In a long, long time, I had a dream, but then I found out that my dream was fading.
So, yesterday I thought about it all night
Think I should have a dream!
Okay, back to the chase. is so-called Ming not installed Dark force, today my home opened the public IP I Kai Sen ah, very open sen of the kind!
Well, it's another topic.
And here we are really starting out:
0x01
Let's take a quick look at the shoes poc,exp idea:
First, we need to know about this vulnerability, which is the discovery of vulnerabilities
Then, we need to know the principle of this loophole, that is to understand the principle
Second, we need to build the environment, or to find the environment on the Internet to understand the use of the vulnerability process
Finally, we're writing exp and POC
0x02
Write a simple POC what we need to know about Python:
1. Python basic output Input 2.python data type 3.python Process Control 4.python Regular Expression 5.python network programming 6.python urllib and URLLIB2 module 7.python SYS module and OS module
Start writing the POC (we take the VBCMS injection of the forum as an example):
1. How to analyze the vulnerability
Can see his exploit address, this is a very obvious SQL injection statement, add the URL encoding, we try to solve the URL encoding
Because we're just going to write the POC, so we just load this code and it's OK.
The following is the main POC code, just as a reference, do not understand Python