備注：攻防世界的flag/鏈接端口在變

0x01 view source

X老師讓小寧同學查看一個網(wǎng)頁的源代碼，但小寧同學發(fā)現(xiàn)鼠標右鍵好像不管用了。

火狐打開開發(fā)者工具寄啼，瀏覽網(wǎng)頁源碼恩够。

 cyberpeace{5c911e8e24e934ac3275bc501d2077fc}

0x02 get post

X老師告訴小寧同學HTTP通常使用兩種請求方法，你知道是哪兩種嗎话瞧？

工具:hackbar

cyberpeace{95621de38b6d4a640f815d4776f9611b}

0x03 robots

X老師上課講了Robots協(xié)議嫩与，小寧同學卻上課打了瞌睡，趕緊來教教小寧Robots協(xié)議是什么吧交排。

cyberpeace{3b64cc61687fe378593b1eb45624a01c}

0x04 backup

X老師忘記刪除備份文件划滋，他派小寧同學去把備份文件找出來,一起來幫小寧同學吧！

index.php的備份文件為 index.php.bak

cyberpeace{0b15784638a7782d7a3068f3874064d5}

0x05 cookie

X老師告訴小寧他在cookie里放了些東西埃篓，小寧疑惑地想：‘這是夾心餅干的意思嗎处坪？’

Cookie，有時也用其復數(shù)形式 Cookies，指某些網(wǎng)站為了辨別用戶身份稻薇、進行 session 跟蹤而儲存在用戶本地終端上的數(shù)據(jù)（通常經(jīng)過加密）嫂冻。定義于 RFC2109 和 2965 中的都已廢棄，最新取代的規(guī)范是 RFC6265 ^[1] 塞椎。（可以叫做瀏覽器緩存）

hackbar查看cookie.php

cyberpeace{b75842d967c4e1ec56971b4fcd3e9d8a}

0x06 disabled button

X老師今天上課講了前端知識桨仿，然后給了大家一個不能按的按鈕，小寧驚奇地發(fā)現(xiàn)這個按鈕按不下去案狠，到底怎么才能按下去呢服傍？

火狐開發(fā)者，刪除disabled=""

cyberpeace{b339ee1ebc8ea14c7e91b1810c04d1d5}

0x07 simple js

小寧發(fā)現(xiàn)了一個網(wǎng)頁骂铁，但卻一直輸不對密碼吹零。(Flag格式為 Cyberpeace{xxxxxxxxx} )

隨便輸入，查看源碼拉庵，在最底下發(fā)現(xiàn)一段16進制編碼灿椅，轉(zhuǎn)化為字符串，發(fā)現(xiàn)為一段數(shù)字钞支，再次轉(zhuǎn)化為字符串茫蛹，通過源碼分析得知即為flag的內(nèi)容.

cyberpeace{786OsErtk12}

0x08 xff_referer

X老師告訴小寧其實xff和referer是可以偽造的。

X-Forwarded-For:簡稱XFF頭烁挟，它代表客戶端婴洼，也就是HTTP的請求端真實的IP，只有在通過了HTTP 代理或者負載均衡服務器時才會添加該項撼嗓；
HTTP Referer是header的一部分柬采，當瀏覽器向web服務器發(fā)送請求的時候，一般會帶上Referer且警，告訴服務器我是從哪個頁面鏈接過來的粉捻，服務器基此可以獲得一些信息用于處理。
//xff
維基百科：
X-Forwarded-For（XFF）是用來識別通過HTTP代理或負載均衡方式連接到Web服務器的客戶端最原始的IP地址的HTTP請求頭字段振湾。
簡單地說杀迹，xff是告訴服務器當前請求者的最終ip的http請求頭字段
通常可以直接通過修改http頭中的X-Forwarded-For字段來仿造請求的最終ip

