" }, { "name": "【HTB靶机】Shield", "icon": "https://www.boe.ttct.edu.tw/favicon.ico", "relatedUrls": "10.10.10.29", "descTags": "Wndows", "content": "Windows靶机测验", "createdAt": "2021-03-01 00:03:10", "updatedAt": "2021-03-01 00:03:41", "id": "613a838b-c314-4416-a437-9e9cdf02a7d6" }, { "name": "【HTB靶机】Vaccine", "icon": "https://www.boe.ttct.edu.tw/favicon.ico", "relatedUrls": "10.10.10.46", "descTags": "Linux", "content": "Linux靶机测验", "createdAt": "2021-02-27 09:17:59", "updatedAt": "2021-02-27 09:17:59", "id": "789adc55-b611-41f3-befd-a4c55db2c564" }, { "name": "【HTB靶机】Archetype", "createdAt": "2021-02-19 15:59:14", "updatedAt": "2021-02-21 11:05:43", "id": "6099fa36-849e-4772-a88e-36f2755863d5", "icon": "https://www.boe.ttct.edu.tw/favicon.ico", "relatedUrls": "http://10.10.10.27", "descTags": "靶机,windows", "content": "Windows靶机测验" }, { "name": "JIS-CTF-VulnUpload-CTF01", "relatedUrls": "http://192.168.219.130", "descTags": "靶机", "content": "1.已经做过的题目。\n2.再熟悉一遍。\n3.", "createdAt": "2021-02-02 14:55:00", "updatedAt": "2021-02-21 11:05:37", "id": "1e97f681-36de-46a7-9ee6-8f0138babc06", "icon": "https://www.boe.ttct.edu.tw/favicon.ico" }, { "name": "【HTB靶机】Oopsie", "icon": "https://www.boe.ttct.edu.tw/favicon.ico", "relatedUrls": "10.10.10.28", "descTags": "靶机,linux", "content": "Linux靶机测验", "createdAt": "2021-02-19 20:03:08", "updatedAt": "2021-02-19 20:03:08", "id": "9f0764ba-ea91-4a30-91eb-dc8b66bf409c" } ], "servers": [ { "projectId": "7aa46a33-6b06-4d2b-add9-5f4c51fc18ce", "trueIP": "151.101.194.132", "systemType": "未知", "systemVersion": "未知", "openPort": "80", "webAppFirewall": "未知", "createdAt": "2021-04-04 11:44:43", "updatedAt": "2021-04-04 12:54:37", "id": "65b7ae03-78be-439b-b180-d6b659f56962" }, { "projectId": "683722ad-1278-4d0b-97cf-e9ae0d30f517", "trueIP": "10.10.10.68", "systemType": "Linux", "webAppFirewall": "暂时未知", "createdAt": "2021-03-20 15:16:05", "updatedAt": "2021-03-20 15:30:25", "id": "80c8c9e9-8423-449e-a51c-0eaeeb45222d", "systemVersion": "Apache/2.4.18 (Ubuntu)", "openPort": "80" }, { "projectId": "c864e5fc-21e9-431a-aabd-60f1243c5038", "trueIP": "10.10.10.3", "systemType": "Linux", "openPort": "21,22,139,445,3632", "webAppFirewall": "暂时未知", "createdAt": "2021-03-16 18:24:58", "updatedAt": "2021-03-17 14:24:58", "id": "d8c52a5d-8403-4a7f-97ae-4fec57e7aba5" }, { "projectId": "e9bf74a4-83ff-48fc-aba3-18eb874cf30d", "trueIP": "10.10.10.49", "systemType": "Linux", "openPort": "22,80,443", "webAppFirewall": "暂未发现", "createdAt": "2021-03-06 22:41:28", "updatedAt": "2021-03-06 22:41:28", "id": "2190fb87-a676-4ea2-aa39-9090d6555cc1" }, { "projectId": "d1e36a8c-309c-41ac-9bed-08d9ee3911f0", "trueIP": "10.10.10.55", "systemType": "Linux", "openPort": "80,69", "webAppFirewall": "暂未发现", "createdAt": "2021-03-04 21:43:16", "updatedAt": "2021-03-06 