简单的代码审计.docxVIP

[*] 进入页面需要输入PASSWORD 点击 source code , 进行代码审计 ?php if (isset ($_GET[password])) { if (ereg (^[a-zA-Z0-9]+$, $_GET[password]) === FALSE) { echo pYou password must be alphanumeric/p; } else if (strlen($_GET[password]) 8 $_GET[password] 9999999) { if (strpos ($_GET[password], *-*) !== FALSE) { die(Flag: . $flag); } else { echo(p*-* have not been found/p); } } else { echo pInvalid password/p; } } ? [*] 查看后发现 password的三个条件 条件1：ereg (^[a-zA-Z0-9]+$, $_GET[password]) ！== FALSE password由字母数字组成 条件2：strlen($_GET[password]) 8 $_GET[password] 9999999 password长度小于