Mehdi0x90/Web_Hacking
GitHub: Mehdi0x90/Web_Hacking
一个系统整理 Web 渗透测试与 Bug Bounty 技巧、漏洞 Payload、绕过手法及安全编码实践的综合安全知识库。
Stars: 797 | Forks: 149
# Web Hacking + Bug Bounty 技巧
这些是我从各种来源收集的 **Bug Bounty / Pentest** 笔记。
## 黄金技巧
* [Writeups](https://github.com/Mehdi0x90/Web_Hacking/blob/main/writeups.md)
* [Smart Hunting](https://github.com/Mehdi0x90/Web_Hacking/blob/main/smart%20hunting.md)
## 信息收集 & OSINT 技术
* [信息收集](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Recon.md)
* [OSINT](https://github.com/Mehdi0x90/Web_Hacking/blob/main/OSINT.md)
## 漏洞列表
* [API Key 泄露](https://github.com/Mehdi0x90/Web_Hacking/blob/main/API%20Key%20Leak.md)
* [CORS](https://github.com/Mehdi0x90/Web_Hacking/blob/main/CORS%20-%20Misconfigurations%20%26%20Bypass.md)
* [CRLF 注入](https://github.com/Mehdi0x90/Web_Hacking/blob/main/CRLF.md)
* [CSRF](https://github.com/Mehdi0x90/Web_Hacking/blob/main/CSRF.md)
* [缓存中毒 / 缓存欺骗](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Cache%20Deception.md)
* [命令注入](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Command%20Injection.md)
* [DOM Clobbering](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Dom%20Clobbering.md)
* [文件包含](https://github.com/Mehdi0x90/Web_Hacking/blob/main/File%20Inclusion.md)
* [文件上传](https://github.com/Mehdi0x90/Web_Hacking/blob/main/File%20Upload.md)
* [GraphQL](https://github.com/Mehdi0x90/Web_Hacking/blob/main/GraphQL.md)
* [Host Header 注入](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Host%20Header%20Injection.md)
* [IDOR](https://github.com/Mehdi0x90/Web_Hacking/blob/main/IDOR.md)
* [JWT](https://github.com/Mehdi0x90/Web_Hacking/blob/main/JWT.md)
* [NoSQLi](https://github.com/Mehdi0x90/Web_Hacking/blob/main/NoSQL%20Injection.md)
* [Open Redirect](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Open%20Redirect.md)
* [Race Condition](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Race%20Condition.md)
* [Reverse Tab Nabbing](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Reverse%20Tab%20Nabbing.md)
* [SQLi](https://github.com/Mehdi0x90/Web_Hacking/blob/main/SQL%20Injection.md)
* [SSRF](https://github.com/Mehdi0x90/Web_Hacking/blob/main/SSRF.md)
* [Sandwich Attack](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Sandwich%20attack.md)
* [XSS](https://github.com/Mehdi0x90/Web_Hacking/blob/main/XSS.md)
* [XXE](https://github.com/Mehdi0x90/Web_Hacking/blob/main/XXE.md)
## 绕过技术
* [常规规避技术](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Evasive%20Techniques.md)
* [2FA / OTP 绕过](https://github.com/Mehdi0x90/Web_Hacking/blob/main/2FA_OTP_Bypass.md)
* [403 绕过](https://github.com/Mehdi0x90/Web_Hacking/blob/main/403%20Bypass.md)
* [429 绕过](https://github.com/Mehdi0x90/Web_Hacking/blob/main/429%20Bypass.md)
* [Captcha 绕过](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Captcha%20Bypass.md)
* [CSP 绕过](https://github.com/Mehdi0x90/Web_Hacking/blob/main/CSP%20Bypass.md)
* [邮箱验证绕过](https://github.com/Mehdi0x90/Web_Hacking/blob/main/email%20verification%20bypass.md)
* [登录绕过](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Login%20Bypass.md)
* [Rate Limit 绕过](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Rate%20Limit%20Bypass.md)
* [重置密码绕过](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Reset%20Password%20Bypass.md)
* [WAF 检测 / 绕过](https://github.com/Mehdi0x90/Web_Hacking/blob/main/WAF%20Bypass.md)
## Cloud / Docker
* [通用](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Cloud-General.md)
* [信息收集](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Cloud%20-%20Info%20Gathering.md)
* [AWS](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Cloud%20-%20AWS.md)
