{"metadata":{"kernelspec":{"language":"python","display_name":"Python 3","name":"python3"},"language_info":{"pygments_lexer":"ipython3","nbconvert_exporter":"python","version":"3.6.4","file_extension":".py","codemirror_mode":{"name":"ipython","version":3},"name":"python","mimetype":"text/x-python"}},"nbformat_minor":4,"nbformat":4,"cells":[{"cell_type":"code","source":"import json\nimport requests\nimport base64\n\ninput = \"mFzaC==\" # {\"waf\": \"MALICIOUS REQUEST CAUGHT BY WAF\", \"output\": [[\"mFzaC\", 0.00952]]}\ninput = base64.b64encode(b\"bash\").decode()\n# https://en.wikipedia.org/wiki/Shellshock_(software_bug)\ninput = base64.b64encode(b\"env x='() { :;}; echo vulnerable' bash -c \\\"echo this is a test\\\"\").decode()\n\ndata = json.dumps(\n    {\"input\": input}\n)\n\ntry:\n    r = requests.post(\"https://waf.fly.dev/score\", data=data)\n    print(r.text)\nexcept requests.exceptions.ConnectionError:\n    print(\"Connection problems. Contact the CTF organizers.\")","metadata":{"execution":{"iopub.status.busy":"2022-09-04T21:42:59.387350Z","iopub.execute_input":"2022-09-04T21:42:59.387714Z","iopub.status.idle":"2022-09-04T21:42:59.560624Z","shell.execute_reply.started":"2022-09-04T21:42:59.387688Z","shell.execute_reply":"2022-09-04T21:42:59.559496Z"},"trusted":true},"execution_count":null,"outputs":[]}]}