Shulou(Shulou.com)06/01 Report--

The concept of unserialize () function

Unserialize () operates on a single serialized variable, converting it back to the value of PHP. The converted value is returned, which can be integer, float, string, array, or object. Returns FALSE if the passed string is unserializable. The opposite function serialize () serializes the function.

Let's look at a topic.

Topic: Skynet management system, link: http://ctf5.shiyanbar.com/10/web1/

1. Go to the topic and view the source code of the page.

This prompt is more domineering, directly let you determine whether the MD5 value of your user name is equal to 0, here the use of php to deal with MD5 hash defects, encounter a hash value of 0e string is regarded as 0Q QNKCDZO is such a string. Recommendation website; https://www.cnblogs.com/Primzahl/p/6018158.html.

2. Enter this special string and check it out

3. Give a path and check it for a while

Here we get another source code, and the key part of it is the unserialize () function. It is clear from the source code that the username value transmitted by post should be an array. Only in this way can we get the values of user,pass respectively.

We can't just give an array, because the unserialize () function needs to process the serialized string and then deserialize it to the value of php. So the value we enter should be an array processed by the serialization function serialize (), and then handed over to the unserialize () function to handle.

Write a serialization string script:

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.