<html> <head> <!-- This stuff in the header has nothing to do with the level --> <link rel="stylesheet" type="text/css" href="http://natas.labs.overthewire.org/css/level.css"> <link rel="stylesheet" href="http://natas.labs.overthewire.org/css/jquery-ui.css" /> <link rel="stylesheet" href="http://natas.labs.overthewire.org/css/wechall.css" /> <script src="http://natas.labs.overthewire.org/js/jquery-1.9.1.js"></script> <script src="http://natas.labs.overthewire.org/js/jquery-ui.js"></script> <script src=http://natas.labs.overthewire.org/js/wechall-data.js></script><script src="http://natas.labs.overthewire.org/js/wechall.js"></script> <script>var wechallinfo = { "level": "natas17", "pass": "<censored>" };</script></head> <body> <h1>natas17</h1> <div id="content"> <? /* CREATE TABLE `users` ( `username` varchar(64) DEFAULT NULL, `password` varchar(64) DEFAULT NULL ); */ if(array_key_exists("username", $_REQUEST)) { $link = mysql_connect('localhost', 'natas17', '<censored>'); mysql_select_db('natas17', $link); $query = "SELECT * from users where username=\"".$_REQUEST["username"]."\""; if(array_key_exists("debug", $_GET)) { echo "Executing query: $query<br>"; } $res = mysql_query($query, $link); if($res) { if(mysql_num_rows($res) > 0) { //echo "This user exists.<br>"; } else { //echo "This user doesn't exist.<br>"; } } else { //echo "Error in query.<br>"; } mysql_close($link); } else { ?> <form action="index.php" method="POST"> Username: <input name="username"><br> <input type="submit" value="Check existence" /> </form> <? } ?> <div id="viewsource"><a href="index-source.html">View sourcecode</a></div> </div> </body> </html>
이번 소스를 보니 이전에 풀었던 Blind SQLi네요.
그런데 다른 점이 하나 있다면 참/거짓을 판별해주는 echo문이 주석 처리 됬다는 점입니다.
따라서 response 값의 차이로는 판별하기 힘들 것 같으니 time based blind SQLi로 풀면 될 것 같습니다.
중간에 타임 꼬여서 한번 더돌림..
'Wargame > Natas:OverTheWire' 카테고리의 다른 글
| [Natas] Level19 (0) | 2016.10.24 |
|---|---|
| [Natas] Level18 (0) | 2016.10.24 |
| [Natas] Level16 (0) | 2016.10.23 |
| [Natas] Level15 (0) | 2016.10.23 |
| [Natas] Level14 (0) | 2016.10.23 |
