BUUCTF WEB PHP1

云端的火焰

那题提醒有备份文件，假如您间接用dirsearch扫，您会扫出去一堆429战503，由于效劳器设置了防扫步伐，限定了会见频次
<?php
    include &#39;class.php&#39;;
    $select = $_GET[&#39;select&#39;];
    $res=unserialize(@$select);
    ?>要末脚动指定扫描速率，大要您能够换个东西，dirmap，那东西自己扫的便没有长短常快
<?php
    include &#39;class.php&#39;;
    $select = $_GET[&#39;select&#39;];
    $res=unserialize(@$select);
    ?>扫出去www.zip，看一看，flag.php，一看便是个假flag
<?php
    include &#39;class.php&#39;;
    $select = $_GET[&#39;select&#39;];
    $res=unserialize(@$select);
    ?>把项目导进到phpstorm中，然后搜刮flag枢纽字，发明正在class.php里呈现了flag，而class.php是由index.php挪用
<?php
    include &#39;class.php&#39;;
    $select = $_GET[&#39;select&#39;];
    $res=unserialize(@$select);
    ?>以是看过代码后简朴梳理一下思绪
<?php
    include &#39;class.php&#39;;
    $select = $_GET[&#39;select&#39;];
    $res=unserialize(@$select);
    ?>index.php
<?php
    include &#39;class.php&#39;;
    $select = $_GET[&#39;select&#39;];
    $res=unserialize(@$select);
    ?>

1. <?php
2.     include &#39;class.php&#39;;
3.     $select = $_GET[&#39;select&#39;];
4.     $res=unserialize(@$select);
5.     ?>

复造代码

<?php
    include &#39;class.php&#39;;
    $select = $_GET[&#39;select&#39;];
    $res=unserialize(@$select);
    ?>class.php
<?php
    include &#39;class.php&#39;;
    $select = $_GET[&#39;select&#39;];
    $res=unserialize(@$select);
    ?>[code]<span <?php
    include &#39;class.php&#39;;
    $select = $_GET[&#39;select&#39;];
    $res=unserialize(@$select);
    ?>class="token <?php
    include &#39;class.php&#39;;
    $select = $_GET[&#39;select&#39;];
    $res=unserialize(@$select);
    ?>delimiter <?php
    include &#39;class.php&#39;;
    $select = $_GET[&#39;select&#39;];
    $res=unserialize(@$select);
    ?>important">