高级会员
- 积分
- 577
- 威望
- 0
- 金币
- 1478
- 贡献
- 0
- 注册时间
- 2022-7-26
- 最后登录
- 2022-7-26
|
人人为我，我为人人。
您需要 登录 才可以下载或查看，没有账号？立即注册
×
1.key又又找不到了url：http://lab1.xseclab.com/xss1_30ac8668cd453e7e387c76b132b140bb/index.php点击链接，burp抓包，发送到重放模块，点击go得到key is : yougotit_script_now
1675846611_63e363d388613dadb48ff.png
2.快速口算url：http://lab1.xseclab.com/xss2_0d557e6d2a4ac08b749b61473a075be1/index.phppython3脚本import requests, re
url = 'http://lab1.xseclab.com/xss2_0d557e6d2a4ac08b749b61473a075be1/index.php'
s = requests.session()
c = s.get(url).content
print(c)
c=c.decode('utf-8')#python3一定要加上这一句
r = re.findall(r'[\d]{2,}',c)
r = int(r[0])*int(r[1])+int(r[2])*(int(r[3])+int(r[4]))
c1 = s.post(url, data={'v':r}).content
print(c1.decode('utf-8'))得到key is 123iohHKHJ%^&*(jkh
1675846612_63e363d4470c5190e9f76.png
3.这个题目是空的试了一圈最后发现是null4.怎么就是不弹出key呢？url：http://lab1.xseclab.com/xss3_5dcdde90bbe55087eb3514405972b1a6/index.php先点了链接发现没反应，审查元素后发现一大段js代码，发现a是个匿名函数，代码中还有禁止弹窗的函数，复制下来，删除前面几个函数，修改打印的值，保存成HTML文件，在浏览器打开script>
var a = function () {
var b = function (p, a, c, k, e, r) {
e = function (c) {
return (c a ? '' : e(parseInt(c / a))) + ((c = c % a) > 35 ? String.fromCharCode(c + 29) : c.toString(36))
};
if (!''.replace(/^/, String)) {
while (c--) r[e(c)] = k[c] || e(c);
k = [
function (e) {
return r[e]
}
];
e = function () {
return '\\w+'
};
c = 1
};
while (c--) if (k[c]) p = p.replace(new RegExp('\\b' + e(c) + '\\b', 'g'), k[c]);
return p
}('1s(1e(p,a,c,k,e,r){e=1e(c){1d(ca?\'\':e(1p(c/a)))+((c=c%a)>1q?1f.1j(c+1k):c.1n(1o))};1g(!\'\'.1h(/^/,1f)){1i(c--)r[e(c)]=k[c]||e(c);k=[1e(e){1d r[e]}];e=1e(){1d\'\\\\w+\'};c=1};1i(c--)1g(k[c])p=p.1h(1l 1m(\'\\\\b\'+e(c)+\'\\\\b\',\'g\'),k[c]);1d p}(\'Y(R(p,a,c,k,e,r){e=R(c){S(ca?\\\'\\\':e(18(c/a)))+((c=c%a)>17?T.16(c+15):c.12(13))};U(!\\\'\\\'.V(/^/,T)){W(c--)r[e(c)]=k[c]||e(c);k=[R(e){S r[e]}];e=R(){S\\\'\\\\\\\\w+\\\'};c=1};W(c--)U(k[c])p=p.V(Z 11(\\\'\\\\\\\\b\\\'+e(c)+\\\'\\\\\\\\b\\\',\\\'g\\\'),k[c]);S p}(\\\'G(B(p,a,c,k,e,r){e=B(c){A c.L(a)};E(!\\\\\\\'\\\\\\\'.C(/^/,F)){D(c--)r[e(c)]=k[c]||e(c);k=[B(e){A r[e]}];e=B(){A\\\\\\\'\\\\\\\\\\\\\\\\w+\\\\\\\'};c=1};D(c--)E(k[c])p=p.C(I J(\\\\\\\'\\\\\\\\\\\\\\\\b\\\\\\\'+e(c)+\\\\\\\'\\\\\\\\\\\\\\\\b\\\\\\\',\\\\\\\'g\\\\\\\'),k[c]);A p}(\\\\\\\'t(h(p,a,c,k,e,r){e=o;n(!\\\\\\\\\\\\\\\'\\\\\\\\\\\\\\\'.m(/^/,o)){l(c--)r[c]=k[c]||c;k=[h(e){f r[e]}];e=h(){f\\\\\\\\\\\\\\\'\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\w+\\\\\\\\\\\\\\\'};c=1};l(c--)n(k[c])p=p.m(q s(\\\\\\\\\\\\\\\'\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\b\\\\\\\\\\\\\\\'+e(c)+\\\\\\\\\\\\\\\'\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\b\\\\\\\\\\\\\\\',\\\\\\\\\\\\\\\'g\\\\\\\\\\\\\\\'),k[c]);f p}(\\\\\\\\\\\\\\\'1 3="6";1 4="7";1 5="";8(1 2=0;29;2++){5+=3+4}\\\\\\\\\\\\\\\',j,j,\\\\\\\\\\\\\\\'|u|i|b|c|d|v|x|y|j\\\\\\\\\\\\\\\'.z(\\\\\\\\\\\\\\\'|\\\\\\\\\\\\\\\'),0,{}))\\\\\\\',H,H,\\\\\\\' |
|
发表于 2023-2-8 15:21:21
