+
+点赞
+是鼓励
+在看
+是认同
+分享
+是
+传递知识
+
+**看完点个**
+**“在看”**
+**分享给更多人**
+
+
diff --git a/doc/警惕！2024年全球零日漏洞利用呈现七大趋势.md b/doc/警惕！2024年全球零日漏洞利用呈现七大趋势.md
index 655d0e2e..867cd163 100644
--- a/doc/警惕！2024年全球零日漏洞利用呈现七大趋势.md
+++ b/doc/警惕！2024年全球零日漏洞利用呈现七大趋势.md
@@ -1,42 +1,29 @@
# 警惕！2024年全球零日漏洞利用呈现七大趋势
-安全内参编译 安全内参 2024-12-25 10:14
+安全内参编译 安小圈 2024-12-30 00:45
-**关注我们**
+**安小圈**
-**带你读懂网络安全**
+第578期
+**【零日漏洞】趋势**
-
+****
+
+
+****
**网络安全设备、远程监控和管理产品、托管文件传输服务、CI/CD工具、开源软件供应链、AI基础软件、系统自带安全功能等成为零日漏洞的热门攻击目标。**
-前情回顾·**零日漏洞层出不穷**
-- [多国警告：零日漏洞攻击暴涨已成为网空新常态](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247513066&idx=1&sn=1f1e58c9bfd0c64d48f2d26a4ec2332c&scene=21#wechat_redirect)
-
-
-- [2023年零日漏洞在野利用激增，商业间谍软件是主要使用者](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247511311&idx=2&sn=8b9d344600b36db40c81d164df732d03&scene=21#wechat_redirect)
-
-
-- [商业间谍软件猖獗！2022年底至少使用5个零日漏洞，安卓苹果设备通杀](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247508198&idx=1&sn=c7f94589bf9f280dd6d5c3fbbba3e904&scene=21#wechat_redirect)
-
-
-- [2021年至少7个零日漏洞被商业化！间谍软件行业正蓬勃发展](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247503777&idx=1&sn=444d5bc8112f1508fcd152f24ceb8d84&scene=21#wechat_redirect)
-
-
-
-
安全内参12月25日消息，2024年，零日漏洞的数量再次显著增加。由于缺乏可用的补丁，这些漏洞使攻击者可以先于网络防御团队采取行动，成为攻陷企业系统的核心武器。
尽管所有零日漏洞都是首席信息安全官（CISO）及其团队必须了解的，也是供应商必须尽快修复的，但某些零日漏洞特别重要，因为它们揭示了攻击者试图通过哪些产品获得对企业网络和数据的访问权限。
以下总结了2024年零日漏洞利用激增的背景下，CISO及其企业安全团队应密切关注的一些重要趋势。这些趋势因其重要性、创新性或对企业资产的直接影响而意义重大。
-
**1. 针对网络安全设备的零日攻击增加**
-
今年，针对网络边缘设备（包括VPN网关、防火墙、邮件安全网关和负载均衡系统）的攻击明显加速。这些设备因其强大的功能、在网络中的特权位置以及底层代码和操作系统的有限可见性，成为攻击者进入企业网络的理想入口点。
年初，Ivanti披露了Connect Secure（SSL VPN）和Policy Secure（网络访问控制）产品中的两个零日漏洞。其中一个漏洞（CVE-2023-46805）允许身份验证绕过，另一个漏洞（CVE-2024-21887）使攻击者能够进行底层操作系统的命令注入。这些漏洞被一个国家级黑客组织利用，并组合成攻击链。
@@ -74,20 +61,16 @@
此外，一些已知漏洞（已修复的nday漏洞）也持续在未修补的网络边缘设备和应用中被广泛利用，使这些系统在2024年成为攻击者（尤其是国家支持的网络间谍组织）的主要目标之一。
-
**2. 远程监控和管理仍是热门目标**
-
攻击者，尤其是为勒索软件团伙工作的初始访问经纪人，习惯性地滥用远程监控和管理（RMM）产品，不仅用于维持在企业网络中的持久性，还用于突破网络防线。
早在2021年，REvil勒索软件团伙就曾利用Kaseya VSA服务器（托管服务商经常使用的RMM平台）中的漏洞。今年2月，攻击者又利用了ConnectWise ScreenConnect中的两个零日漏洞：路径遍历（CVE-2024-1708）和身份验证绕过（CVE-2024-1709）。
通过这些漏洞，攻击者得以访问初始设置向导并重置管理员密码。正常情况下，这种设置向导仅应运行一次，并在完成配置后受到保护。
-
**3. 托管文件传输受到攻击**
-
勒索软件团伙频繁以企业托管文件传输软件（MFT）为目标，以获取企业网络的初始访问权限。2024年12月，攻击者利用了Cleo LexiCom、VLTrader和Harmony这三种企业文件传输产品中的任意文件写入漏洞（CVE-2024-55956）。
该漏洞与2024年10月在Cleo同一产品中修复的另一个漏洞（CVE-2024-50623）类似。后者允许任意文件写入和读取。尽管这些漏洞出现在相同的代码基础部分，并可通过相同端点访问，但Rapid7研究人员表示它们是独立漏洞，无需结合利用。
@@ -98,7 +81,6 @@
2023年初，Cl0p还利用了GoAnywhere MFT中的远程代码执行零日漏洞（CVE-2023-0669），声称窃取了130家组织的数据。更早在2020年，该团伙曾利用Accellion File Transfer Appliance中的零日漏洞（CVE-2021-27101）。
-
**4. 持续集成/持续交付工具漏洞吸引攻击者**
攻击者还在寻找持续集成/持续交付（CI/CD）工具中的漏洞。这些工具不仅可能成为企业网络的潜在入口（尤其是暴露在互联网上时），还可能被用来入侵软件开发管道，从而引发供应链攻击。2020年SolarWinds Orion软件后门攻击事件，就是此类攻击的知名案例。这款软件被数以万计的私营企业和政府机构使用。
@@ -109,7 +91,6 @@
这并非攻击者首次将目标对准TeamCity。2023年9月，另一个身份验证绕过漏洞（CVE-2023-42793）被发现。该漏洞很快被朝鲜国家支持的黑客利用，用于攻破Windows环境。而在2024年，这一漏洞继续成为其他攻击团伙的目标。
-
**5. 软件供应链攻击层出不穷**
CI/CD工具漏洞并不是攻击者进入开发/构建环境，并破坏源代码或植入后门的唯一途径。今年，一场持续多年的渗透行动被曝光，一名使用假身份的恶意开发者逐渐赢得了一个开源项目的信任，并被添加为XZ Utils库的维护者。该库是一种广泛使用的开源数据压缩库。
@@ -120,7 +101,6 @@ CI/CD工具漏洞并不是攻击者进入开发/构建环境，并破坏源代
此外，12月，攻击者利用GitHub Actions中的脚本注入漏洞，入侵并植入Ultralytics YOLO（一种开源AI库）PyPI版本的后门。这类因不安全使用GitHub Actions CI/CD服务而引发的脚本注入漏洞在今年早些时候已被记录，且可能影响许多托管在GitHub上的项目。
-
**6. AI热潮带来新的攻击可能性**
随着组织竞相测试和整合AI聊天机器人及机器学习模型到业务工作流中，它们在云基础设施上部署了各种AI相关框架、库和平台。然而，这些平台不仅配置不安全，还可能存在漏洞。攻击者利用这些漏洞可以访问敏感的知识产权（如定制的AI模型和训练数据），甚至还可能获得对底层服务器的控制权限。
@@ -131,10 +111,8 @@ Jupyter Notebooks是一种广泛用于数据可视化和机器学习的基于Web
这些研究表明，作为较新的领域，许多AI/ML框架在安全性方面尚不成熟，或者未受到与其他类型软件同等水平的安全审查。尽管研究人员正在加强对这些工具的审查，但恶意攻击者也在积极研究这些工具，而仍有大量未被发现的漏洞为他们提供了可乘之机。
-
**7.安全功能绕过使攻击更具威胁性**
-
尽管组织应优先修补严重的远程代码执行漏洞，但需要注意的是，攻击者在实际操作中同样会利用权限提升或安全功能绕过等低严重性漏洞，这些漏洞对于攻击链的成功至关重要。
今年，攻击者利用了Windows中的5个零日漏洞，这些漏洞允许绕过SmartScreen提示，从而执行从互联网上下载的文件：CVE-2024-38217、CVE-2024-38213、CVE-2024-29988、CVE-2024-21351和CVE-2024-21412。
@@ -148,23 +126,45 @@ Windows Defender SmartScreen是一种内置于Windows的文件信誉功能，用
**参考资料：csoonline.com**
+
-**推荐阅读**
-- [网安智库平台长期招聘兼职研究员](http://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247499450&idx=2&sn=2da3ca2e0b4d4f9f56ea7f7579afc378&chksm=ebfab99adc8d308c3ba6e7a74bd41beadf39f1b0e38a39f7235db4c305c06caa49ff63a0cc1d&scene=21#wechat_redirect)
+**【原文来源： 安全内参****】**
+
+
+
+
+[](https://mp.weixin.qq.com/s?__biz=Mzg2MDg0ODg1NQ==&mid=2247537603&idx=1&sn=1ccc079f76699e66a63b1983f8b97037&scene=21#wechat_redirect)
+- # 【年末警惕】针对财会人员！“银狐”木马新变种伪装成财税文件在微信群传播！
+
+[](http://mp.weixin.qq.com/s?__biz=Mzg2MDg0ODg1NQ==&mid=2247530615&idx=3&sn=58f5cff7d004e5b6669099e7b0931226&chksm=ce222fcff955a6d94d1c86fd0d2677f1d2bdd48c56fe50e0616c14f2567b268e1bad558b945b&scene=21#wechat_redirect)
+- [迪士尼 遭【黑客入侵】| 泄露1.1TB数据，被迫弃用Slack](http://mp.weixin.qq.com/s?__biz=Mzg2MDg0ODg1NQ==&mid=2247530615&idx=3&sn=58f5cff7d004e5b6669099e7b0931226&chksm=ce222fcff955a6d94d1c86fd0d2677f1d2bdd48c56fe50e0616c14f2567b268e1bad558b945b&scene=21#wechat_redirect)
-- [欢迎加入“安全内参热点讨论群”](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247501251&idx=1&sn=8b6ebecbe80c1c72317948494f87b489&chksm=ebfa82e3dc8d0bf595d039e75b446e14ab96bf63cf8ffc5d553b58248dde3424fb18e6947440&token=525430415&lang=zh_CN&scene=21#wechat_redirect)
+[](http://mp.weixin.qq.com/s?__biz=Mzg2MDg0ODg1NQ==&mid=2247520585&idx=3&sn=ad5b60917726cceca6868f649edfe0a9&chksm=ce22c6f1f9554fe7637864ef2a3cde10cdfad3015570b03e64c37bdbf0cc75d03a26ffcb2daa&scene=21#wechat_redirect)
+- [【遭入侵】迪士尼，泄露1.2TB内部数据](https://mp.weixin.qq.com/s?__biz=Mzg2MDg0ODg1NQ==&mid=2247520585&idx=3&sn=ad5b60917726cceca6868f649edfe0a9&chksm=ce22c6f1f9554fe7637864ef2a3cde10cdfad3015570b03e64c37bdbf0cc75d03a26ffcb2daa&token=713211275&lang=zh_CN&scene=21#wechat_redirect)
+
+
+[](http://mp.weixin.qq.com/s?__biz=Mzg2MDg0ODg1NQ==&mid=2247529598&idx=1&sn=a6a2b5b2fdda54d41ee7af11bd3a443c&chksm=ce2223c6f955aad04a36fb3e52af88d005acbbdc5ffa588c10688245bb113be655f739e34a10&scene=21#wechat_redirect)
