> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web-vulnerabilities/webdav-attack/webdav-techniques-pentesting-web.md).
# WebDAV 技术
### 侦察（whatweb）：
> 初始 **侦察** 侦察阶段试图识别服务器允许哪些文件扩展名。一旦这些扩展名已知，攻击者就可以尝试上传并执行恶意文件。如果上传和执行成功，他们可能会获得未授权访问并危害系统。
* 该 **WhatWeb** 工具表明 **WebDAV** 协议被使用。
### 暴力破解（Davtest）：
> 该工具 **Davtest** 是一款用于对 WebDAV 服务器进行渗透测试的命令行工具。Davtest 可用于枚举 WebDAV 服务器上受保护的资源，以及测试服务器的安全配置。Davtest 还可用于测试服务器的身份验证和授权，并检测已知漏洞。
```bash
cat /usr/share/wordlists/rockyou.txt| whithe read password; do response=$(davtis -url http://127.0.0.1 -auth admin:$password 2>&1 | grep -i succeed); if [ $response ]; then echo "[+] 正确的密码是 $password"; break; fi; done
```
### 文件上传（Cadaver）：
> **Cadaver** 是另一个用于与 WebDAV 服务器交互的命令行工具。Cadaver 允许用户浏览服务器资源、上传文件并在服务器上执行命令。它还可用于诸如受保护资源枚举和已知漏洞利用等渗透测试任务。
* 一旦我们知道 **用户名和密码** 通过使用暴力破解攻击，我们就使用 Cadaver 进行连接。
* 要 **上传文件**，我们使用命令 **put** 后面跟着文件名：
* 如果 **WebDAV** 可解释的 **PHP** 代码，我们可以执行一个 [LFI](/zh/web-vulnerabilities/owasp-top-10-vulnerabilities/vulnerability-local-file-inclusion-lfi.md) 甚至 [RFI](/zh/web-vulnerabilities/owasp-top-10-vulnerabilities/vulnerability-remote-file-inclusion-rfi.md).
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web-vulnerabilities/webdav-attack/webdav-techniques-pentesting-web.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.