第30天JS应用&Nodejs指南&原型链污染&Express框架&功能实现&审计
普通html里的js，源代码可以看到
而node.js看不到,单独的js代码
换句话说：nodejs是运行在服务端的JavaScript
开发（sql注入）
sql.js
constexpress=require('express');constmysql=require('mysql');constapp=express();constbodyParser=require('body-parser');const{hashPassword}=require("mysql/lib/protocol/Auth");varurlencodedParser=bodyParser.urlencoded({extended:false})// //get路由// app.get('/login',function(req,res){// // res.send('<hr>login!!</hr>');// const u=req.query.username;// const p=req.query.password;// console.log(u);// console.log(p);// if(u=='admin' && p=='123456')// {// res.send('换一家你进去后台');// }// else{// res.send('shibai man!!');// }// })////post路由app.post('/login',urlencodedParser,function(req,res){constu=req.body.username;constp=req.body.password;console.log(u);console.log(p);varconnection=mysql.createConnection({host:'localhost',user:'root',password:'123456',database:'demo01'});connection.connect();constsql='select * from admin where username="'+u+'" and password="'+p+'";';connection.query(sql,function(error,data){if(error){console.log('数据查询错误');}console.log(data);try{if(u==(data[0]['username'])&&p==(data[0]['password'])){res.send('现在是后台页面');}}catch{res.send('shibai man!!');}})console.log(sql);})//根路由app.get('/',function(req,res){res.sendFile(__dirname+'/'+'sql.html');})constserver=app.listen(3000,function(){console.log('web的3000端口已经启动！！！');})sql.html
<!DOCTYPEhtml><htmllang="zh-CN"><head><metacharset="UTF-8"><metaname="viewport"content="width=device-width, initial-scale=1.0"><title>简单登录框</title><style>body{font-family:Arial,sans-serif;background-color:#f0f0f0;display:flex;justify-content:center;align-items:center;height:100vh;margin:0;}.login-box{background-color:white;padding:30px;border-radius:8px;box-shadow:0 2px 10pxrgba(0,0,0,0.1);width:300px;}h2{text-align:center;margin-bottom:25px;color:#333;}.input-group{margin-bottom:20px;}label{display:block;margin-bottom:5px;color:#555;}input{width:100%;padding:10px;border:1px solid #ddd;border-radius:4px;font-size:16px;box-sizing:border-box;}input:focus{outline:none;border-color:#4a90e2;}button{width:100%;padding:12px;background-color:#4a90e2;color:white;border:none;border-radius:4px;font-size:16px;cursor:pointer;}button:hover{background-color:#3a7bc8;}.register-link{text-align:center;margin-top:15px;font-size:14px;}.register-link a{color:#4a90e2;text-decoration:none;}.register-link a:hover{text-decoration:underline;}</style></head><body><divclass="login-box"><h2>用户登录</h2><formaction="http://127.0.0.1:3000/login"method="get">//method视情况而使用<divclass="input-group"><labelfor="username">用户名</label><inputtype="text"id="username"name="username"required></div><divclass="input-group"><labelfor="password">密码</label><inputtype="password"id="password"name="password"required></div><buttontype="submit">登录</button></form></div></body></html>文件管理
file.js
constfs=require('fs');constexpress=require('express');constapp=express();app.get('/file',function(req,res){constdir=req.query.dir;console.log(dir);files=filename_manage(dir);res.send(dir)})functionfilename_manage(dir){fs.readdir('./',function(error,files){console.log(files);});}varserver=app.listen(3000,function(){console.log('web已经启动！！');})命令执行
constrce=require('child_process');//系统命令执行// rce.exec('calc');// rce.spawnSync('calc');//调用代码执行eval('require("child_process").exec("calc");');黑白盒测试思路
黑河：通过对参数功能进行payload测试
白盒：对代码写法安全进行审计
原型链污染
针对打ctf
条件：
1、用到proto
2、有继承
3、还要题目调用危险函数
yapi
管理平台漏洞
rce