+- [惊心动魄！Akira 成功勒索100万美元，全程谈判记录大曝光！](http://mp.weixin.qq.com/s?__biz=Mzg2MDg0ODg1NQ==&mid=2247529598&idx=1&sn=a6a2b5b2fdda54d41ee7af11bd3a443c&chksm=ce2223c6f955aad04a36fb3e52af88d005acbbdc5ffa588c10688245bb113be655f739e34a10&scene=21#wechat_redirect)
+
+
+[](http://mp.weixin.qq.com/s?__biz=Mzg2MDg0ODg1NQ==&mid=2247500168&idx=2&sn=59dcc8abe1a52f4672ba739aaaf32e50&chksm=ce229630f9551f26aa12dfce3efcf450d2db4755d1b873dd91c46f4ab67963a13da0954bd43e&scene=21#wechat_redirect)
+- [【技术解析】| 工商银行美国子公司勒索病毒事件分析](https://mp.weixin.qq.com/s?__biz=Mzg2MDg0ODg1NQ==&mid=2247500168&idx=2&sn=59dcc8abe1a52f4672ba739aaaf32e50&chksm=ce229630f9551f26aa12dfce3efcf450d2db4755d1b873dd91c46f4ab67963a13da0954bd43e&scene=21#wechat_redirect)
+
+
+[](http://mp.weixin.qq.com/s?__biz=Mzg2MDg0ODg1NQ==&mid=2247499768&idx=1&sn=aa44663417d808f2703b690d7a38c92d&chksm=ce22a840f9552156cf12b9f77a44816ef3781117579292252068052a16cfdc380ab6b167aa8f&scene=21#wechat_redirect)
+
+**【突发】中国工商银行遭勒索软件攻击**
+
+****- [【专题分享】中国工商银行：数据安全技术平台建设实践](https://mp.weixin.qq.com/s?__biz=Mzg2MDg0ODg1NQ==&mid=2247490269&idx=2&sn=050ba319ad33de8c821f3512689546a3&chksm=ce214d65f956c473a1ec2a777448036bc1a87e30166fc6dd62dea59bab9ac626d94f48101f92&scene=21#wechat_redirect)
+
-
-点击下方卡片关注我们，
-
-带你一起读懂网络安全 ↓
-
-
-
+
+
+
diff --git a/doc/轻量级，免费，百万POC.md b/doc/轻量级，免费，百万POC.md
new file mode 100644
index 00000000..b1b035c4
--- /dev/null
+++ b/doc/轻量级，免费，百万POC.md
@@ -0,0 +1,105 @@
+# 轻量级，免费，百万POC
+菜狗 富贵安全 2024-12-30 00:38
+
+### Nuclei 是一款现代的高性能漏洞扫描程序，它利用基于 YAML 的简单模板。它使您能够设计模拟真实情况的自定义漏洞检测场景，从而实现零误报。
+- 用于创建和自定义漏洞模板的简单 YAML 格式。
+
+- 由数千名安全专家贡献，以解决流行的漏洞。
+
+- 通过模拟真实世界的步骤来验证漏洞，从而减少误报。
+
+- 超快速的并行扫描处理和请求聚类。
+
+- 集成到 CI/CD 管道中以进行漏洞检测和回归测试。
+
+- 支持多种协议，如 TCP、DNS、HTTP、SSL、WHOIS JavaScript、代码等。
+
+- 与 Jira、Splunk、GitHub、Elastic、GitLab 集成。
+
+### 立即开始
+1. 核 CLI
+
+- 在您的机器上安装 Nuclei。按照此处的安装指南开始安装。此外，我们还提供免费云层，并提供慷慨的每月免费限额：
+
+- 存储并可视化您的漏洞发现
+
+- 编写和管理您的核模板
+
+- 访问最新的原子核模板
+
+- 发现并存储您的目标
+
+### 2. 专业版和企业版
+
+对于安全团队和企业，我们提供基于 Nuclei OSS 构建的云托管服务，该服务经过微调，可帮助您与您的团队和现有工作流程一起持续大规模运行漏洞扫描：
+- 扫描速度提高 50 倍
+
+- 大规模高精度扫描
+
+- 与云服务集成（AWS、GCP、Azure、CloudFlare、Fastly、Terraform、Kubernetes）
+
+- Jira、Slack、Linear、API 和 Webhooks
+
+- 执行和合规报告
+
+- 另外：实时扫描、SAML SSO、SOC 2 兼容平台（具有欧盟和美国托管选项）、共享团队工作区等
+
+- 我们正在不断添加新功能！
+
+- 适用于：渗透测试人员、安全团队和企业
+
+- 如果您的组织规模较大且要求复杂，请注册 Pro或与我们的团队联系。
+
+### 安装
+
+nuclei需要go1.21才能成功安装。运行以下命令获取 repo：
+```
+go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
+```
+
+要了解有关安装 nuclei 的更多信息，请参阅https://docs.projectdiscovery.io/tools/nuclei/install。
+### 命令行标志
+
+要显示该工具的所有标志：
+```
+nuclei -h
+```
+```
+Nuclei is a fast, template based vulnerability scanner focusingon extensive configurability, massive extensibility and ease of use.Usage: ./nuclei [flags]Flags:TARGET: -u, -target string[] target URLs/hosts to scan -l, -list string path to file containing a list of target URLs/hosts to scan (one per line) -eh, -exclude-hosts string[] hosts to exclude to scan from the input list (ip, cidr, hostname) -resume string resume scan using resume.cfg (clustering will be