´ÓÃâ·ÑµÄÎïÁªÍø·À»ðǽhihttps̸»úÆ÷ѧϰ֮Éú³É¶Ô¿¹¹æÔò

 hihttpsÊÇÒ»¿î»ùÓÚMQTTµÄÃâ·ÑµÄÎïÁªÍø·À»ðǽ£¬Í¬Ê±Ò²ÊÇwebÓ¦Ó÷À»ðǽ£¬¼ÈÖ§³Ö´«Í³µÄ¼ì²â¹¦ÄÜÈçSQL×¢Èë¡¢XSS¡¢¶ñÒ⩶´É¨Ãè¡¢ÃÜÂ뱩Á¦Æƽ⡢CC¡¢DDOSµÈ£©£¬ÓÖÖ§³ÖÎ޼ල»úÆ÷ѧϰ£¬×ÔÖ÷¶Ô¿¹£¬ÖØж¨ÒåÍøÂ簲ȫ¡£

½ñÌì±ÊÕ߾ʹÓÎïÁªÍø°²È«µÄ½Ç¶È£¬½éÉÜhihttpsÔõÑùͨ¹ý»úÆ÷ѧϰ×Ô¶¯Éú³É¶Ô¿¹¹æÔòµÄ5¸ö¹ý³Ì£º

 

 

Ò»¡¢   Ñù±¾²É¼¯

MQTTÊÇÎïÁªÍøloT×î¹ã·º²ÉÓõÄЭÒ飬ÌÚѶ°Ù¶È°¢ÀïÔƶ¼Ö§³Ö£¬»ù´¡Ð­ÒéÇë°Ù¶ÈËÑË÷¡°ÎïÁªÍø·À»ðǽhimqttÔ´ÂëÖ®MQTTЭÒé·ÖÎö¡±¡£

ºÍͼÐÎͼÏñµÄÈ˹¤ÖÇÄÜÒ»Ñù£¬»úÆ÷ѧϰÎÞÂÛÊÇÓмල»¹ÊÇÎ޼ල£¬µÚÒ»²½¶¼ÊÇÏȲɼ¯Ñù±¾¡£ÎïÁªÍø°²È«ÓÐÏÈÌìÐÔµÄÑù±¾²É¼¯ÓÅÊÆ£¬³É±¾¼¸ºõΪ0£¬·½·¨ÊÇ£ºÍ¨¹ý·´Ïò´úÀíµÄģʽ²É¼¯ÍêÕûµÄMQTTЭÒéÊý¾Ý£¬¿ÉÒԲο¼hihttpsÔ´Âëhttps://github.com/qq4108863/himqtt/ £¬Ñù±¾ÒªÇóÈçÏ£º

1¡¢×ã¹»µÄËæ»ú»¯£¬ÔÚ²»Í¬µÄIPµØÖ·Ö®¼äËæ»ú²É¼¯¡£

2¡¢×ã¹»¶àµÄÑù±¾£¬±£Ö¤99.99%µÄÕýÈ·ÂÊ£¬ÖÁÉÙÐèÒª²É¼¯ÊýÍò·ÝµÄÑù±¾¡£

3¡¢×ã¹»µÄʱ¼ä£¬ÖÁÉÙÔÚ²»Í¬µÄʱ¼ä¶Î²É¼¯3-7ÌìµÄÑù±¾¡£

4¡¢¾¡Á¿ÊÇÕý³£Á÷Á¿Ï²ɼ¯£¬¼õÉÙÑù±¾±»ºÚ¿Í¹¥»÷ÎÛȾµÄ¿ÉÄÜÐÔ¡£

5¡¢ÍêÕûµÄÊý¾Ý£¬Ñù±¾°üÀ¨È«²¿µÄMQTTЭÒéÍ·ºÍbody¡£

 

»ùÓÚ»úÆ÷ѧϰµÄÎïÁªÍø·À»ðǽhiihttpÊÇÔõÑù¹¤×÷µÄÄØ£¿±ÈÈçÓиöTOPIC½Ó¿Ú"hihttps/read"£¬ÔÚÕý³£Çé¿öÊÇͨ¹ýjsonÐÎʽ·ÃÎÊ£¬hihttpsÏȰѲɼ¯µ½Ñù±¾²ÎÊý±£´æÔÚtrainѵÁ·Ä¿Â¼Ï£¬Ñù365betÌåÓýÔÚÏß¼þÖ÷ÒªÄÚÈÝÈçÏ£º

