修改博文
This commit is contained in:
@@ -103,7 +103,10 @@ export default defineAppConfig({
|
||||
},
|
||||
codeIcon: {
|
||||
terminal: 'i-lucide-terminal',
|
||||
code: 'vscode-icons:file-type-codekit'
|
||||
code: 'vscode-icons:file-type-codekit',
|
||||
kali: 'i-devicon:kalilinux',
|
||||
bash: 'i-devicon:powershell',
|
||||
debian: 'i-devicon:debian'
|
||||
},
|
||||
codeCollapse: {
|
||||
slots: {
|
||||
|
||||
@@ -15,7 +15,7 @@ const props = withDefaults(defineProps<Props>(), {
|
||||
const currentPage = ref(1)
|
||||
|
||||
// 获取所有博客文章
|
||||
const { data: allArticles, pending } = await useAsyncData('blog-all-articles', () => {
|
||||
const { data: allArticles } = await useAsyncData('blog-all-articles', () => {
|
||||
return queryCollection('blog')
|
||||
.select('path', 'title', 'description', 'img', 'date')
|
||||
.where('path', 'NOT LIKE', '%navigation%')
|
||||
@@ -119,7 +119,10 @@ watch(sortedArticles, () => {
|
||||
<!-- 有文章时显示内容 -->
|
||||
<div v-if="sortedArticles && sortedArticles.length > 0">
|
||||
<div class="">
|
||||
<UBlogPosts orientation="vertical" :posts="blogPosts" />
|
||||
<UBlogPosts
|
||||
orientation="vertical"
|
||||
:posts="blogPosts"
|
||||
/>
|
||||
</div>
|
||||
|
||||
<!-- 分页控件 -->
|
||||
@@ -143,4 +146,3 @@ watch(sortedArticles, () => {
|
||||
</div>
|
||||
</div>
|
||||
</template>
|
||||
|
||||
|
||||
@@ -1,3 +1,3 @@
|
||||
title: 技术栈
|
||||
description: 记录日常开发中遇到的技术问题和解决方案
|
||||
icon: lucide-code
|
||||
icon: devicon:prolog
|
||||
|
||||
293
content/blog/1.技术栈/971.服务器加固实战.md
Normal file
293
content/blog/1.技术栈/971.服务器加固实战.md
Normal file
@@ -0,0 +1,293 @@
|
||||
---
|
||||
title: 防于未然，先固不破 — Debian 12 快速加固实战
|
||||
description: 在数字化浪潮席卷全球的今天，服务器已成为承载企业核心业务与数据的“心脏”。一旦这颗心脏被攻破，轻则业务中断，重则数据泄漏、引发监管问责、品牌声誉坍塌，甚至于法律诉讼。
|
||||
date: 2025-08-15
|
||||
img: https://lijue-me.oss-cn-chengdu.aliyuncs.com/20250815215319708.png
|
||||
navigation:
|
||||
icon: simple-icons:debian
|
||||
---
|
||||
|
||||
### 前言
|
||||
在数字化浪潮席卷全球的今天，服务器已成为承载企业核心业务与数据的“心脏”。一旦这颗心脏被攻破，轻则业务中断，重则数据泄漏、引发监管问责、品牌声誉坍塌，甚至于法律诉讼。也正因如此，“我不知道漏洞藏在那里”已经不是借口，而是失责；真正负责任的运维与安全团队，必须把“ **防于未然，先固不破** ”当作铁律。
|
||||
|
||||
然而，系统配置千头万绪——从 BIOS 到内核参数，从系统服务到用户策略，从网络栈到文件权限——**千里之堤，溃于蚁穴**,任何一个角落的配置失误，都可能成为攻击者趁虚而入的跳板。“人眼”已无法在短时间内遍历所有细节，唯有借助安全团队丰富的经验与标准化的自动安全审计工具，将复杂环境拆解成可度量的检查项，才能在海量主机、混部容器与虚拟化场景中抽丝剥茧，还原安全真相。