15:47:21", "id": "91b1b24b-155c-400d-9d42-d2339960da14" }, { "projectId": "63b4d248-8ecc-4771-9e17-cdf9228990cb", "trueIP": "10.10.10.30", "systemType": "Linux", "openPort": "464,445,593,49676,49664,47001,88,135,3269,49698,9389,636,53,49667,49671,139,49718,49666,49683,3268,389,49677,49665,5985", "webAppFirewall": "暂未发现", "createdAt": "2021-03-03 17:59:14", "updatedAt": "2021-03-04 21:21:13", "id": "b14592f6-dc5a-4bb5-ad51-9aca18f70aa4" }, { "projectId": "613a838b-c314-4416-a437-9e9cdf02a7d6", "trueIP": "10.10.10.29", "systemType": "Windows", "openPort": "80,3306", "webAppFirewall": "暂未发现", "createdAt": "2021-03-01 00:04:14", "updatedAt": "2021-03-01 00:04:14", "id": "c4c66dec-7360-4496-89ca-afa4b9ff757c" }, { "projectId": "789adc55-b611-41f3-befd-a4c55db2c564", "trueIP": "10.10.10.46", "systemType": "Linux", "openPort": "21,22,80", "webAppFirewall": "暂未发现", "createdAt": "2021-02-27 09:19:08", "updatedAt": "2021-02-27 09:19:08", "id": "65e8219f-7ae3-42dd-b043-1a6a1fa10188" }, { "projectId": "9f0764ba-ea91-4a30-91eb-dc8b66bf409c", "trueIP": "10.10.10.28", "systemType": "Linux,Apache,Ubuntu", "systemVersion": "Apache httpd 2.4.29 ((Ubuntu))", "openPort": "22,80", "webAppFirewall": "经过【wafw00f 】检测，没有WAF。", "createdAt": "2021-02-19 20:04:02", "updatedAt": "2021-02-20 10:25:54", "id": "36b27d9f-062e-4cef-b871-57aad9433d6b" }, { "projectId": "6099fa36-849e-4772-a88e-36f2755863d5", "trueIP": "10.10.10.27", "createdAt": "2021-02-19 16:02:14", "updatedAt": "2021-02-19 16:05:02", "id": "af35c4a3-7d31-4e60-abb6-7cf49e61173c", "systemType": "Windows", "systemVersion": "123", "openPort": "135,139,445,1433", "webAppFirewall": "暂未发现" }, { "projectId": "fc433541-6eb0-4e12-9faa-8b362a48aa74", "trueIP": "1.1.1.1", "systemType": "Windows,PHP", "systemVersion": "【从google搜到信息页】(http://sfsmaster.boe.ttct.edu.tw/include/sfsinfo/program_info.php)\nLinux(FreeBSD) + Apache + php4.x ，WINNT(WIN2K) + IIS(Apache) + php4.x\n从指令来看，应该是【Linux】那一套。\n", "openPort": "80/tcp,\n113/tcp,\n443/tcp,\n1801/tcp（Windows消息队列）", "webAppFirewall": "存在网页防火墙1", "createdAt": "2021-01-05 19:24:07", "updatedAt": "2021-02-04 13:00:40", "id": "f65a16d9-797e-4a7b-a2bb-2674b0dc06bb" }, { "trueIP": "192.168.219.130\n?", "openPort": "80/tcp,\n22/tcp", "createdAt": "2021-02-02 18:21:57", "updatedAt": "2021-02-04 12:49:39", "id": "b2144770-0a79-495a-86c8-fcaa944b59c2", "systemType": "PHP,Linux,Apache,MYSQL", "systemVersion": "Linux 3.2 - 4.9\nApache/2.4.18 (Ubuntu)" } ], "siteMains": [ { "projectId": "fc433541-6eb0-4e12-9faa-8b362a48aa74", "cmsSystemInfo": "【SFS学务系统】\n[部署使用、常见配置](http://webcache.googleusercontent.com/search?q=cache:NkFd3Z0KO2AJ:elesson.tc.edu.tw/md221/mod/resource/view.php%3Fid%3D1257+&cd=15&hl=zh-CN&ct=clnk&gl=us)", "cdnDetail": "曾使用过CDN\n1", "certDetail": "HTTPS证书实名\n1", "dnsRecords": "DNS多为台湾当地小运营商\n1", "createdAt": "2021-01-05 20:03:07", "updatedAt": "2021-01-06 12:04:30", "id": "c5dd08f8-44a2-4e02-af33-4e9d7dd64cdd" } ], "owners": [ { "projectId": "fc433541-6eb0-4e12-9faa-8b362a48aa74", "whoisDetail": "一些持有人线索", "ownerName": "真实姓名", "siteRegisterRecord": "网站的一些备案，历次备案", "frequentlyUsedAccount": "持有人\n一些账号", "emailDetail": "@qq.com\n@163.com", "phoneTrackDetail": "一些线索", "socialRepoRecord": "社工库，\n查询", "createdAt": "2021-01-05 