"topic": "hihttps/read"

{ "id": 123,"token": "2458-a632-3d56-a9bf "}

{ "id": 456,"token": " ce58-a49d-b767-68ed"}

{ "id": 678,"token": "2bd8-c4d2-d324-29b3"}

{ "id": abc,"token": "45d8-35d2-e8f3-fe4a"}

{ "id": abc%20¡¯or 1=1,"token": "2bd8-c4d2-d324-29b3 "}

¡­¡­

 

µ±²É¼¯µ½µÄÑù±¾ÊýÁ¿£¬´ïµ½Ò»¶¨ÊýÁ¿£¨Èç1Íò£©£¬hihttps»úÆ÷ѧϰÒýÇæ¾Í¿ªÊ¼Æô¶¯£¬µÚÒ»²½¾ÍÊÇÂËÔë¡£

¶þ¡¢ ÂËÔë

ÔÚÕý³£µÄÇé¿öÏ£¬Äõ½µÄÑù±¾¾ø´ó¶àÊýÊÇ´óÁ¿Öظ´ÐÔ´æÔڵģ¬µ«ÊÇÒ²²»ÅųýÑù±¾´æÔںڿ͹¥»÷£¬Ò²¾ÍÊÇ˵£¬¸ö±ðÑù±¾¿ÉÄÜÒѾ­±»ÎÛȾÁË£¬hihttpsÔÚ½µÎ¬ºÍÌØÕ÷Ìáȡ֮ǰÏȹýÂË¡£

ÂËÔëµÄ·½·¨Í¨³£ÊÇÓþÛÀà·½·¨£¬°ÑÑù±¾·ÖΪÁ½À࣬°ÑÆäÖÐСÓÚ3%µÄÑù±¾È¥µô£¬Í¨³£ÓÐÒÔϼ¸ÖÖ×ö·¨£º

1£ºjson²ÎÊý¹ýÂË¡£±ÈÈçÕý³£Çé¿öÏÂÊÇ{ "id": xxx,"token":xxx}£¬ÄÇôÈç¹ûÓÐСÓÚ1%µÄÊÇ{ "sql": xxx,"xss":xxx}£¬ÄÇô¾ÍÒª¹ýÂËÕâÌõÑù±¾¡£

2£ºÃû³Æ³¤¶È¹ýÂË¡£Ò»°ãÀ´Ëµ£¬×Ö·û´®³¤¶ÈÖµ·Ö²¼£¬¾ùÖµ¦Ì£¬·½²î¦Ò3£¬ÔÚÇбÈÑ©·ò²»µÈʽ·¶Î§Í⣬Ҫ¹ýÂ˵ô¡£

3£º²ÎÊýÖµ³¤¶È¹ýÂË¡£Ò»°ãÀ´Ëµ£¬²ÎÊýÈçtolken=xxx£¬ÆäÖÐxxxµÄ³¤¶ÈÖµ·Ö²¼£¬¾ùÖµ¦Ì£¬·½²î¦Ò3£¬ÔÚÇбÈÑ©·ò²»µÈʽ·¶Î§Í⣬Ҫ¹ýÂ˵ô¡£

4£ºSQL×¢Èë¹ýÂË¡£ÓÃlibinjection¿â²éÒ»±é£¬·ûºÏSQL×¢ÈëÌØÕ÷µÄÑù±¾Òª¹ýÂË¡£

5£ºXSS¹¥»÷¹ýÂË¡£ÓÃlibinjection¿â²éÒ»±é£¬·ûºÏXSSÌØÕ÷µÄÑù±¾Òª¹ýÂË¡£

6£ºÆäËûÒÑÖª¹¥»÷¹ýÂË¡£ÈçModSecurity µÄOWASP¹æÔòºÜÅ££¬ÏÈÅÜÒ»±é¹ýÂË¡£

 

¾­¹ýÂËÔë´¦Àíºó£¬365betÌåÓýÔÚÏßÃÇ°ÑÑù±¾¾Í·ÖΪÕý³£ºÍÒì³£Ñù±¾£¬Õý³£µÄÈçÏ£º

 

{ "id": 123,"token": "2458-a632-3d56-a9bf "}

{ "id": 456,"token": " ce58-a49d-b767-68ed"}

{ "id": 678,"token": "2bd8-c4d2-d324-29b3"}

{ "id": abc,"token": "45d8-35d2-e8f3-fe4a"}

¡­¡­

ÉÙÊýÒì³£Ñù±¾£¬ÈçÒÉËÆSQL×¢Èë¹¥»÷ÔòÈ¥µô

{ "id": abc%20¡¯or 1=1,"token": "2bd8-c4d2-d324-29b3 "}

¡­¡­

 

Õû¸ö¹ý³Ì£¬Î޼ල½øÐУ¬¿ÉÒÔÓõ½µÄÊýѧËã·¨ÓÐK¾ùÖµ£¨K-Mean£©¡¢Ö÷³É·Ö·ÖÎöPCA¡¢ÇбÈÑ©·ò²»µÈʽ¡¢¸ß˹»ìºÏÄ£ÐÍGMM¡¢Ï¡Êè¾ØÕó¡­¡­

¾ßÌåµÄËã·¨Ô´Âë¿ÉÒԲο¼https://github.com/qq4108863/AI

 

Èý¡¢ ½µÎ¬

ÂËÔëºó×îÖØÒªµÄÒ»²½¾ÍÊǽµÎ¬£¬ÕâÊÇ»úÆ÷ѧϰµÄºËÐÄ¡£½µÎ¬¾ÍÊÇͨ¹ýÌض¨µÄÊýѧËã·¨£¬°Ñ¸´ÔӵĶ«Î÷£¬ÓÃÌØÕ÷±í´ïÏòÁ¿£¬±äΪ»úÆ÷¿ÉÒÔÀí½âµÄ¶«¶«£¬½µÎ¬·½·¨·ÖΪÏßÐÔ½µÎ¬£¨PCA ¡¢ICA LDA¡¢LFA¡¢LPPµÈ£©ºÍ·ÇÏßÐÔ½µÎ¬KPCA ¡¢KICA¡¢KDA¡¢ISOMAP¡¢LLE¡¢LE¡¢LPP¡¢LTSA¡¢MVUµÈ£©¡£

ÔõôÈûúÆ÷Àí½â/hihttps?id=abc%20¡¯or 1=1¡¯Õâ¾ÍÊÇÒ»Ìõ¹¥»÷ÄØ£¿ÔÚÎïÁªÍø°²È«ÁìÓòºÍͼÐÎͼÏñÍêÈ«²»Í¬£¬Ö÷Òª¾ÍÊÇÉæ¼°×ÔÈ»ÓïÑÔ´¦Àí£¬ÓÈÆäÊÇ365ÌåÓýͶעµÄʶ±ð£¬Ö÷ÒªÓÐÏÂÃ漸ÖÖÄ£ÐÍ£º

1¡¢´Ê´üÄ£ÐÍ

365ÌåÓýͶעµÄ½µÎ¬±¾ÖÊÉÏÉæ¼°µ½ÁË365ÌåÓýͶעµÄ±í´ïÐÎʽ¡£ÔÚ´«Í³µÄ´Ê´üÄ£Ð͵±ÖУ¬¶ÔÓÚÿһ¸ö´Ê²ÉÓÃone-hotÏ¡Êè±àÂëµÄÐÎʽ£¬¼ÙÉèÄ¿±êÓïÁÏÖй²ÓÐN¸öΨһȷÈϵĴʣ¬ÄÇôÐèÒªÒ»¸ö³¤¶ÈNµÄ´Êµä£¬´ÊµäµÄÿһ¸öλÖñí´ïÁË365ÌåÓýͶעÖгöÏÖµÄijһ¸ö´Ê¡£ÔÚij365ÌåÓýͶעÌØÕ÷±í´ïÏ£¬±ÈÈç´ÊƵ¡¢binary¡¢tf-idfµÈ£¬¿ÉÒÔ½«È365betÌåÓýÔÚÏßâ´Ê£¬»òÕß365ÌåÓýͶע±í´ïÔÚÒ»¸öNάµÄÏòÁ¿¿Õ¼äÀƾ½è¸ÃÏòÁ¿¿Õ¼äµÄ±í´ï£¬¿ÉÒÔʹÓûúÆ÷ѧϰËã·¨£¬½øÐкóÐøÈÎÎñ´¦Àí¡£

