A Brief Summary of Primary Interview of Security Engineer

Pre-Knowledge

• Server-related information (real IP, system type, version open port, WAF, etc.)

• Website fingerprint recognition (CMS, CDN, certificate, DNS record, etc.)

• Whois information, name, filing, email, telephone contrast (the mailbox is lost to the social work library, social work preparation, etc.)

• Collection of subdomains, side stations, section C, etc.

• Google hacking targeted search, PDF files, middleware versions, weak password scanning, etc.

• Scan the website directory structure, explode the background, website banner, test files, backups and other sensitive files leaks, etc.

• Protocol, common vulnerabilities, GitHub source code, etc.

Vulnerability Mining

• Browse the website, check the scale, function points, and characteristics of the website.

• Ports, weak passwords, directory scanning, vulnerability detection on response ports, weak passwords for MySQL, FTP, ssh, etc.

• Start to detect vulnerabilities, such as XSS, SSRF, SQL injection, code execution, command execution, unauthorized access, arbitrary file reading, downloading, file inclusion, remote command execution, weak password, editor vulnerability, brute force cracking, replay attack, server Vulnerability detection, and finally use missing scanning tools, etc.

• CMS: Content management system, located in the front-end and back-end office systems, generally you can search for the corresponding source code or version vulnerabilities.

• CDN: An intelligent virtual network built on the basis of the existing network, relying on edge servers deployed in various places, through the load balancing, content distribution, scheduling, and other functional modules of the central platform, so that users can obtain the required content nearby and reduce network congestion. Improve user access response speed and hit rate.

• Use Google search to find information such as background, user information leakage, source code leakage, unauthorized access, MDB file download, website configuration password, php remote file containing vulnerabilities, and other information.

• Middleware: It is an independent system software or service program that connects applications or systems, and can still exchange information even with different interfaces

Vulnerability & Privilege Escalation

• MySQL escalation, serv-u escalation, oracle escalation

• Linux kernel vulnerability escalation

• Windows overflow privilege escalation

Summary of questions that may be interviewed

• Emergency thinking: first intercept the attack package body and log analysis through the security equipment to understand what kind of attack the attacker has carried out, and further judge the attacker's attack method through the combination of black and white simulation methods. After recurrence, the vulnerabilities are repaired and the attacker can be traced back to the source.

• The idea of ​​tracing the source: first analyze the attacker’s IP and attack method through system logs, security equipment intercepted attack packets, etc., use web shell or Trojan to perform micro-step analysis, or go to the Anheng Threat Intelligence Center for IP detection and analysis. Is it a cloud server? , Base station, etc., if it is a cloud server, you can directly reverse osmosis, look at the open ports, domain names, whois, etc. to judge, get the name and phone number, etc., lose the social work database to see if you can find more information and then call it a day

• What projects have been done: After receiving some projects, you can use Mizusawa to collect information on target assets or lighthouses. Do a good job of collecting information to determine whether the framework has Shiro deserialization and struct command execution. The framework cannot be tested one by one. Then there are several kinds of weak passwords, entering the background, template injection, uploading loopholes, and getting shell permissions. What I think is more interesting is that the machine I encountered this time, the normal rotten potatoes cannot be elevated. Finally found that he has a 3306 MySQL service, and found the password in the website source code and has root privileges, and then used the MySQL UDF to increase the privilege, directly upload the UDF file that comes with sqlmap, use the hexadecimal transmission, and finally increase the privilege, To execute the anti-virus system, immediately call Cs, obtain the account and password of the current server, and use the hash to pass the horizontal direction. It is found that it is a large network segment. Scan the code on the IP segment of the intranet to check the website, and collect information again. For ssh, MySQL, SQL Server, 3389, horizontal movement can basically get a large number of machines. The domain controller uses the captured domain controller login account and password, and finally, the gold and silver receipts, to get the domain controller. In the case of the intranet, I think it is a weak password blasting, escalation of rights after obtaining the password, etc.

• Equipment: Wireshark will automatically match the data packet that may be an attack, and then judge whether it is an attack based on the data packet. Burp Suite will extract the URLs. The request modifying, payloads inserted brute-forcing webserver to extract data.

• How to troubleshoot memory horses: If you find some traces of memory web shell, you need to have a troubleshooting idea to track and analyze, and also list a troubleshooting idea based on the principles of each type

• If it is jsp injection, in the log Troubleshoot access requests that can be jsp. 

• If it is a code execution vulnerability, check the error.log of the middleware to see if there is a suspicious error, and determine the injection time and method. 

• Check for possible java code execution vulnerabilities according to the components used in the business. If the spring controller is of the type, look up the log according to the URL reported to the web shell, filter, or listener type, there may be more than 404 requests with parameters.

• Honeypot phishing: usually deploy a middleware page or background page, once it is attacked, it will obtain part of the attacker's information.

• How to analyze the message: According to the data packet, use the platform or Wireshark to analyze which attack payload is the attack path or where is the interface?

Get a station to be tested, what do you think should be done first

Collect Message

SQL Injection Prevention

PUT vulnerability, short file name guessing, remote code execution, parsing vulnerability

Parsing loopholes, directory traversal

File analysis, directory traversal, CRLF injection, directory traversal

Deserialization vulnerability, war backdoor file deployment

Deserialization vulnerability SSRF arbitrary file upload war backdoor file deployment

Shiro rememberMe (Shiro-550) Shiro Padding Oracle Attack(Shiro-721)

SQL injection
Invalid authentication
Leakage of sensitive data
XML external entity (XXE)
Invalid access control
Security configuration error
Cross-site scripting (XSS)
Insufficient logging and monitoring
Unsafe deserialization
Use components with known vulnerabilities

Flow Analysis

• Filter IP:
• Filter source IP address:; ip.src==1.1.1.1Filter destination ip address: ip.dst==1.1.1.1

• Through the port:
• Filter 80 port:, tcp.port==80 source port:, tcp.srcport=80 destination port: tcp.dsttport==80

• Protocol filtering:
• Just enter the protocol name directly, http or https

• http mode filtering:
• Filter get/post package http.request.mothod== "GET/POST"