-
-
HACKER游戏之Escape加密VSUnEscape解密
-
发表于: 2010-10-23 15:33 6556
-
刚才我开始了黑客游戏之旅,第一关是【戴威尔】黑客游戏,网址:http://game.enet.org.cn/。我们开始通关了,页面是一个黑色背景页面,基本上没有提示,要求输入通关密码,如果你使用社会工程学,可能很容易的猜到密码(hackervip.com )。com后面是有空格的哦,嘿嘿,但是往往我们运气没有那么好,所以我还是循规蹈矩的来进行分析。依旧是查看网页的源代码:
从NewWords = unescape(Words);可以看出来,word使用UnEscape加密的,复制word中的字符串,到Escape加密VSUnEscape解密站长工具:http://tool.chinaz.com/Tools/Escape.aspx问的文本框中,点击Unescape解密,马上就可以看到word对应的源码:
熟悉JAVAScript的话你很快就可以看到:
var x=document.password.pass.value;
if (x=="hackervip.com ") {alert('恭喜过关,进入第二关!');看见密码了吧,密码就是x对应的值,第一关是不是很简单啊。呵呵。
var Words ="%0A%3CSCRIPT%3E%0Afunction%20stop%28%29%7B%0Areturn%20false%3B%0A%7D%0Adocument.oncontextmenu%3Dstop%3B%0A%3C/SCRIPT%3E%0A%0A%3CSCRIPT%20language%3DJavaScript%3E%0A%3C%21--%0A%0Afunction%20SymError%28%29%0A%7B%0A%20%20return%20true%3B%0A%7D%0A%0Awindow.onerror%20%3D%20SymError%3B%0A%0A//--%3E%0A%3C/SCRIPT%3E%0A%0A%3CSCRIPT%20language%3DJavascript%3E%0A%0A%0A%0Afunction%20PassConfirm%28%29%20%7B%0A%0Avar%20x%3Ddocument.password.pass.value%3B%0A%0Aif%20%28x%3D%3D%22hackervip.com%u3000%22%29%20%7Balert%28%27%u606D%u559C%u8FC7%u5173%uFF0C%u8FDB%u5165%u7B2C%u4E8C%u5173%uFF01%27%29%3B%0A%0Awindow.open%28%22errror.html%22%2C%22_self%22%29%20%7D%0A%0Aelse%20%7Bdocument.password.pass.value%3D%27%27%3Breturn%20false%3B%0A%0Awindow.open%28%22error.htm%22%2C%22_self%22%29%20%7D%0A%0A%0A%7D%0A%3C/SCRIPT%3E%0A%0A%3Ccenter%3E%u3000%3Cp%3E%3Cfont%20color%3D%22%23ff0000%22%20size%3D%226%22%3E%u300E%u4E2D%u5B89%u7F51%u57F9%u300F%u9ED1%u5BA2%u6E38%u620F%u3000%3C/font%3E%3C/p%3E%0A%3Cp%3E%3Cfont%20color%3D%22%23ff0000%22%20size%3D%226%22%3E%3Ca%20href%3D%22http%3A//www.hackervip.com/%22%3E%0Ahttp%3A//www.hackervip.com%3C/a%3E%u3000%3C/font%3E%3C/p%3E%0A%3Cp%3E%3Cfont%20color%3D%22%2300ff00%22%20size%3D%225%22%3E%u7B2C%u4E00%u5173%3C/font%3E%3C/p%3E%0A%3Cp%3E%3Cfont%20color%3D%22%2300ff00%22%20size%3D%225%22%3E%uFF08%u9ED1%u5BA2%u6E38%u620F%u7F51%u9875%u5173%uFF09%uFF01%3C/font%3E%3C/p%3E%0A%3Cform%20name%3D%22password%22%20method%3D%22post%22%3E%0A%09%3Cfont%20color%3D%22%2300ff00%22%3E%3Cbr%3E%0A%09%u8981%u6C42%uFF1A%u8FDB%u5165%u7B2C%u4E8C%u5173%uFF01%3C/font%3E%0A%09%3Cp%3E%3Cbr%3E%0A%09%3Cfont%20size%3D%225%22%3E%3Cfont%20color%3D%22%23ff0000%22%3E%u8BF7%u8F93%u5165%u5BC6%u7801%3A%3C/font%3E%3Cbr%3E%0A%09%3C/font%3E%3Cbr%3E%0A%09%3Cinput%20type%3D%22password%22%20value%20name%3D%22pass%22%3E%20%3Cbr%3E%0A%09%3Cbr%3E%0A%09%3Cinput%20onclick%3D%22return