23:12:24", "updatedAt": "2021-01-05 23:18:26", "id": "805d68fe-a95b-4f70-a24e-8cd0d55220dc" } ], "siteRelateds": [ { "projectId": "7aa46a33-6b06-4d2b-add9-5f4c51fc18ce", "childDomains": "docs.blockfi.com \t13.35.90.114, 13.35.90.18, 13.35.90.27, 13.35.90.49\nproxy.blockfi.com \t10.0.1.220\nwww.blockfi.com \t104.18.8.105, 104.18.9.105\ntry.blockfi.com \t18.139.47.197, 3.0.207.158\nkingpin.blockfi.com \t54.160.29.104, 54.161.211.236, 54.173.240.22\n\n【不在范围内】dev.blockfi.com \t18.202.248.99\nstorm.blockfi.com \t52.1.185.229, 52.203.97.74\nclick.blockfi.com \t199.60.103.227, 199.60.103.29\nwebmail.blockfi.com \t216.58.200.51\n\ncks.blockfi.com \t104.18.8.105, 104.18.9.105\ncypher.blockfi.com \t10.108.10.12, 10.108.20.32\n\n\nvision.blockfi.com \t18.206.11.133, 3.95.127.36, 35.172.172.107\napp.blockfi.com \t104.18.8.105, 104.18.9.105\n\n\nnebula.blockfi.com \t54.173.23.33, 54.81.192.241\n\napi.blockfi.com \t104.18.8.105, 104.18.9.105\n\nffs.blockfi.com \t34.193.26.134, 35.175.36.207, 54.198.218.104\n\ngateway.blockfi.com \t52.203.224.154, 52.4.212.137, 52.6.127.12\n\nwp.blockfi.com \t3.210.122.156\nauth.blockfi.com \t104.18.8.105, 104.18.9.105\nh2.blockfi.com \t107.21.122.15, 35.153.125.90, 52.70.116.111\n\n\nprometheus.blockfi.com \t52.22.210.218, 52.71.221.19\nblog.blockfi.com \t151.101.130.132, 151.101.194.132, 151.101.2.132, 151.101.66.132\n\nhelp.blockfi.com \t104.16.51.111, 104.16.53.111\n\nsecure.blockfi.com \t104.18.8.105, 104.18.9.105", "createdAt": "2021-04-04 12:24:59", "updatedAt": "2021-04-08 09:15:31", "id": "0188ae36-6687-42f1-b2f7-0b180c33dbce" }, { "projectId": "fc433541-6eb0-4e12-9faa-8b362a48aa74", "childDomains": "[疑似子域名或旁站 ——臺東縣技藝教育中心 學校管理系統]\n(http://tte.boe.ttct.edu.tw/school/index.php?html=login)", "sameServerSites": "a.com\nbb.com\ncc.com", "cClassMachines": "121\n122\n123\n124\n125\n126\n127", "createdAt": "2021-01-05 23:38:34", "updatedAt": "2021-01-06 12:11:47", "id": "5b474db7-b4d2-47b7-8bd3-857db6e5bbc2" } ], "googles": [ { "projectId": "fc433541-6eb0-4e12-9faa-8b362a48aa74", "targetSearch": "针对化搜素", "pdfSearch": "pdf文件", "middlewareSearch": "一些带特征的中间件", "weakPasswordSearch": "很弱口令", "createdAt": "2021-01-05 23:59:39", "updatedAt": "2021-01-06 00:00:44", "id": "9cb3de67-b23e-4021-a923-79b0b06d54cf" } ], "dirFiles": [ { "projectId": "9f0764ba-ea91-4a30-91eb-dc8b66bf409c", "siteDirs": "/css/\n/fonts/\n/images/\n/index.php\n/js/\n/server-status\n/themes/\n/uploads/\n/uploads/1\n/uploads/2\n/uploads/3", "adminSitePage": "1", "bannerFiles": "1", "siteTestFiles": "1", "siteBakFiles": "1", "createdAt": "2021-02-20 10:44:43", "updatedAt": "2021-02-20 12:47:02", "id": "5d13a170-a197-4d7f-882a-fd3ccd2e088a" }, { "projectId": "fc433541-6eb0-4e12-9faa-8b362a48aa74", "siteDirs": "a/b/c", "adminSitePage": "【搜索】site:boe.ttct.edu.tw intitle:管理\n[學務管理系統 -- 