最簡單的徹底禁止公網訪問ssh ftp埠
/ipfirewall filter
add chain=input protocol=tcp dst-port=21-22 src-address-list=!allow-addresses action=drop comment="禁止公網ssh & ftp"disabled=no
使用ip列表來實現更靈活的策略,三分鐘之內只能允許建立三次新會話，超過了就阻塞
/ipfirewall filter
add chain=input protocol=tcp dst-port=21,22,23,8291 src-address-list=login_blacklist action=drop comment="drop login brute forcers 1"disabled=no
add chain=input protocol=tcp dst-port=21,22,23,8291 connection-state=new src-address-list=login_stage5 action=add-src-to-address-list address-list=login_blacklist address-list-timeout=1d comment="drop login brute forcers 2"disabled=no
add chain=input protocol=tcp dst-port=21,22,23,8291 connection-state=new src-address-list=login_stage4 action=add-src-to-address-list address-list=login_stage5 address-list-timeout=1m comment="drop login brute forcers 3"disabled=no
add chain=input protocol=tcp dst-port=21,22,23,8291 connection-state=new src-address-list=login_stage3 action=add-src-to-address-list address-list=login_stage4 address-list-timeout=1m comment="drop login brute forcers 4"disabled=no
add chain=input protocol=tcp dst-port=21,22,23,8291 connection-state=new src-address-list=login_stage2 action=add-src-to-address-list address-list=login_stage3 address-list-timeout=1m comment="drop login brute forcers 5"disabled=no
add chain=input protocol=tcp dst-port=21,22,23,8291 connection-state=new src-address-list=login_stage1 action=add-src-to-address-list address-list=login_stage2 address-list-timeout=1m comment="drop login brute forcers 6"disabled=no
add chain=input protocol=tcp dst-port=21,22,23,8291 connection-state=new action=add-src-to-address-list address-list=login_stage1 address-list-timeout=1m comment="drop login brute forcers 7"disabled=no
防埠掃瞄
/ipfirewall filter
add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list address-list="port scanners"address-list-timeout=14d comment="port scanners to list"disabled=no
add chain=input protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list="port scanners"address-list-timeout=14d comment="nmap fin stealth scan"
add chain=input protocol=tcp tcp-flags=fin,syn action=add-src-to-address-list address-list="port scanners"address-list-timeout=14d comment="syn/fin scan"
add chain=input protocol=tcp tcp-flags=syn,rst action=add-src-to-address-list address-list="port scanners"address-list-timeout=14d comment="syn/rst scan"
add chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack action=add-src-to-address-list address-list="port scanners"address-list-timeout=14d comment="fin/psh/urg scan"
add chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg action=add-src-to-address-list address-list="port scanners"address-list-timeout=14d comment="all/all scan"
add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list="port scanners"address-list-timeout=14d comment="nmap null scan"
add chain=input src-address-list="port scanners"action=drop comment="dropping port scanners"disabled=no
medusa 暴力破解
medusa 美杜莎 和hydra 九頭蛇 差不多 科普下 medusa是支援afp,cvs,ftp,http,imap,ms sql,mysql,ncp netware nntp,pcanywhere,pop3,postgresql,rexec,rlogin,rsh,smb,smtp auth v...
DVWA Brute Force（暴力破解）
本系列文集 dvwa學習筆記 分析 isset函式在php中用來檢測變數是否設定 該函式返回的是布林型別的值，即true false 可以看到，伺服器只是驗證了引數login是否被設定，沒有任何的防爆破機制，且對引數username password沒有做任何過濾，存在明顯的sql注入漏洞。方法一利...
作業（暴力破解）
基於單單表的暴力破解 首先先把攔截關一下 因為我們要讓他傳輸資料，沒必要攔截，而且就算是intercept is off 這也不影響我們的burpsuit找到它 然後開啟pikachu訓練靶場，先輸入乙個隨便的賬戶和密碼，然後可以在歷史裡找到位址是127.0.0.1的資料報，找到剛剛輸入的賬戶和密碼...