%20PassConfirm%28%29%22%20type%3D%22button%22%20value%3D%22%u786E%u5B9A%22%3E%20%3C/p%3E%0A%3C/form%3E%0A%3C/center%3E%0A%3Cp%3E%u3000%3C/p%3E%0A%3Cp%20align%3D%22center%22%3E%3Cfont%20color%3D%22%23ff0000%22%20size%3D%224%22%3E%u8BBE%u8BA1%u8005%uFF1A%u4E2D%u5B89%u7F51%u57F9%0A%3Ca%20href%3D%22http%3A//www.hackervip.com%22%3Ehttp%3A//www.hackervip.com%3C/a%3E%3C/font%3E%3C/p%3E%0A%3Cp%20align%3D%22center%22%3E%u9ED1%u5BA2%u57F9%u8BAD%uFF0C%u5B89%u5168%u57F9%u8BAD%u95E8%u6237%u7F51%u7AD9%3C/p%3E%0A%0A" function SetNewWords() { var NewWords; NewWords = unescape(Words); document.write(NewWords); } SetNewWords();前面定义了一个变量:word,里面有很多字符,不用管它,看下边 function SetNewWords() { var NewWords; NewWords = unescape(Words); document.write(NewWords); }
从NewWords = unescape(Words);可以看出来,word使用UnEscape加密的,复制word中的字符串,到Escape加密VSUnEscape解密站长工具:http://tool.chinaz.com/Tools/Escape.aspx问的文本框中,点击Unescape解密,马上就可以看到word对应的源码:
<SCRIPT> function stop(){ return false; } document.oncontextmenu=stop; </SCRIPT> <SCRIPT language=JavaScript> <!-- function SymError() { return true; } window.onerror = SymError; //--> </SCRIPT> <SCRIPT language=Javascript> function PassConfirm() { var x=document.password.pass.value; if (x=="hackervip.com ") {alert('恭喜过关,进入第二关!'); window.open("errror.html","_self") } else {document.password.pass.value='';return false; window.open("error.htm","_self") } } </SCRIPT> <center> <p><font color="#ff0000" size="6">『中安网培』黑客游戏 </font></p> <p><font color="#ff0000" size="6"><a href="http://www.hackervip.com/"> http://www.hackervip.com</a> </font></p> <p><font color="#00ff00" size="5">第一关</font></p> <p><font color="#00ff00" size="5">(黑客游戏网页关)!</font></p> <form name="password" method="post"> <font color="#00ff00"><br> 要求:进入第二关!</font> <p><br> <font size="5"><font color="#ff0000">请输入密码:</font><br> </font><br> <input type="password" value name="pass"> <br> <br> <input onclick="return PassConfirm()" type="button" value="确定"> </p> </form> </center> <p> </p> <p align="center"><font color="#ff0000" size="4">设计者:中安网培 <a href="http://www.hackervip.com">http://www.hackervip.com</a></font></p> <p align="center">黑客培训,安全培训门户网站</p>
熟悉JAVAScript的话你很快就可以看到:
var x=document.password.pass.value;
if (x=="hackervip.com ") {alert('恭喜过关,进入第二关!');看见密码了吧,密码就是x对应的值,第一关是不是很简单啊。呵呵。
赞赏
他的文章
- [求助]请问Failwest大大,《0day安全:软件漏洞分析技术(第二版)》何时出版?? 10761
- [原创]我的信息安全之路--书籍推荐 16006
- [推荐]F#函数式编程 5894
- [推荐]F#语言 12788
- [推荐]一个程序员的爱情自白 3636
看原图
赞赏
雪币:
留言: