XCTF-WEB-Advanced Zone-NaNNaNaNNaN-Batman-Notes

Come directly to Baidu to search for Batman first -_- ||

It is a file web100 downloaded by itself

Open to find the following content

 

 

 It can be seen that this is a scripting language, so I tried to modify the suffix to html and found that it was an OK box.

 

 

Now it is a way to restore his code to something that can be recognized by normal people ==

It's like this after recovery

function $(){
var e=document.getElementById("c").value;
if(e.length==16)
    if(e.match(/^be0f23/)!=null)
        if(e.match(/233ac/)!=null)
            if(e.match(/e98aa$/)!=null)
                if(e.match(/c7be9/)!=null){
                    var t=["fl","s_a","i","e}"];
                    var n=["a","_h0l","n"];
                    var r=["g{","e","_0"];
                    var i=["it'","_","n"];
                    var s=[t,n,r,i];
                    for(var o=0;o<13;++o){
                        document.write(s[o%4][0]);s[o%4].splice(0,1)
                        }
                    }
                }
                document.write('<input id="c"><button οnclick=$()>Ok</button>');

　　

Next, analyze this code: (Actually, the code has probably guessed that the flag is the stitching of characters in several arrays on the figure)

The first layer of the layer cake: the length is equal to 16

The second layer of the layer cake: be0f23 at the beginning

The third layer of the layer cake: e98aa at the end

Melaleuca fourth layer: string can match: 233ac and c7be9

 

Final construction: be0f233ac7be98aa

Get Flag

 

 

　　

Record a more useful website:

Online test regular website: https://regexper.com/

Anyone who doesn't understand regular rules: https://www.runoob.com/regexp/regexp-syntax.html