|
||||
|
||||
本文将以 **Lynis** 审计工具来还原一次服务器加固实战。
|
||||
|
||||
### 正文
|
||||
#### 什么是Lynis?
|
||||
Lynis 是一款开源、针对基于 UNIX 系统（如 Linux、macOS、BSD 等）的安全审计工具。它能检测系统配置、文件权限、日志、网络等多个方面，提供详细的安全建议，帮助系统管理员加强系统的安全性。Lynis 通常被系统管理员和网络安全工程师用来评估其系统的安全防御能力。
|
||||
- 除了“蓝队”之外，如今的渗透测试人员也将 Lynis 作为他们的工具之一。
|
||||
#### 环境
|
||||
- **OS**：Debian 12 (bookworm) 全新 Server 最小化安装
|
||||
- **内核**：6.1.0-12-amd64（Debian 12 官方 6.1 LTS 最新版）
|
||||
- **架构**：x86_64
|
||||
- **软件源** :启用 Debian Security 及官方主仓库
|
||||
- **用户**：root 初始登录，已创建 sudo 普通用户 `estel`，后续所有操作便于演示均以 su - 模式执行
|
||||
- **时间**：NTP 已启用，与 `pool.ntp.org` 同步，时区 UTC+8
|
||||
- **防火墙**：iptables 未配置（默认空规则）
|
||||
- **已更新**：`apt update && apt full-upgrade -y` 三天前更新
|
||||
- **已安装包**： Docker nfs-server openssh-server
|
||||
|
||||
#### 使用
|
||||
```bash[bash]
|
||||
# ssh 连接进服务器
|
||||
# 在合适的目录进行克隆 Lynis
|
||||
git clone https://github.com/CISOfy/lynis
|
||||
|
||||
#执行安全审查脚本
|
||||
cd lynis && sudo ./lynis audit system
|
||||
```
|
||||
|
||||
#### 扫描结果部分摘录
|
||||
```bash[bash]
|
||||
**[ Lynis 3.1.6 ]**
|
||||
**Lynis security scan details**:
|
||||
**Scan mode**:
|
||||
Normal [▆] Forensics [ ] Integration [ ] Pentest [ ]
|
||||
**Lynis modules**:
|
||||
- Compliance status [**?**]
|
||||
- Security audit [**V**]
|
||||
- Vulnerability scan [**V**]
|
||||
**Details**:
|
||||
Hardening index : **63** [**############** ]
|
||||
Tests performed : **280**
|
||||
Plugins enabled : **2**
|
||||
|
||||
**Software components**:
|
||||
- Firewall [**V**]
|
||||
- Intrusion software [**X**]
|
||||
- Malware scanner [**X**]
|
||||
|
||||
**Files**:
|
||||
- Test and debug information : **/var/log/lynis.log**
|
||||
- Report data : **/var/log/lynis-report.dat**
|
||||
==============================================================
|
||||
**Lynis** 3.1.6
|
||||
Auditing, system hardening, and compliance for UNIX-based systems
|
||||
(Linux, macOS, BSD, and others)
|
||||
2007-2025, CISOfy - https://cisofy.com/lynis/
|
||||
**Enterprise support available (compliance, plugins, interface and tools)**
|
||||
```
|
||||
|
||||
|
||||
#### 结果分析
|
||||
- 根据 Lynis 的体检单
|
||||
- Hardening Index 63/100
|
||||
1. 系统概况
|
||||
- Debian 12，无内核更新，无重启需求，存在 2 个高风险补丁（PKGS-7392）。
|
||||
2. 关键问题
|
||||
- GRUB 无密码 ,可单用户模式提权
|
||||
- SSH 端口为 22，允许 root 登录，多项参数过宽
|
||||
- 大量 systemd 服务暴露评分 9.x（atd、cron、docker、rsyslog 等）
|
||||
- 未挂载 /var /tmp /home 独立分区，可能导致 DoS
|
||||
- 缺乏防火墙规则审查、恶意软件扫描器、文件完整性监控、审计框架
|
||||
|
||||
3. 次要风险
|
||||
- 仅 1 个 DNS 服务器，NFS 空 exports 文件却运行守护进程
|
||||
- USB/火线驱动、编译器、核心参数未加固
|
||||
- 日志未远程归档、登录 banner 未配置
|
||||
|
||||
#### 进行服务器加固
|
||||
```bash[Debian]
|
||||
# 为便于演示默认以下所有操作均在 root 权限下
|
||||
su -
|
||||
```
|
||||
|
||||
```bash[Debian]
|
||||
# 更新系统补丁
|
||||
apt update && apt dist-upgrade -y
|
||||
```
|
||||
|
||||
1. 给 GRUB 加密码
|
||||
```bash[Debian]
|
||||
apt install -y grub2-common
|
||||
grub-mkpasswd-pbkdf2 # 生成 PBKDF2 哈希
|
||||
|
||||
nano /etc/grub.d/40_custom # 追加到配置中
|
||||
|
||||
cat <<EOF
|
||||
set superusers="grubadmin"
|
||||
password_pbkdf2 grubadmin grub.pbkdf2.sha512.10000.xxxxxxxx...