disabled) -sa, -scan-all-ips scan all the IP's associated with dns record -iv, -ip-version string[] IP version to scan of hostname (4,6) - (default 4)TARGET-FORMAT: -im, -input-mode string mode of input file (list, burp, jsonl, yaml, openapi, swagger) (default "list") -ro, -required-only use only required fields in input format when generating requests -sfv, -skip-format-validation skip format validation (like missing vars) when parsing input fileTEMPLATES: -nt, -new-templates run only new templates added in latest nuclei-templates release -ntv, -new-templates-version string[] run new templates added in specific version -as, -automatic-scan automatic web scan using wappalyzer technology detection to tags mapping -t, -templates string[] list of template or template directory to run (comma-separated, file) -turl, -template-url string[] template url or list containing template urls to run (comma-separated, file) -w, -workflows string[] list of workflow or workflow directory to run (comma-separated, file) -wurl, -workflow-url string[] workflow url or list containing workflow urls to run (comma-separated, file) -validate validate the passed templates to nuclei -nss, -no-strict-syntax disable strict syntax check on templates -td, -template-display displays the templates content -tl list all available templates -tgl list all available tags -sign signs the templates with the private key defined in NUCLEI_SIGNATURE_PRIVATE_KEY env variable -code enable loading code protocol-based templates -dut, -disable-unsigned-templates disable running unsigned templates or templates with mismatched signatureFILTERING: -a, -author string[] templates to run based on authors (comma-separated, file) -tags string[] templates to run based on tags (comma-separated, file) -etags, -exclude-tags string[] templates to exclude based on tags (comma-separated, file) -itags, -include-tags string[] tags to be executed even if they are excluded either by default or configuration -id, -template-id string[] templates to run based on template ids (comma-separated, file, allow-wildcard) -eid, -exclude-id string[] templates to exclude based on template ids (comma-separated, file) -it, -include-templates string[] path to template file or directory to be executed even if they are excluded either by default or configuration -et, -exclude-templates string[] path to template file or directory to exclude (comma-separated, file) -em, -exclude-matchers string[] template matchers to exclude in result -s, -severity value[] templates to run based on severity. Possible values: info, low, medium, high, critical, unknown -es, -exclude-severity value[] templates to exclude based on severity. Possible values: info, low, medium, high, critical, unknown -pt, -type value[] templates to run based on protocol type. Possible values: dns, file, http, headless, tcp, workflow, ssl, websocket, whois, code, javascript -ept, -exclude-type value[] templates to exclude based on protocol