打开场景,查看源码,发现a链接,pay.php打开目标页面查看源码,发现提示
<!--
~~~post money and password~~~
if (isset($_POST['password'])) {
$password = $_POST['password'];
if (is_numeric($password)) {
echo "password can't be number</br>";
}elseif ($password == 404) {
echo "Password Right!</br>";
}
}
-->
页面还有提示
<p>If you want to buy the FLAG:</br>
You must be a student from CUIT!!!</br>
You must be answer the correct password!!!
</p>
<p>Flag need your 100000000 money</p>
不明所以,抓个包看看
抓到cookie里有user=0,结合You must be a student from CUIT!!!,把user改为1,发现有变化,you are Cuiter
那第一个条件已经满足
下面就是满足password,post一个包过去,内容password=404a,由于弱相等,Password条件也满足,只剩下最后一道关
Pay for the flag!!!hacker!!!
那结合
Flag need your 100000000 money
,盲猜需要的参数是moneymoney=100000000,提示Nember lenth is too long
那么考虑是strcmp来判断钱数是否够
尝试money=1e12,成功拿到flag
或者直接money[]=1,由于是非字符型,所以strcmp函数会直接返回0,而相等也返回0,成功绕过
给一个完整payload
money=1e12&password=404a
参考视频链接:https://www.bilibili.com/video/BV1HL4y1a7UQ/