层层递进(100)

0x00
题目地址:http://chinalover.sinaapp.com/web3/

0x01
解题思路:
这题没什么难度,不过比较坑爹,从源码中找到链接地址,一直往下链,上网站源码:
页面一源码:

1
2
3
4
5
<body>
<body style="overflow:auto;">
<iframe runat="server" src="SO.html" width="100%" height="237" frameborder="no" border="0" marginwidth="0" marginheight="0" scrolling="no" allowtransparency="yes"></iframe>
<iframe runat="server" src="http://www.lunzhiyu.com" width="100%" height="3800" frameborder="no" border="0" marginwidth="0" marginheight="0" scrolling="no" allowtransparency="yes"></iframe>
</body>

页面二源码:

1
<iframe runat="server" src="S0.html" width="100%" height="237" frameborder="no" border="0" marginwidth="0" marginheight="0" scrolling="no" allowtransparency="yes"></iframe>

页面三源码:

1
2
3
4
5
<body>
<body style="overflow:auto;">
<iframe runat="server" src="SO.htm" width="100%" height="237" frameborder="no" border="0" marginwidth="0" marginheight="0" scrolling="no" allowtransparency="yes"></iframe>
<iframe runat="server" src="http://www.lunzhiyu.com" width="100%" height="3800" frameborder="no" border="0" marginwidth="0" marginheight="0" scrolling="no" allowtransparency="yes"></iframe>
</body>

页面四源码:

1
2
3
4
5
<body>
<body style="overflow:auto;">
<iframe runat="server" src="S0.htm" width="100%" height="237" frameborder="no" border="0" marginwidth="0" marginheight="0" scrolling="no" allowtransparency="yes"></iframe>
<iframe runat="server" src="http://www.lunzhiyu.com" width="100%" height="3800" frameborder="no" border="0" marginwidth="0" marginheight="0" scrolling="no" allowtransparency="yes"></iframe>
</body>

页面五源码:

1
2
3
4
5
<body>
<body style="overflow:auto;">
<iframe runat="server" src="404.html" width="100%" height="3" frameborder="no" border="0" marginwidth="0" marginheight="0" scrolling="no" allowtransparency="yes"></iframe>
<iframe runat="server" src="http://www.lunzhiyu.com" width="100%" height="3800" frameborder="no" border="0" marginwidth="0" marginheight="0" scrolling="no" allowtransparency="yes"></iframe>
</body>

页面六源码:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
<!-- Placed at the end of the document so the pages load faster -->
<!--  
<script src="./js/jquery-n.7.2.min.js"></script>
<script src="./js/jquery-c.7.2.min.js"></script>
<script src="./js/jquery-t.7.2.min.js"></script>
<script src="./js/jquery-f.7.2.min.js"></script>
<script src="./js/jquery-{.7.2.min.js"></script>
<script src="./js/jquery-t.7.2.min.js"></script>
<script src="./js/jquery-h.7.2.min.js"></script>
<script src="./js/jquery-i.7.2.min.js"></script>
<script src="./js/jquery-s.7.2.min.js"></script>
<script src="./js/jquery-_.7.2.min.js"></script>
<script src="./js/jquery-i.7.2.min.js"></script>
<script src="./js/jquery-s.7.2.min.js"></script>
<script src="./js/jquery-_.7.2.min.js"></script>
<script src="./js/jquery-a.7.2.min.js"></script>
<script src="./js/jquery-_.7.2.min.js"></script>
<script src="./js/jquery-f.7.2.min.js"></script>
<script src="./js/jquery-l.7.2.min.js"></script>
<script src="./js/jquery-4.7.2.min.js"></script>
<script src="./js/jquery-g.7.2.min.js"></script>
<script src="./js/jquery-}.7.2.min.js"></script>
-->

从页面一的SO.html跳转到页面二,然后一直往下跳转,最后跳到404.html页面,源码中有注释掉的.js一段,从上往下就能发现flag。
所以flag就是:nctf{this_is_a_fl4g}

《层层递进(100)》有1个想法

发表评论

电子邮件地址不会被公开。 必填项已用*标注