penetration-testing

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Penetration Testing

渗透测试

Validate security controls through authorized testing.

通过授权测试验证安全控制措施。

Phases

测试阶段

yaml

pentest_phases:
  1_reconnaissance:
    - Passive information gathering
    - DNS enumeration
    - Network mapping
    
  2_scanning:
    - Port scanning
    - Service identification
    - Vulnerability scanning
    
  3_exploitation:
    - Attempt exploitation
    - Verify vulnerabilities
    - Document findings
    
  4_post_exploitation:
    - Privilege escalation
    - Lateral movement
    - Data access
    
  5_reporting:
    - Document findings
    - Risk assessment
    - Remediation recommendations

yaml

pentest_phases:
  1_reconnaissance:
    - Passive information gathering
    - DNS enumeration
    - Network mapping
    
  2_scanning:
    - Port scanning
    - Service identification
    - Vulnerability scanning
    
  3_exploitation:
    - Attempt exploitation
    - Verify vulnerabilities
    - Document findings
    
  4_post_exploitation:
    - Privilege escalation
    - Lateral movement
    - Data access
    
  5_reporting:
    - Document findings
    - Risk assessment
    - Remediation recommendations

Reconnaissance

侦察阶段

bash

undefined

bash

undefined

DNS enumeration

dig example.com ANY host -l example.com

Subdomain discovery

subfinder -d example.com

WHOIS

whois example.com

undefined

whois example.com

undefined

Scanning

扫描阶段

bash

undefined

bash

undefined

Port scan

nmap -sV -sC -p- target.com

Web scanning

nikto -h https://target.com dirb https://target.com

Vulnerability scan

nmap --script vuln target.com

undefined

nmap --script vuln target.com

undefined

Web Testing

Web应用测试

bash

undefined

bash

undefined

SQL injection test

sqlmap -u "http://target.com/page?id=1"

XSS testing

Use Burp Suite or manual testing

Directory traversal

curl "http://target.com/file?path=../../../etc/passwd"

undefined

curl "http://target.com/file?path=../../../etc/passwd"

undefined

Rules of Engagement

参与规则

yaml

scope:
  in_scope:
    - target.com
    - api.target.com
  out_of_scope:
    - production-db.target.com
    - third-party services
  
  testing_window: "Weekdays 2-6 AM UTC"
  emergency_contact: "security@target.com"

yaml

scope:
  in_scope:
    - target.com
    - api.target.com
  out_of_scope:
    - production-db.target.com
    - third-party services
  
  testing_window: "Weekdays 2-6 AM UTC"
  emergency_contact: "security@target.com"

Best Practices

最佳实践

Always get written authorization
Define clear scope
Document everything
Report critical findings immediately
Safe exploitation techniques only

始终获取书面授权
明确测试范围
记录所有操作
立即上报关键发现
仅使用安全的漏洞利用技术

penetration-testing

Original

Translation

Penetration Testing

渗透测试

Phases

测试阶段

Reconnaissance

侦察阶段

DNS enumeration

DNS enumeration

Subdomain discovery

Subdomain discovery

WHOIS

WHOIS

Scanning

扫描阶段

Port scan

Port scan

Web scanning

Web scanning

Vulnerability scan

Vulnerability scan

Web Testing

Web应用测试

SQL injection test

SQL injection test

XSS testing

XSS testing

Use Burp Suite or manual testing

Use Burp Suite or manual testing

Directory traversal

Directory traversal

Rules of Engagement

参与规则

Best Practices

最佳实践

Related Skills

相关技能