sql injection bypass WAF
·
DreamHack/WEB
문제 화면이다. 소스코드와 SQL를 하면 봐보자.       import osfrom flask import Flask, requestfrom flask_mysqldb import MySQLapp = Flask(__name__)app.config['MYSQL_HOST'] = os.environ.get('MYSQL_HOST', 'localhost')app.config['MYSQL_USER'] = os.environ.get('MYSQL_USER', 'user')app.config['MYSQL_PASSWORD'] = os.environ.get('MYSQL_PASSWORD', 'pass')app.config['MYSQL_DB'] = os.environ.get('MYSQL_DB', 'users')mysql = M..
(CTF출제) baby-union
·
DreamHack/CTF
import osfrom flask import Flask, request, render_templatefrom flask_mysqldb import MySQLapp = Flask(__name__)app.config['MYSQL_HOST'] = os.environ.get('MYSQL_HOST', 'localhost')app.config['MYSQL_USER'] = os.environ.get('MYSQL_USER', 'user')app.config['MYSQL_PASSWORD'] = os.environ.get('MYSQL_PASSWORD', 'pass')app.config['MYSQL_DB'] = os.environ.get('MYSQL_DB', 'secret_db')mysql = MySQL(app)@app..