|
||||
EOF
|
||||
|
||||
# 更新
|
||||
update-grub
|
||||
|
||||
#如果更新报错,改为在 40_custom 中追加
|
||||
set superusers="root"
|
||||
password_pbkdf2 grubadmin grub.pbkdf2.sha512.10000.xxxxxxxx...
|
||||
```
|
||||
|
||||
2. SSH 强化
|
||||
```bash[Debian]
|
||||
# 修改 SSH 默认端口号 与登录配置
|
||||
|
||||
cp /etc/ssh/sshd_config{,.bak}
|
||||
cat >> /etc/ssh/sshd_config <<EOF
|
||||
Port 49222
|
||||
PermitRootLogin no
|
||||
MaxAuthTries 3
|
||||
MaxSessions 2
|
||||
ClientAliveInterval 300
|
||||
ClientAliveCountMax 2
|
||||
AllowTcpForwarding no
|
||||
TCPKeepAlive no
|
||||
X11Forwarding no
|
||||
AllowAgentForwarding no
|
||||
LogLevel VERBOSE
|
||||
EOF
|
||||
systemctl restart ssh
|
||||
|
||||
```
|
||||
|
||||
3.强化 sshd 安全
|
||||
```bash[Debian]
|
||||
cp /lib/systemd/system/ssh.service /etc/systemd/system/ssh.service
|
||||
|
||||
# 使用 systemd-analyze security 的建议调整
|
||||
systemctl edit --full ssh.service
|
||||
|
||||
systemctl restart ssh
|
||||
```
|
||||
4. 禁用不必要的 systemd 服务
|
||||
```bash[Debian]
|
||||
# atd 一次性计划任务守护进程，不需要调度就关掉；
|
||||
# exim4 Debian 系列默认的 MTA 邮件服务，不需要本地发件关掉；
|
||||
# containerd ‑ Docker/K8s 的运行时，此服务不用容器关掉。
|
||||
|
||||
systemctl disable --now atd exim4 containerd
|
||||
```
|
||||
|
||||
5. Kernel 级系统参数
|
||||
```bash[Debian]
|
||||
cat >/etc/sysctl.d/99-hardening.conf <<EOF
|
||||
dev.tty.ldisc_autoload=0
|
||||
fs.protected_fifos=2
|
||||
kernel.core_uses_pid=1
|
||||
kernel.kptr_restrict=2
|
||||
kernel.unprivileged_bpf_disabled=1
|
||||
kernel.sysrq=0
|
||||
net.core.bpf_jit_harden=2
|
||||
net.ipv4.conf.all.log_martians=1
|
||||
net.ipv4.conf.all.rp_filter=1
|
||||
net.ipv4.conf.all.send_redirects=0
|
||||
net.ipv4.conf.all.accept_redirects=0
|
||||
net.ipv6.conf.all.accept_redirects=0
|
||||
net.ipv6.conf.default.accept_redirects=0
|
||||
kernel.dmesg_restrict = 1
|
||||
EOF
|
||||
sysctl -p /etc/sysctl.d/99-hardening.conf
|
||||
```
|
||||
|
||||
内核部分参数解释
|
||||
|
||||
| 参数 | 作用 | 备注 |
|
||||
| ------------------------------------ | ---------------------------- | ----------------------- |
|
||||
| `dev.tty.ldisc_autoload=0` | 禁止非特权用户加载终端的 line discipline | 防御终端驱动注入攻击 |
|
||||
| `fs.protected_fifos=2` | 严格保护 FIFO/管道文件权限 | 防止竞态条件漏洞 |
|
||||
| `kernel.core_uses_pid=1` | Core 转储文件名包含 PID | 方便调试但需配合 `ulimit -c` 限制 |
|
||||
| `kernel.kptr_restrict=2` | 完全隐藏内核符号地址 | 防内核信息泄漏 |
|
||||
| `kernel.unprivileged_bpf_disabled=1` | 禁止非特权用户使用 BPF | 防御容器逃逸 |
|
||||
| `kernel.sysrq=0` | 禁用 SysRq 组合键 | 防止物理接触攻击 |
|
||||
| `net.core.bpf_jit_harden=2` | BPF JIT 编译器加固 | 缓解 Spectre 漏洞 |
|
||||
| `net.ipv4.conf.all.log_martians=1` | 记录异常 IP 包 | 需配合日志监控 |
|
||||
| `net.ipv4.conf.all.rp_filter=1` | 启用反向路径过滤 | 防 IP 欺骗 |
|
||||
| `net.ipv4/6.*.accept_redirects=0` | 禁止 ICMP 重定向 | 防网络拓扑劫持 |
|
||||
| `net.ipv4.conf.all.send_redirects=0` | 禁止发送 ICMP 重定向 | 仅路由器需要 |
|
||||
| `kernel.dmesg_restrict = 1` | 防止非特权用户访问内核日志 | |
|
||||
6. 关闭 USB / 火线存储
|
||||
```bash[Debian]
|
||||
cat >/etc/modprobe.d/blacklist-usb-storage.conf <<EOF
|
||||
install usb-storage /bin/false
|
||||
install firewire-ohci /bin/false
|
||||
EOF
|
||||
rmmod usb-storage firewire-ohci || true
|
||||
```
|
||||
|
||||
7. 安装防护软件
|
||||
```bash[Debian]
|
||||
# auditd（系统审计日志）、rkhunter（Rootkit 检测）
|
||||
# chkrootkit（基础 Rootkit 扫描）debsums（校验官方软件包完整性）
|
||||
# apparmor-profiles（强制访问控制策略）aide（文件完整性监控）
|
||||
|
||||
apt install -y auditd rkhunter chkrootkit debsums apparmor-profiles apparmor-profiles-extra aide
|
||||
|
||||
# 初始化文件完整性（AIDE）需要较长时间,占用IO
|
||||
aideinit
|
||||
|
||||
systemctl enable --now auditd
|
||||
|
||||
```
|
||||
|
||||
8. 配置安全自动更新
|
||||
```bash[Debian]
|
||||
apt install -y unattended-upgrades
|
||||
dpkg-reconfigure -plow unattended-upgrades
|
||||
```
|
||||
|
||||
#### 复查扫描
|
||||
```
|
||||
lynis audit system
|
||||
|
||||
# 扫描结果部分摘录
|
||||
|
||||
**Lynis security scan details**:
|
||||
**Scan mode**:
|
||||
Normal [▆] Forensics [ ] Integration [ ] Pentest [ ]
|
||||
**Lynis modules**:
|
||||
- Compliance status [**?**]
|
||||
- Security audit [**V**]
|
||||
- Vulnerability scan [**V**]
|
||||
|
||||
**Details**:
|
||||
Hardening index : **78** [**###############** ]
|
||||
Tests performed : **283**
|
||||
Plugins enabled : **2**
|
||||
|
||||
**Software components**:
|
||||
- Firewall [**V**]
|
||||
- Intrusion software [**X**]
|
||||
- Malware scanner [**V**]
|
||||
|
||||
|
||||
**Files**:
|
||||
- Test and debug information : **/var/log/lynis.log**
|
||||
- Report data : **/var/log/lynis-report.dat**
|
||||
|
||||
==============================================================
|
||||
**Lynis** 3.1.6
|
||||
|
||||
Auditing, system hardening, and compliance for UNIX-based systems
|
||||
(Linux, macOS, BSD, and others)
|
||||
|
||||
2007-2025, CISOfy - https://cisofy.com/lynis/
|
||||
**Enterprise support available (compliance, plugins, interface and tools)**
|
||||
|
||||
|
||||
|
||||
================================================================================
|
||||
```
|
||||
|
||||
#### 加固完成
|
||||
- **加固指数：78（63↓ ➜ ↑78）**
|
||||
- **告警数量：0（Great, no warnings）**
|
||||
- 剩余建议：33 条，以“系统性、纵深优化”为主，无紧急风险**
|
||||
经过第一轮快速修补，本机已从 **63 分 危险边缘** 回到“**可交付**”水平：漏洞包归零。后续把“服务安全上下文 + 纵深防御”作为重点，逐步细化为**零告警、高可信的 Debian 12 基线环境**。目标在下一轮扫描中 **≥85 分，Warnings=0**。遵循“未漏先防、未破先固”原则，持续加固即可。
|
||||
|
||||
| 类别 | 关键动作 | 预估加分 |
|
||||
| -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
|
||||
| **系统服务** | 对 `docker.service`、`containerd.service`、`ssh.service` 等仍处 UNSAFE/EXPOSED 状态的单位，逐条应用 `systemd-analyze security` 推荐的安全参数（NoNewPrivileges、ProtectSystem 等） | ≈ +3–4 分 |
