Written for my CSAW Red 2018 Clicker Write-up

Clicker-PartE.py

import requests as rq
import json
url = "http://web.chal.csaw.io:10106/"

def register(userpass):
	global auth
	if len(userpass) < 8:
		return "Please enter at least 8 characters."
	details = {
		"username":userpass,
		"password":userpass,
	}
	req = rq.post(url+"/user/register", json=details)
	if req.json()['status'] == "error":
		return "Username already taken."

	auth = {'Authorization':req.json()['Authorization']}
	uuid = req.json()['uuid']
	return "Logged in as "+userpass+"."

def login(userpass):
	global auth
	details = {
		"username":userpass,
		"password":userpass
	}
	req = rq.post(url+"/user/login", json=details)
	if req.json()['status'] == "error":
		return "Account does not exist/Password invalid."
	auth = {'Authorization':req.json()['Authorization']}
	return "Logged in as "+userpass+"."

def purchase(clicker):
	global auth
	data={'name':clicker}
	req = rq.post("http://web.chal.csaw.io:10106/clicker/purchase", headers=auth, json=data)
	if req.json()['status'] == "success":
		return "Success!"
	else:
		return "Error."

def click(clicker):
	global auth
	data={'name':clicker}
	req = rq.post("http://web.chal.csaw.io:10106/clicker/click", headers=auth, json=data)
	if req.json()['status'] == "success":
		return "Success!"
	elif req.json()['message'] == "Clicker not owned":
		return "Clicker not owned."
	else:
		return "Clicker does not exist."

def stats():
	global auth
	userinfo = rq.get("http://web.chal.csaw.io:10106/user", headers=auth).json()
	userclickers = json.loads(rq.get("http://web.chal.csaw.io:10106/clicker/user", headers=auth).json().replace("'",'"'))
	print("##########\nStats for "+userinfo['username']+":")
	print("##########")
	print("Money: "+str(userinfo['money']))
	#print(userclickers)
	print("##########\nClicker Name | Clicker Value | Clicker Price\n"+("----------"*5))
	for count, i in enumerate(userclickers):
		print(i['name']+" | "+str(i['value'])+" | "+str(i['price']))
	print(("----------"*5))