0. 感悟 a. 做开发有助攻击 b. 边角更容易出问题 1. http协议 a. http://127.0.0.1:8080/index.php?id=1%23&pw=123#2 # 作用书签，显示某段 URL字符转义 + URL 中+号表示空格 %2B 空格 URL中的空格可以用+号或者编码 %20 / 分隔目录和子目录 %2F ? 分隔实际的URL和参数 %3F % 指定特殊字符 %25 # 表示书签 %23 & URL 中指定的参数间的分隔符 %26 = URL 中指定参数的值 %3D b. X-Forwarded-For 2. SQL注入 a. 防御：字符串拼接形式 - 过滤 - 转义变量绑定先占位，后解释 b. Union注入 - 要求select语句，存在回显 c. 报错注入【SQL注入】报错注入姿势总结 d. Boolean盲注 payload：select * from users where user='xx' and pass>'123'# 'mysql 比较：字符串比较，是逐字比较的字符串比较不区分大小写，可加binary()来区分截取字符串相关的函数 if语句 e. Timing盲注页面不存在不同回显，但SQL被执行 f. 文件读写 LOAD_FILE() g. WAF绕过 - 双写 - 大小写 - 编码绕过 - 变换姿势科学计数法，有些WAF应用分词，再组合检查黑词的方式例如：id=1e1union php和SQL识别不一样导致 php认为1e1union为整体 SQL分1e1union为 1e1、 union 正常执行 h. 二次注入 - 概念：攻击者将恶意SQL语句插入到数据库中，程序对数据内容毫无防备，直接带入查询 - 例子： 1) insert 插入 '\'123' 在插入到数据库后，被转义的单引号不再被转义，变为 '123，' 造成注入 2) 插入aaaaaaaa…aaaaa\这样足够长的数据时，导致\'中的引号被截断，剩下的反斜杠造成注入 i. 宽字节注入 - 原理：反斜杠是0x5c，使用addslashes()等转义函数在处理输入时会将 ' 、 \、" 这些字符用反斜杠转义，输入0xbf27,转以后变成了 0xbf5c27,5c被当做了汉字一部分，单引号0x27逃逸出来。 - payload: id=狷' j. ACCESS偏移注入（较少） inner join查询，可能会将不回显的字段弄出来 k. 万能密码 l. Mongodb注入 m. Mysql 过长截断 - 字符串会被MYSQL当作八字节的double处理 - trim 操作，重复注册admin n. Sprintf wordpress中的一个漏洞 https://paper.seebug.org/386/

5. 认证 a. 单因素认证与多因素认证 b. 密码强度 - （伪）任何密码加1秒就是强密码 - OWASP c. 密码加密储存在数据库 d. Session 和 Cookie e. Session Fixation f. 单点登入SSO g. 授权 h. 越权 - 水平越权 - 垂直越权

【Misc】Video Misc

Question Stem

powpow_fVm1u5z.mp4

Steps

This question we use the Kali to do.

MP4 Analysis

First,watch. Can not found sth. strange(especially pay attention to the flash frames). Then we click the right-mouse button to see the information about the video in music/video option.

We can see the title are special, it’s base64. Decode. The result is http://steghide.sourceforge.net/ So we know it’s a hint that we should use the steghide. Especially steghide is usually used with JPEGs, We should watch out for one later. And maybe there are some images in the video.

Then we use the foremost to scan the video.

foremost  powpow_fVm1u5z.mp4

Then we get an PNG image named as 00001069.png.

PNG Analysis

It’s said StegHide does not work with PNGs, so we have to keep looking., there are sth. else in there. The PNG format is ideal for LSB steganography due to it’s lossless compression. So We can use stegsolves. By Changing the color plane, we found the strange things.

Because the stepic has sth. problems in my kali visual machine. I try to use this script(save as stegOutput.py):

#!/usr/bin/env python
from PIL import Image
import sys

def b2a(b):
    s = ''
    while len(b) != 0:
        binbyte = b[:8]  # Get a byte
        s += chr(int(binbyte, 2)) # Convert it
        b = b[9:]  # Skip every 9th bit
    return s

# Load image data
img = Image.open(sys.argv[1])
w,h = img.size
pixels = img.load()

binary = ''
for y in xrange(h):
    for x in xrange(w):
        # Pull out the LSBs of this pixel in RGB order
        binary += ''.join([str(n & 1) for n in pixels[x, y]])
print b2a(binary)

Then:

python stegOutput.py 00001069.png > in.jpeg

Then we got an JPEG image named in.jpeg, So we can finally used the StegHide

steghide extract -sf in.jpeg -p password

We got a base64.txt, decode it.

cat base64.txt
python3
>>> import base64
>>> base64.b85decode(b'W^7?+dsk&3VRB_4W^-?2X=QYIEFgDfAYpQ4AZBT9VQg%9AZBu9Wh@|fWgua4Wgup0ZeeU}c_3kTVQXa}eE')
b'flag{We are fsociety, we are finally free, we are finally awake!}'

Finished.

Flag

flag{We are fsociety, we are finally free, we are finally awake!}

Tools

steghide
Foremost: is a console program to recover files based on their headers, footers, and internal data structures.
stegsolves

一	二	三	四	五	六	日
		1	2	3	4	5
6	7	8	9	10	11	12
13	14	15	16	17	18	19
20	21	22	23	24	25	26
27	28	29	30	31

喵了个咪乎

What's about the earth?

月度归档：2018年08月

【XMan】SQL＆文件相关

【Misc】Video Misc

【Misc】Video Misc

Question Stem

Steps

MP4 Analysis

PNG Analysis

Flag

Tools