Updates from 七月, 2016 Toggle Comment Threads | 键盘快捷键

  • jinzihao pm6:45 on 2016年7月22日 链接地址 | 回复  

    awk的split函数得到的数组下标从1开始,而不是从0开始,和绝大多数编程语言不同(但和BASIC系的语言一致)。
    被这个坑死了…

     
  • jinzihao pm1:56 on 2016年7月22日 链接地址 | 回复  

    #!/bin/bash
    cat $1 | while read line
    do
            echo ${line:0:${#line}-1}
    done
    

    这段shell脚本从第一个命令行参数$1指示的文件中每次读取一行,并显示在屏幕上,其中echo也可以换为其他命令。如果直接用$line,最后会多一个换行符,会导致有些程序运行出现异常(这里echo不会出现异常),可以改写为${line:0:${#line}-1}以去掉$line的最后一个字符(即换行符)。

     
  • jinzihao pm12:49 on 2016年7月12日 链接地址 | 回复  

    [转] 道德经新译 

    道可道,非常道。名可名,非常名。无名天地之始;有名万物之母。故常无欲,以观其妙;常有欲,以观其徼。此两者,同出而异名,同谓之玄。玄之又玄,衆妙之门。

    The tao that can be tar(1)ed
    is not the entire Tao.
    The path that can be specified
    is not the Full Path.

    We declare the names
    of all variables and functions.
    Yet the Tao has no type specifier.

    Dynamically binding, you realize the magic.
    Statically binding, you see only the hierarchy.

    Yet magic and hierarchy
    arise from the same source,
    and this source has a null pointer.

    Reference the NULL within NULL,
    it is the gateway to all wizardry.

    天下皆知美之为美,斯恶已。皆知善之为善,斯不善已。故有无相生,难易相成,长短相较,高下相倾,音声相和,前后相随。是以圣人处无为之事,行不言之教;万物作焉而不辞,生而不有。为而不恃,功成而弗居。夫唯弗居,是以不去。

    When users see one GUI as beautiful,
    other user interfaces become ugly.
    When users see some programs as winners,
    other programs become lossage.

    Pointers and NULLs reference each other.
    High level and assembler depend on each other.
    Double and float cast to each other.
    High-endian and low-endian define each other.
    While and until follow each other.

    Therefore the Guru
    programs without doing anything
    and teaches without saying anything.
    Warnings arise and he lets them come;
    processes are swapped and he lets them go.
    He has but doesn’t possess,
    acts but doesn’t expect.
    When his work is done, he deletes it.
    That is why it lasts forever.

    不尚贤,使民不争;不贵难得之货,使民不为盗;不见可欲,使心不乱。是以圣人之治,虚其心,实其腹,弱其志,强其骨。常使民无知无欲。使夫知者不敢为也。为无为,则无不治。

    When you overesteem great hackers,
    more users become cretins.
    When you develop encryption,
    more users become crackers.

    The Guru leads
    by emptying user’s minds
    and increasing their quotas,
    by weakening their ambition
    and toughening their resolve.
    When users lack knowledge and desire,
    management will not try to interfere.

    Practice not-looping,
    and everything will fall into place.

    道冲而用之或不盈。渊兮似万物之宗。挫其锐,解其纷,和其光,同其尘。湛兮似或存。吾不知谁之子,象帝之先。

    The Tao is like a glob pattern:
    used but never used up.
    It is like the extern void:
    filled with infinite possibilities.

    It is masked but always present.
    I don’t know who built to it.
    It came before the first kernel.

    天地不仁,以万物为刍狗;圣人不仁,以百姓为刍狗。天地之间,其犹橐龠乎?虚而不屈,动而愈出。多言数穷,不如守中。

    The Tao doesn’t take sides:
    it gives birth to both wins and losses.
    The Guru doesn’t take sides;
    she welcomes both hackers and users.

    The Tao is like a stack:
    the data changes but not the structure.
    the more you use it, the deeper it becomes;
    the more you talk of it, the less you understand.

    Hold on to the root.

    五色令人目盲;五音令人耳聋;五味令人口爽;驰骋田猎,令人心发狂;难得之货,令人行妨。是以圣人为腹不为目,故去彼取此。

    Graphics blind the eyes.
    Audio files deafen the ear.
    Mouse clicks numb the fingers.
    Heuristics weaken the mind.
    Options wither the heart.

    The Guru observes the net
    but trusts his inner vision.
    He allows things to come and go.
    His heart is as open as the ether.

    太上,下知有之;其次,亲而誉之;其次,畏之;其次,侮之。信不足,焉有不信焉。悠兮,其贵言。功成事遂,百姓皆谓我自然。

    When the Guru administers, the users
    are hardly aware that he exists.
    Next best is a sysop who is loved.
    Next, one who is feared.
    And worst, one who is despised.

