XCTF novice area Web solving Writeup

Disclaimer: This article is a blogger original article, follow the CC 4.0 BY-SA copyright agreement, reproduced, please attach the original source link and this statement.
This link: https://blog.csdn.net/qq_38867330/article/details/102765463

view_source

Here Insert Picture Description
Here Insert Picture Description
After opening title display FLAG is not here, but subject description prompt the right mouse button does not work. Then think of the F12 key to open the developer tools, the viewer can view the page source code. F12 - - Viewer direct answer.
Here Insert Picture Description

get_post

Here Insert Picture Description
Here Insert Picture Description
Look at the title, requiring "Please submit with the GET method called a, the value of the variable 1", GET method is generally stitching parameters in the url, text only way to pass parameters. Therefore stitching http://111.198.29.45:39706/?a=1 directly after http://111.198.29.45:39706/, output is
Here Insert Picture Description
the way to submit parameters to get, and then ask, "Please just another way to POST Submit named B, the value of the variable 2 ", the request submitted by post Firefox extension hackbar (adding components to find extended)
Here Insert Picture Description
after executing output cyberpeace {xxxxxxxxxxxxxxxxxxxxxxxxx}
Here Insert Picture Description

robots

Here Insert Picture Description
熟悉一下Robots协议
Robots协议(也称为爬虫协议、机器人协议等)的全称是“网络爬虫排除标准”(Robots Exclusion Protocol),网站通过Robots协议告诉搜索引擎哪些页面可以抓取,哪些页面不能抓取。
robots协议通常以robots.txt存在,robots.txt文件是一个文本文件,robots.txt是一个协议,而不是一个命令。robots.txt是搜索引擎中访问网站的时候要查看的第一个文件。robots.txt文件告诉蜘蛛程序在服务器上什么文件是可以被查看的。

robots.txt文件写法:
User-agent: * 这里的代表的所有的搜索引擎种类,是一个通配符
Disallow: /admin/ 这里定义是禁止爬寻admin目录下面的目录
Disallow: /require/ 这里定义是禁止爬寻require目录下面的目录
Disallow: /ABC/ 这里定义是禁止爬寻ABC目录下面的目录
Disallow: /cgi-bin/.htm 禁止访问/cgi-bin/目录下的所有以".htm"为后缀的URL(包含子目录)。
Disallow: /?* 禁止访问网站中所有包含问号 (?) 的网址
Disallow: /.jpg$ 禁止抓取网页所有的.jpg格式的图片
Disallow:/ab/adc.html 禁止爬取ab文件夹下面的adc.html文件。
Allow: /cgi-bin/ 这里定义是允许爬寻cgi-bin目录下面的目录
Allow: /tmp 这里定义是允许爬寻tmp的整个目录
Allow: .htm$ 仅允许访问以".htm"为后缀的URL。
Allow: .gif$ 允许抓取网页和gif格式图片
Sitemap: 网站地图 告诉爬虫这个页面是网站地图

看一下题目,在题目给出的URL后输入/robots.txt即http://111.198.29.45:49905/robots.txt后显示
Here Insert Picture Description
f1ag_1s_h3re.php表示这个页面不允许被爬取,接下来查看一下f1ag_1s_h3re.php页面得到正确答案
Here Insert Picture Description

backup

Here Insert Picture Description
Here Insert Picture Description
After opening the topic prompted "Do you know of a backup file index.php", the backup file is usually the filename + .bak. Enter prompted to download
Here Insert Picture Description
Here Insert Picture Description
it to share four theme Writeup, the remaining please listen next time decomposition.

Guess you like

Origin blog.csdn.net/qq_38867330/article/details/102765463