这题考察Gopher协议,SSRF漏洞和SQL时间盲注,使用 Gopher协议 构建 SSRF 请求,使用 SQL时间盲注探测数据库中的数据。Gopher协议本身并没有直接支持HTTP的POST方法,但它可以通过Gopher客户端模拟HTTP请求的方式进行POST请求的发送,用法如下所示: gopher://127.0.0.1:80/_POST / HTTP/1.1 Host: 127.0.0.1 Content-Lengt...
xctf very_easy_sql EZ个蛋,还是要看别人的wp才会。难得扣,思路全来自very_easy_sql 文章目录 very_easy_sql gopher协议和ssrf联合使用 构造payload SQL注入 very_easy_sql 主页没有回显,先查看源代码看到注释有use.php。且有一句 you are not an inner user, so we can not let you have identify~.意思是...
ailx10:xctf-very_easy_sql(Gopher协议,SSRF漏洞和SQL时间盲注) ailx10:xctf-Background_Management_System(二次注入,SSRF,Gopher协议)
phpmysql_connect("localhost","root","root");mysql_select_db("test");mysql_query("set names utf8");for($i=0;$i<256;$i++){$c=chr($i);$name=mysql_real_escape_string('hehe'.$c);$sql="SELECT * FROM `name` WHERE `name` = '{$name}'";$row=mysql_fetch_array(mysql_query($s...
easypt https://github.com/andikleen/simple-pt/blob/master/fastdecode.c 于是先找到4007C7对应的call的记录,于是就可以直接从0x52f0开始分析 利用这一份简单的代码解码之后直接把所有分支的判断结果提取出来,然后统计一波数量就可以出来了 f = open('ttt') ...
❗ In Constrain and Resource-Based Constrained Delegation if we don't have the password/hash of the account with TRUSTED_TO_AUTH_FOR_DELEGATION that we try to abuse, we can use the very nice trick "tgt::deleg" from kekeo or "tgtdeleg" from rubeus and fool Kerberos to give us a vali...