type. Possible values: dns, file, http, headless, tcp, workflow, ssl, websocket, whois, code, javascript -tc, -template-condition string[] templates to run based on expression conditionOUTPUT: -o, -output string output file to write found issues/vulnerabilities -sresp, -store-resp store all request/response passed through nuclei to output directory -srd, -store-resp-dir string store all request/response passed through nuclei to custom directory (default "output") -silent display findings only -nc, -no-color disable output content coloring (ANSI escape codes) -j, -jsonl write output in JSONL(ines) format -irr, -include-rr -omit-raw include request/response pairs in the JSON, JSONL, and Markdown outputs (for findings only) [DEPRECATED use -omit-raw] (default true) -or, -omit-raw omit request/response pairs in the JSON, JSONL, and Markdown outputs (for findings only) -ot, -omit-template omit encoded template in the JSON, JSONL output -nm, -no-meta disable printing result metadata in cli output -ts, -timestamp enables printing timestamp in cli output -rdb, -report-db string nuclei reporting database (always use this to persist report data) -ms, -matcher-status display match failure status -me, -markdown-export string directory to export results in markdown format -se, -sarif-export string file to export results in SARIF format -je, -json-export string file to export results in JSON format -jle, -jsonl-export string file to export results in JSONL(ine) format -rd, -redact string[] redact given list of keys from query parameter, request header and bodyCONFIGURATIONS: -config string path to the nuclei configuration file -tp, -profile string template profile config file to run -tpl, -profile-list list community template profiles -fr, -follow-redirects enable following redirects for http templates -fhr, -follow-host-redirects follow redirects on the same host -mr, -max-redirects int max number of redirects to follow for http templates (default 10) -dr, -disable-redirects disable redirects for http templates -rc, -report-config string nuclei reporting module configuration file -H, -header string[] custom header/cookie to include in all http request in header:value format (cli, file) -V, -var value custom vars in key=value format -r, -resolvers string file containing resolver list for nuclei -sr, -system-resolvers use system DNS resolving as error fallback -dc, -disable-clustering disable clustering of requests -passive enable passive HTTP response processing mode -fh2, -force-http2 force http2 connection on requests -ev, -env-vars enable environment variables to be used in template -cc, -client-cert string client certificate file (PEM-encoded) used for authenticating against scanned hosts -ck, -client-key string client key file (PEM-encoded) used for authenticating against scanned hosts -ca, -client-ca string client certificate authority file (PEM-encoded) used for authenticating against scanned hosts -sml, -show-match-line