https://baozongwi.xyz/tags/flask-session/Currently exploring Java security and internal network penetration, with CTFs as a hobby.Hugozh-cnhttps://baozongwi.xyz/p/srdnlenctf2025/Sun, 19 Jan 2025 19:42:32 +0000https://baozongwi.xyz/p/srdnlenctf2025/Ben 10 import secrets import sqlite3 import os from flask import Flask, render_template, request, redirect, url_for, flash, session app = Flask(__name__) …https://baozongwi.xyz/p/flask-session-forgery/Tue, 22 Oct 2024 15:30:50 +0000https://baozongwi.xyz/p/flask-session-forgery/0x01 说在前面 在一般的情况下，网站都会做一个简答的身份验证，而flask当中自然也有，这种就是我们常见的session，session是什么，可以看这个文章 …https://baozongwi.xyz/p/great-wall-cup-2024-beijing-tianjin-hebei/Mon, 09 Sep 2024 09:58:00 +0000https://baozongwi.xyz/p/great-wall-cup-2024-beijing-tianjin-hebei/0x01 前言 WM坐牢之后发现还有这个比赛，能看看嘿嘿 0x02 question SQLUP 打开题目环境之后发现源码里面说要fuzz，发现%,没被过滤直接通配符了 username:admin password:%% 测试了一下确实可以 mysql> select * from flag where name …https://baozongwi.xyz/p/hctf2018/Mon, 12 Aug 2024 21:12:16 +0000https://baozongwi.xyz/p/hctf2018/[HCTF 2018]WarmUp 查看源码/source.php <?php highlight_file(__FILE__); class emmm { public static function checkFile(&$page) { $whitelist = …