当前位置:网站首页>MD5绕过
MD5绕过
2022-07-05 04:45:00 【哇咔哇咔哇咔哇咔】
1.0e绕过
弱比较会把0exxxx当做科学计数法,不管后面的值为任何东西,0的任何次幂都为0
if ($_GET['a'] != $_GET['b'])
{
if (md5($_GET['a']) == md5($_GET['b']))
echo '1';
else
echo '0';
}
else echo "请输入不同的a,b值";
要求get获取的a和b的值要求不相等,但要求其md值相同
QNKCDZO
240610708
s878926199a
s155964671a
s214587387a
s214587387a
这些字符串的 md5 值都是 0e 开头,在 php 弱类型比较中判断为相等
2. 数组绕过
md5()函数计算的是一个字符串的哈希值,对于数组则返回false
var_dump(md5($_GET['a']) == md5($_GET['b']))
传入
a[]=a&b[]=b
可以看到,MD5一个数组返回了null,null==null,成功绕过
3. 强类型绕过
因为强类型比较,不仅比较值,还比较类型,0e会被当做字符串,所以不能用0e来进行
但是可以用MD值完全相同的字符来进行绕过
if((string)$_POST['a'] !== (string)$_POST['b'] && md5($_POST['a']) === md5($_POST['b']))
上面的方法都不能用了,百度发现是强类型绕过
payload如下:
a=%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%00%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%55%5d%83%60%fb%5f%07%fe%a2
&b=%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%02%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%d5%5d%83%60%fb%5f%07%fe%a2
进行url解码后的MD5值相等
一些MD5值相等的字符串:
$Param1=“\x4d\xc9\x68\xff\x0e\xe3\x5c\x20\x95\x72\xd4\x77\x7b\x72\x15\x87\xd3\x6f\xa7\xb2\x1b\xdc\x56\xb7\x4a\x3d\xc0\x78\x3e\x7b\x95\x18\xaf\xbf\xa2\x00\xa8\x28\x4b\xf3\x6e\x8e\x4b\x55\xb3\x5f\x42\x75\x93\xd8\x49\x67\x6d\xa0\xd1\x55\x5d\x83\x60\xfb\x5f\x07\xfe\xa2”;
$Param2=“\x4d\xc9\x68\xff\x0e\xe3\x5c\x20\x95\x72\xd4\x77\x7b\x72\x15\x87\xd3\x6f\xa7\xb2\x1b\xdc\x56\xb7\x4a\x3d\xc0\x78\x3e\x7b\x95\x18\xaf\xbf\xa2\x02\xa8\x28\x4b\xf3\x6e\x8e\x4b\x55\xb3\x5f\x42\x75\x93\xd8\x49\x67\x6d\xa0\xd1\xd5\x5d\x83\x60\xfb\x5f\x07\xfe\xa2”;
$data1="\xd1\x31\xdd\x02\xc5\xe6\xee\xc4\x69\x3d\x9a\x06\x98\xaf\xf9\x5c\x2f\xca\xb5\x07\x12\x46\x7e\xab\x40\x04\x58\x3e\xb8\xfb\x7f\x89\x55\xad\x34\x06\x09\xf4\xb3\x02\x83\xe4\x88\x83\x25\xf1\x41\x5a\x08\x51\x25\xe8\xf7\xcd\xc9\x9f\xd9\x1d\xbd\x72\x80\x37\x3c\x5b\xd8\x82\x3e\x31\x56\x34\x8f\x5b\xae\x6d\xac\xd4\x36\xc9\x19\xc6\xdd\x53\xe2\x34\x87\xda\x03\xfd\x02\x39\x63\x06\xd2\x48\xcd\xa0\xe9\x9f\x33\x42\x0f\x57\x7e\xe8\xce\x54\xb6\x70\x80\x28\x0d\x1e\xc6\x98\x21\xbc\xb6\xa8\x83\x93\x96\xf9\x65\xab\x6f\xf7\x2a\x70";
$data2="\xd1\x31\xdd\x02\xc5\xe6\xee\xc4\x69\x3d\x9a\x06\x98\xaf\xf9\x5c\x2f\xca\xb5\x87\x12\x46\x7e\xab\x40\x04\x58\x3e\xb8\xfb\x7f\x89\x55\xad\x34\x06\x09\xf4\xb3\x02\x83\xe4\x88\x83\x25\x71\x41\x5a\x08\x51\x25\xe8\xf7\xcd\xc9\x9f\xd9\x1d\xbd\xf2\x80\x37\x3c\x5b\xd8\x82\x3e\x31\x56\x34\x8f\x5b\xae\x6d\xac\xd4\x36\xc9\x19\xc6\xdd\x53\xe2\xb4\x87\xda\x03\xfd\x02\x39\x63\x06\xd2\x48\xcd\xa0\xe9\x9f\x33\x42\x0f\x57\x7e\xe8\xce\x54\xb6\x70\x80\xa8\x0d\x1e\xc6\x98\x21\xbc\xb6\xa8\x83\x93\x96\xf9\x65\x2b\x6f\xf7\x2a\x70";
4. $ a==md5($a)
0e215962017的MD5值也是由0e开头,在 PHP 弱类型比较中相等
边栏推荐
- [groovy] closure (closure parameter binding | curry function | rcurry function | ncurry function | code example)
- #775 Div.1 B. Integral Array 数学
- 2022-2028 global and Chinese virtual data storage Market Research Report
- Fluent objects and lists
- Observable time series data downsampling practice in Prometheus
- JVM 原理和流程简介
- 首席信息官如何利用业务分析构建业务价值?
- Error statuslogger log4j2 could not find a logging implementation
- 2022 thinking of Mathematical Modeling B problem of American college students / analysis of 2022 American competition B problem
- 2021 electrician Cup - high speed rail traction power supply system operation data analysis and equivalent modeling ideas + code
猜你喜欢
线上故障突突突?如何紧急诊断、排查与恢复
Key review route of probability theory and mathematical statistics examination
Official announcement! The third cloud native programming challenge is officially launched!
Thinking of 2022 American College Students' mathematical modeling competition
49 pictures and 26 questions explain in detail what is WiFi?
介绍汉明距离及计算示例
质量体系建设之路的分分合合
Emlog博客主题模板源码简约好看响应式
Construction d'un Cluster redis sous Windows
Setting up redis cluster cluster under Windows
随机推荐
Neural networks and deep learning Chapter 4: feedforward neural networks reading questions
次小生成树
函數(易錯)
The difference between bundle, chunk and module
2022-2028 global and Chinese equipment as a Service Market Research Report
Rk3399 platform development series explanation (network debugging) 7.29 summary of network performance tools
CSDN body auto generate directory
Practice | mobile end practice
Flutter tips: various fancy nesting of listview and pageview
Flink集群配置
Function (basic: parameter, return value)
托管式服务网络:云原生时代的应用体系架构进化
直播預告 | 容器服務 ACK 彈性預測最佳實踐
Leetcode 222 number of nodes of complete binary tree
2022 thinking of mathematical modeling D problem of American college students / analysis of 2022 American competition D problem
介绍汉明距离及计算示例
QT Bluetooth: a class for searching Bluetooth devices -- qbluetooth devicediscoveryagent
JMeter -- distributed pressure measurement
Thematic information | carbon, carbon neutrality, low carbon, carbon emissions - 22.1.9
English topic assignment (27)