show match lines for file templates, works with extractors only -ztls use ztls library with autofallback to standard one for tls13 [Deprecated] autofallback to ztls is enabled by default -sni string tls sni hostname to use (default: input domain name) -dka, -dialer-keep-alive value keep-alive duration for network requests. -lfa, -allow-local-file-access allows file (payload) access anywhere on the system -lna, -restrict-local-network-access blocks connections to the local / private network -i, -interface string network interface to use for network scan -at, -attack-type string type of payload combinations to perform (batteringram,pitchfork,clusterbomb) -sip, -source-ip string source ip address to use for network scan -rsr, -response-size-read int max response size to read in bytes -rss, -response-size-save int max response size to read in bytes (default 1048576) -reset reset removes all nuclei configuration and data files (including nuclei-templates) -tlsi, -tls-impersonate enable experimental client hello (ja3) tls randomization -hae, -http-api-endpoint string experimental http api endpointINTERACTSH: -iserver, -interactsh-server string interactsh server url for self-hosted instance (default: oast.pro,oast.live,oast.site,oast.online,oast.fun,oast.me) -itoken, -interactsh-token string authentication token for self-hosted interactsh server -interactions-cache-size int number of requests to keep in the interactions cache (default 5000) -interactions-eviction int number of seconds to wait before evicting requests from cache (default 60) -interactions-poll-duration int number of seconds to wait before each interaction poll request (default 5) -interactions-cooldown-period int extra time for interaction polling before exiting (default 5) -ni, -no-interactsh disable interactsh server for OAST testing, exclude OAST based templatesFUZZING: -ft, -fuzzing-type string overrides fuzzing type set in template (replace, prefix, postfix, infix) -fm, -fuzzing-mode string overrides fuzzing mode set in template (multiple, single) -fuzz enable loading fuzzing templates (Deprecated: use -dast instead) -dast enable / run dast (fuzz) nuclei templates -dfp, -display-fuzz-points display fuzz points in the output for debugging -fuzz-param-frequency int frequency of uninteresting parameters for fuzzing before skipping (default 10) -fa, -fuzz-aggression string fuzzing aggression level controls payload count for fuzz (low, medium, high) (default "low")UNCOVER: -uc, -uncover enable uncover engine -uq, -uncover-query string[] uncover search query -ue, -uncover-engine string[] uncover search engine (shodan,censys,fofa,shodan-idb,quake,hunter,zoomeye,netlas,criminalip,publicwww,hunterhow,google) (default shodan) -uf, -uncover-field string uncover fields to return (ip,port,host) (default "ip:port") -ul, -uncover-limit int uncover results to return (default 100) -ur, -uncover-ratelimit int override ratelimit of engines with unknown