实验吧-你真的会PHP吗？writeup

来源：互联网发布：postgresql mysql 电商编辑：程序博客网时间：2024/05/19 02:02

首先fiddler抓包，在response header中发现hint:6c525af4059b4fe7d8c33a.txt,打开后找到index.php源码

<?php$info = ""; $req = [];$flag="xxxxxxxxxx";ini_set("display_error", false); error_reporting(0); if(!isset($_POST['number'])){   header("hint:6c525af4059b4fe7d8c33a.txt");   die("have a fun!!"); }foreach([$_POST] as $global_var) {     foreach($global_var as $key => $value) {         $value = trim($value);         is_string($value) && $req[$key] = addslashes($value); //若is_string($value)为真，则执行$req[$key] = addslashes($value)    } } function is_palindrome_number($number) {     $number = strval($number);     $i = 0;     $j = strlen($number) - 1;     while($i < $j) {         if($number[$i] !== $number[$j]) {             return false;         }         $i++;         $j--;     }     return true; } if(is_numeric($_REQUEST['number'])){  //这里判断的是未经trim()和addslashes()处理过的变量   $info="sorry, you cann't input a number!";}elseif($req['number']!=strval(intval($req['number']))){     $info = "number must be equal to it's integer!! ";  }else{     $value1 = intval($req["number"]);     $value2 = intval(strrev($req["number"]));       if($value1!=$value2){          $info="no, this is not a palindrome number!";     }else{          if(is_palindrome_number($req["number"])){              $info = "nice! {$value1} is a is_palindrome_number number!";           }else{             $info=$flag;          }     }}echo $info;

利用fiddler构造post请求：

这里写图片描述
在post的数据0e-0后面加一个空白字符（或者添加unicode编码过的空白字符如：%00，%20等）以构造字符串满足is_numeric($_REQUEST['number'])的要求，构造字符串0e-0绕过$req['number']!=strval(intval($req['number']))

阅读全文

0 0