首頁]\n(http://sfsmaster.boe.ttct.edu.tw/)\n[學生出入校園管理系統](http://ecard.boe.ttct.edu.tw/schooltaitung/login.php)\n[學務管理系統 -- 密碼檢查]\n(http://sfsmaster.boe.ttct.edu.tw/login.php)\n[臺東縣政府教育處 管理員登入]\n(http://stu-ecard.boe.ttct.edu.tw/std/admin.php)\n[详细配置表 —— 學務管理系統 -- 模組程式說明]\n(http://sfsmaster.boe.ttct.edu.tw/include/sfsinfo/program_info.php)\n[疑似子域名或旁站 ——臺東縣技藝教育中心 學校管理系統]\n(http://tte.boe.ttct.edu.tw/school/index.php?html=login)\n——————————\n\n【御剑搜索】\n台东县，所有学校教务系统，入门列表：\nhttp://sfs.boe.ttct.edu.tw/school_list/\n", "bannerFiles": "a/b/banner.jpg", "siteTestFiles": "test", "siteBakFiles": "test.bak", "createdAt": "2021-01-06 00:12:09", "updatedAt": "2021-02-04 11:49:46", "id": "01f31e6e-2ea1-4fd7-a05a-abc5867b6062" }, { "projectId": "1e97f681-36de-46a7-9ee6-8f0138babc06", "siteDirs": "【http-robots.txt / robots.txt】包含8个\n404：/、/backup、/admin、/r00t、/uploads \n有效：/admin_area、/uploaded_files、/flag\n\n【dirb】\njquery.filedrop.js——上传相关\nscript.js——上传相关\n", "createdAt": "2021-02-02 18:39:46", "updatedAt": "2021-02-02 21:59:09", "id": "a63a8d7d-2a48-492b-83c8-7ccc586f99e3" } ], "holeSources": [ { "projectId": "9f0764ba-ea91-4a30-91eb-dc8b66bf409c", "transferProtocolHole": "1", "commonHole": "1", "exploitDemo": "1", "githubSourceLeakage": "1", "createdAt": "2021-02-20 10:44:51", "updatedAt": "2021-02-20 10:44:51", "id": "7a010990-3359-4472-8cb2-f291912055ad" }, { "projectId": "fc433541-6eb0-4e12-9faa-8b362a48aa74", "transferProtocolHole": "常规漏洞", "commonHole": "[SFS学务管理系统存在Sql注射漏洞（臺灣地區）](https://www.onebug.org/wooyundata/67913.html)\n", "exploitDemo": "$phpinfo()", "githubSourceLeakage": "(http://sfsmaster.boe.ttct.edu.tw/include/sfsinfo/program_info.php)\n部署脚本，已经暴露", "createdAt": "2021-01-06 00:26:14", "updatedAt": "2021-01-06 11:36:35", "id": "021dcadc-dc40-44a7-bd28-6e0188799101" } ], "wakeupTasks": { "daily": [ { "timestamp": 1627901489737, "createdAt": "2021-08-02 18:51:29", "updatedAt": "2021-08-02 18:51:29", "id": "9bb501ae-a5c5-4cc4-a3c8-088b4320ae53" }, { "timestamp": 1617528235061, "createdAt": "2021-04-04 17:23:55", "updatedAt": "2021-04-04 17:23:55", "id": "094f42c6-c456-4039-9ce8-1a374ce07a86" }, { "timestamp": 1617110158994, "createdAt": "2021-03-30 21:15:59", "updatedAt": "2021-03-30 21:15:59", "id": "2da2feda-d279-499e-9d84-461970c0487a" }, { "timestamp": 1638360302053, "createdAt": "2021-12-01 20:05:02", "updatedAt": "2021-12-01 20:05:02", "id": "fc9201c7-6f81-4769-af14-d8013f3a7e94" } ] }, "progress": { "industryStandard": [ { "projectId": "7aa46a33-6b06-4d2b-add9-5f4c51fc18ce", "progress": { "【nmap】综合扫描": { "finished": 0 }, "【ping通】ping 和类ping工具": { "finished": 0 }, "【WAF防火墙/ IDS/ IPS】": { "finished": 0 }, "【扫描网站目录】，用常用文件名称，进行枚举": { "finished": 0 }, "【子域名、旁站、C段，综合查询】": { "finished": 0 }, "【Google高级搜索】": { "finished": 1 }, "【漏洞信息查询】": { "finished": 0 }, "【调用漏洞payload、exp】": { "finished": 0 } }, "createdAt": "2021-04-05 09:35:56", "updatedAt": "2021-08-26 