不会ai，被爆杀了。

幸好在这个线下断网的比赛中，脚本编写能力尚且在线，还是做了两题的，也算有所贡献了()

当然开心的还是成功面基到了很多星盟的师傅们:)

数据识别与审计题目1

从流量包中导出所有的phpsessid和查询的value

img

用脚本处理数据

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
import re
f=open('1.txt','r')
ff=open('2.txt','r')
searching=f.readline()
phpid=ff.readline()
s=''
a=''
for i in range(3000):
    searching=f.readline().strip()
    phpid=ff.readline().strip()[10:]
    print(searching,phpid)
    try:
        with open(f'session_{phpid}','r') as fff:
            js=fff.readline().strip()
            pattern = r'i:\s*(.*?)\s*;'
            match = re.search(pattern,js)
            if match:
                who=match.group(1)
                print(who)
            else:
                print('wtf')
                continue
            if js[-3]!='1' and who!=searching:
                s+='_'+who
            else:
                continue
    except:
        print('Not found')
print(s)
print(a)

img

数据识别与审计题目3

先从网站上爬取所有url，然后用脚本判断

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
import requests
import re
url='http://192.168.56.133'
urls=[]
disallows=['/logs','/user/profile','/api','/admin','/private/folder','/debug','/details','.bak','?token=']
allows=['/logs/public','/api/v2/safe','.zip','/download','/about','/services','/title','/products','/register','/temp','/system','search?q=','/restricted','/cart']
cnt=0
for i in range(1,31):
    urll=url+f'?page={i}'
    r=requests.get(url=urll).text
    pattern=r'<a href="(.*?)"'
    match=re.findall(pattern,r)
    if match:
        urls+=match
for i in urls:
    for j in disallows:
        if j in i:
            cnt+=1
            print(i)
            for x in allows:
                if x in i:
                    cnt-=1
                    print(-1)
print(len(urls))
print(cnt)

img