Web Security Notes

題目網址：https://www.hackthissite.org/missions/prog/11/ 本關重點：眼明手快 題目：Reverse Ascii Shift This string was randomly generated. It will not be recognizable text. You have 3 seconds to take the information from the website, and apply that to your algorithm. Generated String: 82%102%64%75%114%101%91%107%72%90% Shift: 29 大意是給你一串任意ascii碼，以任意特殊符號分隔。目的是把這一串ascii碼減去某個數字後，再還原成字元輸出。限制3秒鐘內...難就難在3秒鐘內要回答。 安全限制 原本想要把網頁內嵌在iframe中，當題目載入後，就從外框去抓內框的ascii碼，處理之後再submit。但是會違反 相同來源政策 ，瀏覽器不讓我這樣搞。所以只能另外想辦法。 想到的方法有兩種，一種是用windows shell script登入網站讀取題目和關鍵字，處理完轉碼之後在送出表單，可是我覺得這樣很花時間，而且題目和關鍵字沒有特定的html tag包起來，只能讀取整個頁面，怕效率不好。第二種方法就是人工複製題目，寫一支小程式來轉碼，複製貼上進行轉碼，得到答案後再貼回答案欄。 用javascript寫小程式的限制 因為我懶惰，所以直接用javascript寫了小程式，這才發現，題目中的ascii碼有時候會超過html可以顯示的字元範圍(譬如：換行字元、刪除字元、esc字元等等)。還好經過多次嘗試之後，總是會有能正常顯示的組合出現，因此我勉強用了兩三個小時解開題目。當我解開時，也決定下次要採用更有效的方法。(想嘗試你的手速可以用這支下面小程式來玩玩)

上一篇 文章 是介紹如何撰寫簡單的console程式，這篇將分享我實作 SharpPcap  winform 程式的心得和遇到的問題。 winform表單設計 一個TextBox，作用是輸入過濾封包的filter到TextBox。 一個ListBox，作用是選擇ListBox中的網卡設備。 兩個Button。作用是開始時按下開始監聽按鈕，結束時按下停止監聽。 form.cs程式碼 設定完介面之後，我在 form.cs 引用 SharpPcap 的元件，並在Form class中先宣告網卡設備清單。然後在 Form 的初始函式中獲取網卡清單並在入到 Listbox 中。 using SharpPcap; using SharpPcap.LibPcap; using PacketDotNet; namespace webcam_alarm_for_skype {     public partial class Form1 : Form     {         LibPcapLiveDeviceList devicelist = LibPcapLiveDeviceList.Instance;         public Form1()         {             InitializeComponent();             for (int i = 0; i < devicelist.Count; i++)             {                 ListBox.Items.Add(devicelist[i].Description);             }         }     } }

題目網址：https://www.hackthissite.org/missions/prog/1/ 本關重點：字串處理、搜尋 題目：Unscramble the words 原始單字清單 You have to find the original (unscrambled) words, which were randomly taken from a wordlist. This level is about unscrambling words. Find the original (unscrambled) words, which were randomly taken from a wordlist. Send a comma separated list of the original words, in the same order as in the list below. You have 30 seconds time to send the solution. List of scrambled words: tsreaeh erxotp rtoatrc pdazoh abomob stieccl ruconyt sbownr kmfcue swleov (重新排列的十個單字) 題目會先給你一千多個單字的題庫，每個單字之間以換行字元隔開。接著會要求你在30秒之內把重新排列過的其中10個單字(如題)找出來，最後以逗點方式隔開答案。 整理單字題庫的字元數 和ASCII碼， 一千多個單字，解題時間卻只有30秒，如果逐個字元比對，平均7個字元長度的10個重新排列單字需要 (1000+500+250+125+62+31+15)*字元比對*7*10，再加上暫存題庫的空間。我想可能不是個有效率的方法。因此我們先將題庫整理一下，列出所有單字的字元數和ascii碼然後以相同順序儲存到暫存陣列。依序進行字元數比對、ascii比對、逐字元比對，我估計計算時間可以減少為 (1000*字元長度比對+200*acii碼比對+5*字元比對*7)*10。

原始網頁： PAE patch updated for Windows 8 by wj32 PAE技術出現之後，很多人質疑 32 bits Windows OS 為什麼不能像32 bits linux 使用4 GB以上的記憶體，為什麼 XP sp1 曾經支援過 PAE 後來sp 2、sp 3卻被封印，面對問題微軟只有笑而不答。因此網路上很多解決方案( How to Enable PAE on a 32 Bit Windows XP 、 Windows 7 32-bit with full 4 GB or 8 GB RAM support )，只為了開啟被微軟封印的 PAE 技術。其中Windows 8 的解決方案卻付之闕如，有些人像我一樣因為透過  微軟 Windows 8 促銷  買到經濟實惠的作業系統。但是升級過程卻沒得選擇，只能直接從 32 bit XP 到 32 bit Windows 8。這下可好了，揪竟該如何讀取4 GB以上的記憶體呢？ 32 bit Windows 8 專用Patch 神人 wj32 提出的 Patch 正好可以解決這個問題，使用前請先移除所有你曾用過的RAM Patch，並記得先備份系統。

網址： http://www.hackthissite.org/missions/realistic/15 本關重點： 耐心、zip檔解密、php可變變數、雜湊值還原、Linux指令、C語言緩衝區溢位 題目：Simple Mail Message: Hi, please help me if you are against war like me. Rumours are saying that the seculas Ltd. company is developing an awful new laser aided weapon, and that they already have patents pending. Please try to find out what their latest patents are about. People say you know your shit and that you are an amazingly good hacker. It should not be a prob for someone with your skills. What I know is that seculas Ltd. hired a new programmer who is responsible for the server, and he passworded everything and always with different passwords. I heard about him, he is one the kind who locks the front door twice and leaves the back-door open. If you think like me please help me and fight those people that make money with war. 大意就是， 某軍火商正在製造可怕的雷射武器，希望你阻止軍火商申請新的專利，並查出他們的專利內容有哪些。題目透漏一個有用的情報，維護官網的工程師雖然都有將資料加密，但卻是個粗心的人。 搜尋重要目錄和程式 就跟所有web滲透的題目一樣，先找出重要的目錄、或程式。並且尋找可以注入變數的

網址：https://www.hackthissite.org/missions/realistic/6/index.html 本關重點 ：XEcryption弱點、已知明文攻擊 題目 ：From: ToxiCo_Watch Message: Hello esteemed hacker, I hope you have some decent cryptography skills. I have some text I need decrypted. I work for this company called ToxiCo Industrial Chemicals, which has recently come under fire because of the toxic chemicals we are dumping into the river nearby. Ecological inspectors have reported no problems, but it is widely speculated that they were paid off by ToxiCo management because the water pollution near the ToxiCo factory has always been a serious and widely publicized issue. I have done some packet sniffing on my network and I have recovered this email that was sent from the CEO of the company to Chief Ecological Inspector Samuel Smith. However, it is encrypted and I cannot seem to decode it using any of my basic decryption tools. I have narrowed it down to the algorithm used to encrypt it, but it is beyond my scope. I was hoping you can