Help
RSS
API
Feed
Maltego
Contact
Domain > www.alsjznc.cn
×
More information on this domain is in
AlienVault OTX
Is this malicious?
Yes
No
DNS Resolutions
Date
IP Address
2025-07-26
116.211.128.101
(
ClassC
)
2025-11-23
43.174.246.26
(
ClassC
)
Port 80
HTTP/1.1 200 OKAlt-Svc: quic:443; h3:443; h3-29:443; h3-27:443;h3-25:443; h3-T050:443; h3-Q050:443;h3-Q049:443;h3-Q048:443; h3-Q046:443; h3-Q043:443Content-Type: text/html;charsetutf-8Expires: Thu, 19 Nov 1981 08:52:00 GMTPragma: no-cacheSet-Cookie: PHPSESSID98nk03ccmp0rnn8r9tebb2r0j7; path/Strict-Transport-Security: max-age31536000Vary: Accept-EncodingX-Xss-Protection: 1; modeblockServer: TencentEdgeOneCache-Control: must-revalidate, no-cache, no-store, post-check0, pre-check0Content-Length: 35389Connection: keep-aliveDate: Sun, 23 Nov 2025 01:23:02 GMTEO-LOG-UUID: 8140811562791499448EO-Cache-Status: MISS !DOCTYPE html>html langen>head> meta http-equivX-UA-Compatible contentIEedge,chrome1 /> meta charsetutf-8 /> title>Get the pikachu/title> meta namedescription contentoverview & stats /> meta nameviewport contentwidthdevice-width, initial-scale1.0, maximum-scale1.0 /> !-- bootstrap & fontawesome --> link relstylesheet hrefassets/css/bootstrap.min.css / > link relstylesheet hrefassets/font-awesome/4.5.0/css/font-awesome.min.css /> !-- page specific plugin styles --> !-- text fonts --> link relstylesheet hrefassets/css/fonts.googleapis.com.css /> !-- ace styles --> link relstylesheet hrefassets/css/ace.min.css classace-main-stylesheet idmain-ace-style /> !--if lte IE 9> link relstylesheet hrefassets/css/ace-part2.min.css classace-main-stylesheet /> !endif--> link relstylesheet hrefassets/css/ace-skins.min.css /> link relstylesheet hrefassets/css/ace-rtl.min.css /> !--if lte IE 9> link relstylesheet hrefassets/css/ace-ie.min.css /> !endif--> !-- inline styles related to this page --> !-- ace settings handler --> script srcassets/js/ace-extra.min.js>/script> !-- HTML5shiv and Respond.js for IE8 to support HTML5 elements and media queries --> !--if lte IE 8> script srcassets/js/html5shiv.min.js>/script> script srcassets/js/respond.min.js>/script> !endif--> script srcassets/js/jquery-2.1.4.min.js>/script> script srcassets/js/bootstrap.min.js>/script>/head>body classno-skin>div idnavbar classnavbar navbar-default ace-save-state> div classnavbar-container ace-save-state idnavbar-container> div classnavbar-header pull-left> a hrefindex.php classnavbar-brand> small> i classfa fa-key>/i> Pikachu 漏洞练习平台 pika~pika~ /small> /a> /div> div classnavbar-buttons navbar-header pull-right rolenavigation> ul classnav ace-nav> li classlight-blue dropdown-modal> a data-toggledropdown href# classdropdown-toggle> img classnav-user-photo srcassets/images/avatars/pikachu1.png altJasons Photo /> span classuser-info> small>欢迎/small> 骚年 /span> /a> /li> /ul> /div> /div>!-- /.navbar-container -->/div>div classmain-container ace-save-state idmain-container> script typetext/javascript> try{ace.settings.loadState(main-container)}catch(e){} /script> div idsidebar classsidebar responsive ace-save-state> script typetext/javascript> try{ace.settings.loadState(sidebar)}catch(e){} /script> ul classnav nav-list> li classactive open> a hrefindex.php> i classace-icon glyphicon glyphicon-tags>/i> span classmenu-text> 系统介绍 /span> /a> b classarrow>/b> /li> li class> a href# classdropdown-toggle> i classace-icon glyphicon glyphicon-lock>/i> span classmenu-text> 暴力破解 /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/burteforce/burteforce.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/burteforce/bf_form.php> i classmenu-icon fa fa-caret-right>/i> 基于表单的暴力破解 /a> b classarrow>/b> /li> li class> a hrefvul/burteforce/bf_server.php> i classmenu-icon fa fa-caret-right>/i> 验证码绕过(on server) /a> b classarrow>/b> /li> li class> a hrefvul/burteforce/bf_client.php> i classmenu-icon fa fa-caret-right>/i> 验证码绕过(on client) /a> b classarrow>/b> /li> li class> a hrefvul/burteforce/bf_token.php> i classmenu-icon fa fa-caret-right>/i> token防爆破? /a> b classarrow>/b> /li>!