SlowTurtle

SlowTurtle_

천천히 그러나 끝까지 완주

728x90

Webhacking-Write-Up/Dreamhack 39

[Dreamhack] CSS Injection 코드가 너무 길어서 하나 하나 필요한 부분만 첨가하기로 했다. 우선 로그인하는 부분만 보면 guest로 하고싶은 욕구를 참지 못하고 guest : guest로 가입했다. guest로 로그인 후 메인 페이지를보니 Private memo Service라는 문구를 보니 id마다 memo를 별개로 하겠구나 라는 생각이 들었고 그럼 flag는 admin으로 로그인한 memo에 있겠구나 생각했다. # Add FLAG execute( 'INSERT INTO memo (uid, text)' 'VALUES (:uid, :text);', { 'uid': adminUid[0][0], 'text': 'FLAG is ' + FLAG } ) 이 코드를 보면 uid, text 그러니까..

Webhacking-Write-Up/Dreamhack 2023.01.10

[Dreamhack] Client Side Template Injection

[Dreamhack] Client Side Template Injection 우선 코드를 보자. #!/usr/bin/python3 from flask import Flask, request, render_template from selenium import webdriver import urllib import os app = Flask(__name__) app.secret_key = os.urandom(32) nonce = os.urandom(16).hex() try: FLAG = open("./flag.txt", "r").read() except: FLAG = "[**FLAG**]" def read_url(url, cookie={"name": "name", "value": "value"}): cook..

Webhacking-Write-Up/Dreamhack 2023.01.10

[Dreamhack] CSRF Advanced

[Dreamhack] CSRF Advanced 우선 코드를 보자! #!/usr/bin/python3 from flask import Flask, request, render_template, make_response, redirect, url_for from selenium.webdriver.common.by import By from selenium import webdriver from hashlib import md5 import urllib import os app = Flask(__name__) app.secret_key = os.urandom(32) try: FLAG = open("./flag.txt", "r").read() except: FLAG = "[**FLAG**]" users = { ..

Webhacking-Write-Up/Dreamhack 2023.01.10

[Dreamhack] CSP Bypass Advanced

[Dreamhack] CSP Bypass Advanced 코드를 먼저 보자. #!/usr/bin/python3 from flask import Flask, request, render_template from selenium import webdriver import urllib import os app = Flask(__name__) app.secret_key = os.urandom(32) nonce = os.urandom(16).hex() try: FLAG = open("./flag.txt", "r").read() except: FLAG = "[**FLAG**]" def read_url(url, cookie={"name": "name", "value": "value"}): cookie.update({..

Webhacking-Write-Up/Dreamhack 2023.01.10

[Dreamhack] CSP Bypass

[Dreamhack] CSP Bypass 우선 코드를 보자. #!/usr/bin/python3 from flask import Flask, request, render_template from selenium import webdriver import urllib import os app = Flask(__name__) app.secret_key = os.urandom(32) nonce = os.urandom(16).hex() try: FLAG = open("./flag.txt", "r").read() except: FLAG = "[**FLAG**]" def read_url(url, cookie={"name": "name", "value": "value"}): cookie.update({"domain":..

Webhacking-Write-Up/Dreamhack 2023.01.10

[Dreamhack] XSS Filtering Bypass Advanced

[Dreamhack] XSS Filtering Bypass Advanced 코드를 먼저 확인하였다. #!/usr/bin/python3 from flask import Flask, request, render_template from selenium import webdriver import urllib import os app = Flask(__name__) app.secret_key = os.urandom(32) try: FLAG = open("./flag.txt", "r").read() except: FLAG = "[**FLAG**]" def read_url(url, cookie={"name": "name", "value": "value"}): cookie.update({"domain": "127.0..