Attack and defense world web practice area (weak_auth, simple_php, xff_referer)

Catalog

weak_auth

Topic introduction

Topic ideas

Visit the shooting range

utilize burpsuite Burst code

find flag

simple_php

Topic introduction

Topic ideas

Visit the shooting range

PHP Content understanding

find flag

xff_referer

Topic introduction

Topic ideas

Visit the shooting range

forge XFF

forge feferer

find flag

---

weak_auth

Topic introduction

Topic ideas

Visit the shooting range

Generally, this kind of login is weak password

For example, the account number is admin

The password for 123456、admin、root etc.

It can also be used. BP Blasting

utilize burpsuite Burst code

Log in to the password you guessed admin/admin Intercept traffic packets

Upload to intruder

choice cluster bomb Explode account and password

Set up payload

Start blasting

The blast was successful

find flag

cyberpeace{dad2b6ebac23fe80a9dc79eb0c9e5b63}

simple_php

Topic introduction

Topic ideas

Visit the shooting range

PHP Content understanding

a=0 And a Not empty ; therefore a=0a

b>1234 And not pure numbers ; therefore b=1235aa

find flag

Cyberpeace{647E37C7627CC3E4019EC69324F66C7C}

xff_referer

Topic introduction

Topic ideas

Visit the shooting range

forge XFF

return referer

forge feferer

find flag

cyberpeace{e8b2f1bc317d06993ab6349580f5eda6}