https://x7peeps.com/tags/NGINX/index.htmlHugozh-CNThu, 23 Jul 2026 14:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/03-%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/%E7%BD%91%E7%BB%9C%E4%BB%A3%E7%90%86%E4%B8%8E%E8%B4%9F%E8%BD%BD%E5%9D%87%E8%A1%A1/%E7%BD%91%E7%BB%9C%E4%BB%A3%E7%90%86%E4%B8%8E%E8%B4%9F%E8%BD%BD%E5%9D%87%E8%A1%A1%E9%AB%98%E5%8D%B1%E6%94%BB%E5%87%BB%E9%93%BE%E4%B8%93%E9%A2%98/index.htmlFri, 26 Jun 2026 14:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/03-%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/%E7%BD%91%E7%BB%9C%E4%BB%A3%E7%90%86%E4%B8%8E%E8%B4%9F%E8%BD%BD%E5%9D%87%E8%A1%A1/%E7%BD%91%E7%BB%9C%E4%BB%A3%E7%90%86%E4%B8%8E%E8%B4%9F%E8%BD%BD%E5%9D%87%E8%A1%A1%E9%AB%98%E5%8D%B1%E6%94%BB%E5%87%BB%E9%93%BE%E4%B8%93%E9%A2%98/index.html系统梳理 Nginx / HAProxy / Traefik / HTTP/2 协议等网络代理与负载均衡组件中 6 个高危漏洞的完整攻击链，涵盖 HTTP 请求走私、Rapid Reset DoS、命令注入、路径穿越等核心利用路径，附完整 PoC、Nuclei 检测模板与自动化利用脚本。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/WebShell%E8%90%BD%E5%9C%B0%E4%B8%8E%E6%96%87%E4%BB%B6%E6%97%B6%E9%97%B4%E7%BA%BF%E5%88%86%E6%9E%90/index.htmlMon, 15 Jun 2026 14:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/WebShell%E8%90%BD%E5%9C%B0%E4%B8%8E%E6%96%87%E4%BB%B6%E6%97%B6%E9%97%B4%E7%BA%BF%E5%88%86%E6%9E%90/index.html围绕 WebShell 文件落地、访问日志、文件时间戳、执行链与二次下载行为，分析如何判断 WebShell 是入口、驻留点还是横向跳板。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/04-%E6%B8%97%E9%80%8F%E6%94%BB%E5%87%BB/1-API%E7%BD%91%E5%85%B3%E4%B8%8E%E4%BB%A3%E7%90%86/Nginx_%E9%85%8D%E7%BD%AE%E9%94%99%E8%AF%AF_Alias_Traversal_%E8%AF%B7%E6%B1%82%E8%B5%B0%E7%A7%81_%E8%B7%AF%E5%BE%84%E7%A9%BF%E8%B6%8A_CVE_%E6%BC%8F%E6%B4%9E%E9%93%BE%E5%88%A9%E7%94%A8%E6%8A%80%E6%9C%AF/index.htmlMon, 22 Jun 2026 02:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/04-%E6%B8%97%E9%80%8F%E6%94%BB%E5%87%BB/1-API%E7%BD%91%E5%85%B3%E4%B8%8E%E4%BB%A3%E7%90%86/Nginx_%E9%85%8D%E7%BD%AE%E9%94%99%E8%AF%AF_Alias_Traversal_%E8%AF%B7%E6%B1%82%E8%B5%B0%E7%A7%81_%E8%B7%AF%E5%BE%84%E7%A9%BF%E8%B6%8A_CVE_%E6%BC%8F%E6%B4%9E%E9%93%BE%E5%88%A9%E7%94%A8%E6%8A%80%E6%9C%AF/index.htmlNginx 反向代理渗透测试：配置错误攻击面、Alias Traversal (off-by-slash)、HTTP 请求走私、路径穿越 ACL 绕过、Resolver DNS 欺骗、CVE-2021-23017 / CVE-2022-41741 漏洞利用链路与蓝队检测方案https://x7peeps.com/%E5%AE%89%E5%85%A8/%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/03-%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/API%E5%AE%89%E5%85%A8%E7%BD%91%E5%85%B3%E4%B8%8E%E9%98%B2%E6%8A%A4%E5%B9%B3%E5%8F%B0/API%E5%AE%89%E5%85%A8%E7%BD%91%E5%85%B3%E4%B8%8E%E9%98%B2%E6%8A%A4%E5%B9%B3%E5%8F%B0%E9%AB%98%E5%8D%B1%E6%94%BB%E5%87%BB%E9%93%BE%E4%B8%93%E9%A2%98/index.htmlThu, 23 Jul 2026 14:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/03-%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/API%E5%AE%89%E5%85%A8%E7%BD%91%E5%85%B3%E4%B8%8E%E9%98%B2%E6%8A%A4%E5%B9%B3%E5%8F%B0/API%E5%AE%89%E5%85%A8%E7%BD%91%E5%85%B3%E4%B8%8E%E9%98%B2%E6%8A%A4%E5%B9%B3%E5%8F%B0%E9%AB%98%E5%8D%B1%E6%94%BB%E5%87%BB%E9%93%BE%E4%B8%93%E9%A2%98/index.html⚠️ 安全免责声明 本文仅用于安全研究与教育目的。文中提供的 PoC、Nuclei 模板和攻击脚本仅供授权安全测试使用。未经授权对他人系统实施攻击属于违法行为。作者不对任何因滥用本文内容造成的结果负责。请在获得书面授权后方可进行实际测试。