如果不允许则继续尝试⼦域爆破 批量抓取⽬标所有⼦域 Web banner 批量对⽬标所有⼦域集中进⾏基础服务端⼝探测识别 批量识别⽬标 所有存活Web站点的Web程序指纹 及其详细版本 从 Git 中查找⽬标泄露的各类 敏感⽂件 及 账号密码,偶尔甚⾄还能碰到⽬标不⼩⼼泄露的各种云的 "AccessKe y" 从⽹盘 / 百度⽂库 中查找⽬标泄露的各类 敏感⽂件 及 账号密码 从各第三⽅历史漏洞库中查找⽬标曾经泄露的 控制台弱⼝令,部署webshelll [ 注: 7.x版本后,默认加了防爆机制 ] Jekins CVE-2018-1999002 [任意⽂件读取] 未授权访问,任意命令执⾏ 控制台弱⼝令,任意命令执⾏ ElasticSearch CVE-2014-3120 [专⻔针对⽼版本(⽆沙盒)RCE] CVE-2015-1427 [Groovy RCE] [ y ] CVE-2015-3337 [Shellshock] 各种能快速 getshell 的常规基础 Web 漏洞利⽤ [注: 有些漏洞在不审代码的情况下其实 是很难有效盲测到的] 后台弱⼝令 SSRF sql注⼊ 越权 命令 / 代码执⾏ / 反序列化 任意⽂件上传 / 下载 / 读取 包含 XSS（实际上,XSS只有在针对某些特定邮箱,⼿⾥有浏览器0day时价值才会⽐较⼤,红队场景下其实并不是⾮常致命) 业务逻辑漏洞

tactic. If you missed last month, you can find this on the Agile4Defense GitHub page at: https://git.io/JeaOu Enterprise Architecture Enterprise Architecture, the domain of the IT bureaucrats, is the https://github.com/Agile4Defense/AgileForDefense You can download this topic directly at: https://git.io/JeaO2

missed last month, you can find the handout for Part 2 on the Agile4Defense GitHub page at: https://git.io/JeaO2 Risk The presence of uncertainty is the simple reason why Agile approaches work better than https://github.com/Agile4Defense/AgileForDefense You can download this table handout directly at: https://git.io/Jejqb Share Your Feedback As we've come to learn on our agile journey, short cycle times and rapid

GIT is a version control system that is used for software development and other version control tasks. As a distributed revision control system it is aimed at speed, data integrity, and support for