https://blog.p0l1st.top/tags/web%E5%AE%89%E5%85%A8/ p0l1st's blog Hugo 0.161.1 & FixIt v0.4.5 en-us p0l1st@venomsec.org (p0l1st) p0l1st@venomsec.org (p0l1st) Tue, 03 Mar 2026 20:25:51 +0000 https://blog.p0l1st.top/post/express%E5%BA%94%E9%A2%84%E5%A4%84%E7%90%86%E7%89%B9%E6%80%A7%E7%BB%95%E8%BF%87%E6%9C%8D%E5%8A%A1%E7%AB%AF%E6%A0%A1%E9%AA%8C%E5%AE%9E%E7%8E%B0xss/ Tue, 03 Mar 2026 20:25:51 +0000p0l1st@venomsec.org (p0l1st) https://blog.p0l1st.top/post/express%E5%BA%94%E9%A2%84%E5%A4%84%E7%90%86%E7%89%B9%E6%80%A7%E7%BB%95%E8%BF%87%E6%9C%8D%E5%8A%A1%E7%AB%AF%E6%A0%A1%E9%AA%8C%E5%AE%9E%E7%8E%B0xss/ Web安全 <h1 class="heading-element" id="前言"><span>前言</span> <a href="#%e5%89%8d%e8%a8%80" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h1><p>之前<a href="https://x.com/AmirMSafari/status/2020569860472750512" target="_blank" rel="external nofollow noopener noreferrer">推特</a>上的一道题，题目环境：https://pwnbox.xyz/</p> https://blog.p0l1st.top/post/%E9%98%BF%E9%87%8Cctf-2026%E9%83%A8%E5%88%86%E5%A4%8D%E7%8E%B0/ Fri, 27 Feb 2026 17:15:29 +0000p0l1st@venomsec.org (p0l1st) https://blog.p0l1st.top/post/%E9%98%BF%E9%87%8Cctf-2026%E9%83%A8%E5%88%86%E5%A4%8D%E7%8E%B0/ CTF <h1 class="heading-element" id="easy-login"><span>Easy Login</span> <a href="#easy-login" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h1><p>懒得写详细了</p> https://blog.p0l1st.top/post/%E5%BC%BA%E7%BD%91%E6%8B%9F%E6%80%812025%E5%88%9D%E8%B5%9B-web-writeup/ Mon, 27 Oct 2025 11:04:24 +0000p0l1st@venomsec.org (p0l1st) https://blog.p0l1st.top/post/%E5%BC%BA%E7%BD%91%E6%8B%9F%E6%80%812025%E5%88%9D%E8%B5%9B-web-writeup/ CTF <h1 class="heading-element" id="smallcode"><span>smallcode</span> <a href="#smallcode" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h1><pre><code>&lt;?php highlight_file(__FILE__); if(isset($_POST[&#39;context&#39;])){ $context = $_POST[&#39;context&#39;]; file_put_contents(&#34;1.txt&#34;,base64_decode($context)); } if(isset($_POST[&#39;env&#39;])){ $env = $_POST[&#39;env&#39;]; putenv($env); } system(&#34;nohup wget --content-disposition -N hhhh &amp;&#34;);</code></pre><p>写so，编译</p> https://blog.p0l1st.top/post/polar%E9%9D%B6%E5%9C%BA-java/ Thu, 14 Aug 2025 18:28:34 +0000p0l1st@venomsec.org (p0l1st) https://blog.p0l1st.top/post/polar%E9%9D%B6%E5%9C%BA-java/ Java安全 <h1 class="heading-element" id="ezjava"><span>ezjava</span> <a href="#ezjava" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h1><p><img loading="lazy" src='https://p0l1st.oss-cn-beijing.aliyuncs.com/img/202508142105238.png' alt="img"></p> https://blog.p0l1st.top/post/2025%E7%A3%90%E7%9F%B3%E5%88%9D%E8%B5%9Bweb/ Thu, 07 Aug 2025 17:07:49 +0000p0l1st@venomsec.org (p0l1st) https://blog.p0l1st.top/post/2025%E7%A3%90%E7%9F%B3%E5%88%9D%E8%B5%9Bweb/ CTF <h1 class="heading-element" id="web-java_ez"><span>web-java_ez</span> <a href="#web-java_ez" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h1><p>VulnController</p> https://blog.p0l1st.top/post/%E7%AC%AC%E4%B8%80%E5%B1%8Aopenharmony-ctf%E4%B8%93%E9%A2%98%E8%B5%9B-web-writeup/ Fri, 06 Jun 2025 16:33:50 +0000p0l1st@venomsec.org (p0l1st) https://blog.p0l1st.top/post/%E7%AC%AC%E4%B8%80%E5%B1%8Aopenharmony-ctf%E4%B8%93%E9%A2%98%E8%B5%9B-web-writeup/ CTF <h1 class="heading-element" id="layers-of-compromise"><span>Layers of Compromise</span> <a href="#layers-of-compromise" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h1><p>弱口令user password123登录</p> https://blog.p0l1st.top/post/actf2025-web-writeup/ Mon, 28 Apr 2025 09:31:57 +0000p0l1st@venomsec.org (p0l1st) https://blog.p0l1st.top/post/actf2025-web-writeup/ CTF <h1 class="heading-element" id="actf-upload"><span>ACTF upload</span> <a href="#actf-upload" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h1><p>随便登录就是普通用户，进去可以上传文件，然后有任意文件读取，先读/app/app.py得到源码</p> https://blog.p0l1st.top/post/2024-%E7%AC%AC%E5%85%AB%E5%B1%8A%E5%BC%BA%E7%BD%91%E6%9D%AF%E7%BA%BF%E4%B8%8A%E8%B5%9Bweb-writeup/ Mon, 04 Nov 2024 10:38:00 +0000p0l1st@venomsec.org (p0l1st) https://blog.p0l1st.top/post/2024-%E7%AC%AC%E5%85%AB%E5%B1%8A%E5%BC%BA%E7%BD%91%E6%9D%AF%E7%BA%BF%E4%B8%8A%E8%B5%9Bweb-writeup/ CTF <h1 class="heading-element" id="pyblockly"><span>PyBlockly</span> <a href="#pyblockly" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h1><p>python沙箱逃逸，关键是过滤了很多符号，但是使用了unicode.unicode，可以把unicode字符转换成最相似的ASCII字符，使用中文符号绕过即可</p>