Jump to content

  • Hello visitors, welcome to the Hacker World Forum!

    Red Team 1949  (formerly CHT Attack and Defense Team) In this rapidly changing Internet era, we maintain our original intention and create the best community to jointly exchange network technologies. You can obtain hacker attack and defense skills and knowledge in the forum, or you can join our Telegram communication group to discuss and communicate in real time. All kinds of advertisements are prohibited in the forum. Please register as a registered user to check our usage and privacy policy. Thank you for your cooperation.

    TheHackerWorld Official

[网鼎杯 2018]Fakebook

 Share
HACK1949

By HACK1949,
in ios/Android development

Recommended Posts

HACK1949 Grand Master

HACK1949

Posted
Posted

[网鼎杯 2018]Fakebook

image

打开网站发现是一个登录界面，还可以任意注册账号

image

先随便注册一个账号
然后点击了一下注册后的名字

image

出现了这个界面，好似没什么用处，但仔细看了一下网址http://1.14.71.254:28653/view.php?no=1，这个no=1，好像可以进行注入

image

说明了字段数为4

image

查找回显点是，被提示错误，应该是什么东西被过滤了，可以用union/**/select进行绕过

image

发现回显点为2

image

查找出数据库名为fakebook

image

表名为users

image

有这么多的列名，就一个一个的试，发现在data列里面有点不对

image

显示出来的是经过序列化后的东西
这就不知道咋整了，直接搜wp
看到了两种解法，简答的一直就是直接用load_file()函数，直接读取flag.php文件得到flag

image

还有一种就是根据下载robots.txt文件，查看页面的源码，通过代码审计，构造payload o=-1 union/**/select 1,2,3,'O:8:"UserInfo":3:{s:4:"name";s:1:"1";s:3:"age";i:0;s:4:"blog";s:29:"file:///var/www/html/flag.php";}' from users然后在源码中找到flag

image

image

Link to post
Link to comment
Share on other sites
 Share
Go to topic listing

discussion group

discussion group

  
    You don't have permission to chat.

    • Recently Browsing   0 members

      • No registered users viewing this page.

    黑客世界站内导航 (SITE MAP)

    ×
    ×
    • Create New...