-- li class-->!-->-->!-- a href# classdropdown-toggle>-->!-- i classmenu-icon fa fa-caret-right>/i>-->!---->!-- test-->!-- b classarrow fa fa-angle-down>/b>-->!-- /a>-->!---->!-- b classarrow>/b>-->!---->!-- ul classsubmenu>-->!-- li class-->!-->-->!-- a hreftop-menu.html>-->!-- i classmenu-icon fa fa-caret-right>/i>-->!-- test sun 01-->!-- /a>-->!---->!-- b classarrow>/b>-->!-- /li>-->!---->!-- /ul>-->!-- /li>--> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon glyphicon glyphicon-indent-left>/i> span classmenu-text> Cross-Site Scripting /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/xss/xss.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/xss/xss_reflected_get.php> i classmenu-icon fa fa-caret-right>/i> 反射型xss(get) /a> b classarrow>/b> /li> li class > a hrefvul/xss/xsspost/post_login.php> i classmenu-icon fa fa-caret-right>/i> 反射型xss(post) /a> b classarrow>/b> /li> li class > a hrefvul/xss/xss_stored.php> i classmenu-icon fa fa-caret-right>/i> 存储型xss /a> b classarrow>/b> /li> li class > a hrefvul/xss/xss_dom.php> i classmenu-icon fa fa-caret-right>/i> DOM型xss /a> b classarrow>/b> /li> li class > a hrefvul/xss/xss_dom_x.php> i classmenu-icon fa fa-caret-right>/i> DOM型xss-x /a> b classarrow>/b> /li> li class > a hrefvul/xss/xssblind/xss_blind.php> i classmenu-icon fa fa-caret-right>/i> xss之盲打 /a> b classarrow>/b> /li> li class > a hrefvul/xss/xss_01.php> i classmenu-icon fa fa-caret-right>/i> xss之过滤 /a> b classarrow>/b> /li> li class > a hrefvul/xss/xss_02.php> i classmenu-icon fa fa-caret-right>/i> xss之htmlspecialchars /a> b classarrow>/b> /li> li class > a hrefvul/xss/xss_03.php> i classmenu-icon fa fa-caret-right>/i> xss之href输出 /a> b classarrow>/b> /li> li class > a hrefvul/xss/xss_04.php> i classmenu-icon fa fa-caret-right>/i> xss之js输出 /a> b classarrow>/b> /li> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon glyphicon glyphicon-share>/i> span classmenu-text> CSRF /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/csrf/csrf.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/csrf/csrfget/csrf_get_login.php> i classmenu-icon fa fa-caret-right>/i> CSRF(get) /a> b classarrow>/b> /li> li class > a hrefvul/csrf/csrfpost/csrf_post_login.php> i classmenu-icon fa fa-caret-right>/i> CSRF(post) /a> b classarrow>/b> /li> li class > a hrefvul/csrf/csrftoken/token_get_login.php> i classmenu-icon fa fa-caret-right>/i> CSRF Token /a> b classarrow>/b> /li> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon fa fa-fighter-jet>/i> span classmenu-text> SQL-Inject /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/sqli/sqli.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/sqli/sqli_id.php> i classmenu-icon fa fa-caret-right>/i> 数字型注入(post) /a> b classarrow>/b> /li> li class > a hrefvul/sqli/sqli_str.php> i classmenu-icon fa fa-caret-right>/i> 字符型注入(get) /a> b classarrow>/b> /li> li class > a hrefvul/sqli/sqli_search.php> i classmenu-icon fa fa-caret-right>/i> 搜索型注入 /a> b classarrow>/b> /li> li class > a hrefvul/sqli/sqli_x.php> i classmenu-icon fa fa-caret-right>/i> xx型注入 /a> b classarrow>/b> /li> li class > a hrefvul/sqli/sqli_iu/sqli_login.php> i classmenu-icon fa fa-caret-right>/i> insert/update注入 /a> b classarrow>/b> /li> li class > a hrefvul/sqli/sqli_del.php> i classmenu-icon fa fa-caret-right>/i> delete注入 /a> b classarrow>/b> /li> li class > a hrefvul/sqli/sqli_header/sqli_header_login.php> i classmenu-icon fa fa-caret-right>/i> http header注入 /a> b classarrow>/b> /li> li class > a hrefvul/sqli/sqli_blind_b.php> i classmenu-icon fa fa-caret-right>/i> 盲注(base on boolian) /a> b classarrow>/b> /li> li class > a hrefvul/sqli/sqli_blind_t.php> i classmenu-icon fa fa-caret-right>/i> 盲注(base on time) /a> b classarrow>/b> /li> li class > a hrefvul/sqli/sqli_widebyte.php> i classmenu-icon fa fa-caret-right>/i> 宽字节注入 /a> b classarrow>/b> /li> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon glyphicon glyphicon-pencil>/i> span classmenu-text> RCE /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/rce/rce.