15:54:16", "id": "47b8000d-8dc0-4805-83cc-b9b819bf2dab" }, { "projectId": "d1e36a8c-309c-41ac-9bed-08d9ee3911f0", "progress": { "【nmap】综合扫描": { "finished": 0 }, "【ping通】ping 和类ping工具": { "finished": 0 }, "【WAF防火墙/ IDS/ IPS】": { "finished": 0 }, "【扫描网站目录】，用常用文件名称，进行枚举": { "finished": 1 }, "【子域名、旁站、C段，综合查询】": { "finished": 0 }, "【Google高级搜索】": { "finished": 0 }, "【漏洞信息查询】": { "finished": 0 }, "【调用漏洞payload、exp】": { "finished": 0 } }, "createdAt": "2021-04-05 11:27:16", "updatedAt": "2021-08-26 15:53:47", "id": "c8cd5c3c-2cd1-4656-b264-7dd329e2a0b1" }, { "projectId": "fc433541-6eb0-4e12-9faa-8b362a48aa74", "progress": { "【nmap】综合扫描": { "finished": 1 }, "【ping通】ping 和类ping工具": { "finished": 0 }, "【WAF防火墙/ IDS/ IPS】": { "finished": 0 }, "【扫描网站目录】，用常用文件名称，进行枚举": { "finished": 1 }, "【子域名、旁站、C段，综合查询】": { "finished": 0 }, "【Google高级搜索】": { "finished": 1 }, "【漏洞信息查询】": { "finished": 0 }, "【调用漏洞payload、exp】": { "finished": 0 } }, "createdAt": "2021-04-05 15:49:33", "updatedAt": "2021-04-05 19:21:59", "id": "2577208e-dd11-404b-a51a-763b7648ef17" }, { "projectId": "683722ad-1278-4d0b-97cf-e9ae0d30f517", "progress": { "【扫描网站目录】，用常用文件名称，进行枚举": { "finished": 0 }, "【nmap】综合扫描": { "finished": 0 }, "【ping通】ping 和类ping工具": { "finished": 0 }, "【WAF防火墙/ IDS/ IPS】": { "finished": 0 }, "【子域名、旁站、C段，综合查询】": { "finished": 0 }, "【Google高级搜索】": { "finished": 0 }, "【漏洞信息查询】": { "finished": 0 }, "【调用漏洞payload、exp】": { "finished": 0 } }, "createdAt": "2021-04-05 18:41:23", "updatedAt": "2021-04-05 18:41:23", "id": "82f332b2-9d62-4297-8cb5-86e93227d21a" }, { "projectId": "789adc55-b611-41f3-befd-a4c55db2c564", "progress": { "【扫描网站目录】，用常用文件名称，进行枚举": { "finished": 0 }, "【nmap】综合扫描": { "finished": 0 }, "【ping通】ping 和类ping工具": { "finished": 0 }, "【WAF防火墙/ IDS/ IPS】": { "finished": 0 }, "【子域名、旁站、C段，综合查询】": { "finished": 0 }, "【Google高级搜索】": { "finished": 0 }, "【漏洞信息查询】": { "finished": 0 }, "【调用漏洞payload、exp】": { "finished": 0 } }, "createdAt": "2021-04-05 17:44:59", "updatedAt": "2021-04-05 17:44:59", "id": "68d94191-fd68-4ae8-9964-0e4958fdd0fa" }, { "projectId": "6099fa36-849e-4772-a88e-36f2755863d5", "progress": { "【扫描网站目录】，用常用文件名称，进行枚举": { "finished": 0 }, "【nmap】综合扫描": { "finished": 0 }, "【ping通】ping 和类ping工具": { "finished": 0 }, "【WAF防火墙/ IDS/ IPS】": { "finished": 0 }, "【子域名、旁站、C段，综合查询】": { "finished": 0 }, "【Google高级搜索】": { "finished": 0 }, "【漏洞信息查询】": { "finished": 0 }, "【调用漏洞payload、exp】": { "finished": 0 } }, "createdAt": "2021-04-05 17:44:05", "updatedAt": "2021-04-05 17:44:05", "id": "50e3b0c3-21ad-4ea0-b7ee-235179d9935e" }, { "projectId": "9f0764ba-ea91-4a30-91eb-dc8b66bf409c", "progress": { "【nmap】综合扫描": { "finished": 0 }, "【ping通】ping 和类ping工具": { "finished": 0 }, "【WAF防火墙/ IDS/ IPS】": { "finished": 0 }, "【扫描网站目录】，用常用文件名称，进行枚举": { "finished": 0 }, "【子域名、旁站、C段，综合查询】": { "finished": 0 }, "【Google高级搜索】": { "finished": 0 }, "【漏洞信息查询】": { "finished": 0 }, "【调用漏洞payload、exp】": { "finished": 0 } }, "createdAt": "2021-04-05 15:48:30", "updatedAt": "2021-04-05 