Referer
HTTP來源地址（referer押搪，或HTTPreferer）
是HTTP表頭的一個字段，用來表示從哪兒鏈接到當前的網(wǎng)頁浅碾，采用的格式是URL大州。換句話說，借著HTTP來源地址垂谢，當前的網(wǎng)頁可以檢查訪客從哪里而來厦画，這也常被用來對付偽造的跨網(wǎng)站請求。
簡單的講，referer就是告訴服務器當前訪問者是從哪個url地址跳轉(zhuǎn)到自己的根暑，跟xff一樣力试，referer也可直接修改
使用火狐插件modify headers，相繼偽造XFF頭和Referer頭排嫌，或者通過burp截包然后添加X-Forwarded-For: 123.123.123.123與Referer: https://www.google.com畸裳。
https://www.cnblogs.com/milantgh/p/3638079.html

cyberpeace{e1ffe2f1129c6957b6ba9b531f0b2f3f}

0x09 weak_auth

小寧寫了一個登陸驗證頁面，隨手就設了一個密碼淳地。

測試發(fā)現(xiàn)用戶名為admin怖糊，密碼為弱口令，直接使用burp爆破即可

cyberpeace{4caf51de45fa9b41fe48f50f6a4740e2}

0x10 webshell

小寧百度了php一句話,覺著很有意思,并且把它放在index.php里颇象。

直接上菜刀

cyberpeace{27840547da2652bb2b942a5f185c92a9}

0x11 command_execution

小寧寫了個ping功能,但沒有寫waf,X老師告訴她這是非常危險的伍伤，你知道為什么嗎。

windows或linux下:
command1 && command2 先執(zhí)行command1后執(zhí)行command2
command1 | command2 只執(zhí)行command2
command1 & command2 先執(zhí)行command2后執(zhí)行command1

cyberpeace{fd47d6c99e527f32317da966a780d1dc}

0x12 simple_php

小寧聽說php是最好的語言,于是她簡單學習之后寫了幾行php代碼遣钳。
php中有兩種比較符號:===扰魂、 ==；
第一種符號先比較類型是否相同蕴茴，如果不相同直接返回不相等劝评；
第二種符號先將類型轉(zhuǎn)換為同類型再進行比較。
字符串和數(shù)字比較使用 == 時,字符串會先轉(zhuǎn)換為數(shù)字類型再比較 php var_dump(‘a(chǎn)’ == 0);//true荐开，這里’a’會被轉(zhuǎn)換數(shù)字0付翁； var_dump(‘123a’ == 123);//true，這里’123a’會被轉(zhuǎn)換為123.
is_numeric() 函數(shù)用于檢測變量是否為數(shù)字或數(shù)字字符串晃听。

Cyberpeace{647E37C7627CC3E4019EC69324F66C7C} 

//1500個弱口令密碼

123456789
1234567890
a123456789
123456
qq123456
abc123456
123456789a
WOAINI1314
12345678
11111111
123123123
88888888
111111111
147258369
987654321
1111111111
1qaz2wsx
789456123
iloveyou
qwertyuiop
asdfghjkl
1q2w3e4r
123456abc
qazwsxedc
abcd1234
123654789
aa123456
123321123
1234qwer
123456aa
123456123
999999999
741852963
963852741
qwer1234
qweasdzxc
asd123456
123456qq
3.1415926
asdf1234
111222333
147852369
111111
123698745
woaiwojia
123456987
zxcvbnm123
5845201314
1q2w3e4r5t
buzhidao
xiaoxiao
qwe123456
1357924680
yangyang
135792468
AS123456
147896325
888888
123123
123321
a123456
zxcvbnm
123456a
aaaaaaaa
11223344
password
87654321
12344321
31415926
asdasdasd
12121212
12341234
a12345678
asdfasdf
qwertyui
520520520
q1w2e3r4
1234abcd
1qazxsw2
1123581321
123456asd
woaini123
woshishui
12301230
1234554321
12369874
25257758
369258147
zhang123
woainima
woaini520
5845211314
12345678910
jingjing
tiantian
584131421
5841314520
yuanyuan
woailaopo
584131420
5201314
666666
1234567
654321
789456
woaini
112233
1314520
7758521
123
1
123654
520520
147258
aaaaaa
222222
abc123
110110
1111111
5211314
qazwsx
7758258
qwerty
456123
159357
521521
123qwe
456789
1314521
987654
asdfgh
123abc
qweasd
asdasd
qwe123
zxcvbn
asd123
1234560
qaz123
q123456
abcdefg
A12345
123asd
z123456
qweqwe
w123456
caonima
zxc123
123456q
aaa111
00000000
66666666
qqqqqqqq
000000000
0000000000
0123456789
110110110
22222222
a1234567
11112222
521521521
123qweasd
11235813
5201314520
100200300
qazwsx123
wocaonima
q123456789
9876543210
qaz123456
123456QWE
20082008
qq123123
000000
WOJIUSHIWO
sunshine
wodemima
a5201314
zhangwei
110120119
123456789q
woaini521
dongdong
13141314
20080808
14789632
aini1314
zhanglei
worinima
qq5201314
zhangjie
wangyang
love1314
584201314
0
121212
111222
131313
999999
555666
333333
100200
555555
12345
7777777
qqqqqq
zzzzzz
1234
778899
666888
123789
777777
201314
101010
168168
159753
123000
314159
789789
963852
qazqaz
369369
ffffff
131420
584520
741852
456852
131421
111
135246
110119
147852
321321
753951
211314
518518
456456
444444
windows
123457
336699
1111
258369
654123
147369
1q2w3e
119119
321654
7758520
520530
112358
564335
911911
951753
110120
135790
102030
258258
shmily
232323
111000
369258
520025
121314
251314
dddddd
709394
123465
721521
3344520
wwwwww
584521
loveyou
521125
142536
1230123
ssssss
a
332211
120120
3344521
124578
fuckyou
aaa123
112112
mnbvcxz
xxxxxx
nihaoma
134679
521314
321456
a111111
7895123
852456
520123
weiwei
qwaszx
qazxsw
q1w2e3
zxczxc
111111a
baobao
a123123
99999999
123456123456
55555555
asdfghjk
12345678A
321321321
12345600
123456654321
0987654321
z123456789
12345679
123456aaa
1233211234567
321654987
zxc123456
computer
superman
goodluck
a123456a
12qwaszx
12345qwert
aptx4869
77585210
74108520
7894561230
abcd123456
mingming
shanghai
wangjian
www123456
7758521521
qq123456789
25251325
wangjing
110119120
1314520520
nicholas
5201314a
wobuzhidao
xiaoqiang
16897168
longlong
xiaolong
shanshan
110120130
5841314521
zhangjian
qwqwqw
0000000
888999
1314
7654321
11111
ww111111
246810
222333
445566
333666
FOREVER
hao123456
585858
121121
212121
aaaaaaa
wang123
111qqq
159951
147147
maomao
235689
159159
feifei
beyond
898989
7788250
5203344
555888
1234566
a000000
7788521
122333
123456.
jiajia
123123a
wangwei
258456
q123123
520
woaiwoziji
xiaoyu
zhendeaini
asasas
jiushiaini
000000a
ms0083jxj
