web渗透安全测试.docVIP

Web渗透安全测试 2012-04-12 10:47:41 ?????? 当我们进行安全渗透测试的时候，首先要做的就是尽可能多地收集目标应用程序信息，所以，信息搜集是渗透测试一个必不可少的步骤。这项任务可以通过多种不同的方式来完成，通过使用有哪些信誉好的足球投注网站引擎、扫描器、发送简单的HTTP请求或者专门精心制作的请求，都有可能导致应用程序泄漏诸如错误信息、版本信息以及所使用的技术等信息。?一、测试robots.txt文件?现在，我们首先介绍如何测试robots.txt文件。Web蜘蛛/机器人/爬虫可以用来检索网页，并沿着超链接进一步探索更多、更深的Web内容。当然，网站可以在根目录放上一个robots.txt文件，这样就可以规定哪些Web蜘蛛行为是站点可以接受的，那些是禁止的。?举例来说，我们可以看一下/robots.txt的内容片断： ? User-agent: * Disallow: /search Disallow: /sdch Disallow: /groups Disallow: /images Disallow: /catalogs Allow: /catalogs/about Allow: /catalogs/p? Disallow: /catalogues Disallow: /news Allow: /news/directory Disallow: /nwshp Disallow: /setnewsprefs? Disallow: /index.html? Disallow: /? Allow: /?hl= Disallow: /?hl=* Disallow: /addurl/image? Disallow: /pagead/ Disallow: /relpage/ Disallow: /relcontent Disallow: /imgres Disallow: /imglanding Disallow: /sbd Disallow: /keyword/ Disallow: /u/ Disallow: /univ/ Disallow: /cobrand Disallow: /custom Disallow: /advanced_group_search Disallow: /googlesite Disallow: /preferences Disallow: /setprefs Disallow: /swr Disallow: /url Disallow: /default Disallow: /m? Disallow: /m/? Disallow: /m/blogs? Disallow: /m/directions? Disallow: /m/ig Disallow: /m/images? Disallow: /m/imgres? Disallow: /m/local? Disallow: /m/movies? Disallow: /m/news? Disallow: /m/news/i? Disallow: /m/place? Disallow: /m/products? Disallow: /m/products/ Disallow: /m/setnewsprefs? Disallow: /m/search? Disallow: /m/swmloptin? Disallow: /m/trends Disallow: /m/video? Disallow: /wml? Disallow: /wml/? Disallow: /wml/search? Disallow: /xhtml? Disallow: /xhtml/? Disallow: /xhtml/search? Disallow: /xml? Disallow: /imode? Disallow: /imode/? Disallow: /imode/search? Disallow: /jsky? Disallow: /jsky/? Disallow: /jsky/search? Disallow: /pda? Disallow: /pda/? Disallow: /pda/search? Disallow: /sprint_xhtml Disallow: /sprint_wml Disallow: /pqa Disallow: /palm Disallow: /gwt/ Disallow: /purchases Disallow: /hws Disallow: /bsd? Disallow: /linux? Disallow: /mac? Disallow: /microsoft? Disallow: /unclesam? Disallo