<?xml version="1.0" encoding="utf-8" ?><rss version="2.0"><channel><title><![CDATA[bmth666的博客]]></title><description><![CDATA[]]></description><link>https://blog.youkuaiyun.com/bmth666</link><language>zh-cn</language><generator>https://blog.youkuaiyun.com/</generator><copyright><![CDATA[Copyright &copy; bmth666]]></copyright><item><title><![CDATA[SWPUCTF2019web题复现]]></title><link>https://blog.youkuaiyun.com/bmth666/article/details/123773368</link><guid>https://blog.youkuaiyun.com/bmth666/article/details/123773368</guid><author>bmth666</author><pubDate>Tue, 05 Apr 2022 14:05:18 +0800</pubDate><description><![CDATA[[SWPU2019]easy_web

有一个登录框，试了试万能密码失败，那就注册吧

登录后发现有一个申请广告，在标题处输入11111111’，发现报错，应该是sql注入

禁用了or，空格等等，先使用union发现有22列
-1'/**/union/**/select/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,'22

后面发现还可以用-1'/**/group/**/by/**/22,'1，一样可以爆出为22列

查看数据库：-1']]></description><category></category></item><item><title><![CDATA[2021极客大挑战web部分wp]]></title><link>https://blog.youkuaiyun.com/bmth666/article/details/120928178</link><guid>https://blog.youkuaiyun.com/bmth666/article/details/120928178</guid><author>bmth666</author><pubDate>Fri, 26 Nov 2021 14:42:21 +0800</pubDate><description><![CDATA[Dark
看到url：http://c6h35nlkeoew5vzcpsacsidbip2ezotsnj6sywn7znkdtrbsqkexa7yd.onion/
发现后缀为.onion，为洋葱，下载后使用洋葱游览器访问

Welcome2021
查看源码发现

那么抓包使用WELCOME请求方式访问

访问f1111aaaggg9.php

得到flag
babysql
简单的sql注入，直接使用sqlmap即可，也可以联合注入
1' union select 1,2,3,4#


发现注入点为1,2
直]]></description><category></category></item><item><title><![CDATA[CTF之萌新反序列化学习]]></title><link>https://blog.youkuaiyun.com/bmth666/article/details/104737025</link><guid>https://blog.youkuaiyun.com/bmth666/article/details/104737025</guid><author>bmth666</author><pubDate>Wed, 13 Jan 2021 18:10:14 +0800</pubDate><description><![CDATA[概念
数据(变量)序列化(持久化)
将一个变量的数据“转换为”字符串，但并不是类型转换，目的是将该字符串储存在本地。相反的行为称为反序列化。
序列化和反序列化的目：使得程序间传输对象会更加方便
＃　相关函数

...]]></description><category></category></item><item><title><![CDATA[CTF之萌新web学习(文件包含)]]></title><link>https://blog.youkuaiyun.com/bmth666/article/details/104616201</link><guid>https://blog.youkuaiyun.com/bmth666/article/details/104616201</guid><author>bmth666</author><pubDate>Wed, 13 Jan 2021 18:06:49 +0800</pubDate><description><![CDATA[文件包含漏洞
在通过服务器脚本的函数引入文件时，由于传入的文件名没有经过合理的校验，从而操作了预想之外的文件，导致意外的文件泄露、恶意代码的注入等。
相关函数

include()
include_once()
require()
require_once()

include和require区别主要是，include在包含的过程中如果出现错误，会抛出一个警告，程序继续正常运行；而require函...]]></description><category></category></item><item><title><![CDATA[CTFshow刷题记录]]></title><link>https://blog.youkuaiyun.com/bmth666/article/details/108929655</link><guid>https://blog.youkuaiyun.com/bmth666/article/details/108929655</guid><author>bmth666</author><pubDate>Wed, 13 Jan 2021 18:04:10 +0800</pubDate><description><![CDATA[文章目录web_月饼杯web1_此夜圆web2_故人心web3_莫负婵娟WEB入门web55红包题第二弹web57
web_月饼杯
最近在ctfshow上看到了不少好题，来学一学，做一做
web1_此夜圆
题目直接给出了源码：
&lt;?php
error_reporting(0);

class a
{
	public $uname;
	public $password;
	public function __construct($uname,$password)
	{
		$this-&gt;uname]]></description><category></category></item><item><title><![CDATA[攻防世界web进阶区刷题记录(2)]]></title><link>https://blog.youkuaiyun.com/bmth666/article/details/105147518</link><guid>https://blog.youkuaiyun.com/bmth666/article/details/105147518</guid><author>bmth666</author><pubDate>Wed, 13 Jan 2021 18:03:19 +0800</pubDate><description><![CDATA[文章目录web进阶区FlatScience
web进阶区
继续写攻防世界的刷题记录，有些技巧还是要记下来的，buuctf写过的就不写了
FlatScience
一脸懵逼，不知所云，查看wp，首先查看robots.txt

