fakebook

stm的fakebook，乍一看还以为是facebook，果然fake

看题

有登录和注册两个功能点

看了下robots.txt，发现有备份文件

果断下载，内容如下

这里的blog在注册页面要用到，先审计一下

<?php

class UserInfo

{

    public $name = "";

    public $age = 0;

    public $blog = "";

    public function __construct($name, $age, $blog)

    {

        $this->name = $name;

        $this->age = (int)$age;

        $this->blog = $blog;

    }

    function get($url)

    {

        $ch = curl_init(); // 初始化curl的session

        curl_setopt($ch, CURLOPT_URL, $url); // 设置要获取的url

        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); // 把输出转换为string

        $output = curl_exec($ch); // 执行curl session

        $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE); // 获取http状态码

        if($httpCode == 404) {

            return 404;

        }

        curl_close($ch); // 关闭 session

        return $output; // 返回结果

    }

    public function getBlogContents ()

    {

        return $this->get($this->blog); // 调用get函数

    }

    public function isValidBlog () // 判断blog格式是否正确

    {

        $blog = $this->blog;

        return preg_match("/^(((http(s?))\:\/\/)?)([0-9a-zA-Z\-]+\.)+[a-zA-Z]{2,6}(\:[0-9]+)?(\/\S*)?$/i", $blog);

    }

}