|
||||
| **审计规则** | 为 auditd 导入 CIS 审计规则 → ACCT-9628 | ≈ +2 分 |
|
||||
| **密码策略** | 设定最小/最大口令寿命、启用 pam_cracklib，统一 umask 027 → AUTH-9262/9328 | ≈ +2 分 |
|
||||
| **内核参数** | 修正 fs.protected_fifos、kernel.yama.ptrace_scope 等 4 项 sysctl 差异 → KRNL-6000 | ≈ +1 分 |
|
||||
| **纵深防御** | 禁止 USB-Storage/FireWire、配置远程日志、加固编译器 & cron 权限 | ≈ +1 分 |
|
||||
|
||||
## 总结
|
||||
通过本次基于 Lynis 的服务器安全加固实战，我们成功将一台"裸奔"的 Debian 12 服务器从 63 分的**危险边缘状态**提升至 78 分的**可交付水平**——这不仅是数字上的跃升，更是从"千疮百孔"逐步到"基线合规"的质变。从 GRUB 无密码、SSH 配置过宽，到内核参数缺失、关键服务暴露——每一项都是潜在的攻击入口，而工具化的检测让我们得以"**抽丝剥茧，还原安全真相**"。
|
||||
|
||||
更重要的是，78 分绝非终点。正如**防于未然，先固不破**的铁律所示，安全加固是一个持续迭代的过程：systemd 服务的深度加固、审计规则的精细配置、密码策略的严格管控——每一步都在为企业的数字资产构筑更坚固的防线。
|
||||
|
||||
在数字化浪潮愈发汹涌的今天，服务器安全已不容半点侥幸。那些仍抱着"我不知道漏洞藏在哪里"的心态，直到漏洞爆发才仓促补救的团队，终将在下一次攻击中付出惨重代价。真正负责任的做法，是把安全加固的重心从 **"事后补救"** 前移到 **"事前预防"**，让每一台服务器都成为攻击者难以逾越的堡垒。
|
||||
|
||||
**千里之堤，毁于蚁穴；百密一疏，功亏一篑。唯有持之以恒的安全意识与标准化的加固流程，才能在这场没有硝烟的网络战争中立于不败之地。**
|
||||
@@ -7,97 +7,8 @@ navigation:
|
||||
icon: simple-icons:openstreetmap
|
||||
---
|
||||
|
||||
```bash[test.shell]
|
||||
```bash[Kali]
|
||||
nmap -p- --min-rate=1000 -T4 -v -n -Pn 192.168.1.1
|
||||
```
|
||||
|
||||
|
||||
### NSE
|
||||
Nmap Scripting Engine（NSE）是Nmap的核心扩展功能，通过Lua脚本实现自动化扫描、漏洞检测、信息收集等高级操作。
|
||||
|
||||
#### NSE脚本按功能分为12大类，每类对应不同扫描需求
|
||||
|
||||
| 类别 | 核心目的 | 样例脚本 | 典型使用场合 |
|
||||
|------------|---------------------------------------|-------------------------------|----------------------------------------------------------|
|
||||
| vuln | CVE/漏洞快速验证 | http-vuln-cve2017-5638 | 目标服务版本与已知漏洞匹配 |
|
||||
| safe | 只读式安全审计（无破坏性） | ssh2-enum-algos | 建立会话后立即枚举支持的算法 |
|
||||
| default | 默认已开启的基础信息采集 | http-title | 首次扫描时的“看一眼” |
|
||||
| discovery | 发现服务/子网/资产信息 | smb-os-discovery | 内网资产清点、OS 指纹识别 |
|
||||
| auth | 认证、密钥与票据处理 | ssh-hostkey | 密钥指纹比对、横向渗透准备 |
|
||||
| brute | 弱口令爆破 | http-form-brute | 对表单类登录口的暴力尝试 |
|
||||
| exploit | 利用已确认漏洞取得立足点（需授权） | http-vuln-cve2021-41773 | 实战攻击复现、漏洞验证 |
|
||||
| intrusive | 高交互操作（易被 IDS 告警） | http-slowloris | 拒绝服务场景模拟/压力测试（慎用！） |
|
||||
| malware | 嗅探后门或恶意软件痕迹 | http-malware-host | 威胁狩猎与入侵后取证 |
|
||||
| version | 精细化版本指纹 | http-apache-negotiation | 为后续补丁或 PoC 匹配做准备 |
|
||||
| broadcast | 广播域/多播发现 | nbstat | 内网渗透早期：快速识别 NetBIOS 设备 |
|
||||
| external | 外链第三方数据源（DNSBL 等） | dns-blacklist | 资产信誉检查、垃圾邮件源或钓鱼域名扫描 |
|
||||
|
||||
### 常用 NSE 脚本一览
|
||||
|
||||
| 脚本名称 | 主要用途 | Nmap 一键示例 |
|
||||
|---|---|---|
|
||||
| **http-title** | 抓取 HTTP 网站标题 | `nmap --script http-title <target>` |
|
||||
| **https-redirect** | 识别 HTTP→HTTPS 跳转链 | `nmap --script https-redirect -p 80 <target>` |
|
||||
| **http-robtots** | 收集目标 robots/disallow 条目 | `nmap --script http-robots.txt -p 80 <target>` |
|
||||
| **http-headers** | 枚举响应标头与安全策略 | `nmap --script http-headers -p 80 <target>` |
