【WP】第一届 “帕鲁杯“ - CTF挑战赛 Web 全解

Web

Web-签到

考点：审计py代码

from flask import Flask, request, jsonifyimport requestsfrom flag import flag  # 假设从 flag.py 文件中导入了 flag 函数app = Flask(__name__)@app.route('/', methods=['GET', 'POST'])def getinfo():    url = request.args.get('url')    if url:        # 请求url        response = requests.get(url)        content = response.text        print(content)        if "paluctf" in content:            return flag        else:            return content    else:        response = {            'message': 200,  # 这里是数值，不是字符串            'data': "Come sign in and get the flag!"        }        return jsonify(response)@app.route('/flag', methods=['GET', 'POST'])def flag1():    return "paluctf"if __name__ == '__main__':    app.run(debug=True, host="0.0.0.0", port=80)

http://127.0.0.1:50258/?url=http://localhost/flag

R23 

考点：

1.采用&引用绕过_wakeup()魔术方法

2.PHP序列化中的R与r (frankli.site)

参考：PHP序列化中的R与r (frankli.site)

3.无用数据再引用绕过R:2

源代码：