1
assessment_standards:
2
  # 等保 2.0
3
  level_protection:
4
    level_2:
5
      - 身份鉴别
6
      - 访问控制
7
      - 安全审计
8

9
    level_3:
10
      - 重要数据传输
11
      - 边界防护
12
      - 入侵防范
13

14
  # ISO 27001
15
  iso_27001:
16
    - A.5 信息安全政策
17
    - A.6 信息安全组织
18
    - A.9 访问控制
19

20
  # NIST CSF
21
  nist_csf:
22
    - Identify 识别
23
    - Protect 防护
24
    - Detect 检测
25
    - Respond 响应
26
    - Recover 恢复

1
vulnerability_databases:
2
  - name: CVE
3
    url: cve.mitre.org
4
    format: JSON
5

6
  - name: CNVD
7
    url: cnvd.org.cn
8
    format: XML
9

10
  - name: NVD
11
    url: nvd.nist.gov
12
    format: API
13

14
  - name: 乌云镜像
15
    url: github.com/wooyun-drops
16
    format: Local

1
vulnerability_scan:
2
  # 网络扫描
3
  network:
4
    scanner: nessus
5
    targets:
6
      - 10.0.0.0/8
7
      - 192.168.0.0/16
8
    schedule: weekly
9

10
    plugins:
11
      - 主机发现
12
      - 端口扫描
13
      - 服务识别
14
      - 漏洞检测
15

16
  # Web 扫描
17
  web:
18
    scanner: awvs
19
    targets:
20
      - https://app.example.com
21

22
    scope:
23
      - /api/*
24
      - /admin/*

1
web_pentest:
2
  # 信息收集
3
  reconnaissance:
4
    - subdomain_enum
5
    - technology_fingerprint
6
    - sensitive_files
7
    - directory_enum
8

9
  # 漏洞检测
10
  vulnerabilities:
11
    - injection: SQLi, XSS, Command Injection
12
    - auth: weak_password, session_fixing
13
    - business: IDOR, Race Condition
14
    - api: BOLA, Mass Assignment
15

16
  # 工具链
17
  tools:
18
    - burp_pro
19
    - sqlmap
20
    - nuclei
21
    - ffuf

1
exploitation:
2
  # SQL 注入
3
  sqli:
4
    tools:
5
      - sqlmap
6
      - sqlninja
7
    payl oad: "' OR 1=1 --"
8

9
  # 命令注入
10
  command_injection:
11
    tools:
12
      - commix
13
      - burp
14
    payl oad: "; cat /etc/passwd"
15

16
  # 文件上传
17
  file_upload:
18
    bypass_techniques:
19
      - extension: .php5, .phtml
20
      - content_type: image/gif
21
      - magic_bytes: GIF89a

1
kill_chain:
2
  # Lockheed Martin 模型
3
  stages:
4
    - name: 侦察
5
      techniques:
6
        - T1595 主动扫描
7
        - T1592 主机发现
8

9
    - name: 武器化
10
      techniques:
11
        - T1204 用户执行
12

13
    - name: 投递
14
      techniques:
15
        - T1566 钓鱼攻击
16

17
    - name: 利用
18
      techniques:
19
        - T1059 命令执行
20

21
    - name: 安装
22
      techniques:
23
        - T1543 创建服务
24

25
    - name: 命令控制
26
      techniques:
27
        - T1071 C2 通道

1
attack_techniques:
2
  # 初始访问
3
  initial_access:
4
    - T1566 钓鱼攻击
5
    - T1190 边界服务
6
    - T1133 外部远程服务
7

8
  # 执行
9
  execution:
10
    - T1059 命令执行
11
    - T1053 计划任务
12
    - T1053 远程服务
13

14
  # 持久化
15
  persistence:
16
    - T1547 启动项
17
    - T1543 创建服务
18
    - T1505 Webshell
19

20
  # 权限提升
21
  privilege_escalation:
22
    - T1068 内核漏洞
23
    - T1055 进程注入

1
purple_exercise:
2
  # 计划阶段
3
  planning:
4
    - scope_definition
5
    - rules_of_engagement
6
    - legal_clearance
7
    - resource_allocation
8

9
  # 执行阶段
10
  execution:
11
    - red_team_ops
12
    - blue_team_detection
13
    - purple_coordination
14

15
  # 复盘阶段
16
  lessons_learned:
17
    - attack_summary
18
    - detection_gaps
19
    - improvement_plan

1
detection_metrics:
2
  # 覆盖率
3
  coverage:
4
    - mitre_att&ck_coverage: 75%
5
    - critical_assets_covered: 100%
6

7
  # 检测时效
8
  time_to_detect:
9
    - mean: 4h
10
    - median: 2h
11
    - 95th: 24h
12

13
  # 响应时效
14
  time_to_respond:
15
    - mean: 8h
16
    - median: 4h

1
code_audit:
2
  # 输入验证
3
  input_validation:
4
    - 外部输入校验
5
    - SQL 参数化
6
    - 命令执行防护
7

8
  # 认证授权
9
  auth:
10
    - 密码存储安全
11
    - 会话管理
12
    - 权限控制
13

14
  # 数据保护
15
  data_protection:
16
    - 敏感信息加密
17
    - 密钥管理
18
    - 日志脱敏
19

20
  # 错误处理
21
  error_handling:
22
    - 不泄露敏感信息
23
    - 统一错误响应

1
// 漏洞：SQL 注入
2
// 错误
3
String sql = "SELECT * FROM users WHERE id = " + id;
4

5
// 正确
6
PreparedStatement pstmt = conn.prepareStatement(
7
    "SELECT * FROM users WHERE id = ?");
8
pstmt.setString(1, id);
9

10
// 漏洞：XSS
11
// 错误
12
out.println(userInput);
13

14
// 正确
15
out.println(htmlEncoder.encode(userInput));
16

17
// 漏洞：密码存储
18
// 错误
19
String hash = MD5(password);
20

21
// 正确
22
String hash = BCrypt.hashpw(password, BCrypt.gensalt());

1
# 自定义 Nuclei 模板
2
id: custom-vulnerability
3
info:
4
  name: API Misconfiguration
5
  severity: high
6

7
http:
8
  - method: GET
9
    path:
10
      - "/api/v1/users"
11

12
    matchers:
13
      - type: regex
14
        regex: '"(admin|root)"'
15
        condition: and
16

17
    extractors:
18
      - type: regex
19
        regex: '"id":\s*(\d+)'
20
        group: 1