sullo

WAFっていいな。簡単なペネトレ全部防げそう root@dev-bot:~# nmap example.com Starting Nmap 7.95 ( https://nmap.org ) at 2026-11-03 13:22 UTC Nmap scan report for nmap example.com (104.21.20.26) Host is up (0.0046s latency). Other addresses for nmap example.com (not scanned): 172.67.190.251 2606:4700:3037::6815:141a 2606:4700:3035::ac43:befb Not shown: 998 filtered tcp ports (no-response) PORT STATE SERVICE 80/tcp open http 443/tcp open https Nmap done: 1 IP address (1 host up) scanned in 4.74 seconds curl -I example.com #--- HTTP/1.1 200 OK Date: Tue, 03 Nov 2026 13:24:38 GMT Content-Type: text/html Connection: keep-alive CF-Cache-Status: HIT Cache-Control: public, max-age=0, must-revalidate Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Pbe8W5nVe0oNQVKN8w0qKmjlbI...略"}]} Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} Server: cloudflare CF-RAY: a54bb34f3c92d472-NRT alt-svc: h3=":443"; ma=86400 何のページがあるのかわからない..そんなときはこれ。 zenn.dev note.com github.com/matteo741/Gobuster/blob/main/wordlist.… sudo apt update && sudo apt install -y gobuster dirb #gobuster --help gobuster dir -u http://study-hack-come.com -w /usr/share/wordlists/dirb/common.txt wordlist1.txtにワードのリストをはりつけ。 gobuster dir -u https://example.com -w wordlist1.txt 結果 =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: https://example.com [+] Method: GET [+] Threads: 10 [+] Wordlist: wordlist1.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /robots.txt (Status: 200) [Size: 1248] /wp-config.php (Status: 403) [Size: 4917] /admin (Status: 401) [Size: 27] /index (Status: 307) [Size: 0] [--> /] Progress: 1828 / 1829 (99.95%) =============================================================== Finished =============================================================== gobuster dir -u https://example.com -w wordlist1.txt -x php,html,txt -o gobuster-basic.txt 結果 # gobuster-basic.txtからでも確認できる。 =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: https://example.com [+] Method: GET [+] Threads: 10 [+] Wordlist: wordlist1.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Extensions: php,html,txt [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /robots.txt (Status: 200) [Size: 1248] /wp-config.php (Status: 403) [Size: 4917] /wp-config.php.html (Status: 403) [Size: 4917] /wp-config.php.php (Status: 403) [Size: 4917] /wp-config.php.txt (Status: 403) [Size: 4917] /admin (Status: 401) [Size: 27] /index.html (Status: 307) [Size: 0] [--> /] /index (Status: 307) [Size: 0] [--> /] Progress: 7312 / 7316 (99.95%) =============================================================== Finished =============================================================== robots.txtを確認する。 検索エンジンのクローラーにここは検索結果に載せるなと指示する設定ファイル curl -s https://example.com/robots.txt 特になにもなかった。 # As a condition of accessing this website, you agree to abide by the following # content signals: # (a) If a content-signal = yes, you may collect content for the corresponding # use. # (b) If a content-signal = no, you may not collect content for the # corresponding use. # (c) If the website operator does not include a content signal for a # corresponding use, the website operator neither grants nor restricts # permission via content signal with respect to the corresponding use. # The content signals and their meanings are: # search: building a search index and providing search results (e.g., returning # hyperlinks and short excerpts from your website's contents). Search does not # include providing AI-generated search summaries. # ai-input: inputting content into one or more AI models (e.g., retrieval # augmented generation, grounding, or other real-time taking of content for # generative AI search answers). # ai-train: training or fine-tuning AI models. # ANY RESTRICTIONS EXPRESSED VIA CONTENT SIGNALS ARE EXPRESS RESERVATIONS OF # RIGHTS UNDER ARTICLE 4 OF THE EUROPEAN UNION DIRECTIVE 2019/790 ON COPYRIGHT # AND RELATED RIGHTS IN THE DIGITAL SINGLE MARKET. WordPress専用スキャンを試す cubepath.com sudo apt update sudo apt install curl unzip jq NUCLEI_VERSION=$(curl -fsSL https://api.github.com/repos/projectdiscovery/nuclei/releases/latest | jq -r .tag_name | sed 's/^v//') echo "$NUCLEI_VERSION" cd "$(mktemp -d)" curl -fsSLO "https://github.com/projectdiscovery/nuclei/releases/download/v${NUCLEI_VERSION}/nuclei_${NUCLEI_VERSION}_linux_amd64.zip" curl -fsSLO "https://github.com/projectdiscovery/nuclei/releases/download/v${NUCLEI_VERSION}/nuclei_${NUCLEI_VERSION}_checksums.txt" sha256sum --check --ignore-missing "nuclei_${NUCLEI_VERSION}_checksums.txt" # nuclei_3.11.1_linux_amd64.zip: OK を期待 unzip nuclei_*_linux_amd64.zip nuclei sudo install -m 0755 nuclei /usr/local/bin/nuclei nuclei -version #バージョン表示を確認 テンプレートをダウンロードする nuclei -update-templates ファイルを確認 ls /root/nuclei-templates #--- CODE_OF_CONDUCT.md TEMPLATES-STATS.md headless CONTRIBUTING.md TOP-10.md helpers LICENSE.md cloud http PULL_REQUEST_TEMPLATE.md code javascript README_CN.md contributors.json network README_JA.md cves.json profiles README_KR.md cves.json-checksum.txt ssl TEMPLATE-CREATION-GUIDE.md dast templates-checksum.txt TEMPLATE-REVIEW-GUIDE.md dns workflows TEMPLATES-STATS.json file 試しに実行 nuclei -u https://example.com -severity high,critical -rate-limit 50 -stats 結果 [INF] Scan completed in 3m. 0 matches found. [INF] HTTP connections: 5911 total, 1894 new, 4017 reused (68.0%) [0:03:06] | Templates: 4457 | Hosts: 1 | RPS: 57 | Matched: 0 | Errors: 22 | Requests: 10615/10782 (98%) なにもなしと。 本題のwordpress topscoder/nuclei-wordfence-cve export GITHUB_TEMPLATE_REPO=topscoder/nuclei-wordfence-cve nuclei -update-templates 期待する結果 [INF] No new updates found for nuclei templates [INF] Repo topscoder/nuclei-wordfence-cve cloned successfully at /root/nuclei-templates/github/topscoder/nuclei-wordfence-cve 早速試す nuclei -t github/topscoder/nuclei-wordfence-cve -u https://example.com -o results.jsonl # Deepl # 特定の CVE に関連する脆弱性をスキャンするには # nuclei -t github/topscoder/nuclei-wordfence-cve -template-id cve-2023-32961 -u https://target.com # 重大なものだけスキャン # nuclei -t github/topscoder/nuclei-wordfence-cve -severity critical -u https://target.com # WordPress コアの脆弱性のみをスキャンするには、次のコマンドを実行します。 # nuclei -t github/topscoder/nuclei-wordfence-cve -tags wp-core -u https://target.com # WordPress プラグインの脆弱性のみをスキャンするには、次のコマンドを実行してください： # nuclei -t github/topscoder/nuclei-wordfence-cve -tags wp-plugin -u https://target.com nuclei -t github/topscoder/nuclei-wordfence-cve -tags wp-plugin -u https://target.com nuclei -t github/topscoder/nuclei-wordfence-cve -tags wp-plugin -u rico-diary.com jqを使って深刻度ごとに表示 jq -r '.info.severity' results.jsonl | sort | uniq -c CMSeekを試す WebサイトのCMS検出・脆弱性スキャンツール Tuhinshubhra/CMSeeK sudo apt update sudo apt install git python3 python3-pip -y git clone https://github.com/Tuhinshubhra/CMSeeK cd CMSeeK curl -LsSf https://astral.sh/uv/install.sh | sh source ~/.bashrc #source ~/.bashrc uv venv && source .venv/bin/activate uv pip install -r requirements.txt 試す python3 cmseek.py -u example.com Niktoを試す omomuki-tech.com sudo apt update sudo apt install -y perl libxml-parser-perl　libxml-writer-perl git clone https://github.com/sullo/nikto.git cd nikto/program perl nikto.pl -Version 試す perl nikto.pl -h https://example.com -ssl # 80の時は perl nikto.pl -h http://example.com 保存形式 # テキスト形式で保存 perl nikto.pl -h http://example.com -o scan_result.txt -Format txt # HTML形式で保存 perl nikto.pl -h http://example.com -o scan_result.html -Format htm # CSV形式で保存 perl nikto.pl -h http://example.com -o scan_result.csv -Format csv # XML形式で保存 perl nikto.pl -h http://example.com -o scan_result.xml -Format xml # JSON形式で保存 perl nikto.pl -h http://example.com -o scan_result.json -Format json 結果をみる。 - Nikto v2.6.1/ + Target Host: example.com + Target Port: 443 + GET /: An alt-svc header was found which is advertising HTTP/3. The endpoint is: ':443'. Nikto cannot test HTTP/3 over QUIC. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/alt-svc: + GET /: Cloudflare detected via cf-ray header. Recommend proxying via Burp or mitmproxy to avoid TLS fingerprint blocks. See: https://github.com/sullo/nikto/wiki/Using-a-Proxy: + SSL Info: Subject: /CN=example.com CN: example.com SAN: example.com, www.example.com, *.www.example.com Ciphers: TLS_AES_256_GCM_SHA384 Issuer: /C=US/O=Google Trust Services/CN=WE1 + GET /: cloudflare - Cloudflare detected via banner. Recommend proxying via Burp or mitmproxy to avoid TLS fingerprint blocks if not already proxying. SSL/TLS証明書検索 platform.censys.io