渗透测试技术 (陈新华 主编王伦 主编乔治锡 主编李力 副主编李肇 副主编杨益鸣 副主编)（Z-Library）

【One-Line Pitch】 A task-driven, hands-on introduction to penetration testing that walks beginners from building a safe lab environment through information gathering, Web and middleware exploitation, scanning, and OS/database attacks. Best for students and newcomers in cybersecurity who want practical, step-by-step operations rather than theory alone. 【Book Arc】 - **Opening (~0%–10%)**: Sets up the lab. Explains what penetration testing is, its workflow, and legal boundaries, then walks through installing VMware and a Kali Linux attack VM—solving the "where do I safely practice?" problem. - **Early (~10%–30%)**: Information gathering fundamentals. Covers host discovery and port scanning with Nmap and Metasploit, including scan types (-sP, -sS, -sU, -sA, -sV) and how to read port states—the reconnaissance base for everything later. - **Early–Middle (~30%–45%)**: Server and Web fingerprinting. Introduces browser plugins (Wappalyzer), WhatWeb, and manual fingerprinting techniques (error pages, robots.txt, default icons) to identify CMS, frameworks, and versions. - **Middle (~45%–60%)**: Web asset and directory discovery. Uses dirb and dirsearch to enumerate directories and sensitive files, turning a live host into a map of attack surfaces. - **Late (~60%–85%)**: Exploitation. Applies typical Web application vulnerabilities (framework and component flaws) and middleware vulnerabilities (configuration and code flaws) to gain control or extract data. - **Ending (~85%–100%)**: Deeper targets. Covers vulnerability scanning, operating-system penetration (file-sharing and remote-connection services), and database penetration across MySQL, SQL Server, PostgreSQL, and Redis. 【Key Takeaways】 - **The lab comes first** (Opening): A virtualized attack/defense setup with VMware and Kali is treated as the prerequisite skill, not an afterthought—snapshots let you safely break and restore systems. - **Reconnaissance drives everything** (Early): Host discovery and port scanning with Nmap and Metasploit determine which targets are alive and what services they expose, shaping every later decision. - **Fingerprinting narrows the attack** (Early–Middle): Identifying CMS, Web server, language, and version lets you map known vulnerabilities instead of guessing—version numbers are the bridge from recon to exploitation. - **Directory scanning reveals hidden assets** (Middle): Tools like dirb and dirsearch surface admin panels, backups, and upload pages that are often the easiest entry points. - **Web flaws split into framework vs. component classes** (Late): The book frames Web exploitation around development-framework bugs and third-party component bugs, giving a reusable mental model. - **Middleware flaws split into configuration vs. code classes** (Late): Misconfigurations (directory browsing, path traversal) and code defects (deserialization, file read) are handled as distinct exploitation families. - **OS and database layers are separate battlegrounds** (Ending): File-sharing and remote-connection services, plus four common databases, each require their own tools and techniques. - **Every task ends with extension thinking** (Throughout): "提高拓展" sections push readers to reason about further exploitation, reinforcing mindset over memorized steps. 【Reading Tips】 - **Deep-read the Opening lab setup**: Reproduce the VMware/Kali build yourself; a working snapshot-based lab is what makes every later exercise safe and repeatable. - **Skim tool menus, deep-read principles**: Command lists (e.g., dirsearch options) can be referenced later, but the "why" behind scan types and fingerprint signals is what transfers to new tools. - **Pair each task with its extension section**: The "提高拓展" content is where exploitation thinking is taught—don't skip it for speed. - **Use the difficulty markers**: Practice questions are graded (△/△△/△△△); start easy to confirm basics, then push into the harder ones. - **Keep legal boundaries front of mind**: The book stresses lawful, authorized testing only—treat this as a working constraint, not boilerplate. 【Coverage Limits】 This guide is built from stratified excerpts covering the front matter, lab setup, information gathering, fingerprinting, and directory scanning; the excerpts do not cover the detailed content of the Web/middleware exploitation, vulnerability scanning, OS, and database chapters, so those sections are summarized from the book's own structural overview rather than chapter-level detail.