Python Challenge! 17 COOKIES
If you would like to support me, please like, comment & subscribe, and check me out on Patreon: https://patreon.com/johnhammond010
E-mail: johnhammond010@gmail.com
PayPal: http://paypal.me/johnhammond010
GitHub: https://github.com/JohnHammond
Site: http://www.johnhammond.org
Twitter: https://twitter.com/_johnhammond
What You'll Learn
Completes Python Challenge 17 COOKIES, focusing on cybersecurity concepts
Full Transcript
hey how's it going everybody my name is John Hammond welcome back to another Python Challenge video um I'm looking at challenge 17 now and we are presented with this image of cookies um I can only assume this challenge has to do with cookies and uh web browsing cookie stuff like that so let's start to poke at it um I'm just going to assume that there it's probably this page has probably set a cookie for us um although I see this picture of uh another challenge we had before that was that was uh level four I think and I honestly don't remember which one that was I'm just going to look for totally Python Challenge you guys don't look at my YouTube don't look at my YouTube page all right uh what was it oh follow the chain 0404 yeah okay it was this one um and that link is PC def link list okay I'm gonna keep that open just in case we need it but first I want to poke at this page to see if this is the one that actually sets the cookie for us so I'm going to create a new file I'll put it in a new folder for level 17 of Python Challenge and I'll just call this solved up high you can name whatever you want and I will add my shebang line as usual and I'm going to use request to play with this web page so I'll steal that URL paste it there and response can be requests.get URL and I can print the response just to see if we get anything response with an S and 401 what is that oh we don't author I didn't I didn't actually authorize my bad um I remember later on in the challenges you do have to supply like I think it was huge after after the inflate this B challenge you have to supply huge n file to be able toess this stuff off equals o I'll just pass in that Tuple there now we should okay we do get a response it is response 200 cool so we get a response so we have our whole page since we can read that response let's see if there are any cookies there and there are nothing so let's try that uh level four one the link list.php let's try it was it PC PC def yep def linked list.php and we don't need to authorize for that one so I won't I'll just actually just remove that line that was before the inflate the speed challenge let's just see what this is response. text okay we do get the page are there any cookies on that page whoa yes there are cookie info that looks like the key info you should have followed busy nothing what does that mean when we go to this page I remember the challenge you live may help don't try all nothing oh right right right yeah you would click on this and it would take you to the same page with a get variable HTTP variable pass through nothing equals 1 2 3 4 5 and then you would just follow the chain I remember that so we should have followed it said busy nothing I wonder if busy nothing should equal that same 1 2 3 four five yep B okay oh whoa wait wait whoa B what what the heck is info B info equals B we're on the right page right if you came here from level four go back okay okay that makes sense because nothing should have been level should level four should have been nothing and this level level 17 should be busy nothing I guess you should follow the obvious chain the next busy nothing is 44827 okay but we had B with that what does that mean uh let's try and do this multiple times for I in range let just do it three times to see how far we can follow the chain I'm just going to set this as a placeholder busy nothing so I can replace out of it URL equals url. replace busy nothing with uh our next nothing so before we start looping let's have our next nothing equal this and we were able to get a nothing out of it right next nothing well hang on before we before we do all of this URL equals oh I have to remove all this indentation next busy nothing is that thing is that right so yeah we just have to split it was at the very it was at the very end right so let split and then let's get the last one let's just set that to next nothing because that's what we're using to Loop through it and let's just say info [Music] equals that responses cookies with info and let's try and loop through this now should be good oh oh oh oh yeah let's actually print that stuff out print next nothing next next nothing just to see what these variables are and let's replace next nothing in that text with info I added an i in there next nothing info B blah blah blah oh oh oh I'm sorry this should all be in our for Loop that's nothing B oh sweet we're getting data we're getting data let's do that 10 times o oh we're totally getting get let's do this forever see how much we can get let's go oh that's cool all right I'm gonna let this run and I'll let you know once it ends I'll pause this now okay I would think we'd be getting towards the end here oh yeah cool it finished um and last next nothing is it so that must be the end of it let's see what that last one was um let's try busy nothing equal equals that I said that's it okay okay but it does get one last value there so let's put all these into a thing let's say data [Music] equals an empty list and then let's do data. append the info and I know this this obviously just gave us an error so once we get that error we should know that we have finished so let's just put this in a try and accepting break once we're done and then we can print out data dot no no no we want to join this because it's an array now oh info cool no data data data is the list that we're working with I'm sorry guys I'm trying to think all right so now when we run this uh let's just keep it printing so we know what stuff is going on okay so now it's doing all stuff for us and once this is done we should have all of the data put together I'll pause this again and get back to you once it's done should be finishing up here real soon with all these uh percent signs I'm I'm I'm sure these are like URL encoded data okay yeah sweet so now we have our full data let's just call this data site and since we have all that to work with now we've accomplished we've gotten all the stuff that we need let's just commment out all this stuff cuz I don't think we'll need anymore now we just have this string whatever this is uh this looks to