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/rce/rce_ping.php> i classmenu-icon fa fa-caret-right>/i> exec ping /a> b classarrow>/b> /li> li class > a hrefvul/rce/rce_eval.php> i classmenu-icon fa fa-caret-right>/i> exec evel /a> b classarrow>/b> /li> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon glyphicon glyphicon-file>/i> span classmenu-text> File Inclusion /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/fileinclude/fileinclude.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/fileinclude/fi_local.php> i classmenu-icon fa fa-caret-right>/i> File Inclusion(local) /a> b classarrow>/b> /li> li class > a hrefvul/fileinclude/fi_remote.php> i classmenu-icon fa fa-caret-right>/i> File Inclusion(remote) /a> b classarrow>/b> /li> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon glyphicon glyphicon-download>/i> span classmenu-text> Unsafe Filedownload /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/unsafedownload/unsafedownload.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/unsafedownload/down_nba.php> i classmenu-icon fa fa-caret-right>/i> Unsafe Filedownload /a> b classarrow>/b> /li> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon glyphicon glyphicon-upload>/i> span classmenu-text> Unsafe Fileupload /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/unsafeupload/upload.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/unsafeupload/clientcheck.php> i classmenu-icon fa fa-caret-right>/i> client check /a> b classarrow>/b> /li> li class > a hrefvul/unsafeupload/servercheck.php> i classmenu-icon fa fa-caret-right>/i> MIME type /a> b classarrow>/b> /li> li class > a hrefvul/unsafeupload/getimagesize.php> i classmenu-icon fa fa-caret-right>/i> getimagesize /a> b classarrow>/b> /li> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon glyphicon glyphicon-text-height>/i> span classmenu-text> Over Permission /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/overpermission/op.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/overpermission/op1/op1_login.php> i classmenu-icon fa fa-caret-right>/i> 水平越权 /a> b classarrow>/b> /li> li class > a hrefvul/overpermission/op2/op2_login.php> i classmenu-icon fa fa-caret-right>/i> 垂直越权 /a> b classarrow>/b> /li> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon glyphicon glyphicon-align-left>/i> span classmenu-text> ../../ /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/dir/dir.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/dir/dir_list.php> i classmenu-icon fa fa-caret-right>/i> 目录遍历 /a> b classarrow>/b> /li> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon glyphicon glyphicon-camera>/i> span classmenu-text> 敏感信息泄露 /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/infoleak/infoleak.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/infoleak/findabc.php> i classmenu-icon fa fa-caret-right>/i> IcanseeyourABC /a> b classarrow>/b> /li> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon glyphicon glyphicon-align-left>/i> span classmenu-text> PHP反序列化 /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/unserilization/unserilization.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/unserilization/unser.php> i classmenu-icon fa fa-caret-right>/i> PHP反序列化漏洞 /a> b classarrow>/b> /li> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon glyphicon glyphicon-flag>/i> span classmenu-text> XXE /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/xxe/xxe.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/xxe/xxe_1.php> i classmenu-icon fa fa-caret-right>/i> XXE漏洞 /a> b classarrow>/b> /li> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon glyphicon glyphicon-repeat>/i> span classmenu-text> URL重定向 /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/urlredirect/unsafere.