BUUCTF，Web：[极客大挑战 2019]BuyFlag

attention

If you want to buy the FLAG:
You must be a student from CUIT!!!
You must be answer the correct password!!!

---

only Cuit's students can buy the FLAG

三个提示，买，用money=100000000，是个CUIT的学生，正确密码

源码

	~~~post money and password~~~

if (isset($_POST['password'])) 
{
	$password = $_POST['password'];
	if (is_numeric($password)) 
    {
		echo "password can't be number
";
	}
    elseif ($password == 404) 
    {
		echo "Password Right!
";
	}
}

弱比较

password=404a

这是密码

抓包 post 仍然没有反应，第二个提示没用，学生能对应的只能是 cookie 的 user

 改为 1

三个条件满足了两个，money 参数太长

使用科学计数法得到 flag，运算不可用 

 flag{baf3e10e-319b-4315-a300-09be81b69856}