ÕâÖÖ·½Ê½±»³ÆΪn-gramÓï·¨£¬Ö¸365ÌåÓýͶעÖÐÁ¬Ðø³öÏÖµÄn¸öÓï´Ê¡£µ±n·Ö±ðΪ1¡¢2¡¢3ʱ£¬ÓÖ·Ö±ð³ÆΪһԪÓï·¨£¨unigram£©¡¢¶þÔªÓï·¨£¨bigram£©ÓëÈýÔªÓï·¨£¨trigram£©¡£

 

2¡¢Î¬¶ÈÑ¡Ôñ·½·¨

³£ÓõÄÓп¨·½¡¢»¥ÐÅÏ¢ÕâÖÖͳ¼Æ¼ìÑéµÄ·½·¨£»»¹ÓнèÖú»úÆ÷ѧϰģÐͽµÎ¬µÄ·½·¨¡£±ÈÈ磬ʹÓÃËæ»úÉ­ÁÖ£¬»òÕßÂß¼­»Ø¹éµÈÄ£ÐÍ£¬É¸Ñ¡³öÄÇЩÔÚ·ÖÀàÈÎÎñÖоßÓнϴóÌØÕ÷ÖØÒªÐÔ£¬»òÕßϵÊý¾ø¶ÔÖµ½Ï´óµÄTOPÌØÕ÷×÷Ϊ½µÎ¬ºóµÄÌØÕ÷¼¯ºÏ¡£

 

3¡¢Ö÷ÌâÄ£ÐÍ

Ö÷ÌâÄ£ÐÍͬʱ¾ß±¸Á˽µÎ¬ºÍÓïÒå±í´ïµÄЧ¹û£¬±ÈÈçLSI¡¢LDA¡¢PLSA¡¢HDPµÈͳ¼ÆÖ÷ÌâÄ£ÐÍ£¬ÕâЩģÐÍÑ°Çó365ÌåÓýͶעÔÚµÍά¿Õ¼ä£¨²»Í¬Ö÷ÌâÉÏ£©µÄ±í´ï£¬ÔÚ½µµÍά¶ÈµÄͬʱ£¬¾¡¿ÉÄܱ£ÁôÔ­ÓÐ365ÌåÓýͶעµÄÓïÒåÐÅÏ¢¡£

 

4¡¢Éñ¾­ÍøÂç

Èç¾í»ýÉñ¾­CNN¡¢Ñ­»·Éñ¾­RNNµÈ¡£

 

 

ÀíÂÛ¿ÉÄÜÓе㸴ÔÓ£¬ÄÇ365betÌåÓýÔÚÏßÃÇÖ±½ÓÄÃ4ÌõÑù±¾À´¾ÙÀý˵Ã÷°É£º

{ "id": 123,"token": "2458-a632-3d56-a9bf "}

{ "id": 456,"token": " ce58-a49d-b767-68ed"}

{ "id": 678,"token": "2bd8-c4d2-d324-29b3"}

{ "id": abc,"token": "45d8-35d2-e8f3-fe4a"}

 ¡­..

½µÎ¬µÄÄ¿µÄ¾ÍÊÇΪÁËÈûúÆ÷Äܹ»Àí½âidÊÇʲô£¬tokenÓÖÊÇʲô£¬Ê²Ã´Çé¿öÊǹ¥»÷¡£365betÌåÓýÔÚÏßÃÇÏÈÀ´¶¨ÒåһЩϡÊè±àÂ룺

N£ºÕûÊý£¬0-9

C£º×Ö·û£¬a-z

X: 16½øÖÆÊý×Ö£¬0-9 a-f

D:±êµã·Ö¸ô·û.-|

¡­¡­..