ratelimit (default 60 req/min) (default 60)RATE-LIMIT: -rl, -rate-limit int maximum number of requests to send per second (default 150) -rld, -rate-limit-duration value maximum number of requests to send per second (default 1s) -rlm, -rate-limit-minute int maximum number of requests to send per minute (DEPRECATED) -bs, -bulk-size int maximum number of hosts to be analyzed in parallel per template (default 25) -c, -concurrency int maximum number of templates to be executed in parallel (default 25) -hbs, -headless-bulk-size int maximum number of headless hosts to be analyzed in parallel per template (default 10) -headc, -headless-concurrency int maximum number of headless templates to be executed in parallel (default 10) -jsc, -js-concurrency int maximum number of javascript runtimes to be executed in parallel (default 120) -pc, -payload-concurrency int max payload concurrency for each template (default 25) -prc, -probe-concurrency int http probe concurrency with httpx (default 50)OPTIMIZATIONS: -timeout int time to wait in seconds before timeout (default 10) -retries int number of times to retry a failed request (default 1) -ldp, -leave-default-ports leave default HTTP/HTTPS ports (eg. host:80,host:443) -mhe, -max-host-error int max errors for a host before skipping from scan (default 30) -te, -track-error string[] adds given error to max-host-error watchlist (standard, file) -nmhe, -no-mhe disable skipping host from scan based on errors -project use a project folder to avoid sending same request multiple times -project-path string set a specific project path (default "/tmp") -spm, -stop-at-first-match stop processing HTTP requests after the first match (may break template/workflow logic) -stream stream mode - start elaborating without sorting the input -ss, -scan-strategy value strategy to use while scanning(auto/host-spray/template-spray) (default auto) -irt, -input-read-timeout value timeout on input read (default 3m0s) -nh, -no-httpx disable httpx probing for non-url input -no-stdin disable stdin processingHEADLESS: -headless enable templates that require headless browser support (root user on Linux will disable sandbox) -page-timeout int seconds to wait for each page in headless mode (default 20) -sb, -show-browser show the browser on the screen when running templates with headless mode -ho, -headless-options string[] start headless chrome with additional options -sc, -system-chrome use local installed Chrome browser instead of nuclei installed -lha, -list-headless-action list available headless actionsDEBUG: -debug show all requests and responses -dreq, -debug-req show all sent requests -dresp, -debug-resp show all received responses -p, -proxy string[] list of http/socks5 proxy to use (comma separated or file input) -pi, -proxy-internal proxy all internal requests -ldf, -list-dsl-function list all supported DSL function signatures -tlog, -trace-log string file to write sent requests trace log -elog, -error-log