XSS Challenges 4

์ „ ๋‹จ๊ณ„์—์„œ ์‚ฌ์šฉํ•œ ๊ณต๋ฐฑ ์น˜ํ™˜ ๊ตฌ๋ฌธ์„ ์‚ฝ์ž…ํ•ด๋ณธ ๊ฒฐ๊ณผ ์„ฑ๊ณต์ ์œผ๋กœ ์‹คํ–‰๋˜์ง€ ์•Š๊ณ  ์žˆ์Šต๋‹ˆ๋‹ค. ์–ด๋– ํ•œ ๊ตฌ๋ฌธ์„ ๊ฒ€์ฆํ•˜๊ณ  ์žˆ๋Š”์ง€ ์†Œ์Šค๋ฅผ ํ†ตํ•ด ํ™•์ธํ•ด ๋ณธ ๊ฒฐ๊ณผ "()(๊ด„ํ˜ธ)"์™€ ํŒ์—…์ฐฝ์„ ๋„์›Œ์ฃผ๋Š” "alert"๊ฐ€ ํ•„ํ„ฐ๋ง๋˜๊ณ  ์žˆ์Šต๋‹ˆ๋‹ค. ๊ด„ํ˜ธ์˜ ๊ฒฝ์šฐ ์ œ๊ฑฐ๋ฅผ ํ•˜๊ณ  ์žˆ์œผ๋ฉฐ alert๋Š” -> Alert๋กœ ๋ณ€๊ฒฝ์‹œํ‚ด์œผ๋กœ์จ ์˜๋ฏธ ์—†๋Š” ๊ตฌ๋ฌธ์„ ๋งŒ๋“ค๊ณ  ์žˆ์Šต๋‹ˆ๋‹ค. ๊ด„ํ˜ธ ์ œ๊ฑฐ์˜ ์ฝ”๋“œ๋ฅผ ์šฐํšŒํ•  ์ˆ˜ ์žˆ๋Š” ๋ฐฉ๋ฒ•์€ ` --> "back-tick" ๋ฐฑํ‹ฑ์„ ์‚ฌ์šฉํ•ด์ฃผ์‹œ๋ฉด ๋ฉ๋‹ˆ๋‹ค. ๋˜ํ•œ alert๋ฅผ ํ˜ผ๋ˆ์‹œํ‚ค๊ณ  ์žˆ๊ธฐ ๋•Œ๋ฌธ์— ์ด๋ฒˆ ๋ฌธ์ œ์—๋Š” "confirm"์ด๋‚˜ "prompt"๋กœ ๋ณ€๊ฒฝํ•˜์—ฌ ์‚ฌ์šฉํ•ด์ฃผ์‹œ๋ฉด ๋ฉ๋‹ˆ๋‹ค. ์„ฑ๊ณตํ›„ ํŽ˜์ด์ง€ ์†Œ์Šค๋ฅผ ํ™•์ธํ•ด๋ณด์‹œ๋ฉด ๊ฒ€์ฆํ•˜๋Š” alert ๋Œ€์‹  confirm์œผ๋กœ ๋Œ€์ฒดํ•˜๊ณ  ๊ด„ํ˜ธ๋ฅผ ๋Œ€์‹ ํ•œ ๋ฐฑ ํ‹ฑ์œผ๋กœ ๊ตฌ๋ถ„์„ ํ•ด์คฌ๊ธฐ ๋•Œ๋ฌธ์— ํŒ์—…์ฐฝ ์„ฑ๊ณต์ ์œผ๋กœ ..

CHALLENGE
[LOS] Golem ํ’€์ด(11)

11๋ฒˆ์งธ ๋ฌธ์ œ์ธ " golem " ๋ฌธ์ œ๋ฅผ ํ™•์ธํ•ด๋ณด๋ฉด 2๊ฐ€์ง€ ๊ฒ€์ฆ์ ˆ์ฐจ๋ฅผ ๊ฑฐ์น˜๊ณ  ์žˆ์Šต๋‹ˆ๋‹ค. if(preg_match('/prob|_|\.|\(\)/i', $_GET [pw])) exit("No Hack ~_~"); if(preg_match('/or|and|substr\(|=/i', $_GET[pw])) exit("HeHe"); ๊ฒ€์ฆํ•˜๊ณ  ์žˆ๋Š” ๋ฌธ๊ตฌ๋“ค์„ ํ™•์ธํ•ด๋ณด๋ฉด ์ฃผ๋กœ ์‚ฌ์šฉ๋˜๋Š” ์—ฐ์‚ฐ์ž์ธ " or, and, = " ๊ทธ๋ฆฌ๊ณ  ๋ฌธ์ž์—ด์„ ์ถœ๋ ฅํ•ด์ฃผ๋Š” ํ•จ์ˆ˜์ธ " substr " ๊นŒ์ง€ ๊ฒ€์ฆ์„ ํ•˜๊ณ  ์žˆ์Šต๋‹ˆ๋‹ค. ์ „ ๋‹จ๊ณ„์˜ ๋ ˆ๋ฒจ์—์„œ๋Š” or์™€ and ์—ฐ์‚ฐ์ž ๋Œ€์ฒด ๊ธฐ๋ฒ•์„ ์‚ฌ์šฉํ–ˆ์ง€๋งŒ substr ํ•จ์ˆ˜๊นŒ์ง€ ์šฐํšŒํ•ด์•ผ ๋˜๋‹ˆ ์ข€ ๋” ๊นŒ๋‹ค๋กœ์›Œ์กŒ๋‹ค๊ณ  ๋ณผ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. $query = "select pw from prob_golem where id..