15:48:30", "id": "748bd50c-ed85-4169-8ce4-8806dfb95c00" }, { "projectId": "613a838b-c314-4416-a437-9e9cdf02a7d6", "progress": { "【nmap】综合扫描": { "finished": 0 }, "【ping通】ping 和类ping工具": { "finished": 0 }, "【WAF防火墙/ IDS/ IPS】": { "finished": 0 }, "【扫描网站目录】，用常用文件名称，进行枚举": { "finished": 0 }, "【子域名、旁站、C段，综合查询】": { "finished": 0 }, "【Google高级搜索】": { "finished": 0 }, "【漏洞信息查询】": { "finished": 0 }, "【调用漏洞payload、exp】": { "finished": 0 } }, "createdAt": "2021-04-05 15:48:17", "updatedAt": "2021-04-05 15:48:17", "id": "42036d07-d6a2-4e11-af2e-3ebc0de51262" }, { "projectId": "1e97f681-36de-46a7-9ee6-8f0138babc06", "progress": { "【nmap】综合扫描": { "finished": 0 }, "【ping通】ping 和类ping工具": { "finished": 0 }, "【WAF防火墙/ IDS/ IPS】": { "finished": 0 }, "【扫描网站目录】，用常用文件名称，进行枚举": { "finished": 0 }, "【子域名、旁站、C段，综合查询】": { "finished": 0 }, "【Google高级搜索】": { "finished": 0 }, "【漏洞信息查询】": { "finished": 0 }, "【调用漏洞payload、exp】": { "finished": 0 } }, "createdAt": "2021-04-05 13:22:44", "updatedAt": "2021-04-05 13:22:44", "id": "b6f177c4-fa36-479d-8d66-80f80e790774" }, { "projectId": "63b4d248-8ecc-4771-9e17-cdf9228990cb", "progress": { "【nmap】综合扫描": { "finished": 0 }, "【ping通】ping 和类ping工具": { "finished": 0 }, "【WAF防火墙/ IDS/ IPS】": { "finished": 0 }, "【扫描网站目录】，用常用文件名称，进行枚举": { "finished": 0 }, "【子域名、旁站、C段，综合查询】": { "finished": 0 }, "【Google高级搜索】": { "finished": 0 }, "【漏洞信息查询】": { "finished": 0 }, "【调用漏洞payload、exp】": { "finished": 0 } }, "createdAt": "2021-04-05 11:41:14", "updatedAt": "2021-04-05 11:41:14", "id": "12abe481-ae4e-43ec-8a3f-3f2365e41c65" }, { "projectId": "e9bf74a4-83ff-48fc-aba3-18eb874cf30d", "progress": { "【nmap】综合扫描": { "finished": 0 }, "【ping通】ping 和类ping工具": { "finished": 0 }, "【WAF防火墙/ IDS/ IPS】": { "finished": 0 }, "【扫描网站目录】，用常用文件名称，进行枚举": { "finished": 0 }, "【子域名、旁站、C段，综合查询】": { "finished": 0 }, "【Google高级搜索】": { "finished": 0 }, "【漏洞信息查询】": { "finished": 0 }, "【调用漏洞payload、exp】": { "finished": 0 } }, "createdAt": "2021-04-05 11:27:12", "updatedAt": "2021-04-05 11:27:12", "id": "ce3de43a-41a7-46ae-b55a-84f9efbe6921" }, { "projectId": "d898b6de-1536-483d-a731-6791bce7f1f5", "progress": { "【nmap】综合扫描": { "finished": 0 }, "【ping通】ping 和类ping工具": { "finished": 0 }, "【WAF防火墙/ IDS/ IPS】": { "finished": 0 }, "【扫描网站目录】，用常用文件名称，进行枚举": { "finished": 0 }, "【子域名、旁站、C段，综合查询】": { "finished": 0 }, "【Google高级搜索】": { "finished": 0 }, "【漏洞信息查询】": { "finished": 0 }, "【调用漏洞payload、exp】": { "finished": 0 } }, "createdAt": "2021-04-05 11:26:43", "updatedAt": "2021-04-05 11:26:43", "id": "f6da927b-0510-4c8e-84d9-74849951bbc7" }, { "projectId": "c864e5fc-21e9-431a-aabd-60f1243c5038", "progress": { "【nmap】综合扫描": { "finished": 0 }, "【ping通】ping 和类ping工具": { "finished": 0 }, "【WAF防火墙/ IDS/ IPS】": { "finished": 0 }, "【扫描网站目录】，用常用文件名称，进行枚举": { "finished": 0 }, "【子域名、旁站、C段，综合查询】": { "finished": 0 }, "【Google高级搜索】": { "finished": 0 }, "【漏洞信息查询】": { "finished": 0 }, "【调用漏洞payload、exp】": { "finished": 0 } }, "createdAt": "2021-04-05 09:35:55", "updatedAt": "2021-04-05 