https://superliverbun.github.io/tags/holyyoung/Recent content in HolyYoung on Bun_.'s BlogHugoenSat, 26 Oct 2024 14:39:22 +0000https://superliverbun.github.io/posts/taiwan-holyyoung-training-%E7%B6%B2%E9%A0%81%E5%AE%89%E5%85%A8/Sat, 26 Oct 2024 02:40:36 +0000https://superliverbun.github.io/posts/taiwan-holyyoung-training-%E7%B6%B2%E9%A0%81%E5%AE%89%E5%85%A8/<p>身為一個資安小萌新，來上這堂課也是很正常的吧。(哭爛)</p> <h2 id="idor-challenge" class="relative group">IDOR Challenge <span class="absolute top-0 w-6 transition-opacity opacity-0 -start-6 not-prose group-hover:opacity-100"><a class="group-hover:text-primary-300 dark:group-hover:text-neutral-700" style="text-decoration-line: none !important;" href="#idor-challenge" aria-label="Anchor">#</a></span></h2><p><a href="http://lab.slasho.tw:8002/" target="_blank" rel="noreferrer">Link</a><br> 在footer有管理員入口<br> <figure><img src="https://superliverbun.github.io/images/hackmd/r14P7f5e1l-cd8ce5.png" alt="image" class="mx-auto my-0 rounded-md" /> </figure> <br> <figure><img src="https://superliverbun.github.io/images/hackmd/Sy3DQfceyl-80f863.png" alt="image" class="mx-auto my-0 rounded-md" /> </figure> <br> 用burp 試試看<br> <figure><img src="https://superliverbun.github.io/images/hackmd/BJgi7Mclkg-afa742.png" alt="image" class="mx-auto my-0 rounded-md" /> </figure> <br> 看來admin也不行，但她寫<strong>非本地訪問</strong><br> 所以加一句</p>