1.目录和文件模糊测试爆破目录ffuf-w/usr/share/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt-uhttp://154.57.164.72:30163/webfuzzing_hidden_path/FUZZffuf-w./common.txt-uhttp://154.57.164.72:30163/webfuzzing_hidden_path/flag/FUZZ-e.php,.html,.txt,.bak,.js-v2.递归模糊测试feroxbuster-w/usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt-uhttp://154.57.164.67:30345/recursive_fuzz-xhtml,php-t200-C400,401,404--depth43.参数和值模糊测试ffuf-w/usr/share/seclists/Discovery/Web-Content/common.txt-uhttp://154.57.164.82:30364/get.php?xFUZZffuf-uhttp://154.57.164.82:30364/post.php-XPOST-HContent-Type: application/x-www-form-urlencoded-dyFUZZ-w/usr/share/seclists/Discovery/Web-Content/common.txt4.虚拟主机和子域名模糊测试sudosh-cecho 154.57.164.82 inlanefreight.htb /etc/hostsgobuster vhost-uhttp://inlanefreight.htb:31971-w/usr/share/seclists/Discovery/Web-Content/common.txt --append-domaingobuster dns-dinlanefreight.com-w/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt5.过滤模糊测试输出6.验证发现feroxbuster-w/usr/share/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt-uhttp://154.57.164.82:30211/-xhtml,php-t200-C400,401,404--depth57.API 模糊测试python3 api_fuzzer.py http://154.57.164.82:313508.技能评估1发现panel.php需要accessID参数feroxbuster-w/usr/share/seclists/Discovery/Web-Content/common.txt-uhttp://154.57.164.82:31213/-xhtml,php-t200curl-vhttp://154.57.164.82:31213/admin/panel.php2爆破参数后访问得知需要爆破Vhostffuf-w/usr/share/seclists/Discovery/Web-Content/common.txt-uhttp://154.57.164.82:31213/admin/panel.php?accessIDFUZZ-fs58curlhttp://154.57.164.82:31213/admin/panel.php?accessIDgetaccess3爆破得到Vhost继续爆破目录得到Flagsudosh-cecho 154.57.164.82 fuzzing_fun.htb /etc/hostsgobuster vhost-uhttp://fuzzing_fun.htb:31213-w/usr/share/seclists/Discovery/Web-Content/common.txt --append-domain|grepStatus: 200feroxbuster-uhttp://hidden.fuzzing_fun.htb:31213/godeep/-w/usr/share/seclists/Discovery/Web-Content/common.txt-xhtml,php-t200