search

amour233 / comment-utterances

0 stars 0 forks source link

2022/10/29/simple_ssti/ #3

Open utterances-bot opened 2 years ago

utterances-bot commented 2 years ago

Simple_sstI - LYL

Simple_SSTI_1打开题目场景，我们可以看到如下的情形 这里提示说你要传入一个名字叫做flag的参数（url传参），并没有别的思路，先检查一下网页源代码F12 发现注释里面有提示“You know, in the flask, We often set a secret_key variable.”，所以我们就要去找flask里的secret_key，这里就属于flask的模板注入，我

https://amour233.github.io/2022/10/29/simple_ssti/

amour233 commented 2 years ago

测试1111