# 🛡️ 终极安全分析模板
一个全面且达到生产级标准的模板库，用于**静态分析 (SAST)** 和**动态分析 (DAST)** 安全测试。旨在覆盖完整的漏洞谱系——从源代码缺陷到实时目标利用。
## 📂 仓库布局
```
security-templates/
├── README.md ← you are here
├── BUG-BOUNTY-PLAYBOOK.md ← end-to-end methodology + full coverage checklist
├── nuclei/ ← DYNAMIC analysis (DAST) — live target scanning
│ ├── README.md
│ ├── _skeletons/ ← copy-paste starting points for every protocol
│ ├── cves/ ← curated high-impact CVEs (2017→2024, KEV/EPSS)
│ ├── exposures/ ← leaked files, secrets, config disclosure
│ ├── vulnerabilities/ ← SQLi, XSS, SSRF, SSTI, LFI, RCE, XXE …
│ ├── modern/ ← smuggling, cache poisoning, GraphQL, JWT, SSRF→cloud, proto-pollution
│ ├── access-control/ ← IDOR/BOLA, mass assignment, forced-browse, CORS, session, data exposure
│ ├── headers/ ← header manipulation: IP/host auth-bypass, X-Forwarded-*, verb tampering, reset poisoning
│ ├── api/ ← API sec: Swagger/OpenAPI, GraphQL, BOLA, JWT alg-confusion, rate-limit, data exposure
│ ├── cloud/ ← cloud metadata SSRF, bucket takeover, cred exposure, k8s/docker API
│ ├── auth/ ← OAuth/OIDC/SAML, 2FA bypass, JWT kid injection, registration flaws
│ ├── ai/ ← AI/LLM: prompt injection, exposed AI keys/endpoints, framework debug, AI-SSRF
│ ├── fuzzing/ ← ⚡ ADAPTIVE behavioral fuzzers (runtime payloads, DAST mode)
│ ├── payloads/ ← runtime payload wordlists (xss/sqli/lfi/ssti/cmdi/ssrf)
│ ├── misconfiguration/ ← CORS, headers, dir-listing, TLS
│ ├── default-logins/ ← weak / default credentials
│ ├── takeovers/ ← subdomain takeover fingerprints
│ ├── technologies/ ← tech/version detection
│ └── workflows/ ← chained multi-template logic
├── semgrep/ ← STATIC analysis (SAST) — source code scanning
│ ├── README.md
│ ├── _skeleton.yaml
│ ├── python/ javascript/ java/ go/ php/ ruby/ csharp/ cpp/ multi/ ← per-language rules
│ ├── cicd/ ← GitHub Actions script-injection / pwn-request / supply-chain
│ ├── iac/ ← Dockerfile / compose / Terraform / k8s misconfig
│ └── secrets/ generic/ ← secret detection + cross-cutting rules
├── trivy/ ← IaC / container / dependency scanning
├── codeql/ ← deep dataflow static analysis
└── scripts/ ← runners, CI, recon pipeline, adaptive payload generator
├── run-all.sh / run-all.ps1
├── oneshot.sh ← fully-piped recon→auth→scan(unauth+authed)→dedupe→PoC→dashboard
├── recon-master.sh ← deepest recon: ASN→CIDR, subs (passive+brute+permute), JS/secret harvest, screenshots
├── auth-capture.py ← 🔐 Playwright login / browser-cookie capture → auth-headers.txt
├── intruder.sh ← Burp Intruder + Repeater on the CLI (request manipulation)
├── race.sh ← race-condition / single-packet attack (limit-overrun, coupon reuse)
├── bizlogic.sh ← business-logic tampering probe (price/quantity/role/workflow)
├── spyhunt-scan.sh ← spyhunt Target-Intel + vuln modules wrapper
├── api-scan.sh ← API/GraphQL deep flow (swagger parse → api/access-control/auth templates)
├── monitor.sh ← continuous monitoring: diff new subs/hosts/URLs, optional --notify
├── notify.sh ← Slack / Discord / Telegram webhook notifications
├── bug-bounty-pipeline.sh ← recon → live → crawl → known scan → adaptive fuzz
├── dynamic-payload-generator.py ← probes behavior, synthesizes context-aware payloads
└── github-actions-security.yml
```
## 🎛️ 单一入口点 — `secsuite.sh`
仓库根目录下的一个脚本即可运行并验证所有内容：
```
./secsuite.sh check # validate all templates+scripts + self-test the tools
./secsuite.sh doctor # show which external tools are installed
./secsuite.sh setup # install the whole Fedora toolchain (DEFAULT: offline ZIP, no git clone)
./secsuite.sh setup --online # old path: git clone + go install @latest
./secsuite.sh fetch # just download all source ZIPs into the current folder
./secsuite.sh offline # install from ZIPs already in the current folder
./secsuite.sh templates # download+merge official+custom+community templates