me with we see this bz here this looks admittedly like bzip data because that bz like file header that magic number you know the begins of the this this looks like compressed bz data but it has all these URL and coded stuff in it so let's actually get rid of those I can do this with URL lib URL lib and since this all came from a web Source right there might be percent sign 20 or like a plus sign in there like uh yeah yeah I see one right there I see a plus sign they're GNA URL lib is going to do that or like uh request is going to do that one it see like it's like joining characters so let's do Ur Li uh do unquote plus unquote we'll get rid of all of those percent encoded uh VAR like values for us and plus we'll remove that plus sign that's being weird and it'll properly encode that too uh data equals z to unode Plus data now we can print out that data oh and obviously since it's all actual data now yeah like with encoded stuff we are not going to be able to read all of it unless we take out the string representation of it so that's it right now we have bip data let's actually uncompress it let's import bz2 uh if you don't know the Syntax for this stuff you should be able to find it I'm just calling M decompressor and bz2 yeah you can just look at the uh documentation for this online bz2 decompressor it needs to create an object for itself and then uh decompressor do decompress and we can pass in that data string that we're working with now let's just say data again hopefully hopefully he's zal to that so let's data let's St that hopefully oh cool is it the 26th already what call his father and inform him that the flowers are on their way he'll what does that mean is it the 26th already call his father oh oh oh oh oh oh oh the 26th that's uh reference to the older challenge of the calendar thing right um um um um I had something on that didn't I I had a video on that one who is this evil oh no no no the calendar whom whom uh the very end I got Mozart right yeah yeah yeah yeah that was Mozart that was the last one call his father Mozart call Mozart's father who is Mozart's father Mozart's father Google Leopold Mozart okay he's dead obviously I can't really call him call his father call molart and tell him the flowers are on their way what oh call that was another that was another challenge that was uh who is this evil that was when we were looking at the phone stuff right yeah yeah yeah yeah yeah yeah yeah that was the phone one oh they must have his number it must have his number in the phone book oh what was that what was the Syntax for that xmlrpc lib the server name was that and then it just called you could yeah yeah yeah you could phone other people and get a phone number for them right let's try and do that idle import XML RPC lib cool um server was what was it in the video python challenge.com pcphone book. PHP it had to have that Python Challenge dot wait wait wait what was the Syntax for it server name client equals XML server proxy server proxy okay server proxy with that server name so oh oh what what oh oh it needs to have HTTP duh actually know that it's doing the thing do the thing on the internet Okay cool so now we have client and you used phone to phone people Leopold Mozart Leopold Mozart he is not damn it is it just his first name I remember in this one it was Bert it was like yeah yeah it was Bert that got us the actual uh got us his actual name so let's just use Leopold oh 555 violin is that it is that it I'm going to do it oh oh I moved this to the wrong monitor I've got two monitors going on right now it's pretty nice I remember violin oh no I mean yes what but stuff violin PHP okay so Parent Directory up stuff violin. PHP oh hello hello Mr Leopold Mozart hello there um what do you have to say to me you have nothing in your source code the title is It's me what do you want damn it um is it the 26 already call his father and inform him that the flowers are on their way he'll understand how do I do that I mean he is a web page right now uh I wonder if I can just send him that stuff oh you know what I wonder if I have to send him it as a cookie just like everything else is or has been in this freaking in this freaking challenge everything has been cookies that we just put out so yeah uh let's create a header info because that was everything else was a dictionary for our cookies and let's say what was it the flow are on the way okay they're FL the flowers are on their way so now so we don't need any of this stuff now but we can use what is that URL take hit URL now equals HTTP request let's just do a response requests I should bring this up for you get URL let's actually print that out see what we get if anything 200 what does that say Okay cool so we have the we have the web page we see leopo there it's me what do you want well I want to tell you the flowers are on their way let's pass in that cookies uh dictionary that we have here cookies equals cookies go oh well don't you dare to forget the balloons what what don't you dare to forget the balloons is that it is it just is it just balloons I'm G try that balloons what balloon balloon balloons damn it uh wait wait wait the stuff is different right CU we were on when we were on level 17 it was return what was it level 17's URL was payy no that's level four damn it it was uh death return right you see return uh romance HTML yeah okay cool cool that was level 17 it's got to be balloons w we found it we got it we win woo level 18 everybody damn that was really cool that was super cool I was referencing a bunch of different levels and looping through cookie data and sending our own cookie data decompressing bey2 junk oh that was awesome cool oh wow sweet finally level 18 guys h thanks for watching hope you enjoyed this one hope you're enjoying the Python Challenge video series and all the stuff that we've been doing here yeah oh man and my heart's like my heart feels good right now my heart St for a little bit now I just feel like good feels thanks again guys hope you're enjoying this uh if you are Maybe please uh please like maybe please leave me a comment uh ask me what else you want to see and uh if you're feeling generous maybe subscribe you know I love that thanks guys see you in the next tutorial
Watch on YouTube ↗
(saves to browser)
Sign in to unlock AI tutor explanation · ⚡30
Playlist
Uploads from John Hammond · John Hammond · 27 of 60
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
▶
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
Code Commentaries? PHP to JavaScript in Bash and PHP!
