January 2021
Intermediate to advanced
547 pages
12h 4m
Chinese
Content preview from 网络安全评估（第三版）
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
评价数据存储
｜
487
表
15
-
10
：Metasploit 可利用的 Oracle Database 漏洞（续）
CVE
引用
影响的版本
描述
– All
从
Oracle
服务器调用一个出口
SMB
会话
，
为在
线攻击获得服务账号的
NTLM
哈希值
f
a. Metasploit client_system_analyzer_upload module.
b. Metasploit dbms_cdc_publish2 module.
c. Metasploit dbms_cdc_publish3 module.
d. Metasploit jvm_os_code_10g module.
e. Metasploit it_rollbackworkspace module.
f. Metasploit ora_ntlm_stealer module.
MongoDB
MongoDB
是一个面向文档的交叉平台数据库。缺省情况下，服务器监听在
TCP 27017
端口，并且可以无授权运行。
Shodan
在线提供了公开实例的详细
信息
注
23
。
Nmap
可以通过
mongodb-databases
和
mongodb-info
脚本询问可用的服
务，如实例
15-21
所示（篇幅受限，只给出了部分输出）。表
15-11
列出了
MongoDB
中远程可采用的漏洞。
实例 15-21：使用 Nmap 枚举 MongoDB
root@kali:~#
nmap -sSVC -p27017 173.255.254.242
Starting Nmap ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.