09:35:55", "id": "33044398-21f5-4afc-aa0d-e6f97fd538c6" } ] }, "electrons": [ { "productName": "vmd", "hasGitHubSource": "√", "hasAsarFile": "√", "createdAt": "2021-05-21 16:31:47", "updatedAt": "2021-05-24 11:21:39", "id": "942acef6-c80b-4d18-a11e-d4dcb0f1dd03", "hasOthersFile": "见 asar 文件", "hasDevTools": "√", "code_danger_points": "【contextIsolation】未隔离\nprocess\n① process.env.xxx\n①① GITHUB_ACCESS_TOKEN，窃取token\n\n【全局vmd】\nvmd.openFile(\"c:/123.txt\")\n\n这一段，是从源码分析，逻辑链条，推断出来的。\n不过，如果通过【纯粹盲试】，应该能够 很快得出结果。\n另外，除此之外，通过【openFileInReader方法】的【sharedState.setFilePath】调用，也能很快明白这一点。\nvmd.setFocusedWindow()\n// vmd.setFilePath(\"1\",\"c:/123.txt\") // 字符串不行，必须是数字类型。 后来查看了一下，因为在【getWindowState】方法中，匹配的时候，是用【三等号】的。\nvmd.setFilePath(1,\"C:/Users/Administrator/Desktop/target.md\")\nvmd.setFilePath(1,\"C:/123.txt\")\n\nvmd.getWindowState(1)\n以上三步之后，可以看到，Redux状态机中的【filePath】已被改变；但界面没变化。\n可能还差一步，来触发变化。\n尝试：\n① 本打算用【ipcRenderer】的【'md'事件】；但后来发现，好像【ipcRenderer】没有暴露出来。\n①① 但是实际上，是被触发了的；因为【'md'事件】在【sendMarkdown】中；【sendMarkdown】在【changeFile】中。\n\n【new-window】\nwindow.open(\"c:/123.txt\")\n\n\n\ndocument.addEventListener，的【'drop'】事件。也涉及到了【打开文件】的功能。\n此处，可以篡改【drop监听】，达到类似的效果（？？？真的吗）\n① 第一种方式，新建 drop 监听，并且尝试渗透进【现有钩子】\n② 第二种方式，直接模拟【dispatchEvent】发送事件。\n\n\n【handleLink方法】，似乎有各种事件，的分发机制\nwindow.addEventListener，所有的【'click'】事件，都交由【handleLink方法】处理。\n① 这一步，可以模拟【点击事件】。\n② 但是，也可以构筑很多，【超链接标签】，然后手动点击。（或者，模拟 click 点击）。\n\n\nshell.openExternal\n① 右键，Open link ，按钮\n② handleLink方法\n初步结论：\n都可以常规调起。\n是否，有其它的【模拟右键菜单功能】呢？？？？？？？？？？？？？？？？？？？？？？？？？\n或者说，放一些链接，被动等待点击？？？\n直接模拟右键点击吧，虽然是间接方式，不过也能达到效果\n但是，仍有问题，通过【模拟右键事件】后，出现的【原生右键菜单】，无法进一步点击了………………………………………………\n\nshell.openItem\n① handleLink方法\n② 右键，Open folder，按钮\n③ 右键，Open file，按钮\n④ 右键，Open image，按钮\n初步结论：\n都可以常规调起。\n是否，有其它的【模拟右键菜单功能】呢？？？？？？？？？？？？？？？？？？？？？？？？？？？？\n或者说，放一些链接，被动等待点击？？？\n直接模拟右键点击吧，虽然是间接方式，不过也能达到效果\n但是，仍有问题，通过【模拟右键事件】后，出现的【原生右键菜单】，无法进一步点击了………………………………………………\n\n\nBrowserWindow\n\n① preload\n①① client-api.js\n①①① 全局对象【vmd】\n①①② sharedState，所有状态方法\n①①③ ipcRenderer。没有直接挂载上去，只在其它 暴露方法中 ，提供了固定调用。\n①①① 各种衍生的 on 方法\n\n② contextIsolation，默认值（老版本为开启）\n②① window.process\n\n③ 其它的，在别的片段中，已经分析的七七八八了\n\n\n【historyTool导航历史】，似乎与不少跳转，有关联\n① 手动前进\n② 手动后退\n③ 插入【手动模拟状态】，然后跳转至状态\n后来的结果发现：\n① 最开始，发现【全局变量】有history；但后来发现，是【chrome】原生的history。\n② 再后来，尝试用【require( './history' )】，来获取【history导航历史】的工具函数。 但是，后来发现，【main.js】的业务逻辑使用，是用的【闭包形式】————数据不互通。\n所以，失败了\n\n\n\n\n【new-window】无任何导航限制\n① 来去自由？？\n② 已分析。\n\n【will-navigate】无任何导航限制\n① 来去自由？\n② 已分析。\n\nlocation=\"c:/123.txt\"\n\n\n\n【enableRemoteModule】默认开启，可由【渲染进程】，调用【主进程】方法\n① window.remote\n①① window.remote.BrowserWindow ，直接打开新窗口。\n①② remote.shell.openExternal(\"c:/windows/system32/calc.exe\")，直接打开计算器。\n\n\n某些协议\n① 已知的，location = \"calculator://\" 。但这个是比较基本的。