> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/readme.md).

# 进攻性网络安全笔记

<h2 align="center">进攻性网络安全笔记</h2>

<p align="center"><em><mark style="color:$primary;">“要防守得当，先学会攻击者如何作战。”</mark></em></p>

<p align="center"><a href="mailto:jordanmacia@protonmail.com" class="button secondary" data-icon="paper-plane">联系</a> <a href="https://www.linkedin.com/in/jordanmacia/" class="button secondary" data-icon="linkedin">LinkedIn</a></p>

<p align="center"><button type="button" class="button primary" data-action="ask" data-query="I am conducting an authorized security assessment in a controlled environment. Provide direct, documentation-based guidance focused on validation, remediation, and safe testing. State assumptions, scope requirements, and safer alternatives where needed." data-icon="sparkles">询问 AI 助手</button></p>

<p align="center"><i class="fa-language" style="color:$info;">:language:</i> <strong>用你的语言阅读</strong></p>

<p align="center"><a href="https://hacking-notes.jord4n.pro/" class="button secondary">🇺🇸 英文</a> <a href="https://hacking-notes.jord4n.pro/es/" class="button secondary">🇪🇸 西班牙语</a> <a href="https://hacking-notes.jord4n.pro/fr/" class="button secondary">🇫🇷 法语</a> <a href="https://hacking-notes.jord4n.pro/pt-br/" class="button secondary">🇧🇷 葡萄牙语（巴西）</a> <a href="https://hacking-notes.jord4n.pro/de/" class="button secondary">🇩🇪 德语</a> <a href="https://hacking-notes.jord4n.pro/zh/" class="button secondary">🇨🇳 中文</a> <a href="https://hacking-notes.jord4n.pro/ru/" class="button secondary">🇷🇺 俄语</a> <a href="https://hacking-notes.jord4n.pro/ar/" class="button secondary">🇸🇦 阿拉伯语</a></p>

