Tryhackme-Web Hacking Fundamentals

最新推荐文章于 2024-12-30 15:09:01 发布

zhangwenbo1229

最新推荐文章于 2024-12-30 15:09:01 发布

阅读量1.8k

点赞数

CC 4.0 BY-SA版权

分类专栏： # Tryhackme-Modules 文章标签：信息安全

本文链接：https://blog.youkuaiyun.com/qq_36531487/article/details/119571962

Web Hacking Fundamentals

文章目录

Web Hacking Fundamentals

Web Fundamentals

task1 Introduction and objectives

1.Read and understand the information

task2 How do we load websites?

1.What request verb is used to retrieve page content?

get

2.What port do web servers normally listen on?

3.What’s responsible for making websites look fancy?

CSS

网页的实际内容通常是HTML、CSS和JavaScript的组合。 HTML 定义页面结构和内容。CSS 允许您更改页面的外观，使其看起来花哨。JavaScript 是一种在浏览器中运行的编程语言，允许您使页面交互或加载额外的内容。

task3 More HTTP - Verbs and request formats

1.What verb would be used for a login?

post

2.What verb would be used to see your bank balance once you’re logged in?

get

3.Does the body of a GET request matter? Yea/Nay

Nay

4.What’s the status code for “I’m a teapot”?

418

IETF在1998年愚人节时发布的一个笑话RFC，具体可以参考RFC 2324 - Hyper Text Coffee Pot Control Protocol (HTCPCP/1.0)超文本咖啡壶控制协议。
htcpcp1.0协议中的418的意义是：当客户端给一个茶壶发送泡咖啡的请求时，茶壶就返回一个418错误状态码，表示“我是一个茶壶“

5.What status code will you get if you need to authenticate to access some content, and you’re unauthenticated?

401

task4 Cookies, tasty!

1.Read and try and understand this information. Check out the link for extra information

task5 Mini CTF

1.What’s the GET flag?

thm{162520bec925bd7979e9ae65a725f99f}

curl http://10.10.103.59:8081/ctf/get

2.What’s the POST flag?

thm{3517c902e22def9c6e09b99a9040ba09}

curl -d flag_please http://10.10.103.59:8081/ctf/post

3.What’s the “Get a cookie” flag?

thm{91b1ac2606f36b935f465558213d7ebd}

火狐浏览器访问http://10.10.103.59:8081/ctf/getcookie,查看浏览器cookie

4.What’s the “Set a cookie” flag?

thm{c10b5cb7546f359d19c747db2d0f47b3}

修改domain为10.10.103.59的cookie名/值都为flagpls,访问http://10.10.103.59:8081/ctf/sendcookie;

或者在上一问使用curl -c cookie.txt http://10.10.103.59:8081/ctf/getcookie 获取cookie,修改cookie名/值为flagpls，再使用curl -b cookie.txt http://10.10.103.59:8081/ctf/sendcookie 得到flag