\n\n\n——以上，是已经确定的——\n——以上，是已经确定的——\n——以上，是已经确定的——\n——以上，是已经确定的——\n——以上，是已经确定的——\n——以上，是已经确定的——\n——以上，是已经确定的——\n——以上，是已经确定的——\n——以上，是已经确定的——\n——以上，是已经确定的——\n——以上，是已经确定的——\n——以上，是已经确定的——\n——以上，是已经确定的——\n——以上，是已经确定的——\n——以上，是已经确定的——\n——以上，是已经确定的——\n——以上，是已经确定的——\n——以上，是已经确定的——\n——以上，是已经确定的——\n——以上，是已经确定的——\n\n\n\n\n\n【handleLink方法】，似乎有各种事件，的分发机制\n'markdown-file'形式，采用了特殊的【打开方式】\n\n\n【navigateTo方法】，也与不少跳转，有关联\n\n\n\n\n\n\n\n\n\n\n③ sandbox，默认值（老版本为关闭）\n\n【getLinkType】方法，对于url的处理\n\nregisterEmojiProtocol方法\n① protocol.registerFileProtocol\n\nlocation = \"emoji:1234\"\n但是，需要突破到【本地文件】\n\n\ntemporarilyInterceptFileProtocol方法\n① protocol.interceptStringProtocol\n② protocol.uninterceptProtocol\n这个方法，执行第一次后，就会失效？？？？？？？？？\n\n\n【remark-emoji-to-gemoji】表情框架\n\n\n\n\n\n\n【sharedState.subscribe】中，的【changeFile】，可以改变文件名。\n① 将会在，任意Redux改变的时候，影响到【changeFile】方法；该方法，可以通过state来改变。\n\n这一步，试验已经成功！！！可作为，补充分析资料\n\n\n【vmd.onContent】，会被【win.webContents.send】的【'md'事件】触发。而参数中的【filePath】，会被【changeFile】方法触发。\n此处，又和【vmd.setFilePath】，联系了起来。\n\n这一步，试验已经成功！！！可作为，补充分析资料\n\n\n\nwatcher，这个也许可以知道【页面更新】的具体逻辑。\n① 最终，还是通过【sendMarkdown】，来实现更新的。\n\n\n\n【sendMarkdown方法】，存在于【changeFile】、【'did-finish-load'回调】、【watcher 的 'change' 回调】。\n\n这一步，试验已经成功！！！可作为，补充分析资料\n\n\n\n\npageContent.innerHTML，在【vmd.onContent】，从【win.webContents.send('md'】传参而来。\n\n\n\n【currentWindow】，这个全局变量，是哪里冒出来的？？？？？？？？？\n\n可以干，非常多的事情\n\n\n\n————————————————\n\n\n\n\n缺少【setPermissionRequestHandler】，来做域限制\n① 这个，暂时不知道怎样利用？？？？？？\n\n【鼠标中键点击】，可能会为【链接】，打开一个新窗口\n① 这个，暂时不知道怎样利用？？？？？？\n\n\n\n\n\nwindow.remote.shell，这个存在，我能够理解………………\n\n但是，window.shell，这个是怎么来的？？？？？？？？？？？？？？？？？？？？？？\n① 可能，需要用【fiddle】开发软件，进行一个小小的测试………………………………\n\n\n\n————————————————\n——————确认无害——————\n——————确认无害——————\n——————确认无害——————\n——————确认无害——————\n——————确认无害——————\n——————确认无害——————\n——————确认无害——————\n——————确认无害——————\n——————确认无害——————\n——————确认无害——————\n——————确认无害——————\n——————确认无害——————\n——————确认无害——————\n——————确认无害——————\n——————确认无害——————\n——————确认无害——————\n————————————————\n\nAbout vmd，打开一个新窗口\n① openAboutDialog\n\nvmd.openFileDialog，仅打开一个新窗口\n\n【getStylesheet】，存在【读取文件】的情况。\n初步结果：\n① 暂时没有发现，能够控制 路径 的地方。\n\n【onFindAction】的【openSearchWindow】\n初步结果：\n① 没有明显，可控输入。\n\n\n【shiftKey】键，改变了【打开文件】的方式。\n初步结果：\n① 对应的方法【vmd.openFile】，直接暴露在外部。\n② 而且，如果要模拟事件的话，直接采用的是外层的【handleLink】。\n②① 但是！！！，【document.addEventListener】的【'drop'事件】，是能够利用的。\n\n\n而且，【history变量】，竟然能够【全局访问到】？？？？？？？？？\n① 后来发现，是【chrome】原生的history\n", "input_textEditor": "大部分的XSS，都可以直接生效。", "remainingProblem_afterSuccess": "①\n【emoji协议】，这块我还没有完全，搞透。\n\n②\nhistory工具，似乎可能有攻击点，但我没有找到\n\n③\ndrop事件的模拟，攻击链，我感觉还需要优化一下\n\n④\n右键菜单，事件的模拟，我感觉还可以优化一下\n\n————分隔线————\n\n以及，【敏感点】那一块，还遗留的问题" }, { "productName": "Caret", "hasGitHubSource": "×", "hasAsarFile": "√", "hasOthersFile": "见 asar", "hasDevTools": "×", "input_textEditor": "①\n\n————\n\n①\n\n", "createdAt": "2021-05-20 18:21:52", "updatedAt": "2021-05-20 18:21:52", "id": "8e0b3ba3-9800-49b6-989c-0be7194991f7" }, { "productName": "Laverna", "hasGitHubSource": "√", "hasAsarFile": "√", "hasOthersFile": "见 asar", "hasDevTools": "×", "input_textEditor": "不完整标签，被过滤\n\n

标签支持，且被自动补全\n\n标签支持，且被自动补全\n\n的onload事件，被过滤\n\n的onerror，在【编辑状态】能触发；在【查看状态】被抹除\n\n