当前位置：网站首页>Attack and defense world ----- lottery

Attack and defense world ----- lottery

2022-07-21 19:41:00 【jjj34】

Knowledge point ：

1.git Let the cat out of the

2.php Weak type comparison

After getting the website , Do a directory scan

Found to have git Let the cat out of the  

open kali, use githack Download

Get the source code and conduct code audit

 

from index.php Start auditing the purchase of combined websites flag page

 

  Go to bug.php Found in js References to

stay js in , Found out api.php 

 

  Final , stay api.php The calculation method of scores is found in

be aware That's Two = Number , Therefore, there are weak type vulnerabilities, namely 

true And anything  ==  by true
 Such as  
true == 1  This is true
true == 2  This is also true
 therefore , As long as we put numbers The values in the array are changed to  true,true,true,true,true,true,true, Then it must be all right , You can get the highest bonus

  Ideas have , The next step is to capture and modify the value

take json in ,numbers Change the value of to array value  

 

 

How many times , You can get enough money , Then buy flag

Be careful ： Although we have source code , But you can't change the source code , Because these source codes are run on each other's servers （ You can buy it locally by changing the price ） 

原网站

版权声明
本文为[jjj34]所创，转载请带上原文链接，感谢
https://yzsam.com/2022/202/202207210400453730.html

边栏推荐

猜你喜欢

随机推荐