|
||||
| **http-methods** | 检测允许/禁止的 HTTP 方法 | `nmap --script http-methods -p 80 <target>` |
|
||||
| **http-cors** | 测试 CORS、CSRF 漏洞 | `nmap --script http-cors <target>` |
|
||||
| **http-sql-injection** | 基本 SQL 注入探针 | `nmap --script http-sql-injection -p 80 <target>` |
|
||||
| **http-xssed** | 与 xssed.com 集成交叉检测 | `nmap --script http-xssed <target>` |
|
||||
| **smb-os-discovery** | 枚举 SMB 服务器操作系统/域信息 | `nmap --script smb-os-discovery -p 445 <target>` |
|
||||
| **smb-enum-shares** | 列出共享目录（需 guest） | `nmap --script smb-enum-shares -p 445 <target>` |
|
||||
| **smb-enum-users** | 提取本地/域用户列表 | `nmap --script smb-enum-users -p 445 <target>` |
|
||||
| **smb-vuln-ms17-010** | 探测 EternalBlue（MS17-010） | `nmap --script smb-vuln-ms17-010 -p 445 <target>` |
|
||||
| **ssh-hostkey** | 抓取并对比公钥指纹 | `nmap --script ssh-hostkey -p 22 <target>` |
|
||||
| **ssh-brute** | SSH 账号密码暴力破解（需授权） | `nmap --script ssh-brute --script-args userdb=users.txt,passdb=pass.txt -p 22 <target>` |
|
||||
| **ssh2-enum-algos** | 列出支持的算法与 KEX | `nmap --script ssh2-enum-algos -p 22 <target>` |
|
||||
| **http-vuln-cve2023-XXXX** | 按指定 CVE 编号进行漏洞检查（替换 XXXX） | `nmap --script http-vuln-cve2023-XXXX <target>` |
|
||||
| **ftp-anon** | 检测是否允许匿名登录 | `nmap --script ftp-anon -p 21 <target>` |
|
||||
| **ftp-bounce** | 检查是否允许 FTP Bounce 扫描 | `nmap --script ftp-bounce -p 21 <target>` |
|
||||
| **dns-zone-transfer** | 测试 AXFR（区域传输）泄露 | `nmap --script dns-zone-transfer -p 53 <target>` |
|
||||
| **dns-brute** | 字典爆破子域名 | `nmap --script dns-brute --script-args dns-brute.domain=<domain>` |
|
||||
| **mysql-brute** | 暴力破解 MySQL 实例 | `nmap --script mysql-brute -p 3306 <target>` |
|
||||
| **mysql-audit** | 核对 MySQL CIS/基线配置 | `nmap --script mysql-audit --script-args mysql-audit.username='root',mysql-audit.password='pass123' -p 3306 <target>` |
|
||||
| **ssl-cert** | 解析 TLS 证书详情 | `nmap --script ssl-cert -p 443 <target>` |
|
||||
| **ssl-poodle** | 探测 SSLv3 & POODLE 漏洞 | `nmap --script ssl-poodle -p 443 <target>` |
|
||||
| **vulners** | 基于 Vulners DB 的版本漏洞关联 | `nmap --script vulners -sV <target>` |
|
||||
| **whois-ip** | 查询归属 IP 段的 Whois 信息 | `nmap --script whois-ip <target>` |
|
||||
| **smtp-enum-users** | VRFY/EXPN 暴力枚举邮箱账户 | `nmap --script smtp-enum-users -p 25 <target>` |
|
||||
|
||||
### 自定义脚本
|
||||
|
||||
```lua[演示.lua]
|
||||
-- myecho.nse
|
||||
local stdnse = require "stdnse"
|
||||
|
||||
description = [[极简回显脚本：打印自定义消息]]
|
||||
author = "YourName"
|
||||
license = "GPLv2"
|
||||
categories = {"safe"}
|
||||
|
||||
-- 任何 TCP 端口都触发
|
||||
portrule = function(host,port) return port.protocol == "tcp" end
|
||||
|
||||
action = function(host,port)
|
||||
local msg = stdnse.get_script_args("myecho.msg") or "Hi from custom-NSE!"