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/urlredirect/urlredirect.php> i classmenu-icon fa fa-caret-right>/i> 不安全的URL跳转 /a> b classarrow>/b> /li> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon fa fa-exchange>/i> span classmenu-text> SSRF /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/ssrf/ssrf.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/ssrf/ssrf_curl.php> i classmenu-icon fa fa-caret-right>/i> SSRF(curl) /a> b classarrow>/b> /li> li class > a hrefvul/ssrf/ssrf_fgc.php> i classmenu-icon fa fa-caret-right>/i> SSRF(file_get_content) /a> b classarrow>/b> /li> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon glyphicon glyphicon-cog>/i> span classmenu-text> 管理工具 /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefpkxss/index.php> i classmenu-icon fa fa-caret-right>/i> XSS后台 /a> b classarrow>/b> /li> /ul> /li> /ul>!-- /.nav-list --> div classsidebar-toggle sidebar-collapse idsidebar-collapse> i idsidebar-toggle-icon classace-icon fa fa-angle-double-left ace-save-state data-icon1ace-icon fa fa-angle-double-left data-icon2ace-icon fa fa-angle-double-right>/i> /div> /div>div classmain-content> div classmain-content-inner> div classbreadcrumbs ace-save-state idbreadcrumbs> ul classbreadcrumb> li classactive>系统介绍/li> /ul> /div>div classpage-content> div idintro_main> p classp1> Pikachu是一个带有漏洞的Web应用系统，在这里包含了常见的web安全漏洞。 如果你是一个Web渗透测试学习人员且正发愁没有合适的靶场进行练习，那么Pikachu可能正合你意。 /p> p classp2> h2 classv_title>Pikachu上的漏洞类型列表如下：/h2> ul classvul_list_info> li>Burt Force(暴力破解漏洞)/li> li>XSS(跨站脚本漏洞)/li> li>CSRF(跨站请求伪造)/li> li>SQL-Inject(SQL注入漏洞)/li> li>RCE(远程命令/代码执行)/li> li>Files Inclusion(文件包含漏洞)/li> li>Unsafe file downloads(不安全的文件下载)/li> li>Unsafe file uploads(不安全的文件上传)/li> li>Over Permisson(越权漏洞)/li> li>../../../(目录遍历)/li> li>I can see your ABC(敏感信息泄露)/li> li>PHP反序列化漏洞/li> li>XXE(XML External Entity attack)/li> li>不安全的URL重定向/li> li>SSRF(Server-Side Request Forgery)/li> li>More...(找找看?..有彩蛋!)/li> li>管理工具里面提供了一个简易的xss管理后台,供你测试钓鱼和捞cookie~/li> li>后续会持续更新一些新的漏洞进来,也欢迎你提交漏洞案例给我,最新版本请关注a hrefhttps://github.com/zhuifengshaonianhanlu>pikachu/a>/li> /ul> /p> p classp3> 每类漏洞根据不同的情况又分别设计了不同的子类br/> 同时,为了让这些漏洞变的有意思一些,在Pikachu平台上为每个漏洞都设计了一些小的场景,点击漏洞页面右上角的提示可以查看到帮助信息。 /p> h2>如何安装和使用/h2> p> Pikachu使用世界上最好的语言PHP进行开发-_-，数据库使用的是mysql，因此运行Pikachu你需要提前安装好PHP+MYSQL+中间件（如apache,nginx等）的基础环境，建议在你的测试环境直接使用 一些集成软件来搭建这些基础环境,比如XAMPP,WAMP等,作为一个搞安全的人,这些东西对你来说应该不是什么难事。接下来:br/> -->把下载下来的pikachu文件夹放到web服务器根目录下;br/> -->根据实际情况修改inc/config.inc.php里面的数据库连接配置;br/> -->访问http://x.x.x.x/pikachu,会有一个红色的热情提示欢迎使用,pikachu还没有初始化，点击进行初始化安装!,点击即可完成安装。 /p> p classp4> 我为Pikachu创建了一个QQ群(ID:532078894)，欢迎加进来和大家一起学习讨论。br/> 如果阁下对Pikachu有什么建议或者想找我聊聊可以发个邮件给我：1061321987@qq.com。谢谢。 /p> h2>切记/h2> p> 少就是多,慢就是快 /p> /div>/div>!-- /.page-content -->/div>/div>!-- /.main-content -->div classfooter> div classfooter-inner> div classfooter-content> span classbigger-120> Pikachu PIKA~ PIKA~© runner.han /span> /div> /div>/div>a href# idbtn-scroll-up classbtn-scroll-up btn btn-sm btn-inverse> i classace-icon fa fa-angle-double-up icon-only bigger-110>/i>/a>/div>!-- /.main-container -->!-- basic scripts -->!--if !IE> -->!-- !endif-->!--if IE>script srcassets/js/jquery-1.11.3.min.js>/script>!endif-->script typetext/javascript> if(ontouchstart in document.documentElement) document.write(script srcassets/js/jquery.mobile.custom.min.js>++/script>);/script>!-- page specific plugin scripts -->!--if lte IE 8>script srcassets/js/excanvas.min.js>/script>!endif-->script srcassets/js/jquery-ui.custom.min.js>/script>script srcassets/js/jquery.ui.touch-punch.min.js>/script>script srcassets/js/jquery.easypiechart.min.js>/script>script srcassets/js/jquery.sparkline.index.min.js>/script>script srcassets/js/jquery.flot.min.js>/script>script srcassets/js/jquery.flot.pie.min.js>/script>script srcassets/js/jquery.flot.resize.min.js>/script>!-- ace scripts -->script srcassets/js/ace-elements.min.js>/script>script srcassets/js/ace.min.js>/script>!-- inline scripts related to this page -->script> $(function (){ $(data-togglepopover).popover(); });/script>/body>/html>
Port 443
