0
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

@osakana0_0b(OSAKANA)

WAFっていいな。簡単なペネトレ全部防げそう

0
Last updated at Posted at 2026-11-03
root@dev-bot:~# nmap example.com
Starting Nmap 7.95 ( https://nmap.org ) at 2026-11-03 13:22 UTC
Nmap scan report for nmap example.com (104.21.20.26)
Host is up (0.0046s latency).
Other addresses for nmap example.com (not scanned): 172.67.190.251 2606:4700:3037::6815:141a 2606:4700:3035::ac43:befb
Not shown: 998 filtered tcp ports (no-response)
PORT    STATE SERVICE
80/tcp  open  http
443/tcp open  https

Nmap done: 1 IP address (1 host up) scanned in 4.74 seconds

curl -I example.com
#---
HTTP/1.1 200 OK
Date: Tue, 03 Nov 2026 13:24:38 GMT
Content-Type: text/html
Connection: keep-alive
CF-Cache-Status: HIT
Cache-Control: public, max-age=0, must-revalidate
Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Pbe8W5nVe0oNQVKN8w0qKmjlbI...略"}]}
Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
Server: cloudflare
CF-RAY: a54bb34f3c92d472-NRT
alt-svc: h3=":443"; ma=86400

何のページがあるのかわからない..そんなときはこれ。

sudo apt update && sudo apt install -y gobuster dirb
#gobuster --help

gobuster dir -u http://study-hack-come.com -w /usr/share/wordlists/dirb/common.txt

wordlist1.txtにワードのリストをはりつけ。

gobuster dir -u https://example.com -w wordlist1.txt

結果

===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     https://example.com
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                wordlist1.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/robots.txt           (Status: 200) [Size: 1248]
/wp-config.php        (Status: 403) [Size: 4917]
/admin                (Status: 401) [Size: 27]
/index                (Status: 307) [Size: 0] [--> /]
Progress: 1828 / 1829 (99.95%)
===============================================================
Finished
===============================================================

gobuster dir -u https://example.com -w wordlist1.txt -x php,html,txt -o gobuster-basic.txt

結果

# gobuster-basic.txtからでも確認できる。
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     https://example.com
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                wordlist1.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              php,html,txt
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/robots.txt           (Status: 200) [Size: 1248]
/wp-config.php        (Status: 403) [Size: 4917]
/wp-config.php.html   (Status: 403) [Size: 4917]
/wp-config.php.php    (Status: 403) [Size: 4917]
/wp-config.php.txt    (Status: 403) [Size: 4917]
/admin                (Status: 401) [Size: 27]
/index.html           (Status: 307) [Size: 0] [--> /]
/index                (Status: 307) [Size: 0] [--> /]
Progress: 7312 / 7316 (99.95%)
===============================================================
Finished
===============================================================

robots.txtを確認する。

検索エンジンのクローラーにここは検索結果に載せるなと指示する設定ファイル

curl -s https://example.com/robots.txt

特になにもなかった。

# As a condition of accessing this website, you agree to abide by the following
# content signals:
# (a)  If a content-signal = yes, you may collect content for the corresponding
#      use.
# (b)  If a content-signal = no, you may not collect content for the
#      corresponding use.
# (c)  If the website operator does not include a content signal for a
#      corresponding use, the website operator neither grants nor restricts
#      permission via content signal with respect to the corresponding use.
# The content signals and their meanings are:
# search:   building a search index and providing search results (e.g., returning
#           hyperlinks and short excerpts from your website's contents). Search does not
#           include providing AI-generated search summaries.
# ai-input: inputting content into one or more AI models (e.g., retrieval
#           augmented generation, grounding, or other real-time taking of content for
#           generative AI search answers).
# ai-train: training or fine-tuning AI models.
# ANY RESTRICTIONS EXPRESSED VIA CONTENT SIGNALS ARE EXPRESS RESERVATIONS OF
# RIGHTS UNDER ARTICLE 4 OF THE EUROPEAN UNION DIRECTIVE 2019/790 ON COPYRIGHT
# AND RELATED RIGHTS IN THE DIGITAL SINGLE MARKET.

WordPress専用スキャンを試す

sudo apt update
sudo apt install curl unzip jq
NUCLEI_VERSION=$(curl -fsSL https://api.github.com/repos/projectdiscovery/nuclei/releases/latest | jq -r .tag_name | sed 's/^v//')
echo "$NUCLEI_VERSION"
cd "$(mktemp -d)"
curl -fsSLO "https://github.com/projectdiscovery/nuclei/releases/download/v${NUCLEI_VERSION}/nuclei_${NUCLEI_VERSION}_linux_amd64.zip"
curl -fsSLO "https://github.com/projectdiscovery/nuclei/releases/download/v${NUCLEI_VERSION}/nuclei_${NUCLEI_VERSION}_checksums.txt"
sha256sum --check --ignore-missing "nuclei_${NUCLEI_VERSION}_checksums.txt"
# nuclei_3.11.1_linux_amd64.zip: OK を期待
unzip nuclei_*_linux_amd64.zip nuclei
sudo install -m 0755 nuclei /usr/local/bin/nuclei
nuclei -version
#バージョン表示を確認