John Hammond
Tutorials? MySQL connection with PHP and Bash!
John Hammond
Variable Naming in Python! Happy Birthday, Linux! Nokia N900!
John Hammond
JavaScript Splits The URL!
John Hammond
HTML Tables in Python!
John Hammond
HTML, Net Shares, GML!
John Hammond
Python 08 Programming Style and Comments
John Hammond
Python 26 Object Oriented Programming
John Hammond
75 Python Tutorials, Out Now!
John Hammond
Batch 14 Mathematical Expressions
John Hammond
Batch 85 Array Append
John Hammond
Batch 86 Array Count
John Hammond
Batch 87 Array Index
John Hammond
Batch 88 Array Insert
John Hammond
Batch 89 Array Remove
John Hammond
Batch 90 Array Reverse
John Hammond
Python [colorama] 00 Installing on Linux
John Hammond
Python [colorama] 09 Cursor Position
John Hammond
Python [hashlib] 02 Algorithms
John Hammond
Python 00 Installing IDLE on Linux
John Hammond
Python [pygame] 11 Rectangular Collision Detection
John Hammond
Python [pygame] 12 Platforming Rectangular Collision Resolution
John Hammond
Python [XML-RPC] 01 Research
John Hammond
Python [pyenchant] 03 Personal Word Lists
John Hammond
FancyURLopener Authentication and User-Agent [urllib] 03
John Hammond
Python 04: PEP8 Coding
John Hammond
Python Challenge! 17 COOKIES
John Hammond
Google CTF 2016: Ernst Echidna
John Hammond
Google CTF 2016: Spotted Quoll
John Hammond
Google CTF 2016: Can you Repo It?
John Hammond
Google CTF 2016: No Big Deal
John Hammond
Google CTF 2016: In Recorded Conversation
John Hammond
Homemade CTF Challenge: 01 "Orchestra"
John Hammond
Homemade CTF Challenge: 02 "Bae's Base"
John Hammond
Homemade CTF Challenge: 03 "Web Hunt"
John Hammond
Homemade CTF Challenge: 04 "UPX"
John Hammond
Homemade CTF Challenge: 05 "The Assumption Song"
John Hammond
Homemade CTF Challenge: 06 "A Brisk Stroll"
John Hammond
Homemade CTF Challenge: 06 "I lost my password!"
John Hammond
web25 :: Mr. Robot : EKOPARTY CTF 2016
John Hammond
web50 : RFC 7230 :: EKOPARTY CTF 2016
John Hammond
misc50 : Hidden inside EKO :: EKOPARTY CTF 2016
John Hammond
Hack The Vote 2016 CTF: Sander's Fan Club [web100]
John Hammond
Hack The Vote 2016 CTF Warpspeed [forensics150]
John Hammond
Juniors CTF 2016 :: Black Suprematic Square
John Hammond
Juniors CTF 2016 :: Six Strange Tales
John Hammond
Juniors CTF 2016 :: Lost Code
John Hammond
Juniors CTF 2016 :: Here Goes!
John Hammond
Juniors CTF 2016 :: Southern Cross
John Hammond
Juniors CTF 2016 :: Clone Attack
John Hammond
Juniors CTF 2016 :: Dirty Repo
John Hammond
Juniors CTF 2016 :: Hackers Blog
John Hammond
Juniors CTF 2016 :: Voting!!!
John Hammond
Juniors CTF 2016 :: The Good, The Bad and The Junkman
John Hammond
Juniors CTF 2016 :: Stop Thief!
John Hammond
Juniors CTF 2016 :: ROFL
John Hammond
Juniors CTF 2016 :: Restriced Area
John Hammond
Juniors CTF 2016 :: Oh SSH!
John Hammond
HackCon CTF 2017 TRIVIA and BONUS Challenges
John Hammond
HackCon CTF 2017 "Bacche" Challenges
John Hammond
More on: Network Security
View skill →Related AI Lessons
⚡
⚡
⚡
⚡
Why Every Backend Developer Should Learn Nginx Before Going to Production
Medium · DevOps
Connecting Frontend to Backend: A Backend Engineer’s Reality Check
Medium · Programming
Build Secure Authentication System Using Access and Refresh Tokens
Medium · Python
5 PHP Features You're Probably Not Using (But Should)
Dev.to · Mahdyar
🎓
Tutor Explanation
DeepCamp AI