[attack and defense world | WP] cat

The problem solving steps

analysis

Open the page to see

Input url Found no response , And input 127.0.0.1 This kind of ip After the address , Echo occurred

Find out url You can enter values directly , Let's try wide byte input , That is input %80, The error reporting interface appears

Replace the error reporting interface with html, Found to be Django Error reporting interface

The bosses say yes django The code is set to gbk Caused wide characters to be incorrectly encoded （ More than the ascii Code range ）.

The idea behind is to look at the prompt directly , I heard that there was a hint during the game

That is to say, it can be used @ And file path

Then we can only follow the train of thought , That is, first look at the previous error page database The path of （ There is no idea to find others here , Just look at the database first ）

Then read the file , Input

@/opt/api/database.sqlite3

Learning knowledge

URL code

What is? URL code

url Coding is a coding format , It and utf-8 perhaps GBK The difference in coding is url Encoding is for characters other than alphanumeric , for instance ：

• ASCII Character control code ： character in range 00-1F Hexadecimal （0-31 Decimal system ） and 7F（127 Decimal system ）
• Not ASCII Encoding format characters , such as GBK code 、utf-8 Code the Chinese character part of these two codes （ notes ：GBK Chinese characters in the code are two bytes , stay url In the code, it is shaped like %B4%BA, and utf-8 It's three bytes , stay url In the code, it is shaped like %E6%98%A5）