New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

常见web漏洞 #202

Open

wsxk opened this issue Aug 2, 2024 · 0 comments

Labels

Gitalk /web_vul/

Owner

wsxk commented Aug 2, 2024

https://wsxk.github.io/web_vul/

常见web漏洞

3.1 路径遍历漏洞
3.2 命令注入
3.3 身份验证绕过
3.4 SQL注入
3.5 跨站脚本
常见web漏洞
3.1 路径遍历漏洞
路径遍历漏洞指的是允许攻击者在未经授权的情况下读取服务器上任意文件的安全漏洞
例子:

路径遍历漏洞的参数通常是../../../flag

curl http://challenge.localhost:80/?path=../flag

3.2 命令注入
命令注入指的是攻击者可以控制变量作为命令被执行而导致的安全漏洞
比如有如下代码:
def level2():
timezone = request.args.get(

wsxk added Gitalk /web_vul/ labels

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment