DOCSEARCHbyAlgolia
Submit Docs

枫-WIKI Network Security and Code Audit Documentation

website·Indexed 29 days ago

https://qian-shen.github.io/

A comprehensive knowledge base covering network security, code audit, and operational security. Key topics include Web security vulnerabilities (SQLI, XSS, XXE, CSRF, RCE), database security for MySQL, MsSQL, and Redis, intranet security for Windows and Linux (including permission escalation), cloud-native security (containers and microservices), and security standards like SDLC and risk assessment.

Tokens
21.1K
Snippets
102
Records
155
Agent score
73%

What's inside 枫-WIKI

  1. Overview of vuepress-theme-reco

    vuepress-theme-reco is a minimalist VuePress theme specifically designed for blogging. It extends the default VuePress theme to add blog-specific features including categories, tag walls, pagination, and comment systems. Because it is based on the default theme, official VuePress theme configurations remain applicable.

  2. Understand SQL Injection principles and impacts

    SQL Injection occurs when a web application fails to properly filter or validate user-supplied data, allowing an attacker to control parameters that are passed into a database query. By constructing malicious SQL statements, attackers can perform unauthorized operations on the database.

    Potential Impacts:

    • Leakage of private user information.
    • Website defacement via database manipulation.
    • Distribution of malware by embedding malicious links in database fields.
    • Unauthorized administrative access to the database server.
    • Remote control of the server or installation of backdoors via OS-level database features.
    • Destruction of hard drive data and total system failure.

  3. Understand Forward vs Reverse Connections

    A Forward Connection occurs when an attacker connects to a specific open port on a target machine (e.g., Remote Desktop, SSH, Web services). A Reverse Connection (Reverse Shell) occurs when the target machine initiates a connection back to a listener hosted by the attacker. Reverse shells are used when the target is behind a firewall that blocks incoming requests, has occupied ports, is in a local network with a dynamic IP, or when the target's online status is unknown.

  5. Query MSSQL system views for database metadata

    MSSQL provides several system views to retrieve information about the database structure, users, and files:
    ViewFunction
    sysobjectsRecords all tables in the database (common fields: id, name, xtype)
    syscolumnsRecords all columns in all tables (common fields: id, name, xtype)
    sys.databasesLists all databases in the SQL Server instance
    information_schema.tablesLists tables in the current user database
    information_schema.columnsLists columns in the current user database
    sys.sql_loginsLists all login names in SQL Server
    sys.all_columnsUnion of all columns for user-defined and system objects
    sys.database_principalsDatabase permissions or exceptional column permissions
    sys.database_filesDatabase files stored in the database

  6. Understand and prevent deserialization vulnerabilities

    Deserialization vulnerabilities occur when a program converts a byte stream back into an object (deserialization) and automatically invokes specific functions (such as magic methods) using parameters that can be controlled by a user. This allows an attacker to inject malicious code, potentially leading to remote command execution (RCE) or the uploading of a web shell to gain system permissions.

    Remediation:

    • Avoid passing user-controllable input or parameters directly into deserialization functions.
    • Implement strict input validation and filtering on parameters before they reach the deserialization function.

  7. Understand Arbitrary File Upload vulnerabilities

    Arbitrary File Upload vulnerabilities occur when a web application allows users to upload files without sufficient restrictions on file type, content, or naming. This can happen due to poor input validation, failure to account for system-specific behaviors, or server-side parsing vulnerabilities. The primary risk is the ability for an attacker to upload malicious scripts (e.g., web shells) or executable programs. If the upload directory has execution permissions, an attacker can achieve Remote Code Execution (RCE) and potentially compromise the entire server or other hosted websites.

  8. Understand and identify Brute Force vulnerabilities in Web Authentication

    Brute force is an attack method used to obtain authentication credentials by systematically attempting a large volume of credential combinations against an authentication interface until a successful login is achieved. Common vulnerability patterns that enable brute force attacks include:

    1. Client-side Validation: Captchas or verification codes are generated and validated on the frontend, allowing attackers to bypass them easily.
    2. Missing Verification Tokens: The authentication request (traffic packet) does not include a verification code, allowing direct automated attempts on usernames and passwords.
    3. Captcha Replay: Verification codes are not invalidated after use or have no expiration, allowing the same code to be reused for multiple login attempts.

  9. Understand Information Security Risk Assessment fundamentals

    Information security risk assessment is the process of analyzing an information system's asset value, potential threats, vulnerabilities, and existing protections to determine the probability of security events and their potential losses, ultimately proposing risk management measures.

    Key concepts include:

    • Risk: A potential harm to an organization caused by a specific threat exploiting a vulnerability. Risk severity is proportional to asset value damage and threat frequency.
    • Asset: Anything of value to the organization (information, software, hardware, services, personnel).
    • Threat: Potential causes of unexpected events that may harm the system or organization.
    • Vulnerability: A weakness in one or more assets that can be exploited by threats.

    The CIA Triad in Risk Context:

    • Confidentiality: Preventing unauthorized users from reading data.
    • Integrity: Preventing unauthorized users from modifying or deleting data.
    • Availability: Ensuring authorized entities can use the system normally when needed.

  10. Understand the Secure Software Development Life Cycle (SSDLC)

    The Secure Software Development Life Cycle (SSDLC) is a management model (originally proposed by Microsoft) that integrates security activities into every phase of the traditional System Development Life Cycle (SDLC). The primary goal of SSDLC is to reduce the number of vulnerabilities in software and lower their severity levels.

  11. Understand Cross-Site Scripting (XSS) vulnerability

    Cross-Site Scripting (XSS) occurs when an attacker embeds malicious code into a vulnerable front-end page. Because the application does not strictly filter or restrict input and output, the browser treats the crafted script as valid code and executes it when a victim visits the page. This can lead to the theft of sensitive information, session cookies, or be used for phishing and crypto-mining.

  12. Understand Cookie-based session storage

    Cookies are a browser-side data storage mechanism used for session management (e.g., tracking logged-in users or shopping carts). The server generates the cookie and sends it to the browser; the browser then stores this data as key-value pairs in a local text file. On subsequent requests to the same domain, the browser automatically sends the cookie back to the server. To prevent malicious use and excessive disk consumption, browsers impose limits on the number of cookies stored per domain.