34 |
35 |
--------------------------------------------------------------------------------
/back-end/CSRF/manage/login.php:
--------------------------------------------------------------------------------
1 | setTimeout(() => {location.href='index.html'}, 3000)";
8 | exit();
9 | }
10 |
11 | if ("" == trim($username) || "" == trim($password)) {
12 | goBack('请填写账号或密码');
13 | }
14 |
15 | $conn = new mysqli('db', getenv('MYSQL_USER'), getenv('MYSQL_PASSWORD'));
16 | if ($conn->connect_error) {
17 | die("数据库连接失败: " . $conn->connect_error);
18 | }
19 |
20 | // 对 password 进行 md5 加密，并存入数据库里
21 | $password = md5($password);
22 | $sql = "SELECT * FROM csrf.admin WHERE username='$username' and password='$password'";
23 | $result = $conn->query($sql);
24 |
25 | // 判断数据库里是否有此用户
26 | if (mysqli_num_rows($result)) {
27 | // 设置cookies，并以-分割
28 | setcookie('user_flag', $password.'-'.$username, time() + 3600 * 24);
29 | header('Location: ./main.php');
30 | } else {
31 | goBack('账号密码错误');
32 | }
33 | $conn->close();
34 | ?>
--------------------------------------------------------------------------------
/back-end/JSON Hijacking/web/login.php:
--------------------------------------------------------------------------------
1 | setTimeout(() => {location.href='index.html'}, 3000)";
8 | exit();
9 | }
10 |
11 | if ("" == trim($username) || "" == trim($password)) {
12 | goBack('请填写账号或密码');
13 | }
14 |
15 | $conn = new mysqli('db', getenv('MYSQL_USER'), getenv('MYSQL_PASSWORD'));
16 | if ($conn->connect_error) {
17 | die("数据库连接失败: " . $conn->connect_error);
18 | }
19 |
20 | // 对 password 进行 md5 加密，并存入数据库里
21 | $password = md5($password);
22 | $sql = "SELECT * FROM json_hijacking.user WHERE username='$username' and password='$password'";
23 | $result = $conn->query($sql);
24 |
25 | // 判断数据库里是否有此用户
26 | if (mysqli_num_rows($result)) {
27 | // 设置cookies，并以-分割
28 | setcookie('user_flag', $password.'-'.$username, time() + 3600 * 24);
29 | header('Location: ./main.php');
30 | } else {
31 | goBack('账号密码错误');
32 | }
33 | $conn->close();
34 | ?>
--------------------------------------------------------------------------------
/back-end/CSRF/manage/utils.php:
--------------------------------------------------------------------------------
1 | connect_error) {
26 | die("数据库连接失败: " . $conn->connect_error);
27 | }
28 |
29 | $sql = "SELECT * FROM csrf.admin WHERE username='$usernameByCookies' and password='$passwordByCookies'";
30 | $result = $conn->query($sql);
31 |
32 | if (!mysqli_num_rows($result)) {
33 | return [];
34 | }
35 |
36 | return [$usernameByCookies, $passwordByCookies];
37 | }
38 | ?>
--------------------------------------------------------------------------------
/back-end/XSS/persistent/client/js.js:
--------------------------------------------------------------------------------
1 | const template = data => {
2 | return `
3 |