Webhackingkr Pro Hot <VALIDATED>

"PRO" challenge Webhacking.kr is a high-difficulty task (valued at 400 points) that involves bypassing advanced administrative filters and security configurations. It typically requires a deep understanding of PHP-based filtering session management WAF (Web Application Firewall) bypass techniques. Challenge Overview Challenge Name Core Concepts : PHP filter bypass, admin authentication, WAF evasion. Analysis & Methodology

The challenge presents a portal where administrative access is required to retrieve the flag. Directly attempting to login as

is usually blocked by a script that filters specific keywords. 1. Identifying the Filter Typically, the application uses functions like preg_match()

or custom blacklists to prevent the use of the word "admin" in GET or POST parameters. Common PHP Filter (preg_match( Use code with caution. Copied to clipboard 2. Bypassing with Double URL Encoding If the script utilizes urldecode()

the filter check, you can bypass it using double URL encoding. Single Encode right arrow %61%64%6d%69%6e (often still caught by the filter). Double Encode . The string %2561%2564%256d%2569%256e

: The browser automatically decodes the first layer (sending webhackingkr pro hot

to the server), which passes the filter because it doesn't literally say "admin." The PHP urldecode() then converts , granting access. 3. Advanced Session & Cookie Manipulation

Higher-tier challenges like "PRO" often involve more than simple keyword filters. Remote Address Replacement : Some challenges check your IP against . If the script extracts values from , you can sometimes overwrite internal variables like $REMOTE_ADDR via a custom cookie. WAF Evasion

: Using specialized tools or manual payload crafting to find inconsistencies between how a WAF and the back-end PHP interpreter parse URLs. Final Execution To solve this type of challenge: Webhacking.kr write-up: old-26 - Planet DesKel

---

4. Example Methodology for a Blind SQLi (Common in Pro Hot)

If you find a parameter that behaves differently with ' and '':

1. Confirm injection with time‑based (if sleep is blocked):
   • Try BENCHMARK(1000000,MD5('a')) (MySQL)
   • Or heavy Cartesian joins: (SELECT count(*) FROM information_schema.columns A, information_schema.columns B)
2. Extract data bit by bit using binary search with conditional delays:

   ' OR IF(ASCII(SUBSTR((SELECT flag FROM flag_table),1,1)) > 64, BENCHMARK(5000000,MD5('x')), 0) -- -
   

3. Automate with Python script sending requests with timeout detection.

Pro tip: Use --technique=T in SQLmap only after manual confirmation, then study its payloads. "PRO" challenge Webhacking

---

Step 4: Exploit Code

You can solve this easily using the browser's Developer Console (F12 -> Console).

1. Copy the Target String from the page source. Let's say the target string in the code is "ABCDE...".
2. Determine the offset. Look at the loop in the source code.
   • Example: String.fromCharCode(user_input.charCodeAt(i) + 2) implies the offset is +2.
   • Therefore, we need to subtract 2 from the target string's codes.

Run this script in your console:

// 1. Paste the target string found in the source code here:
var target = "PASTE_TARGET_STRING_HERE";
// 2. Set the offset found in the loop (e.g., if code is +4, put -4)
var offset = -1; // Adjust this value based on the specific challenge logic
var solution = "";
for (var i = 0; i < target.length; i++) 
// Reverse the operation
solution += String.fromCharCode(target.charCodeAt(i) + offset);

console.log("The password is: " + solution);
 Confirm injection with time‑based (if  sleep  is blocked):

5. Bypassing Common Filters (Pro Hot Level)

• Spaces → /**/, %09, %0a, %0c, %0d, parentheses
• or/and → ||, &&, xor, ^
• = → like, in, <>, regexp
• sleep → heavy queries, WAITFOR DELAY (MSSQL), pg_sleep (PostgreSQL), recursive CTEs
• select/union → case variation, double encoding, SeLecT (if no case‑sensitive check), or use JSON functions

---

Exploitation Strategy

2. Read the source – even if it’s not given

Some Pro challenges don’t show source code directly. But you can often leak it via:

• view-source:
• phps extension
• Backup files (~, .bak, .swp)
• LFI leading to php://filter

Why "WebHackingKR Pro Hot" Matters for Your Career

Recruiters from top Korean tech companies (Kakao, Naver, Samsung SDS) often look at WebHackingKR rankings. While having a high overall rank is good, being able to articulate a solution to a "Pro Hot" challenge during an interview is gold.

It demonstrates:

1. Persistence: You didn't give up after 2 hours.
2. Creative Thinking: You bypassed a restriction the developer thought was impossible.
3. Tooling Ability: You likely had to write a custom Python or Go script to solve a blind injection race condition.