ํฌ์ŠคํŒ… ์ธ๋„ค์ผ ์ด๋ฏธ์ง€

War Games/Lord of SQLInjection

[LOS] Level15: succubus

Lord Of SQLInjection: lv.15 succubus succubus์ž…๋‹ˆ๋‹ค. ์ด ๋ฌธ์ œ๋Š” ๋‘˜๋‹ค ์‹ฑ๊ธ€์ฟผ๋ฆฌ๋ฅผ ๋ง‰๊ณ ์žˆ๊ณ , id์˜ ๊ฐ’๋งŒ ์žˆ์œผ๋ฉด ํ’€๋ฆฝ๋‹ˆ๋‹ค. ํ‰์†Œ๊ฐ™์ด sql injection์„ ํ•˜๋ฉด ๋˜๊ฒ ์ง€๋งŒ, ์‹ฑ๊ธ€์ฟผ๋ฆฌ๋ฅผ ์–ด๋–ป๊ฒŒ ํ•ด๊ฒฐํ•ด์ฃผ๋ฉด ์ข‹์„๊นŒ์š”? preg_match๋ฌธ์„ ์ฃผ์˜๊นŠ๊ฒŒ ๋ด…์‹œ๋‹ค. if(preg_match('/\'/',$_GET[id])) exit("HeHe"); ๋ณด๋ฉด ์‹ฑ๊ธ€์ฟผ๋ฆฌ ์•ž์— \๊ฐ€ ๋ถ™์–ด์žˆ์ฃ ? (์ฝ”๋“œ๋ธ”๋Ÿญ ์•ˆ์— ๋“ค์–ด์žˆ์–ด์„œ / ์ขŒ์šฐ๋Œ๋ฆผํ•œ๊ฒƒ์ฒ˜๋Ÿผ ๋ณด์ด๋„ค์š”) \๋Š” ๋งŽ์€ ์–ธ์–ด ์•ˆ์—์„œ "๋ฌธ์ž์—ด ์ž์ฒด"๋กœ ์ธ์‹๋˜๊ฒŒ๋” ํ•ฉ๋‹ˆ๋‹ค. ๊ทธ๋ƒฅ ์‹ฑ๊ธ€์ฟผ๋ฆฌ๋ฅผ ๋„ฃ์œผ๋ฉด ์ด๊ฒŒ ๋ฌธ์ž์—ด ์ž‘์€๋”ฐ์˜ดํ‘œ๋กœ ์“ฐ๊ณ ์‹ถ์—ˆ๋Š”์ง€, ์ฟผ๋ฆฌ๋ฅผ ๋‚˜๋ˆ ์ฃผ๋Š” ์‹ฑ๊ธ€์ฟผ๋ฆฌ์ธ์ง€ ๊ตฌ๋ถ„ํ•˜์ง€ ๋ชปํ•˜๊ธฐ ๋•Œ๋ฌธ์— \๋ฅผ ์•ž์— ์ž…๋ ฅํ•˜๋ฉด ๋’ค์— ์žˆ๋Š” ์‹ฑ๊ธ€์ฟผ๋ฆฌ๋ฅผ ๋ฌธ์ž์—ด๋กœ ์ธ์‹ํ•ฉ๋‹ˆ๋‹ค. ์ด๋ฅผ ์ด..

2020.01.13 ๊ฒŒ์‹œ๋จ

 ํฌ์ŠคํŒ… ์ธ๋„ค์ผ ์ด๋ฏธ์ง€

War Games/Lord of SQLInjection

[LOS] Level4: orc

Lord Of SQLInjection: lv.4 orc orc์ž…๋‹ˆ๋‹ค. pw๋ฅผ ์ž…๋ ฅ๋ฐ›์•„์„œ admin์˜ ๋น„๋ฐ€๋ฒˆํ˜ธ์™€ ๊ฐ™์€์ง€ ๋น„๊ตํ•ด ๋ฌธ์ œ๋ฅผ ํ‘ธ๋Š” ๋ฐฉ์‹์˜ los๋„ค์š”. ์ด ๊ฒฝ์šฐ์—๋Š” ์ „์ˆ˜์กฐ์‚ฌ๋ฅผ ํ†ตํ•ด ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ํ•œ๊ธ€์ž์”ฉ ์•Œ์•„๋‚ด์•ผํ•˜๋Š”๋ฐ, ์ €๋Š” python์ฝ”๋”ฉ์„ ์ด์šฉํ–ˆ์Šต๋‹ˆ๋‹ค.(ver.2.7.15๊ธฐ์ค€) import httplib headers = {'Content-Type':'application/x-www-form-urlencoded', 'Cookie':'PHPSESSID=h8vk5n8gafml7kmsgv87809itt'} conn = httplib.HTTPSConnection('los.rubiya.kr', 443) pw = '' for i in range(10): for j in range(32, 127): conn.r..

2020.01.01 ๊ฒŒ์‹œ๋จ

 ํฌ์ŠคํŒ… ์ธ๋„ค์ผ ์ด๋ฏธ์ง€

War Games/Lord of SQLInjection

[LOS] Level1: gremlin

Lord Of SQLInjection LOS์‹œ์ž‘! ์ €๊ธฐ enter to the dungeon ํด๋ฆญํ•˜๋ฉด ์ฒ˜์Œ์ด๋ฉด join, or loginํ•ฉ์‹œ๋‹ค ์šฐ์„  ์ฒซ๋ฒˆ์งธ ๋‹จ๊ณ„์ธ gremlin๋‹จ๊ณ„์— ๋“ค์–ด๊ฐ€๋ฉด ๋‹ค์Œ๊ณผ ๊ฐ™์€ ํŽ˜์ด์ง€๊ฐ€ ๋œน๋‹ˆ๋‹ค.

2019.12.30 ๊ฒŒ์‹œ๋จ