Back to Details

pentest-expert

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Pentest Expert

渗透测试专家

Methodology

方法论

1. Reconnaissance

1. 信息收集

bash
undefined
bash
undefined

Passive

被动信息收集

whois target.com dig target.com ANY +noall +answer host -t mx target.com theHarvester -d target.com -b google,bing,linkedin
whois target.com dig target.com ANY +noall +answer host -t mx target.com theHarvester -d target.com -b google,bing,linkedin

Active

主动信息收集

nmap -sn 192.168.1.0/24 # Host discovery nmap -sC -sV -oA scan target # Service scan nmap -p- --min-rate=1000 target # All ports fast
undefined
nmap -sn 192.168.1.0/24 # 主机发现 nmap -sC -sV -oA scan target # 服务扫描 nmap -p- --min-rate=1000 target # 快速全端口扫描
undefined

2. Web Enumeration

2. Web枚举

bash
undefined
bash
undefined

Directory brute

目录爆破

gobuster dir -u http://target -w /usr/share/wordlists/dirb/common.txt feroxbuster -u http://target -w wordlist.txt
gobuster dir -u http://target -w /usr/share/wordlists/dirb/common.txt feroxbuster -u http://target -w wordlist.txt

Subdomain enum

子域名枚举

subfinder -d target.com amass enum -d target.com
subfinder -d target.com amass enum -d target.com

Tech detection

技术栈探测

whatweb http://target wappalyzer http://target
undefined
whatweb http://target wappalyzer http://target
undefined

3. Vulnerability Scanning

3. 漏洞扫描

bash
nikto -h http://target
nuclei -u http://target -t cves/
sqlmap -u "http://target/page?id=1" --batch
bash
nikto -h http://target
nuclei -u http://target -t cves/
sqlmap -u "http://target/page?id=1" --batch

Severity Rating

严重程度评级

LevelCVSSExamples
Critical9.0-10.0RCE, Auth bypass, SQLi with data
High7.0-8.9Stored XSS, IDOR with sensitive data
Medium4.0-6.9Reflected XSS, Info disclosure
Low0.1-3.9Missing headers, version disclosure
级别CVSS示例
严重9.0-10.0RCE、身份验证绕过、可获取数据的SQL注入
高7.0-8.9存储型XSS、可获取敏感数据的IDOR
中4.0-6.9反射型XSS、信息泄露
低0.1-3.9缺失安全头、版本信息泄露

Report Structure

报告结构

  1. Executive Summary
  2. Scope & Methodology
  3. Findings (sorted by severity)
  4. Remediation Recommendations
  5. Appendix (raw data, screenshots)
  1. 执行摘要
  2. 范围与方法论
  3. 漏洞发现（按严重程度排序）
  4. 修复建议
  5. 附录（原始数据、截图）