{ "id": 123,"token": "2458-a632-3d56-a9bf "} ÕâÖÖ365betÌåÓýÔÚÏßÃǾÍÓÃÏ¡Êè±àÂë°ÑÆäά¶È½µÎªid=N£¬token=XDXDXDX£¬ÕâÑù»úÆ÷¾Í¿ÉÄÜÀí½âÁË£¬Å¶£¬Ô­À´id¾ÍÊÇÊý×ÖÂï¡£

µ±È»ÕâÊÇ×î¼òµ¥µÄÇé¿ö£¬Êµ¼Ê³¡¾°¿ÉÄܸܺ´ÔÓ£¬±ÈÈç10.1¾¿¾¹ÊÇ´ú±íÊý×Ö£¿»òÕßÇ®£¿»òÕß°æ±¾ºÅÄØ£¿¾ÍÐèÒª×ö¸ü¶àµÄ²ÎÊý¹ØÁªÔËË㣨Èçmoney»òÕßversion£©¡£Èç¹û365betÌåÓýÔÚÏßÃǹ۲쵽µÄÑù±¾£¬´óÓÚ99.9%µÄ²ÎÊýid¶¼ÊÇÊý×Ö£¬¾Í¿ÉÒÔÈÏΪ{ "id": abc,"token": "45d8-35d2-e8f3-fe4a"}¾ÍÊÇÒ»Ìõ·Ç·¨¹¥»÷£¬Õâ¾ÍÊÇ»úÆ÷ѧϰÄܹ»¼ì²âδ֪¹¥»÷µÄºËÐÄÔ­Àí¡£

ʵ¼ÊÉú²ú»·¾³ÖÐÇé¿ö¸ü¸´Ôӵģ¬365betÌåÓýÔÚÏßÈûúÆ÷´ïµ½ÍøÂçר¼ÒµÄÖÇÄÜˮƽ£¬»¹Óкܳ¤µÄ·Ҫ×ߣ¬µ«ÕâÊDZØÈ»µÄ·¢Õ¹·½Ïò¡£

ËÄ¡¢ÌØÕ÷ÌáÈ¡

ÏÂÒ»²½£¬hihttps¾ÍÊǶÔÕý³£Á÷Á¿½øÐÐÊýÖµ»¯µÄÌØÕ÷ÌáÈ¡ºÍ·ÖÎö¡£Í¨¹ý¶Ô´óÁ¿Ñù±¾½øÐÐÌØÕ÷·Ö²¼Í³¼Æ£¬½¨Á¢ÊýѧģÐÍ£¬ÌØÕ÷ÌáÈ¡°üÀ¨£ºJSON²ÎÊý¸öÊý¡¢²ÎÊýÖµ³¤¶ÈµÄ¾ùÖµºÍ·½²î¡¢²ÎÊý×Ö·û·Ö²¼¡¢TOPIC·ÃÎÊƵÂʵȵȡ£ÈçϱíËùʾ£º

 

Àà±ð	ÐòºÅ	ÌØÕ÷Ãû³Æ	ÌØÕ÷ÃèÊö
Óï·¨ÌØÕ÷	1	Topic_len	TOPIC ³¤¶È
	2	Path_len	·¾¶³¤¶È
	3	Path	·¾¶×î´ó³¤¶È
	4	Path_Maxlen	·¾¶Æ½¾ù³¤¶È
	5	Argument_len	²ÎÊý²¿·Ö³¤¶È
	6	Name_Max_len	²ÎÊýÃû×î´ó³¤¶È
	7	Name_Avglen	²ÎÊýÃûƽ¾ù³¤¶È
	8	Value_Max_len	²ÎÊýÖµ×î´ó³¤¶È
	9	Value_Avg_len	²ÎÊýֵƽ¾ù³¤¶È
	10	Argument_len	²ÎÊý¸öÊý
	11	String_Max_len	×Ö·û´®×î´ó³¤¶È
	12	Number_Maxlen	Á¬ÐøÊý×Ö×î´ó³¤¶È
	13	Path_number	·¾¶ÖеÄÊý×Ö¸öÊý
	14	Unknow_len	ÌØÊâ×Ö·ûµÄ¸öÊý
	15	Number_Percentage	²ÎÊýÖµÖÐÊý×ÖÕ¼ÓбÈÀý
	16	String_Percentage	²ÎÊýÖµ×ÖĸռÓбÈÀý
	17	Unkown_Percentage	²ÎÊýÖµÖÐÌØÊâ×Ö·ûµÄ±ÈÀý
	18	BigString_Percentage	´óд×Ö·ûËùÕ¼±ÈÀý
	20	Spacing_Precentage	¿Õ¸ñ×Ö·ûËùÕ¼±ÈÀý
¹¥»÷ÌØÕ÷	21	ContainIP	²ÎÊýÖµÊÇ·ñ°üº¬IP
	22	Sql_Risk_level	SQL ÀàÐÍΣÏյȼ¶
	23	Xss_Risk_level	Xss ÀàÐÍΣÏյȼ¶
	24	Others_Risk_level	ÆäËûÀàÐÍΣÏյȼ¶
×ÔÈ»ÓïÑÔ	25	NLP	×ÔÈ»ÓïÑÔÀí½â´¦Àí

