nctf-web-2

1….签到2
http://teamxlc.sinaapp.com/web1/02298884f0724c04293b4d8c0178615e/index.php
提示：请输入口令zhimakaimen
截包把zhimakaime改成zhimakaimen即可

2…..md5 collision

源码

<?php $md51 = md5('QNKCDZO'); $a = @$_GET['a']; $md52 = @md5($a); if(isset($a)){ if ($a != 'QNKCDZO' && $md51 == $md52) { echo "nctf{*}"; } else { echo "false!!!"; }} else{echo "please input a";} ?>

题目链接 http://115.28.150.176/md5/index.php

GET 参数a=0e***********

3.PHP 弱类型

if (isset($_GET['a']) and isset($_GET['b'])) {
if ($_GET['a'] != $_GET['b'])
if (md5($_GET['a']) === md5($_GET['b']))
die('Flag: '.$flag);
else
print 'Wrong.';
}

利用php弱类型绕过的题,直接构造:

http://chinalover.sinaapp.com/web17/index.php?a[]=aaa&b[]=bbb
得到flag.