CHALLENGE
[LOS] Vampire ํ’€์ด(9)

9๋ฒˆ์งธ ๋ฌธ์ œ์ธ " vampire " ๋‹จ๊ณ„์ž…๋‹ˆ๋‹ค. ์ฟผ๋ฆฌ๋ฌธ์„ ์ž…๋ ฅ๋ฐ›์•„ ์‹คํ–‰๋˜๋Š” ๋ณ€์ˆ˜๋Š” " id='{$_GET [id]} " ๋กœ ์ „์— ํ’€์—ˆ๋˜ ๋ฌธ์ œ๋“ค๊ณผ ์œ ์‚ฌํ•˜๊ฒŒ ํ‚ค์›Œ๋“œ ์šฐํšŒ๋ฅผ ํ•ด์•ผ ๋  ๊ฒƒ ๊ฐ™์•„ ๋ณด์ž…๋‹ˆ๋‹ค. $_GET [id] = str_replace("admin", "",$_GET [id]); replace ํ•จ์ˆ˜๋ฅผ ํ†ตํ•ด ์ฟผ๋ฆฌ๋ฌธ์— " admin " ์ด ํฌํ•จ๋˜์–ด ์žˆ๋Š” ๊ฒฝ์šฐ ์‹คํ–‰์ด ๋˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค. ๋˜ํ•œ ๋Œ€, ์†Œ ๋ฌธ์ž๋ฅผ ๊ตฌ๋ถ„ํ•˜์ง€ ์•Š๊ณ  ์žˆ๊ธฐ ๋•Œ๋ฌธ์— ADMIN ๊ฐ™์€ ๋Œ€๋ฌธ์ž๋กœ ์ ‘๊ทผํ•ด๋„ ์‹คํŒจํ•˜๊ธฐ ๋•Œ๋ฌธ์— ์ด๋Ÿด ๋•Œ๋Š” ํ˜ผ๋ˆํ™” ๊ธฐ๋ฒ•์„ ์‚ฌ์šฉํ•ด์„œ ํ•ด๊ฒฐํ•˜๋ฉด ๋ฉ๋‹ˆ๋‹ค. ๋ธ”๋ž™๋ฆฌ์ŠคํŠธ๋กœ ํ•ด๋‹น ํ‚ค์›Œ๋“œ๋ฅผ ๋Œ€์†Œ๋ฌธ์ž ๊ตฌ๋ถ„ ์—†์ด ์ œ๊ฑฐํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ์—๋Š” ์•„๋ž˜์™€ ๊ฐ™์€ ๋ฐฉ๋ฒ•์œผ๋กœ ๋ฌธ์ž์—ด ์‚ฌ์ด์— ์‚ฝ์ž…ํ•˜๋Š” ํ˜ผ๋™ํ™” ๊ธฐ๋ฒ•์„ ์ด์šฉํ•˜๊ฒŒ ๋˜๋ฉด ์ค‘๊ฐ„์— " admin " ํ‚ค์›Œ๋“œ๋Š”..

CHALLENGE
[LOS] Troll ํ’€์ด(8)

" troll " ๋ฌธ์ œ์˜ ๊ฒฝ์šฐ ์ฟผ๋ฆฌ๋ฌธ์„ ์‹คํ–‰์‹œ์ผœ์ฃผ๋Š” ๋ณ€์ˆ˜๊ฐ€ pw ๊ฐ€ ์•„๋‹Œ " id='{$_GET[id]} " ์ฆ‰ id ์ธ ๊ฒƒ์„ ํ™•์ธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ด๋ฒˆ ๋ฌธ์ œ๋Š” ํŒจ์Šค์›Œ๋“œ๋ฅผ ๋„์ถœ์‹œํ‚ค๋Š” ๊ฒƒ์ด ์•„๋‹Œ ํ•ด๋‹น ๊ณ„์ •์œผ๋กœ ๊ทธ๋ƒฅ ์ ‘๊ทผํ•˜๊ธฐ๋งŒ ํ•˜๋ฉด ๋  ๊ฒƒ ๊ฐ™์Šต๋‹ˆ๋‹ค. ํ•ด๋‹น ๋ฌธ์ œ๋Š” ํŠน์ • " ํ‚ค์›Œ๋“œ "๋ฅผ ๋ธ”๋ž™๋ฆฌ์ŠคํŠธ ๋ฐฉ์‹์œผ๋กœ ํ•„ํ„ฐ๋ง ์ •์ฑ…์„ ๊ฑธ์–ด๋‘๋ฉด ์–ด๋–ป๊ฒŒ ์ ‘๊ทผ์„ ์‹œ๋„ํ•ด ๋ณผ ๊ฒƒ์ธ๊ฐ€? ์— ๋Œ€ํ•œ ๊ณ ๋ฏผ์„ ํ•ด๋ณด๋Š” ๋ฌธ์ œ์˜€๋˜ ๊ฒƒ ๊ฐ™์Šต๋‹ˆ๋‹ค. ์‰ฝ๊ฒŒ ์ƒ๊ฐํ•˜๋ฉด ๊ต‰์žฅํžˆ ์‰ฌ์šด ๋ฌธ์ œ์ด๊ณ  ์–ด๋ ต๊ฒŒ ์ƒ๊ฐํ•˜๋ฉด ๋„ˆ๋ฌด ๋ฉ€๋ฆฌ ๋Œ์•„๊ฐˆ ์ˆ˜๋„ ์žˆ๋Š” ๋ฌธ์ œ์ž…๋‹ˆ๋‹ค. MYSQL ์€ ๊ธฐ๋ณธ์ ์œผ๋กœ ๋Œ€์†Œ๋ฌธ์ž ๊ตฌ๋ถ„์ด ์—†์–ด์„œ " admin " = " ADMIN "์ด๋‚˜ ๋˜‘๊ฐ™์€ ๊ฒฐ๊ณผ๋กœ ๋ฐ›์•„๋“ค์ด์ง€๋งŒ ์ƒ๋‹จ์˜ ์†Œ์Šค๋ฅผ ๋ณด์‹œ๋ฉด preg_match์— ์„ ์–ธ๋œ ์ฝ”๋“œ๊ฐ€ ๋ฌธ์ œ์ธ ๊ฒƒ์œผ๋กœ ํŒŒ์•…๋ฉ๋‹ˆ๋‹ค. /admin/..

CHALLENGE
[LOS] ORGE ํ’€์ด(7)

7๋ฒˆ์งธ ๋ฌธ์ œ์ธ " orge " ๋Š” ์ „์— ํ’€์—ˆ๋˜ " orc " ๋ฌธ์ œ์™€ ์œ ์‚ฌํ•ฉ๋‹ˆ๋‹ค. " pw='{$_GET [pw]} " ์•ˆ์— ์ฟผ๋ฆฌ๋ฌธ์„ ์‚ฝ์ž…ํ•˜์—ฌ ์‹คํ–‰๋˜๋Š” ํ˜•ํƒœ์ด์ง€๋งŒ ๋ช‡ ๊ฐ€์ง€ ๋‹ค๋ฅธ ์ ์ด ์กด์žฌํ•ฉ๋‹ˆ๋‹ค. ๊ฒ€์ฆ๊ตฌ๋ฌธ 1. ๊ธฐ์กด admin ๊ณ„์ • ์ด์™ธ์— guest ๊ณ„์ •์ด ์ถ”๊ฐ€์ ์œผ๋กœ ์กด์žฌํ•จ 2. or , and ์—ฐ์‚ฐ์ž๋ฅผ ์ถ”๊ฐ€์ ์œผ๋กœ ๊ฒ€์ฆํ•˜๊ณ  ์žˆ์Œ ๋ฌธ์ œ๋ฅผ ํ•ด๊ฒฐํ•˜๊ธฐ ์œ„ํ•œ ํฌ์ธํŠธ ๋ถ€๋ถ„์€ $query = "select pw from prob_orge where id='admin' and pw='{$_GET [pw]}'"; if(($result ['pw']) && ($result['pw'] == $_GET ['pw'])) solve("orge"); ์œ„์ฒ˜๋Ÿผ 'admin' ๊ณ„์ •์œผ๋กœ ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๋„๋ก ์ถ”๊ฐ€์ ์œผ๋กœ ์„ ์–ธํ•ด์ค˜์•ผ ํ•˜๋ฉฐ, ์ž…๋ ฅ๋œ p..

CHALLENGE