Alternative injection Search Skills

 

Generally, cainiao like me will use the following method:

1: Manually test

2: Use mingkido or a D to directly browse the page to find injection points.

3: Search Engine site: xxx.com inurl: php or asp

4: tools like safe3 jsky automatically determine after capturing the connection ~~~ Method 1 disadvantages: only partial page pulling can be tested. A bit of luck-based experience. method 2 disadvantages: basically the same as the first one. Incomplete. only partial page browsing. Method 3 disadvantages: search engine indexing is limited. Some sites are not even indexed yet. 4 disadvantages: It is simulated to capture page links. During the detection, but every time it is done so early, the whole site cannot be crawled, some sites also restrict this type of software crawling

 

The train of thought today is:

Solution 1:

1: Set up a search engine on your own. The name of the spider is "Baiduspider" (which can avoid many restrictions and is difficult to be managed and discovered ),

2: capture the page links required by the target site, such as including php? Asp? This type of page does not include html or htm

3: a d browses the local site: xxx.com injection points are continuously pulled out ~~~~ Using this method, the last time I successfully got several beautiful points in the century

Tool 1 used: Local php + mysql environment, please download it yourself ~~ Everywhere ~~

Tool used 2: Spider system open source mongo.rar (5.01 MB)

 

Solution 2:

The principle is similar, not as good as above ~~~ Because the page cannot be set to circumvent ~~~

1: A sitemapproduction tool to simulate crawling and generate sitemap.html

2: Build a local web environment and access 127.0.0.1/sitemap.html

3: a d checks all links on sitemap ~~~

Tool 1 used: Local asp environment, this is your next netbox

Tool used 2: unlimited sitemapproduction tool. Zip (407.24 KB) Someone cannot find the password of the spider SYSTEM account ~~~~ Pay attention to the compressed text in the logon password and instructions ~~ The login password of the spider is the same as that of the background logon ~~

 

From 3est