 

Îå¡¢Éú³É¶Ô¿¹¹æÔò

×îºóhihttpsͨ¹ý´óÁ¿µÄÑù±¾²É¼¯ £¬¾«È·¸øÕâ¸ö"hihttps/read"½Ó¿Ú²ÎÊý£¬Éú³É¶Ô¿¹¹æÔò£¬±£´æÔÚruleĿ¼Ï£¬ºÍ´«Í³OWASP¹æÔò·ÅÔÚÒ»Æ𣬱£»¤ÎïÁªÍø·þÎñÆ÷²»±»¹¥»÷¡£

ÏÂÃæµÄÒ»ÂÉÊÓΪ¹¥»÷£¬Ö»ÓлúÆ÷ѧϰ²ÅÓпÉÄܼì²âδ֪¹¥»÷£¬ÕâÊÇÍøÂ簲ȫר¼ÒÒ²ÄÑÒÔ×öµ½µÄ¡£

{ "id": 123 }                                 ²ÎÊýȱÉÙ

{ "id": abc,"token": " ce58-a49d-b767-68ed"}    ²ÎÊýidÖµ²»ÕýÈ·

{ "admin": %0acdef,"token": "2bd8-c4d2"}      δ֪¹¥»÷

¡­.....

×îºó×ܽáÈçÏ£º

1¡¢Õû¸ö¹ý³ÌÍêÈ«ÊÇÎ޼ලµÄ»úÆ÷ѧϰ£¬ÓÐЩÌØÊâµÄ²ÎÊý£¬Ò²¿ÉÒÔÓÉÍøÂ簲ȫר¼ÒÈËΪ¸ÉÔ¤°ë¼à¶½£¬´Ó¶ø´Ó99.9%µ½100%׼ȷÂʵĽø»¯¡£

2¡¢´«Í³µÄ¹æÔòºÜÄѶԸ¶Î´ÖªÂ©¶´ºÍδ֪¹¥»÷¡£ÈûúÆ÷ÏñÈËÒ»Ñùѧϰ£¬¾ßÓÐÒ»¶¨ÖÇÄÜ×Ô¶¯¶Ô¿¹APT¹¥»÷»òÐíÊÇΨһÓÐЧ;¾¶£¬µ«ºÚ¿Í¼¼Êõ±¾Éí¾ÍÊÇÈËÀà×¼âÖÇÁ¦µÄ½ÏÁ¿£¬ÎïÁªÍø°²È«ÈÔÈ»ÈÎÖضøµÀÔ¶¡£

3¡¢ÐÒºÃhihttpsÕâÀàÃâ·ÑµÄÎïÁªÍø·À»ðǽÔÚ»úÆ÷ѧϰ¡¢×ÔÖ÷¶Ô¿¹ÖпªÁ˺ܺÃÒ»¸öÍ·£¬Î´À´ÎïÁªÍø°²È«ºÜ¿ÉÄÜÊÇÌØÕ÷¹¤³Ì+»úÆ÷ѧϰ¹²Í¬Íê³É£¬±ØÈ»ÊÇAIµÄÌìÏ¡£