web21

base64编码爆破

image-20220326183208502

抓包发现并没有使用get和post提交

image-20220326183101849

发现一个basic 解码base64是密码image-20220326183154126

开始爆破,添加位置

image-20220326191936110

选择用户自定义

image-20220326192020001

在一填admin:

image-20220326192031782

二加上刚才的字典

image-20220326192102803

添加base64编码,取消下面的url编码

image-20220326192124605

image-20220326191915961

查看响应

image-20220326192208620

web22

子域名爆破

扫一下百度吧,记录下工具

ctfr

python ctfr.py -d baidu.com

oneforall

python oneforall.py --targets baidu.com run

layer

image-20220331222123654

web23

<?php

/*
# -*- coding: utf-8 -*-
 Author: h1xa
 Date:   2020-09-03 11:43:51
 Last Modified by:   h1xa
 Last Modified time: 2020-09-03 11:56:11
 email: h1xa@ctfer.com
 link: https://ctfer.com

*/
error_reporting(0);

include('flag.php');
if(isset($_GET['token'])){#得到token
    $token = md5($_GET['token']);#对token进行MD5加密
    if(substr($token, 1,1)===substr($token, 14,1) && substr($token, 14,1) ===substr($token, 17,1)){
        #截取token的第二位,如果等于token的第15位     并且token的第15位等于token的第18位
        if((intval(substr($token, 1,1))+intval(substr($token, 14,1))+substr($token, 17,1))/substr($token, 1,1)===intval(substr($token, 31,1))){
            #截取到的token的第2位专换成数字+15位+18位的和除以第二位等于第32位的话就结束
            echo $flag;
        }
    }
}else{
    highlight_file(__FILE__);

}
?>

<?php
error_reporting(0);
$dir = "0123456789qazwsxedcrfvtgbyhnujmikolp";
for ($i = 0; $i < 36; $i++){
    for ($j =0;$j < 36; $j++){
        $token = $dir[$i].$dir[$j];
        $token = md5($token);
        if(substr($token,1,1) === substr($token,14,1)&& substr($token,14,1)===substr($token,17,1)){
            if ((intval(substr($token,1,1))+intval(substr($token,14,1)) + intval(substr($token,17,1))/intval(substr($token,1,1)) === intval(substr($token,31,1)))){
                echo $dir[$i].$dir[$j];
                exit(0);
            }
        }
    }
}

#3j

image-20220401131618105