nssctf web入门（1）

news2025/10/31 16:57:28

这里通过nssctf的题单web安全入门来写，会按照题单详细解释每题。题单在NSSCTF中。

想入门ctfweb的可以看这个系列，之后会一直出这个题单的解析，题目一共有28题，打算写10篇。

[SWPUCTF 2021 新生赛]jicao

<?php
highlight_file('index.php');   #highlight_file输出当前文件的代码
include("flag.php");           #include包含了flag文件
$id=$_POST['id'];              #通过post获取一个为id的变量
$json=json_decode($_GET['json'],true);     #通过get获取一个为json的变量 通过json_decode将json变量解码为php中的关联数组。关联数组是 PHP 中一种常用的数据类型，它可以将字符串键与对应的值进行关联。
if ($id=="wllmNB"&&$json['x']=="wllm") #通过if判断id的值和json中参数的值 来返回flag
{echo $flag;}
?>

这里主要是json_decode我们做题还是要了解明白的

{
    "name": "John Doe",
    "age": 30,
    "isMarried": true,
    "hobbies": [
        "reading",
        "playing games",
        "swimming"
    ],
    "address": {
        "street": "123 Main St",
        "city": "Anytown",
        "state": "CA",
        "zip": "12345"
    }
}
这里我们通过这个来举例json_decoede的用法上面是我们要的json字符
$jsonStr = '{"name":"John Doe","age":30,"isMarried":true,"hobbies":["reading","playing games","swimming"],"address":{"street":"123 Main St","city":"Anytown","state":"CA","zip":"12345"}}';

$array = json_decode($jsonStr, true);

print_r($array);
我们这里通过json_decode来转为php关联数组
输出的值为
Array
(
    [name] => John Doe
    [age] => 30
    [isMarried] => 1
    [hobbies] => Array
        (
            [0] => reading
            [1] => playing games
            [2] => swimming
        )

    [address] => Array
        (
            [street] => 123 Main St
            [city] => Anytown
            [state] => CA
            [zip] => 12345
        )

)

那回到题目通过json_decode知道get的json是一个数组且$json中有x值为wllm

由此知道我们要构造id=wllmNB son={"x":"wllm"} 通过hackbar得到flag值