XCTF 进阶区 CAT

最新推荐文章于 2023-06-26 20:25:38 发布

原创最新推荐文章于 2023-06-26 20:25:38 发布 · 1.2k 阅读

0 ·

CC 4.0 BY-SA版权

XCTF 专栏收录该内容

26 篇文章

订阅专栏

本文通过一次实战案例，展示了如何利用未被过滤的特殊字符进行宽字节注入攻击，揭示了phpCURLOPT_SAFE_UPLOAD特性下，使用@符号作为绝对路径读取文件的安全风险。

这题脑洞是真的大，讲道理
在这里插入图片描述

看到这个，先尝试了一下命令拼接，发现字符被过滤了应该。fuzz一下看看，有哪些字符还没被过滤了

import requests
dictory=["!","@","#","$","%","^","&","*","(",")","[","]","?","<",">",",",".","/","'",":","|","\\","`",":"]
sesssion = requests.session()
for i in range(0,len(dictory)-1):
    response = sesssion.get("http://111.198.29.45:30710/index.php?url="+dictory[i])
    if "Invalid URL" not in response.text:
        print(dictory[i])