Top25漏洞常见参数

基础研究，参考各种文章，使用频率前 25 位的。这些参数可用于工具或手动使用的参数。

包含以下漏洞的常见参数：

XSS跨站脚本攻击
SSRF服务端请求伪造
LFI本地文件包含
sql注入
RCE远程代码执行
URL重定向

XSS跨站脚本攻击

?q={payload}
?s={payload}
?search={payload}
?id={payload}
?lang={payload}
?keyword={payload}
?query={payload}
?page={payload}
?keywords={payload}
?year={payload}
?view={payload}
?email={payload}
?type={payload}
?name={payload}
?p={payload}
?month={payload}
?image={payload}
?list_type={payload}
?url={payload}
?terms={payload}
?categoryid={payload}
?key={payload}
?login={payload}
?begindate={payload}
?enddate={payload}

SSRF服务端请求伪造

?dest={target}
?redirect={target}
?uri={target}
?path={target}
?continue={target}
?url={target}
?window={target}
?next={target}
?data={target}
?reference={target}
?site={target}
?html={target}
?val={target}
?validate={target}
?domain={target}
?callback={target}
?return={target}
?page={target}
?Feed={target}
?host={target}
?port={target}
?to={target}
?out={target}
?view={target}
?dir={target}

LFI本地文件包含

?cat={payload}
?dir={payload}
?action={payload}
?board={payload}
?date={payload}
?detail={payload}
?file={payload}
?download={payload}
?path={payload}
?folder={payload}
?prefix={payload}
?include={payload}
?page={payload}
?inc={payload}
?locate={payload}
?show={payload}
?doc={payload}
?site={payload}
?type={payload}
?view={payload}
?content={payload}
?document={payload}
?layout={payload}
?mod={payload}
?conf={payload}

sql注入

?id=
?page=
?dir=
?search=
?category=
?file=
?class=
?url=
?news=
?item=
?menu=
?lang=
?name=
?ref=
?title=
?view=
?topic=
?thread=
?type=
?date=
?form=
?join=
?main=
?nav=
?region=

RCE远程代码

?cmd=
?exec=
?command=
?execute=
?ping=
?query=
?jump=
?code=
?reg=
?do=
?func=
?arg=
?option=
?load=
?process=
?step=
?read=
?function=
?req=
?feature=
?exe=
?module=
?payload=
?run=
?print=

执行URL重定向

?next={payload}
?url={payload}
?target={payload}
?rurl={payload}
?dest={payload}
?destination={payload}
?redir={payload}
?redirect_uri={payload}
?redirect_url={payload}
?redirect={payload}
/redirect/{payload}
/cgi-bin/redirect.cgi?{payload}
/out/{payload}
/out?{payload}
?view={payload}
/login?to={payload}
?image_url={payload}
?go={payload}
?return={payload}
?returnTo={payload}
?return_to={payload}
?checkout_url={payload}
?continue={payload}
?return_path={payload}

原文地址：https://cloud.tencent.com/developer/article/2047034