Last active
December 23, 2018 07:31
-
-
Save sonickun/3fd567044b4c2976a407d0901589af2b to your computer and use it in GitHub Desktop.
SECCON2018国内決勝でDefense Keyをヘッドレスブラウザで自動で取ってきてPOSTするやつ
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# coding: UTF-8 | |
from bs4 import BeautifulSoup | |
from selenium import webdriver | |
from selenium.webdriver.chrome.options import Options | |
from selenium.webdriver.support.ui import WebDriverWait | |
from selenium.webdriver.support import expected_conditions as EC | |
from selenium.webdriver.common.by import By | |
def get_key(): | |
options = Options() | |
options.set_headless(True) | |
# Seleniumでchromeを起動 | |
driver = webdriver.Chrome(executable_path='/home/sonickun/ctf/chromedriver', chrome_options=options) | |
driver.get("http://score.ja.seccon/") | |
driver.add_cookie({ | |
'name': 'PHPSESSID', | |
'value': '40eaa2ab50ed57dab7562d0db7a5f01388b65f86', | |
'domain': 'score.ja.seccon'}) | |
driver.add_cookie({ | |
'name': 'io', | |
'value': 'VT4d8XHUst8B9-EoAAtZ', | |
'domain': 'score.ja.seccon'}) | |
# JavaScriptによるレンダリングを待機 | |
driver.get("http://score.ja.seccon/flagwords/") | |
element = WebDriverWait(driver, 10).until( | |
EC.presence_of_element_located((By.CLASS_NAME, "myteam")) | |
) | |
html = driver.page_source.encode('utf-8') | |
# BSで読み込み | |
soup = BeautifulSoup(html, "html.parser") | |
# 自チームのDefense keyを抽出 | |
out = soup.find(id="flagword_table") | |
l = str(out).split('"myteam"><th>katagaitai</th><td>')[1] | |
key = l.split("<")[0] | |
return key | |
import time | |
import requests | |
while True: | |
key = get_key() | |
print key | |
# 問題サーバへDefense keyをPOST | |
url1 = "http://matsushima.pwn.ja.seccon/MarinaBaySandsNo1Fhaimakaisoutyudayo" | |
payload = {"defense_flag": key, "submit":"%E9%80%81%E4%BF%A1"} | |
r = requests.post(url1, data=payload) | |
print "Post Done" | |
time.sleep(300) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment