2026-05-22 02:15:40 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： 谛听（DiTing）是一套面向ClaudeCode的Web安全审计技能系统，支持PHP/Java/.NET/Node.js等语言及12个主流框架，提供50+审计文件、漏洞模式与安全代码对比、grep检测命令及动态调试方法，涵盖SQL注入、反序列化等常见漏洞链挖掘，包含安装指南和交互式脚本生成功能。 综合评分： 85 文章分类： 代码审计,WEB安全,安全工具,漏洞分析,红队

cover_image

Web 代码审计技能skills | PHP / Java / .NET / Node.js · 50+ 审计文件 · 动态调试 · 漏洞链挖掘

L-Serim L-Serim

夜组安全

2026年5月15日 08:00 青海

在小说阅读器读本章

去阅读

免责声明

由于传播、利用本公众号夜组安全所提供的信息而造成的任何直接或者间接的后果及损失，均由使用者本人负责，公众号夜组安全及作者不为此承担任何责任，一旦造成后果请自行承担！如有侵权烦请告知，我们会立即删除并致歉。谢谢！所有工具安全性自测！！！VX：NightCTI

朋友们现在只对常读和星标的公众号才展示大图推送，建议大家把夜组安全“设为星标”，否则可能就看不到了啦！

工具介绍

谛听（DiTing）是一套面向 Claude Code 的 Web 安全审计技能系统。名称取自地藏菩萨座下神兽，能”听辨世间万物真伪”——寓意跨平台覆盖、精准识别漏洞、动静结合验证。

核心设计理念：按语言和框架组织。 每种语言拥有完整、独立的审计文件集合——从总览（危险函数/优先级）到每个漏洞的详细模式（漏洞代码 ↔ 安全代码对比），再到框架专项审计。审计者无需在多文件间跳转，一种语言一个目录即可完成完整审计。

特性

语言优先：每个语言自成一体的审计目录，包含漏洞模式 + grep命令 + Payload
12 个框架覆盖：Laravel / ThinkPHP / Spring Boot / Struts2 / Shiro / MyBatis / ASP.NET MVC / WebForms / Express / NestJS / Next.js
漏洞↔安全代码对比：每个漏洞文件包含漏洞模式和修复代码的并列对比
grep 检测命令：每个文件附有可执行的 grep 搜索命令，可直接用于源码扫描
静态+动态：代码模式匹配 → Arthas/Xdebug/–inspect 运行时验证
漏洞链挖掘：9 类常见漏洞组合链（中危+中危→严重）
交互式脚本生成：确认漏洞后自动生成 Python 检测/利用脚本

目录结构

web-audit-skills/
├── SKILL.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 技能入口
├── INDEX.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 完整索引（含难度标注）
├── README.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 本文件
│
├── php/ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# PHP 完整审计
│ &nbsp; ├── overview.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; 总览：危险函数/框架识别/优先级
│ &nbsp; ├── sql-injection.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; SQL注入（原生/PDO/Laravel/TP）
│ &nbsp; ├──&nbsp;command-injection.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 命令注入（system/exec/shell_exec）
│ &nbsp; ├── file-upload.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 文件上传（扩展名/Content-Type绕过）
│ &nbsp; ├── file-include.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; 文件包含（LFI/RFI/Wrapper/日志污染）
│ &nbsp; ├── deserialization.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 反序列化（unserialize/Phar/Session）
│ &nbsp; ├── ssrf.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; SSRF（file_get_contents/curl）
│ &nbsp; ├── xxe.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; XXE（SimpleXML/DOMDocument）
│ &nbsp; ├── ssti.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; SSTI（Twig/Smarty/Blade）
│ &nbsp; ├── xss.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; XSS（echo/模板未转义）
│ &nbsp; ├──&nbsp;type-juggling.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 类型混淆（== vs ===/strcmp/md5）
│ &nbsp; ├── variable-override.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 变量覆盖（extract/parse_str/$$）
│ &nbsp; ├── authentication.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; 认证授权（密码Hash/JWT/Cookie）
│ &nbsp; ├── idor.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; IDOR越权
│ &nbsp; ├── csrf.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; CSRF
│ &nbsp; ├── path-traversal.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; 路径遍历
│ &nbsp; ├── business-logic.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; 业务逻辑（竞争条件/价格操纵）
│ &nbsp; ├── api-security.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; API安全（Mass Assignment/CORS）
│ &nbsp; └── framework/
│ &nbsp; &nbsp; &nbsp; ├── laravel.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; Laravel专项
│ &nbsp; &nbsp; &nbsp; └── thinkphp.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; ThinkPHP专项
│
├── java/ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# Java 完整审计
│ &nbsp; ├── overview.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; 总览：危险API/框架识别/优先级
│ &nbsp; ├── sql-injection.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; SQL注入（JDBC/MyBatis/JPA）
│ &nbsp; ├── deserialization.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 反序列化（readObject/Fastjson/Jackson/Hessian）
│ &nbsp; ├── jndi-injection.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; JNDI注入（Log4j/LDAP/RMI）
│ &nbsp; ├── spel-injection.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; SpEL/OGNL注入
│ &nbsp; ├── ssti.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; SSTI（Freemarker/Velocity/Thymeleaf）
│ &nbsp; ├── ssrf.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; SSRF（URL/RestTemplate/HttpClient）
│ &nbsp; ├── xxe.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; XXE（DocumentBuilder/SAXParser）
│ &nbsp; ├──&nbsp;command-injection.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 命令注入（Runtime.exec/ProcessBuilder）
│ &nbsp; ├── file-upload.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 文件上传（Servlet/MultipartFile）
│ &nbsp; ├── authentication.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; 认证授权（Spring Security/Shiro/JWT）
│ &nbsp; ├── idor.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; IDOR越权
│ &nbsp; ├── api-security.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; API安全（Actuator/Mass Assignment）
│ &nbsp; ├── business-logic.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; 业务逻辑（竞争条件/状态机）
│ &nbsp; └── framework/
│ &nbsp; &nbsp; &nbsp; ├── spring-boot.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; Spring Boot专项
│ &nbsp; &nbsp; &nbsp; ├── struts2.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; Struts2专项
│ &nbsp; &nbsp; &nbsp; ├── shiro.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; Shiro专项
│ &nbsp; &nbsp; &nbsp; └── mybatis.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; MyBatis专项
│
├── dotnet/ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# .NET 完整审计
│ &nbsp; ├── overview.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; 总览
│ &nbsp; ├── sql-injection.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; SQL注入（ADO.NET/EF）
│ &nbsp; ├── deserialization.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 反序列化（BinaryFormatter/Json.NET）
│ &nbsp; ├── viewstate.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; ViewState/MachineKey
│ &nbsp; ├── ssrf.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; SSRF（WebClient/HttpClient）
│ &nbsp; ├── xxe.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; XXE（XmlDocument）
│ &nbsp; ├── ssti.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; SSTI（Razor）
│ &nbsp; ├──&nbsp;command-injection.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 命令注入（Process.Start）
│ &nbsp; ├── file-upload.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 文件上传
│ &nbsp; ├── authentication.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; 认证授权（Identity/JWT）
│ &nbsp; ├── idor.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; IDOR越权
│ &nbsp; ├── csrf.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; CSRF
│ &nbsp; └── framework/
│ &nbsp; &nbsp; &nbsp; ├── aspnet-mvc.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; ASP.NET MVC/Core专项
│ &nbsp; &nbsp; &nbsp; └── aspnet-webforms.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; WebForms专项
│
├── nodejs/ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# Node.js 完整审计
│ &nbsp; ├── overview.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; 总览
│ &nbsp; ├── sql-injection.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; SQL注入（Sequelize/Knex）
│ &nbsp; ├── nosql-injection.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; NoSQL注入（MongoDB/Redis/ES）
│ &nbsp; ├── prototype-pollution.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 原型链污染
│ &nbsp; ├── ssti.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; SSTI（Pug/EJS/Handlebars/Nunjucks）
│ &nbsp; ├── ssrf.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; SSRF（http/axios/fetch）
│ &nbsp; ├──&nbsp;command-injection.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 命令注入（exec/spawn/eval）
│ &nbsp; ├── deserialization.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 反序列化（js-yaml/node-serialize）
│ &nbsp; ├── authentication.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; 认证授权（Passport/JWT/IDOR）
│ &nbsp; ├── path-traversal.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; 路径遍历（sendFile/二次解码）
│ &nbsp; ├── redos.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; ReDoS（灾难性回溯）
│ &nbsp; ├── graphql.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; GraphQL安全
│ &nbsp; ├── websocket.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; WebSocket安全
│ &nbsp; └── framework/
│ &nbsp; &nbsp; &nbsp; ├── express.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; Express专项
│ &nbsp; &nbsp; &nbsp; ├── nestjs.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; NestJS专项
│ &nbsp; &nbsp; &nbsp; └── nextjs.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# &nbsp; Next.js专项
│
├── dynamic/ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 动态调试
│ &nbsp; ├── debug_audit.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 动态调试方法论（4种模式）
│ &nbsp; └── java_arthas_cmds.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; Arthas安全审计命令速查
│
├── workflow/ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 审计编排
│ &nbsp; ├── audit_decision_tree.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 8层审计决策树
│ &nbsp; └── vuln_chaining.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 漏洞链组合逻辑（9类链）
│
├── exploit/ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 利用与脚本
│ &nbsp; ├── script_generation.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 交互式脚本生成
│ &nbsp; ├── template_audit_script.py &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; Python脚本模板
│ &nbsp; └── exploit_guide.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; Payload速查
│
└── remediation/ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 修复方案
&nbsp; &nbsp; └── remediation_guide.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 各平台修复代码+安全配置

快速开始

安装到 Claude Code

cp -r web-audit-skills ~/.claude/skills/

使用

在 Claude Code 对话中提出审计请求：

审计这个 Spring Boot 项目的安全性
检查这个 Laravel 项目是否存在 SQL 注入

AI 将自动：识别技术栈 → 加载对应语言目录 → 按优先级审计 → 动态验证 → 生成报告。

独立阅读

所有文件为纯 Markdown，可直接用编辑器阅读：

# 先读语言总览
cat php/overview.md
cat java/overview.md

# 按漏洞查阅
cat java/deserialization.md
cat nodejs/prototype-pollution.md

审计流程

指纹识别 → 语言总览 → 静态grep → 动态验证 → 脚本/报告
&nbsp; &nbsp;│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
&nbsp; &nbsp;▼ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ▼ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;▼ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;▼ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ▼
响应头/URL &nbsp; &nbsp;对应语言 &nbsp; &nbsp;grep命令 &nbsp; &nbsp;Arthas/ &nbsp; &nbsp;交互式
项目文件 &nbsp; &nbsp; &nbsp;overview &nbsp; 模式匹配 &nbsp; &nbsp;Xdebug/ &nbsp; &nbsp;检测脚本
确定技术栈 &nbsp; &nbsp;危险API &nbsp; &nbsp;逐项审查 &nbsp; &nbsp;--inspect &nbsp; 审计报告
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;审计优先级 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 运行时拦截

漏洞确认五要素

Source — 用户可控输入点
Sink — 危险函数/操作
Path — Source→Sink 完整调用链（无安全处理）
Impact — 可达成的具体安全影响
Evidence — 静态代码证据 + 动态行为证据

工具获取

点击关注下方名片进入公众号

回复关键字【260515】获取下载链接

往期精彩

[NextAnti 反蜜罐插件，快速被蓝队识破并反制红队小伎俩

2026-05-14

](https://mp.weixin.qq.com/s?_biz=Mzk0ODM0NDIxNQ==&mid=2247496839&idx=1&sn=a8ee0709f6d4e09f0adc679c73e3a108&scene=21#wechatredirect)[安卓设备WLAN渗透测试工具 | MAC转换器、网络扫描、漏洞利用、握手存储、虚拟网络控制器

2026-05-12

](https://mp.weixin.qq.com/s?_biz=Mzk0ODM0NDIxNQ==&mid=2247496820&idx=1&sn=b54ee212002df07efe9cddc7f890bb51&scene=21#wechatredirect)[一个面向 Java 反序列化测试的桌面 GUI 工具

2026-05-11

](https://mp.weixin.qq.com/s?_biz=Mzk0ODM0NDIxNQ==&mid=2247496802&idx=1&sn=dcef431c1beec77191e475c995415aec&scene=21#wechatredirect)[攻防、SRC必备插件 | 前端资产采集、嗅探、指纹扫描、泄露扫描、漏洞审计与 Vue Router 分析

2026-05-09

](https://mp.weixin.qq.com/s?_biz=Mzk0ODM0NDIxNQ==&mid=2247496793&idx=1&sn=f10685d09ce9e98c87c3a13e17a7cd2a&scene=21#wechatredirect)[AI 驱动的 Web 加密流量渗透测试自动化代理框架 | 专为解决前端加密 Web 应用的流量加解密问题

2026-05-08

](https://mp.weixin.qq.com/s?_biz=Mzk0ODM0NDIxNQ==&mid=2247496751&idx=1&sn=37cdb1c9332b0d6171f02836b05d8b31&scene=21#wechatredirect)

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：夜组安全《Web 代码审计技能skills | PHP / Java / .NET / Node.js · 50+ 审计文件 · 动态调试 · 漏洞链挖掘》