HTTP/1.1 200 OKAlt-Svc: quic:443; h3:443; h3-29:443; h3-27:443;h3-25:443; h3-T050:443; h3-Q050:443;h3-Q049:443;h3-Q048:443; h3-Q046:443; h3-Q043:443Content-Type: text/html;charsetutf-8Expires: Thu, 19 Nov 1981 08:52:00 GMTPragma: no-cacheSet-Cookie: PHPSESSIDavjf8es2c6undp6ovs9l7d8e96; path/Strict-Transport-Security: max-age31536000Vary: Accept-EncodingX-Xss-Protection: 1; modeblockServer: TencentEdgeOneCache-Control: must-revalidate, no-cache, no-store, post-check0, pre-check0Content-Length: 35389Connection: keep-aliveDate: Sun, 23 Nov 2025 01:23:03 GMTEO-LOG-UUID: 5392361760152221529EO-Cache-Status: MISS !DOCTYPE html>html langen>head> meta http-equivX-UA-Compatible contentIEedge,chrome1 /> meta charsetutf-8 /> title>Get the pikachu/title> meta namedescription contentoverview & stats /> meta nameviewport contentwidthdevice-width, initial-scale1.0, maximum-scale1.0 /> !-- bootstrap & fontawesome --> link relstylesheet hrefassets/css/bootstrap.min.css / > link relstylesheet hrefassets/font-awesome/4.5.0/css/font-awesome.min.css /> !-- page specific plugin styles --> !-- text fonts --> link relstylesheet hrefassets/css/fonts.googleapis.com.css /> !-- ace styles --> link relstylesheet hrefassets/css/ace.min.css classace-main-stylesheet idmain-ace-style /> !--if lte IE 9> link relstylesheet hrefassets/css/ace-part2.min.css classace-main-stylesheet /> !endif--> link relstylesheet hrefassets/css/ace-skins.min.css /> link relstylesheet hrefassets/css/ace-rtl.min.css /> !--if lte IE 9> link relstylesheet hrefassets/css/ace-ie.min.css /> !endif--> !-- inline styles related to this page --> !-- ace settings handler --> script srcassets/js/ace-extra.min.js>/script> !-- HTML5shiv and Respond.js for IE8 to support HTML5 elements and media queries --> !--if lte IE 8> script srcassets/js/html5shiv.min.js>/script> script srcassets/js/respond.min.js>/script> !endif--> script srcassets/js/jquery-2.1.4.min.js>/script> script srcassets/js/bootstrap.min.js>/script>/head>body classno-skin>div idnavbar classnavbar navbar-default ace-save-state> div classnavbar-container ace-save-state idnavbar-container> div classnavbar-header pull-left> a hrefindex.php classnavbar-brand> small> i classfa fa-key>/i> Pikachu 漏洞练习平台 pika~pika~ /small> /a> /div> div classnavbar-buttons navbar-header pull-right rolenavigation> ul classnav ace-nav> li classlight-blue dropdown-modal> a data-toggledropdown href# classdropdown-toggle> img classnav-user-photo srcassets/images/avatars/pikachu1.png altJasons Photo /> span classuser-info> small>欢迎/small> 骚年 /span> /a> /li> /ul> /div> /div>!-- /.navbar-container -->/div>div classmain-container ace-save-state idmain-container> script typetext/javascript> try{ace.settings.loadState(main-container)}catch(e){} /script> div idsidebar classsidebar responsive ace-save-state> script typetext/javascript> try{ace.settings.loadState(sidebar)}catch(e){} /script> ul classnav nav-list> li classactive open> a hrefindex.php> i classace-icon glyphicon glyphicon-tags>/i> span classmenu-text> 系统介绍 /span> /a> b classarrow>/b> /li> li class> a href# classdropdown-toggle> i classace-icon glyphicon glyphicon-lock>/i> span classmenu-text> 暴力破解 /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/burteforce/burteforce.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/burteforce/bf_form.php> i classmenu-icon fa fa-caret-right>/i> 基于表单的暴力破解 /a> b classarrow>/b> /li> li class> a hrefvul/burteforce/bf_server.php> i classmenu-icon fa fa-caret-right>/i> 验证码绕过(on server) /a> b classarrow>/b> /li> li class> a hrefvul/burteforce/bf_client.php> i classmenu-icon fa fa-caret-right>/i> 验证码绕过(on client) /a> b classarrow>/b> /li> li class> a hrefvul/burteforce/bf_token.php> i classmenu-icon fa fa-caret-right>/i> token防爆破? /a> b classarrow>/b> /li>!-- li class-->!-->-->!-- a href# classdropdown-toggle>-->!-- i classmenu-icon fa fa-caret-right>/i>-->!---->!-- test-->!-- b classarrow fa fa-angle-down>/b>-->!-- /a>-->!---->!-- b classarrow>/b>-->!