唯梦不可辜负
落霞与孤鹜齐飞,秋水共长天一色。
Spoofing Spoofing
39.99.132.128 Spoofingflag01┌──(kali㉿kali)-[~/桌面/tools/tools/fscan_all_version] └─$ ./fscan -h 39.99.132.128
2025-09-28
wmctf wmctf
guessrd.getrandbits(32)使用random.Random()(梅森旋转算法,Mersenne Twister)生成密钥和 ID。MT19937 算法不具备密码学安全性,若攻击者收集到足够多的输出结果,就能预测其后续生成的
2025-09-21
24长城杯 24长城杯
24长城杯39.101.67.119 flag01┌──(kali㉿kali)-[~/桌面/tools/tools/fscan_all_version] └─$ ./fscan -h 39.101.67.119 ___
2025-09-13
长城杯1 长城杯1
文曲签学长按Fn键激活特殊模式 read HINT提示去公众号拿 提示:flag在/flag下,可以尝试目录穿越漏洞来读取它。会过滤“../”,可以使用双写来绕过。文件名有大小写区分。 于是 read ....//....//..../
2025-09-13
湾区杯 湾区杯
湾区杯sstixz.aliyun.com/news/15003 发现{{ . }} 显示map[B64Decode:0x6ee380 exec:0x6ee120]说明是Go 模板 后端暴露了两个函数给模板使用:B64Decode,exec,
2025-09-08
闽盾杯+陇剑杯 闽盾杯+陇剑杯
闽盾杯 安全的文件上传php短标签 <? echo '123';?> #前提是开启配置参数short_open_tags=on <?=(表达式)?> 等价于 <?php echo (表达式)?>
2025-09-06
nss#4th nss#4th
ez_signinfrom flask import Flask, request, render_template, jsonify from pymongo import MongoClient import re app = Fla
2025-09-03
Lilctf Lilctf
https://blog.rkk.moe/2025/08/18/LilCTF-2025-Writeup/#Web ez_bottlefrom bottle import route, run, template, post, reques
2025-09-03
2022网鼎杯半决赛复现 2022网鼎杯半决赛复现
2022网鼎杯半决赛复现flag0139.99.151.78 XIAORANG.LAB ./fscan -h 39.99.151.78 ___ _ / _ \
2025-09-01
prize prize
grandmas_notes看源码可知会提示密码前几位的正确性。burp攻击,记得开重定向,减缓攻击速度,即可爆出admin密码。 abcdefghijklmnopqrstuvwxyz0123456789ZAQWSXCDERFVBGTYHN
2025-08-31
Hospital Hospital
https://fushuling.com/index.php/2024/01/06/%e6%98%a5%e7%a7%8b%e4%ba%91%e5%a2%83-hospital/ 春秋云境-Hospital – S1mh0’s Blog 春
2025-08-23
Exchanges Exchanges
Exchangesflag01扫一下 ──(kali㉿kali)-[~/桌面/tools/tools/fscan_all_version] └─$ ./fscan -h 39.98.109.189 ___
2025-08-17
1 / 4