HTTP 01

发送一个GET 到 /pentesterlab

HTTP 02

In this challenge, your goal is to send a GET request to /pentesterlabwith the following GET parameter: key with the value please

HTTP 03 In this challenge your goal is to send a GET request to /pentesterlab with the following cookie: key with the value please

HTTP 04

In this challenge your goal is to send a GET request to /pentesterlab with the Content-Type set to key/please

HTTP 05

In this challenge your goal is to send a GET request to /pentesterlab with Accept-Language set to key-please

HTTP 06

In this challenge your goal is to send a POST request to /pentesterlab with the following POST parameter: key with the value please

HTTP 07

In this challenge your goal is to send a POST request to /pentesterlab with an empty body

HTTP 08

In this challenge, your goal is to send a GET request to /pentesterlab with the following POST parameter: key with the value please

注意代理的问题，代理对于这种GET的post参数不一定转发

HTTP 09

In this challenge your goal is to send a GET request to /pentesterlab with the following GET parameter key twice. Both with the value please

HTTP 10

In this challenge your goal is to send a POST request to /pentesterlab with the following POST parameter key twice. Both with the value please

HTTP 11

In this challenge your goal is to send a POST request to /pentesterlab with the following GET parameter key with the value please and the following POST parameter key with the value please

HTTP 12

In this challenge your goal is to send a GET request to /pentesterlab with the following GET parameter: key with the value =please

HTTP 13

In this challenge, your goal is to send a GET request to /pentesterlab with the following GET parameter: key with the value please&

HTTP 14

In this challenge your goal is to send a GET request to /pentesterlab with the following GET parameter: ?key with the value please

HTTP 15

In this challenge your goal is to send a GET request to /pentesterlab with the following GET parameter: key with the value pretty please

postman其实把这个URL编码的事情帮你做了，其实正确的URL是

HTTP 16

In this challenge your goal is to send a GET request to /pentesterlab with the following GET parameter: key with the value please#

HTTP 17

In this challenge your goal is to send a GET request to /pentesterlab with the following GET parameter: key with the value please followed by a NULL Byte

空字符是%00

HTTP 18

In this challenge your goal is to send a GET request to /pentesterlab with the following GET parameter: key with the value please followed by a double-encoded NULL Byte

这个 double-encoded null byte 是 %2500

HTTP 19

In this challenge, your goal is to send a GET request to /pentesterlab with the following GET parameter: key as an array with the first element with the value key and the second element with the value please

HTTP 20

In this challenge your goal is to send a GET request to /pentesterlab with the following GET parameter: key as a hash/dictionnary with the key please set to 1

HTTP 21

In this challenge, your goal is to send a request with the method HACK to /pentesterlab

(base) [~] curl —location —request HACK ‘http://ptl-126175c2-2a7cba61.libcurl.so/pentesterlab’ \ 15:46:03 —header ‘Authorization: Basic ZWxhc3RpYzplbGFzdGlj’ The key for this challenge is: a70e893c-dbf4-45f5-a88c-27c260bf8ae4

这次postman不能自定义方法

HTTP 22

In this challenge, your goal is to send a request with the header X-HTTP-Method-Override set to HACK to /pentesterlab

HTTP 23

In this challenge, your goal is to send a request with the header X-Forwarded-For set to 1.2.3.4 to /pentesterlab

HTTP 24

In this challenge, your goal is to send a request with the header X-Forwarded-Host set to pentesterlab.com to /pentesterlab

HTTP 25

In this challenge, your goal is to send a request to /pentesterlab/../pentesterlab

HTTP 26

In this challenge, your goal is to send a request to /pentesterlab;pentesterlab

URL需要编码

HTTP 27

In this challenge, your goal is to send a request to /pentesterlab#pentesterlab

HTTP 28

In this challenge, your goal is to send a request to /pentesterlab using HTTP multipart.

HTTP 29

In this challenge, your goal is to send a request to /pentesterlab using HTTP multipart with a file (at least one byte in size) using the parameter name: filename.

HTTP 30

In this challenge, your goal is to send a request to /pentesterlab using HTTP multipart with a file using the parameter name: filename. The filename must contain a directory traversal (../).

curl —location —request POST ‘http://ptl-23318c2a-ece20ff5.libcurl.so/pentesterlab’ -F “filename=@test.txt;filename=../test.txt” The key for this challenge is: e04b0586-379c-4f0f-bab6-840127c4d4bc

这个题不能用postman做，主要是postman不支持文件名的重复

HTTP 31

In this challenge, your goal is to send a POST request to /pentesterlab with the body of the request containing: please.

We recommend you to solve this challenge with curl initially. Then you can write a snippet of code in your favourite language to solve it (this will allow you to create a collection of scripts you can re-use in the future)

HTTP 32

In this challenge, your goal is to send a POST request to /pentesterlab with the body of the request containing: please and the header Content-Type set to application/xml.

HTTP 33

In this challenge, your goal is to send a POST request to /pentesterlab with the body of the request containing the following XML: [VALUE] where [VALUE] should be replaced with >please. The request should also set the header Content-Type to application/xml.

HTTP 34

In this challenge, your goal is to send a POST request to /pentesterlab with the body of the request containing the following XML: [VALUE] where [VALUE] should be replaced with . The request should also set the header Content-Type to application/xml.

xml中的尖括号需要转义

HTTP 35

In this challenge, your goal is to send a POST request to /pentesterlab with the body of the request containing the following XML: [VALUE] where [VALUE] should be replaced with &please. The request should also set the header Content-Type to application/xml.

&也需要转义