当前位置:网站首页>Buuctf reinforcement question ezsql
Buuctf reinforcement question ezsql
2022-07-01 14:21:00 【Silent boiling water】
The title reappears
- I did this problem three months ago , But I didn't get flag, After other big guys make it , Hurry to learn to record a wave .
- The requirements of the title are clearly written :web There are loopholes in the service , Need reinforcement , If the reinforcement is successful, you can visit an address to get flag
- First visit web Service address , Discovery is a login page , Try immediately SQL Inject , Universal password successfully logged in , There are obvious injection vulnerabilities .
- Next SSH Connect to the target machine address , View directory , Find the login page code for code audit , Find the user login authentication code and SQL sentence , If it is found that the user name and password entered are not filtered, it is directly put into SQL Query statement . Obvious loopholes , The next step is to add a filter function , Complete the reinforcement .
- Find the filter function , After trying one by one , In the use of addslashes( ) Function successfully reinforced .
addslashes() function
In every double quote (") Add backslash before : <?php $str = addslashes('Shanghai is the "biggest" city in China.'); echo($str); ?> addslashes() Function returns a string with a backslash before a predefined character . The predefined characters are : Single quotation marks (') Double quotes (")
The backslash (\)
NULL
- stay xshell Modify the code in , as follows :
- I couldn't do it before , Maybe it's because I put addslashes( ) Function is added to the assignment function formula , Lead to the failure of reinforcement .
$username = $_GET['username'];
$password = $_GET['password'];
// Become the following
$username = addslashes($_GET['username']);
$password = addslashes($_GET['password']);
- After reinforcement, log in again with the master key , Show login failure , Reinforcement successful .
- visit Check Service access address , obtain flag.
边栏推荐
- 【IoT毕设.下】STM32+机智云AIoT+实验室安全监控系统
- [IOT completion. Part 2] stm32+ smart cloud aiot+ laboratory security monitoring system
- What "hard core innovations" does Intel have in the first half of 2022? Just look at this picture!
- Logic is a good thing
- Station B was scolded on the hot search..
- C 语言基础
- WebSocket(简单体验版)
- 百度上找的期货公司安全吗?期货公司怎么确定正规
- 2022-2-15 learning the imitation Niuke project - post in Section 2
- MySQL日志
猜你喜欢
Leetcode(69)——x 的平方根
Websocket (simple experience version)
算网融合赋能行业转型,移动云点亮数智未来新路标
日志中打印统计信息的方案
Use the right scene, get twice the result with half the effort! Full introduction to the window query function and usage scenarios of tdengine
leetcode622.设计循环队列(C语言)
微服务大行其道的今天,Service Mesh是怎样一种存在?
Use lambda function URL + cloudfront to realize S3 image back to source
QT learning management system
Oracle-数据库对象的使用
随机推荐
A new book by teacher Zhang Yujin of Tsinghua University: 2D vision system and image technology (five copies will be sent at the end of the article)
玩转gRPC—不同编程语言间通信
[repair version] imitating the template of I love watching movies website / template of ocean CMS film and television system
Use of Oracle database objects
Research Report on the development trend and competitive strategy of the global traditional computer industry
phpcms实现订单直接支付宝支付功能
In depth cooperation | Taosi data cooperates with changhongjia Huawei customers in China to provide tdengine with powerful enterprise level products and perfect service guarantee
“国防七子”经费暴增,清华足足362亿元,甩第二名101亿 |全国高校2022预算大公开...
Research Report on the development trend and competitive strategy of the global powder filling machine industry
【R语言数据科学】:机器学习常见评估指标
C语言基础知识
深度合作 | 涛思数据携手长虹佳华为中国区客户提供 TDengine 强大企业级产品与完善服务保障
Research Report on the development trend and competitive strategy of the global camera filter bracket industry
Use the npoi package of net core 6 C to read excel Pictures in xlsx cells and stored to the specified server
Provincial election + noi Part VIII fraction theory
被裁三个月,面试到处碰壁,心态已经开始崩了
SWT/ANR问题--如何捕获性能的trace
How can we protect our passwords?
算网融合赋能行业转型,移动云点亮数智未来新路标
光環效應——誰說頭上有光的就算英雄