33333333
qweqweqwe
ffffffff
1234567a
aaa123456
qwerasdf
299792458
123456789.
8888888888
52013145201314
888888888
abc12345
a123123123
123456..
12312312
a1b2c3d4
abc123456789
1a2b3c4d
123456ab
li123456
qq000000
qw123456
w123456789
1234512345
456456456
ab123456
Q1W2E3R4T5
19491001
zz123456
123qwe123
77585217758521
1234567890123
123456as
chenchen
q1234567
123456qaz
qwert12345
52013140
3141592653
qweasd123
52013141314
wang123456
asdf123456
123456798
1234567899
liu123456
123456789abc
123456qw
123456abcd
74107410
ddzj39cb3
zx123456
20092009
nihao123
lxqqqqqq
woainiwoaini
19861212
liangliang
123456789123
13145201314520
eladnbin1104
19861015
123456zxc
qwe123qwe
5201314123
zhangyan
123456...
llllll
yj2009
476730751
007007
0123456
010203
686868
wan0425
666999
989898
000111
777888
787878
888666
000123
999888
234567
abcdef
123567
168888
181818
565656
13
mm123456
131425
012345
556677
0000
11
998877
198512
gggggg
789123
mmmmmm
198611
158158
1234561
198411
142857
winner
qq00000
198511
456321
198612
1q1q1q
119911
131415
wangyut2
808080
10203
7007
1.23457E+11
1230
123520
tiancai
110
dragon
7788414
qq1234
5213344
1122334
123456z
55555
1230456
1231230
5121314
1314159
2597758
wanglei
7788520
198610
770880
aa5201314
caonima123
2525775
1122
1233210
134679852
1.23456E+11
michael
asdzxc
1234568
asd
1314258
1001
a123321
asdf123
s123456
ww123456
1234569
1.23457E+12
7758991
pppppp
@qq.com
qqq123
l123456
qwert123
0.123456
369852
qwertyu
abc1234567
1111111111111111
hao123
abcd123
tingting
dearbook
code8925
zzzzzzzz
77777777
xiazhili
88771024
11111111111111111111
wwwwwwww
10101010
12345678A@
44444444
1122334455
12345612
P@ssw0rd
csdncsdn
05962514787
ssssssss
lilylily
dddddddd
zxczxczxc
369369369
aaaaaaaaa
abcdefgh
123789456
19830209
168168168
helloworld
aaaaaaaaaa
112233445566
zaq12wsx
xxxxxxxx
ds760206
123321123321
789789789
qq111111
13145200
a1111111
google250
123321aa
007007007
66668888
csdn.net
aaaa1111
maidoumaidou
z3255500
01234567
21212121
00001111
12345687
12348765
01020304
23232323
qkvmlia569
passw0rd
77585211
01010101
a11111111
aa123123
mmmmmmmm
qazqazqaz
200919ab
qazxswedc
19841010
20102010
666666666
111111aa
19841020
00000000000000000000
19810914
123456000
10203040
123123123123
12345abcde
13801001020
meiyoumima
518518518
5200251314
hahahaha
13131313
fa1681688
llllllll
19851010
asasasas
012345678
77889900
newhappy
23456789
12365478
1111qqqq
wangpeng
z1234567
w1234567
dgdg7234322
qqqq1111
1234asdf
1234567b
951ljb753
45612300
justdoit
q1111111
11111111a
qqqqqqqqq
19841028
911911911
11110000
19841021
microsoft
258258258
123454321
987456321
qwqwqwqw
19841018
159159159
123123aa
jjjjjjjj
hhhhhhhh
pppppppp
q12345678
19841012
456789123
administrator
a0000000
admin123
lovelove
internet
a00000000
19841023
120120120
asd123123
kkkkkkkk
12131415
admin369
84131421
ybnkoia569
testtest
19851120
42011178
1qaz2wsx3edc
12332100
78787878
66778899
19871024
456123789
z12345678
123123456
123456zx
mac123456
88889999
11111111111
147147147
55667788
miaomiao
qwe123123
12332112
1qaz1qaz
cccccccc
qkvpoia569
youaifa569
oooooooo
12312300
1111111a
imissyou
333333333
19841011
zhimakaimen
xingxing
13572468
19841024
19850603
asdasd123
asd12345
qwe12345
qwerty123
5555555555
1223334444
19821010
19871025
3141592654
1029384756
19841001
19861020
369852147
handsome
12300000
12345678Q
16899168
99998888
a1s2d3f4
qqq11111
19851023
19851025
19851212
112112112
songguang
aaa123123
aaaa0000
19871212