* [Azure](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Cloud%20-%20Azure.md)
* [GCP](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Cloud%20-%20GCP.md)
* [CDN - Domain Fronting](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Cloud%20-%20CDN%20-%20Domain%20Fronting.md)
* [Docker & Kubernetes](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Cloud%20-%20Docker%20%26%20Kubernetes.md)
* [容器攻击](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Container%20Attacks.md)
## 顶级工具与扩展
* [Nuclei](https://github.com/Mehdi0x90/Web_Hacking/blob/main/nuclei.md) - Nuclei 是一款现代的、高性能的漏洞扫描器，它利用基于 YAML 的简单模板
* [inql](https://github.com/doyensec/inql) - 用于高级 GraphQL 测试的 Burp 扩展
* [Logger++](https://github.com/Mehdi0x90/Web_Hacking/blob/main/LoggerPlusPlus.md) - Burp 扩展，一款适用于 Burp Suite 的多线程日志记录扩展
* [param-miner](https://github.com/PortSwigger/param-miner) - Burp 扩展，用于识别隐藏的、未链接的参数
* [Oralyzer](https://github.com/r0075h3ll/Oralyzer) - 一款简单的 Python 脚本，用于探测网站中的 Open Redirection 漏洞
* [SQLiPy Sqlmap Integration](https://portswigger.net/bappstore/f154175126a04bfe8edc6056f340f52e) - SQLiPy 是一款适用于 Burp Suite 的 Python 插件，它使用 SQLMap API 集成了 SQLMap
* [ParamSpider](https://github.com/0xKayala/ParamSpider) - 适合人类的参数挖掘工具
* [gf](https://github.com/tomnomnom/gf) - 一个 grep 的包装器，用于避免输入常见的匹配模式
## Bug Hunter 思维导图
* [XXE](mindmaps-pdf/XXE.pdf)
* [SSRF](mindmaps-pdf/SSRF.pdf)
* [CORS](mindmaps-pdf/CORS.pdf)
* [Prototype Pollution](mindmaps-pdf/Prototype%20Pollution.pdf)
## Red Team 攻击
* [不安全的接口和 API - 针对云](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Insecure%20Interfaces%20and%20APIs.md)
* [EC2 提权](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Privilege%20escalation%20EC2.md)
* [SMTP](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Red%20Team%20-%20SMTP.md)
## 安全编码
* [2FA](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Secure%20Coding%20-%202FA.md)
* [密码重置](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Secure%20Coding%20-%20Password%20Reset.md)
* [Session Fixation](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Secure%20Coding%20-%20Session%20Fixation.md)
* [Broken Object Level Authorization](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Secure%20Coding%20-%20Broken%20Object%20Level%20Authorization.md)
* [Broken Authentication](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Secure%20Coding%20-%20Broken%20Authentication.md)
* [Broken Object Property Level Authorization](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Secure%20Coding%20-%20Broken%20Object%20Property%20Level%20Authorization.md)
* [Unrestricted Resource Consumption](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Secure%20Coding%20-%20Unrestricted%20Resource%20Consumption.md)
* [Broken Function Level Authorization](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Secure%20Coding%20-%20Broken%20Function%20Level%20Authorization.md)
* [不受限制的敏感业务流访问](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Secure%20Coding%20-%20Unrestricted%20Access%20to%20Sensitive%20Business%20Flows.md)
* [Server Side Request Forgery](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Secure%20Coding%20-%20Server%20Side%20Request%20Forgery.md)
* [Security Misconfiguration](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Secure%20Coding%20-%20Security%20Misconfiguration.md)
* [Improper Inventory Management](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Secure%20Coding%20-%20Improper%20Inventory%20Management.md)
* [Unsafe Consumption of APIs](https://github.com/Mehdi0x90/Web_Hacking/blob/main/Secure%20Coding%20-%20Unsafe%20Consumption%20of%20APIs.md)
*本仓库的所有内容将持续更新...*
标签：CISA项目, Payload, Web安全, Web漏洞, 安全测试笔记, 蓝队分析, 逆向工具, 防御加固