[BSidesCF 2019]Pick Tac Toe
解题步骤
要把梯子打开, 加载了个谷歌的脚本
简单的井字棋游戏
众所周知, 只要两边都会玩, 都是平局结束, 赢不了。
f12开开，发现可以改前端
<html>
<head>
<title>Global Thermonuclear War?</title>
<link href="/css/style.css" rel="stylesheet" />
<link href="/css/bootstrap.min.css" rel="stylesheet" />
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>
<style>
</style>
</head>
<body>
<content>
<div class="container">
<h1>Pick Tac Toe</h1>
<table id="board">
<tr>
<form id='form_ul' method='POST' action='/move'>
<input type='hidden' name='move' value='ul'>
<td id='ul' onClick='$("#form_ul").submit()'> </td>
</form>
<form id='form_u' method='POST' action='/move'>
<input type='hidden' name='move' value='u'>
<td id='u' onClick='$("#form_u").submit()'> </td>
</form>
<form id='form_ur' method='POST' action='/move'>
<input type='hidden' name='move' value='ur'>
<td id='ur' onClick='$("#form_ur").submit()'> </td>
</form>
</tr>
<tr>
<form id='form_l' method='POST' action='/move'>
<input type='hidden' name='move' value='l'>
<td id='l' onClick='$("#form_l").submit()'> </td>
</form>
<form id='form_c' method='POST' action='/move'>
<input type='hidden' name='move' value='c'>
<td id='c' onClick='$("#form_c").submit()'> </td>
</form>
<form id='form_r' method='POST' action='/move'>
<input type='hidden' name='move' value='r'>
<td id='r' onClick='$("#form_r").submit()'> </td>
</form>
</tr>
<tr>
<form id='form_bl' method='POST' action='/move'>
<input type='hidden' name='move' value='bl'>
<td id='bl' onClick='$("#form_bl").submit()'> </td>
</form>
<form id='form_b' method='POST' action='/move'>
<input type='hidden' name='move' value='b'>
<td id='b' onClick='$("#form_b").submit()'> </td>
</form>
<form id='form_br' method='POST' action='/move'>
<input type='hidden' name='move' value='br'>
<td id='br' onClick='$("#form_br").submit()'> </td>
</form>
</tr>
</table>
<hr />
<div id='reset' style=''>
<form method='POST' action='/reset'>
<input id='button' type='submit' value='Reset' />
</form>
</div>
</div>
</content>
</body>
</html>
玩到这种程度
burpsuite抓包改一下
但是不懂为啥我用来代理抓包的火狐浏览器挂不了梯子，导致无法加载谷歌脚本
所以在edge上改前端
把值改为‘b’（卑鄙的外乡人开外挂）
然后点击最后一行的空缺位置