テンプレートをダウンロードする

nuclei -update-templates

ファイルを確認

ls /root/nuclei-templates  
#---
CODE_OF_CONDUCT.md          TEMPLATES-STATS.md      headless
CONTRIBUTING.md             TOP-10.md               helpers
LICENSE.md                  cloud                   http
PULL_REQUEST_TEMPLATE.md    code                    javascript
README_CN.md                contributors.json       network
README_JA.md                cves.json               profiles
README_KR.md                cves.json-checksum.txt  ssl
TEMPLATE-CREATION-GUIDE.md  dast                    templates-checksum.txt
TEMPLATE-REVIEW-GUIDE.md    dns                     workflows
TEMPLATES-STATS.json        file

試しに実行

nuclei -u https://example.com -severity high,critical -rate-limit 50 -stats

結果

[INF] Scan completed in 3m. 0 matches found.
[INF] HTTP connections: 5911 total, 1894 new, 4017 reused (68.0%)
[0:03:06] | Templates: 4457 | Hosts: 1 | RPS: 57 | Matched: 0 | Errors: 22 | Requests: 10615/10782 (98%)

なにもなしと。

本題のwordpress

export GITHUB_TEMPLATE_REPO=topscoder/nuclei-wordfence-cve
nuclei -update-templates

期待する結果

[INF] No new updates found for nuclei templates
[INF] Repo topscoder/nuclei-wordfence-cve cloned successfully at /root/nuclei-templates/github/topscoder/nuclei-wordfence-cve

早速試す

nuclei -t github/topscoder/nuclei-wordfence-cve -u https://example.com -o results.jsonl
# Deepl
# 特定の CVE に関連する脆弱性をスキャンするには
# nuclei -t github/topscoder/nuclei-wordfence-cve -template-id cve-2023-32961 -u https://target.com
# 重大なものだけスキャン
# nuclei -t github/topscoder/nuclei-wordfence-cve -severity critical -u https://target.com
# WordPress コアの脆弱性のみをスキャンするには、次のコマンドを実行します。
# nuclei -t github/topscoder/nuclei-wordfence-cve -tags wp-core -u https://target.com
# WordPress プラグインの脆弱性のみをスキャンするには、次のコマンドを実行してください：
# nuclei -t github/topscoder/nuclei-wordfence-cve -tags wp-plugin -u https://target.com
nuclei -t github/topscoder/nuclei-wordfence-cve -tags wp-plugin -u https://target.com

jqを使って深刻度ごとに表示

jq -r '.info.severity' results.jsonl | sort | uniq -c

CMSeekを試す WebサイトのCMS検出・脆弱性スキャンツール

sudo apt update
sudo apt install git python3 python3-pip -y
git clone https://github.com/Tuhinshubhra/CMSeeK
cd CMSeeK

curl -LsSf https://astral.sh/uv/install.sh | sh
source ~/.bashrc
#source ~/.bashrc
uv venv && source .venv/bin/activate
uv pip install -r requirements.txt

試す

python3 cmseek.py -u example.com

Niktoを試す

sudo apt update
sudo apt install -y perl libxml-parser-perl　libxml-writer-perl
git clone https://github.com/sullo/nikto.git
cd nikto/program

perl nikto.pl -Version

試す

perl nikto.pl -h https://example.com -ssl 
# 80の時は
perl nikto.pl -h http://example.com

保存形式

# テキスト形式で保存
perl nikto.pl -h http://example.com -o scan_result.txt -Format txt
# HTML形式で保存
perl nikto.pl -h http://example.com -o scan_result.html -Format htm
# CSV形式で保存
perl nikto.pl -h http://example.com -o scan_result.csv -Format csv
# XML形式で保存
perl nikto.pl -h http://example.com -o scan_result.xml -Format xml
# JSON形式で保存
perl nikto.pl -h http://example.com -o scan_result.json -Format json

結果をみる。

- Nikto v2.6.1/
+ Target Host: example.com
+ Target Port: 443
+ GET /: An alt-svc header was found which is advertising HTTP/3. The endpoint is: ':443'. Nikto cannot test HTTP/3 over QUIC. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/alt-svc: 
+ GET /: Cloudflare detected via cf-ray header. Recommend proxying via Burp or mitmproxy to avoid TLS fingerprint blocks. See: https://github.com/sullo/nikto/wiki/Using-a-Proxy: 
+ SSL Info:           Subject:  /CN=example.com
                      CN:       example.com
                      SAN:      example.com, www.example.com, *.www.example.com
                      Ciphers:  TLS_AES_256_GCM_SHA384
                      Issuer:   /C=US/O=Google Trust Services/CN=WE1
+ GET /: cloudflare - Cloudflare detected via banner. Recommend proxying via Burp or mitmproxy to avoid TLS fingerprint blocks if not already proxying.

SSL/TLS証明書検索

platform.censys.io

0
0
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
Sign upLogin
0
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?