./secsuite.sh oneshot "*.x.com" # full piped recon→scan→dedupe→PoC
./secsuite.sh oneshot app.x.com --login https://app.x.com/login # authed + unauthed in one run
./secsuite.sh auth login --url https://app.x.com/login # capture a session for reuse
./secsuite.sh auth from-browser --domain x.com --browser firefox # grab your live browser cookies
./secsuite.sh recon x.com --aggressive --severity high,critical --tags rce,sqli
./secsuite.sh recon-master "*.x.com" --brute # deepest recon: subs+JS+params+intel, feeds oneshot
./secsuite.sh recon-extra x.com # favicon→Shodan pivot, GitHub recon, waymore, deep-JS
# secrets (LinkFinder/SecretFinder/xnLinkFinder/mantra/
# jsluice/sourcemapper + KeyReaper), csprecon, git-dumper,
# 401/403 bypass, S3 buckets (auto-runs inside oneshot)
./secsuite.sh vuln-extra x.com # vuln-CLASS detectors: takeover(subzy/baddns), CRLF,
# SSTI(TInjA), cache-poison(toxicache), NoSQLi, CORS(Corsy),
# open-redirect(Oralyzer), framework-secrets(badsecrets),
# smuggling, API-brute(kiterunner/sj), GraphQL(graphw00f/
# graphql-cop/clairvoyance) + HackTricks safe-marker quick-checks
# (LFI/SSTI/redirect/SQLi/CORS, response-shaped) → docs/HACKTRICKS-METHODOLOGY.md
./secsuite.sh net-recon x.com # NETWORK layer: IP discovery (dnsx A/AAAA/PTR, asnmap→CIDR,
# hakip2host, uncover) → hunt the REAL origin behind the CDN
# (cdncheck, SPF ip4: leaks, favicon pivot, hakoriginfinder) →
# PROVE the backend IP (curl --resolve vs CDN baseline) → nmap
# ports → NSE vuln+vulners / service-NSE / testssl / nuclei
# network templates (oneshot pops this in a 2nd terminal)
# + 50-service unauth/default-cred probe matrix → docs/NETWORK-RECON.md
./secsuite.sh authz-diff --urls ranked-params.txt --session-a auth/admin.txt --session-b auth/user.txt
# headless Autorize — differential BOLA/IDOR/access-control
./secsuite.sh api-scan https://api.x.com --auth-headers auth/auth-headers.txt # API/GraphQL deep scan
./secsuite.sh spyhunt x.com --deep # spyhunt Target-Intel + vuln modules
./secsuite.sh monitor x.com --notify --interval 3600 # continuous new-asset alerts (cron-friendly)
./secsuite.sh templates # sync official (ALL CVEs 2010→now) + community feeds
./secsuite.sh intruder -request req.txt -w payloads.txt --auth-headers auth/auth-headers.txt # Burp Intruder
./secsuite.sh repeater -u https://x.com/ -H "X-Original-URL: /admin" # Burp Repeater (one request)
./secsuite.sh static ./src --sarif # full SAST sweep
./secsuite.sh dedupe a.jsonl b.jsonl --near -o merged.jsonl
./secsuite.sh confirm merged.jsonl -o confirmed.jsonl --report confirm.md # differential FP-killer
./secsuite.sh rce-confirm --nuclei findings.jsonl -o rce/ # upgrade cmdi/SSTI primitives to CONFIRMED-EXEC
# with a SAFE arithmetic marker (no real command run) + PoC
./secsuite.sh poc confirmed.jsonl --out poc/ # PoCs carry the CONFIRMED/FP verdict
./secsuite.sh dashboard --recon-dir ./recon-x.com # one shareable HTML report
./secsuite.sh lint nuclei/ --min warn # static false-positive linter for templates
```
### ✅ 确认阶段 — 在报告前消除误报
`confirm` 会**差异化地**重新测试每一个发现：它重放一次攻击，然后
重放一个*中和后的孪生请求*（将 payload 替换为无害的 token），只有当证据**伴随** payload 出现且**在没有** payload 时消失，它才
信任该发现。盲注/基于时间的漏洞类别通过可重复的响应时间差值来确认。
每个发现都会被评级为 **CONFIRMED / LIKELY / FALSE-POSITIVE / UNCONFIRMED /
MANUAL**，误报将被丢弃，判定结果会直接传入 PoC 的 `SUBMISSION.md`。它会在 `oneshot` 中自动运行（使用 `--no-confirm` 禁用）：
```
./secsuite.sh confirm findings-dedup.jsonl -o clean.jsonl --keep confirmed,likely --report confirm.md
```
### 🔤 编码 / WAF 绕过 — “服务器会接受什么？”
服务器和 WAF 在输入如何解码上存在分歧。`encode` 映射了这一差距：它
将任何 payload 跨越 **29 种方案**进行变异（URL 单次/双重/三重/全十六进制，
base64，HTML 实体，`\uXXXX`，`%uXXXX`，超长 UTF-8，空字节，大小写混合，
SQL/JS 注释，UTF-7……），并且 — 在 `probe` 模式下 — 以每种编码发射一个测试载荷（canary），以检测目标实际**解码**了哪些编码（此时，仅检查原始字节的 WAF 就可以通过这些编码被绕过）：
```
./secsuite.sh encode mutate --payload "