那么就访问试试，发现在login.php加’得到报错信息，数据库是sqlite

查看源码得到hint，那么加上?debug，得到源码

&lt;?php
if(isset($_...]]></description><category></category></item><item><title><![CDATA[CTFHub之web进阶学习]]></title><link>https://blog.youkuaiyun.com/bmth666/article/details/105837743</link><guid>https://blog.youkuaiyun.com/bmth666/article/details/105837743</guid><author>bmth666</author><pubDate>Wed, 13 Jan 2021 18:01:34 +0800</pubDate><description><![CDATA[文章目录PHPBypass disable_functionLD_PRELOADShellShock(未完成)Apache Mod CGI(未完成)
PHP
Bypass disable_function
PHP 的 disabled_functions主要是用于禁用一些危险的函数防止被一些攻击者利用
有四种绕过 disable_functions 的手法：

攻击后端组件，寻找存在命令注入的 w...]]></description><category></category></item><item><title><![CDATA[BUUCTF刷题记录(5)]]></title><link>https://blog.youkuaiyun.com/bmth666/article/details/105231486</link><guid>https://blog.youkuaiyun.com/bmth666/article/details/105231486</guid><author>bmth666</author><pubDate>Wed, 13 Jan 2021 18:00:15 +0800</pubDate><description><![CDATA[文章目录web[GXYCTF2019]BabyUpload[网鼎杯 2018]Comment
web
打ctf(×)
被ctf打(√)
[GXYCTF2019]BabyUpload
过滤了htaccess，ph后缀，还限制了&lt;?php，所以只能用：
GIF89a
&lt;script language="php"&gt;@eval($_POST['pass']);&lt;/script&gt...]]></description><category></category></item><item><title><![CDATA[UNCTF2020web方向部分题解]]></title><link>https://blog.youkuaiyun.com/bmth666/article/details/109765055</link><guid>https://blog.youkuaiyun.com/bmth666/article/details/109765055</guid><author>bmth666</author><pubDate>Wed, 18 Nov 2020 10:10:35 +0800</pubDate><description><![CDATA[文章目录Web方向easy_ssrfeasyflask俄罗斯方块人大战奥特曼easyunserializebabyevalezphpeasy_uploadUN's_online_toolsezfind其他的题目的一些思路:checkin-sql：easyphp：
Web方向
easy_ssrf
php遇到不认识的协议就会当目录处理
?url=0://unctf.com/../../../../../../../../flag

easyflask
SSTI/沙盒逃逸详细总结 
SSTI模板注入及绕过姿势(基]]></description><category></category></item><item><title><![CDATA[BUUCTF刷题记录(7)]]></title><link>https://blog.youkuaiyun.com/bmth666/article/details/105823482</link><guid>https://blog.youkuaiyun.com/bmth666/article/details/105823482</guid><author>bmth666</author><pubDate>Fri, 16 Oct 2020 19:10:28 +0800</pubDate><description><![CDATA[文章目录web[NPUCTF2020]ReadlezPHP
web
打ctf(×)
被ctf打(√)
[NPUCTF2020]ReadlezPHP
我反序列化真不行，需要多理解理解这方面的内容。
打开用view-source:查看源码，得到信息

进入得到代码，为反序列化
&lt;?php
#error_reporting(0);
class HelloPhp
{
    public $a;
 ...]]></description><category></category></item><item><title><![CDATA[CTFshow之36Dweb做题记录]]></title><link>https://blog.youkuaiyun.com/bmth666/article/details/105931127</link><guid>https://blog.youkuaiyun.com/bmth666/article/details/105931127</guid><author>bmth666</author><pubDate>Sat, 08 Aug 2020 16:59:35 +0800</pubDate><description><![CDATA[WEB_给你shell
打开题目首先F12，得到信息

那么?view_source=flag.txt得到了源码：
 &lt;?php
//It's no need to use scanner. Of course if you want, but u will find nothing.
error_reporting(0);
include "config.php";

if (isset(...]]></description><category></category></item><item><title><![CDATA[BUUCTF刷题记录(6)]]></title><link>https://blog.youkuaiyun.com/bmth666/article/details/105499305</link><guid>https://blog.youkuaiyun.com/bmth666/article/details/105499305</guid><author>bmth666</author><pubDate>Thu, 14 May 2020 10:11:34 +0800</pubDate><description><![CDATA[文章目录web[FBCTF2019]RCEService
web
打ctf(×)
被ctf打(√)
[FBCTF2019]RCEService
首先查看文件夹文件，{"cmd":"ls"}

然后输入其他的发现被ban了，看wp得源码
&lt;?php

putenv('PATH=/home/rceservice/jail');

if (isset($_REQUEST['cmd'])) {
  ...]]></description><category></category></item><item><title><![CDATA[BUUCTF刷题记录(2)]]></title><link>https://blog.youkuaiyun.com/bmth666/article/details/104884196</link><guid>https://blog.youkuaiyun.com/bmth666/article/details/104884196</guid><author>bmth666</author><pubDate>Thu, 07 May 2020 11:02:13 +0800</pubDate><description><![CDATA[文章目录web[De1CTF 2019]SSRF Me[极客大挑战 2019]PHP
web
[De1CTF 2019]SSRF Me
[极客大挑战 2019]PHP