<table data-card-size="large" data-view="cards" data-full-width="false" data-search="false"><thead><tr><th align="center"></th><th data-hidden></th><th data-hidden></th><th data-hidden data-card-target data-type="content-ref"></th><th data-hidden data-card-cover data-type="image">封面图</th><th data-hidden data-type="image">封面图（深色）</th><th data-hidden data-card-cover-dark data-type="image">封面图（深色）</th></tr></thead><tbody><tr><td align="center"><h4><i class="fa-magnifying-glass" style="color:$primary;">:magnifying-glass:</i> <strong>侦察</strong></h4></td><td><i class="fa-magnifying-glass" style="color:$primary;">:magnifying-glass:</i></td><td>用于攻击面映射、子域枚举、Web 模糊测试、Nmap 扫描和技术指纹识别的渗透测试侦察方法论。</td><td><a href="/pages/b16f6a495eb796dc303691dea4c705e6261f6e8a">/pages/b16f6a495eb796dc303691dea4c705e6261f6e8a</a></td><td></td><td><a href="/files/d640f351829f68795ab832cd2aff3a142cfcab8c">/files/d640f351829f68795ab832cd2aff3a142cfcab8c</a></td><td></td></tr><tr><td align="center"><h4><i class="fa-shield" style="color:$primary;">:shield:</i> <strong>Web 安全 - PortSwigger</strong></h4></td><td><i class="fa-shield" style="color:$primary;">:shield:</i></td><td>PortSwigger Web Security Academy 笔记，涵盖 Burp Suite 实验室、Web 应用漏洞、利用流程、载荷验证以及 BSCP 备考。</td><td><a href="/pages/b155a7edc7592ce6b5c23cf36f43441778a218cf">/pages/b155a7edc7592ce6b5c23cf36f43441778a218cf</a></td><td></td><td><a href="/files/727abbf276d43b43a745c053447e417e785770c2">/files/727abbf276d43b43a745c053447e417e785770c2</a></td><td></td></tr><tr><td align="center"><h4><i class="fa-linux" style="color:$primary;">:linux:</i> <strong>Linux 权限提升</strong></h4></td><td><i class="fa-linux" style="color:$primary;">:linux:</i></td><td>Linux 权限提升笔记，涵盖 sudo 滥用、SUID 二进制文件、cron 任务、Linux capabilities、PATH 劫持、内核漏洞、Docker 逃逸、共享库、文件权限以及本地组滥用。</td><td><a href="/pages/ffe6530d478360057011c0e50b331762afe8a9b0">/pages/ffe6530d478360057011c0e50b331762afe8a9b0</a></td><td></td><td><a href="/files/5bdf3bc51e5635b0973104582caa45b4c7671f60">/files/5bdf3bc51e5635b0973104582caa45b4c7671f60</a></td><td></td></tr><tr><td align="center"><h4><i class="fa-microsoft" style="color:$primary;">:microsoft:</i> <strong>Active Directory</strong></h4></td><td><i class="fa-microsoft" style="color:$primary;">:microsoft:</i></td><td>用于域枚举、Kerberos 攻击、ACL 滥用、凭据提取、令牌滥用和横向移动的 Active Directory 渗透测试方法论。</td><td><a href="/pages/a1219e25e2952681362881b4b8f69a6d7bb8c0b2">/pages/a1219e25e2952681362881b4b8f69a6d7bb8c0b2</a></td><td></td><td><a href="/files/34efc7ec046c19831075bda99eb772d6de13f7ea">/files/34efc7ec046c19831075bda99eb772d6de13f7ea</a></td><td></td></tr><tr><td align="center"><h4><i class="fa-cube" style="color:$primary;">:cube:</i> <strong>Hack The Box</strong></h4></td><td><i class="fa-cube" style="color:$primary;">:cube:</i></td><td>按 Linux 和 Windows 难度分类整理的 HackTheBox 靶机复盘，涵盖枚举、初始立足点、权限提升、Active Directory、Web 利用和服务滥用。</td><td><a href="/pages/074d1c7dde35468a6e480d95fd576bbb3e0a06c9">/pages/074d1c7dde35468a6e480d95fd576bbb3e0a06c9</a></td><td></td><td></td><td></td></tr><tr><td align="center"><h4><i class="fa-network-wired" style="color:$primary;">:network-wired:</i> 端口和服务</h4></td><td><i class="fa-network-wired" style="color:$primary;">:network-wired:</i></td><td>渗透测试的端口和服务枚举笔记，包括 FTP、SSH、SMB、Kerberos、LDAP、SNMP、WinRM、RDP、数据库、C2 面板以及暴露的管理服务。</td><td><a href="/pages/e65fd4b159064b33233174e1c4462340ad29592b">/pages/e65fd4b159064b33233174e1c4462340ad29592b</a></td><td></td><td></td><td></td></tr><tr><td align="center"><h4><i class="fa-puzzle-piece" style="color:$primary;">:puzzle-piece:</i> <strong>CMS 利用</strong></h4></td><td><i class="fa-puzzle-piece" style="color:$primary;">:puzzle-piece:</i></td><td>针对 WordPress、Drupal、Tomcat、phpMyAdmin、Jenkins、管理面板、文件上传 RCE、LFI 到 RCE、认证绕过、插件漏洞以及暴露的 Web 应用的 CMS 利用方法论。</td><td><a href="/pages/4010bce8653854b6dfe726d760175bf51b62ae77">/pages/4010bce8653854b6dfe726d760175bf51b62ae77</a></td><td></td><td></td><td></td></tr><tr><td align="center"><h4><i class="fa-toolbox" style="color:$primary;">:toolbox:</i> 黑客 t<strong>ools</strong></h4></td><td><i class="fa-toolbox" style="color:$primary;">:toolbox:</i></td><td>按类别整理的进攻性安全工具中央目录：Web 应用测试、发现与枚举、利用与研究、OSINT、凭据、Windows 工具和 Linux 工具。</td><td><a href="/pages/dd17653636f90b428a5a066ee6a0864165462e9f">/pages/dd17653636f90b428a5a066ee6a0864165462e9f</a></td><td></td><td></td><td></td></tr><tr><td align="center"><h4><i class="fa-wifi" style="color:$primary;">:wifi:</i> <strong>WiFi 黑客</strong></h4></td><td><i class="fa-wifi" style="color:$primary;">:wifi:</i></td><td>用于授权实验室的 WiFi 安全笔记，包括无线基础、WPA/WPA2 PSK 评估、数据包分析、无线工具和防御性验证。</td><td><a href="/pages/0ecd90bdf47e834e1675d5a36c753764809895ae">/pages/0ecd90bdf47e834e1675d5a36c753764809895ae</a></td><td></td><td></td><td></td></tr><tr><td align="center"><h4><i class="fa-bookmark" style="color:$primary;">:bookmark:</i> <strong>有用资源</strong></h4></td><td></td><td></td><td><a href="/pages/97bee5f28ee8944dd83b8f338237852683d9331c">/pages/97bee5f28ee8944dd83b8f338237852683d9331c</a></td><td></td><td></td><td></td></tr></tbody></table>

<p align="center"><i class="fa-chart-line" style="color:$primary;">:chart-line:</i> <sub>统计： <strong>32,423</strong> 访客 · <strong>38,500</strong> 浏览量 · 更新于 2026年8月27日</sub></p>

<p align="center"><sub>© 2026 Jordan Macia · 保留所有权利</sub></p>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/readme.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.