Buuctf [极客大挑战 2019]BuyFlag1 WP解析

最新推荐文章于 2023-08-06 17:38:54 发布

QiaN_djx

最新推荐文章于 2023-08-06 17:38:54 发布

阅读量1.3k

点赞数 3

分类专栏： buuctf web 文章标签： php 前端 css spring 网络安全

本文链接：https://blog.csdn.net/qq_60115503/article/details/127728651

版权

buuctf web 专栏收录该内容

4 篇文章 0 订阅

订阅专栏

题目来源：极客大挑战 2019
题目名称：BuyFlag 1

打开网页

探索网站直到发现了pay

ctrl+u查看源代码

<!DOCTYPE HTML>

<html>
	<head>
		<title>Buy You Flag</title>
		<meta charset="utf-8" />
		<meta name="viewport" content="width=device-width, initial-scale=1" />
		<!--[if lte IE 8]><script src="assets/js/ie/html5shiv.js"></script><![endif]-->
		<link rel="stylesheet" href="assets/css/main.css" />
		<!--[if lte IE 8]><link rel="stylesheet" href="assets/css/ie8.css" /><![endif]-->
		<!--[if lte IE 9]><link rel="stylesheet" href="assets/css/ie9.css" /><![endif]-->
	</head>
	<body>

		<!-- Page Wrapper -->
			<div id="page-wrapper">

				<!-- Header -->
					<header id="header">
						<h1><a href="index.php">Syclover</a></h1>
						<nav id="nav">
							<ul>
								<li class="special">
									<a href="#menu" class="menuToggle"><span>Menu</span></a>
									<div id="menu">
										<ul>
											<li><a href="index.php">Home</a></li>
											<li><a href="pay.php">PayFlag</a></li>
										</ul>
									</div>
								</li>
							</ul>
						</nav>
					</header>

				<!-- Main -->
					<article id="main">
						<header>
							<h2>Flag</h2>
							<p>Flag need your 100000000 money</p>
						</header>
						<section class="wrapper style5">
							<div class="inner">

								<h3>attention</h3>
								<p>If you want to buy the FLAG:</br>
									You must be a student from CUIT!!!</br>
									You must be answer the correct password!!!

	
								</p>
<hr />
<p>
Only Cuit's students can buy the FLAG</br>	
</p>								

								<hr />

							</div>
						</section>
					</article>

				<!-- Footer -->
					<footer id="footer">

						<ul class="copyright">
							<li>&copy; Syclover</li><li>Design: Cl4y</li>
						</ul>
					</footer>

			</div>

		<!-- Scripts -->
			<script src="assets/js/jquery.min.js"></script>
			<script src="assets/js/jquery.scrollex.min.js"></script>
			<script src="assets/js/jquery.scrolly.min.js"></script>
			<script src="assets/js/skel.min.js"></script>
			<script src="assets/js/util.js"></script>
			<!--[if lte IE 8]><script src="assets/js/ie/respond.min.js"></script><![endif]-->
			<script src="assets/js/main.js"></script>
	
	</body>

PHP代码

post money and password~~~
if (isset($_POST['password'])) {
	$password = $_POST['password'];
	if (is_numeric($password)) {
		echo "password can't be number</br>";
	}elseif ($password == 404) {
		echo "Password Right!</br>";
	}
}

isset()函数是用来检验是否被设置的

is_numeric()函数检测字符串是否由数字组成,源代码如果字符串包括数字则print:password can not be number

是否变量password==404时输出password right!

思路:

用post方法发送一个名为password的变量,设置password=404a任何字母都可以

步骤:

使用burpsuite抓包