由于有备份文件，尝试www.zip发现可以下载！！！

得到flag.php文件，但发现Syc{dog_dog_dog_dog}并不是。。。。然后查看class.php得到
&lt;?php
include 'flag.php';...]]></description><category></category></item><item><title><![CDATA[BUUCTF刷题记录(4)]]></title><link>https://blog.youkuaiyun.com/bmth666/article/details/104961558</link><guid>https://blog.youkuaiyun.com/bmth666/article/details/104961558</guid><author>bmth666</author><pubDate>Sun, 12 Apr 2020 12:43:11 +0800</pubDate><description><![CDATA[文章目录web[ACTF2020 新生赛]Upload
web
[ACTF2020 新生赛]Upload
和之前极客大挑战一样的题，上传后缀为phtml即可

连上蚁剑，即可得到flag


]]></description><category></category></item><item><title><![CDATA[攻防世界web进阶区刷题记录(1)]]></title><link>https://blog.youkuaiyun.com/bmth666/article/details/105034450</link><guid>https://blog.youkuaiyun.com/bmth666/article/details/105034450</guid><author>bmth666</author><pubDate>Fri, 27 Mar 2020 17:33:51 +0800</pubDate><description><![CDATA[文章目录webbaby_webTraining-WWW-Robotsphp_rceWeb_php_include方法1方法2方法3warmupNewsCenter
web
baby_web
提示是：想想初始页面是哪个
进入是一个hello world，然后就没有了，由于提示试试抓包，得到flag

Training-WWW-Robots
由于提示我们就查看robots.txt

获得flag

p...]]></description><category></category></item><item><title><![CDATA[BJDCTF 2nd菜鸡做题记录]]></title><link>https://blog.youkuaiyun.com/bmth666/article/details/105056121</link><guid>https://blog.youkuaiyun.com/bmth666/article/details/105056121</guid><author>bmth666</author><pubDate>Wed, 25 Mar 2020 11:09:54 +0800</pubDate><description><![CDATA[文章目录
萌新赛
做了一下web，感觉还没有入门，太难了吧，然后看大佬博客把能写的复现一下
[BJDCTF 2nd]简单注入
这道题没写出来，想了好久才想到可以用\转义掉'，然后就开始盲注，发现禁用了select，尝试绕过未果，卡死，看师傅文章才发现可以正则匹配出password，妙呀，先写一下我的思路
username=\
password=...]]></description><category></category></item><item><title><![CDATA[CTF之萌新web学习(命令执行2)]]></title><link>https://blog.youkuaiyun.com/bmth666/article/details/104691516</link><guid>https://blog.youkuaiyun.com/bmth666/article/details/104691516</guid><author>bmth666</author><pubDate>Tue, 24 Mar 2020 15:31:23 +0800</pubDate><description><![CDATA[1命令执行无回显情况：
判断：延时，HTTP请求，DNS请求
2控制字符串长度getshell]]></description><category></category></item><item><title><![CDATA[BUUCTF刷题记录(3)]]></title><link>https://blog.youkuaiyun.com/bmth666/article/details/104926794</link><guid>https://blog.youkuaiyun.com/bmth666/article/details/104926794</guid><author>bmth666</author><pubDate>Fri, 20 Mar 2020 09:59:40 +0800</pubDate><description><![CDATA[web
[SWPU2019]Web1
[ASIS 2019]Unicorn shop
[ACTF2020 新生赛]Include
[安洵杯 2019]easy_web
[WesternCTF2018]shrine
[ACTF2020 新生赛]Exec
[GXYCTF2019]禁止套娃
方法一：array_flip()和array_rand()
方法二：array_reverse()
方法三：使用session
[GXYCTF2019]BabySQli
[CISCN 2019 初赛]Love Math]]></description><category></category></item><item><title><![CDATA[BUUCTF刷题记录]]></title><link>https://blog.youkuaiyun.com/bmth666/article/details/104850599</link><guid>https://blog.youkuaiyun.com/bmth666/article/details/104850599</guid><author>bmth666</author><pubDate>Sun, 15 Mar 2020 16:59:49 +0800</pubDate><description><![CDATA[文章目录web[强网杯 2019]随便注[护网杯 2018]easy_tornado
web
[强网杯 2019]随便注
注意表的两端两边要加：``
1' ; show databases;#查看数据库

1' ;show tables;#查看表

0'; show columns from words ;#查看words表中字段

0';show columns from 19198109311...]]></description><category></category></item><item><title><![CDATA[CTFHub之web基础刷题记录(续集)]]></title><link>https://blog.youkuaiyun.com/bmth666/article/details/104836708</link><guid>https://blog.youkuaiyun.com/bmth666/article/details/104836708</guid><author>bmth666</author><pubDate>Fri, 13 Mar 2020 15:10:04 +0800</pubDate><description><![CDATA[CTFHub之从入门到入土。第二部
文件上传和命令执行详解，wp]]></description><category></category></item></channel></rss>