作者:颖奇L'Amore

Most of the time is also called Y1ng. Cisco Certified Internetwork Expert - Routing and Switching. CTF player for team r3kapig. Forcus on Web Security. Islamic Scholar. Be good at sleeping and fishing in troubled waters.

78 篇文章

thumbnail
DNS Rebinding Attack DNS重绑攻击在SSRF中的应用
Author:颖奇L'Amore Blog:www.gem-love.com [alert]题目介绍[/alert] 在12月23日华为XCTF高校网络安全专题挑战赛-鲲鹏计算专场中,出现了一道DNS Rebinding Attack的题目,题目名称CLOUDSTORAGE,附件给了docker [collapse title="app.js"] …
thumbnail
RoarCTF 2020 Writeup
Author:颖奇L'Amore Blog:www.gem-love.com 有幸能为本次比赛出题,就是题出的比较垃圾,每道题都有非预期,在这里先给各位谢罪了。详细的解法我已经写到官方Writeup了,请各位关注。以下是我出的3个题目的预期&已知非预期(不是官方wp),如果看到其他非预期,会更新过来。 有其他解法欢迎评论区告知我! [ale…
thumbnail
2020祥云杯Writeup
Author:颖奇L'Amore Blog:www.gem-love.com Command 命令注入 127.0.0.1|find%09%2f%09-name%09"fla?.txt" 找到flag:/etc/.findflag/flag.txt 127.0.0.1|ca\t%09%2fetc%2f.findfla?%2ffla?.txt fla…
thumbnail
N1CTF 2020 Writeup
Author:颖奇L'Amore Blog:www.gem-love.com This weekend I played N1CTF with team r3kapig and finally we got the 2nd🥈 place. Thanks to all my teammates for their hard work, and als…
thumbnail
🇯🇵SECCON 2020 OnlineCTF Writeup
Author:颖奇L'Amore Blog:www.gem-love.com Beginner's Capsule solved by [email protected] 题目是TS写的,给了Docker (tar.gz格式) 可以任意执行命令,根据给的这段代码来看我们要读flag,但是flag是个PR,是不能从外界访问的 源码没有什么有用的东西,写的基本都…
thumbnail
2020“巅峰极客”初赛Writeup
Author:颖奇L'Amore Blog:www.gem-love.com 因为一直在TCTF Final摸鱼,这个比赛就随便看了看,最后一个web在赛后6分钟做出的,于是无缘线下了,这个线上赛就权当娱乐了 babyphp2 www.zip得到源码。不用注入,因为读文件和上传文件都不需要登录,那个只是个障眼法。 有类,有上传,有文件读取,很明显的…
thumbnail
XCTF-GACTF 2020 Writeup
Author:颖奇L'Amore Blog:www.gem-love.com 这个周末比较忙,就第一天中午打了一小会儿 XWiki 题目是XWiki 11.10.1,则可以使用CVE-2020-11057一键RCE: Create new user Go to profile -> Edit -> My dashboard -> …
thumbnail
“钓鱼城杯”国际网络安全技能大赛Writeup
Author:颖奇L'Amore Blog:www.gem-love.com zblog 在title找到了任意文件读取 view-source:http://122.112.253.135/?title=../../../../../../../etc/passwd view-source:http://122.112.253.135/?titl…
thumbnail
🇺🇸GoogleCTF 2020 Writeup
Author:颖奇L'Amore Blog:www.gem-love.com JS大赛 我好爱 如果不和强网杯冲突就更好了 All The Little Things I left a little secret in a note, but it's private, private is safe. Note: TJMike🎤 from Pas…