zxcv1234
98765432
98989898
789654123
yyyyyyyy
111111qq
96385274
19861012
19861013
gggggggg
6666666666
19851013
19851019
19841026
19841022
19851218
19861122
19841015
windowsxp
QQQQQqqqqq
12345611
123456456
159753123
11221122
hello123
19861111
1q1q1q1q
qazhuang123
abc12345678
woshitiancai
119119119
19871125
19861028
19851125
19851020
19821016
19861016
19861120
19841017
19881010
wangwang
123123qq
19871012
19841027
111222tianya
980099
323232
393041123
tangkai
dedewang
vicekw
qyahzn
634142554
googletester
tianya
*123456
594232
deeven
9233923
780813
811224bai
qqwwee
az123456
3429795
733733
816618
811009
3353212li
q
ggg111
791127
majiajun
z
523
EtnXtxSa65
zxzxzx
223344
741741
010101
259421
storyofall
always
098765
880312
6
650829yjm
1708
774517397
987987
sgdHhfC4x2
780504
wsky0o0o0o
635241
963963
a00000
9YUE27RI
1qa2ws
000999
19960309
d123456
NBvBB32fa9
114114
20062006
kb9zc8uxtx
2199127551
463395727
113113
ApjSqpM844
d
333222
fashion@000
210316
s1t2o3n4
ye123456
legend
00
734992
789987
000
001280
uifKjhF522
lwxlwx
zzzzz
200810
198410
ndaCebx2wx
8496856
821010
JxsGx2Yd87
801122
312312
jianfei000
sxUaIehAtp
huang
999666
667788
858877108aop
2m66xF2AJT
wanshuai198202
789654321
vjfLkiG522
801018
z1122334455
208884
bbbbbb
3456789
001234
benq*edifer
791028
19891229
199771
summer
qfcFgdA3zx
d54q7xjmhx
6Cxd2X986x
PCwAC33gb9
809998
315315
123987
19871015
198412
b33m6yghef
xm55xExBZS
mcaBdaw2vx
151515
d54p7xjkha
CrkUrrP954
668899
3uc9xN53xH
231997
22
4wdaxQ642F
198211
i97wb6sxq7
831220
lssy123
821222
19991226
theIigD4x2
6666666
e10adc3949ba59abbe56e057f20f88
137900
95368452
17746052
24081986
162752
syq20071003
linjiang
fuanyue47
yx12345678
8675309
operation
1.11111E+17
asd45679
xiaofeng
nishiwoer
a123
genius
tianshi
sakura
332335
86944950
woshishen
19880405
huizhang
szc03137
19840504
killer
5518266
woainia
20052324
asddsa
110112
2587758
xiaoxin
xiaoyao
1.23457E+17
woshishei
gundam
316032611
zhanghang
1063524602
151732
woshizhu
wokaonima
WOshiWO
freedom
39398890
34416912
zhanghao
132456
NISHIZHU
jianjian
198319
diablo
112211
showme
81151007
999
kissme
xiaowei
fantasy
7266979
159632
lee01301228
shangxin
woshiniba
522010
110011
1010110
wenwen
1415926
1234321
213213
19871206
fengfeng
dd123456
932313
wangchao
a45389612
331234
jiejie
xiaofei
965523
2007
19861018
19861225
1232123
zzb19860526
831213
nobodywillknowthispwd
love1314a
goyj2010
117289788
1310613106
xaoyin78
zzzxxx
bensile
411511
AAADDD
admin1234
123456hrr
sam123
g13916055158
QAZXCV
da2khdahda
19810625
z333666
qiye123456
ok100404
x50862356
jthrzok
itbbs20101208PC
123412
2w2w2w
aaasss
loveyou1314
@sohu.com
13245612
8844.8844
ex50867212
88448844
seoer2010
liudu88888
www1234
jkhldfkf12dj
556688
lm292979
2345678
123456rt
sxz123
sidake2bn
lb8844
liuping200
kissbaby
eeeeee
78157878
woyaolp512
123456ok
yixin2011
198361
222888
252323
abc123ddd
adf46sdfsf
818078
5201314q
750250
yy55yy88
xkhl656266
runsystem
hjl80033913
bqueensss
85665684
851010
a123456b
86815945
600242
a88778877
jjjjjj
1987721
aa112288
xkl656266
787878kai
tyc99tycaa
yj123456
okmokm
098098
2616445
zhong133
bqueenssss
liuping1920
831101qsl
asdqwe22
789457dwewee
liuli123
200616
poow29q6666
lingnan123
333777
987453
a123b456
nurk202121
88888888zzk
5655487
laozi124
901027
leon123456
123sv67e9
yiersan
1148878306
qw12345
414512@QQ.com
hld_1209
along0321
feadsf3dW
qqqwww
051123
200884
123124
@*$#*#$#,
551188
3edc4rfv5
19851030
qqq111
rui100
qq67890
4451551
123456Bc
123678dd
909090
123654yyy
1qazxsw
q111111
kuai+321=Wen_123
5580817aaa
373518
2895192
ab12345
no1444888
tongji5613
aw123123
zxcvbnm111
447100
LGL6641341
rrrrrr
199065
1985111802
dddfff
15894998@qq.com
62379372
123456t
agiene8547
admdfdsfsdd
kingusj
921212
mashuguang
dmba8898
963258
1234567890000
dg123456
123456k
sxm0627
li9900
2290669
hhhhhh
ucdosa
fcqq12346
111aaa
000123a
2w3e4r
yinchuanqi
love8023
hyp815822
jo@qq.cc
chenqing
eohank1980
6184685521
aa998877
123456ac
123qaz
aqaqaq
oooppp
okok588588
nihao789
windson
111333
1997070101
9861250123
7708801314520
12345678900
1234567891
123456789qq
1472583690
1234567891234567
+
qwertyuiop123
/*
aa123456789
7215217758991
9638527410
wo123456
zhang123456
asdfghjkl123
woaini5201314
ABCD123456789
qwertyuio
123456789aa
woaini1314520
asd123456789
woaini123456
1234567899876543
77585211314
13579246810
zxcvbnm,./
<
5205201314
123456789z
13800138000
123456789w
123456789+
abcdefg123
a1314520
www123456789
0000000000000000
qwe123456789
123456789asd
12345678912
qqq123456
123456789*
0147258369
5211314521
laopowoaini
yang123456
qq1314520
qaz123456789
ainiyiwannian
a147258369
l123456789
www123
aaa123456789
woainilaopo
abcd12345
520131400
1213141516
7418529630
nuttertools
1314520123
123456789aaa
as123456789
123456789QWE
zxcvbnm123456
123456789..
qwer123456
wo123456789
123456w
123456789abcd
7758521123
1234567890.
y123456
123456789l
ab123456789
1111122222
m123456
chen123456
a987654321
qw123456789
zxc123456789
li123456789
7758258520
77582581314258
iloveyou1314
qazwsxedcrfv
x123456
987654321a
1314woaini
123698741
huang123
h123456
qwertyuiop123456
1314521521
200820082008
q11111
qq1234567
123456l
12345677654321
0.123456789
poiuytrewq
woxiangni
123456789m
7417417474741
5201314789
123456789zxc
123456789qaz
123456789520
ai123456
52013143344
abcde12345
Love5201314
775852100
123456+
yongyuanaini
131452000
123zxc
147258369a
wohenni
woxihuanni
123456tt
134679258
C:\PROGRAMFILES\TENCENT\QQ\
yang123
zxcvbnm123456789
123456520
*
7758258123
qazwsx123456
abcdefg123456
123abc456
woaini1314.
wang123456789
s123456789
1357913579
abc5201314
zhangjing
asdfghj
123456780
2582587758
1234567890a
13145201314
=
520131488
a7758521
74108520963.
Y123456789
010203040506
5201314.
c123456
q5201314
789632145
huang123456
LAOpo520
xiao123456
LAOPO521
woaiwolaopo
zxcv123456
wan1314
m123456789
7410852963
yu123456
123456789ab
5201314qq
x123456789
123456788
a1234567890
BEIJING2008
wu123456
123456qqq
110112119
246813579
aidejiushini
w5201314
h123456789
12345a
123456m
qq147258369
yy123456
102030405060
123.123
123012301230
zhangqiang
asdfghjkl;'
zhao123456
caonimabi
woaini3344
98765432100
123woaini
WOSHINIDIE
qwer123
12345678999
b123456
123456789as
woaini110
123456789p
love520
77582581314
wei123456
womendeai
00123456789
mengmeng
duibuqiwoaini
123...
iloveyou520
zhangyang
520131
131452
@163.com
12312
12
7936369
775852
521131
)
woain
52052
Adgjmptw
521
7.7088E+12
asdf
12332
woaini131
52152
2
1.23321E+12
Adgjm
aaaaa
321
@
808000
10101
xxm111
@126.com
woaini52
66666
88888
775825
962464
aaa
8888
8888888
13579
456
12365
5.20131E+13
198711
198712
1988
198811
14725836
2008
98765
125521
qwert
7.21522E+12
welcome
198911
1989
hu1990
14725
1478963
1212
520521
zhang
58452
1987
aaaa
888168
5555555
222
1236987
65432
259758
123369
753159
321123
198812
456654
zhangyu
252525
888
7
2009
1986
qq12345
895623
2222222
456258
11011
dandan
852963