---->!-- ul classsubmenu>-->!-- li class-->!-->-->!-- a hreftop-menu.html>-->!-- i classmenu-icon fa fa-caret-right>/i>-->!-- test sun 01-->!-- /a>-->!---->!-- b classarrow>/b>-->!-- /li>-->!---->!-- /ul>-->!-- /li>--> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon glyphicon glyphicon-indent-left>/i> span classmenu-text> Cross-Site Scripting /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/xss/xss.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/xss/xss_reflected_get.php> i classmenu-icon fa fa-caret-right>/i> 反射型xss(get) /a> b classarrow>/b> /li> li class > a hrefvul/xss/xsspost/post_login.php> i classmenu-icon fa fa-caret-right>/i> 反射型xss(post) /a> b classarrow>/b> /li> li class > a hrefvul/xss/xss_stored.php> i classmenu-icon fa fa-caret-right>/i> 存储型xss /a> b classarrow>/b> /li> li class > a hrefvul/xss/xss_dom.php> i classmenu-icon fa fa-caret-right>/i> DOM型xss /a> b classarrow>/b> /li> li class > a hrefvul/xss/xss_dom_x.php> i classmenu-icon fa fa-caret-right>/i> DOM型xss-x /a> b classarrow>/b> /li> li class > a hrefvul/xss/xssblind/xss_blind.php> i classmenu-icon fa fa-caret-right>/i> xss之盲打 /a> b classarrow>/b> /li> li class > a hrefvul/xss/xss_01.php> i classmenu-icon fa fa-caret-right>/i> xss之过滤 /a> b classarrow>/b> /li> li class > a hrefvul/xss/xss_02.php> i classmenu-icon fa fa-caret-right>/i> xss之htmlspecialchars /a> b classarrow>/b> /li> li class > a hrefvul/xss/xss_03.php> i classmenu-icon fa fa-caret-right>/i> xss之href输出 /a> b classarrow>/b> /li> li class > a hrefvul/xss/xss_04.php> i classmenu-icon fa fa-caret-right>/i> xss之js输出 /a> b classarrow>/b> /li> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon glyphicon glyphicon-share>/i> span classmenu-text> CSRF /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/csrf/csrf.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/csrf/csrfget/csrf_get_login.php> i classmenu-icon fa fa-caret-right>/i> CSRF(get) /a> b classarrow>/b> /li> li class > a hrefvul/csrf/csrfpost/csrf_post_login.php> i classmenu-icon fa fa-caret-right>/i> CSRF(post) /a> b classarrow>/b> /li> li class > a hrefvul/csrf/csrftoken/token_get_login.php> i classmenu-icon fa fa-caret-right>/i> CSRF Token /a> b classarrow>/b> /li> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon fa fa-fighter-jet>/i> span classmenu-text> SQL-Inject /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/sqli/sqli.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/sqli/sqli_id.php> i classmenu-icon fa fa-caret-right>/i> 数字型注入(post) /a> b classarrow>/b> /li> li class > a hrefvul/sqli/sqli_str.php> i classmenu-icon fa fa-caret-right>/i> 字符型注入(get) /a> b classarrow>/b> /li> li class > a hrefvul/sqli/sqli_search.php> i classmenu-icon fa fa-caret-right>/i> 搜索型注入 /a> b classarrow>/b> /li> li class > a hrefvul/sqli/sqli_x.php> i classmenu-icon fa fa-caret-right>/i> xx型注入 /a> b classarrow>/b> /li> li class > a hrefvul/sqli/sqli_iu/sqli_login.php> i classmenu-icon fa fa-caret-right>/i> insert/update注入 /a> b classarrow>/b> /li> li class > a hrefvul/sqli/sqli_del.php> i classmenu-icon fa fa-caret-right>/i> delete注入 /a> b classarrow>/b> /li> li class > a hrefvul/sqli/sqli_header/sqli_header_login.php> i classmenu-icon fa fa-caret-right>/i> http header注入 /a> b classarrow>/b> /li> li class > a hrefvul/sqli/sqli_blind_b.php> i classmenu-icon fa fa-caret-right>/i> 盲注(base on boolian) /a> b classarrow>/b> /li> li class > a hrefvul/sqli/sqli_blind_t.php> i classmenu-icon fa fa-caret-right>/i> 盲注(base on time) /a> b classarrow>/b> /li> li class > a hrefvul/sqli/sqli_widebyte.php> i classmenu-icon fa fa-caret-right>/i> 宽字节注入 /a> b classarrow>/b> /li> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon glyphicon glyphicon-pencil>/i> span classmenu-text> RCE /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/rce/rce.