https://souljian.cn/tags/%E6%89%AB%E6%8F%8F/Recent content in 扫描 on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088220/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088220/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>Burp Suite 测试只在授权环境进行。</p> <h2 id="一burp-架构">一、Burp 架构 </h2><img src="https://souljian.cn/img/burp-suite-architecture.svg" alt="Burp Suite 架构" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">① Proxy 代理 → ② Repeater 重放 → ③ Intruder 爆破 → ④ Scanner 扫描 </span></span></code></pre></td></tr></table> </div> </div><h2 id="二模块介绍">二、模块介绍 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span><span class="lnt">5 </span><span class="lnt">6 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">Proxy：HTTP 代理 · 抓包改包 </span></span><span class="line"><span class="cl">Repeater：手动重放请求 </span></span><span class="line"><span class="cl">Intruder：参数爆破 · 模糊测试 </span></span><span class="line"><span class="cl">Scanner：自动化漏洞扫描 </span></span><span class="line"><span class="cl">Decoder：编码/解码工具 </span></span><span class="line"><span class="cl">Comparer：内容对比 </span></span></code></pre></td></tr></table> </div> </div><h2 id="三常用插件">三、常用插件 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">AuthMatrix · HackerOne · Autorize </span></span><span class="line"><span class="cl">JSFinder · RouteViz · J2EEScan </span></span></code></pre></td></tr></table> </div> </div><h2 id="四小结">四、小结 </h2><p>Burp Suite 是 Web 安全测试的瑞士军刀。掌握 Proxy + Repeater + Intruder 三个核心模块即可覆盖 90% 的 Web 测试场景。</p>