string file to write sent requests error log -version show nuclei version -hm, -hang-monitor enable nuclei hang monitoring -v, -verbose show verbose output -profile-mem string optional nuclei memory profile dump file -vv display templates loaded for scan -svd, -show-var-dump show variables dump for debugging -ep, -enable-pprof enable pprof debugging server -tv, -templates-version shows the version of the installed nuclei-templates -hc, -health-check run diagnostic check upUPDATE: -up, -update update nuclei engine to the latest released version -ut, -update-templates update nuclei-templates to latest released version -ud, -update-template-dir string custom directory to install / update nuclei-templates -duc, -disable-update-check disable automatic nuclei/templates update checkSTATISTICS: -stats display statistics about the running scan -sj, -stats-json display statistics in JSONL(ines) format -si, -stats-interval int number of seconds to wait between showing a statistics update (default 5) -mp, -metrics-port int port to expose nuclei metrics on (default 9092)CLOUD: -auth configure projectdiscovery cloud (pdcp) api key (default true) -tid, -team-id string upload scan results to given team id (optional) (default "none") -cup, -cloud-upload upload scan results to pdcp dashboard [DEPRECATED use -dashboard] -sid, -scan-id string upload scan results to existing scan id (optional) -sname, -scan-name string scan name to set (optional) -pd, -dashboard upload / view nuclei results in projectdiscovery cloud (pdcp) UI dashboard -pdu, -dashboard-upload string upload / view nuclei results file (jsonl) in projectdiscovery cloud (pdcp) UI dashboardAUTHENTICATION: -sf, -secret-file string[] path to config file containing secrets for nuclei authenticated scan -ps, -prefetch-secrets prefetch secrets from the secrets fileEXAMPLES:Run nuclei on single host: $ nuclei -target example.comRun nuclei with specific template directories: $ nuclei -target example.com -t http/cves/ -t sslRun nuclei against a list of hosts: $ nuclei -list hosts.txtRun nuclei with a JSON output: $ nuclei -target example.com -json-export output.jsonRun nuclei with sorted Markdown outputs (with environment variables): $ MARKDOWN_EXPORT_SORT_MODE=template nuclei -target example.com -markdown-export nuclei_report/Additional documentation is available at: https://docs.nuclei.sh/getting-started/running
+```
+### 单目标扫描
+
+要对 Web 应用程序执行快速扫描：
+```
+nuclei -target https://example.com
+```
+### 扫描多个目标
+
+Nuclei 可以通过提供目标列表来处理批量扫描。您可以使用包含多个 URL 的文件。
+```
+nuclei -targets urls.txt
+```
+### 网络扫描
+
+这将扫描整个子网以查找与网络相关的问题，例如开放端口或配置错误的服务。
+```
+nuclei -target 192.168.1.0/24
+```
+### 使用自定义模板进行扫描
+
+使用自定义模板进行扫描
+```
+nuclei -u https://example.com -t /path/to/your-template.yaml
+```
+### 将 Nuclei 连接至 ProjectDiscovery
+
+您可以在您的机器上运行扫描并将结果上传到云平台进行进一步分析和补救。
+```
+nuclei -target https://example.com -dashboard
+```
+```
+原文链接:https://github.com/projectdiscovery/nuclei
+```
+
+
+