    If you don’t trust the users,
    you make them untrustworthy.

    The Guru doesn’t talk, he hacks.
    When his work is done,
    the users say, “Amazing:
    we implemented it, all by ourselves!”

    绝圣弃智,民利百倍;绝仁弃义,民复孝慈;绝巧弃利,盗贼无有。此三者以为文不足。故令有所属:见素抱朴,少私寡欲。

    Throw away documentation and manuals,
    and users will be a hundred times happier.
    Throw away privileges and quotas,
    and users will do the Right Thing.
    Throw away proprietary and site licenses,
    and there won’t be any pirating.

    If these three aren’t enough,
    just stay at your home directory
    and let all processes take their course.

    民之饥,以其上食税之多,是以饥。民之难治,以其上之有为,是以难治。民之轻死,以其求生之厚,是以轻死。夫唯无以生为者,是贤于贵生。

    When license fees are too high,
    users do things by hand.
    When the management is too intrusive,
    users lose their spirit.

    Hack for the user’s benefit.
    Trust them; leave them alone.

    小国寡民。使有什伯之器而不用;使民重死而不远徙。虽有舟舆,无所乘之,虽有甲兵,无所陈之。使民复结绳而用之,甘其食,美其服,安其居,乐其俗。邻国相望,鸡犬之声相闻,民至老死,不相往来。

    If a system is administered wisely,
    its users will be content.
    They enjoy hacking their code
    and don’t waste time implementing
    labor-saving shell scripts.
    Since they dearly love their accounts,
    they aren’t interested in other machines.
    There may be telnet, rlogin, and ftp,
    but these don’t access any hosts.
    There may be an arsenal of cracks and malware,
    but nobody ever uses them.
    People enjoy reading their mail,
    take pleasure in being with their newsgroups,
    spend weekends working at their terminals,
    delight in the doings at the site.
    And even though the next system is so close
    that users can hear its key clicks and biff beeps,
    they are content to die of old age
    without ever having gone to see it.

    原作者:Jeffrey Sorensen (rec.humor.funny.archives)

     
  • jinzihao pm10:42 on 2016年7月10日 链接地址 | 回复  

    CISCNCTF 随记(1)  

    曼彻斯特编码:二进制的0编码为10,二进制的1编码为01(1和0也可以反过来),如果一个二进制串中只有01和10可以考虑曼彻斯特编码

    二进制串里如果包含char或者int,有可能从前往后看,也可能是每一个单元(char就是1 byte,int就是4 byte)从后向前看,在pwn类型的题中也有类似的问题。

    python的hex函数10->16,int函数any->10,bin函数10->2;字符串逆序在后面加[::-1]。

    Word有隐藏文字的功能,可以在选项里打开显示隐藏文字的功能。也有可能出现白底白字导致看不到的情况,如果不放心就直接把docx当做zip解包,打开Word的源文件看看有没有遗漏。

    TrueCrypt和PGPDesktop都可以加密文件,TrueCrypt用一个字符串或者用一个文件做密码,PGPDesktop用公钥私钥来解密,私钥也可以要求密码。Linux下的GnuPG与之兼容。(有待尝试)

    摩尔斯电码听不清的话拿Audacity的频谱模式看一看。

    别忘了栅格密码,13572468可以写成第一行1357第二行2468,然后一列一列看就是12345678。

    tesseract识别验证码效果不错,也有一个并不难上手的Python接口pytesseract。(进一步提高识别率有待尝试)

    Python用requests模块发送http请求,功能大体相当于curl。

    vim有备份文件和交换文件,如果编辑的文件是index.php,备份文件在index.php~,交换文件在.index.php.swp,如果再次意外退出就生成.index.php.swo,接着是.index.php.swn,.index.php.swm,……。swp没有的话swo还要试一试。

    PHP判断浮点数相等时有精度问题,PHP认为0.99999999999999999999和1是相等的。另外MySQL和PHP在浮点数判等时精度有差别,也可能会有利用的机会。

    shell脚本中如果不让用空格,用$IFS环境变量可以产生空格;如果不知道当前目录,也不允许用`pwd`的话,用$PWD环境变量效果一样。

    SQL注入不止会发生在GET和POST参数上,http header里面也可能有注入,cookie也有可能,只要能作为用户输入的东西都可能有注入。

    Access数据库有DLookup函数,用在UPDATE型注入时可以很方便地起到内联SELECT的效果,解决了Access不能直接在UPDATE的SET部分内联SELECT的问题。

     

     
c
写新的
j
下一篇文章/下一个回复
k
前一篇文章/以前的回复
r
回复
e
编辑
o
显示/隐藏 回复
t
回到顶部
l
go to login
h
show/hide help
shift + esc
取消