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/rce/rce_ping.php> i classmenu-icon fa fa-caret-right>/i> exec ping /a> b classarrow>/b> /li> li class > a hrefvul/rce/rce_eval.php> i classmenu-icon fa fa-caret-right>/i> exec evel /a> b classarrow>/b> /li> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon glyphicon glyphicon-file>/i> span classmenu-text> File Inclusion /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/fileinclude/fileinclude.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/fileinclude/fi_local.php> i classmenu-icon fa fa-caret-right>/i> File Inclusion(local) /a> b classarrow>/b> /li> li class > a hrefvul/fileinclude/fi_remote.php> i classmenu-icon fa fa-caret-right>/i> File Inclusion(remote) /a> b classarrow>/b> /li> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon glyphicon glyphicon-download>/i> span classmenu-text> Unsafe Filedownload /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/unsafedownload/unsafedownload.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/unsafedownload/down_nba.php> i classmenu-icon fa fa-caret-right>/i> Unsafe Filedownload /a> b classarrow>/b> /li> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon glyphicon glyphicon-upload>/i> span classmenu-text> Unsafe Fileupload /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/unsafeupload/upload.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/unsafeupload/clientcheck.php> i classmenu-icon fa fa-caret-right>/i> client check /a> b classarrow>/b> /li> li class > a hrefvul/unsafeupload/servercheck.php> i classmenu-icon fa fa-caret-right>/i> MIME type /a> b classarrow>/b> /li> li class > a hrefvul/unsafeupload/getimagesize.php> i classmenu-icon fa fa-caret-right>/i> getimagesize /a> b classarrow>/b> /li> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon glyphicon glyphicon-text-height>/i> span classmenu-text> Over Permission /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/overpermission/op.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/overpermission/op1/op1_login.php> i classmenu-icon fa fa-caret-right>/i> 水平越权 /a> b classarrow>/b> /li> li class > a hrefvul/overpermission/op2/op2_login.php> i classmenu-icon fa fa-caret-right>/i> 垂直越权 /a> b classarrow>/b> /li> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon glyphicon glyphicon-align-left>/i> span classmenu-text> ../../ /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/dir/dir.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/dir/dir_list.php> i classmenu-icon fa fa-caret-right>/i> 目录遍历 /a> b classarrow>/b> /li> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon glyphicon glyphicon-camera>/i> span classmenu-text> 敏感信息泄露 /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/infoleak/infoleak.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/infoleak/findabc.php> i classmenu-icon fa fa-caret-right>/i> IcanseeyourABC /a> b classarrow>/b> /li> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon glyphicon glyphicon-align-left>/i> span classmenu-text> PHP反序列化 /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/unserilization/unserilization.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/unserilization/unser.php> i classmenu-icon fa fa-caret-right>/i> PHP反序列化漏洞 /a> b classarrow>/b> /li> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon glyphicon glyphicon-flag>/i> span classmenu-text> XXE /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/xxe/xxe.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/xxe/xxe_1.php> i classmenu-icon fa fa-caret-right>/i> XXE漏洞 /a> b classarrow>/b> /li> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon glyphicon glyphicon-repeat>/i> span classmenu-text> URL重定向 /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/urlredirect/unsafere.