当前位置:网站首页>MD5 bypass
MD5 bypass
2022-07-05 04:50:00 【Whoa, whoa, whoa, whoa, whoa】
1.0e Bypass
Weak comparison will 0exxxx As scientific counting , No matter what the following value is ,0 Any power of is 0
if ($_GET['a'] != $_GET['b'])
{
if (md5($_GET['a']) == md5($_GET['b']))
echo '1';
else
echo '0';
}
else echo " Please enter a different a,b value ";
requirement get Acquired a and b The value of is required to be unequal , However, it is required that md Same value
QNKCDZO
240610708
s878926199a
s155964671a
s214587387a
s214587387a
Of these strings md5 Values are 0e start , stay php It is judged to be equal in weak type comparison
2. Array bypassing
md5() The function calculates the hash value of a string , For arrays, return false
var_dump(md5($_GET['a']) == md5($_GET['b']))
Pass in
a[]=a&b[]=b
You can see ,MD5 An array returns null,null==null, Successfully bypassed
3. Strong type bypasses
Because strong types are more , Not only compare values , Also compare the types ,0e Will be treated as a string , So it can't be used 0e To carry out
But you can use MD Value exactly the same character to bypass
if((string)$_POST['a'] !== (string)$_POST['b'] && md5($_POST['a']) === md5($_POST['b']))
None of the above methods can be used , Baidu found that it is a strong type to bypass
payload as follows :
a=%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%00%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%55%5d%83%60%fb%5f%07%fe%a2
&b=%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%02%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%d5%5d%83%60%fb%5f%07%fe%a2
Conduct url After decoding MD5 The values are equal
some MD5 String with equal value :
$Param1=“\x4d\xc9\x68\xff\x0e\xe3\x5c\x20\x95\x72\xd4\x77\x7b\x72\x15\x87\xd3\x6f\xa7\xb2\x1b\xdc\x56\xb7\x4a\x3d\xc0\x78\x3e\x7b\x95\x18\xaf\xbf\xa2\x00\xa8\x28\x4b\xf3\x6e\x8e\x4b\x55\xb3\x5f\x42\x75\x93\xd8\x49\x67\x6d\xa0\xd1\x55\x5d\x83\x60\xfb\x5f\x07\xfe\xa2”;
$Param2=“\x4d\xc9\x68\xff\x0e\xe3\x5c\x20\x95\x72\xd4\x77\x7b\x72\x15\x87\xd3\x6f\xa7\xb2\x1b\xdc\x56\xb7\x4a\x3d\xc0\x78\x3e\x7b\x95\x18\xaf\xbf\xa2\x02\xa8\x28\x4b\xf3\x6e\x8e\x4b\x55\xb3\x5f\x42\x75\x93\xd8\x49\x67\x6d\xa0\xd1\xd5\x5d\x83\x60\xfb\x5f\x07\xfe\xa2”;
$data1="\xd1\x31\xdd\x02\xc5\xe6\xee\xc4\x69\x3d\x9a\x06\x98\xaf\xf9\x5c\x2f\xca\xb5\x07\x12\x46\x7e\xab\x40\x04\x58\x3e\xb8\xfb\x7f\x89\x55\xad\x34\x06\x09\xf4\xb3\x02\x83\xe4\x88\x83\x25\xf1\x41\x5a\x08\x51\x25\xe8\xf7\xcd\xc9\x9f\xd9\x1d\xbd\x72\x80\x37\x3c\x5b\xd8\x82\x3e\x31\x56\x34\x8f\x5b\xae\x6d\xac\xd4\x36\xc9\x19\xc6\xdd\x53\xe2\x34\x87\xda\x03\xfd\x02\x39\x63\x06\xd2\x48\xcd\xa0\xe9\x9f\x33\x42\x0f\x57\x7e\xe8\xce\x54\xb6\x70\x80\x28\x0d\x1e\xc6\x98\x21\xbc\xb6\xa8\x83\x93\x96\xf9\x65\xab\x6f\xf7\x2a\x70";
$data2="\xd1\x31\xdd\x02\xc5\xe6\xee\xc4\x69\x3d\x9a\x06\x98\xaf\xf9\x5c\x2f\xca\xb5\x87\x12\x46\x7e\xab\x40\x04\x58\x3e\xb8\xfb\x7f\x89\x55\xad\x34\x06\x09\xf4\xb3\x02\x83\xe4\x88\x83\x25\x71\x41\x5a\x08\x51\x25\xe8\xf7\xcd\xc9\x9f\xd9\x1d\xbd\xf2\x80\x37\x3c\x5b\xd8\x82\x3e\x31\x56\x34\x8f\x5b\xae\x6d\xac\xd4\x36\xc9\x19\xc6\xdd\x53\xe2\xb4\x87\xda\x03\xfd\x02\x39\x63\x06\xd2\x48\xcd\xa0\xe9\x9f\x33\x42\x0f\x57\x7e\xe8\xce\x54\xb6\x70\x80\xa8\x0d\x1e\xc6\x98\x21\xbc\xb6\xa8\x83\x93\x96\xf9\x65\x2b\x6f\xf7\x2a\x70";
4. $ a==md5($a)
0e215962017 Of MD5 The value is also determined by 0e start , stay PHP Equality in weak type comparison
边栏推荐
- 计组笔记(1)——校验码、原补码乘除计算、浮点数计算
- 2022 thinking of mathematical modeling a problem of American college students / analysis of 2022 American competition a problem
- 3 minutes learn to create Google account and email detailed tutorial!
- AutoCAD - Document Management
- Wenet: E2E speech recognition tool for industrial implementation
- Raki's notes on reading paper: soft gazetteers for low resource named entity recognition
- History of web page requests
- An article takes you to thoroughly understand descriptors
- XSS injection
- [groovy] closure (closure call | closure default parameter it | code example)
猜你喜欢
AutoCAD - stretching
Minor spanning tree
[groovy] closure (closure as function parameter | code example)
The 22nd Spring Festival Gala, an immersive stage for the yuan universe to shine into reality
Introduce Hamming distance and calculation examples
Construction d'un Cluster redis sous Windows
2022-2028 global and Chinese FPGA prototype system Market Research Report
2022 thinking of mathematical modeling D problem of American college students / analysis of 2022 American competition D problem
Matplotlib draws three-dimensional scatter and surface graphs
Label exchange experiment
随机推荐
AutoCAD - Document Management
Looking at Chinese science and technology from the Winter Olympics: what is the mystery of the high-speed camera that the whole people thank?
Function overloading
[groovy] closure (Introduction to closure class closure | closure parametertypes and maximumnumberofparameters member usage)
【Leetcode】1352. 最后 K 个数的乘积
[groovy] closure (closure as function parameter | code example)
AutoCAD - workspace settings
数论函数及其求和 待更新
[ideas] 2021 may day mathematical modeling competition / May Day mathematical modeling ideas + references + codes
JVM 原理和流程简介
Introduction to JVM principle and process
Practice | mobile end practice
AutoCAD - stretching
[crampon programming] lintcode decoding Encyclopedia - 872 termination process
windows下Redis-cluster集群搭建
Emlog blog theme template source code simple good-looking responsive
2022-2028 global and Chinese equipment as a Service Market Research Report
中国AS树脂市场调研与投资预测报告(2022版)
AutoCAD - lengthening
[PCL self study: feature9] global aligned spatial distribution (GASD) descriptor (continuously updated)