들어가기전에
Bilnd SQL injection을 먼저 알고 가자
Lord of SQL injection – orc
Level 04
Source Code
<?php
include "../config.php";
login_chk();
dbconnect();
if(preg_match('/prob|_|\.|\(\)/i', $_GET[pw])) exit("No Hack ~_~");
$query = "select id from prob_orc where id='admin' and pw='{$_GET[pw]}'";
echo "<hr>query : <strong>{$query}</strong><hr><br>";
$result = @mysql_fetch_array(mysql_query($query));
if($result['id']) echo "<h2>Hello admin</h2>";
$_GET[pw] = addslashes($_GET[pw]);
$query = "select pw from prob_orc where id='admin' and pw='{$_GET[pw]}'";
$result = @mysql_fetch_array(mysql_query($query));
if(($result['pw']) && ($result['pw'] == $_GET['pw'])) solve("orc");
highlight_file(__FILE__);
?>Analyse
http://los.sandbox.cash/orc-~~.php?pw=123 이라고 입력하게 되면
select id from prob_orc where id='admin' and pw='123' 과 같이 MySQL 쿼리문이 입력된 뒤에
만약 쿼리가 참이라면 “Hello admin”을 띄워준다.
그리고 &result['pw']에 반드시 admin의 password가 들어가야 orc 문제가 풀린다.
Frist Hint is next page