七月份文章收藏

标签：com   net   图片   head   错误页面   app   not   http   ref   

HTML缩小的潜在XSS漏洞

https://hackerone.com/reports/24684

node.js 目录遍历

https://hackerone.com/reports/358645

--path-as-is    Do not squash .. sequences in URL path

curl 中 --path-as-is 选项的意思是在不要压缩URL路径中的 .. 符号

serve包介绍：https://www.npmjs.com/package/serve

内容注入

https://hackerone.com/reports/144104

用户或攻击者能够将其文本注入错误页面，并且可以捕获用户访问恶意站点。

图片xss

https://hackerone.com/reports/72526

"><img src="x" onerror=alert(cookie)>.png

header头攻击

https://hackerone.com/reports/137181

NGINX alias错误配置可任意读取

https://hackerone.com/reports/317201

https://github.com/yandex/gixy/blob/master/docs/en/plugins/aliastraversal.md

https://www.leavesongs.com/PENETRATION/nginx-insecure-configuration.html

七月份文章收藏

标签：com   net   图片   head   错误页面   app   not   http   ref   

原文地址：https://www.cnblogs.com/i-honey/p/9282011.html