如何将特定的请求正文发送到端点（CTF Web）

Question

我有这个 ctf 问题，它给了我一个网站，每次我重新加载页面时都会随机给我一个励志名言，我还附加了这个 php 文件。

<?php

function random(int $length = 60): string
{
    $characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
    $randomString = '';

    for ($i = 0; $i < $length; $i++) {
        $randomString .= $characters[rand(0, strlen($characters) - 1)];
    }

    return $randomString;
}

function getQuote(): string
{
    $quotes = [
        "The only way to do great work is to love what you do.",
        "In three words I can sum up everything I've learned about life: it goes on.",
        "Success is not final, failure is not fatal: It is the courage to continue that counts.",
        "The best way to predict the future is to create it.",
        "Life is what happens when you're busy making other plans",
        "Do not wait to strike till the iron is hot, but make it hot by striking.",
        "Believe you can and you're halfway there.",
        "The only limit to our realization of tomorrow will be our doubts of today.",
        "The purpose of our lives is to be happy",
        "You miss 100% of the shots you don't take",
    ];

    $request_body = json_decode(file_get_contents('php://input'), true);

    if (isset($request_body['__']) && $request_body['__'] == hash('sha256', random() . time())) {
        return 'FLAG{fake-flag}';
    }

    return $quotes[rand(0, 9)];
}

getQuote();

我想我需要发送一个特定的请求正文，其中包含带有提供的方法的哈希值以及“__”，我尝试使用以下 python 代码：

import requests
import hashlib
import random
import time
import json


def randi(length=60):
    characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'
    random_string = ''.join(random.choice(characters) for _ in range(length))
    return random_string


def hash():
    random_value = randi()
    timestamp = str(int(time.time()))
    data_to_hash = random_value + timestamp

    sha256_hash = hashlib.sha256(data_to_hash.encode()).hexdigest()
    return sha256_hash

def request():
    url = "http://206.189.50.236:1337"
    generated_hash = hash()

    payload = {
        "__": generated_hash
    }

    headers = {
        "Content-Type": "application/json"
    }

    response = requests.post(url, data=json.dumps(payload), headers=headers)
    
    print("Response:")
    print(response.text)

request()

但没有任何效果

Answer 1

PHP rand() 图片来自 https://www.random.org/analysis/

从图中可以看出，PHP 的

rand()

函数生成循环伪随机序列，因此您可以尝试观察

return $quotes[rand(0, 9)];

的返回值，并预测

random()

函数的输出。
之后，你可以尝试找出什么字符串会通过

hash('sha256', random() . time()))

的条件，你就能解决它。