|
||||
return ("%s -> %s:%d (%s)"):format(msg, host.ip, port.number, port.service or "unknown")
|
||||
end
|
||||
```
|
||||
|
||||
```bash
|
||||
# 复制.nse到脚本文件夹
|
||||
sudo cp myecho.nse /usr/share/nmap/scripts/
|
||||
nmap --script-updatedb # 更新索引
|
||||
```
|
||||
|
||||
```bash
|
||||
# 执行脚本
|
||||
nmap --script myecho -p22 127.0.0.1
|
||||
nmap --script myecho --script-args 'myecho.msg=HelloNSE' -p80 scanme.nmap.org
|
||||
nmap --script '(safe or discovery) and myecho' -p80,443 10.0.2.0/24
|
||||
```
|
||||
|
||||
### 总结
|
||||
NSE 脚本可大幅提升 Nmap 在渗透测试和信息收集中的效率。建议定期关注 Nmap 官方脚本库更新（[NSE Docs](https://nmap.org/nsedoc/ "NSE Docs"))以覆盖最新漏洞。
|
||||
|
||||
|
||||
#### 未完成
|
||||
@@ -9,7 +9,7 @@ navigation:
|
||||
|
||||
|
||||
### 需求
|
||||
##### 写了一个文档插件. 缘由呢是之前在 WordPress 上用过一个插件.对接微信的JS SDK,可以实现将连接带标题,图,简介封装成一个 卡片形式.分享给朋友或者朋友圈.比如:
|
||||
##### 写了一个文档插件. 缘由呢是之前在 WordPress 上用过一个插件.对接微信的JS SDK,可以实现将链接带标题,图,简介封装成一个 卡片形式.分享给朋友或者朋友圈.比如:
|
||||
|
||||
|
||||
##### 如果没有对接微信的SDK,分享链接是这样的:
|
||||
|
||||
@@ -31,43 +31,43 @@ sudo gvm-check-setup
|
||||
└─**$** sudo gvm-check-setup
|
||||
[sudo] estel 的密码：
|
||||
gvm-check-setup 25.04.0
|
||||
This script is provided and maintained by Debian and Kali.
|
||||
Test completeness and readiness of GVM-25.04.0
|
||||
Step 1: Checking OpenVAS (Scanner)...
|
||||
OK: OpenVAS Scanner is present in version 23.20.1.
|
||||
OK: Notus Scanner is present in version 22.6.5.
|
||||
OK: Server CA Certificate is present as /var/lib/gvm/CA/servercert.pem.
|
||||
This script is provided and maintained by Debian and Kali.
|
||||
Test completeness and readiness of GVM-25.04.0
|
||||
Step 1: Checking OpenVAS (Scanner)...
|
||||
OK: OpenVAS Scanner is present in version 23.20.1.
|
||||
OK: Notus Scanner is present in version 22.6.5.
|
||||
OK: Server CA Certificate is present as /var/lib/gvm/CA/servercert.pem.
|
||||
Checking permissions of /var/lib/openvas/gnupg/*
|
||||
OK: _gvm owns all files in /var/lib/openvas/gnupg
|
||||
OK: _gvm owns all files in /var/lib/openvas/gnupg
|
||||
|
||||
OK: redis-server is present.
|
||||
OK: scanner (db_address setting) is configured properly using the redis-server socket: /var/run/redis-openvas/redis-server.sock
|
||||
OK: the mqtt_server_uri is defined in /etc/openvas/openvas.conf
|
||||
OK: _gvm owns all files in /var/lib/openvas/plugins
|
||||
OK: NVT collection in /var/lib/openvas/plugins contains 94316 NVTs.
|
||||
OK: The notus directory /var/lib/notus/products contains 502 NVTs.
|
||||
OK: redis-server is present.
|
||||
OK: scanner (db_address setting) is configured properly using the redis-server socket: /var/run/redis-openvas/redis-server.sock
|
||||
OK: the mqtt_server_uri is defined in /etc/openvas/openvas.conf
|
||||
OK: _gvm owns all files in /var/lib/openvas/plugins
|
||||
OK: NVT collection in /var/lib/openvas/plugins contains 94316 NVTs.
|
||||
OK: The notus directory /var/lib/notus/products contains 502 NVTs.
|
||||
Checking that the obsolete redis database has been removed
|
||||
Could not connect to Redis at /var/run/redis-openvas/redis-server.sock: No such file or directory
|
||||
OK: No old Redis DB
|
||||
Starting ospd-openvas service
|
||||
Waiting for ospd-openvas service
|
||||
OK: ospd-openvas service is active.
|
||||
OK: ospd-OpenVAS is present in version 22.9.0.
|
||||
Step 2: Checking GVMD Manager ...
|
||||
OK: GVM Manager (gvmd) is present in version 26.0.0.
|
||||
Step 3: Checking Certificates ...