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/urlredirect/urlredirect.php> i classmenu-icon fa fa-caret-right>/i> 不安全的URL跳转 /a> b classarrow>/b> /li> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon fa fa-exchange>/i> span classmenu-text> SSRF /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefvul/ssrf/ssrf.php> i classmenu-icon fa fa-caret-right>/i> 概述 /a> b classarrow>/b> /li> li class > a hrefvul/ssrf/ssrf_curl.php> i classmenu-icon fa fa-caret-right>/i> SSRF(curl) /a> b classarrow>/b> /li> li class > a hrefvul/ssrf/ssrf_fgc.php> i classmenu-icon fa fa-caret-right>/i> SSRF(file_get_content) /a> b classarrow>/b> /li> /ul> /li> li class> a href# classdropdown-toggle> i classace-icon glyphicon glyphicon-cog>/i> span classmenu-text> 管理工具 /span> b classarrow fa fa-angle-down>/b> /a> b classarrow>/b> ul classsubmenu> li class > a hrefpkxss/index.php> i classmenu-icon fa fa-caret-right>/i> XSS后台 /a> b classarrow>/b> /li> /ul> /li> /ul>!-- /.nav-list --> div classsidebar-toggle sidebar-collapse idsidebar-collapse> i idsidebar-toggle-icon classace-icon fa fa-angle-double-left ace-save-state data-icon1ace-icon fa fa-angle-double-left data-icon2ace-icon fa fa-angle-double-right>/i> /div> /div>div classmain-content> div classmain-content-inner> div classbreadcrumbs ace-save-state idbreadcrumbs> ul classbreadcrumb> li classactive>系统介绍/li> /ul> /div>div classpage-content> div idintro_main> p classp1> Pikachu是一个带有漏洞的Web应用系统，在这里包含了常见的web安全漏洞。 如果你是一个Web渗透测试学习人员且正发愁没有合适的靶场进行练习，那么Pikachu可能正合你意。 /p> p classp2> h2 classv_title>Pikachu上的漏洞类型列表如下：/h2> ul classvul_list_info> li>Burt Force(暴力破解漏洞)/li> li>XSS(跨站脚本漏洞)/li> li>CSRF(跨站请求伪造)/li> li>SQL-Inject(SQL注入漏洞)/li> li>RCE(远程命令/代码执行)/li> li>Files Inclusion(文件包含漏洞)/li> li>Unsafe file downloads(不安全的文件下载)/li> li>Unsafe file uploads(不安全的文件上传)/li> li>Over Permisson(越权漏洞)/li> li>../../../(目录遍历)/li> li>I can see your ABC(敏感信息泄露)/li> li>PHP反序列化漏洞/li> li>XXE(XML External Entity attack)/li> li>不安全的URL重定向/li> li>SSRF(Server-Side Request Forgery)/li> li>More...(找找看?..有彩蛋!)/li> li>管理工具里面提供了一个简易的xss管理后台,供你测试钓鱼和捞cookie~/li> li>后续会持续更新一些新的漏洞进来,也欢迎你提交漏洞案例给我,最新版本请关注a hrefhttps://github.com/zhuifengshaonianhanlu>pikachu/a>/li> /ul> /p> p classp3> 每类漏洞根据不同的情况又分别设计了不同的子类br/> 同时,为了让这些漏洞变的有意思一些,在Pikachu平台上为每个漏洞都设计了一些小的场景,点击漏洞页面右上角的提示可以查看到帮助信息。 /p> h2>如何安装和使用/h2> p> Pikachu使用世界上最好的语言PHP进行开发-_-，数据库使用的是mysql，因此运行Pikachu你需要提前安装好PHP+MYSQL+中间件（如apache,nginx等）的基础环境，建议在你的测试环境直接使用 一些集成软件来搭建这些基础环境,比如XAMPP,WAMP等,作为一个搞安全的人,这些东西对你来说应该不是什么难事。接下来:br/> -->把下载下来的pikachu文件夹放到web服务器根目录下;br/> -->根据实际情况修改inc/config.inc.php里面的数据库连接配置;br/> -->访问http://x.x.x.x/pikachu,会有一个红色的热情提示欢迎使用,pikachu还没有初始化，点击进行初始化安装!,点击即可完成安装。 /p> p classp4> 我为Pikachu创建了一个QQ群(ID:532078894)，欢迎加进来和大家一起学习讨论。br/> 如果阁下对Pikachu有什么建议或者想找我聊聊可以发个邮件给我：1061321987@qq.com。谢谢。 /p> h2>切记/h2> p> 少就是多,慢就是快 /p> /div>/div>!-- /.page-content -->/div>/div>!-- /.main-content -->div classfooter> div classfooter-inner> div classfooter-content> span classbigger-120> Pikachu PIKA~ PIKA~© runner.han /span> /div> /div>/div>a href# idbtn-scroll-up classbtn-scroll-up btn btn-sm btn-inverse> i classace-icon fa fa-angle-double-up icon-only bigger-110>/i>/a>/div>!-- /.main-container -->!-- basic scripts -->!--if !IE> -->!-- !endif-->!--if IE>script srcassets/js/jquery-1.11.3.min.js>/script>!endif-->script typetext/javascript> if(ontouchstart in document.documentElement) document.write(script srcassets/js/jquery.mobile.custom.min.js>++/script>);/script>!-- page specific plugin scripts -->!--if lte IE 8>script srcassets/js/excanvas.min.js>/script>!endif-->script srcassets/js/jquery-ui.custom.min.js>/script>script srcassets/js/jquery.ui.touch-punch.min.js>/script>script srcassets/js/jquery.easypiechart.min.js>/script>script srcassets/js/jquery.sparkline.index.min.js>/script>script srcassets/js/jquery.flot.min.js>/script>script srcassets/js/jquery.flot.pie.min.js>/script>script srcassets/js/jquery.flot.resize.min.js>/script>!-- ace scripts -->script srcassets/js/ace-elements.min.js>/script>script srcassets/js/ace.min.js>/script>!-- inline scripts related to this page -->script> $(function (){ $(data-togglepopover).popover(); });/script>/body>/html>
View on OTX
|
View on ThreatMiner
Please enable JavaScript to view the
comments powered by Disqus.
Data with thanks to
AlienVault OTX
,
VirusTotal
,
Malwr
and
others
. [
Sitemap
]