|
||||
OK: GVM client certificate is valid and present as /var/lib/gvm/CA/clientcert.pem.
|
||||
OK: Your GVM certificate infrastructure passed validation.
|
||||
Step 4: Checking data ...
|
||||
ERROR: SCAP DATA are missing.
|
||||
FIX: Run the SCAP synchronization script greenbone-feed-sync.
|
||||
sudo greenbone-feed-sync --type scap.
|
||||
ERROR: Your GVM-25.04.0 installation is not yet complete!
|
||||
OK: No old Redis DB
|
||||
Starting ospd-openvas service
|
||||
Waiting for ospd-openvas service
|
||||
OK: ospd-openvas service is active.
|
||||
OK: ospd-OpenVAS is present in version 22.9.0.
|
||||
Step 2: Checking GVMD Manager ...
|
||||
OK: GVM Manager (gvmd) is present in version 26.0.0.
|
||||
Step 3: Checking Certificates ...
|
||||
OK: GVM client certificate is valid and present as /var/lib/gvm/CA/clientcert.pem.
|
||||
OK: Your GVM certificate infrastructure passed validation.
|
||||
Step 4: Checking data ...
|
||||
ERROR: SCAP DATA are missing.
|
||||
FIX: Run the SCAP synchronization script greenbone-feed-sync.
|
||||
sudo greenbone-feed-sync --type scap.
|
||||
ERROR: Your GVM-25.04.0 installation is not yet complete!
|
||||
Please follow the instructions marked with FIX above and run this
|
||||
script again.
|
||||
|
||||
IMPORTANT NOTE: this script is provided and maintained by Debian and Kali.
|
||||
If you find any issue in this script, please report it directly to Debian or Kali
|
||||
IMPORTANT NOTE: this script is provided and maintained by Debian and Kali.
|
||||
If you find any issue in this script, please report it directly to Debian or Kali
|
||||
```
|
||||
|
||||
标准漏洞/数据库这些数据在国外
|
||||
|
||||
@@ -1,3 +1,3 @@
|
||||
title: AI
|
||||
description: AI 改变世界
|
||||
icon: lucide-brain
|
||||
icon: devicon:streamlit
|
||||
|
||||
@@ -1,3 +1,3 @@
|
||||
title: 生活
|
||||
description: 生活中一些有趣的事情
|
||||
icon: lucide-heart
|
||||
icon: devicon:love2d
|
||||
|
||||
@@ -50,6 +50,7 @@
|
||||
"remark-rehype": "^11.1.2"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@iconify-json/devicon": "^1.2.41",
|
||||
"@iconify-json/lucide": "^1.2.57",
|
||||
"@iconify-json/simple-icons": "^1.2.43",
|
||||
"@nuxt/eslint": "^1.5.2",
|
||||
|
||||
10
pnpm-lock.yaml
generated
10
pnpm-lock.yaml
generated
@@ -60,6 +60,9 @@ importers:
|
||||
specifier: ^11.1.2
|
||||
version: 11.1.2
|
||||
devDependencies:
|
||||
'@iconify-json/devicon':
|
||||
specifier: ^1.2.41
|
||||
version: 1.2.41
|
||||
'@iconify-json/lucide':
|
||||
specifier: ^1.2.57
|
||||
version: 1.2.57
|
||||
@@ -889,6 +892,9 @@ packages:
|
||||
resolution: {integrity: sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==}
|
||||
engines: {node: '>=18.18'}
|
||||
|
||||
'@iconify-json/devicon@1.2.41':
|
||||
resolution: {integrity: sha512-4hCbtXRkdwbzemxVc7+6LQT0cOQaD1SHZpElhuV0YC5JfUqBu7T5ejRcjgim1lJO888Mj0WSp4th1eUhDEChUg==}
|
||||
|
||||
'@iconify-json/lucide@1.2.57':
|
||||
resolution: {integrity: sha512-I1CIObdPBIL/9v75KKoyHWNhq+qqN6ef8+iJY4AVpHLtnRu0Vbp6K0TKcoYZ70U+EgiL6krEbFdcjK3+fwpfHQ==}
|
||||
|
||||
@@ -7673,6 +7679,10 @@ snapshots:
|
||||
|
||||
'@humanwhocodes/retry@0.4.3': {}
|
||||
|
||||
'@iconify-json/devicon@1.2.41':
|
||||
dependencies:
|
||||
'@iconify/types': 2.0.0
|
||||
|
||||
'@iconify-json/lucide@1.2.57':
|
||||
dependencies:
|
||||
'@iconify/types': 2.0.0
|
||||
|
||||
Reference in New Issue
Block a user